1 /* Type object implementation */
2 
3 #include "Python.h"
4 #include "pycore_object.h"
5 #include "pycore_pystate.h"
6 #include "frameobject.h"
7 #include "structmember.h"
8 
9 #include <ctype.h>
10 
11 /*[clinic input]
12 class type "PyTypeObject *" "&PyType_Type"
13 class object "PyObject *" "&PyBaseObject_Type"
14 [clinic start generated code]*/
15 /*[clinic end generated code: output=da39a3ee5e6b4b0d input=4b94608d231c434b]*/
16 
17 #include "clinic/typeobject.c.h"
18 
19 /* Support type attribute cache */
20 
21 /* The cache can keep references to the names alive for longer than
22    they normally would.  This is why the maximum size is limited to
23    MCACHE_MAX_ATTR_SIZE, since it might be a problem if very large
24    strings are used as attribute names. */
25 #define MCACHE_MAX_ATTR_SIZE    100
26 #define MCACHE_SIZE_EXP         12
27 #define MCACHE_HASH(version, name_hash)                                 \
28         (((unsigned int)(version) ^ (unsigned int)(name_hash))          \
29          & ((1 << MCACHE_SIZE_EXP) - 1))
30 
31 #define MCACHE_HASH_METHOD(type, name)                                  \
32         MCACHE_HASH((type)->tp_version_tag,                     \
33                     ((PyASCIIObject *)(name))->hash)
34 #define MCACHE_CACHEABLE_NAME(name)                             \
35         PyUnicode_CheckExact(name) &&                           \
36         PyUnicode_IS_READY(name) &&                             \
37         PyUnicode_GET_LENGTH(name) <= MCACHE_MAX_ATTR_SIZE
38 
39 struct method_cache_entry {
40     unsigned int version;
41     PyObject *name;             /* reference to exactly a str or None */
42     PyObject *value;            /* borrowed */
43 };
44 
45 static struct method_cache_entry method_cache[1 << MCACHE_SIZE_EXP];
46 static unsigned int next_version_tag = 0;
47 
48 #define MCACHE_STATS 0
49 
50 #if MCACHE_STATS
51 static size_t method_cache_hits = 0;
52 static size_t method_cache_misses = 0;
53 static size_t method_cache_collisions = 0;
54 #endif
55 
56 /* alphabetical order */
57 _Py_IDENTIFIER(__abstractmethods__);
58 _Py_IDENTIFIER(__class__);
59 _Py_IDENTIFIER(__class_getitem__);
60 _Py_IDENTIFIER(__delitem__);
61 _Py_IDENTIFIER(__dict__);
62 _Py_IDENTIFIER(__doc__);
63 _Py_IDENTIFIER(__getattribute__);
64 _Py_IDENTIFIER(__getitem__);
65 _Py_IDENTIFIER(__hash__);
66 _Py_IDENTIFIER(__init_subclass__);
67 _Py_IDENTIFIER(__len__);
68 _Py_IDENTIFIER(__module__);
69 _Py_IDENTIFIER(__name__);
70 _Py_IDENTIFIER(__new__);
71 _Py_IDENTIFIER(__set_name__);
72 _Py_IDENTIFIER(__setitem__);
73 _Py_IDENTIFIER(builtins);
74 
75 static PyObject *
76 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
77 
78 static void
79 clear_slotdefs(void);
80 
81 static PyObject *
82 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound);
83 
84 static int
85 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value);
86 
87 /*
88  * finds the beginning of the docstring's introspection signature.
89  * if present, returns a pointer pointing to the first '('.
90  * otherwise returns NULL.
91  *
92  * doesn't guarantee that the signature is valid, only that it
93  * has a valid prefix.  (the signature must also pass skip_signature.)
94  */
95 static const char *
find_signature(const char * name,const char * doc)96 find_signature(const char *name, const char *doc)
97 {
98     const char *dot;
99     size_t length;
100 
101     if (!doc)
102         return NULL;
103 
104     assert(name != NULL);
105 
106     /* for dotted names like classes, only use the last component */
107     dot = strrchr(name, '.');
108     if (dot)
109         name = dot + 1;
110 
111     length = strlen(name);
112     if (strncmp(doc, name, length))
113         return NULL;
114     doc += length;
115     if (*doc != '(')
116         return NULL;
117     return doc;
118 }
119 
120 #define SIGNATURE_END_MARKER         ")\n--\n\n"
121 #define SIGNATURE_END_MARKER_LENGTH  6
122 /*
123  * skips past the end of the docstring's introspection signature.
124  * (assumes doc starts with a valid signature prefix.)
125  */
126 static const char *
skip_signature(const char * doc)127 skip_signature(const char *doc)
128 {
129     while (*doc) {
130         if ((*doc == *SIGNATURE_END_MARKER) &&
131             !strncmp(doc, SIGNATURE_END_MARKER, SIGNATURE_END_MARKER_LENGTH))
132             return doc + SIGNATURE_END_MARKER_LENGTH;
133         if ((*doc == '\n') && (doc[1] == '\n'))
134             return NULL;
135         doc++;
136     }
137     return NULL;
138 }
139 
140 int
_PyType_CheckConsistency(PyTypeObject * type)141 _PyType_CheckConsistency(PyTypeObject *type)
142 {
143 #define CHECK(expr) \
144     do { if (!(expr)) { _PyObject_ASSERT_FAILED_MSG((PyObject *)type, Py_STRINGIFY(expr)); } } while (0)
145 
146     CHECK(!_PyObject_IsFreed((PyObject *)type));
147 
148     if (!(type->tp_flags & Py_TPFLAGS_READY)) {
149         /* don't check static types before PyType_Ready() */
150         return 1;
151     }
152 
153     CHECK(Py_REFCNT(type) >= 1);
154     CHECK(PyType_Check(type));
155 
156     CHECK(!(type->tp_flags & Py_TPFLAGS_READYING));
157     CHECK(type->tp_dict != NULL);
158 
159     return 1;
160 #undef CHECK
161 }
162 
163 static const char *
_PyType_DocWithoutSignature(const char * name,const char * internal_doc)164 _PyType_DocWithoutSignature(const char *name, const char *internal_doc)
165 {
166     const char *doc = find_signature(name, internal_doc);
167 
168     if (doc) {
169         doc = skip_signature(doc);
170         if (doc)
171             return doc;
172         }
173     return internal_doc;
174 }
175 
176 PyObject *
_PyType_GetDocFromInternalDoc(const char * name,const char * internal_doc)177 _PyType_GetDocFromInternalDoc(const char *name, const char *internal_doc)
178 {
179     const char *doc = _PyType_DocWithoutSignature(name, internal_doc);
180 
181     if (!doc || *doc == '\0') {
182         Py_RETURN_NONE;
183     }
184 
185     return PyUnicode_FromString(doc);
186 }
187 
188 PyObject *
_PyType_GetTextSignatureFromInternalDoc(const char * name,const char * internal_doc)189 _PyType_GetTextSignatureFromInternalDoc(const char *name, const char *internal_doc)
190 {
191     const char *start = find_signature(name, internal_doc);
192     const char *end;
193 
194     if (start)
195         end = skip_signature(start);
196     else
197         end = NULL;
198     if (!end) {
199         Py_RETURN_NONE;
200     }
201 
202     /* back "end" up until it points just past the final ')' */
203     end -= SIGNATURE_END_MARKER_LENGTH - 1;
204     assert((end - start) >= 2); /* should be "()" at least */
205     assert(end[-1] == ')');
206     assert(end[0] == '\n');
207     return PyUnicode_FromStringAndSize(start, end - start);
208 }
209 
210 unsigned int
PyType_ClearCache(void)211 PyType_ClearCache(void)
212 {
213     Py_ssize_t i;
214     unsigned int cur_version_tag = next_version_tag - 1;
215 
216 #if MCACHE_STATS
217     size_t total = method_cache_hits + method_cache_collisions + method_cache_misses;
218     fprintf(stderr, "-- Method cache hits        = %zd (%d%%)\n",
219             method_cache_hits, (int) (100.0 * method_cache_hits / total));
220     fprintf(stderr, "-- Method cache true misses = %zd (%d%%)\n",
221             method_cache_misses, (int) (100.0 * method_cache_misses / total));
222     fprintf(stderr, "-- Method cache collisions  = %zd (%d%%)\n",
223             method_cache_collisions, (int) (100.0 * method_cache_collisions / total));
224     fprintf(stderr, "-- Method cache size        = %zd KiB\n",
225             sizeof(method_cache) / 1024);
226 #endif
227 
228     for (i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
229         method_cache[i].version = 0;
230         Py_CLEAR(method_cache[i].name);
231         method_cache[i].value = NULL;
232     }
233     next_version_tag = 0;
234     /* mark all version tags as invalid */
235     PyType_Modified(&PyBaseObject_Type);
236     return cur_version_tag;
237 }
238 
239 void
_PyType_Fini(void)240 _PyType_Fini(void)
241 {
242     PyType_ClearCache();
243     clear_slotdefs();
244 }
245 
246 void
PyType_Modified(PyTypeObject * type)247 PyType_Modified(PyTypeObject *type)
248 {
249     /* Invalidate any cached data for the specified type and all
250        subclasses.  This function is called after the base
251        classes, mro, or attributes of the type are altered.
252 
253        Invariants:
254 
255        - Py_TPFLAGS_VALID_VERSION_TAG is never set if
256          Py_TPFLAGS_HAVE_VERSION_TAG is not set (in case of a
257          bizarre MRO, see type_mro_modified()).
258 
259        - before Py_TPFLAGS_VALID_VERSION_TAG can be set on a type,
260          it must first be set on all super types.
261 
262        This function clears the Py_TPFLAGS_VALID_VERSION_TAG of a
263        type (so it must first clear it on all subclasses).  The
264        tp_version_tag value is meaningless unless this flag is set.
265        We don't assign new version tags eagerly, but only as
266        needed.
267      */
268     PyObject *raw, *ref;
269     Py_ssize_t i;
270 
271     if (!PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
272         return;
273 
274     raw = type->tp_subclasses;
275     if (raw != NULL) {
276         assert(PyDict_CheckExact(raw));
277         i = 0;
278         while (PyDict_Next(raw, &i, NULL, &ref)) {
279             assert(PyWeakref_CheckRef(ref));
280             ref = PyWeakref_GET_OBJECT(ref);
281             if (ref != Py_None) {
282                 PyType_Modified((PyTypeObject *)ref);
283             }
284         }
285     }
286     type->tp_flags &= ~Py_TPFLAGS_VALID_VERSION_TAG;
287 }
288 
289 static void
type_mro_modified(PyTypeObject * type,PyObject * bases)290 type_mro_modified(PyTypeObject *type, PyObject *bases) {
291     /*
292        Check that all base classes or elements of the MRO of type are
293        able to be cached.  This function is called after the base
294        classes or mro of the type are altered.
295 
296        Unset HAVE_VERSION_TAG and VALID_VERSION_TAG if the type
297        has a custom MRO that includes a type which is not officially
298        super type, or if the type implements its own mro() method.
299 
300        Called from mro_internal, which will subsequently be called on
301        each subclass when their mro is recursively updated.
302      */
303     Py_ssize_t i, n;
304     int custom = (Py_TYPE(type) != &PyType_Type);
305     int unbound;
306     PyObject *mro_meth = NULL;
307     PyObject *type_mro_meth = NULL;
308 
309     if (!PyType_HasFeature(type, Py_TPFLAGS_HAVE_VERSION_TAG))
310         return;
311 
312     if (custom) {
313         _Py_IDENTIFIER(mro);
314         mro_meth = lookup_maybe_method(
315             (PyObject *)type, &PyId_mro, &unbound);
316         if (mro_meth == NULL)
317             goto clear;
318         type_mro_meth = lookup_maybe_method(
319             (PyObject *)&PyType_Type, &PyId_mro, &unbound);
320         if (type_mro_meth == NULL)
321             goto clear;
322         if (mro_meth != type_mro_meth)
323             goto clear;
324         Py_XDECREF(mro_meth);
325         Py_XDECREF(type_mro_meth);
326     }
327     n = PyTuple_GET_SIZE(bases);
328     for (i = 0; i < n; i++) {
329         PyObject *b = PyTuple_GET_ITEM(bases, i);
330         PyTypeObject *cls;
331 
332         assert(PyType_Check(b));
333         cls = (PyTypeObject *)b;
334 
335         if (!PyType_HasFeature(cls, Py_TPFLAGS_HAVE_VERSION_TAG) ||
336             !PyType_IsSubtype(type, cls)) {
337             goto clear;
338         }
339     }
340     return;
341  clear:
342     Py_XDECREF(mro_meth);
343     Py_XDECREF(type_mro_meth);
344     type->tp_flags &= ~(Py_TPFLAGS_HAVE_VERSION_TAG|
345                         Py_TPFLAGS_VALID_VERSION_TAG);
346 }
347 
348 static int
assign_version_tag(PyTypeObject * type)349 assign_version_tag(PyTypeObject *type)
350 {
351     /* Ensure that the tp_version_tag is valid and set
352        Py_TPFLAGS_VALID_VERSION_TAG.  To respect the invariant, this
353        must first be done on all super classes.  Return 0 if this
354        cannot be done, 1 if Py_TPFLAGS_VALID_VERSION_TAG.
355     */
356     Py_ssize_t i, n;
357     PyObject *bases;
358 
359     if (PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
360         return 1;
361     if (!PyType_HasFeature(type, Py_TPFLAGS_HAVE_VERSION_TAG))
362         return 0;
363     if (!PyType_HasFeature(type, Py_TPFLAGS_READY))
364         return 0;
365 
366     type->tp_version_tag = next_version_tag++;
367     /* for stress-testing: next_version_tag &= 0xFF; */
368 
369     if (type->tp_version_tag == 0) {
370         /* wrap-around or just starting Python - clear the whole
371            cache by filling names with references to Py_None.
372            Values are also set to NULL for added protection, as they
373            are borrowed reference */
374         for (i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
375             method_cache[i].value = NULL;
376             Py_INCREF(Py_None);
377             Py_XSETREF(method_cache[i].name, Py_None);
378         }
379         /* mark all version tags as invalid */
380         PyType_Modified(&PyBaseObject_Type);
381         return 1;
382     }
383     bases = type->tp_bases;
384     n = PyTuple_GET_SIZE(bases);
385     for (i = 0; i < n; i++) {
386         PyObject *b = PyTuple_GET_ITEM(bases, i);
387         assert(PyType_Check(b));
388         if (!assign_version_tag((PyTypeObject *)b))
389             return 0;
390     }
391     type->tp_flags |= Py_TPFLAGS_VALID_VERSION_TAG;
392     return 1;
393 }
394 
395 
396 static PyMemberDef type_members[] = {
397     {"__basicsize__", T_PYSSIZET, offsetof(PyTypeObject,tp_basicsize),READONLY},
398     {"__itemsize__", T_PYSSIZET, offsetof(PyTypeObject, tp_itemsize), READONLY},
399     {"__flags__", T_ULONG, offsetof(PyTypeObject, tp_flags), READONLY},
400     {"__weakrefoffset__", T_PYSSIZET,
401      offsetof(PyTypeObject, tp_weaklistoffset), READONLY},
402     {"__base__", T_OBJECT, offsetof(PyTypeObject, tp_base), READONLY},
403     {"__dictoffset__", T_PYSSIZET,
404      offsetof(PyTypeObject, tp_dictoffset), READONLY},
405     {"__mro__", T_OBJECT, offsetof(PyTypeObject, tp_mro), READONLY},
406     {0}
407 };
408 
409 static int
check_set_special_type_attr(PyTypeObject * type,PyObject * value,const char * name)410 check_set_special_type_attr(PyTypeObject *type, PyObject *value, const char *name)
411 {
412     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
413         PyErr_Format(PyExc_TypeError,
414                      "can't set %s.%s", type->tp_name, name);
415         return 0;
416     }
417     if (!value) {
418         PyErr_Format(PyExc_TypeError,
419                      "can't delete %s.%s", type->tp_name, name);
420         return 0;
421     }
422 
423     if (PySys_Audit("object.__setattr__", "OsO",
424                     type, name, value) < 0) {
425         return 0;
426     }
427 
428     return 1;
429 }
430 
431 const char *
_PyType_Name(PyTypeObject * type)432 _PyType_Name(PyTypeObject *type)
433 {
434     const char *s = strrchr(type->tp_name, '.');
435     if (s == NULL) {
436         s = type->tp_name;
437     }
438     else {
439         s++;
440     }
441     return s;
442 }
443 
444 static PyObject *
type_name(PyTypeObject * type,void * context)445 type_name(PyTypeObject *type, void *context)
446 {
447     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
448         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
449 
450         Py_INCREF(et->ht_name);
451         return et->ht_name;
452     }
453     else {
454         return PyUnicode_FromString(_PyType_Name(type));
455     }
456 }
457 
458 static PyObject *
type_qualname(PyTypeObject * type,void * context)459 type_qualname(PyTypeObject *type, void *context)
460 {
461     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
462         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
463         Py_INCREF(et->ht_qualname);
464         return et->ht_qualname;
465     }
466     else {
467         return PyUnicode_FromString(_PyType_Name(type));
468     }
469 }
470 
471 static int
type_set_name(PyTypeObject * type,PyObject * value,void * context)472 type_set_name(PyTypeObject *type, PyObject *value, void *context)
473 {
474     const char *tp_name;
475     Py_ssize_t name_size;
476 
477     if (!check_set_special_type_attr(type, value, "__name__"))
478         return -1;
479     if (!PyUnicode_Check(value)) {
480         PyErr_Format(PyExc_TypeError,
481                      "can only assign string to %s.__name__, not '%s'",
482                      type->tp_name, Py_TYPE(value)->tp_name);
483         return -1;
484     }
485 
486     tp_name = PyUnicode_AsUTF8AndSize(value, &name_size);
487     if (tp_name == NULL)
488         return -1;
489     if (strlen(tp_name) != (size_t)name_size) {
490         PyErr_SetString(PyExc_ValueError,
491                         "type name must not contain null characters");
492         return -1;
493     }
494 
495     type->tp_name = tp_name;
496     Py_INCREF(value);
497     Py_SETREF(((PyHeapTypeObject*)type)->ht_name, value);
498 
499     return 0;
500 }
501 
502 static int
type_set_qualname(PyTypeObject * type,PyObject * value,void * context)503 type_set_qualname(PyTypeObject *type, PyObject *value, void *context)
504 {
505     PyHeapTypeObject* et;
506 
507     if (!check_set_special_type_attr(type, value, "__qualname__"))
508         return -1;
509     if (!PyUnicode_Check(value)) {
510         PyErr_Format(PyExc_TypeError,
511                      "can only assign string to %s.__qualname__, not '%s'",
512                      type->tp_name, Py_TYPE(value)->tp_name);
513         return -1;
514     }
515 
516     et = (PyHeapTypeObject*)type;
517     Py_INCREF(value);
518     Py_SETREF(et->ht_qualname, value);
519     return 0;
520 }
521 
522 static PyObject *
type_module(PyTypeObject * type,void * context)523 type_module(PyTypeObject *type, void *context)
524 {
525     PyObject *mod;
526 
527     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
528         mod = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___module__);
529         if (mod == NULL) {
530             if (!PyErr_Occurred()) {
531                 PyErr_Format(PyExc_AttributeError, "__module__");
532             }
533             return NULL;
534         }
535         Py_INCREF(mod);
536     }
537     else {
538         const char *s = strrchr(type->tp_name, '.');
539         if (s != NULL) {
540             mod = PyUnicode_FromStringAndSize(
541                 type->tp_name, (Py_ssize_t)(s - type->tp_name));
542             if (mod != NULL)
543                 PyUnicode_InternInPlace(&mod);
544         }
545         else {
546             mod = _PyUnicode_FromId(&PyId_builtins);
547             Py_XINCREF(mod);
548         }
549     }
550     return mod;
551 }
552 
553 static int
type_set_module(PyTypeObject * type,PyObject * value,void * context)554 type_set_module(PyTypeObject *type, PyObject *value, void *context)
555 {
556     if (!check_set_special_type_attr(type, value, "__module__"))
557         return -1;
558 
559     PyType_Modified(type);
560 
561     return _PyDict_SetItemId(type->tp_dict, &PyId___module__, value);
562 }
563 
564 static PyObject *
type_abstractmethods(PyTypeObject * type,void * context)565 type_abstractmethods(PyTypeObject *type, void *context)
566 {
567     PyObject *mod = NULL;
568     /* type itself has an __abstractmethods__ descriptor (this). Don't return
569        that. */
570     if (type != &PyType_Type)
571         mod = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___abstractmethods__);
572     if (!mod) {
573         if (!PyErr_Occurred()) {
574             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
575             if (message)
576                 PyErr_SetObject(PyExc_AttributeError, message);
577         }
578         return NULL;
579     }
580     Py_INCREF(mod);
581     return mod;
582 }
583 
584 static int
type_set_abstractmethods(PyTypeObject * type,PyObject * value,void * context)585 type_set_abstractmethods(PyTypeObject *type, PyObject *value, void *context)
586 {
587     /* __abstractmethods__ should only be set once on a type, in
588        abc.ABCMeta.__new__, so this function doesn't do anything
589        special to update subclasses.
590     */
591     int abstract, res;
592     if (value != NULL) {
593         abstract = PyObject_IsTrue(value);
594         if (abstract < 0)
595             return -1;
596         res = _PyDict_SetItemId(type->tp_dict, &PyId___abstractmethods__, value);
597     }
598     else {
599         abstract = 0;
600         res = _PyDict_DelItemId(type->tp_dict, &PyId___abstractmethods__);
601         if (res && PyErr_ExceptionMatches(PyExc_KeyError)) {
602             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
603             if (message)
604                 PyErr_SetObject(PyExc_AttributeError, message);
605             return -1;
606         }
607     }
608     if (res == 0) {
609         PyType_Modified(type);
610         if (abstract)
611             type->tp_flags |= Py_TPFLAGS_IS_ABSTRACT;
612         else
613             type->tp_flags &= ~Py_TPFLAGS_IS_ABSTRACT;
614     }
615     return res;
616 }
617 
618 static PyObject *
type_get_bases(PyTypeObject * type,void * context)619 type_get_bases(PyTypeObject *type, void *context)
620 {
621     Py_INCREF(type->tp_bases);
622     return type->tp_bases;
623 }
624 
625 static PyTypeObject *best_base(PyObject *);
626 static int mro_internal(PyTypeObject *, PyObject **);
627 static int type_is_subtype_base_chain(PyTypeObject *, PyTypeObject *);
628 static int compatible_for_assignment(PyTypeObject *, PyTypeObject *, const char *);
629 static int add_subclass(PyTypeObject*, PyTypeObject*);
630 static int add_all_subclasses(PyTypeObject *type, PyObject *bases);
631 static void remove_subclass(PyTypeObject *, PyTypeObject *);
632 static void remove_all_subclasses(PyTypeObject *type, PyObject *bases);
633 static void update_all_slots(PyTypeObject *);
634 
635 typedef int (*update_callback)(PyTypeObject *, void *);
636 static int update_subclasses(PyTypeObject *type, PyObject *name,
637                              update_callback callback, void *data);
638 static int recurse_down_subclasses(PyTypeObject *type, PyObject *name,
639                                    update_callback callback, void *data);
640 
641 static int
mro_hierarchy(PyTypeObject * type,PyObject * temp)642 mro_hierarchy(PyTypeObject *type, PyObject *temp)
643 {
644     int res;
645     PyObject *new_mro, *old_mro;
646     PyObject *tuple;
647     PyObject *subclasses;
648     Py_ssize_t i, n;
649 
650     res = mro_internal(type, &old_mro);
651     if (res <= 0)
652         /* error / reentrance */
653         return res;
654     new_mro = type->tp_mro;
655 
656     if (old_mro != NULL)
657         tuple = PyTuple_Pack(3, type, new_mro, old_mro);
658     else
659         tuple = PyTuple_Pack(2, type, new_mro);
660 
661     if (tuple != NULL)
662         res = PyList_Append(temp, tuple);
663     else
664         res = -1;
665     Py_XDECREF(tuple);
666 
667     if (res < 0) {
668         type->tp_mro = old_mro;
669         Py_DECREF(new_mro);
670         return -1;
671     }
672     Py_XDECREF(old_mro);
673 
674     /* Obtain a copy of subclasses list to iterate over.
675 
676        Otherwise type->tp_subclasses might be altered
677        in the middle of the loop, for example, through a custom mro(),
678        by invoking type_set_bases on some subclass of the type
679        which in turn calls remove_subclass/add_subclass on this type.
680 
681        Finally, this makes things simple avoiding the need to deal
682        with dictionary iterators and weak references.
683     */
684     subclasses = type___subclasses___impl(type);
685     if (subclasses == NULL)
686         return -1;
687     n = PyList_GET_SIZE(subclasses);
688     for (i = 0; i < n; i++) {
689         PyTypeObject *subclass;
690         subclass = (PyTypeObject *)PyList_GET_ITEM(subclasses, i);
691         res = mro_hierarchy(subclass, temp);
692         if (res < 0)
693             break;
694     }
695     Py_DECREF(subclasses);
696 
697     return res;
698 }
699 
700 static int
type_set_bases(PyTypeObject * type,PyObject * new_bases,void * context)701 type_set_bases(PyTypeObject *type, PyObject *new_bases, void *context)
702 {
703     int res = 0;
704     PyObject *temp;
705     PyObject *old_bases;
706     PyTypeObject *new_base, *old_base;
707     Py_ssize_t i;
708 
709     if (!check_set_special_type_attr(type, new_bases, "__bases__"))
710         return -1;
711     if (!PyTuple_Check(new_bases)) {
712         PyErr_Format(PyExc_TypeError,
713              "can only assign tuple to %s.__bases__, not %s",
714                  type->tp_name, Py_TYPE(new_bases)->tp_name);
715         return -1;
716     }
717     if (PyTuple_GET_SIZE(new_bases) == 0) {
718         PyErr_Format(PyExc_TypeError,
719              "can only assign non-empty tuple to %s.__bases__, not ()",
720                  type->tp_name);
721         return -1;
722     }
723     for (i = 0; i < PyTuple_GET_SIZE(new_bases); i++) {
724         PyObject *ob;
725         PyTypeObject *base;
726 
727         ob = PyTuple_GET_ITEM(new_bases, i);
728         if (!PyType_Check(ob)) {
729             PyErr_Format(PyExc_TypeError,
730                          "%s.__bases__ must be tuple of classes, not '%s'",
731                          type->tp_name, Py_TYPE(ob)->tp_name);
732             return -1;
733         }
734 
735         base = (PyTypeObject*)ob;
736         if (PyType_IsSubtype(base, type) ||
737             /* In case of reentering here again through a custom mro()
738                the above check is not enough since it relies on
739                base->tp_mro which would gonna be updated inside
740                mro_internal only upon returning from the mro().
741 
742                However, base->tp_base has already been assigned (see
743                below), which in turn may cause an inheritance cycle
744                through tp_base chain.  And this is definitely
745                not what you want to ever happen.  */
746             (base->tp_mro != NULL && type_is_subtype_base_chain(base, type))) {
747 
748             PyErr_SetString(PyExc_TypeError,
749                             "a __bases__ item causes an inheritance cycle");
750             return -1;
751         }
752     }
753 
754     new_base = best_base(new_bases);
755     if (new_base == NULL)
756         return -1;
757 
758     if (!compatible_for_assignment(type->tp_base, new_base, "__bases__"))
759         return -1;
760 
761     Py_INCREF(new_bases);
762     Py_INCREF(new_base);
763 
764     old_bases = type->tp_bases;
765     old_base = type->tp_base;
766 
767     type->tp_bases = new_bases;
768     type->tp_base = new_base;
769 
770     temp = PyList_New(0);
771     if (temp == NULL)
772         goto bail;
773     if (mro_hierarchy(type, temp) < 0)
774         goto undo;
775     Py_DECREF(temp);
776 
777     /* Take no action in case if type->tp_bases has been replaced
778        through reentrance.  */
779     if (type->tp_bases == new_bases) {
780         /* any base that was in __bases__ but now isn't, we
781            need to remove |type| from its tp_subclasses.
