gh-151763: Fix double decref in _PyPegen_raise_error_known_location()

[manoj-marimuthu]

The following PR addresses OOM-00019 from issue-151763.

Issue:

The _PyPegen_raise_error_known_location() in pegen_errors.c uses the Py_BuildValue function on a PyObject* called error_line with reference-stealing N format.

tmp=Py_BuildValue("(OnnNnn)", p->tok->filename, lineno, col_number, error_line, end_lineno, end_col_number);

when Py_BuildValue fails it returns NULL (ie tmp becomes NULL). when tmp == NULL, we do:

if (!tmp) {
goto error;
}

and goto error does:

error:
Py_XDECREF(errstr);
Py_XDECREF(error_line);
returnNULL;

This means that even if Py_BuildValue has decref'd error_line already, goto error repeats it which in turn trips _Py_NegativeRefcount: on debug builds.

Reproduced using:

importast, _testcapi, faulthandlerfaulthandler.enable()
src="x y z\n"# generic invalid syntax -> located SyntaxError_testcapi.set_nomemory(55, 0) # fail every allocation from #55 onwardtry:
ast.parse(src) # error_line built OK, then Py_BuildValue fails# -> N-arg already consumed -> error: decrefs it againfinally:
_testcapi.remove_mem_hooks()

• In debug build (tested on windows), it gives:

_Py_NegativeRefcount: Assertionfailed: objecthasnegativerefcount<objectat000001FC999C04F0isfreed>FatalPythonerror: _PyObject_AssertFailed: _PyObject_AssertFailedPythonruntimestate: initializedobjectaddress : 000001FC9931C4B0objectrefcount : 1objecttype : 00007FF875688D10objecttypename: MemoryErrorobjectrepr : lostsys.stderrCurrentthread0x00003d48 (mostrecentcallfirst):
File"D:\open source\cpython\Lib\ast.py", line46inparseFile"D:\open source\cpython\PCBuild\amd64\reproducer.py", line6in<module>Extensionmodules: _testcapi (total: 1)

Fix

we can fix this by setting error_line to NULL just after tmp's declaration so that Py_XDECREF(error_line); neglects it when Py_BuildValue() fails.

error_line=NULL;

It now raises a MemoryError correctly.

Tested on - windows

branch - 3.16.0a0

• Issue: CPython crashes on memory-allocation failure (OOM): 35 findings (4 dups → 31 distinct) #151763