UAF in `Element.findtext()` when tag `__eq__` mutates parent

[StanFromIreland]

Crash report

What happened?

Similar to #126037.

from xml.etree.ElementTree import Element, SubElement

class T(str):
 def __eq__(self, other):
 root.clear()
 return True

root = Element('a')
SubElement(root, T('a')).text = str(object())
repr(root.findtext('a'))

Under UBSan results in:

Objects/object.c:766:19: runtime error: member access within misaligned address 0xdddddddddddddddd for type 'struct PyTypeObject', which requires 8 byte alignment
0xdddddddddddddddd: note: pointer points here
<memory cannot be printed>
Segmentation fault (core dumped)

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-148735: Fix a UAF in Element.findtext() #148738
• [3.14] gh-148735: Fix a UAF in Element.findtext() (GH-148738) #148916
• [3.13] gh-148735: Fix a UAF in Element.findtext() (GH-148738) #148923