782            conversely, any class now in __bases__ that wasn't
783            needs to have |type| added to its subclasses. */
784 
785         /* for now, sod that: just remove from all old_bases,
786            add to all new_bases */
787         remove_all_subclasses(type, old_bases);
788         res = add_all_subclasses(type, new_bases);
789         update_all_slots(type);
790     }
791 
792     Py_DECREF(old_bases);
793     Py_DECREF(old_base);
794 
795     assert(_PyType_CheckConsistency(type));
796     return res;
797 
798   undo:
799     for (i = PyList_GET_SIZE(temp) - 1; i >= 0; i--) {
800         PyTypeObject *cls;
801         PyObject *new_mro, *old_mro = NULL;
802 
803         PyArg_UnpackTuple(PyList_GET_ITEM(temp, i),
804                           "", 2, 3, &cls, &new_mro, &old_mro);
805         /* Do not rollback if cls has a newer version of MRO.  */
806         if (cls->tp_mro == new_mro) {
807             Py_XINCREF(old_mro);
808             cls->tp_mro = old_mro;
809             Py_DECREF(new_mro);
810         }
811     }
812     Py_DECREF(temp);
813 
814   bail:
815     if (type->tp_bases == new_bases) {
816         assert(type->tp_base == new_base);
817 
818         type->tp_bases = old_bases;
819         type->tp_base = old_base;
820 
821         Py_DECREF(new_bases);
822         Py_DECREF(new_base);
823     }
824     else {
825         Py_DECREF(old_bases);
826         Py_DECREF(old_base);
827     }
828 
829     assert(_PyType_CheckConsistency(type));
830     return -1;
831 }
832 
833 static PyObject *
type_dict(PyTypeObject * type,void * context)834 type_dict(PyTypeObject *type, void *context)
835 {
836     if (type->tp_dict == NULL) {
837         Py_RETURN_NONE;
838     }
839     return PyDictProxy_New(type->tp_dict);
840 }
841 
842 static PyObject *
type_get_doc(PyTypeObject * type,void * context)843 type_get_doc(PyTypeObject *type, void *context)
844 {
845     PyObject *result;
846     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE) && type->tp_doc != NULL) {
847         return _PyType_GetDocFromInternalDoc(type->tp_name, type->tp_doc);
848     }
849     result = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___doc__);
850     if (result == NULL) {
851         if (!PyErr_Occurred()) {
852             result = Py_None;
853             Py_INCREF(result);
854         }
855     }
856     else if (Py_TYPE(result)->tp_descr_get) {
857         result = Py_TYPE(result)->tp_descr_get(result, NULL,
858                                                (PyObject *)type);
859     }
860     else {
861         Py_INCREF(result);
862     }
863     return result;
864 }
865 
866 static PyObject *
type_get_text_signature(PyTypeObject * type,void * context)867 type_get_text_signature(PyTypeObject *type, void *context)
868 {
869     return _PyType_GetTextSignatureFromInternalDoc(type->tp_name, type->tp_doc);
870 }
871 
872 static int
type_set_doc(PyTypeObject * type,PyObject * value,void * context)873 type_set_doc(PyTypeObject *type, PyObject *value, void *context)
874 {
875     if (!check_set_special_type_attr(type, value, "__doc__"))
876         return -1;
877     PyType_Modified(type);
878     return _PyDict_SetItemId(type->tp_dict, &PyId___doc__, value);
879 }
880 
881 /*[clinic input]
882 type.__instancecheck__ -> bool
883 
884     instance: object
885     /
886 
887 Check if an object is an instance.
888 [clinic start generated code]*/
889 
890 static int
type___instancecheck___impl(PyTypeObject * self,PyObject * instance)891 type___instancecheck___impl(PyTypeObject *self, PyObject *instance)
892 /*[clinic end generated code: output=08b6bf5f591c3618 input=cdbfeaee82c01a0f]*/
893 {
894     return _PyObject_RealIsInstance(instance, (PyObject *)self);
895 }
896 
897 /*[clinic input]
898 type.__subclasscheck__ -> bool
899 
900     subclass: object
901     /
902 
903 Check if a class is a subclass.
904 [clinic start generated code]*/
905 
906 static int
type___subclasscheck___impl(PyTypeObject * self,PyObject * subclass)907 type___subclasscheck___impl(PyTypeObject *self, PyObject *subclass)
908 /*[clinic end generated code: output=97a4e51694500941 input=071b2ca9e03355f4]*/
909 {
910     return _PyObject_RealIsSubclass(subclass, (PyObject *)self);
911 }
912 
913 
914 static PyGetSetDef type_getsets[] = {
915     {"__name__", (getter)type_name, (setter)type_set_name, NULL},
916     {"__qualname__", (getter)type_qualname, (setter)type_set_qualname, NULL},
917     {"__bases__", (getter)type_get_bases, (setter)type_set_bases, NULL},
918     {"__module__", (getter)type_module, (setter)type_set_module, NULL},
919     {"__abstractmethods__", (getter)type_abstractmethods,
920      (setter)type_set_abstractmethods, NULL},
921     {"__dict__",  (getter)type_dict,  NULL, NULL},
922     {"__doc__", (getter)type_get_doc, (setter)type_set_doc, NULL},
923     {"__text_signature__", (getter)type_get_text_signature, NULL, NULL},
924     {0}
925 };
926 
927 static PyObject *
type_repr(PyTypeObject * type)928 type_repr(PyTypeObject *type)
929 {
930     PyObject *mod, *name, *rtn;
931 
932     mod = type_module(type, NULL);
933     if (mod == NULL)
934         PyErr_Clear();
935     else if (!PyUnicode_Check(mod)) {
936         Py_DECREF(mod);
937         mod = NULL;
938     }
939     name = type_qualname(type, NULL);
940     if (name == NULL) {
941         Py_XDECREF(mod);
942         return NULL;
943     }
944 
945     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
946         rtn = PyUnicode_FromFormat("<class '%U.%U'>", mod, name);
947     else
948         rtn = PyUnicode_FromFormat("<class '%s'>", type->tp_name);
949 
950     Py_XDECREF(mod);
951     Py_DECREF(name);
952     return rtn;
953 }
954 
955 static PyObject *
type_call(PyTypeObject * type,PyObject * args,PyObject * kwds)956 type_call(PyTypeObject *type, PyObject *args, PyObject *kwds)
957 {
958     PyObject *obj;
959 
960     if (type->tp_new == NULL) {
961         PyErr_Format(PyExc_TypeError,
962                      "cannot create '%.100s' instances",
963                      type->tp_name);
964         return NULL;
965     }
966 
967 #ifdef Py_DEBUG
968     /* type_call() must not be called with an exception set,
969        because it can clear it (directly or indirectly) and so the
970        caller loses its exception */
971     assert(!PyErr_Occurred());
972 #endif
973 
974     obj = type->tp_new(type, args, kwds);
975     obj = _Py_CheckFunctionResult((PyObject*)type, obj, NULL);
976     if (obj == NULL)
977         return NULL;
978 
979     /* Ugly exception: when the call was type(something),
980        don't call tp_init on the result. */
981     if (type == &PyType_Type &&
982         PyTuple_Check(args) && PyTuple_GET_SIZE(args) == 1 &&
983         (kwds == NULL ||
984          (PyDict_Check(kwds) && PyDict_GET_SIZE(kwds) == 0)))
985         return obj;
986 
987     /* If the returned object is not an instance of type,
988        it won't be initialized. */
989     if (!PyType_IsSubtype(Py_TYPE(obj), type))
990         return obj;
991 
992     type = Py_TYPE(obj);
993     if (type->tp_init != NULL) {
994         int res = type->tp_init(obj, args, kwds);
995         if (res < 0) {
996             assert(PyErr_Occurred());
997             Py_DECREF(obj);
998             obj = NULL;
999         }
1000         else {
1001             assert(!PyErr_Occurred());
1002         }
1003     }
1004     return obj;
1005 }
1006 
1007 PyObject *
PyType_GenericAlloc(PyTypeObject * type,Py_ssize_t nitems)1008 PyType_GenericAlloc(PyTypeObject *type, Py_ssize_t nitems)
1009 {
1010     PyObject *obj;
1011     const size_t size = _PyObject_VAR_SIZE(type, nitems+1);
1012     /* note that we need to add one, for the sentinel */
1013 
1014     if (PyType_IS_GC(type))
1015         obj = _PyObject_GC_Malloc(size);
1016     else
1017         obj = (PyObject *)PyObject_MALLOC(size);
1018 
1019     if (obj == NULL)
1020         return PyErr_NoMemory();
1021 
1022     memset(obj, '\0', size);
1023 
1024     if (type->tp_itemsize == 0)
1025         (void)PyObject_INIT(obj, type);
1026     else
1027         (void) PyObject_INIT_VAR((PyVarObject *)obj, type, nitems);
1028 
1029     if (PyType_IS_GC(type))
1030         _PyObject_GC_TRACK(obj);
1031     return obj;
1032 }
1033 
1034 PyObject *
PyType_GenericNew(PyTypeObject * type,PyObject * args,PyObject * kwds)1035 PyType_GenericNew(PyTypeObject *type, PyObject *args, PyObject *kwds)
1036 {
1037     return type->tp_alloc(type, 0);
1038 }
1039 
1040 /* Helpers for subtyping */
1041 
1042 static int
traverse_slots(PyTypeObject * type,PyObject * self,visitproc visit,void * arg)1043 traverse_slots(PyTypeObject *type, PyObject *self, visitproc visit, void *arg)
1044 {
1045     Py_ssize_t i, n;
1046     PyMemberDef *mp;
1047 
1048     n = Py_SIZE(type);
1049     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1050     for (i = 0; i < n; i++, mp++) {
1051         if (mp->type == T_OBJECT_EX) {
1052             char *addr = (char *)self + mp->offset;
1053             PyObject *obj = *(PyObject **)addr;
1054             if (obj != NULL) {
1055                 int err = visit(obj, arg);
1056                 if (err)
1057                     return err;
1058             }
1059         }
1060     }
1061     return 0;
1062 }
1063 
1064 static int
subtype_traverse(PyObject * self,visitproc visit,void * arg)1065 subtype_traverse(PyObject *self, visitproc visit, void *arg)
1066 {
1067     PyTypeObject *type, *base;
1068     traverseproc basetraverse;
1069 
1070     /* Find the nearest base with a different tp_traverse,
1071        and traverse slots while we're at it */
1072     type = Py_TYPE(self);
1073     base = type;
1074     while ((basetraverse = base->tp_traverse) == subtype_traverse) {
1075         if (Py_SIZE(base)) {
1076             int err = traverse_slots(base, self, visit, arg);
1077             if (err)
1078                 return err;
1079         }
1080         base = base->tp_base;
1081         assert(base);
1082     }
1083 
1084     if (type->tp_dictoffset != base->tp_dictoffset) {
1085         PyObject **dictptr = _PyObject_GetDictPtr(self);
1086         if (dictptr && *dictptr)
1087             Py_VISIT(*dictptr);
1088     }
1089 
1090     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE)
1091         /* For a heaptype, the instances count as references
1092            to the type.          Traverse the type so the collector
1093            can find cycles involving this link. */
1094         Py_VISIT(type);
1095 
1096     if (basetraverse)
1097         return basetraverse(self, visit, arg);
1098     return 0;
1099 }
1100 
1101 static void
clear_slots(PyTypeObject * type,PyObject * self)1102 clear_slots(PyTypeObject *type, PyObject *self)
1103 {
1104     Py_ssize_t i, n;
1105     PyMemberDef *mp;
1106 
1107     n = Py_SIZE(type);
1108     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1109     for (i = 0; i < n; i++, mp++) {
1110         if (mp->type == T_OBJECT_EX && !(mp->flags & READONLY)) {
1111             char *addr = (char *)self + mp->offset;
1112             PyObject *obj = *(PyObject **)addr;
1113             if (obj != NULL) {
1114                 *(PyObject **)addr = NULL;
1115                 Py_DECREF(obj);
1116             }
1117         }
1118     }
1119 }
1120 
1121 static int
subtype_clear(PyObject * self)1122 subtype_clear(PyObject *self)
1123 {
1124     PyTypeObject *type, *base;
1125     inquiry baseclear;
1126 
1127     /* Find the nearest base with a different tp_clear
1128        and clear slots while we're at it */
1129     type = Py_TYPE(self);
1130     base = type;
1131     while ((baseclear = base->tp_clear) == subtype_clear) {
1132         if (Py_SIZE(base))
1133             clear_slots(base, self);
1134         base = base->tp_base;
1135         assert(base);
1136     }
1137 
1138     /* Clear the instance dict (if any), to break cycles involving only
1139        __dict__ slots (as in the case 'self.__dict__ is self'). */
1140     if (type->tp_dictoffset != base->tp_dictoffset) {
1141         PyObject **dictptr = _PyObject_GetDictPtr(self);
1142         if (dictptr && *dictptr)
1143             Py_CLEAR(*dictptr);
1144     }
1145 
1146     if (baseclear)
1147         return baseclear(self);
1148     return 0;
1149 }
1150 
1151 static void
subtype_dealloc(PyObject * self)1152 subtype_dealloc(PyObject *self)
1153 {
1154     PyTypeObject *type, *base;
1155     destructor basedealloc;
1156     int has_finalizer;
1157 
1158     /* Extract the type; we expect it to be a heap type */
1159     type = Py_TYPE(self);
1160     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
1161 
1162     /* Test whether the type has GC exactly once */
1163 
1164     if (!PyType_IS_GC(type)) {
1165         /* A non GC dynamic type allows certain simplifications:
1166            there's no need to call clear_slots(), or DECREF the dict,
1167            or clear weakrefs. */
1168 
1169         /* Maybe call finalizer; exit early if resurrected */
1170         if (type->tp_finalize) {
1171             if (PyObject_CallFinalizerFromDealloc(self) < 0)
1172                 return;
1173         }
1174         if (type->tp_del) {
1175             type->tp_del(self);
1176             if (self->ob_refcnt > 0)
1177                 return;
1178         }
1179 
1180         /* Find the nearest base with a different tp_dealloc */
1181         base = type;
1182         while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1183             base = base->tp_base;
1184             assert(base);
1185         }
1186 
1187         /* Extract the type again; tp_del may have changed it */
1188         type = Py_TYPE(self);
1189 
1190         /* Call the base tp_dealloc() */
1191         assert(basedealloc);
1192         basedealloc(self);
1193 
1194        /* Only decref if the base type is not already a heap allocated type.
1195           Otherwise, basedealloc should have decref'd it already */
1196         if (type->tp_flags & Py_TPFLAGS_HEAPTYPE && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE))
1197             Py_DECREF(type);
1198 
1199         /* Done */
1200         return;
1201     }
1202 
1203     /* We get here only if the type has GC */
1204 
1205     /* UnTrack and re-Track around the trashcan macro, alas */
1206     /* See explanation at end of function for full disclosure */
1207     PyObject_GC_UnTrack(self);
1208     Py_TRASHCAN_BEGIN(self, subtype_dealloc);
1209 
1210     /* Find the nearest base with a different tp_dealloc */
1211     base = type;
1212     while ((/*basedealloc =*/ base->tp_dealloc) == subtype_dealloc) {
1213         base = base->tp_base;
1214         assert(base);
1215     }
1216 
1217     has_finalizer = type->tp_finalize || type->tp_del;
1218 
1219     if (type->tp_finalize) {
1220         _PyObject_GC_TRACK(self);
1221         if (PyObject_CallFinalizerFromDealloc(self) < 0) {
1222             /* Resurrected */
1223             goto endlabel;
1224         }
1225         _PyObject_GC_UNTRACK(self);
1226     }
1227     /*
1228       If we added a weaklist, we clear it. Do this *before* calling tp_del,
1229       clearing slots, or clearing the instance dict.
1230 
1231       GC tracking must be off at this point. weakref callbacks (if any, and
1232       whether directly here or indirectly in something we call) may trigger GC,
1233       and if self is tracked at that point, it will look like trash to GC and GC
1234       will try to delete self again.
1235     */
1236     if (type->tp_weaklistoffset && !base->tp_weaklistoffset)
1237         PyObject_ClearWeakRefs(self);
1238 
1239     if (type->tp_del) {
1240         _PyObject_GC_TRACK(self);
1241         type->tp_del(self);
1242         if (self->ob_refcnt > 0) {
1243             /* Resurrected */
1244             goto endlabel;
1245         }
1246         _PyObject_GC_UNTRACK(self);
1247     }
1248     if (has_finalizer) {
1249         /* New weakrefs could be created during the finalizer call.
1250            If this occurs, clear them out without calling their
1251            finalizers since they might rely on part of the object
1252            being finalized that has already been destroyed. */
1253         if (type->tp_weaklistoffset && !base->tp_weaklistoffset) {
1254             /* Modeled after GET_WEAKREFS_LISTPTR() */
1255             PyWeakReference **list = (PyWeakReference **) \
1256                 PyObject_GET_WEAKREFS_LISTPTR(self);
1257             while (*list)
1258                 _PyWeakref_ClearRef(*list);
1259         }
1260     }
1261 
1262     /*  Clear slots up to the nearest base with a different tp_dealloc */
1263     base = type;
1264     while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1265         if (Py_SIZE(base))
1266             clear_slots(base, self);
1267         base = base->tp_base;
1268         assert(base);
1269     }
1270 
1271     /* If we added a dict, DECREF it */
1272     if (type->tp_dictoffset && !base->tp_dictoffset) {
1273         PyObject **dictptr = _PyObject_GetDictPtr(self);
1274         if (dictptr != NULL) {
1275             PyObject *dict = *dictptr;
1276             if (dict != NULL) {
1277                 Py_DECREF(dict);
1278                 *dictptr = NULL;
1279             }
1280         }
1281     }
1282 
1283     /* Extract the type again; tp_del may have changed it */
1284     type = Py_TYPE(self);
1285 
1286     /* Call the base tp_dealloc(); first retrack self if
1287      * basedealloc knows about gc.
1288      */
1289     if (PyType_IS_GC(base))
1290         _PyObject_GC_TRACK(self);
1291     assert(basedealloc);
1292     basedealloc(self);
1293 
1294     /* Can't reference self beyond this point. It's possible tp_del switched
1295        our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
1296        reference counting. Only decref if the base type is not already a heap
1297        allocated type. Otherwise, basedealloc should have decref'd it already */
1298     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE))
1299       Py_DECREF(type);
1300 
1301   endlabel:
1302     Py_TRASHCAN_END
1303 
1304     /* Explanation of the weirdness around the trashcan macros:
1305 
1306        Q. What do the trashcan macros do?
1307 
1308        A. Read the comment titled "Trashcan mechanism" in object.h.
1309           For one, this explains why there must be a call to GC-untrack
1310           before the trashcan begin macro.      Without understanding the
1311           trashcan code, the answers to the following questions don't make
1312           sense.
1313 
1314        Q. Why do we GC-untrack before the trashcan and then immediately
1315           GC-track again afterward?
1316 
1317        A. In the case that the base class is GC-aware, the base class
1318           probably GC-untracks the object.      If it does that using the
1319           UNTRACK macro, this will crash when the object is already
1320           untracked.  Because we don't know what the base class does, the
1321           only safe thing is to make sure the object is tracked when we
1322           call the base class dealloc.  But...  The trashcan begin macro
1323           requires that the object is *untracked* before it is called.  So
1324           the dance becomes:
1325 
1326          GC untrack
1327          trashcan begin
1328          GC track
1329 
1330        Q. Why did the last question say "immediately GC-track again"?
1331           It's nowhere near immediately.
1332 
1333        A. Because the code *used* to re-track immediately.      Bad Idea.
1334           self has a refcount of 0, and if gc ever gets its hands on it
1335           (which can happen if any weakref callback gets invoked), it
1336           looks like trash to gc too, and gc also tries to delete self
1337           then.  But we're already deleting self.  Double deallocation is
1338           a subtle disaster.
1339     */
1340 }
1341 
1342 static PyTypeObject *solid_base(PyTypeObject *type);
1343 
1344 /* type test with subclassing support */
1345 
1346 static int
type_is_subtype_base_chain(PyTypeObject * a,PyTypeObject * b)1347 type_is_subtype_base_chain(PyTypeObject *a, PyTypeObject *b)
1348 {
1349     do {
1350         if (a == b)
1351             return 1;
1352         a = a->tp_base;
1353     } while (a != NULL);
1354 
1355     return (b == &PyBaseObject_Type);
1356 }
1357 
1358 int
PyType_IsSubtype(PyTypeObject * a,PyTypeObject * b)1359 PyType_IsSubtype(PyTypeObject *a, PyTypeObject *b)
1360 {
1361     PyObject *mro;
1362 
1363     mro = a->tp_mro;
1364     if (mro != NULL) {
1365         /* Deal with multiple inheritance without recursion
1366            by walking the MRO tuple */
1367         Py_ssize_t i, n;
1368         assert(PyTuple_Check(mro));
1369         n = PyTuple_GET_SIZE(mro);
1370         for (i = 0; i < n; i++) {
1371             if (PyTuple_GET_ITEM(mro, i) == (PyObject *)b)
1372                 return 1;
1373         }
1374         return 0;
1375     }
1376     else
1377         /* a is not completely initilized yet; follow tp_base */
1378         return type_is_subtype_base_chain(a, b);
1379 }
1380 
1381 /* Routines to do a method lookup in the type without looking in the
1382    instance dictionary (so we can't use PyObject_GetAttr) but still
1383    binding it to the instance.
1384 
1385    Variants:
1386 
1387    - _PyObject_LookupSpecial() returns NULL without raising an exception
1388      when the _PyType_Lookup() call fails;
1389 
1390    - lookup_maybe_method() and lookup_method() are internal routines similar
1391      to _PyObject_LookupSpecial(), but can return unbound PyFunction
1392      to avoid temporary method object. Pass self as first argument when
1393      unbound == 1.
1394 */
1395 
1396 PyObject *
_PyObject_LookupSpecial(PyObject * self,_Py_Identifier * attrid)1397 _PyObject_LookupSpecial(PyObject *self, _Py_Identifier *attrid)
1398 {
1399     PyObject *res;
1400 
1401     res = _PyType_LookupId(Py_TYPE(self), attrid);
1402     if (res != NULL) {
1403         descrgetfunc f;
1404         if ((f = Py_TYPE(res)->tp_descr_get) == NULL)
1405             Py_INCREF(res);
1406         else
1407             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1408     }
1409     return res;
1410 }
1411 
1412 static PyObject *
lookup_maybe_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1413 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1414 {
1415     PyObject *res = _PyType_LookupId(Py_TYPE(self), attrid);
1416     if (res == NULL) {
1417         return NULL;
1418     }
1419 
1420     if (PyType_HasFeature(Py_TYPE(res), Py_TPFLAGS_METHOD_DESCRIPTOR)) {
1421         /* Avoid temporary PyMethodObject */
1422         *unbound = 1;
1423         Py_INCREF(res);
1424     }
1425     else {
1426         *unbound = 0;
1427         descrgetfunc f = Py_TYPE(res)->tp_descr_get;
1428         if (f == NULL) {
1429             Py_INCREF(res);
1430         }
1431         else {
1432             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1433         }
1434     }
1435     return res;
1436 }
1437 
1438 static PyObject *
lookup_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1439 lookup_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1440 {
1441     PyObject *res = lookup_maybe_method(self, attrid, unbound);
1442     if (res == NULL && !PyErr_Occurred()) {
1443         PyErr_SetObject(PyExc_AttributeError, attrid->object);
1444     }
1445     return res;
1446 }
1447 
1448 static PyObject*
call_unbound(int unbound,PyObject * func,PyObject * self,PyObject ** args,Py_ssize_t nargs)1449 call_unbound(int unbound, PyObject *func, PyObject *self,
1450              PyObject **args, Py_ssize_t nargs)
1451 {
1452     if (unbound) {
1453         return _PyObject_FastCall_Prepend(func, self, args, nargs);
1454     }
1455     else {
1456         return _PyObject_FastCall(func, args, nargs);
1457     }
1458 }
1459 
1460 static PyObject*
call_unbound_noarg(int unbound,PyObject * func,PyObject * self)1461 call_unbound_noarg(int unbound, PyObject *func, PyObject *self)
1462 {
1463     if (unbound) {
1464         PyObject *args[1] = {self};
1465         return _PyObject_FastCall(func, args, 1);
1466     }
1467     else {
1468         return _PyObject_CallNoArg(func);
1469     }
1470 }
1471 
1472 /* A variation of PyObject_CallMethod* that uses lookup_maybe_method()
1473    instead of PyObject_GetAttrString(). */
1474 static PyObject *
call_method(PyObject * obj,_Py_Identifier * name,PyObject ** args,Py_ssize_t nargs)1475 call_method(PyObject *obj, _Py_Identifier *name,
1476             PyObject **args, Py_ssize_t nargs)
1477 {
1478     int unbound;
1479     PyObject *func, *retval;
1480 
1481     func = lookup_method(obj, name, &unbound);
1482     if (func == NULL) {
1483         return NULL;
1484     }
1485     retval = call_unbound(unbound, func, obj, args, nargs);
1486     Py_DECREF(func);
1487     return retval;
1488 }
1489 
1490 /* Clone of call_method() that returns NotImplemented when the lookup fails. */
1491 
1492 static PyObject *
call_maybe(PyObject * obj,_Py_Identifier * name,PyObject ** args,Py_ssize_t nargs)1493 call_maybe(PyObject *obj, _Py_Identifier *name,
1494            PyObject **args, Py_ssize_t nargs)
1495 {
1496     int unbound;
1497     PyObject *func, *retval;
1498 
1499     func = lookup_maybe_method(obj, name, &unbound);
1500     if (func == NULL) {
1501         if (!PyErr_Occurred())
1502             Py_RETURN_NOTIMPLEMENTED;
1503         return NULL;
1504     }
1505 
1506     retval = call_unbound(unbound, func, obj, args, nargs);
1507     Py_DECREF(func);
1508     return retval;
1509 }
1510 
1511 /*
1512     Method resolution order algorithm C3 described in
1513     "A Monotonic Superclass Linearization for Dylan",
1514     by Kim Barrett, Bob Cassel, Paul Haahr,
1515     David A. Moon, Keith Playford, and P. Tucker Withington.
1516     (OOPSLA 1996)
1517 
1518     Some notes about the rules implied by C3:
1519 
1520     No duplicate bases.
1521     It isn't legal to repeat a class in a list of base classes.
1522 
1523     The next three properties are the 3 constraints in "C3".
1524 
1525     Local precedence order.
1526     If A precedes B in C's MRO, then A will precede B in the MRO of all
1527     subclasses of C.
1528 
1529     Monotonicity.
1530     The MRO of a class must be an extension without reordering of the
1531     MRO of each of its superclasses.
1532 
1533     Extended Precedence Graph (EPG).
1534     Linearization is consistent if there is a path in the EPG from
1535     each class to all its successors in the linearization.  See
1536     the paper for definition of EPG.
1537  */
1538 
1539 static int
tail_contains(PyObject * tuple,int whence,PyObject * o)1540 tail_contains(PyObject *tuple, int whence, PyObject *o)
1541 {
1542     Py_ssize_t j, size;
1543     size = PyTuple_GET_SIZE(tuple);
1544 
1545     for (j = whence+1; j < size; j++) {
1546         if (PyTuple_GET_ITEM(tuple, j) == o)
1547             return 1;
1548     }
1549     return 0;
1550 }
1551 
1552 static PyObject *
class_name(PyObject * cls)1553 class_name(PyObject *cls)
1554 {
1555     PyObject *name;
1556     if (_PyObject_LookupAttrId(cls, &PyId___name__, &name) == 0) {
1557         name = PyObject_Repr(cls);
1558     }
1559     return name;
1560 }
1561 
1562 static int
check_duplicates(PyObject * tuple)1563 check_duplicates(PyObject *tuple)
1564 {
1565     Py_ssize_t i, j, n;
1566     /* Let's use a quadratic time algorithm,
1567        assuming that the bases tuples is short.
1568     */
1569     n = PyTuple_GET_SIZE(tuple);
1570     for (i = 0; i < n; i++) {
1571         PyObject *o = PyTuple_GET_ITEM(tuple, i);
1572         for (j = i + 1; j < n; j++) {
1573             if (PyTuple_GET_ITEM(tuple, j) == o) {
1574                 o = class_name(o);
1575                 if (o != NULL) {
1576                     if (PyUnicode_Check(o)) {
1577                         PyErr_Format(PyExc_TypeError,
1578                                      "duplicate base class %U", o);
1579                     }
1580                     else {
1581                         PyErr_SetString(PyExc_TypeError,
1582                                         "duplicate base class");
1583                     }
1584                     Py_DECREF(o);
1585                 }
1586                 return -1;
1587             }
1588         }
1589     }
1590     return 0;
1591 }
1592 
1593 /* Raise a TypeError for an MRO order disagreement.
1594 
1595    It's hard to produce a good error message.  In the absence of better
1596    insight into error reporting, report the classes that were candidates
1597    to be put next into the MRO.  There is some conflict between the
1598    order in which they should be put in the MRO, but it's hard to
1599    diagnose what constraint can't be satisfied.
1600 */
1601 
1602 static void
set_mro_error(PyObject ** to_merge,Py_ssize_t to_merge_size,int * remain)1603 set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain)
1604 {
1605     Py_ssize_t i, n, off;
1606     char buf[1000];
1607     PyObject *k, *v;
1608     PyObject *set = PyDict_New();
1609     if (!set) return;
1610 
1611     for (i = 0; i < to_merge_size; i++) {
1612         PyObject *L = to_merge[i];
1613         if (remain[i] < PyTuple_GET_SIZE(L)) {
1614             PyObject *c = PyTuple_GET_ITEM(L, remain[i]);
1615             if (PyDict_SetItem(set, c, Py_None) < 0) {
1616                 Py_DECREF(set);
1617                 return;
1618             }
1619         }
1620     }
1621     n = PyDict_GET_SIZE(set);
1622 
1623     off = PyOS_snprintf(buf, sizeof(buf), "Cannot create a \
1624 consistent method resolution\norder (MRO) for bases");
1625     i = 0;
1626     while (PyDict_Next(set, &i, &k, &v) && (size_t)off < sizeof(buf)) {
1627         PyObject *name = class_name(k);
1628         const char *name_str = NULL;
1629         if (name != NULL) {
1630             if (PyUnicode_Check(name)) {
1631                 name_str = PyUnicode_AsUTF8(name);
1632             }
1633             else {
1634                 name_str = "?";
1635             }
1636         }
1637         if (name_str == NULL) {
1638             Py_XDECREF(name);
1639             Py_DECREF(set);
1640             return;
1641         }
1642         off += PyOS_snprintf(buf + off, sizeof(buf) - off, " %s", name_str);
1643         Py_XDECREF(name);
1644         if (--n && (size_t)(off+1) < sizeof(buf)) {
1645             buf[off++] = ',';
1646             buf[off] = '\0';
1647         }
1648     }
1649     PyErr_SetString(PyExc_TypeError, buf);
1650     Py_DECREF(set);
1651 }
1652 
1653 static int
pmerge(PyObject * acc,PyObject ** to_merge,Py_ssize_t to_merge_size)1654 pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
1655 {
1656     int res = 0;
1657     Py_ssize_t i, j, empty_cnt;
1658     int *remain;
1659 
1660     /* remain stores an index into each sublist of to_merge.
1661        remain[i] is the index of the next base in to_merge[i]
1662        that is not included in acc.
1663     */
1664     remain = PyMem_New(int, to_merge_size);
1665     if (remain == NULL) {
1666         PyErr_NoMemory();
1667         return -1;
1668     }
1669     for (i = 0; i < to_merge_size; i++)
1670         remain[i] = 0;
1671 
1672   again:
1673     empty_cnt = 0;
1674     for (i = 0; i < to_merge_size; i++) {
1675         PyObject *candidate;
1676 
1677         PyObject *cur_tuple = to_merge[i];
1678 
1679         if (remain[i] >= PyTuple_GET_SIZE(cur_tuple)) {
1680             empty_cnt++;
1681             continue;
1682         }
1683 
1684         /* Choose next candidate for MRO.
1685 
1686            The input sequences alone can determine the choice.
1687            If not, choose the class which appears in the MRO
1688            of the earliest direct superclass of the new class.
1689         */
1690 
1691         candidate = PyTuple_GET_ITEM(cur_tuple, remain[i]);
1692         for (j = 0; j < to_merge_size; j++) {
1693             PyObject *j_lst = to_merge[j];
1694             if (tail_contains(j_lst, remain[j], candidate))
1695                 goto skip; /* continue outer loop */
1696         }
1697         res = PyList_Append(acc, candidate);
1698         if (res < 0)
1699             goto out;
1700 
1701         for (j = 0; j < to_merge_size; j++) {
1702             PyObject *j_lst = to_merge[j];
1703             if (remain[j] < PyTuple_GET_SIZE(j_lst) &&
1704                 PyTuple_GET_ITEM(j_lst, remain[j]) == candidate) {
1705                 remain[j]++;
1706             }
1707         }
1708         goto again;
1709       skip: ;
1710     }
1711 
1712     if (empty_cnt != to_merge_size) {
1713         set_mro_error(to_merge, to_merge_size, remain);
1714         res = -1;
1715     }
1716 
1717   out:
1718     PyMem_Del(remain);
1719 
1720     return res;
1721 }
1722 
1723 static PyObject *
mro_implementation(PyTypeObject * type)1724 mro_implementation(PyTypeObject *type)
1725 {
1726     PyObject *result;
1727     PyObject *bases;
1728     PyObject **to_merge;
1729     Py_ssize_t i, n;
1730 
1731     if (type->tp_dict == NULL) {
1732         if (PyType_Ready(type) < 0)
1733             return NULL;
1734     }
1735 
1736     bases = type->tp_bases;
1737     assert(PyTuple_Check(bases));
1738     n = PyTuple_GET_SIZE(bases);
1739     for (i = 0; i < n; i++) {
1740         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1741         if (base->tp_mro == NULL) {
1742             PyErr_Format(PyExc_TypeError,
1743                          "Cannot extend an incomplete type '%.100s'",
1744                          base->tp_name);
1745             return NULL;
1746         }
1747         assert(PyTuple_Check(base->tp_mro));
1748     }
1749 
1750     if (n == 1) {
1751         /* Fast path: if there is a single base, constructing the MRO
1752          * is trivial.
1753          */
1754         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, 0);
1755         Py_ssize_t k = PyTuple_GET_SIZE(base->tp_mro);
1756         result = PyTuple_New(k + 1);
1757         if (result == NULL) {
1758             return NULL;
1759         }
1760         Py_INCREF(type);
1761         PyTuple_SET_ITEM(result, 0, (PyObject *) type);
1762         for (i = 0; i < k; i++) {
1763             PyObject *cls = PyTuple_GET_ITEM(base->tp_mro, i);
1764             Py_INCREF(cls);
1765             PyTuple_SET_ITEM(result, i + 1, cls);
1766         }
1767         return result;
1768     }
1769 
1770     /* This is just a basic sanity check. */
1771     if (check_duplicates(bases) < 0) {
1772         return NULL;
1773     }
1774 
1775     /* Find a superclass linearization that honors the constraints
1776        of the explicit tuples of bases and the constraints implied by
1777        each base class.
1778 
1779        to_merge is an array of tuples, where each tuple is a superclass
1780        linearization implied by a base class.  The last element of
1781        to_merge is the declared tuple of bases.
