bpo-46561: Ensure operands to __get__ survive the call

[tekknolagi]

Callees can assume their parameters survive for the entire call. This
violates that assumption and can cause a use-after-free.

https://bugs.python.org/issue46561

[markshannon]

The changes look good, could you add some test cases?

[tekknolagi]

I am working on making a C-API equivalent for your sample Python test code. Unfortunately, it is not so easy as making a C extension class with Py_tp_descr_get because that path appears to do the right thing. So instead I have to make a class which has something (a function or C extension callable) with a tp_vectorcall for __get__.

[tekknolagi]

Lol, did this finally bite someone else?

[serhiy-storchaka]

I am on a mission to review old PRs that were not reviewed by anybody.

LGTM, but please fix the NEWS entry (and its text is not very clear, it could be improved). It would be nice to add tests, but if it is too complicated, it is not necessary.

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[github-actions]

This PR is stale because it has been open for 30 days with no activity.

[serhiy-storchaka]

@tekknolagi, please sign the CLA. This is needed to merge this PR.

[serhiy-storchaka]

Well, it was fixed by GH-118454.

[tekknolagi]

I feel like I've signed the CLA like 3 times. I'll sign it again if needed. But also, I'm not sure if Dino's patch does address it? It looks like a SETREF after the call.

[tekknolagi]

Oh. I had signed the old CLA. I signed the new one.

[serhiy-storchaka]

Thank you. That bug has been fixed in other PR after I approved this PR and before I have opportunity to return to it (and I didn't because you didn't update the entry in the NEWS section). But this will help with your other PRs.

[serhiy-storchaka]

I'm not sure if Dino's patch does address it? It looks like a SETREF after the call.

Before your patch, descr and res were borrowed references (returned by _PyType_Lookup()). You added Py_INCREF to make it a strong reference. Now we use _PyType_LookupRef() which returns a strong reference, so that Py_INCREF no longer needed. Py_SETREF is equivalent to Py_DECREF and assignment in right order. So these changes were equivalent.