Repair refcounting on error return from type_set_bases.
Include a test case that failed for one of my efforts to repair this.
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 60c4fbc..2a7df8a 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -303,13 +303,16 @@
return r;
bail:
+ Py_DECREF(type->tp_bases);
+ Py_DECREF(type->tp_base);
+ if (type->tp_mro != old_mro) {
+ Py_DECREF(type->tp_mro);
+ }
+
type->tp_bases = old_bases;
type->tp_base = old_base;
type->tp_mro = old_mro;
- Py_DECREF(value);
- Py_DECREF(new_base);
-
return -1;
}