1782     */
1783 
1784     to_merge = PyMem_New(PyObject *, n + 1);
1785     if (to_merge == NULL) {
1786         PyErr_NoMemory();
1787         return NULL;
1788     }
1789 
1790     for (i = 0; i < n; i++) {
1791         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1792         to_merge[i] = base->tp_mro;
1793     }
1794     to_merge[n] = bases;
1795 
1796     result = PyList_New(1);
1797     if (result == NULL) {
1798         PyMem_Del(to_merge);
1799         return NULL;
1800     }
1801 
1802     Py_INCREF(type);
1803     PyList_SET_ITEM(result, 0, (PyObject *)type);
1804     if (pmerge(result, to_merge, n + 1) < 0) {
1805         Py_CLEAR(result);
1806     }
1807 
1808     PyMem_Del(to_merge);
1809     return result;
1810 }
1811 
1812 /*[clinic input]
1813 type.mro
1814 
1815 Return a type's method resolution order.
1816 [clinic start generated code]*/
1817 
1818 static PyObject *
type_mro_impl(PyTypeObject * self)1819 type_mro_impl(PyTypeObject *self)
1820 /*[clinic end generated code: output=bffc4a39b5b57027 input=28414f4e156db28d]*/
1821 {
1822     PyObject *seq;
1823     seq = mro_implementation(self);
1824     if (seq != NULL && !PyList_Check(seq)) {
1825         Py_SETREF(seq, PySequence_List(seq));
1826     }
1827     return seq;
1828 }
1829 
1830 static int
mro_check(PyTypeObject * type,PyObject * mro)1831 mro_check(PyTypeObject *type, PyObject *mro)
1832 {
1833     PyTypeObject *solid;
1834     Py_ssize_t i, n;
1835 
1836     solid = solid_base(type);
1837 
1838     n = PyTuple_GET_SIZE(mro);
1839     for (i = 0; i < n; i++) {
1840         PyTypeObject *base;
1841         PyObject *tmp;
1842 
1843         tmp = PyTuple_GET_ITEM(mro, i);
1844         if (!PyType_Check(tmp)) {
1845             PyErr_Format(
1846                 PyExc_TypeError,
1847                 "mro() returned a non-class ('%.500s')",
1848                 Py_TYPE(tmp)->tp_name);
1849             return -1;
1850         }
1851 
1852         base = (PyTypeObject*)tmp;
1853         if (!PyType_IsSubtype(solid, solid_base(base))) {
1854             PyErr_Format(
1855                 PyExc_TypeError,
1856                 "mro() returned base with unsuitable layout ('%.500s')",
1857                 base->tp_name);
1858             return -1;
1859         }
1860     }
1861 
1862     return 0;
1863 }
1864 
1865 /* Lookups an mcls.mro method, invokes it and checks the result (if needed,
1866    in case of a custom mro() implementation).
1867 
1868    Keep in mind that during execution of this function type->tp_mro
1869    can be replaced due to possible reentrance (for example,
1870    through type_set_bases):
1871 
1872       - when looking up the mcls.mro attribute (it could be
1873         a user-provided descriptor);
1874 
1875       - from inside a custom mro() itself;
1876 
1877       - through a finalizer of the return value of mro().
1878 */
1879 static PyObject *
mro_invoke(PyTypeObject * type)1880 mro_invoke(PyTypeObject *type)
1881 {
1882     PyObject *mro_result;
1883     PyObject *new_mro;
1884     int custom = (Py_TYPE(type) != &PyType_Type);
1885 
1886     if (custom) {
1887         _Py_IDENTIFIER(mro);
1888         int unbound;
1889         PyObject *mro_meth = lookup_method((PyObject *)type, &PyId_mro,
1890                                            &unbound);
1891         if (mro_meth == NULL)
1892             return NULL;
1893         mro_result = call_unbound_noarg(unbound, mro_meth, (PyObject *)type);
1894         Py_DECREF(mro_meth);
1895     }
1896     else {
1897         mro_result = mro_implementation(type);
1898     }
1899     if (mro_result == NULL)
1900         return NULL;
1901 
1902     new_mro = PySequence_Tuple(mro_result);
1903     Py_DECREF(mro_result);
1904     if (new_mro == NULL)
1905         return NULL;
1906 
1907     if (custom && mro_check(type, new_mro) < 0) {
1908         Py_DECREF(new_mro);
1909         return NULL;
1910     }
1911 
1912     return new_mro;
1913 }
1914 
1915 /* Calculates and assigns a new MRO to type->tp_mro.
1916    Return values and invariants:
1917 
1918      - Returns 1 if a new MRO value has been set to type->tp_mro due to
1919        this call of mro_internal (no tricky reentrancy and no errors).
1920 
1921        In case if p_old_mro argument is not NULL, a previous value
1922        of type->tp_mro is put there, and the ownership of this
1923        reference is transferred to a caller.
1924        Otherwise, the previous value (if any) is decref'ed.
1925 
1926      - Returns 0 in case when type->tp_mro gets changed because of
1927        reentering here through a custom mro() (see a comment to mro_invoke).
1928 
1929        In this case, a refcount of an old type->tp_mro is adjusted
1930        somewhere deeper in the call stack (by the innermost mro_internal
1931        or its caller) and may become zero upon returning from here.
1932        This also implies that the whole hierarchy of subclasses of the type
1933        has seen the new value and updated their MRO accordingly.
1934 
1935      - Returns -1 in case of an error.
1936 */
1937 static int
mro_internal(PyTypeObject * type,PyObject ** p_old_mro)1938 mro_internal(PyTypeObject *type, PyObject **p_old_mro)
1939 {
1940     PyObject *new_mro, *old_mro;
1941     int reent;
1942 
1943     /* Keep a reference to be able to do a reentrancy check below.
1944        Don't let old_mro be GC'ed and its address be reused for
1945        another object, like (suddenly!) a new tp_mro.  */
1946     old_mro = type->tp_mro;
1947     Py_XINCREF(old_mro);
1948     new_mro = mro_invoke(type);  /* might cause reentrance */
1949     reent = (type->tp_mro != old_mro);
1950     Py_XDECREF(old_mro);
1951     if (new_mro == NULL)
1952         return -1;
1953 
1954     if (reent) {
1955         Py_DECREF(new_mro);
1956         return 0;
1957     }
1958 
1959     type->tp_mro = new_mro;
1960 
1961     type_mro_modified(type, type->tp_mro);
1962     /* corner case: the super class might have been hidden
1963        from the custom MRO */
1964     type_mro_modified(type, type->tp_bases);
1965 
1966     PyType_Modified(type);
1967 
1968     if (p_old_mro != NULL)
1969         *p_old_mro = old_mro;  /* transfer the ownership */
1970     else
1971         Py_XDECREF(old_mro);
1972 
1973     return 1;
1974 }
1975 
1976 
1977 /* Calculate the best base amongst multiple base classes.
1978    This is the first one that's on the path to the "solid base". */
1979 
1980 static PyTypeObject *
best_base(PyObject * bases)1981 best_base(PyObject *bases)
1982 {
1983     Py_ssize_t i, n;
1984     PyTypeObject *base, *winner, *candidate, *base_i;
1985     PyObject *base_proto;
1986 
1987     assert(PyTuple_Check(bases));
1988     n = PyTuple_GET_SIZE(bases);
1989     assert(n > 0);
1990     base = NULL;
1991     winner = NULL;
1992     for (i = 0; i < n; i++) {
1993         base_proto = PyTuple_GET_ITEM(bases, i);
1994         if (!PyType_Check(base_proto)) {
1995             PyErr_SetString(
1996                 PyExc_TypeError,
1997                 "bases must be types");
1998             return NULL;
1999         }
2000         base_i = (PyTypeObject *)base_proto;
2001         if (base_i->tp_dict == NULL) {
2002             if (PyType_Ready(base_i) < 0)
2003                 return NULL;
2004         }
2005         if (!PyType_HasFeature(base_i, Py_TPFLAGS_BASETYPE)) {
2006             PyErr_Format(PyExc_TypeError,
2007                          "type '%.100s' is not an acceptable base type",
2008                          base_i->tp_name);
2009             return NULL;
2010         }
2011         candidate = solid_base(base_i);
2012         if (winner == NULL) {
2013             winner = candidate;
2014             base = base_i;
2015         }
2016         else if (PyType_IsSubtype(winner, candidate))
2017             ;
2018         else if (PyType_IsSubtype(candidate, winner)) {
2019             winner = candidate;
2020             base = base_i;
2021         }
2022         else {
2023             PyErr_SetString(
2024                 PyExc_TypeError,
2025                 "multiple bases have "
2026                 "instance lay-out conflict");
2027             return NULL;
2028         }
2029     }
2030     assert (base != NULL);
2031 
2032     return base;
2033 }
2034 
2035 static int
extra_ivars(PyTypeObject * type,PyTypeObject * base)2036 extra_ivars(PyTypeObject *type, PyTypeObject *base)
2037 {
2038     size_t t_size = type->tp_basicsize;
2039     size_t b_size = base->tp_basicsize;
2040 
2041     assert(t_size >= b_size); /* Else type smaller than base! */
2042     if (type->tp_itemsize || base->tp_itemsize) {
2043         /* If itemsize is involved, stricter rules */
2044         return t_size != b_size ||
2045             type->tp_itemsize != base->tp_itemsize;
2046     }
2047     if (type->tp_weaklistoffset && base->tp_weaklistoffset == 0 &&
2048         type->tp_weaklistoffset + sizeof(PyObject *) == t_size &&
2049         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2050         t_size -= sizeof(PyObject *);
2051     if (type->tp_dictoffset && base->tp_dictoffset == 0 &&
2052         type->tp_dictoffset + sizeof(PyObject *) == t_size &&
2053         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2054         t_size -= sizeof(PyObject *);
2055 
2056     return t_size != b_size;
2057 }
2058 
2059 static PyTypeObject *
solid_base(PyTypeObject * type)2060 solid_base(PyTypeObject *type)
2061 {
2062     PyTypeObject *base;
2063 
2064     if (type->tp_base)
2065         base = solid_base(type->tp_base);
2066     else
2067         base = &PyBaseObject_Type;
2068     if (extra_ivars(type, base))
2069         return type;
2070     else
2071         return base;
2072 }
2073 
2074 static void object_dealloc(PyObject *);
2075 static int object_init(PyObject *, PyObject *, PyObject *);
2076 static int update_slot(PyTypeObject *, PyObject *);
2077 static void fixup_slot_dispatchers(PyTypeObject *);
2078 static int set_names(PyTypeObject *);
2079 static int init_subclass(PyTypeObject *, PyObject *);
2080 
2081 /*
2082  * Helpers for  __dict__ descriptor.  We don't want to expose the dicts
2083  * inherited from various builtin types.  The builtin base usually provides
2084  * its own __dict__ descriptor, so we use that when we can.
2085  */
2086 static PyTypeObject *
get_builtin_base_with_dict(PyTypeObject * type)2087 get_builtin_base_with_dict(PyTypeObject *type)
2088 {
2089     while (type->tp_base != NULL) {
2090         if (type->tp_dictoffset != 0 &&
2091             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
2092             return type;
2093         type = type->tp_base;
2094     }
2095     return NULL;
2096 }
2097 
2098 static PyObject *
get_dict_descriptor(PyTypeObject * type)2099 get_dict_descriptor(PyTypeObject *type)
2100 {
2101     PyObject *descr;
2102 
2103     descr = _PyType_LookupId(type, &PyId___dict__);
2104     if (descr == NULL || !PyDescr_IsData(descr))
2105         return NULL;
2106 
2107     return descr;
2108 }
2109 
2110 static void
raise_dict_descr_error(PyObject * obj)2111 raise_dict_descr_error(PyObject *obj)
2112 {
2113     PyErr_Format(PyExc_TypeError,
2114                  "this __dict__ descriptor does not support "
2115                  "'%.200s' objects", Py_TYPE(obj)->tp_name);
2116 }
2117 
2118 static PyObject *
subtype_dict(PyObject * obj,void * context)2119 subtype_dict(PyObject *obj, void *context)
2120 {
2121     PyTypeObject *base;
2122 
2123     base = get_builtin_base_with_dict(Py_TYPE(obj));
2124     if (base != NULL) {
2125         descrgetfunc func;
2126         PyObject *descr = get_dict_descriptor(base);
2127         if (descr == NULL) {
2128             raise_dict_descr_error(obj);
2129             return NULL;
2130         }
2131         func = Py_TYPE(descr)->tp_descr_get;
2132         if (func == NULL) {
2133             raise_dict_descr_error(obj);
2134             return NULL;
2135         }
2136         return func(descr, obj, (PyObject *)(Py_TYPE(obj)));
2137     }
2138     return PyObject_GenericGetDict(obj, context);
2139 }
2140 
2141 static int
subtype_setdict(PyObject * obj,PyObject * value,void * context)2142 subtype_setdict(PyObject *obj, PyObject *value, void *context)
2143 {
2144     PyObject **dictptr;
2145     PyTypeObject *base;
2146 
2147     base = get_builtin_base_with_dict(Py_TYPE(obj));
2148     if (base != NULL) {
2149         descrsetfunc func;
2150         PyObject *descr = get_dict_descriptor(base);
2151         if (descr == NULL) {
2152             raise_dict_descr_error(obj);
2153             return -1;
2154         }
2155         func = Py_TYPE(descr)->tp_descr_set;
2156         if (func == NULL) {
2157             raise_dict_descr_error(obj);
2158             return -1;
2159         }
2160         return func(descr, obj, value);
2161     }
2162     /* Almost like PyObject_GenericSetDict, but allow __dict__ to be deleted. */
2163     dictptr = _PyObject_GetDictPtr(obj);
2164     if (dictptr == NULL) {
2165         PyErr_SetString(PyExc_AttributeError,
2166                         "This object has no __dict__");
2167         return -1;
2168     }
2169     if (value != NULL && !PyDict_Check(value)) {
2170         PyErr_Format(PyExc_TypeError,
2171                      "__dict__ must be set to a dictionary, "
2172                      "not a '%.200s'", Py_TYPE(value)->tp_name);
2173         return -1;
2174     }
2175     Py_XINCREF(value);
2176     Py_XSETREF(*dictptr, value);
2177     return 0;
2178 }
2179 
2180 static PyObject *
subtype_getweakref(PyObject * obj,void * context)2181 subtype_getweakref(PyObject *obj, void *context)
2182 {
2183     PyObject **weaklistptr;
2184     PyObject *result;
2185     PyTypeObject *type = Py_TYPE(obj);
2186 
2187     if (type->tp_weaklistoffset == 0) {
2188         PyErr_SetString(PyExc_AttributeError,
2189                         "This object has no __weakref__");
2190         return NULL;
2191     }
2192     _PyObject_ASSERT((PyObject *)type,
2193                      type->tp_weaklistoffset > 0);
2194     _PyObject_ASSERT((PyObject *)type,
2195                      ((type->tp_weaklistoffset + sizeof(PyObject *))
2196                       <= (size_t)(type->tp_basicsize)));
2197     weaklistptr = (PyObject **)((char *)obj + type->tp_weaklistoffset);
2198     if (*weaklistptr == NULL)
2199         result = Py_None;
2200     else
2201         result = *weaklistptr;
2202     Py_INCREF(result);
2203     return result;
2204 }
2205 
2206 /* Three variants on the subtype_getsets list. */
2207 
2208 static PyGetSetDef subtype_getsets_full[] = {
2209     {"__dict__", subtype_dict, subtype_setdict,
2210      PyDoc_STR("dictionary for instance variables (if defined)")},
2211     {"__weakref__", subtype_getweakref, NULL,
2212      PyDoc_STR("list of weak references to the object (if defined)")},
2213     {0}
2214 };
2215 
2216 static PyGetSetDef subtype_getsets_dict_only[] = {
2217     {"__dict__", subtype_dict, subtype_setdict,
2218      PyDoc_STR("dictionary for instance variables (if defined)")},
2219     {0}
2220 };
2221 
2222 static PyGetSetDef subtype_getsets_weakref_only[] = {
2223     {"__weakref__", subtype_getweakref, NULL,
2224      PyDoc_STR("list of weak references to the object (if defined)")},
2225     {0}
2226 };
2227 
2228 static int
valid_identifier(PyObject * s)2229 valid_identifier(PyObject *s)
2230 {
2231     if (!PyUnicode_Check(s)) {
2232         PyErr_Format(PyExc_TypeError,
2233                      "__slots__ items must be strings, not '%.200s'",
2234                      Py_TYPE(s)->tp_name);
2235         return 0;
2236     }
2237     if (!PyUnicode_IsIdentifier(s)) {
2238         PyErr_SetString(PyExc_TypeError,
2239                         "__slots__ must be identifiers");
2240         return 0;
2241     }
2242     return 1;
2243 }
2244 
2245 /* Forward */
2246 static int
2247 object_init(PyObject *self, PyObject *args, PyObject *kwds);
2248 
2249 static int
type_init(PyObject * cls,PyObject * args,PyObject * kwds)2250 type_init(PyObject *cls, PyObject *args, PyObject *kwds)
2251 {
2252     int res;
2253 
2254     assert(args != NULL && PyTuple_Check(args));
2255     assert(kwds == NULL || PyDict_Check(kwds));
2256 
2257     if (kwds != NULL && PyTuple_Check(args) && PyTuple_GET_SIZE(args) == 1 &&
2258         PyDict_Check(kwds) && PyDict_GET_SIZE(kwds) != 0) {
2259         PyErr_SetString(PyExc_TypeError,
2260                         "type.__init__() takes no keyword arguments");
2261         return -1;
2262     }
2263 
2264     if (args != NULL && PyTuple_Check(args) &&
2265         (PyTuple_GET_SIZE(args) != 1 && PyTuple_GET_SIZE(args) != 3)) {
2266         PyErr_SetString(PyExc_TypeError,
2267                         "type.__init__() takes 1 or 3 arguments");
2268         return -1;
2269     }
2270 
2271     /* Call object.__init__(self) now. */
2272     /* XXX Could call super(type, cls).__init__() but what's the point? */
2273     args = PyTuple_GetSlice(args, 0, 0);
2274     if (args == NULL) {
2275         return -1;
2276     }
2277     res = object_init(cls, args, NULL);
2278     Py_DECREF(args);
2279     return res;
2280 }
2281 
2282 unsigned long
PyType_GetFlags(PyTypeObject * type)2283 PyType_GetFlags(PyTypeObject *type)
2284 {
2285     return type->tp_flags;
2286 }
2287 
2288 /* Determine the most derived metatype. */
2289 PyTypeObject *
_PyType_CalculateMetaclass(PyTypeObject * metatype,PyObject * bases)2290 _PyType_CalculateMetaclass(PyTypeObject *metatype, PyObject *bases)
2291 {
2292     Py_ssize_t i, nbases;
2293     PyTypeObject *winner;
2294     PyObject *tmp;
2295     PyTypeObject *tmptype;
2296 
2297     /* Determine the proper metatype to deal with this,
2298        and check for metatype conflicts while we're at it.
2299        Note that if some other metatype wins to contract,
2300        it's possible that its instances are not types. */
2301 
2302     nbases = PyTuple_GET_SIZE(bases);
2303     winner = metatype;
2304     for (i = 0; i < nbases; i++) {
2305         tmp = PyTuple_GET_ITEM(bases, i);
2306         tmptype = Py_TYPE(tmp);
2307         if (PyType_IsSubtype(winner, tmptype))
2308             continue;
2309         if (PyType_IsSubtype(tmptype, winner)) {
2310             winner = tmptype;
2311             continue;
2312         }
2313         /* else: */
2314         PyErr_SetString(PyExc_TypeError,
2315                         "metaclass conflict: "
2316                         "the metaclass of a derived class "
2317                         "must be a (non-strict) subclass "
2318                         "of the metaclasses of all its bases");
2319         return NULL;
2320     }
2321     return winner;
2322 }
2323 
2324 static PyObject *
type_new(PyTypeObject * metatype,PyObject * args,PyObject * kwds)2325 type_new(PyTypeObject *metatype, PyObject *args, PyObject *kwds)
2326 {
2327     PyObject *name, *bases = NULL, *orig_dict, *dict = NULL;
2328     PyObject *qualname, *slots = NULL, *tmp, *newslots, *cell;
2329     PyTypeObject *type = NULL, *base, *tmptype, *winner;
2330     PyHeapTypeObject *et;
2331     PyMemberDef *mp;
2332     Py_ssize_t i, nbases, nslots, slotoffset, name_size;
2333     int j, may_add_dict, may_add_weak, add_dict, add_weak;
2334     _Py_IDENTIFIER(__qualname__);
2335     _Py_IDENTIFIER(__slots__);
2336     _Py_IDENTIFIER(__classcell__);
2337 
2338     assert(args != NULL && PyTuple_Check(args));
2339     assert(kwds == NULL || PyDict_Check(kwds));
2340 
2341     /* Special case: type(x) should return x->ob_type */
2342     /* We only want type itself to accept the one-argument form (#27157)
2343        Note: We don't call PyType_CheckExact as that also allows subclasses */
2344     if (metatype == &PyType_Type) {
2345         const Py_ssize_t nargs = PyTuple_GET_SIZE(args);
2346         const Py_ssize_t nkwds = kwds == NULL ? 0 : PyDict_GET_SIZE(kwds);
2347 
2348         if (nargs == 1 && nkwds == 0) {
2349             PyObject *x = PyTuple_GET_ITEM(args, 0);
2350             Py_INCREF(Py_TYPE(x));
2351             return (PyObject *) Py_TYPE(x);
2352         }
2353 
2354         /* SF bug 475327 -- if that didn't trigger, we need 3
2355            arguments. but PyArg_ParseTuple below may give
2356            a msg saying type() needs exactly 3. */
2357         if (nargs != 3) {
2358             PyErr_SetString(PyExc_TypeError,
2359                             "type() takes 1 or 3 arguments");
2360             return NULL;
2361         }
2362     }
2363 
2364     /* Check arguments: (name, bases, dict) */
2365     if (!PyArg_ParseTuple(args, "UO!O!:type.__new__", &name, &PyTuple_Type,
2366                           &bases, &PyDict_Type, &orig_dict))
2367         return NULL;
2368 
2369     /* Adjust for empty tuple bases */
2370     nbases = PyTuple_GET_SIZE(bases);
2371     if (nbases == 0) {
2372         base = &PyBaseObject_Type;
2373         bases = PyTuple_Pack(1, base);
2374         if (bases == NULL)
2375             return NULL;
2376         nbases = 1;
2377     }
2378     else {
2379         _Py_IDENTIFIER(__mro_entries__);
2380         for (i = 0; i < nbases; i++) {
2381             tmp = PyTuple_GET_ITEM(bases, i);
2382             if (PyType_Check(tmp)) {
2383                 continue;
2384             }
2385             if (_PyObject_LookupAttrId(tmp, &PyId___mro_entries__, &tmp) < 0) {
2386                 return NULL;
2387             }
2388             if (tmp != NULL) {
2389                 PyErr_SetString(PyExc_TypeError,
2390                                 "type() doesn't support MRO entry resolution; "
2391                                 "use types.new_class()");
2392                 Py_DECREF(tmp);
2393                 return NULL;
2394             }
2395         }
2396         /* Search the bases for the proper metatype to deal with this: */
2397         winner = _PyType_CalculateMetaclass(metatype, bases);
2398         if (winner == NULL) {
2399             return NULL;
2400         }
2401 
2402         if (winner != metatype) {
2403             if (winner->tp_new != type_new) /* Pass it to the winner */
2404                 return winner->tp_new(winner, args, kwds);
2405             metatype = winner;
2406         }
2407 
2408         /* Calculate best base, and check that all bases are type objects */
2409         base = best_base(bases);
2410         if (base == NULL) {
2411             return NULL;
2412         }
2413 
2414         Py_INCREF(bases);
2415     }
2416 
2417     /* Use "goto error" from this point on as we now own the reference to "bases". */
2418 
2419     dict = PyDict_Copy(orig_dict);
2420     if (dict == NULL)
2421         goto error;
2422 
2423     /* Check for a __slots__ sequence variable in dict, and count it */
2424     slots = _PyDict_GetItemIdWithError(dict, &PyId___slots__);
2425     nslots = 0;
2426     add_dict = 0;
2427     add_weak = 0;
2428     may_add_dict = base->tp_dictoffset == 0;
2429     may_add_weak = base->tp_weaklistoffset == 0 && base->tp_itemsize == 0;
2430     if (slots == NULL) {
2431         if (PyErr_Occurred()) {
2432             goto error;
2433         }
2434         if (may_add_dict) {
2435             add_dict++;
2436         }
2437         if (may_add_weak) {
2438             add_weak++;
2439         }
2440     }
2441     else {
2442         /* Have slots */
2443 
2444         /* Make it into a tuple */
2445         if (PyUnicode_Check(slots))
2446             slots = PyTuple_Pack(1, slots);
2447         else
2448             slots = PySequence_Tuple(slots);
2449         if (slots == NULL)
2450             goto error;
2451         assert(PyTuple_Check(slots));
2452 
2453         /* Are slots allowed? */
2454         nslots = PyTuple_GET_SIZE(slots);
2455         if (nslots > 0 && base->tp_itemsize != 0) {
2456             PyErr_Format(PyExc_TypeError,
2457                          "nonempty __slots__ "
2458                          "not supported for subtype of '%s'",
2459                          base->tp_name);
2460             goto error;
2461         }
2462 
2463         /* Check for valid slot names and two special cases */
2464         for (i = 0; i < nslots; i++) {
2465             PyObject *tmp = PyTuple_GET_ITEM(slots, i);
2466             if (!valid_identifier(tmp))
2467                 goto error;
2468             assert(PyUnicode_Check(tmp));
2469             if (_PyUnicode_EqualToASCIIId(tmp, &PyId___dict__)) {
2470                 if (!may_add_dict || add_dict) {
2471                     PyErr_SetString(PyExc_TypeError,
2472                         "__dict__ slot disallowed: "
2473                         "we already got one");
2474                     goto error;
2475                 }
2476                 add_dict++;
2477             }
2478             if (_PyUnicode_EqualToASCIIString(tmp, "__weakref__")) {
2479                 if (!may_add_weak || add_weak) {
2480                     PyErr_SetString(PyExc_TypeError,
2481                         "__weakref__ slot disallowed: "
2482                         "either we already got one, "
2483                         "or __itemsize__ != 0");
2484                     goto error;
2485                 }
2486                 add_weak++;
2487             }
2488         }
2489 
2490         /* Copy slots into a list, mangle names and sort them.
2491            Sorted names are needed for __class__ assignment.
2492            Convert them back to tuple at the end.
2493         */
2494         newslots = PyList_New(nslots - add_dict - add_weak);
2495         if (newslots == NULL)
2496             goto error;
2497         for (i = j = 0; i < nslots; i++) {
2498             tmp = PyTuple_GET_ITEM(slots, i);
2499             if ((add_dict &&
2500                  _PyUnicode_EqualToASCIIId(tmp, &PyId___dict__)) ||
2501                 (add_weak &&
2502                  _PyUnicode_EqualToASCIIString(tmp, "__weakref__")))
2503                 continue;
2504             tmp =_Py_Mangle(name, tmp);
2505             if (!tmp) {
2506                 Py_DECREF(newslots);
2507                 goto error;
2508             }
2509             PyList_SET_ITEM(newslots, j, tmp);
2510             if (PyDict_GetItemWithError(dict, tmp)) {
2511                 /* CPython inserts __qualname__ and __classcell__ (when needed)
2512                    into the namespace when creating a class.  They will be deleted
2513                    below so won't act as class variables. */
2514                 if (!_PyUnicode_EqualToASCIIId(tmp, &PyId___qualname__) &&
2515                     !_PyUnicode_EqualToASCIIId(tmp, &PyId___classcell__)) {
2516                     PyErr_Format(PyExc_ValueError,
2517                                  "%R in __slots__ conflicts with class variable",
2518                                  tmp);
2519                     Py_DECREF(newslots);
2520                     goto error;
2521                 }
2522             }
2523             else if (PyErr_Occurred()) {
2524                 Py_DECREF(newslots);
2525                 goto error;
2526             }
2527             j++;
2528         }
2529         assert(j == nslots - add_dict - add_weak);
2530         nslots = j;
2531         Py_CLEAR(slots);
2532         if (PyList_Sort(newslots) == -1) {
2533             Py_DECREF(newslots);
2534             goto error;
2535         }
2536         slots = PyList_AsTuple(newslots);
2537         Py_DECREF(newslots);
2538         if (slots == NULL)
2539             goto error;
2540 
2541         /* Secondary bases may provide weakrefs or dict */
2542         if (nbases > 1 &&
2543             ((may_add_dict && !add_dict) ||
2544              (may_add_weak && !add_weak))) {
2545             for (i = 0; i < nbases; i++) {
2546                 tmp = PyTuple_GET_ITEM(bases, i);
2547                 if (tmp == (PyObject *)base)
2548                     continue; /* Skip primary base */
2549                 assert(PyType_Check(tmp));
2550                 tmptype = (PyTypeObject *)tmp;
2551                 if (may_add_dict && !add_dict &&
2552                     tmptype->tp_dictoffset != 0)
2553                     add_dict++;
2554                 if (may_add_weak && !add_weak &&
2555                     tmptype->tp_weaklistoffset != 0)
2556                     add_weak++;
2557                 if (may_add_dict && !add_dict)
2558                     continue;
2559                 if (may_add_weak && !add_weak)
2560                     continue;
2561                 /* Nothing more to check */
2562                 break;
2563             }
2564         }
2565     }
2566 
2567     /* Allocate the type object */
2568     type = (PyTypeObject *)metatype->tp_alloc(metatype, nslots);
2569     if (type == NULL)
2570         goto error;
2571 
2572     /* Keep name and slots alive in the extended type object */
2573     et = (PyHeapTypeObject *)type;
2574     Py_INCREF(name);
2575     et->ht_name = name;
2576     et->ht_slots = slots;
2577     slots = NULL;
2578 
2579     /* Initialize tp_flags */
2580     // All heap types need GC, since we can create a reference cycle by storing
2581     // an instance on one of its parents:
2582     type->tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HEAPTYPE |
2583         Py_TPFLAGS_BASETYPE | Py_TPFLAGS_HAVE_GC;
2584 
2585     /* Initialize essential fields */
2586     type->tp_as_async = &et->as_async;
2587     type->tp_as_number = &et->as_number;
2588     type->tp_as_sequence = &et->as_sequence;
2589     type->tp_as_mapping = &et->as_mapping;
2590     type->tp_as_buffer = &et->as_buffer;
2591     type->tp_name = PyUnicode_AsUTF8AndSize(name, &name_size);
2592     if (!type->tp_name)
2593         goto error;
2594     if (strlen(type->tp_name) != (size_t)name_size) {
2595         PyErr_SetString(PyExc_ValueError,
2596                         "type name must not contain null characters");
2597         goto error;
2598     }
2599 
2600     /* Set tp_base and tp_bases */
2601     type->tp_bases = bases;
2602     bases = NULL;
2603     Py_INCREF(base);
2604     type->tp_base = base;
2605 
2606     /* Initialize tp_dict from passed-in dict */
2607     Py_INCREF(dict);
2608     type->tp_dict = dict;
2609 
2610     /* Set __module__ in the dict */
2611     if (_PyDict_GetItemIdWithError(dict, &PyId___module__) == NULL) {
2612         if (PyErr_Occurred()) {
2613             goto error;
2614         }
2615         tmp = PyEval_GetGlobals();
2616         if (tmp != NULL) {
2617             tmp = _PyDict_GetItemIdWithError(tmp, &PyId___name__);
2618             if (tmp != NULL) {
2619                 if (_PyDict_SetItemId(dict, &PyId___module__,
2620                                       tmp) < 0)
2621                     goto error;
2622             }
2623             else if (PyErr_Occurred()) {
2624                 goto error;
2625             }
2626         }
2627     }
2628 
2629     /* Set ht_qualname to dict['__qualname__'] if available, else to
2630        __name__.  The __qualname__ accessor will look for ht_qualname.
2631     */
2632     qualname = _PyDict_GetItemIdWithError(dict, &PyId___qualname__);
2633     if (qualname != NULL) {
2634         if (!PyUnicode_Check(qualname)) {
2635             PyErr_Format(PyExc_TypeError,
2636                          "type __qualname__ must be a str, not %s",
2637                          Py_TYPE(qualname)->tp_name);
2638             goto error;
2639         }
2640     }
2641     else if (PyErr_Occurred()) {
2642         goto error;
2643     }
2644     et->ht_qualname = qualname ? qualname : et->ht_name;
2645     Py_INCREF(et->ht_qualname);
2646     if (qualname != NULL && _PyDict_DelItemId(dict, &PyId___qualname__) < 0)
2647         goto error;
2648 
2649     /* Set tp_doc to a copy of dict['__doc__'], if the latter is there
2650        and is a string.  The __doc__ accessor will first look for tp_doc;
2651        if that fails, it will still look into __dict__.
