bpo-44483: Fix crash in union object with bad ``__module__`` (GH-26848) (GH-26852)
(cherry picked from commit adfa1ba398c74720b42f16f06fd3ec0353599fa5)
Co-authored-by: Ken Jin <28750310+Fidget-Spinner@users.noreply.github.com>
diff --git a/Lib/test/test_types.py b/Lib/test/test_types.py
index 767c3d0..d3e315a 100644
--- a/Lib/test/test_types.py
+++ b/Lib/test/test_types.py
@@ -747,6 +747,15 @@ def __eq__(self, other):
with self.assertRaises(TypeError):
issubclass(list, type_)
+ def test_or_type_operator_with_bad_module(self):
+ class TypeVar:
+ @property
+ def __module__(self):
+ 1 / 0
+ # Crashes in Issue44483
+ with self.assertRaises(ZeroDivisionError):
+ str | TypeVar()
+
def test_ellipsis_type(self):
self.assertIsInstance(Ellipsis, types.EllipsisType)
diff --git a/Misc/NEWS.d/next/Core and Builtins/2021-06-22-19-08-19.bpo-44483.eq2f7T.rst b/Misc/NEWS.d/next/Core and Builtins/2021-06-22-19-08-19.bpo-44483.eq2f7T.rst
new file mode 100644
index 0000000..ea54e79
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2021-06-22-19-08-19.bpo-44483.eq2f7T.rst
@@ -0,0 +1,2 @@
+Fix a crash in ``types.Union`` objects when creating a union of an object
+with bad ``__module__`` field.
diff --git a/Objects/unionobject.c b/Objects/unionobject.c
index 0535036..a66d615 100644
--- a/Objects/unionobject.c
+++ b/Objects/unionobject.c
@@ -284,6 +284,16 @@ is_new_type(PyObject *obj)
return is_typing_module(obj);
}
+// Emulates short-circuiting behavior of the ``||`` operator
+// while also checking negative values.
+#define CHECK_RES(res) { \
+ int result = res; \
+ if (result) { \
+ return result; \
+ } \
+}
+
+// Returns 1 on true, 0 on false, and -1 on error.
static int
is_unionable(PyObject *obj)
{
@@ -291,10 +301,11 @@ is_unionable(PyObject *obj)
return 1;
}
PyTypeObject *type = Py_TYPE(obj);
+ CHECK_RES(is_typevar(obj));
+ CHECK_RES(is_new_type(obj));
+ CHECK_RES(is_special_form(obj));
return (
- is_typevar(obj) ||
- is_new_type(obj) ||
- is_special_form(obj) ||
+ // The following checks never fail.
PyType_Check(obj) ||
PyObject_TypeCheck(obj, &Py_GenericAliasType) ||
type == &_Py_UnionType);