Crash with an evil custom mro() on a metaclass

[izbyshev]

Crash report

There is a path in type_mro_modified that results in double-free of *mro_meth:

• cpython/Objects/typeobject.c

  Line 362 in ad5e852

  Py_XDECREF(mro_meth);

• cpython/Objects/typeobject.c

  Line 371 in ad5e852

  goto clear;

A reproducer:

class B:
    pass

class M(type):
    def mro(cls):
        del M.mro
        return (B,)

class C(metaclass=M):
    pass

Crash with the debug CPython:

$ ./python mro-crasher.py
/home/test/cpython/Include/object.h:601: _Py_NegativeRefcount: Assertion failed: object has negative ref count
<object at 0x7f88c12d1a90 is freed>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized

Current thread 0x00007f88c13cb080 (most recent call first):
  File "/home/test/mro-crasher.py", line 9 in <module>
Aborted (core dumped)

This bug was introduced in #73052.

[izbyshev]

I'll open a PR shortly.

[izbyshev]

Opened #92113. @JulienPalard

[JulienPalard]

Fixed by @izbyshev in #92113 (Thank you!).

[ctismer]

@izbyshev Thanks a lot for fixing this! We had problems with PySide and type creation and did a crude work-around.
The error is gone since Python 3.9.13.
Unfortunately, the same error is still in Python 3.8 (which we hopefully deprecate soon).
Is it ok if I re-open it?

[JelleZijlstra]

3.8 is in security fix-only mode, so we probably won't fix this.

[ctismer]

Ok, I understand. Closing the issue, again. Thanks