2652     */
2653     {
2654         PyObject *doc = _PyDict_GetItemIdWithError(dict, &PyId___doc__);
2655         if (doc != NULL && PyUnicode_Check(doc)) {
2656             Py_ssize_t len;
2657             const char *doc_str;
2658             char *tp_doc;
2659 
2660             doc_str = PyUnicode_AsUTF8(doc);
2661             if (doc_str == NULL)
2662                 goto error;
2663             /* Silently truncate the docstring if it contains null bytes. */
2664             len = strlen(doc_str);
2665             tp_doc = (char *)PyObject_MALLOC(len + 1);
2666             if (tp_doc == NULL) {
2667                 PyErr_NoMemory();
2668                 goto error;
2669             }
2670             memcpy(tp_doc, doc_str, len + 1);
2671             type->tp_doc = tp_doc;
2672         }
2673         else if (doc == NULL && PyErr_Occurred()) {
2674             goto error;
2675         }
2676     }
2677 
2678     /* Special-case __new__: if it's a plain function,
2679        make it a static function */
2680     tmp = _PyDict_GetItemIdWithError(dict, &PyId___new__);
2681     if (tmp != NULL && PyFunction_Check(tmp)) {
2682         tmp = PyStaticMethod_New(tmp);
2683         if (tmp == NULL)
2684             goto error;
2685         if (_PyDict_SetItemId(dict, &PyId___new__, tmp) < 0) {
2686             Py_DECREF(tmp);
2687             goto error;
2688         }
2689         Py_DECREF(tmp);
2690     }
2691     else if (tmp == NULL && PyErr_Occurred()) {
2692         goto error;
2693     }
2694 
2695     /* Special-case __init_subclass__ and __class_getitem__:
2696        if they are plain functions, make them classmethods */
2697     tmp = _PyDict_GetItemIdWithError(dict, &PyId___init_subclass__);
2698     if (tmp != NULL && PyFunction_Check(tmp)) {
2699         tmp = PyClassMethod_New(tmp);
2700         if (tmp == NULL)
2701             goto error;
2702         if (_PyDict_SetItemId(dict, &PyId___init_subclass__, tmp) < 0) {
2703             Py_DECREF(tmp);
2704             goto error;
2705         }
2706         Py_DECREF(tmp);
2707     }
2708     else if (tmp == NULL && PyErr_Occurred()) {
2709         goto error;
2710     }
2711 
2712     tmp = _PyDict_GetItemIdWithError(dict, &PyId___class_getitem__);
2713     if (tmp != NULL && PyFunction_Check(tmp)) {
2714         tmp = PyClassMethod_New(tmp);
2715         if (tmp == NULL)
2716             goto error;
2717         if (_PyDict_SetItemId(dict, &PyId___class_getitem__, tmp) < 0) {
2718             Py_DECREF(tmp);
2719             goto error;
2720         }
2721         Py_DECREF(tmp);
2722     }
2723     else if (tmp == NULL && PyErr_Occurred()) {
2724         goto error;
2725     }
2726 
2727     /* Add descriptors for custom slots from __slots__, or for __dict__ */
2728     mp = PyHeapType_GET_MEMBERS(et);
2729     slotoffset = base->tp_basicsize;
2730     if (et->ht_slots != NULL) {
2731         for (i = 0; i < nslots; i++, mp++) {
2732             mp->name = PyUnicode_AsUTF8(
2733                 PyTuple_GET_ITEM(et->ht_slots, i));
2734             if (mp->name == NULL)
2735                 goto error;
2736             mp->type = T_OBJECT_EX;
2737             mp->offset = slotoffset;
2738 
2739             /* __dict__ and __weakref__ are already filtered out */
2740             assert(strcmp(mp->name, "__dict__") != 0);
2741             assert(strcmp(mp->name, "__weakref__") != 0);
2742 
2743             slotoffset += sizeof(PyObject *);
2744         }
2745     }
2746     if (add_dict) {
2747         if (base->tp_itemsize)
2748             type->tp_dictoffset = -(long)sizeof(PyObject *);
2749         else
2750             type->tp_dictoffset = slotoffset;
2751         slotoffset += sizeof(PyObject *);
2752     }
2753     if (add_weak) {
2754         assert(!base->tp_itemsize);
2755         type->tp_weaklistoffset = slotoffset;
2756         slotoffset += sizeof(PyObject *);
2757     }
2758     type->tp_basicsize = slotoffset;
2759     type->tp_itemsize = base->tp_itemsize;
2760     type->tp_members = PyHeapType_GET_MEMBERS(et);
2761 
2762     if (type->tp_weaklistoffset && type->tp_dictoffset)
2763         type->tp_getset = subtype_getsets_full;
2764     else if (type->tp_weaklistoffset && !type->tp_dictoffset)
2765         type->tp_getset = subtype_getsets_weakref_only;
2766     else if (!type->tp_weaklistoffset && type->tp_dictoffset)
2767         type->tp_getset = subtype_getsets_dict_only;
2768     else
2769         type->tp_getset = NULL;
2770 
2771     /* Special case some slots */
2772     if (type->tp_dictoffset != 0 || nslots > 0) {
2773         if (base->tp_getattr == NULL && base->tp_getattro == NULL)
2774             type->tp_getattro = PyObject_GenericGetAttr;
2775         if (base->tp_setattr == NULL && base->tp_setattro == NULL)
2776             type->tp_setattro = PyObject_GenericSetAttr;
2777     }
2778     type->tp_dealloc = subtype_dealloc;
2779 
2780     /* Always override allocation strategy to use regular heap */
2781     type->tp_alloc = PyType_GenericAlloc;
2782     type->tp_free = PyObject_GC_Del;
2783     type->tp_traverse = subtype_traverse;
2784     type->tp_clear = subtype_clear;
2785 
2786     /* store type in class' cell if one is supplied */
2787     cell = _PyDict_GetItemIdWithError(dict, &PyId___classcell__);
2788     if (cell != NULL) {
2789         /* At least one method requires a reference to its defining class */
2790         if (!PyCell_Check(cell)) {
2791             PyErr_Format(PyExc_TypeError,
2792                          "__classcell__ must be a nonlocal cell, not %.200R",
2793                          Py_TYPE(cell));
2794             goto error;
2795         }
2796         PyCell_Set(cell, (PyObject *) type);
2797         if (_PyDict_DelItemId(dict, &PyId___classcell__) < 0) {
2798             goto error;
2799         }
2800     }
2801     else if (PyErr_Occurred()) {
2802         goto error;
2803     }
2804 
2805     /* Initialize the rest */
2806     if (PyType_Ready(type) < 0)
2807         goto error;
2808 
2809     /* Put the proper slots in place */
2810     fixup_slot_dispatchers(type);
2811 
2812     if (type->tp_dictoffset) {
2813         et->ht_cached_keys = _PyDict_NewKeysForClass();
2814     }
2815 
2816     if (set_names(type) < 0)
2817         goto error;
2818 
2819     if (init_subclass(type, kwds) < 0)
2820         goto error;
2821 
2822     Py_DECREF(dict);
2823     return (PyObject *)type;
2824 
2825 error:
2826     Py_XDECREF(dict);
2827     Py_XDECREF(bases);
2828     Py_XDECREF(slots);
2829     Py_XDECREF(type);
2830     return NULL;
2831 }
2832 
2833 static const short slotoffsets[] = {
2834     -1, /* invalid slot */
2835 #include "typeslots.inc"
2836 };
2837 
2838 PyObject *
PyType_FromSpecWithBases(PyType_Spec * spec,PyObject * bases)2839 PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
2840 {
2841     PyHeapTypeObject *res;
2842     PyMemberDef *memb;
2843     PyObject *modname;
2844     PyTypeObject *type, *base;
2845 
2846     PyType_Slot *slot;
2847     Py_ssize_t nmembers;
2848     char *s, *res_start;
2849 
2850     nmembers = 0;
2851     for (slot = spec->slots; slot->slot; slot++) {
2852         if (slot->slot == Py_tp_members) {
2853             nmembers = 0;
2854             for (memb = slot->pfunc; memb->name != NULL; memb++) {
2855                 nmembers++;
2856             }
2857         }
2858     }
2859 
2860     res = (PyHeapTypeObject*)PyType_GenericAlloc(&PyType_Type, nmembers);
2861     if (res == NULL)
2862         return NULL;
2863     res_start = (char*)res;
2864 
2865     if (spec->name == NULL) {
2866         PyErr_SetString(PyExc_SystemError,
2867                         "Type spec does not define the name field.");
2868         goto fail;
2869     }
2870 
2871     /* Set the type name and qualname */
2872     s = strrchr(spec->name, '.');
2873     if (s == NULL)
2874         s = (char*)spec->name;
2875     else
2876         s++;
2877 
2878     type = &res->ht_type;
2879     /* The flags must be initialized early, before the GC traverses us */
2880     type->tp_flags = spec->flags | Py_TPFLAGS_HEAPTYPE;
2881     res->ht_name = PyUnicode_FromString(s);
2882     if (!res->ht_name)
2883         goto fail;
2884     res->ht_qualname = res->ht_name;
2885     Py_INCREF(res->ht_qualname);
2886     type->tp_name = spec->name;
2887 
2888     /* Adjust for empty tuple bases */
2889     if (!bases) {
2890         base = &PyBaseObject_Type;
2891         /* See whether Py_tp_base(s) was specified */
2892         for (slot = spec->slots; slot->slot; slot++) {
2893             if (slot->slot == Py_tp_base)
2894                 base = slot->pfunc;
2895             else if (slot->slot == Py_tp_bases) {
2896                 bases = slot->pfunc;
2897             }
2898         }
2899         if (!bases) {
2900             bases = PyTuple_Pack(1, base);
2901             if (!bases)
2902                 goto fail;
2903         }
2904         else if (!PyTuple_Check(bases)) {
2905             PyErr_SetString(PyExc_SystemError, "Py_tp_bases is not a tuple");
2906             goto fail;
2907         }
2908         else {
2909             Py_INCREF(bases);
2910         }
2911     }
2912     else if (!PyTuple_Check(bases)) {
2913         PyErr_SetString(PyExc_SystemError, "bases is not a tuple");
2914         goto fail;
2915     }
2916     else {
2917         Py_INCREF(bases);
2918     }
2919 
2920     /* Calculate best base, and check that all bases are type objects */
2921     base = best_base(bases);
2922     if (base == NULL) {
2923         Py_DECREF(bases);
2924         goto fail;
2925     }
2926     if (!PyType_HasFeature(base, Py_TPFLAGS_BASETYPE)) {
2927         PyErr_Format(PyExc_TypeError,
2928                      "type '%.100s' is not an acceptable base type",
2929                      base->tp_name);
2930         Py_DECREF(bases);
2931         goto fail;
2932     }
2933 
2934     /* Initialize essential fields */
2935     type->tp_as_async = &res->as_async;
2936     type->tp_as_number = &res->as_number;
2937     type->tp_as_sequence = &res->as_sequence;
2938     type->tp_as_mapping = &res->as_mapping;
2939     type->tp_as_buffer = &res->as_buffer;
2940     /* Set tp_base and tp_bases */
2941     type->tp_bases = bases;
2942     Py_INCREF(base);
2943     type->tp_base = base;
2944 
2945     type->tp_basicsize = spec->basicsize;
2946     type->tp_itemsize = spec->itemsize;
2947 
2948     for (slot = spec->slots; slot->slot; slot++) {
2949         if (slot->slot < 0
2950             || (size_t)slot->slot >= Py_ARRAY_LENGTH(slotoffsets)) {
2951             PyErr_SetString(PyExc_RuntimeError, "invalid slot offset");
2952             goto fail;
2953         }
2954         else if (slot->slot == Py_tp_base || slot->slot == Py_tp_bases) {
2955             /* Processed above */
2956             continue;
2957         }
2958         else if (slot->slot == Py_tp_doc) {
2959             /* For the docstring slot, which usually points to a static string
2960                literal, we need to make a copy */
2961             const char *old_doc = _PyType_DocWithoutSignature(type->tp_name, slot->pfunc);
2962             size_t len = strlen(old_doc)+1;
2963             char *tp_doc = PyObject_MALLOC(len);
2964             if (tp_doc == NULL) {
2965                 type->tp_doc = NULL;
2966                 PyErr_NoMemory();
2967                 goto fail;
2968             }
2969             memcpy(tp_doc, old_doc, len);
2970             type->tp_doc = tp_doc;
2971         }
2972         else if (slot->slot == Py_tp_members) {
2973             /* Move the slots to the heap type itself */
2974             size_t len = Py_TYPE(type)->tp_itemsize * nmembers;
2975             memcpy(PyHeapType_GET_MEMBERS(res), slot->pfunc, len);
2976             type->tp_members = PyHeapType_GET_MEMBERS(res);
2977         }
2978         else {
2979             /* Copy other slots directly */
2980             *(void**)(res_start + slotoffsets[slot->slot]) = slot->pfunc;
2981         }
2982     }
2983     if (type->tp_dealloc == NULL) {
2984         /* It's a heap type, so needs the heap types' dealloc.
2985            subtype_dealloc will call the base type's tp_dealloc, if
2986            necessary. */
2987         type->tp_dealloc = subtype_dealloc;
2988     }
2989 
2990     if (PyType_Ready(type) < 0)
2991         goto fail;
2992 
2993     if (type->tp_dictoffset) {
2994         res->ht_cached_keys = _PyDict_NewKeysForClass();
2995     }
2996 
2997     /* Set type.__module__ */
2998     s = strrchr(spec->name, '.');
2999     if (s != NULL) {
3000         int err;
3001         modname = PyUnicode_FromStringAndSize(
3002                 spec->name, (Py_ssize_t)(s - spec->name));
3003         if (modname == NULL) {
3004             goto fail;
3005         }
3006         err = _PyDict_SetItemId(type->tp_dict, &PyId___module__, modname);
3007         Py_DECREF(modname);
3008         if (err != 0)
3009             goto fail;
3010     } else {
3011         if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
3012                 "builtin type %.200s has no __module__ attribute",
3013                 spec->name))
3014             goto fail;
3015     }
3016 
3017     return (PyObject*)res;
3018 
3019  fail:
3020     Py_DECREF(res);
3021     return NULL;
3022 }
3023 
3024 PyObject *
PyType_FromSpec(PyType_Spec * spec)3025 PyType_FromSpec(PyType_Spec *spec)
3026 {
3027     return PyType_FromSpecWithBases(spec, NULL);
3028 }
3029 
3030 void *
PyType_GetSlot(PyTypeObject * type,int slot)3031 PyType_GetSlot(PyTypeObject *type, int slot)
3032 {
3033     if (!PyType_HasFeature(type, Py_TPFLAGS_HEAPTYPE) || slot < 0) {
3034         PyErr_BadInternalCall();
3035         return NULL;
3036     }
3037     if ((size_t)slot >= Py_ARRAY_LENGTH(slotoffsets)) {
3038         /* Extension module requesting slot from a future version */
3039         return NULL;
3040     }
3041     return  *(void**)(((char*)type) + slotoffsets[slot]);
3042 }
3043 
3044 /* Internal API to look for a name through the MRO, bypassing the method cache.
3045    This returns a borrowed reference, and might set an exception.
3046    'error' is set to: -1: error with exception; 1: error without exception; 0: ok */
3047 static PyObject *
find_name_in_mro(PyTypeObject * type,PyObject * name,int * error)3048 find_name_in_mro(PyTypeObject *type, PyObject *name, int *error)
3049 {
3050     Py_ssize_t i, n;
3051     PyObject *mro, *res, *base, *dict;
3052     Py_hash_t hash;
3053 
3054     if (!PyUnicode_CheckExact(name) ||
3055         (hash = ((PyASCIIObject *) name)->hash) == -1)
3056     {
3057         hash = PyObject_Hash(name);
3058         if (hash == -1) {
3059             *error = -1;
3060             return NULL;
3061         }
3062     }
3063 
3064     /* Look in tp_dict of types in MRO */
3065     mro = type->tp_mro;
3066 
3067     if (mro == NULL) {
3068         if ((type->tp_flags & Py_TPFLAGS_READYING) == 0) {
3069             if (PyType_Ready(type) < 0) {
3070                 *error = -1;
3071                 return NULL;
3072             }
3073             mro = type->tp_mro;
3074         }
3075         if (mro == NULL) {
3076             *error = 1;
3077             return NULL;
3078         }
3079     }
3080 
3081     res = NULL;
3082     /* Keep a strong reference to mro because type->tp_mro can be replaced
3083        during dict lookup, e.g. when comparing to non-string keys. */
3084     Py_INCREF(mro);
3085     assert(PyTuple_Check(mro));
3086     n = PyTuple_GET_SIZE(mro);
3087     for (i = 0; i < n; i++) {
3088         base = PyTuple_GET_ITEM(mro, i);
3089         assert(PyType_Check(base));
3090         dict = ((PyTypeObject *)base)->tp_dict;
3091         assert(dict && PyDict_Check(dict));
3092         res = _PyDict_GetItem_KnownHash(dict, name, hash);
3093         if (res != NULL)
3094             break;
3095         if (PyErr_Occurred()) {
3096             *error = -1;
3097             goto done;
3098         }
3099     }
3100     *error = 0;
3101 done:
3102     Py_DECREF(mro);
3103     return res;
3104 }
3105 
3106 /* Internal API to look for a name through the MRO.
3107    This returns a borrowed reference, and doesn't set an exception! */
3108 PyObject *
_PyType_Lookup(PyTypeObject * type,PyObject * name)3109 _PyType_Lookup(PyTypeObject *type, PyObject *name)
3110 {
3111     PyObject *res;
3112     int error;
3113     unsigned int h;
3114 
3115     if (MCACHE_CACHEABLE_NAME(name) &&
3116         PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG)) {
3117         /* fast path */
3118         h = MCACHE_HASH_METHOD(type, name);
3119         if (method_cache[h].version == type->tp_version_tag &&
3120             method_cache[h].name == name) {
3121 #if MCACHE_STATS
3122             method_cache_hits++;
3123 #endif
3124             return method_cache[h].value;
3125         }
3126     }
3127 
3128     /* We may end up clearing live exceptions below, so make sure it's ours. */
3129     assert(!PyErr_Occurred());
3130 
3131     res = find_name_in_mro(type, name, &error);
3132     /* Only put NULL results into cache if there was no error. */
3133     if (error) {
3134         /* It's not ideal to clear the error condition,
3135            but this function is documented as not setting
3136            an exception, and I don't want to change that.
3137            E.g., when PyType_Ready() can't proceed, it won't
3138            set the "ready" flag, so future attempts to ready
3139            the same type will call it again -- hopefully
3140            in a context that propagates the exception out.
3141         */
3142         if (error == -1) {
3143             PyErr_Clear();
3144         }
3145         return NULL;
3146     }
3147 
3148     if (MCACHE_CACHEABLE_NAME(name) && assign_version_tag(type)) {
3149         h = MCACHE_HASH_METHOD(type, name);
3150         method_cache[h].version = type->tp_version_tag;
3151         method_cache[h].value = res;  /* borrowed */
3152         Py_INCREF(name);
3153         assert(((PyASCIIObject *)(name))->hash != -1);
3154 #if MCACHE_STATS
3155         if (method_cache[h].name != Py_None && method_cache[h].name != name)
3156             method_cache_collisions++;
3157         else
3158             method_cache_misses++;
3159 #endif
3160         Py_SETREF(method_cache[h].name, name);
3161     }
3162     return res;
3163 }
3164 
3165 PyObject *
_PyType_LookupId(PyTypeObject * type,struct _Py_Identifier * name)3166 _PyType_LookupId(PyTypeObject *type, struct _Py_Identifier *name)
3167 {
3168     PyObject *oname;
3169     oname = _PyUnicode_FromId(name);   /* borrowed */
3170     if (oname == NULL)
3171         return NULL;
3172     return _PyType_Lookup(type, oname);
3173 }
3174 
3175 /* Check if the "readied" PyUnicode name
3176    is a double-underscore special name. */
3177 static int
is_dunder_name(PyObject * name)3178 is_dunder_name(PyObject *name)
3179 {
3180     Py_ssize_t length = PyUnicode_GET_LENGTH(name);
3181     int kind = PyUnicode_KIND(name);
3182     /* Special names contain at least "__x__" and are always ASCII. */
3183     if (length > 4 && kind == PyUnicode_1BYTE_KIND) {
3184         Py_UCS1 *characters = PyUnicode_1BYTE_DATA(name);
3185         return (
3186             ((characters[length-2] == '_') && (characters[length-1] == '_')) &&
3187             ((characters[0] == '_') && (characters[1] == '_'))
3188         );
3189     }
3190     return 0;
3191 }
3192 
3193 /* This is similar to PyObject_GenericGetAttr(),
3194    but uses _PyType_Lookup() instead of just looking in type->tp_dict. */
3195 static PyObject *
type_getattro(PyTypeObject * type,PyObject * name)3196 type_getattro(PyTypeObject *type, PyObject *name)
3197 {
3198     PyTypeObject *metatype = Py_TYPE(type);
3199     PyObject *meta_attribute, *attribute;
3200     descrgetfunc meta_get;
3201     PyObject* res;
3202 
3203     if (!PyUnicode_Check(name)) {
3204         PyErr_Format(PyExc_TypeError,
3205                      "attribute name must be string, not '%.200s'",
3206                      name->ob_type->tp_name);
3207         return NULL;
3208     }
3209 
3210     /* Initialize this type (we'll assume the metatype is initialized) */
3211     if (type->tp_dict == NULL) {
3212         if (PyType_Ready(type) < 0)
3213             return NULL;
3214     }
3215 
3216     /* No readable descriptor found yet */
3217     meta_get = NULL;
3218 
3219     /* Look for the attribute in the metatype */
3220     meta_attribute = _PyType_Lookup(metatype, name);
3221 
3222     if (meta_attribute != NULL) {
3223         Py_INCREF(meta_attribute);
3224         meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
3225 
3226         if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
3227             /* Data descriptors implement tp_descr_set to intercept
3228              * writes. Assume the attribute is not overridden in
3229              * type's tp_dict (and bases): call the descriptor now.
3230              */
3231             res = meta_get(meta_attribute, (PyObject *)type,
3232                            (PyObject *)metatype);
3233             Py_DECREF(meta_attribute);
3234             return res;
3235         }
3236     }
3237 
3238     /* No data descriptor found on metatype. Look in tp_dict of this
3239      * type and its bases */
3240     attribute = _PyType_Lookup(type, name);
3241     if (attribute != NULL) {
3242         /* Implement descriptor functionality, if any */
3243         Py_INCREF(attribute);
3244         descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
3245 
3246         Py_XDECREF(meta_attribute);
3247 
3248         if (local_get != NULL) {
3249             /* NULL 2nd argument indicates the descriptor was
3250              * found on the target object itself (or a base)  */
3251             res = local_get(attribute, (PyObject *)NULL,
3252                             (PyObject *)type);
3253             Py_DECREF(attribute);
3254             return res;
3255         }
3256 
3257         return attribute;
3258     }
3259 
3260     /* No attribute found in local __dict__ (or bases): use the
3261      * descriptor from the metatype, if any */
3262     if (meta_get != NULL) {
3263         PyObject *res;
3264         res = meta_get(meta_attribute, (PyObject *)type,
3265                        (PyObject *)metatype);
3266         Py_DECREF(meta_attribute);
3267         return res;
3268     }
3269 
3270     /* If an ordinary attribute was found on the metatype, return it now */
3271     if (meta_attribute != NULL) {
3272         return meta_attribute;
3273     }
3274 
3275     /* Give up */
3276     PyErr_Format(PyExc_AttributeError,
3277                  "type object '%.50s' has no attribute '%U'",
3278                  type->tp_name, name);
3279     return NULL;
3280 }
3281 
3282 static int
type_setattro(PyTypeObject * type,PyObject * name,PyObject * value)3283 type_setattro(PyTypeObject *type, PyObject *name, PyObject *value)
3284 {
3285     int res;
3286     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
3287         PyErr_Format(
3288             PyExc_TypeError,
3289             "can't set attributes of built-in/extension type '%s'",
3290             type->tp_name);
3291         return -1;
3292     }
3293     if (PyUnicode_Check(name)) {
3294         if (PyUnicode_CheckExact(name)) {
3295             if (PyUnicode_READY(name) == -1)
3296                 return -1;
3297             Py_INCREF(name);
3298         }
3299         else {
3300             name = _PyUnicode_Copy(name);
3301             if (name == NULL)
3302                 return -1;
3303         }
3304         if (!PyUnicode_CHECK_INTERNED(name)) {
3305             PyUnicode_InternInPlace(&name);
3306             if (!PyUnicode_CHECK_INTERNED(name)) {
3307                 PyErr_SetString(PyExc_MemoryError,
3308                                 "Out of memory interning an attribute name");
3309                 Py_DECREF(name);
3310                 return -1;
3311             }
3312         }
3313     }
3314     else {
3315         /* Will fail in _PyObject_GenericSetAttrWithDict. */
3316         Py_INCREF(name);
3317     }
3318     res = _PyObject_GenericSetAttrWithDict((PyObject *)type, name, value, NULL);
3319     if (res == 0) {
3320         /* Clear the VALID_VERSION flag of 'type' and all its
3321            subclasses.  This could possibly be unified with the
3322            update_subclasses() recursion in update_slot(), but carefully:
3323            they each have their own conditions on which to stop
3324            recursing into subclasses. */
3325         PyType_Modified(type);
3326 
3327         if (is_dunder_name(name)) {
3328             res = update_slot(type, name);
3329         }
3330         assert(_PyType_CheckConsistency(type));
3331     }
3332     Py_DECREF(name);
3333     return res;
3334 }
3335 
3336 extern void
3337 _PyDictKeys_DecRef(PyDictKeysObject *keys);
3338 
3339 static void
type_dealloc(PyTypeObject * type)3340 type_dealloc(PyTypeObject *type)
3341 {
3342     PyHeapTypeObject *et;
3343     PyObject *tp, *val, *tb;
3344 
3345     /* Assert this is a heap-allocated type object */
3346     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
3347     _PyObject_GC_UNTRACK(type);
3348     PyErr_Fetch(&tp, &val, &tb);
3349     remove_all_subclasses(type, type->tp_bases);
3350     PyErr_Restore(tp, val, tb);
3351     PyObject_ClearWeakRefs((PyObject *)type);
3352     et = (PyHeapTypeObject *)type;
3353     Py_XDECREF(type->tp_base);
3354     Py_XDECREF(type->tp_dict);
3355     Py_XDECREF(type->tp_bases);
3356     Py_XDECREF(type->tp_mro);
3357     Py_XDECREF(type->tp_cache);
3358     Py_XDECREF(type->tp_subclasses);
3359     /* A type's tp_doc is heap allocated, unlike the tp_doc slots
3360      * of most other objects.  It's okay to cast it to char *.
3361      */
3362     PyObject_Free((char *)type->tp_doc);
3363     Py_XDECREF(et->ht_name);
3364     Py_XDECREF(et->ht_qualname);
3365     Py_XDECREF(et->ht_slots);
3366     if (et->ht_cached_keys)
3367         _PyDictKeys_DecRef(et->ht_cached_keys);
3368     Py_TYPE(type)->tp_free((PyObject *)type);
3369 }
3370 
3371 /*[clinic input]
3372 type.__subclasses__
3373 
3374 Return a list of immediate subclasses.
3375 [clinic start generated code]*/
3376 
3377 static PyObject *
type___subclasses___impl(PyTypeObject * self)3378 type___subclasses___impl(PyTypeObject *self)
3379 /*[clinic end generated code: output=eb5eb54485942819 input=5af66132436f9a7b]*/
3380 {
3381     PyObject *list, *raw, *ref;
3382     Py_ssize_t i;
3383 
3384     list = PyList_New(0);
3385     if (list == NULL)
3386         return NULL;
3387     raw = self->tp_subclasses;
3388     if (raw == NULL)
3389         return list;
3390     assert(PyDict_CheckExact(raw));
3391     i = 0;
3392     while (PyDict_Next(raw, &i, NULL, &ref)) {
3393         assert(PyWeakref_CheckRef(ref));
3394         ref = PyWeakref_GET_OBJECT(ref);
3395         if (ref != Py_None) {
3396             if (PyList_Append(list, ref) < 0) {
3397                 Py_DECREF(list);
3398                 return NULL;
3399             }
3400         }
3401     }
3402     return list;
3403 }
3404 
3405 static PyObject *
type_prepare(PyObject * self,PyObject * const * args,Py_ssize_t nargs,PyObject * kwnames)3406 type_prepare(PyObject *self, PyObject *const *args, Py_ssize_t nargs,
3407              PyObject *kwnames)
3408 {
3409     return PyDict_New();
3410 }
3411 
3412 /*
3413    Merge the __dict__ of aclass into dict, and recursively also all
3414    the __dict__s of aclass's base classes.  The order of merging isn't
3415    defined, as it's expected that only the final set of dict keys is
3416    interesting.
3417    Return 0 on success, -1 on error.
3418 */
3419 
3420 static int
merge_class_dict(PyObject * dict,PyObject * aclass)3421 merge_class_dict(PyObject *dict, PyObject *aclass)
3422 {
3423     PyObject *classdict;
3424     PyObject *bases;
3425     _Py_IDENTIFIER(__bases__);
3426 
3427     assert(PyDict_Check(dict));
3428     assert(aclass);
3429 
3430     /* Merge in the type's dict (if any). */
3431     if (_PyObject_LookupAttrId(aclass, &PyId___dict__, &classdict) < 0) {
3432         return -1;
3433     }
3434     if (classdict != NULL) {
3435         int status = PyDict_Update(dict, classdict);
3436         Py_DECREF(classdict);
3437         if (status < 0)
3438             return -1;
3439     }
3440 
3441     /* Recursively merge in the base types' (if any) dicts. */
3442     if (_PyObject_LookupAttrId(aclass, &PyId___bases__, &bases) < 0) {
3443         return -1;
3444     }
3445     if (bases != NULL) {
3446         /* We have no guarantee that bases is a real tuple */
3447         Py_ssize_t i, n;
3448         n = PySequence_Size(bases); /* This better be right */
3449         if (n < 0) {
3450             Py_DECREF(bases);
3451             return -1;
3452         }
3453         else {
3454             for (i = 0; i < n; i++) {
3455                 int status;
3456                 PyObject *base = PySequence_GetItem(bases, i);
3457                 if (base == NULL) {
3458                     Py_DECREF(bases);
3459                     return -1;
3460                 }
3461                 status = merge_class_dict(dict, base);
3462                 Py_DECREF(base);
3463                 if (status < 0) {
3464                     Py_DECREF(bases);
3465                     return -1;
3466                 }
3467             }
3468         }
3469         Py_DECREF(bases);
3470     }
3471     return 0;
3472 }
3473 
3474 /* __dir__ for type objects: returns __dict__ and __bases__.
3475    We deliberately don't suck up its __class__, as methods belonging to the
3476    metaclass would probably be more confusing than helpful.
