commit d824b4e4afbe9cf02310e39b14402fb2aa271f8f
author Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Tue Mar 06 23:47:40 2018 -0800
committer GitHub <noreply@github.com> Tue Mar 06 23:47:40 2018 -0800
tree 171067fcbaee01eb008b5858cd18b719996f123c
parent c4d77a661138debbbe584b8b08410afc8719a9b1

bpo-32999: Fix ABC.__subclasscheck__ crash (GH-6002)

(cherry picked from commit fc7df0e664198cb05cafd972f190a18ca422989c)

Co-authored-by: INADA Naoki <methane@users.noreply.github.com>

Modules/_abc.c

diff --git a/Modules/_abc.c b/Modules/_abc.c
index 504e23d..8628839 100644
--- a/Modules/_abc.c
+++ b/Modules/_abc.c
@@ -16,6 +16,7 @@
 _Py_IDENTIFIER(__class__);
 _Py_IDENTIFIER(__dict__);
 _Py_IDENTIFIER(__bases__);
+_Py_IDENTIFIER(__mro__);
 _Py_IDENTIFIER(_abc_impl);
 _Py_IDENTIFIER(__subclasscheck__);
 _Py_IDENTIFIER(__subclasshook__);
@@ -568,7 +569,7 @@
                              PyObject *subclass)
 /*[clinic end generated code: output=b56c9e4a530e3894 input=1d947243409d10b8]*/
 {
-    PyObject *ok, *mro, *subclasses = NULL, *result = NULL;
+    PyObject *ok, *mro = NULL, *subclasses = NULL, *result = NULL;
     Py_ssize_t pos;
     int incache;
     _abc_data *impl = _get_impl(self);
@@ -637,20 +638,31 @@
     }
     Py_DECREF(ok);
 
-    /* 4. Check if it's a direct subclass. */
-    mro = ((PyTypeObject *)subclass)->tp_mro;
-    assert(PyTuple_Check(mro));
-    for (pos = 0; pos < PyTuple_GET_SIZE(mro); pos++) {
-        PyObject *mro_item = PyTuple_GET_ITEM(mro, pos);
-        if (mro_item == NULL) {
+    /* 4. Check if it's a direct subclass.
+     *
+     * if cls in getattr(subclass, '__mro__', ()):
+     *     cls._abc_cache.add(subclass)
+     *     return True
+     */
+    if (_PyObject_LookupAttrId(subclass, &PyId___mro__, &mro) < 0) {
+        goto end;
+    }
+    if (mro != NULL) {
+        if (!PyTuple_Check(mro)) {
+            // Python version supports non-tuple iterable.  Keep it as
+            // implementation detail.
+            PyErr_SetString(PyExc_TypeError, "__mro__ is not a tuple");
             goto end;
         }
-        if ((PyObject *)self == mro_item) {
-            if (_add_to_weak_set(&impl->_abc_cache, subclass) < 0) {
+        for (pos = 0; pos < PyTuple_GET_SIZE(mro); pos++) {
+            PyObject *mro_item = PyTuple_GET_ITEM(mro, pos);
+            if ((PyObject *)self == mro_item) {
+                if (_add_to_weak_set(&impl->_abc_cache, subclass) < 0) {
+                    goto end;
+                }
+                result = Py_True;
                 goto end;
             }
-            result = Py_True;
-            goto end;
         }
     }
 
@@ -690,7 +702,8 @@
     result = Py_False;
 
 end:
-    Py_XDECREF(impl);
+    Py_DECREF(impl);
+    Py_XDECREF(mro);
     Py_XDECREF(subclasses);
     Py_XINCREF(result);
     return result;