3477 */
3478 /*[clinic input]
3479 type.__dir__
3480 
3481 Specialized __dir__ implementation for types.
3482 [clinic start generated code]*/
3483 
3484 static PyObject *
type___dir___impl(PyTypeObject * self)3485 type___dir___impl(PyTypeObject *self)
3486 /*[clinic end generated code: output=69d02fe92c0f15fa input=7733befbec645968]*/
3487 {
3488     PyObject *result = NULL;
3489     PyObject *dict = PyDict_New();
3490 
3491     if (dict != NULL && merge_class_dict(dict, (PyObject *)self) == 0)
3492         result = PyDict_Keys(dict);
3493 
3494     Py_XDECREF(dict);
3495     return result;
3496 }
3497 
3498 /*[clinic input]
3499 type.__sizeof__
3500 
3501 Return memory consumption of the type object.
3502 [clinic start generated code]*/
3503 
3504 static PyObject *
type___sizeof___impl(PyTypeObject * self)3505 type___sizeof___impl(PyTypeObject *self)
3506 /*[clinic end generated code: output=766f4f16cd3b1854 input=99398f24b9cf45d6]*/
3507 {
3508     Py_ssize_t size;
3509     if (self->tp_flags & Py_TPFLAGS_HEAPTYPE) {
3510         PyHeapTypeObject* et = (PyHeapTypeObject*)self;
3511         size = sizeof(PyHeapTypeObject);
3512         if (et->ht_cached_keys)
3513             size += _PyDict_KeysSize(et->ht_cached_keys);
3514     }
3515     else
3516         size = sizeof(PyTypeObject);
3517     return PyLong_FromSsize_t(size);
3518 }
3519 
3520 static PyMethodDef type_methods[] = {
3521     TYPE_MRO_METHODDEF
3522     TYPE___SUBCLASSES___METHODDEF
3523     {"__prepare__", (PyCFunction)(void(*)(void))type_prepare,
3524      METH_FASTCALL | METH_KEYWORDS | METH_CLASS,
3525      PyDoc_STR("__prepare__() -> dict\n"
3526                "used to create the namespace for the class statement")},
3527     TYPE___INSTANCECHECK___METHODDEF
3528     TYPE___SUBCLASSCHECK___METHODDEF
3529     TYPE___DIR___METHODDEF
3530     TYPE___SIZEOF___METHODDEF
3531     {0}
3532 };
3533 
3534 PyDoc_STRVAR(type_doc,
3535 /* this text signature cannot be accurate yet.  will fix.  --larry */
3536 "type(object_or_name, bases, dict)\n"
3537 "type(object) -> the object's type\n"
3538 "type(name, bases, dict) -> a new type");
3539 
3540 static int
type_traverse(PyTypeObject * type,visitproc visit,void * arg)3541 type_traverse(PyTypeObject *type, visitproc visit, void *arg)
3542 {
3543     /* Because of type_is_gc(), the collector only calls this
3544        for heaptypes. */
3545     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
3546         char msg[200];
3547         sprintf(msg, "type_traverse() called for non-heap type '%.100s'",
3548                 type->tp_name);
3549         Py_FatalError(msg);
3550     }
3551 
3552     Py_VISIT(type->tp_dict);
3553     Py_VISIT(type->tp_cache);
3554     Py_VISIT(type->tp_mro);
3555     Py_VISIT(type->tp_bases);
3556     Py_VISIT(type->tp_base);
3557 
3558     /* There's no need to visit type->tp_subclasses or
3559        ((PyHeapTypeObject *)type)->ht_slots, because they can't be involved
3560        in cycles; tp_subclasses is a list of weak references,
3561        and slots is a tuple of strings. */
3562 
3563     return 0;
3564 }
3565 
3566 static int
type_clear(PyTypeObject * type)3567 type_clear(PyTypeObject *type)
3568 {
3569     PyDictKeysObject *cached_keys;
3570     /* Because of type_is_gc(), the collector only calls this
3571        for heaptypes. */
3572     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
3573 
3574     /* We need to invalidate the method cache carefully before clearing
3575        the dict, so that other objects caught in a reference cycle
3576        don't start calling destroyed methods.
3577 
3578        Otherwise, the only field we need to clear is tp_mro, which is
3579        part of a hard cycle (its first element is the class itself) that
3580        won't be broken otherwise (it's a tuple and tuples don't have a
3581        tp_clear handler).  None of the other fields need to be
3582        cleared, and here's why:
3583 
3584        tp_cache:
3585            Not used; if it were, it would be a dict.
3586 
3587        tp_bases, tp_base:
3588            If these are involved in a cycle, there must be at least
3589            one other, mutable object in the cycle, e.g. a base
3590            class's dict; the cycle will be broken that way.
3591 
3592        tp_subclasses:
3593            A dict of weak references can't be part of a cycle; and
3594            dicts have their own tp_clear.
3595 
3596        slots (in PyHeapTypeObject):
3597            A tuple of strings can't be part of a cycle.
3598     */
3599 
3600     PyType_Modified(type);
3601     cached_keys = ((PyHeapTypeObject *)type)->ht_cached_keys;
3602     if (cached_keys != NULL) {
3603         ((PyHeapTypeObject *)type)->ht_cached_keys = NULL;
3604         _PyDictKeys_DecRef(cached_keys);
3605     }
3606     if (type->tp_dict)
3607         PyDict_Clear(type->tp_dict);
3608     Py_CLEAR(type->tp_mro);
3609 
3610     return 0;
3611 }
3612 
3613 static int
type_is_gc(PyTypeObject * type)3614 type_is_gc(PyTypeObject *type)
3615 {
3616     return type->tp_flags & Py_TPFLAGS_HEAPTYPE;
3617 }
3618 
3619 PyTypeObject PyType_Type = {
3620     PyVarObject_HEAD_INIT(&PyType_Type, 0)
3621     "type",                                     /* tp_name */
3622     sizeof(PyHeapTypeObject),                   /* tp_basicsize */
3623     sizeof(PyMemberDef),                        /* tp_itemsize */
3624     (destructor)type_dealloc,                   /* tp_dealloc */
3625     0,                                          /* tp_vectorcall_offset */
3626     0,                                          /* tp_getattr */
3627     0,                                          /* tp_setattr */
3628     0,                                          /* tp_as_async */
3629     (reprfunc)type_repr,                        /* tp_repr */
3630     0,                                          /* tp_as_number */
3631     0,                                          /* tp_as_sequence */
3632     0,                                          /* tp_as_mapping */
3633     0,                                          /* tp_hash */
3634     (ternaryfunc)type_call,                     /* tp_call */
3635     0,                                          /* tp_str */
3636     (getattrofunc)type_getattro,                /* tp_getattro */
3637     (setattrofunc)type_setattro,                /* tp_setattro */
3638     0,                                          /* tp_as_buffer */
3639     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
3640         Py_TPFLAGS_BASETYPE | Py_TPFLAGS_TYPE_SUBCLASS,         /* tp_flags */
3641     type_doc,                                   /* tp_doc */
3642     (traverseproc)type_traverse,                /* tp_traverse */
3643     (inquiry)type_clear,                        /* tp_clear */
3644     0,                                          /* tp_richcompare */
3645     offsetof(PyTypeObject, tp_weaklist),        /* tp_weaklistoffset */
3646     0,                                          /* tp_iter */
3647     0,                                          /* tp_iternext */
3648     type_methods,                               /* tp_methods */
3649     type_members,                               /* tp_members */
3650     type_getsets,                               /* tp_getset */
3651     0,                                          /* tp_base */
3652     0,                                          /* tp_dict */
3653     0,                                          /* tp_descr_get */
3654     0,                                          /* tp_descr_set */
3655     offsetof(PyTypeObject, tp_dict),            /* tp_dictoffset */
3656     type_init,                                  /* tp_init */
3657     0,                                          /* tp_alloc */
3658     type_new,                                   /* tp_new */
3659     PyObject_GC_Del,                            /* tp_free */
3660     (inquiry)type_is_gc,                        /* tp_is_gc */
3661 };
3662 
3663 
3664 /* The base type of all types (eventually)... except itself. */
3665 
3666 /* You may wonder why object.__new__() only complains about arguments
3667    when object.__init__() is not overridden, and vice versa.
3668 
3669    Consider the use cases:
3670 
3671    1. When neither is overridden, we want to hear complaints about
3672       excess (i.e., any) arguments, since their presence could
3673       indicate there's a bug.
3674 
3675    2. When defining an Immutable type, we are likely to override only
3676       __new__(), since __init__() is called too late to initialize an
3677       Immutable object.  Since __new__() defines the signature for the
3678       type, it would be a pain to have to override __init__() just to
3679       stop it from complaining about excess arguments.
3680 
3681    3. When defining a Mutable type, we are likely to override only
3682       __init__().  So here the converse reasoning applies: we don't
3683       want to have to override __new__() just to stop it from
3684       complaining.
3685 
3686    4. When __init__() is overridden, and the subclass __init__() calls
3687       object.__init__(), the latter should complain about excess
3688       arguments; ditto for __new__().
3689 
3690    Use cases 2 and 3 make it unattractive to unconditionally check for
3691    excess arguments.  The best solution that addresses all four use
3692    cases is as follows: __init__() complains about excess arguments
3693    unless __new__() is overridden and __init__() is not overridden
3694    (IOW, if __init__() is overridden or __new__() is not overridden);
3695    symmetrically, __new__() complains about excess arguments unless
3696    __init__() is overridden and __new__() is not overridden
3697    (IOW, if __new__() is overridden or __init__() is not overridden).
3698 
3699    However, for backwards compatibility, this breaks too much code.
3700    Therefore, in 2.6, we'll *warn* about excess arguments when both
3701    methods are overridden; for all other cases we'll use the above
3702    rules.
3703 
3704 */
3705 
3706 /* Forward */
3707 static PyObject *
3708 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
3709 
3710 static int
excess_args(PyObject * args,PyObject * kwds)3711 excess_args(PyObject *args, PyObject *kwds)
3712 {
3713     return PyTuple_GET_SIZE(args) ||
3714         (kwds && PyDict_Check(kwds) && PyDict_GET_SIZE(kwds));
3715 }
3716 
3717 static int
object_init(PyObject * self,PyObject * args,PyObject * kwds)3718 object_init(PyObject *self, PyObject *args, PyObject *kwds)
3719 {
3720     PyTypeObject *type = Py_TYPE(self);
3721     if (excess_args(args, kwds)) {
3722         if (type->tp_init != object_init) {
3723             PyErr_SetString(PyExc_TypeError,
3724                             "object.__init__() takes exactly one argument (the instance to initialize)");
3725             return -1;
3726         }
3727         if (type->tp_new == object_new) {
3728             PyErr_Format(PyExc_TypeError,
3729                          "%.200s.__init__() takes exactly one argument (the instance to initialize)",
3730                          type->tp_name);
3731             return -1;
3732         }
3733     }
3734     return 0;
3735 }
3736 
3737 static PyObject *
object_new(PyTypeObject * type,PyObject * args,PyObject * kwds)3738 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
3739 {
3740     if (excess_args(args, kwds)) {
3741         if (type->tp_new != object_new) {
3742             PyErr_SetString(PyExc_TypeError,
3743                             "object.__new__() takes exactly one argument (the type to instantiate)");
3744             return NULL;
3745         }
3746         if (type->tp_init == object_init) {
3747             PyErr_Format(PyExc_TypeError, "%.200s() takes no arguments",
3748                          type->tp_name);
3749             return NULL;
3750         }
3751     }
3752 
3753     if (type->tp_flags & Py_TPFLAGS_IS_ABSTRACT) {
3754         PyObject *abstract_methods;
3755         PyObject *sorted_methods;
3756         PyObject *joined;
3757         PyObject *comma;
3758         _Py_static_string(comma_id, ", ");
3759 
3760         /* Compute ", ".join(sorted(type.__abstractmethods__))
3761            into joined. */
3762         abstract_methods = type_abstractmethods(type, NULL);
3763         if (abstract_methods == NULL)
3764             return NULL;
3765         sorted_methods = PySequence_List(abstract_methods);
3766         Py_DECREF(abstract_methods);
3767         if (sorted_methods == NULL)
3768             return NULL;
3769         if (PyList_Sort(sorted_methods)) {
3770             Py_DECREF(sorted_methods);
3771             return NULL;
3772         }
3773         comma = _PyUnicode_FromId(&comma_id);
3774         if (comma == NULL) {
3775             Py_DECREF(sorted_methods);
3776             return NULL;
3777         }
3778         joined = PyUnicode_Join(comma, sorted_methods);
3779         Py_DECREF(sorted_methods);
3780         if (joined == NULL)
3781             return NULL;
3782 
3783         PyErr_Format(PyExc_TypeError,
3784                      "Can't instantiate abstract class %s "
3785                      "with abstract methods %U",
3786                      type->tp_name,
3787                      joined);
3788         Py_DECREF(joined);
3789         return NULL;
3790     }
3791     return type->tp_alloc(type, 0);
3792 }
3793 
3794 static void
object_dealloc(PyObject * self)3795 object_dealloc(PyObject *self)
3796 {
3797     Py_TYPE(self)->tp_free(self);
3798 }
3799 
3800 static PyObject *
object_repr(PyObject * self)3801 object_repr(PyObject *self)
3802 {
3803     PyTypeObject *type;
3804     PyObject *mod, *name, *rtn;
3805 
3806     type = Py_TYPE(self);
3807     mod = type_module(type, NULL);
3808     if (mod == NULL)
3809         PyErr_Clear();
3810     else if (!PyUnicode_Check(mod)) {
3811         Py_DECREF(mod);
3812         mod = NULL;
3813     }
3814     name = type_qualname(type, NULL);
3815     if (name == NULL) {
3816         Py_XDECREF(mod);
3817         return NULL;
3818     }
3819     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
3820         rtn = PyUnicode_FromFormat("<%U.%U object at %p>", mod, name, self);
3821     else
3822         rtn = PyUnicode_FromFormat("<%s object at %p>",
3823                                   type->tp_name, self);
3824     Py_XDECREF(mod);
3825     Py_DECREF(name);
3826     return rtn;
3827 }
3828 
3829 static PyObject *
object_str(PyObject * self)3830 object_str(PyObject *self)
3831 {
3832     unaryfunc f;
3833 
3834     f = Py_TYPE(self)->tp_repr;
3835     if (f == NULL)
3836         f = object_repr;
3837     return f(self);
3838 }
3839 
3840 static PyObject *
object_richcompare(PyObject * self,PyObject * other,int op)3841 object_richcompare(PyObject *self, PyObject *other, int op)
3842 {
3843     PyObject *res;
3844 
3845     switch (op) {
3846 
3847     case Py_EQ:
3848         /* Return NotImplemented instead of False, so if two
3849            objects are compared, both get a chance at the
3850            comparison.  See issue #1393. */
3851         res = (self == other) ? Py_True : Py_NotImplemented;
3852         Py_INCREF(res);
3853         break;
3854 
3855     case Py_NE:
3856         /* By default, __ne__() delegates to __eq__() and inverts the result,
3857            unless the latter returns NotImplemented. */
3858         if (self->ob_type->tp_richcompare == NULL) {
3859             res = Py_NotImplemented;
3860             Py_INCREF(res);
3861             break;
3862         }
3863         res = (*self->ob_type->tp_richcompare)(self, other, Py_EQ);
3864         if (res != NULL && res != Py_NotImplemented) {
3865             int ok = PyObject_IsTrue(res);
3866             Py_DECREF(res);
3867             if (ok < 0)
3868                 res = NULL;
3869             else {
3870                 if (ok)
3871                     res = Py_False;
3872                 else
3873                     res = Py_True;
3874                 Py_INCREF(res);
3875             }
3876         }
3877         break;
3878 
3879     default:
3880         res = Py_NotImplemented;
3881         Py_INCREF(res);
3882         break;
3883     }
3884 
3885     return res;
3886 }
3887 
3888 static PyObject *
object_get_class(PyObject * self,void * closure)3889 object_get_class(PyObject *self, void *closure)
3890 {
3891     Py_INCREF(Py_TYPE(self));
3892     return (PyObject *)(Py_TYPE(self));
3893 }
3894 
3895 static int
compatible_with_tp_base(PyTypeObject * child)3896 compatible_with_tp_base(PyTypeObject *child)
3897 {
3898     PyTypeObject *parent = child->tp_base;
3899     return (parent != NULL &&
3900             child->tp_basicsize == parent->tp_basicsize &&
3901             child->tp_itemsize == parent->tp_itemsize &&
3902             child->tp_dictoffset == parent->tp_dictoffset &&
3903             child->tp_weaklistoffset == parent->tp_weaklistoffset &&
3904             ((child->tp_flags & Py_TPFLAGS_HAVE_GC) ==
3905              (parent->tp_flags & Py_TPFLAGS_HAVE_GC)) &&
3906             (child->tp_dealloc == subtype_dealloc ||
3907              child->tp_dealloc == parent->tp_dealloc));
3908 }
3909 
3910 static int
same_slots_added(PyTypeObject * a,PyTypeObject * b)3911 same_slots_added(PyTypeObject *a, PyTypeObject *b)
3912 {
3913     PyTypeObject *base = a->tp_base;
3914     Py_ssize_t size;
3915     PyObject *slots_a, *slots_b;
3916 
3917     assert(base == b->tp_base);
3918     size = base->tp_basicsize;
3919     if (a->tp_dictoffset == size && b->tp_dictoffset == size)
3920         size += sizeof(PyObject *);
3921     if (a->tp_weaklistoffset == size && b->tp_weaklistoffset == size)
3922         size += sizeof(PyObject *);
3923 
3924     /* Check slots compliance */
3925     if (!(a->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
3926         !(b->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
3927         return 0;
3928     }
3929     slots_a = ((PyHeapTypeObject *)a)->ht_slots;
3930     slots_b = ((PyHeapTypeObject *)b)->ht_slots;
3931     if (slots_a && slots_b) {
3932         if (PyObject_RichCompareBool(slots_a, slots_b, Py_EQ) != 1)
3933             return 0;
3934         size += sizeof(PyObject *) * PyTuple_GET_SIZE(slots_a);
3935     }
3936     return size == a->tp_basicsize && size == b->tp_basicsize;
3937 }
3938 
3939 static int
compatible_for_assignment(PyTypeObject * oldto,PyTypeObject * newto,const char * attr)3940 compatible_for_assignment(PyTypeObject* oldto, PyTypeObject* newto, const char* attr)
3941 {
3942     PyTypeObject *newbase, *oldbase;
3943 
3944     if (newto->tp_free != oldto->tp_free) {
3945         PyErr_Format(PyExc_TypeError,
3946                      "%s assignment: "
3947                      "'%s' deallocator differs from '%s'",
3948                      attr,
3949                      newto->tp_name,
3950                      oldto->tp_name);
3951         return 0;
3952     }
3953     /*
3954      It's tricky to tell if two arbitrary types are sufficiently compatible as
3955      to be interchangeable; e.g., even if they have the same tp_basicsize, they
3956      might have totally different struct fields. It's much easier to tell if a
3957      type and its supertype are compatible; e.g., if they have the same
3958      tp_basicsize, then that means they have identical fields. So to check
3959      whether two arbitrary types are compatible, we first find the highest
3960      supertype that each is compatible with, and then if those supertypes are
3961      compatible then the original types must also be compatible.
3962     */
3963     newbase = newto;
3964     oldbase = oldto;
3965     while (compatible_with_tp_base(newbase))
3966         newbase = newbase->tp_base;
3967     while (compatible_with_tp_base(oldbase))
3968         oldbase = oldbase->tp_base;
3969     if (newbase != oldbase &&
3970         (newbase->tp_base != oldbase->tp_base ||
3971          !same_slots_added(newbase, oldbase))) {
3972         PyErr_Format(PyExc_TypeError,
3973                      "%s assignment: "
3974                      "'%s' object layout differs from '%s'",
3975                      attr,
3976                      newto->tp_name,
3977                      oldto->tp_name);
3978         return 0;
3979     }
3980 
3981     return 1;
3982 }
3983 
3984 static int
object_set_class(PyObject * self,PyObject * value,void * closure)3985 object_set_class(PyObject *self, PyObject *value, void *closure)
3986 {
3987     PyTypeObject *oldto = Py_TYPE(self);
3988     PyTypeObject *newto;
3989 
3990     if (value == NULL) {
3991         PyErr_SetString(PyExc_TypeError,
3992                         "can't delete __class__ attribute");
3993         return -1;
3994     }
3995     if (!PyType_Check(value)) {
3996         PyErr_Format(PyExc_TypeError,
3997           "__class__ must be set to a class, not '%s' object",
3998           Py_TYPE(value)->tp_name);
3999         return -1;
4000     }
4001     if (PySys_Audit("object.__setattr__", "OsO",
4002                     self, "__class__", value) < 0) {
4003         return -1;
4004     }
4005 
4006     newto = (PyTypeObject *)value;
4007     /* In versions of CPython prior to 3.5, the code in
4008        compatible_for_assignment was not set up to correctly check for memory
4009        layout / slot / etc. compatibility for non-HEAPTYPE classes, so we just
4010        disallowed __class__ assignment in any case that wasn't HEAPTYPE ->
4011        HEAPTYPE.
4012 
4013        During the 3.5 development cycle, we fixed the code in
4014        compatible_for_assignment to correctly check compatibility between
4015        arbitrary types, and started allowing __class__ assignment in all cases
4016        where the old and new types did in fact have compatible slots and
4017        memory layout (regardless of whether they were implemented as HEAPTYPEs
4018        or not).
4019 
4020        Just before 3.5 was released, though, we discovered that this led to
4021        problems with immutable types like int, where the interpreter assumes
4022        they are immutable and interns some values. Formerly this wasn't a
4023        problem, because they really were immutable -- in particular, all the
4024        types where the interpreter applied this interning trick happened to
4025        also be statically allocated, so the old HEAPTYPE rules were
4026        "accidentally" stopping them from allowing __class__ assignment. But
4027        with the changes to __class__ assignment, we started allowing code like
4028 
4029          class MyInt(int):
4030              ...
4031          # Modifies the type of *all* instances of 1 in the whole program,
4032          # including future instances (!), because the 1 object is interned.
4033          (1).__class__ = MyInt
4034 
4035        (see https://bugs.python.org/issue24912).
4036 
4037        In theory the proper fix would be to identify which classes rely on
4038        this invariant and somehow disallow __class__ assignment only for them,
4039        perhaps via some mechanism like a new Py_TPFLAGS_IMMUTABLE flag (a
4040        "blacklisting" approach). But in practice, since this problem wasn't
4041        noticed late in the 3.5 RC cycle, we're taking the conservative
4042        approach and reinstating the same HEAPTYPE->HEAPTYPE check that we used
4043        to have, plus a "whitelist". For now, the whitelist consists only of
4044        ModuleType subtypes, since those are the cases that motivated the patch
4045        in the first place -- see https://bugs.python.org/issue22986 -- and
4046        since module objects are mutable we can be sure that they are
4047        definitely not being interned. So now we allow HEAPTYPE->HEAPTYPE *or*
4048        ModuleType subtype -> ModuleType subtype.
4049 
4050        So far as we know, all the code beyond the following 'if' statement
4051        will correctly handle non-HEAPTYPE classes, and the HEAPTYPE check is
4052        needed only to protect that subset of non-HEAPTYPE classes for which
4053        the interpreter has baked in the assumption that all instances are
4054        truly immutable.
4055     */
4056     if (!(PyType_IsSubtype(newto, &PyModule_Type) &&
4057           PyType_IsSubtype(oldto, &PyModule_Type)) &&
4058         (!(newto->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
4059          !(oldto->tp_flags & Py_TPFLAGS_HEAPTYPE))) {
4060         PyErr_Format(PyExc_TypeError,
4061                      "__class__ assignment only supported for heap types "
4062                      "or ModuleType subclasses");
4063         return -1;
4064     }
4065 
4066     if (compatible_for_assignment(oldto, newto, "__class__")) {
4067         if (newto->tp_flags & Py_TPFLAGS_HEAPTYPE)
4068             Py_INCREF(newto);
4069         Py_TYPE(self) = newto;
4070         if (oldto->tp_flags & Py_TPFLAGS_HEAPTYPE)
4071             Py_DECREF(oldto);
4072         return 0;
4073     }
4074     else {
4075         return -1;
4076     }
4077 }
4078 
4079 static PyGetSetDef object_getsets[] = {
4080     {"__class__", object_get_class, object_set_class,
4081      PyDoc_STR("the object's class")},
4082     {0}
4083 };
4084 
4085 
4086 /* Stuff to implement __reduce_ex__ for pickle protocols >= 2.
4087    We fall back to helpers in copyreg for:
4088    - pickle protocols < 2
4089    - calculating the list of slot names (done only once per class)
4090    - the __newobj__ function (which is used as a token but never called)
4091 */
4092 
4093 static PyObject *
import_copyreg(void)4094 import_copyreg(void)
4095 {
4096     PyObject *copyreg_str;
4097     PyObject *copyreg_module;
4098     _Py_IDENTIFIER(copyreg);
4099 
4100     copyreg_str = _PyUnicode_FromId(&PyId_copyreg);
4101     if (copyreg_str == NULL) {
4102         return NULL;
4103     }
4104     /* Try to fetch cached copy of copyreg from sys.modules first in an
4105        attempt to avoid the import overhead. Previously this was implemented
4106        by storing a reference to the cached module in a static variable, but
4107        this broke when multiple embedded interpreters were in use (see issue
4108        #17408 and #19088). */
4109     copyreg_module = PyImport_GetModule(copyreg_str);
4110     if (copyreg_module != NULL) {
4111         return copyreg_module;
4112     }
4113     if (PyErr_Occurred()) {
4114         return NULL;
4115     }
4116     return PyImport_Import(copyreg_str);
4117 }
4118 
4119 static PyObject *
_PyType_GetSlotNames(PyTypeObject * cls)4120 _PyType_GetSlotNames(PyTypeObject *cls)
4121 {
4122     PyObject *copyreg;
4123     PyObject *slotnames;
4124     _Py_IDENTIFIER(__slotnames__);
4125     _Py_IDENTIFIER(_slotnames);
4126 
4127     assert(PyType_Check(cls));
4128 
4129     /* Get the slot names from the cache in the class if possible. */
4130     slotnames = _PyDict_GetItemIdWithError(cls->tp_dict, &PyId___slotnames__);
4131     if (slotnames != NULL) {
4132         if (slotnames != Py_None && !PyList_Check(slotnames)) {
4133             PyErr_Format(PyExc_TypeError,
4134                          "%.200s.__slotnames__ should be a list or None, "
4135                          "not %.200s",
4136                          cls->tp_name, Py_TYPE(slotnames)->tp_name);
4137             return NULL;
4138         }
4139         Py_INCREF(slotnames);
4140         return slotnames;
4141     }
4142     else {
4143         if (PyErr_Occurred()) {
4144             return NULL;
4145         }
4146         /* The class does not have the slot names cached yet. */
4147     }
4148 
4149     copyreg = import_copyreg();
4150     if (copyreg == NULL)
4151         return NULL;
4152 
4153     /* Use _slotnames function from the copyreg module to find the slots
4154        by this class and its bases. This function will cache the result
4155        in __slotnames__. */
4156     slotnames = _PyObject_CallMethodIdObjArgs(copyreg, &PyId__slotnames,
4157                                               cls, NULL);
4158     Py_DECREF(copyreg);
4159     if (slotnames == NULL)
4160         return NULL;
4161 
4162     if (slotnames != Py_None && !PyList_Check(slotnames)) {
4163         PyErr_SetString(PyExc_TypeError,
4164                         "copyreg._slotnames didn't return a list or None");
4165         Py_DECREF(slotnames);
4166         return NULL;
4167     }
4168 
4169     return slotnames;
4170 }
4171 
4172 static PyObject *
_PyObject_GetState(PyObject * obj,int required)4173 _PyObject_GetState(PyObject *obj, int required)
4174 {
4175     PyObject *state;
4176     PyObject *getstate;
4177     _Py_IDENTIFIER(__getstate__);
4178 
4179     if (_PyObject_LookupAttrId(obj, &PyId___getstate__, &getstate) < 0) {
4180         return NULL;
4181     }
4182     if (getstate == NULL) {
4183         PyObject *slotnames;
4184 
4185         if (required && obj->ob_type->tp_itemsize) {
4186             PyErr_Format(PyExc_TypeError,
4187                          "cannot pickle '%.200s' object",
4188                          Py_TYPE(obj)->tp_name);
4189             return NULL;
4190         }
4191 
4192         {
4193             PyObject **dict;
4194             dict = _PyObject_GetDictPtr(obj);
4195             /* It is possible that the object's dict is not initialized
4196                yet. In this case, we will return None for the state.
4197                We also return None if the dict is empty to make the behavior
4198                consistent regardless whether the dict was initialized or not.
4199                This make unit testing easier. */
4200             if (dict != NULL && *dict != NULL && PyDict_GET_SIZE(*dict)) {
4201                 state = *dict;
4202             }
4203             else {
4204                 state = Py_None;
4205             }
4206             Py_INCREF(state);
4207         }
4208 
4209         slotnames = _PyType_GetSlotNames(Py_TYPE(obj));
4210         if (slotnames == NULL) {
4211             Py_DECREF(state);
4212             return NULL;
4213         }
4214 
4215         assert(slotnames == Py_None || PyList_Check(slotnames));
4216         if (required) {
4217             Py_ssize_t basicsize = PyBaseObject_Type.tp_basicsize;
4218             if (obj->ob_type->tp_dictoffset)
4219                 basicsize += sizeof(PyObject *);
4220             if (obj->ob_type->tp_weaklistoffset)
4221                 basicsize += sizeof(PyObject *);
4222             if (slotnames != Py_None)
4223                 basicsize += sizeof(PyObject *) * PyList_GET_SIZE(slotnames);
4224             if (obj->ob_type->tp_basicsize > basicsize) {
4225                 Py_DECREF(slotnames);
4226                 Py_DECREF(state);
4227                 PyErr_Format(PyExc_TypeError,
4228                              "cannot pickle '%.200s' object",
4229                              Py_TYPE(obj)->tp_name);
4230                 return NULL;
4231             }
4232         }
4233 
4234         if (slotnames != Py_None && PyList_GET_SIZE(slotnames) > 0) {
4235             PyObject *slots;
4236             Py_ssize_t slotnames_size, i;
4237 
4238             slots = PyDict_New();
4239             if (slots == NULL) {
4240                 Py_DECREF(slotnames);
4241                 Py_DECREF(state);
4242                 return NULL;
4243             }
4244 
4245             slotnames_size = PyList_GET_SIZE(slotnames);
4246             for (i = 0; i < slotnames_size; i++) {
4247                 PyObject *name, *value;
4248 
4249                 name = PyList_GET_ITEM(slotnames, i);
4250                 Py_INCREF(name);
4251                 if (_PyObject_LookupAttr(obj, name, &value) < 0) {
4252                     goto error;
4253                 }
4254                 if (value == NULL) {
4255                     Py_DECREF(name);
4256                     /* It is not an error if the attribute is not present. */
4257                 }
4258                 else {
4259                     int err = PyDict_SetItem(slots, name, value);
4260                     Py_DECREF(name);
4261                     Py_DECREF(value);
4262                     if (err) {
4263                         goto error;
4264                     }
4265                 }
4266 
4267                 /* The list is stored on the class so it may mutate while we
4268                    iterate over it */
4269                 if (slotnames_size != PyList_GET_SIZE(slotnames)) {
4270                     PyErr_Format(PyExc_RuntimeError,
4271                                  "__slotsname__ changed size during iteration");
4272                     goto error;
4273                 }
4274 
4275                 /* We handle errors within the loop here. */
4276                 if (0) {
4277                   error:
4278                     Py_DECREF(slotnames);
4279                     Py_DECREF(slots);
4280                     Py_DECREF(state);
4281                     return NULL;
4282                 }
4283             }
4284 
4285             /* If we found some slot attributes, pack them in a tuple along
4286                the original attribute dictionary. */
4287             if (PyDict_GET_SIZE(slots) > 0) {
4288                 PyObject *state2;
4289 
4290                 state2 = PyTuple_Pack(2, state, slots);
4291                 Py_DECREF(state);
4292                 if (state2 == NULL) {
4293                     Py_DECREF(slotnames);
4294                     Py_DECREF(slots);
4295                     return NULL;
4296                 }
4297                 state = state2;
4298             }
4299             Py_DECREF(slots);
4300         }
4301         Py_DECREF(slotnames);
4302     }
4303     else { /* getstate != NULL */
4304         state = _PyObject_CallNoArg(getstate);
4305         Py_DECREF(getstate);
4306         if (state == NULL)
4307             return NULL;
4308     }
4309 
4310     return state;
4311 }
4312 
4313 static int
_PyObject_GetNewArguments(PyObject * obj,PyObject ** args,PyObject ** kwargs)4314 _PyObject_GetNewArguments(PyObject *obj, PyObject **args, PyObject **kwargs)
4315 {
4316     PyObject *getnewargs, *getnewargs_ex;
4317     _Py_IDENTIFIER(__getnewargs_ex__);
4318     _Py_IDENTIFIER(__getnewargs__);
4319 
4320     if (args == NULL || kwargs == NULL) {
4321         PyErr_BadInternalCall();
4322         return -1;
4323     }
4324 
4325     /* We first attempt to fetch the arguments for __new__ by calling
4326        __getnewargs_ex__ on the object. */
4327     getnewargs_ex = _PyObject_LookupSpecial(obj, &PyId___getnewargs_ex__);
4328     if (getnewargs_ex != NULL) {
4329         PyObject *newargs = _PyObject_CallNoArg(getnewargs_ex);
4330         Py_DECREF(getnewargs_ex);
4331         if (newargs == NULL) {
4332             return -1;
4333         }
4334         if (!PyTuple_Check(newargs)) {
4335             PyErr_Format(PyExc_TypeError,
4336                          "__getnewargs_ex__ should return a tuple, "
4337                          "not '%.200s'", Py_TYPE(newargs)->tp_name);
4338             Py_DECREF(newargs);
4339             return -1;
4340         }
4341         if (PyTuple_GET_SIZE(newargs) != 2) {
4342             PyErr_Format(PyExc_ValueError,
4343                          "__getnewargs_ex__ should return a tuple of "
4344                          "length 2, not %zd", PyTuple_GET_SIZE(newargs));
4345             Py_DECREF(newargs);
4346             return -1;
4347         }
4348         *args = PyTuple_GET_ITEM(newargs, 0);
4349         Py_INCREF(*args);
4350         *kwargs = PyTuple_GET_ITEM(newargs, 1);
4351         Py_INCREF(*kwargs);
4352         Py_DECREF(newargs);
4353 
4354         /* XXX We should perhaps allow None to be passed here. */
4355         if (!PyTuple_Check(*args)) {
4356             PyErr_Format(PyExc_TypeError,
4357                          "first item of the tuple returned by "
4358                          "__getnewargs_ex__ must be a tuple, not '%.200s'",
4359                          Py_TYPE(*args)->tp_name);
4360             Py_CLEAR(*args);
4361             Py_CLEAR(*kwargs);
4362             return -1;
4363         }
4364         if (!PyDict_Check(*kwargs)) {
4365             PyErr_Format(PyExc_TypeError,
4366                          "second item of the tuple returned by "
4367                          "__getnewargs_ex__ must be a dict, not '%.200s'",
4368                          Py_TYPE(*kwargs)->tp_name);
4369             Py_CLEAR(*args);
4370             Py_CLEAR(*kwargs);
4371             return -1;
4372         }
4373         return 0;
4374     } else if (PyErr_Occurred()) {
4375         return -1;
4376     }
4377 
4378     /* The object does not have __getnewargs_ex__ so we fallback on using
4379        __getnewargs__ instead. */
4380     getnewargs = _PyObject_LookupSpecial(obj, &PyId___getnewargs__);
4381     if (getnewargs != NULL) {
4382         *args = _PyObject_CallNoArg(getnewargs);
4383         Py_DECREF(getnewargs);
4384         if (*args == NULL) {
4385             return -1;
4386         }
4387         if (!PyTuple_Check(*args)) {
4388             PyErr_Format(PyExc_TypeError,
4389                          "__getnewargs__ should return a tuple, "
4390                          "not '%.200s'", Py_TYPE(*args)->tp_name);
4391             Py_CLEAR(*args);
4392             return -1;
4393         }
4394         *kwargs = NULL;
4395         return 0;
4396     } else if (PyErr_Occurred()) {
4397         return -1;
4398     }
4399 
4400     /* The object does not have __getnewargs_ex__ and __getnewargs__. This may
4401        mean __new__ does not takes any arguments on this object, or that the
4402        object does not implement the reduce protocol for pickling or
4403        copying. */
4404     *args = NULL;
4405     *kwargs = NULL;
4406     return 0;
4407 }
4408 
4409 static int
_PyObject_GetItemsIter(PyObject * obj,PyObject ** listitems,PyObject ** dictitems)4410 _PyObject_GetItemsIter(PyObject *obj, PyObject **listitems,
4411                        PyObject **dictitems)
4412 {
4413     if (listitems == NULL || dictitems == NULL) {
4414         PyErr_BadInternalCall();
4415         return -1;
4416     }
4417 
4418     if (!PyList_Check(obj)) {
4419         *listitems = Py_None;
4420         Py_INCREF(*listitems);
4421     }
4422     else {
4423         *listitems = PyObject_GetIter(obj);
4424         if (*listitems == NULL)
4425             return -1;
4426     }
4427 
4428     if (!PyDict_Check(obj)) {
4429         *dictitems = Py_None;
4430         Py_INCREF(*dictitems);
4431     }
4432     else {
4433         PyObject *items;
4434         _Py_IDENTIFIER(items);
4435 
4436         items = _PyObject_CallMethodIdObjArgs(obj, &PyId_items, NULL);
4437         if (items == NULL) {
4438             Py_CLEAR(*listitems);
4439             return -1;
4440         }
4441         *dictitems = PyObject_GetIter(items);
4442         Py_DECREF(items);
4443         if (*dictitems == NULL) {
4444             Py_CLEAR(*listitems);
4445             return -1;
4446         }
4447     }
4448 
4449     assert(*listitems != NULL && *dictitems != NULL);
4450 
4451     return 0;
4452 }
4453 
4454 static PyObject *
reduce_newobj(PyObject * obj)4455 reduce_newobj(PyObject *obj)
4456 {
4457     PyObject *args = NULL, *kwargs = NULL;
4458     PyObject *copyreg;
4459     PyObject *newobj, *newargs, *state, *listitems, *dictitems;
4460     PyObject *result;
4461     int hasargs;
4462 
4463     if (Py_TYPE(obj)->tp_new == NULL) {
4464         PyErr_Format(PyExc_TypeError,
4465                      "cannot pickle '%.200s' object",
4466                      Py_TYPE(obj)->tp_name);
4467         return NULL;
4468     }
4469     if (_PyObject_GetNewArguments(obj, &args, &kwargs) < 0)
4470         return NULL;
4471 
4472     copyreg = import_copyreg();
4473     if (copyreg == NULL) {
4474         Py_XDECREF(args);
4475         Py_XDECREF(kwargs);
4476         return NULL;
4477     }
4478     hasargs = (args != NULL);
4479     if (kwargs == NULL || PyDict_GET_SIZE(kwargs) == 0) {
4480         _Py_IDENTIFIER(__newobj__);
4481         PyObject *cls;
4482         Py_ssize_t i, n;
4483 
4484         Py_XDECREF(kwargs);
4485         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj__);
4486         Py_DECREF(copyreg);
4487         if (newobj == NULL) {
4488             Py_XDECREF(args);
4489             return NULL;
4490         }
4491         n = args ? PyTuple_GET_SIZE(args) : 0;
4492         newargs = PyTuple_New(n+1);
4493         if (newargs == NULL) {
4494             Py_XDECREF(args);
4495             Py_DECREF(newobj);
4496             return NULL;
4497         }
4498         cls = (PyObject *) Py_TYPE(obj);
4499         Py_INCREF(cls);
4500         PyTuple_SET_ITEM(newargs, 0, cls);
4501         for (i = 0; i < n; i++) {
4502             PyObject *v = PyTuple_GET_ITEM(args, i);
4503             Py_INCREF(v);
4504             PyTuple_SET_ITEM(newargs, i+1, v);
4505         }
4506         Py_XDECREF(args);
4507     }
4508     else if (args != NULL) {
4509         _Py_IDENTIFIER(__newobj_ex__);
4510 
4511         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj_ex__);
4512         Py_DECREF(copyreg);
4513         if (newobj == NULL) {
4514             Py_DECREF(args);
4515             Py_DECREF(kwargs);
4516             return NULL;
4517         }
4518         newargs = PyTuple_Pack(3, Py_TYPE(obj), args, kwargs);
4519         Py_DECREF(args);
4520         Py_DECREF(kwargs);
4521         if (newargs == NULL) {
4522             Py_DECREF(newobj);
4523             return NULL;
4524         }
4525     }
4526     else {
4527         /* args == NULL */
4528         Py_DECREF(kwargs);
4529         PyErr_BadInternalCall();
4530         return NULL;
4531     }
4532 
4533     state = _PyObject_GetState(obj,
4534                 !hasargs && !PyList_Check(obj) && !PyDict_Check(obj));
4535     if (state == NULL) {
4536         Py_DECREF(newobj);
4537         Py_DECREF(newargs);
4538         return NULL;
4539     }
4540     if (_PyObject_GetItemsIter(obj, &listitems, &dictitems) < 0) {
4541         Py_DECREF(newobj);
4542         Py_DECREF(newargs);
4543         Py_DECREF(state);
4544         return NULL;
4545     }
4546 
4547     result = PyTuple_Pack(5, newobj, newargs, state, listitems, dictitems);
4548     Py_DECREF(newobj);
4549     Py_DECREF(newargs);
4550     Py_DECREF(state);
4551     Py_DECREF(listitems);
4552     Py_DECREF(dictitems);
4553     return result;
4554 }
4555 
4556 /*
4557  * There were two problems when object.__reduce__ and object.__reduce_ex__
4558  * were implemented in the same function:
4559  *  - trying to pickle an object with a custom __reduce__ method that
4560  *    fell back to object.__reduce__ in certain circumstances led to
4561  *    infinite recursion at Python level and eventual RecursionError.
4562  *  - Pickling objects that lied about their type by overwriting the
4563  *    __class__ descriptor could lead to infinite recursion at C level
4564  *    and eventual segfault.
4565  *
4566  * Because of backwards compatibility, the two methods still have to
4567  * behave in the same way, even if this is not required by the pickle
4568  * protocol. This common functionality was moved to the _common_reduce
4569  * function.
4570  */
4571 static PyObject *
_common_reduce(PyObject * self,int proto)4572 _common_reduce(PyObject *self, int proto)
4573 {
4574     PyObject *copyreg, *res;
4575 
4576     if (proto >= 2)
4577         return reduce_newobj(self);
4578 
4579     copyreg = import_copyreg();
4580     if (!copyreg)
4581         return NULL;
4582 
4583     res = PyObject_CallMethod(copyreg, "_reduce_ex", "Oi", self, proto);
4584     Py_DECREF(copyreg);
4585 
4586     return res;
4587 }
4588 
4589 /*[clinic input]
4590 object.__reduce__
4591 
4592 Helper for pickle.
4593 [clinic start generated code]*/
4594 
4595 static PyObject *
object___reduce___impl(PyObject * self)4596 object___reduce___impl(PyObject *self)
4597 /*[clinic end generated code: output=d4ca691f891c6e2f input=11562e663947e18b]*/
4598 {
4599     return _common_reduce(self, 0);
4600 }
4601 
4602 /*[clinic input]
4603 object.__reduce_ex__
4604 
4605   protocol: int
4606   /
4607 
4608 Helper for pickle.
4609 [clinic start generated code]*/
4610 
4611 static PyObject *
object___reduce_ex___impl(PyObject * self,int protocol)4612 object___reduce_ex___impl(PyObject *self, int protocol)
4613 /*[clinic end generated code: output=2e157766f6b50094 input=f326b43fb8a4c5ff]*/
4614 {
4615     static PyObject *objreduce;
4616     PyObject *reduce, *res;
4617     _Py_IDENTIFIER(__reduce__);
4618 
4619     if (objreduce == NULL) {
4620         objreduce = _PyDict_GetItemId(PyBaseObject_Type.tp_dict,
4621                                       &PyId___reduce__);
4622     }
4623 
4624     if (_PyObject_LookupAttrId(self, &PyId___reduce__, &reduce) < 0) {
4625         return NULL;
4626     }
4627     if (reduce != NULL) {
4628         PyObject *cls, *clsreduce;
4629         int override;
4630 
4631         cls = (PyObject *) Py_TYPE(self);
4632         clsreduce = _PyObject_GetAttrId(cls, &PyId___reduce__);
4633         if (clsreduce == NULL) {
4634             Py_DECREF(reduce);
4635             return NULL;
4636         }
4637         override = (clsreduce != objreduce);
4638         Py_DECREF(clsreduce);
4639         if (override) {
4640             res = _PyObject_CallNoArg(reduce);
4641             Py_DECREF(reduce);
4642             return res;
4643         }
4644         else
4645             Py_DECREF(reduce);
4646     }
4647 
4648     return _common_reduce(self, protocol);
4649 }
4650 
4651 static PyObject *
object_subclasshook(PyObject * cls,PyObject * args)4652 object_subclasshook(PyObject *cls, PyObject *args)
4653 {
4654     Py_RETURN_NOTIMPLEMENTED;
4655 }
4656 
4657 PyDoc_STRVAR(object_subclasshook_doc,
4658 "Abstract classes can override this to customize issubclass().\n"
4659 "\n"
4660 "This is invoked early on by abc.ABCMeta.__subclasscheck__().\n"
4661 "It should return True, False or NotImplemented.  If it returns\n"
4662 "NotImplemented, the normal algorithm is used.  Otherwise, it\n"
4663 "overrides the normal algorithm (and the outcome is cached).\n");
4664 
4665 static PyObject *
object_init_subclass(PyObject * cls,PyObject * arg)4666 object_init_subclass(PyObject *cls, PyObject *arg)
4667 {
4668     Py_RETURN_NONE;
4669 }
4670 
4671 PyDoc_STRVAR(object_init_subclass_doc,
4672 "This method is called when a class is subclassed.\n"
4673 "\n"
4674 "The default implementation does nothing. It may be\n"
4675 "overridden to extend subclasses.\n");
4676 
4677 /*[clinic input]
4678 object.__format__
4679 
4680   format_spec: unicode
4681   /
4682 
4683 Default object formatter.
4684 [clinic start generated code]*/
4685 
4686 static PyObject *
object___format___impl(PyObject * self,PyObject * format_spec)4687 object___format___impl(PyObject *self, PyObject *format_spec)
4688 /*[clinic end generated code: output=34897efb543a974b input=7c3b3bc53a6fb7fa]*/
4689 {
4690     /* Issue 7994: If we're converting to a string, we
4691        should reject format specifications */
4692     if (PyUnicode_GET_LENGTH(format_spec) > 0) {
4693         PyErr_Format(PyExc_TypeError,
4694                      "unsupported format string passed to %.200s.__format__",
4695                      self->ob_type->tp_name);
4696         return NULL;
4697     }
4698     return PyObject_Str(self);
4699 }
4700 
4701 /*[clinic input]
4702 object.__sizeof__
4703 
4704 Size of object in memory, in bytes.
4705 [clinic start generated code]*/
4706 
4707 static PyObject *
object___sizeof___impl(PyObject * self)4708 object___sizeof___impl(PyObject *self)
4709 /*[clinic end generated code: output=73edab332f97d550 input=1200ff3dfe485306]*/
4710 {
4711     Py_ssize_t res, isize;
4712 
4713     res = 0;
4714     isize = self->ob_type->tp_itemsize;
4715     if (isize > 0)
4716         res = Py_SIZE(self) * isize;
4717     res += self->ob_type->tp_basicsize;
4718 
4719     return PyLong_FromSsize_t(res);
4720 }
4721 
4722 /* __dir__ for generic objects: returns __dict__, __class__,
4723    and recursively up the __class__.__bases__ chain.
4724 */
4725 /*[clinic input]
4726 object.__dir__
4727 
4728 Default dir() implementation.
4729 [clinic start generated code]*/
4730 
4731 static PyObject *
object___dir___impl(PyObject * self)4732 object___dir___impl(PyObject *self)
4733 /*[clinic end generated code: output=66dd48ea62f26c90 input=0a89305bec669b10]*/
4734 {
4735     PyObject *result = NULL;
4736     PyObject *dict = NULL;
4737     PyObject *itsclass = NULL;
4738 
4739     /* Get __dict__ (which may or may not be a real dict...) */
4740     if (_PyObject_LookupAttrId(self, &PyId___dict__, &dict) < 0) {
4741         return NULL;
4742     }
4743     if (dict == NULL) {
4744         dict = PyDict_New();
4745     }
4746     else if (!PyDict_Check(dict)) {
4747         Py_DECREF(dict);
4748         dict = PyDict_New();
4749     }
4750     else {
4751         /* Copy __dict__ to avoid mutating it. */
4752         PyObject *temp = PyDict_Copy(dict);
4753         Py_DECREF(dict);
4754         dict = temp;
4755     }
4756 
4757     if (dict == NULL)
4758         goto error;
4759 
4760     /* Merge in attrs reachable from its class. */
4761     if (_PyObject_LookupAttrId(self, &PyId___class__, &itsclass) < 0) {
4762         goto error;
4763     }
4764     /* XXX(tomer): Perhaps fall back to obj->ob_type if no
4765                    __class__ exists? */
4766     if (itsclass != NULL && merge_class_dict(dict, itsclass) < 0)
4767         goto error;
4768 
4769     result = PyDict_Keys(dict);
4770     /* fall through */
4771 error:
4772     Py_XDECREF(itsclass);
4773     Py_XDECREF(dict);
4774     return result;
4775 }
4776 
4777 static PyMethodDef object_methods[] = {
4778     OBJECT___REDUCE_EX___METHODDEF
4779     OBJECT___REDUCE___METHODDEF
4780     {"__subclasshook__", object_subclasshook, METH_CLASS | METH_VARARGS,
4781      object_subclasshook_doc},
4782     {"__init_subclass__", object_init_subclass, METH_CLASS | METH_NOARGS,
4783      object_init_subclass_doc},
4784     OBJECT___FORMAT___METHODDEF
4785     OBJECT___SIZEOF___METHODDEF
4786     OBJECT___DIR___METHODDEF
4787     {0}
4788 };
4789 
4790 PyDoc_STRVAR(object_doc,
4791 "object()\n--\n\n"
4792 "The base class of the class hierarchy.\n\n"
4793 "When called, it accepts no arguments and returns a new featureless\n"
4794 "instance that has no instance attributes and cannot be given any.\n");
4795 
4796 PyTypeObject PyBaseObject_Type = {
4797     PyVarObject_HEAD_INIT(&PyType_Type, 0)
4798     "object",                                   /* tp_name */
4799     sizeof(PyObject),                           /* tp_basicsize */
4800     0,                                          /* tp_itemsize */
4801     object_dealloc,                             /* tp_dealloc */
4802     0,                                          /* tp_vectorcall_offset */
4803     0,                                          /* tp_getattr */
4804     0,                                          /* tp_setattr */
4805     0,                                          /* tp_as_async */
4806     object_repr,                                /* tp_repr */
4807     0,                                          /* tp_as_number */
4808     0,                                          /* tp_as_sequence */
4809     0,                                          /* tp_as_mapping */
4810     (hashfunc)_Py_HashPointer,                  /* tp_hash */
4811     0,                                          /* tp_call */
4812     object_str,                                 /* tp_str */
4813     PyObject_GenericGetAttr,                    /* tp_getattro */
4814     PyObject_GenericSetAttr,                    /* tp_setattro */
4815     0,                                          /* tp_as_buffer */
4816     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,   /* tp_flags */
4817     object_doc,                                 /* tp_doc */
4818     0,                                          /* tp_traverse */
4819     0,                                          /* tp_clear */
4820     object_richcompare,                         /* tp_richcompare */
4821     0,                                          /* tp_weaklistoffset */
4822     0,                                          /* tp_iter */
4823     0,                                          /* tp_iternext */
4824     object_methods,                             /* tp_methods */
4825     0,                                          /* tp_members */
4826     object_getsets,                             /* tp_getset */
4827     0,                                          /* tp_base */
4828     0,                                          /* tp_dict */
4829     0,                                          /* tp_descr_get */
4830     0,                                          /* tp_descr_set */
4831     0,                                          /* tp_dictoffset */
4832     object_init,                                /* tp_init */
4833     PyType_GenericAlloc,                        /* tp_alloc */
4834     object_new,                                 /* tp_new */
4835     PyObject_Del,                               /* tp_free */
4836 };
4837 
4838 
4839 /* Add the methods from tp_methods to the __dict__ in a type object */
4840 
4841 static int
add_methods(PyTypeObject * type,PyMethodDef * meth)4842 add_methods(PyTypeObject *type, PyMethodDef *meth)
4843 {
4844     PyObject *dict = type->tp_dict;
4845     PyObject *name;
4846 
4847     for (; meth->ml_name != NULL; meth++) {
4848         PyObject *descr;
4849         int err;
4850         int isdescr = 1;
4851         if (meth->ml_flags & METH_CLASS) {
4852             if (meth->ml_flags & METH_STATIC) {
4853                 PyErr_SetString(PyExc_ValueError,
4854                      "method cannot be both class and static");
4855                 return -1;
4856             }
4857             descr = PyDescr_NewClassMethod(type, meth);
4858         }
4859         else if (meth->ml_flags & METH_STATIC) {
4860             PyObject *cfunc = PyCFunction_NewEx(meth, (PyObject*)type, NULL);
4861             if (cfunc == NULL)
4862                 return -1;
4863             descr = PyStaticMethod_New(cfunc);
4864             isdescr = 0;  // PyStaticMethod is not PyDescrObject
4865             Py_DECREF(cfunc);
4866         }
4867         else {
4868             descr = PyDescr_NewMethod(type, meth);
4869         }
4870         if (descr == NULL)
4871             return -1;
4872 
4873         if (isdescr) {
4874             name = PyDescr_NAME(descr);
4875         }
4876         else {
4877             name = PyUnicode_FromString(meth->ml_name);
4878             if (name == NULL) {
4879                 Py_DECREF(descr);
4880                 return -1;
4881             }
4882         }
4883 
4884         if (!(meth->ml_flags & METH_COEXIST)) {
4885             if (PyDict_GetItemWithError(dict, name)) {
4886                 if (!isdescr) {
4887                     Py_DECREF(name);
4888                 }
4889                 Py_DECREF(descr);
4890                 continue;
4891             }
4892             else if (PyErr_Occurred()) {
4893                 if (!isdescr) {
4894                     Py_DECREF(name);
4895                 }
4896                 return -1;
4897             }
4898         }
4899         err = PyDict_SetItem(dict, name, descr);
4900         if (!isdescr) {
4901             Py_DECREF(name);
4902         }
4903         Py_DECREF(descr);
4904         if (err < 0)
4905             return -1;
4906     }
4907     return 0;
4908 }
4909 
4910 static int
add_members(PyTypeObject * type,PyMemberDef * memb)4911 add_members(PyTypeObject *type, PyMemberDef *memb)
4912 {
4913     PyObject *dict = type->tp_dict;
4914 
4915     for (; memb->name != NULL; memb++) {
4916         PyObject *descr = PyDescr_NewMember(type, memb);
4917         if (descr == NULL)
4918             return -1;
4919 
4920         if (PyDict_GetItemWithError(dict, PyDescr_NAME(descr))) {
4921             Py_DECREF(descr);
4922             continue;
4923         }
4924         else if (PyErr_Occurred()) {
4925             Py_DECREF(descr);
4926             return -1;
4927         }
4928         if (PyDict_SetItem(dict, PyDescr_NAME(descr), descr) < 0) {
4929             Py_DECREF(descr);
4930             return -1;
4931         }
4932         Py_DECREF(descr);
4933     }
4934     return 0;
4935 }
4936 
4937 static int
add_getset(PyTypeObject * type,PyGetSetDef * gsp)4938 add_getset(PyTypeObject *type, PyGetSetDef *gsp)
4939 {
4940     PyObject *dict = type->tp_dict;
4941 
4942     for (; gsp->name != NULL; gsp++) {
4943         PyObject *descr = PyDescr_NewGetSet(type, gsp);
4944         if (descr == NULL)
4945             return -1;
4946 
4947         if (PyDict_GetItemWithError(dict, PyDescr_NAME(descr))) {
4948             Py_DECREF(descr);
4949             continue;
4950         }
4951         else if (PyErr_Occurred()) {
4952             Py_DECREF(descr);
4953             return -1;
4954         }
4955         if (PyDict_SetItem(dict, PyDescr_NAME(descr), descr) < 0) {
4956             Py_DECREF(descr);
4957             return -1;
4958         }
4959         Py_DECREF(descr);
4960     }
4961     return 0;
4962 }
4963 
4964 static void
inherit_special(PyTypeObject * type,PyTypeObject * base)4965 inherit_special(PyTypeObject *type, PyTypeObject *base)
4966 {
4967 
4968     /* Copying tp_traverse and tp_clear is connected to the GC flags */
4969     if (!(type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
4970         (base->tp_flags & Py_TPFLAGS_HAVE_GC) &&
4971         (!type->tp_traverse && !type->tp_clear)) {
4972         type->tp_flags |= Py_TPFLAGS_HAVE_GC;
4973         if (type->tp_traverse == NULL)
4974             type->tp_traverse = base->tp_traverse;
4975         if (type->tp_clear == NULL)
4976             type->tp_clear = base->tp_clear;
4977     }
4978     {
4979         /* The condition below could use some explanation.
4980            It appears that tp_new is not inherited for static types
4981            whose base class is 'object'; this seems to be a precaution
4982            so that old extension types don't suddenly become
4983            callable (object.__new__ wouldn't insure the invariants
4984            that the extension type's own factory function ensures).
4985            Heap types, of course, are under our control, so they do
4986            inherit tp_new; static extension types that specify some
4987            other built-in type as the default also
4988            inherit object.__new__. */
4989         if (base != &PyBaseObject_Type ||
4990             (type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
4991             if (type->tp_new == NULL)
4992                 type->tp_new = base->tp_new;
4993         }
4994     }
4995     if (type->tp_basicsize == 0)
4996         type->tp_basicsize = base->tp_basicsize;
4997 
4998     /* Copy other non-function slots */
4999 
5000 #undef COPYVAL
5001 #define COPYVAL(SLOT) \
5002     if (type->SLOT == 0) type->SLOT = base->SLOT
5003 
5004     COPYVAL(tp_itemsize);
5005     COPYVAL(tp_weaklistoffset);
5006     COPYVAL(tp_dictoffset);
5007 
5008     /* Setup fast subclass flags */
5009     if (PyType_IsSubtype(base, (PyTypeObject*)PyExc_BaseException))
5010         type->tp_flags |= Py_TPFLAGS_BASE_EXC_SUBCLASS;
5011     else if (PyType_IsSubtype(base, &PyType_Type))
5012         type->tp_flags |= Py_TPFLAGS_TYPE_SUBCLASS;
5013     else if (PyType_IsSubtype(base, &PyLong_Type))
5014         type->tp_flags |= Py_TPFLAGS_LONG_SUBCLASS;
5015     else if (PyType_IsSubtype(base, &PyBytes_Type))
5016         type->tp_flags |= Py_TPFLAGS_BYTES_SUBCLASS;
5017     else if (PyType_IsSubtype(base, &PyUnicode_Type))
5018         type->tp_flags |= Py_TPFLAGS_UNICODE_SUBCLASS;
5019     else if (PyType_IsSubtype(base, &PyTuple_Type))
5020         type->tp_flags |= Py_TPFLAGS_TUPLE_SUBCLASS;
5021     else if (PyType_IsSubtype(base, &PyList_Type))
5022         type->tp_flags |= Py_TPFLAGS_LIST_SUBCLASS;
5023     else if (PyType_IsSubtype(base, &PyDict_Type))
5024         type->tp_flags |= Py_TPFLAGS_DICT_SUBCLASS;
5025 }
5026 
5027 static int
overrides_hash(PyTypeObject * type)5028 overrides_hash(PyTypeObject *type)
5029 {
5030     PyObject *dict = type->tp_dict;
5031     _Py_IDENTIFIER(__eq__);
5032 
5033     assert(dict != NULL);
5034     if (_PyDict_GetItemId(dict, &PyId___eq__) != NULL)
5035         return 1;
5036     if (_PyDict_GetItemId(dict, &PyId___hash__) != NULL)
5037         return 1;
5038     return 0;
5039 }
5040 
5041 static void
inherit_slots(PyTypeObject * type,PyTypeObject * base)5042 inherit_slots(PyTypeObject *type, PyTypeObject *base)
5043 {
5044     PyTypeObject *basebase;
5045 
5046 #undef SLOTDEFINED
5047 #undef COPYSLOT
5048 #undef COPYNUM
5049 #undef COPYSEQ
5050 #undef COPYMAP
5051 #undef COPYBUF
5052 
5053 #define SLOTDEFINED(SLOT) \
5054     (base->SLOT != 0 && \
5055      (basebase == NULL || base->SLOT != basebase->SLOT))
5056 
5057 #define COPYSLOT(SLOT) \
5058     if (!type->SLOT && SLOTDEFINED(SLOT)) type->SLOT = base->SLOT
5059 
5060 #define COPYASYNC(SLOT) COPYSLOT(tp_as_async->SLOT)
5061 #define COPYNUM(SLOT) COPYSLOT(tp_as_number->SLOT)
5062 #define COPYSEQ(SLOT) COPYSLOT(tp_as_sequence->SLOT)
5063 #define COPYMAP(SLOT) COPYSLOT(tp_as_mapping->SLOT)
5064 #define COPYBUF(SLOT) COPYSLOT(tp_as_buffer->SLOT)
5065 
5066     /* This won't inherit indirect slots (from tp_as_number etc.)
5067        if type doesn't provide the space. */
5068 
5069     if (type->tp_as_number != NULL && base->tp_as_number != NULL) {
5070         basebase = base->tp_base;
5071         if (basebase->tp_as_number == NULL)
5072             basebase = NULL;
5073         COPYNUM(nb_add);
5074         COPYNUM(nb_subtract);
5075         COPYNUM(nb_multiply);
5076         COPYNUM(nb_remainder);
5077         COPYNUM(nb_divmod);
5078         COPYNUM(nb_power);
5079         COPYNUM(nb_negative);
5080         COPYNUM(nb_positive);
5081         COPYNUM(nb_absolute);
5082         COPYNUM(nb_bool);
5083         COPYNUM(nb_invert);
5084         COPYNUM(nb_lshift);
5085         COPYNUM(nb_rshift);
5086         COPYNUM(nb_and);
5087         COPYNUM(nb_xor);
5088         COPYNUM(nb_or);
5089         COPYNUM(nb_int);
5090         COPYNUM(nb_float);
5091         COPYNUM(nb_inplace_add);
5092         COPYNUM(nb_inplace_subtract);
5093         COPYNUM(nb_inplace_multiply);
5094         COPYNUM(nb_inplace_remainder);
5095         COPYNUM(nb_inplace_power);
5096         COPYNUM(nb_inplace_lshift);
5097         COPYNUM(nb_inplace_rshift);
5098         COPYNUM(nb_inplace_and);
5099         COPYNUM(nb_inplace_xor);
5100         COPYNUM(nb_inplace_or);
5101         COPYNUM(nb_true_divide);
5102         COPYNUM(nb_floor_divide);
5103         COPYNUM(nb_inplace_true_divide);
5104         COPYNUM(nb_inplace_floor_divide);
5105         COPYNUM(nb_index);
5106         COPYNUM(nb_matrix_multiply);
5107         COPYNUM(nb_inplace_matrix_multiply);
5108     }
5109 
5110     if (type->tp_as_async != NULL && base->tp_as_async != NULL) {
5111         basebase = base->tp_base;
5112         if (basebase->tp_as_async == NULL)
5113             basebase = NULL;
5114         COPYASYNC(am_await);
5115         COPYASYNC(am_aiter);
5116         COPYASYNC(am_anext);
5117     }
5118 
5119     if (type->tp_as_sequence != NULL && base->tp_as_sequence != NULL) {
5120         basebase = base->tp_base;
5121         if (basebase->tp_as_sequence == NULL)
5122             basebase = NULL;
5123         COPYSEQ(sq_length);
5124         COPYSEQ(sq_concat);
5125         COPYSEQ(sq_repeat);
5126         COPYSEQ(sq_item);
5127         COPYSEQ(sq_ass_item);
5128         COPYSEQ(sq_contains);
5129         COPYSEQ(sq_inplace_concat);
5130         COPYSEQ(sq_inplace_repeat);
5131     }
5132 
5133     if (type->tp_as_mapping != NULL && base->tp_as_mapping != NULL) {
5134         basebase = base->tp_base;
5135         if (basebase->tp_as_mapping == NULL)
5136             basebase = NULL;
5137         COPYMAP(mp_length);
5138         COPYMAP(mp_subscript);
5139         COPYMAP(mp_ass_subscript);
5140     }
5141 
5142     if (type->tp_as_buffer != NULL && base->tp_as_buffer != NULL) {
5143         basebase = base->tp_base;
5144         if (basebase->tp_as_buffer == NULL)
5145             basebase = NULL;
5146         COPYBUF(bf_getbuffer);
5147         COPYBUF(bf_releasebuffer);
5148     }
5149 
5150     basebase = base->tp_base;
5151 
5152     COPYSLOT(tp_dealloc);
5153     if (type->tp_getattr == NULL && type->tp_getattro == NULL) {
5154         type->tp_getattr = base->tp_getattr;
5155         type->tp_getattro = base->tp_getattro;
5156     }
5157     if (type->tp_setattr == NULL && type->tp_setattro == NULL) {
5158         type->tp_setattr = base->tp_setattr;
5159         type->tp_setattro = base->tp_setattro;
5160     }
5161     COPYSLOT(tp_repr);
5162     /* tp_hash see tp_richcompare */
5163     {
5164         /* Always inherit tp_vectorcall_offset to support PyVectorcall_Call().
5165          * If _Py_TPFLAGS_HAVE_VECTORCALL is not inherited, then vectorcall
5166          * won't be used automatically. */
5167         COPYSLOT(tp_vectorcall_offset);
5168 
5169         /* Inherit _Py_TPFLAGS_HAVE_VECTORCALL for non-heap types
5170         * if tp_call is not overridden */
5171         if (!type->tp_call &&
5172             (base->tp_flags & _Py_TPFLAGS_HAVE_VECTORCALL) &&
5173             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
5174         {
5175             type->tp_flags |= _Py_TPFLAGS_HAVE_VECTORCALL;
5176         }
5177         COPYSLOT(tp_call);
5178     }
5179     COPYSLOT(tp_str);
5180     {
5181         /* Copy comparison-related slots only when
5182            not overriding them anywhere */
5183         if (type->tp_richcompare == NULL &&
5184             type->tp_hash == NULL &&
5185             !overrides_hash(type))
5186         {
5187             type->tp_richcompare = base->tp_richcompare;
5188             type->tp_hash = base->tp_hash;
5189         }
5190     }
5191     {
5192         COPYSLOT(tp_iter);
5193         COPYSLOT(tp_iternext);
5194     }
5195     {
5196         COPYSLOT(tp_descr_get);
5197         /* Inherit Py_TPFLAGS_METHOD_DESCRIPTOR if tp_descr_get was inherited,
5198          * but only for extension types */
5199         if (base->tp_descr_get &&
5200             type->tp_descr_get == base->tp_descr_get &&
5201             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE) &&
5202             (base->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR))
5203         {
5204             type->tp_flags |= Py_TPFLAGS_METHOD_DESCRIPTOR;
5205         }
5206         COPYSLOT(tp_descr_set);
5207         COPYSLOT(tp_dictoffset);
5208         COPYSLOT(tp_init);
5209         COPYSLOT(tp_alloc);
5210         COPYSLOT(tp_is_gc);
5211         COPYSLOT(tp_finalize);
5212         if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) ==
5213             (base->tp_flags & Py_TPFLAGS_HAVE_GC)) {
5214             /* They agree about gc. */
5215             COPYSLOT(tp_free);
5216         }
5217         else if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5218                  type->tp_free == NULL &&
5219                  base->tp_free == PyObject_Free) {
5220             /* A bit of magic to plug in the correct default
5221              * tp_free function when a derived class adds gc,
5222              * didn't define tp_free, and the base uses the
5223              * default non-gc tp_free.
5224              */
5225             type->tp_free = PyObject_GC_Del;
5226         }
5227         /* else they didn't agree about gc, and there isn't something
5228          * obvious to be done -- the type is on its own.
5229          */
5230     }
5231 }
5232 
5233 static int add_operators(PyTypeObject *);
5234 
5235 int
PyType_Ready(PyTypeObject * type)5236 PyType_Ready(PyTypeObject *type)
5237 {
5238     PyObject *dict, *bases;
5239     PyTypeObject *base;
5240     Py_ssize_t i, n;
5241 
5242     if (type->tp_flags & Py_TPFLAGS_READY) {
5243         assert(_PyType_CheckConsistency(type));
5244         return 0;
5245     }
5246     _PyObject_ASSERT((PyObject *)type,
5247                      (type->tp_flags & Py_TPFLAGS_READYING) == 0);
5248 
5249     /* Consistency checks for PEP 590:
5250      * - Py_TPFLAGS_METHOD_DESCRIPTOR requires tp_descr_get
5251      * - _Py_TPFLAGS_HAVE_VECTORCALL requires tp_call and
5252      *   tp_vectorcall_offset > 0
5253      * To avoid mistakes, we require this before inheriting.
5254      */
5255     if (type->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR) {
5256         _PyObject_ASSERT((PyObject *)type, type->tp_descr_get != NULL);
5257     }
5258     if (type->tp_flags & _Py_TPFLAGS_HAVE_VECTORCALL) {
5259         _PyObject_ASSERT((PyObject *)type, type->tp_vectorcall_offset > 0);
5260         _PyObject_ASSERT((PyObject *)type, type->tp_call != NULL);
5261     }
5262 
5263     type->tp_flags |= Py_TPFLAGS_READYING;
5264 
5265 #ifdef Py_TRACE_REFS
5266     /* PyType_Ready is the closest thing we have to a choke point
5267      * for type objects, so is the best place I can think of to try
5268      * to get type objects into the doubly-linked list of all objects.
5269      * Still, not all type objects go through PyType_Ready.
5270      */
5271     _Py_AddToAllObjects((PyObject *)type, 0);
5272 #endif
5273 
5274     if (type->tp_name == NULL) {
5275         PyErr_Format(PyExc_SystemError,
5276                      "Type does not define the tp_name field.");
5277         goto error;
5278     }
5279 
5280     /* Initialize tp_base (defaults to BaseObject unless that's us) */
5281     base = type->tp_base;
5282     if (base == NULL && type != &PyBaseObject_Type) {
5283         base = type->tp_base = &PyBaseObject_Type;
5284         Py_INCREF(base);
5285     }
5286 
5287     /* Now the only way base can still be NULL is if type is
5288      * &PyBaseObject_Type.
5289      */
5290 
5291     /* Initialize the base class */
5292     if (base != NULL && base->tp_dict == NULL) {
5293         if (PyType_Ready(base) < 0)
5294             goto error;
5295     }
5296 
5297     /* Initialize ob_type if NULL.      This means extensions that want to be
5298        compilable separately on Windows can call PyType_Ready() instead of
5299        initializing the ob_type field of their type objects. */
5300     /* The test for base != NULL is really unnecessary, since base is only
5301        NULL when type is &PyBaseObject_Type, and we know its ob_type is
5302        not NULL (it's initialized to &PyType_Type).      But coverity doesn't
5303        know that. */
5304     if (Py_TYPE(type) == NULL && base != NULL)
5305         Py_TYPE(type) = Py_TYPE(base);
5306 
5307     /* Initialize tp_bases */
5308     bases = type->tp_bases;
5309     if (bases == NULL) {
5310         if (base == NULL)
5311             bases = PyTuple_New(0);
5312         else
5313             bases = PyTuple_Pack(1, base);
5314         if (bases == NULL)
5315             goto error;
5316         type->tp_bases = bases;
5317     }
5318 
5319     /* Initialize tp_dict */
5320     dict = type->tp_dict;
5321     if (dict == NULL) {
5322         dict = PyDict_New();
5323         if (dict == NULL)
5324             goto error;
5325         type->tp_dict = dict;
5326     }
5327 
5328     /* Add type-specific descriptors to tp_dict */
5329     if (add_operators(type) < 0)
5330         goto error;
5331     if (type->tp_methods != NULL) {
5332         if (add_methods(type, type->tp_methods) < 0)
5333             goto error;
5334     }
5335     if (type->tp_members != NULL) {
5336         if (add_members(type, type->tp_members) < 0)
5337             goto error;
5338     }
5339     if (type->tp_getset != NULL) {
5340         if (add_getset(type, type->tp_getset) < 0)
5341             goto error;
5342     }
5343 
5344     /* Calculate method resolution order */
5345     if (mro_internal(type, NULL) < 0)
5346         goto error;
5347 
5348     /* Inherit special flags from dominant base */
5349     if (type->tp_base != NULL)
5350         inherit_special(type, type->tp_base);
5351 
5352     /* Initialize tp_dict properly */
5353     bases = type->tp_mro;
5354     assert(bases != NULL);
5355     assert(PyTuple_Check(bases));
5356     n = PyTuple_GET_SIZE(bases);
5357     for (i = 1; i < n; i++) {
5358         PyObject *b = PyTuple_GET_ITEM(bases, i);
5359         if (PyType_Check(b))
5360             inherit_slots(type, (PyTypeObject *)b);
5361     }
5362 
5363     /* All bases of statically allocated type should be statically allocated */
5364     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
5365         for (i = 0; i < n; i++) {
5366             PyObject *b = PyTuple_GET_ITEM(bases, i);
5367             if (PyType_Check(b) &&
5368                 (((PyTypeObject *)b)->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
5369                 PyErr_Format(PyExc_TypeError,
5370                              "type '%.100s' is not dynamically allocated but "
5371                              "its base type '%.100s' is dynamically allocated",
5372                              type->tp_name, ((PyTypeObject *)b)->tp_name);
5373                 goto error;
5374             }
5375         }
5376 
5377     /* Sanity check for tp_free. */
5378     if (PyType_IS_GC(type) && (type->tp_flags & Py_TPFLAGS_BASETYPE) &&
5379         (type->tp_free == NULL || type->tp_free == PyObject_Del)) {
5380         /* This base class needs to call tp_free, but doesn't have
5381          * one, or its tp_free is for non-gc'ed objects.
5382          */
5383         PyErr_Format(PyExc_TypeError, "type '%.100s' participates in "
5384                      "gc and is a base type but has inappropriate "
5385                      "tp_free slot",
5386                      type->tp_name);
5387         goto error;
5388     }
5389 
5390     /* if the type dictionary doesn't contain a __doc__, set it from
5391        the tp_doc slot.
5392      */
5393     if (_PyDict_GetItemIdWithError(type->tp_dict, &PyId___doc__) == NULL) {
5394         if (PyErr_Occurred()) {
5395             goto error;
5396         }
5397         if (type->tp_doc != NULL) {
5398             const char *old_doc = _PyType_DocWithoutSignature(type->tp_name,
5399                 type->tp_doc);
5400             PyObject *doc = PyUnicode_FromString(old_doc);
5401             if (doc == NULL)
5402                 goto error;
5403             if (_PyDict_SetItemId(type->tp_dict, &PyId___doc__, doc) < 0) {
5404                 Py_DECREF(doc);
5405                 goto error;
5406             }
5407             Py_DECREF(doc);
5408         } else {
5409             if (_PyDict_SetItemId(type->tp_dict,
5410                                   &PyId___doc__, Py_None) < 0)
5411                 goto error;
5412         }
5413     }
5414 
5415     /* Hack for tp_hash and __hash__.
5416        If after all that, tp_hash is still NULL, and __hash__ is not in
5417        tp_dict, set tp_hash to PyObject_HashNotImplemented and
5418        tp_dict['__hash__'] equal to None.
5419        This signals that __hash__ is not inherited.
5420      */
5421     if (type->tp_hash == NULL) {
5422         if (_PyDict_GetItemIdWithError(type->tp_dict, &PyId___hash__) == NULL) {
5423             if (PyErr_Occurred() ||
5424                _PyDict_SetItemId(type->tp_dict, &PyId___hash__, Py_None) < 0)
5425             {
5426                 goto error;
5427             }
5428             type->tp_hash = PyObject_HashNotImplemented;
5429         }
5430     }
5431 
5432     /* Some more special stuff */
5433     base = type->tp_base;
5434     if (base != NULL) {
5435         if (type->tp_as_async == NULL)
5436             type->tp_as_async = base->tp_as_async;
5437         if (type->tp_as_number == NULL)
5438             type->tp_as_number = base->tp_as_number;
5439         if (type->tp_as_sequence == NULL)
5440             type->tp_as_sequence = base->tp_as_sequence;
5441         if (type->tp_as_mapping == NULL)
5442             type->tp_as_mapping = base->tp_as_mapping;
5443         if (type->tp_as_buffer == NULL)
5444             type->tp_as_buffer = base->tp_as_buffer;
5445     }
5446 
5447     /* Link into each base class's list of subclasses */
5448     bases = type->tp_bases;
5449     n = PyTuple_GET_SIZE(bases);
5450     for (i = 0; i < n; i++) {
5451         PyObject *b = PyTuple_GET_ITEM(bases, i);
5452         if (PyType_Check(b) &&
5453             add_subclass((PyTypeObject *)b, type) < 0)
5454             goto error;
5455     }
5456 
5457     /* All done -- set the ready flag */
5458     type->tp_flags =
5459         (type->tp_flags & ~Py_TPFLAGS_READYING) | Py_TPFLAGS_READY;
5460     assert(_PyType_CheckConsistency(type));
5461     return 0;
5462 
5463   error:
5464     type->tp_flags &= ~Py_TPFLAGS_READYING;
5465     return -1;
5466 }
5467 
5468 static int
add_subclass(PyTypeObject * base,PyTypeObject * type)5469 add_subclass(PyTypeObject *base, PyTypeObject *type)
5470 {
5471     int result = -1;
5472     PyObject *dict, *key, *newobj;
5473 
5474     dict = base->tp_subclasses;
5475     if (dict == NULL) {
5476         base->tp_subclasses = dict = PyDict_New();
5477         if (dict == NULL)
5478             return -1;
5479     }
5480     assert(PyDict_CheckExact(dict));
5481     key = PyLong_FromVoidPtr((void *) type);
5482     if (key == NULL)
5483         return -1;
5484     newobj = PyWeakref_NewRef((PyObject *)type, NULL);
5485     if (newobj != NULL) {
5486         result = PyDict_SetItem(dict, key, newobj);
5487         Py_DECREF(newobj);
5488     }
5489     Py_DECREF(key);
5490     return result;
5491 }
5492 
5493 static int
add_all_subclasses(PyTypeObject * type,PyObject * bases)5494 add_all_subclasses(PyTypeObject *type, PyObject *bases)
5495 {
5496     int res = 0;
5497 
5498     if (bases) {
5499         Py_ssize_t i;
5500         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
5501             PyObject *base = PyTuple_GET_ITEM(bases, i);
5502             if (PyType_Check(base) &&
5503                 add_subclass((PyTypeObject*)base, type) < 0)
5504                 res = -1;
5505         }
5506     }
5507 
5508     return res;
5509 }
5510 
5511 static void
remove_subclass(PyTypeObject * base,PyTypeObject * type)5512 remove_subclass(PyTypeObject *base, PyTypeObject *type)
5513 {
5514     PyObject *dict, *key;
5515 
5516     dict = base->tp_subclasses;
5517     if (dict == NULL) {
5518         return;
5519     }
5520     assert(PyDict_CheckExact(dict));
5521     key = PyLong_FromVoidPtr((void *) type);
5522     if (key == NULL || PyDict_DelItem(dict, key)) {
5523         /* This can happen if the type initialization errored out before
5524            the base subclasses were updated (e.g. a non-str __qualname__
5525            was passed in the type dict). */
5526         PyErr_Clear();
5527     }
5528     Py_XDECREF(key);
5529 }
5530 
5531 static void
remove_all_subclasses(PyTypeObject * type,PyObject * bases)5532 remove_all_subclasses(PyTypeObject *type, PyObject *bases)
5533 {
5534     if (bases) {
5535         Py_ssize_t i;
5536         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
5537             PyObject *base = PyTuple_GET_ITEM(bases, i);
5538             if (PyType_Check(base))
5539                 remove_subclass((PyTypeObject*) base, type);
5540         }
5541     }
5542 }
5543 
5544 static int
check_num_args(PyObject * ob,int n)5545 check_num_args(PyObject *ob, int n)
5546 {
5547     if (!PyTuple_CheckExact(ob)) {
5548         PyErr_SetString(PyExc_SystemError,
5549             "PyArg_UnpackTuple() argument list is not a tuple");
5550         return 0;
5551     }
5552     if (n == PyTuple_GET_SIZE(ob))
5553         return 1;
5554     PyErr_Format(
5555         PyExc_TypeError,
5556         "expected %d argument%s, got %zd", n, n == 1 ? "" : "s", PyTuple_GET_SIZE(ob));
5557     return 0;
5558 }
5559 
5560 /* Generic wrappers for overloadable 'operators' such as __getitem__ */
5561 
5562 /* There's a wrapper *function* for each distinct function typedef used
5563    for type object slots (e.g. binaryfunc, ternaryfunc, etc.).  There's a
5564    wrapper *table* for each distinct operation (e.g. __len__, __add__).
5565    Most tables have only one entry; the tables for binary operators have two
5566    entries, one regular and one with reversed arguments. */
5567 
5568 static PyObject *
wrap_lenfunc(PyObject * self,PyObject * args,void * wrapped)5569 wrap_lenfunc(PyObject *self, PyObject *args, void *wrapped)
5570 {
5571     lenfunc func = (lenfunc)wrapped;
5572     Py_ssize_t res;
5573 
5574     if (!check_num_args(args, 0))
5575         return NULL;
5576     res = (*func)(self);
5577     if (res == -1 && PyErr_Occurred())
5578         return NULL;
5579     return PyLong_FromSsize_t(res);
5580 }
5581 
5582 static PyObject *
wrap_inquirypred(PyObject * self,PyObject * args,void * wrapped)5583 wrap_inquirypred(PyObject *self, PyObject *args, void *wrapped)
5584 {
5585     inquiry func = (inquiry)wrapped;
5586     int res;
5587 
5588     if (!check_num_args(args, 0))
5589         return NULL;
5590     res = (*func)(self);
5591     if (res == -1 && PyErr_Occurred())
5592         return NULL;
5593     return PyBool_FromLong((long)res);
5594 }
5595 
5596 static PyObject *
wrap_binaryfunc(PyObject * self,PyObject * args,void * wrapped)5597 wrap_binaryfunc(PyObject *self, PyObject *args, void *wrapped)
5598 {
5599     binaryfunc func = (binaryfunc)wrapped;
5600     PyObject *other;
5601 
5602     if (!check_num_args(args, 1))
5603         return NULL;
5604     other = PyTuple_GET_ITEM(args, 0);
5605     return (*func)(self, other);
5606 }
5607 
5608 static PyObject *
wrap_binaryfunc_l(PyObject * self,PyObject * args,void * wrapped)5609 wrap_binaryfunc_l(PyObject *self, PyObject *args, void *wrapped)
5610 {
5611     binaryfunc func = (binaryfunc)wrapped;
5612     PyObject *other;
5613 
5614     if (!check_num_args(args, 1))
5615         return NULL;
5616     other = PyTuple_GET_ITEM(args, 0);
5617     return (*func)(self, other);
5618 }
5619 
5620 static PyObject *
wrap_binaryfunc_r(PyObject * self,PyObject * args,void * wrapped)5621 wrap_binaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
5622 {
5623     binaryfunc func = (binaryfunc)wrapped;
5624     PyObject *other;
5625 
5626     if (!check_num_args(args, 1))
5627         return NULL;
5628     other = PyTuple_GET_ITEM(args, 0);
5629     return (*func)(other, self);
5630 }
5631 
5632 static PyObject *
wrap_ternaryfunc(PyObject * self,PyObject * args,void * wrapped)5633 wrap_ternaryfunc(PyObject *self, PyObject *args, void *wrapped)
5634 {
5635     ternaryfunc func = (ternaryfunc)wrapped;
5636     PyObject *other;
5637     PyObject *third = Py_None;
5638 
5639     /* Note: This wrapper only works for __pow__() */
5640 
5641     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
5642         return NULL;
5643     return (*func)(self, other, third);
5644 }
5645 
5646 static PyObject *
wrap_ternaryfunc_r(PyObject * self,PyObject * args,void * wrapped)5647 wrap_ternaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
5648 {
5649     ternaryfunc func = (ternaryfunc)wrapped;
5650     PyObject *other;
5651     PyObject *third = Py_None;
5652 
5653     /* Note: This wrapper only works for __pow__() */
5654 
5655     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
5656         return NULL;
5657     return (*func)(other, self, third);
5658 }
5659 
5660 static PyObject *
wrap_unaryfunc(PyObject * self,PyObject * args,void * wrapped)5661 wrap_unaryfunc(PyObject *self, PyObject *args, void *wrapped)
5662 {
5663     unaryfunc func = (unaryfunc)wrapped;
5664 
5665     if (!check_num_args(args, 0))
5666         return NULL;
5667     return (*func)(self);
5668 }
5669 
5670 static PyObject *
wrap_indexargfunc(PyObject * self,PyObject * args,void * wrapped)5671 wrap_indexargfunc(PyObject *self, PyObject *args, void *wrapped)
5672 {
5673     ssizeargfunc func = (ssizeargfunc)wrapped;
5674     PyObject* o;
5675     Py_ssize_t i;
5676 
5677     if (!PyArg_UnpackTuple(args, "", 1, 1, &o))
5678         return NULL;
5679     i = PyNumber_AsSsize_t(o, PyExc_OverflowError);
5680     if (i == -1 && PyErr_Occurred())
5681         return NULL;
5682     return (*func)(self, i);
5683 }
5684 
5685 static Py_ssize_t
getindex(PyObject * self,PyObject * arg)5686 getindex(PyObject *self, PyObject *arg)
5687 {
5688     Py_ssize_t i;
5689 
5690     i = PyNumber_AsSsize_t(arg, PyExc_OverflowError);
5691     if (i == -1 && PyErr_Occurred())
5692         return -1;
5693     if (i < 0) {
5694         PySequenceMethods *sq = Py_TYPE(self)->tp_as_sequence;
5695         if (sq && sq->sq_length) {
5696             Py_ssize_t n = (*sq->sq_length)(self);
5697             if (n < 0) {
5698                 assert(PyErr_Occurred());
5699                 return -1;
5700             }
5701             i += n;
5702         }
5703     }
5704     return i;
5705 }
5706 
5707 static PyObject *
wrap_sq_item(PyObject * self,PyObject * args,void * wrapped)5708 wrap_sq_item(PyObject *self, PyObject *args, void *wrapped)
5709 {
5710     ssizeargfunc func = (ssizeargfunc)wrapped;
5711     PyObject *arg;
5712     Py_ssize_t i;
5713 
5714     if (PyTuple_GET_SIZE(args) == 1) {
5715         arg = PyTuple_GET_ITEM(args, 0);
5716         i = getindex(self, arg);
5717         if (i == -1 && PyErr_Occurred())
5718             return NULL;
5719         return (*func)(self, i);
5720     }
5721     check_num_args(args, 1);
5722     assert(PyErr_Occurred());
5723     return NULL;
5724 }
5725 
5726 static PyObject *
wrap_sq_setitem(PyObject * self,PyObject * args,void * wrapped)5727 wrap_sq_setitem(PyObject *self, PyObject *args, void *wrapped)
5728 {
5729     ssizeobjargproc func = (ssizeobjargproc)wrapped;
5730     Py_ssize_t i;
5731     int res;
5732     PyObject *arg, *value;
5733 
5734     if (!PyArg_UnpackTuple(args, "", 2, 2, &arg, &value))
5735         return NULL;
5736     i = getindex(self, arg);
5737     if (i == -1 && PyErr_Occurred())
5738         return NULL;
5739     res = (*func)(self, i, value);
5740     if (res == -1 && PyErr_Occurred())
5741         return NULL;
5742     Py_RETURN_NONE;
5743 }
5744 
5745 static PyObject *
wrap_sq_delitem(PyObject * self,PyObject * args,void * wrapped)5746 wrap_sq_delitem(PyObject *self, PyObject *args, void *wrapped)
5747 {
5748     ssizeobjargproc func = (ssizeobjargproc)wrapped;
5749     Py_ssize_t i;
5750     int res;
5751     PyObject *arg;
5752 
5753     if (!check_num_args(args, 1))
5754         return NULL;
5755     arg = PyTuple_GET_ITEM(args, 0);
5756     i = getindex(self, arg);
5757     if (i == -1 && PyErr_Occurred())
5758         return NULL;
5759     res = (*func)(self, i, NULL);
5760     if (res == -1 && PyErr_Occurred())
5761         return NULL;
5762     Py_RETURN_NONE;
5763 }
5764 
5765 /* XXX objobjproc is a misnomer; should be objargpred */
5766 static PyObject *
wrap_objobjproc(PyObject * self,PyObject * args,void * wrapped)5767 wrap_objobjproc(PyObject *self, PyObject *args, void *wrapped)
5768 {
5769     objobjproc func = (objobjproc)wrapped;
5770     int res;
5771     PyObject *value;
5772 
5773     if (!check_num_args(args, 1))
5774         return NULL;
5775     value = PyTuple_GET_ITEM(args, 0);
5776     res = (*func)(self, value);
5777     if (res == -1 && PyErr_Occurred())
5778         return NULL;
5779     else
5780         return PyBool_FromLong(res);
5781 }
5782 
5783 static PyObject *
wrap_objobjargproc(PyObject * self,PyObject * args,void * wrapped)5784 wrap_objobjargproc(PyObject *self, PyObject *args, void *wrapped)
5785 {
5786     objobjargproc func = (objobjargproc)wrapped;
5787     int res;
5788     PyObject *key, *value;
5789 
5790     if (!PyArg_UnpackTuple(args, "", 2, 2, &key, &value))
5791         return NULL;
5792     res = (*func)(self, key, value);
5793     if (res == -1 && PyErr_Occurred())
5794         return NULL;
5795     Py_RETURN_NONE;
5796 }
5797 
5798 static PyObject *
wrap_delitem(PyObject * self,PyObject * args,void * wrapped)5799 wrap_delitem(PyObject *self, PyObject *args, void *wrapped)
5800 {
5801     objobjargproc func = (objobjargproc)wrapped;
5802     int res;
5803     PyObject *key;
5804 
5805     if (!check_num_args(args, 1))
5806         return NULL;
5807     key = PyTuple_GET_ITEM(args, 0);
5808     res = (*func)(self, key, NULL);
5809     if (res == -1 && PyErr_Occurred())
5810         return NULL;
5811     Py_RETURN_NONE;
5812 }
5813 
5814 /* Helper to check for object.__setattr__ or __delattr__ applied to a type.
5815    This is called the Carlo Verre hack after its discoverer.  See
5816    https://mail.python.org/pipermail/python-dev/2003-April/034535.html
5817    */
5818 static int
hackcheck(PyObject * self,setattrofunc func,const char * what)5819 hackcheck(PyObject *self, setattrofunc func, const char *what)
5820 {
5821     PyTypeObject *type = Py_TYPE(self);
5822     PyObject *mro = type->tp_mro;
5823     if (!mro) {
5824         /* Probably ok not to check the call in this case. */
5825         return 1;
5826     }
5827     assert(PyTuple_Check(mro));
5828 
5829     /* Find the (base) type that defined the type's slot function. */
5830     PyTypeObject *defining_type = type;
5831     Py_ssize_t i;
5832     for (i = PyTuple_GET_SIZE(mro) - 1; i >= 0; i--) {
5833         PyTypeObject *base = (PyTypeObject*) PyTuple_GET_ITEM(mro, i);
5834         if (base->tp_setattro == slot_tp_setattro) {
5835             /* Ignore Python classes:
5836                they never define their own C-level setattro. */
5837         }
5838         else if (base->tp_setattro == type->tp_setattro) {
5839             defining_type = base;
5840             break;
5841         }
5842     }
5843 
5844     /* Reject calls that jump over intermediate C-level overrides. */
5845     for (PyTypeObject *base = defining_type; base; base = base->tp_base) {
5846         if (base->tp_setattro == func) {
5847             /* 'func' is the right slot function to call. */
5848             break;
5849         }
5850         else if (base->tp_setattro != slot_tp_setattro) {
5851             /* 'base' is not a Python class and overrides 'func'.
5852                Its tp_setattro should be called instead. */
5853             PyErr_Format(PyExc_TypeError,
5854                          "can't apply this %s to %s object",
5855                          what,
5856                          type->tp_name);
5857             return 0;
5858         }
5859     }
5860     return 1;
5861 }
5862 
5863 static PyObject *
wrap_setattr(PyObject * self,PyObject * args,void * wrapped)5864 wrap_setattr(PyObject *self, PyObject *args, void *wrapped)
5865 {
5866     setattrofunc func = (setattrofunc)wrapped;
5867     int res;
5868     PyObject *name, *value;
5869 
5870     if (!PyArg_UnpackTuple(args, "", 2, 2, &name, &value))
5871         return NULL;
5872     if (!hackcheck(self, func, "__setattr__"))
5873         return NULL;
5874     res = (*func)(self, name, value);
5875     if (res < 0)
5876         return NULL;
5877     Py_RETURN_NONE;
5878 }
5879 
5880 static PyObject *
wrap_delattr(PyObject * self,PyObject * args,void * wrapped)5881 wrap_delattr(PyObject *self, PyObject *args, void *wrapped)
5882 {
5883     setattrofunc func = (setattrofunc)wrapped;
5884     int res;
5885     PyObject *name;
5886 
5887     if (!check_num_args(args, 1))
5888         return NULL;
5889     name = PyTuple_GET_ITEM(args, 0);
5890     if (!hackcheck(self, func, "__delattr__"))
5891         return NULL;
5892     res = (*func)(self, name, NULL);
5893     if (res < 0)
5894         return NULL;
5895     Py_RETURN_NONE;
5896 }
5897 
5898 static PyObject *
wrap_hashfunc(PyObject * self,PyObject * args,void * wrapped)5899 wrap_hashfunc(PyObject *self, PyObject *args, void *wrapped)
5900 {
5901     hashfunc func = (hashfunc)wrapped;
5902     Py_hash_t res;
5903 
5904     if (!check_num_args(args, 0))
5905         return NULL;
5906     res = (*func)(self);
5907     if (res == -1 && PyErr_Occurred())
5908         return NULL;
5909     return PyLong_FromSsize_t(res);
5910 }
5911 
5912 static PyObject *
wrap_call(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)5913 wrap_call(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
5914 {
5915     ternaryfunc func = (ternaryfunc)wrapped;
5916 
5917     return (*func)(self, args, kwds);
5918 }
5919 
5920 static PyObject *
wrap_del(PyObject * self,PyObject * args,void * wrapped)5921 wrap_del(PyObject *self, PyObject *args, void *wrapped)
5922 {
5923     destructor func = (destructor)wrapped;
5924 
5925     if (!check_num_args(args, 0))
5926         return NULL;
5927 
5928     (*func)(self);
5929     Py_RETURN_NONE;
5930 }
5931 
5932 static PyObject *
wrap_richcmpfunc(PyObject * self,PyObject * args,void * wrapped,int op)5933 wrap_richcmpfunc(PyObject *self, PyObject *args, void *wrapped, int op)
5934 {
5935     richcmpfunc func = (richcmpfunc)wrapped;
5936     PyObject *other;
5937 
5938     if (!check_num_args(args, 1))
5939         return NULL;
5940     other = PyTuple_GET_ITEM(args, 0);
5941     return (*func)(self, other, op);
5942 }
5943 
5944 #undef RICHCMP_WRAPPER
5945 #define RICHCMP_WRAPPER(NAME, OP) \
5946 static PyObject * \
5947 richcmp_##NAME(PyObject *self, PyObject *args, void *wrapped) \
5948 { \
5949     return wrap_richcmpfunc(self, args, wrapped, OP); \
5950 }
5951 
RICHCMP_WRAPPER(lt,Py_LT)5952 RICHCMP_WRAPPER(lt, Py_LT)
5953 RICHCMP_WRAPPER(le, Py_LE)
5954 RICHCMP_WRAPPER(eq, Py_EQ)
5955 RICHCMP_WRAPPER(ne, Py_NE)
5956 RICHCMP_WRAPPER(gt, Py_GT)
5957 RICHCMP_WRAPPER(ge, Py_GE)
5958 
5959 static PyObject *
5960 wrap_next(PyObject *self, PyObject *args, void *wrapped)
5961 {
5962     unaryfunc func = (unaryfunc)wrapped;
5963     PyObject *res;
5964 
5965     if (!check_num_args(args, 0))
5966         return NULL;
5967     res = (*func)(self);
5968     if (res == NULL && !PyErr_Occurred())
5969         PyErr_SetNone(PyExc_StopIteration);
5970     return res;
5971 }
5972 
5973 static PyObject *
wrap_descr_get(PyObject * self,PyObject * args,void * wrapped)5974 wrap_descr_get(PyObject *self, PyObject *args, void *wrapped)
5975 {
5976     descrgetfunc func = (descrgetfunc)wrapped;
5977     PyObject *obj;
5978     PyObject *type = NULL;
5979 
5980     if (!PyArg_UnpackTuple(args, "", 1, 2, &obj, &type))
5981         return NULL;
5982     if (obj == Py_None)
5983         obj = NULL;
5984     if (type == Py_None)
5985         type = NULL;
5986     if (type == NULL &&obj == NULL) {
5987         PyErr_SetString(PyExc_TypeError,
5988                         "__get__(None, None) is invalid");
5989         return NULL;
5990     }
5991     return (*func)(self, obj, type);
5992 }
5993 
5994 static PyObject *
wrap_descr_set(PyObject * self,PyObject * args,void * wrapped)5995 wrap_descr_set(PyObject *self, PyObject *args, void *wrapped)
5996 {
5997     descrsetfunc func = (descrsetfunc)wrapped;
5998     PyObject *obj, *value;
5999     int ret;
6000 
6001     if (!PyArg_UnpackTuple(args, "", 2, 2, &obj, &value))
6002         return NULL;
6003     ret = (*func)(self, obj, value);
6004     if (ret < 0)
6005         return NULL;
6006     Py_RETURN_NONE;
6007 }
6008 
6009 static PyObject *
wrap_descr_delete(PyObject * self,PyObject * args,void * wrapped)6010 wrap_descr_delete(PyObject *self, PyObject *args, void *wrapped)
6011 {
6012     descrsetfunc func = (descrsetfunc)wrapped;
6013     PyObject *obj;
6014     int ret;
6015 
6016     if (!check_num_args(args, 1))
6017         return NULL;
6018     obj = PyTuple_GET_ITEM(args, 0);
6019     ret = (*func)(self, obj, NULL);
6020     if (ret < 0)
6021         return NULL;
6022     Py_RETURN_NONE;
6023 }
6024 
6025 static PyObject *
wrap_init(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)6026 wrap_init(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
6027 {
6028     initproc func = (initproc)wrapped;
6029 
6030     if (func(self, args, kwds) < 0)
6031         return NULL;
6032     Py_RETURN_NONE;
6033 }
6034 
6035 static PyObject *
tp_new_wrapper(PyObject * self,PyObject * args,PyObject * kwds)6036 tp_new_wrapper(PyObject *self, PyObject *args, PyObject *kwds)
6037 {
6038     PyTypeObject *type, *subtype, *staticbase;
6039     PyObject *arg0, *res;
6040 
6041     if (self == NULL || !PyType_Check(self))
6042         Py_FatalError("__new__() called with non-type 'self'");
6043     type = (PyTypeObject *)self;
6044     if (!PyTuple_Check(args) || PyTuple_GET_SIZE(args) < 1) {
6045         PyErr_Format(PyExc_TypeError,
6046                      "%s.__new__(): not enough arguments",
6047                      type->tp_name);
6048         return NULL;
6049     }
6050     arg0 = PyTuple_GET_ITEM(args, 0);
6051     if (!PyType_Check(arg0)) {
6052         PyErr_Format(PyExc_TypeError,
6053                      "%s.__new__(X): X is not a type object (%s)",
6054                      type->tp_name,
6055                      Py_TYPE(arg0)->tp_name);
6056         return NULL;
6057     }
6058     subtype = (PyTypeObject *)arg0;
6059     if (!PyType_IsSubtype(subtype, type)) {
6060         PyErr_Format(PyExc_TypeError,
6061                      "%s.__new__(%s): %s is not a subtype of %s",
6062                      type->tp_name,
6063                      subtype->tp_name,
6064                      subtype->tp_name,
6065                      type->tp_name);
6066         return NULL;
6067     }
6068 
6069     /* Check that the use doesn't do something silly and unsafe like
6070        object.__new__(dict).  To do this, we check that the
6071        most derived base that's not a heap type is this type. */
6072     staticbase = subtype;
6073     while (staticbase && (staticbase->tp_new == slot_tp_new))
6074         staticbase = staticbase->tp_base;
6075     /* If staticbase is NULL now, it is a really weird type.
6076        In the spirit of backwards compatibility (?), just shut up. */
6077     if (staticbase && staticbase->tp_new != type->tp_new) {
6078         PyErr_Format(PyExc_TypeError,
6079                      "%s.__new__(%s) is not safe, use %s.__new__()",
6080                      type->tp_name,
6081                      subtype->tp_name,
6082                      staticbase->tp_name);
6083         return NULL;
6084     }
6085 
6086     args = PyTuple_GetSlice(args, 1, PyTuple_GET_SIZE(args));
6087     if (args == NULL)
6088         return NULL;
6089     res = type->tp_new(subtype, args, kwds);
6090     Py_DECREF(args);
6091     return res;
6092 }
6093 
6094 static struct PyMethodDef tp_new_methoddef[] = {
6095     {"__new__", (PyCFunction)(void(*)(void))tp_new_wrapper, METH_VARARGS|METH_KEYWORDS,
6096      PyDoc_STR("__new__($type, *args, **kwargs)\n--\n\n"
6097                "Create and return a new object.  "
6098                "See help(type) for accurate signature.")},
6099     {0}
6100 };
6101 
6102 static int
add_tp_new_wrapper(PyTypeObject * type)6103 add_tp_new_wrapper(PyTypeObject *type)
6104 {
6105     PyObject *func;
6106 
6107     if (_PyDict_GetItemIdWithError(type->tp_dict, &PyId___new__) != NULL)
6108         return 0;
6109     if (PyErr_Occurred())
6110         return -1;
6111     func = PyCFunction_NewEx(tp_new_methoddef, (PyObject *)type, NULL);
6112     if (func == NULL)
6113         return -1;
6114     if (_PyDict_SetItemId(type->tp_dict, &PyId___new__, func)) {
6115         Py_DECREF(func);
6116         return -1;
6117     }
6118     Py_DECREF(func);
6119     return 0;
6120 }
6121 
6122 /* Slot wrappers that call the corresponding __foo__ slot.  See comments
6123    below at override_slots() for more explanation. */
6124 
6125 #define SLOT0(FUNCNAME, OPSTR) \
6126 static PyObject * \
6127 FUNCNAME(PyObject *self) \
6128 { \
6129     _Py_static_string(id, OPSTR); \
6130     return call_method(self, &id, NULL, 0); \
6131 }
6132 
6133 #define SLOT1(FUNCNAME, OPSTR, ARG1TYPE) \
6134 static PyObject * \
6135 FUNCNAME(PyObject *self, ARG1TYPE arg1) \
6136 { \
6137     PyObject* stack[1] = {arg1}; \
6138     _Py_static_string(id, OPSTR); \
6139     return call_method(self, &id, stack, 1); \
6140 }
6141 
6142 /* Boolean helper for SLOT1BINFULL().
6143    right.__class__ is a nontrivial subclass of left.__class__. */
6144 static int
method_is_overloaded(PyObject * left,PyObject * right,struct _Py_Identifier * name)6145 method_is_overloaded(PyObject *left, PyObject *right, struct _Py_Identifier *name)
6146 {
6147     PyObject *a, *b;
6148     int ok;
6149 
6150     if (_PyObject_LookupAttrId((PyObject *)(Py_TYPE(right)), name, &b) < 0) {
6151         return -1;
6152     }
6153     if (b == NULL) {
6154         /* If right doesn't have it, it's not overloaded */
6155         return 0;
6156     }
6157 
6158     if (_PyObject_LookupAttrId((PyObject *)(Py_TYPE(left)), name, &a) < 0) {
6159         Py_DECREF(b);
6160         return -1;
6161     }
6162     if (a == NULL) {
6163         Py_DECREF(b);
6164         /* If right has it but left doesn't, it's overloaded */
6165         return 1;
6166     }
6167 
6168     ok = PyObject_RichCompareBool(a, b, Py_NE);
6169     Py_DECREF(a);
6170     Py_DECREF(b);
6171     return ok;
6172 }
6173 
6174 
6175 #define SLOT1BINFULL(FUNCNAME, TESTFUNC, SLOTNAME, OPSTR, ROPSTR) \
6176 static PyObject * \
6177 FUNCNAME(PyObject *self, PyObject *other) \
6178 { \
6179     PyObject* stack[1]; \
6180     _Py_static_string(op_id, OPSTR); \
6181     _Py_static_string(rop_id, ROPSTR); \
6182     int do_other = Py_TYPE(self) != Py_TYPE(other) && \
6183         Py_TYPE(other)->tp_as_number != NULL && \
6184         Py_TYPE(other)->tp_as_number->SLOTNAME == TESTFUNC; \
6185     if (Py_TYPE(self)->tp_as_number != NULL && \
6186         Py_TYPE(self)->tp_as_number->SLOTNAME == TESTFUNC) { \
6187         PyObject *r; \
6188         if (do_other && PyType_IsSubtype(Py_TYPE(other), Py_TYPE(self))) { \
6189             int ok = method_is_overloaded(self, other, &rop_id); \
6190             if (ok < 0) { \
6191                 return NULL; \
6192             } \
6193             if (ok) { \
6194                 stack[0] = self; \
6195                 r = call_maybe(other, &rop_id, stack, 1); \
6196                 if (r != Py_NotImplemented) \
6197                     return r; \
6198                 Py_DECREF(r); \
6199                 do_other = 0; \
6200             } \
6201         } \
6202         stack[0] = other; \
6203         r = call_maybe(self, &op_id, stack, 1); \
6204         if (r != Py_NotImplemented || \
6205             Py_TYPE(other) == Py_TYPE(self)) \
6206             return r; \
6207         Py_DECREF(r); \
6208     } \
6209     if (do_other) { \
6210         stack[0] = self; \
6211         return call_maybe(other, &rop_id, stack, 1); \
6212     } \
6213     Py_RETURN_NOTIMPLEMENTED; \
6214 }
6215 
6216 #define SLOT1BIN(FUNCNAME, SLOTNAME, OPSTR, ROPSTR) \
6217     SLOT1BINFULL(FUNCNAME, FUNCNAME, SLOTNAME, OPSTR, ROPSTR)
6218 
6219 static Py_ssize_t
slot_sq_length(PyObject * self)6220 slot_sq_length(PyObject *self)
6221 {
6222     PyObject *res = call_method(self, &PyId___len__, NULL, 0);
6223     Py_ssize_t len;
6224 
6225     if (res == NULL)
6226         return -1;
6227 
6228     Py_SETREF(res, PyNumber_Index(res));
6229     if (res == NULL)
6230         return -1;
6231 
6232     assert(PyLong_Check(res));
6233     if (Py_SIZE(res) < 0) {
6234         Py_DECREF(res);
6235         PyErr_SetString(PyExc_ValueError,
6236                         "__len__() should return >= 0");
6237         return -1;
6238     }
6239 
6240     len = PyNumber_AsSsize_t(res, PyExc_OverflowError);
6241     assert(len >= 0 || PyErr_ExceptionMatches(PyExc_OverflowError));
6242     Py_DECREF(res);
6243     return len;
6244 }
6245 
6246 static PyObject *
slot_sq_item(PyObject * self,Py_ssize_t i)6247 slot_sq_item(PyObject *self, Py_ssize_t i)
6248 {
6249     PyObject *retval;
6250     PyObject *args[1];
6251     PyObject *ival = PyLong_FromSsize_t(i);
6252     if (ival == NULL) {
6253         return NULL;
6254     }
6255     args[0] = ival;
6256     retval = call_method(self, &PyId___getitem__, args, 1);
6257     Py_DECREF(ival);
6258     return retval;
6259 }
6260 
6261 static int
slot_sq_ass_item(PyObject * self,Py_ssize_t index,PyObject * value)6262 slot_sq_ass_item(PyObject *self, Py_ssize_t index, PyObject *value)
6263 {
6264     PyObject *stack[2];
6265     PyObject *res;
6266     PyObject *index_obj;
6267 
6268     index_obj = PyLong_FromSsize_t(index);
6269     if (index_obj == NULL) {
6270         return -1;
6271     }
6272 
6273     stack[0] = index_obj;
6274     if (value == NULL) {
6275         res = call_method(self, &PyId___delitem__, stack, 1);
6276     }
6277     else {
6278         stack[1] = value;
6279         res = call_method(self, &PyId___setitem__, stack, 2);
6280     }
6281     Py_DECREF(index_obj);
6282 
6283     if (res == NULL) {
6284         return -1;
6285     }
6286     Py_DECREF(res);
6287     return 0;
6288 }
6289 
6290 static int
slot_sq_contains(PyObject * self,PyObject * value)6291 slot_sq_contains(PyObject *self, PyObject *value)
6292 {
6293     PyObject *func, *res;
6294     int result = -1, unbound;
6295     _Py_IDENTIFIER(__contains__);
6296 
6297     func = lookup_maybe_method(self, &PyId___contains__, &unbound);
6298     if (func == Py_None) {
6299         Py_DECREF(func);
6300         PyErr_Format(PyExc_TypeError,
6301                      "'%.200s' object is not a container",
6302                      Py_TYPE(self)->tp_name);
6303         return -1;
6304     }
6305     if (func != NULL) {
6306         PyObject *args[1] = {value};
6307         res = call_unbound(unbound, func, self, args, 1);
6308         Py_DECREF(func);
6309         if (res != NULL) {
6310             result = PyObject_IsTrue(res);
6311             Py_DECREF(res);
6312         }
6313     }
6314     else if (! PyErr_Occurred()) {
6315         /* Possible results: -1 and 1 */
6316         result = (int)_PySequence_IterSearch(self, value,
6317                                          PY_ITERSEARCH_CONTAINS);
6318     }
6319     return result;
6320 }
6321 
6322 #define slot_mp_length slot_sq_length
6323 
6324 SLOT1(slot_mp_subscript, "__getitem__", PyObject *)
6325 
6326 static int
slot_mp_ass_subscript(PyObject * self,PyObject * key,PyObject * value)6327 slot_mp_ass_subscript(PyObject *self, PyObject *key, PyObject *value)
6328 {
6329     PyObject *stack[2];
6330     PyObject *res;
6331 
6332     stack[0] = key;
6333     if (value == NULL) {
6334         res = call_method(self, &PyId___delitem__, stack, 1);
6335     }
6336     else {
6337         stack[1] = value;
6338         res = call_method(self, &PyId___setitem__, stack, 2);
6339     }
6340 
6341     if (res == NULL)
6342         return -1;
6343     Py_DECREF(res);
6344     return 0;
6345 }
6346 
6347 SLOT1BIN(slot_nb_add, nb_add, "__add__", "__radd__")
6348 SLOT1BIN(slot_nb_subtract, nb_subtract, "__sub__", "__rsub__")
6349 SLOT1BIN(slot_nb_multiply, nb_multiply, "__mul__", "__rmul__")
6350 SLOT1BIN(slot_nb_matrix_multiply, nb_matrix_multiply, "__matmul__", "__rmatmul__")
6351 SLOT1BIN(slot_nb_remainder, nb_remainder, "__mod__", "__rmod__")
6352 SLOT1BIN(slot_nb_divmod, nb_divmod, "__divmod__", "__rdivmod__")
6353 
6354 static PyObject *slot_nb_power(PyObject *, PyObject *, PyObject *);
6355 
6356 SLOT1BINFULL(slot_nb_power_binary, slot_nb_power,
6357              nb_power, "__pow__", "__rpow__")
6358 
6359 static PyObject *
slot_nb_power(PyObject * self,PyObject * other,PyObject * modulus)6360 slot_nb_power(PyObject *self, PyObject *other, PyObject *modulus)
6361 {
6362     _Py_IDENTIFIER(__pow__);
6363 
6364     if (modulus == Py_None)
6365         return slot_nb_power_binary(self, other);
6366     /* Three-arg power doesn't use __rpow__.  But ternary_op
6367        can call this when the second argument's type uses
6368        slot_nb_power, so check before calling self.__pow__. */
6369     if (Py_TYPE(self)->tp_as_number != NULL &&
6370         Py_TYPE(self)->tp_as_number->nb_power == slot_nb_power) {
6371         PyObject* stack[2] = {other, modulus};
6372         return call_method(self, &PyId___pow__, stack, 2);
6373     }
6374     Py_RETURN_NOTIMPLEMENTED;
6375 }
6376 
6377 SLOT0(slot_nb_negative, "__neg__")
6378 SLOT0(slot_nb_positive, "__pos__")
6379 SLOT0(slot_nb_absolute, "__abs__")
6380 
6381 static int
slot_nb_bool(PyObject * self)6382 slot_nb_bool(PyObject *self)
6383 {
6384     PyObject *func, *value;
6385     int result, unbound;
6386     int using_len = 0;
6387     _Py_IDENTIFIER(__bool__);
6388 
6389     func = lookup_maybe_method(self, &PyId___bool__, &unbound);
6390     if (func == NULL) {
6391         if (PyErr_Occurred()) {
6392             return -1;
6393         }
6394 
6395         func = lookup_maybe_method(self, &PyId___len__, &unbound);
6396         if (func == NULL) {
6397             if (PyErr_Occurred()) {
6398                 return -1;
6399             }
6400             return 1;
6401         }
6402         using_len = 1;
6403     }
6404 
6405     value = call_unbound_noarg(unbound, func, self);
6406     if (value == NULL) {
6407         goto error;
6408     }
6409 
6410     if (using_len) {
6411         /* bool type enforced by slot_nb_len */
6412         result = PyObject_IsTrue(value);
6413     }
6414     else if (PyBool_Check(value)) {
6415         result = PyObject_IsTrue(value);
6416     }
6417     else {
6418         PyErr_Format(PyExc_TypeError,
6419                      "__bool__ should return "
6420                      "bool, returned %s",
6421                      Py_TYPE(value)->tp_name);
6422         result = -1;
6423     }
6424 
6425     Py_DECREF(value);
6426     Py_DECREF(func);
6427     return result;
6428 
6429 error:
6430     Py_DECREF(func);
6431     return -1;
6432 }
6433 
6434 
6435 static PyObject *
slot_nb_index(PyObject * self)6436 slot_nb_index(PyObject *self)
6437 {
6438     _Py_IDENTIFIER(__index__);
6439     return call_method(self, &PyId___index__, NULL, 0);
6440 }
6441 
6442 
6443 SLOT0(slot_nb_invert, "__invert__")
6444 SLOT1BIN(slot_nb_lshift, nb_lshift, "__lshift__", "__rlshift__")
6445 SLOT1BIN(slot_nb_rshift, nb_rshift, "__rshift__", "__rrshift__")
6446 SLOT1BIN(slot_nb_and, nb_and, "__and__", "__rand__")
6447 SLOT1BIN(slot_nb_xor, nb_xor, "__xor__", "__rxor__")
6448 SLOT1BIN(slot_nb_or, nb_or, "__or__", "__ror__")
6449 
6450 SLOT0(slot_nb_int, "__int__")
6451 SLOT0(slot_nb_float, "__float__")
6452 SLOT1(slot_nb_inplace_add, "__iadd__", PyObject *)
6453 SLOT1(slot_nb_inplace_subtract, "__isub__", PyObject *)
6454 SLOT1(slot_nb_inplace_multiply, "__imul__", PyObject *)
6455 SLOT1(slot_nb_inplace_matrix_multiply, "__imatmul__", PyObject *)
6456 SLOT1(slot_nb_inplace_remainder, "__imod__", PyObject *)
6457 /* Can't use SLOT1 here, because nb_inplace_power is ternary */
6458 static PyObject *
slot_nb_inplace_power(PyObject * self,PyObject * arg1,PyObject * arg2)6459 slot_nb_inplace_power(PyObject *self, PyObject * arg1, PyObject *arg2)
6460 {
6461     PyObject *stack[1] = {arg1};
6462     _Py_IDENTIFIER(__ipow__);
6463     return call_method(self, &PyId___ipow__, stack, 1);
6464 }
6465 SLOT1(slot_nb_inplace_lshift, "__ilshift__", PyObject *)
6466 SLOT1(slot_nb_inplace_rshift, "__irshift__", PyObject *)
6467 SLOT1(slot_nb_inplace_and, "__iand__", PyObject *)
6468 SLOT1(slot_nb_inplace_xor, "__ixor__", PyObject *)
6469 SLOT1(slot_nb_inplace_or, "__ior__", PyObject *)
6470 SLOT1BIN(slot_nb_floor_divide, nb_floor_divide,
6471          "__floordiv__", "__rfloordiv__")
6472 SLOT1BIN(slot_nb_true_divide, nb_true_divide, "__truediv__", "__rtruediv__")
6473 SLOT1(slot_nb_inplace_floor_divide, "__ifloordiv__", PyObject *)
6474 SLOT1(slot_nb_inplace_true_divide, "__itruediv__", PyObject *)
6475 
6476 static PyObject *
slot_tp_repr(PyObject * self)6477 slot_tp_repr(PyObject *self)
6478 {
6479     PyObject *func, *res;
6480     _Py_IDENTIFIER(__repr__);
6481     int unbound;
6482 
6483     func = lookup_maybe_method(self, &PyId___repr__, &unbound);
6484     if (func != NULL) {
6485         res = call_unbound_noarg(unbound, func, self);
6486         Py_DECREF(func);
6487         return res;
6488     }
6489     PyErr_Clear();
6490     return PyUnicode_FromFormat("<%s object at %p>",
6491                                Py_TYPE(self)->tp_name, self);
6492 }
6493 
6494 SLOT0(slot_tp_str, "__str__")
6495 
6496 static Py_hash_t
slot_tp_hash(PyObject * self)6497 slot_tp_hash(PyObject *self)
6498 {
6499     PyObject *func, *res;
6500     Py_ssize_t h;
6501     int unbound;
6502 
6503     func = lookup_maybe_method(self, &PyId___hash__, &unbound);
6504 
6505     if (func == Py_None) {
6506         Py_DECREF(func);
6507         func = NULL;
6508     }
6509 
6510     if (func == NULL) {
6511         return PyObject_HashNotImplemented(self);
6512     }
6513 
6514     res = call_unbound_noarg(unbound, func, self);
6515     Py_DECREF(func);
6516     if (res == NULL)
6517         return -1;
6518 
6519     if (!PyLong_Check(res)) {
6520         PyErr_SetString(PyExc_TypeError,
6521                         "__hash__ method should return an integer");
6522         return -1;
6523     }
6524     /* Transform the PyLong `res` to a Py_hash_t `h`.  For an existing
6525        hashable Python object x, hash(x) will always lie within the range of
6526        Py_hash_t.  Therefore our transformation must preserve values that
6527        already lie within this range, to ensure that if x.__hash__() returns
6528        hash(y) then hash(x) == hash(y). */
6529     h = PyLong_AsSsize_t(res);
6530     if (h == -1 && PyErr_Occurred()) {
6531         /* res was not within the range of a Py_hash_t, so we're free to
6532            use any sufficiently bit-mixing transformation;
6533            long.__hash__ will do nicely. */
6534         PyErr_Clear();
6535         h = PyLong_Type.tp_hash(res);
6536     }
6537     /* -1 is reserved for errors. */
6538     if (h == -1)
6539         h = -2;
6540     Py_DECREF(res);
6541     return h;
6542 }
6543 
6544 static PyObject *
slot_tp_call(PyObject * self,PyObject * args,PyObject * kwds)6545 slot_tp_call(PyObject *self, PyObject *args, PyObject *kwds)
6546 {
6547     _Py_IDENTIFIER(__call__);
6548     int unbound;
6549     PyObject *meth = lookup_method(self, &PyId___call__, &unbound);
6550     PyObject *res;
6551 
6552     if (meth == NULL)
6553         return NULL;
6554 
6555     if (unbound) {
6556         res = _PyObject_Call_Prepend(meth, self, args, kwds);
6557     }
6558     else {
6559         res = PyObject_Call(meth, args, kwds);
6560     }
6561 
6562     Py_DECREF(meth);
6563     return res;
6564 }
6565 
6566 /* There are two slot dispatch functions for tp_getattro.
6567 
6568    - slot_tp_getattro() is used when __getattribute__ is overridden
6569      but no __getattr__ hook is present;
6570 
6571    - slot_tp_getattr_hook() is used when a __getattr__ hook is present.
6572 
6573    The code in update_one_slot() always installs slot_tp_getattr_hook(); this
6574    detects the absence of __getattr__ and then installs the simpler slot if
6575    necessary. */
6576 
6577 static PyObject *
slot_tp_getattro(PyObject * self,PyObject * name)6578 slot_tp_getattro(PyObject *self, PyObject *name)
6579 {
6580     PyObject *stack[1] = {name};
6581     return call_method(self, &PyId___getattribute__, stack, 1);
6582 }
6583 
6584 static PyObject *
call_attribute(PyObject * self,PyObject * attr,PyObject * name)6585 call_attribute(PyObject *self, PyObject *attr, PyObject *name)
6586 {
6587     PyObject *res, *descr = NULL;
6588     descrgetfunc f = Py_TYPE(attr)->tp_descr_get;
6589 
6590     if (f != NULL) {
6591         descr = f(attr, self, (PyObject *)(Py_TYPE(self)));
6592         if (descr == NULL)
6593             return NULL;
6594         else
6595             attr = descr;
6596     }
6597     res = PyObject_CallFunctionObjArgs(attr, name, NULL);
6598     Py_XDECREF(descr);
6599     return res;
6600 }
6601 
6602 static PyObject *
slot_tp_getattr_hook(PyObject * self,PyObject * name)6603 slot_tp_getattr_hook(PyObject *self, PyObject *name)
6604 {
6605     PyTypeObject *tp = Py_TYPE(self);
6606     PyObject *getattr, *getattribute, *res;
6607     _Py_IDENTIFIER(__getattr__);
6608 
6609     /* speed hack: we could use lookup_maybe, but that would resolve the
6610        method fully for each attribute lookup for classes with
6611        __getattr__, even when the attribute is present. So we use
6612        _PyType_Lookup and create the method only when needed, with
6613        call_attribute. */
6614     getattr = _PyType_LookupId(tp, &PyId___getattr__);
6615     if (getattr == NULL) {
6616         /* No __getattr__ hook: use a simpler dispatcher */
6617         tp->tp_getattro = slot_tp_getattro;
6618         return slot_tp_getattro(self, name);
6619     }
6620     Py_INCREF(getattr);
6621     /* speed hack: we could use lookup_maybe, but that would resolve the
6622        method fully for each attribute lookup for classes with
6623        __getattr__, even when self has the default __getattribute__
6624        method. So we use _PyType_Lookup and create the method only when
6625        needed, with call_attribute. */
6626     getattribute = _PyType_LookupId(tp, &PyId___getattribute__);
6627     if (getattribute == NULL ||
6628         (Py_TYPE(getattribute) == &PyWrapperDescr_Type &&
6629          ((PyWrapperDescrObject *)getattribute)->d_wrapped ==
6630          (void *)PyObject_GenericGetAttr))
6631         res = PyObject_GenericGetAttr(self, name);
6632     else {
6633         Py_INCREF(getattribute);
6634         res = call_attribute(self, getattribute, name);
6635         Py_DECREF(getattribute);
6636     }
6637     if (res == NULL && PyErr_ExceptionMatches(PyExc_AttributeError)) {
6638         PyErr_Clear();
6639         res = call_attribute(self, getattr, name);
6640     }
6641     Py_DECREF(getattr);
6642     return res;
6643 }
6644 
6645 static int
slot_tp_setattro(PyObject * self,PyObject * name,PyObject * value)6646 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value)
6647 {
6648     PyObject *stack[2];
6649     PyObject *res;
6650     _Py_IDENTIFIER(__delattr__);
6651     _Py_IDENTIFIER(__setattr__);
6652 
6653     stack[0] = name;
6654     if (value == NULL) {
6655         res = call_method(self, &PyId___delattr__, stack, 1);
6656     }
6657     else {
6658         stack[1] = value;
6659         res = call_method(self, &PyId___setattr__, stack, 2);
6660     }
6661     if (res == NULL)
6662         return -1;
6663     Py_DECREF(res);
6664     return 0;
6665 }
6666 
6667 static _Py_Identifier name_op[] = {
6668     {0, "__lt__", 0},
6669     {0, "__le__", 0},
6670     {0, "__eq__", 0},
6671     {0, "__ne__", 0},
6672     {0, "__gt__", 0},
6673     {0, "__ge__", 0}
6674 };
6675 
6676 static PyObject *
slot_tp_richcompare(PyObject * self,PyObject * other,int op)6677 slot_tp_richcompare(PyObject *self, PyObject *other, int op)
6678 {
6679     int unbound;
6680     PyObject *func, *res;
6681 
6682     func = lookup_maybe_method(self, &name_op[op], &unbound);
6683     if (func == NULL) {
6684         PyErr_Clear();
6685         Py_RETURN_NOTIMPLEMENTED;
6686     }
6687 
6688     PyObject *args[1] = {other};
6689     res = call_unbound(unbound, func, self, args, 1);
6690     Py_DECREF(func);
6691     return res;
6692 }
6693 
6694 static PyObject *
slot_tp_iter(PyObject * self)6695 slot_tp_iter(PyObject *self)
6696 {
6697     int unbound;
6698     PyObject *func, *res;
6699     _Py_IDENTIFIER(__iter__);
6700 
6701     func = lookup_maybe_method(self, &PyId___iter__, &unbound);
6702     if (func == Py_None) {
6703         Py_DECREF(func);
6704         PyErr_Format(PyExc_TypeError,
6705                      "'%.200s' object is not iterable",
6706                      Py_TYPE(self)->tp_name);
6707         return NULL;
6708     }
6709 
6710     if (func != NULL) {
6711         res = call_unbound_noarg(unbound, func, self);
6712         Py_DECREF(func);
6713         return res;
6714     }
6715 
6716     PyErr_Clear();
6717     func = lookup_maybe_method(self, &PyId___getitem__, &unbound);
6718     if (func == NULL) {
6719         PyErr_Format(PyExc_TypeError,
6720                      "'%.200s' object is not iterable",
6721                      Py_TYPE(self)->tp_name);
6722         return NULL;
6723     }
6724     Py_DECREF(func);
6725     return PySeqIter_New(self);
6726 }
6727 
6728 static PyObject *
slot_tp_iternext(PyObject * self)6729 slot_tp_iternext(PyObject *self)
6730 {
6731     _Py_IDENTIFIER(__next__);
6732     return call_method(self, &PyId___next__, NULL, 0);
6733 }
6734 
6735 static PyObject *
slot_tp_descr_get(PyObject * self,PyObject * obj,PyObject * type)6736 slot_tp_descr_get(PyObject *self, PyObject *obj, PyObject *type)
6737 {
6738     PyTypeObject *tp = Py_TYPE(self);
6739     PyObject *get;
6740     _Py_IDENTIFIER(__get__);
6741 
6742     get = _PyType_LookupId(tp, &PyId___get__);
6743     if (get == NULL) {
6744         /* Avoid further slowdowns */
6745         if (tp->tp_descr_get == slot_tp_descr_get)
6746             tp->tp_descr_get = NULL;
6747         Py_INCREF(self);
6748         return self;
6749     }
6750     if (obj == NULL)
6751         obj = Py_None;
6752     if (type == NULL)
6753         type = Py_None;
6754     return PyObject_CallFunctionObjArgs(get, self, obj, type, NULL);
6755 }
6756 
6757 static int
slot_tp_descr_set(PyObject * self,PyObject * target,PyObject * value)6758 slot_tp_descr_set(PyObject *self, PyObject *target, PyObject *value)
6759 {
6760     PyObject* stack[2];
6761     PyObject *res;
6762     _Py_IDENTIFIER(__delete__);
6763     _Py_IDENTIFIER(__set__);
6764 
6765     stack[0] = target;
6766     if (value == NULL) {
6767         res = call_method(self, &PyId___delete__, stack, 1);
6768     }
6769     else {
6770         stack[1] = value;
6771         res = call_method(self, &PyId___set__, stack, 2);
6772     }
6773     if (res == NULL)
6774         return -1;
6775     Py_DECREF(res);
6776     return 0;
6777 }
6778 
6779 static int
slot_tp_init(PyObject * self,PyObject * args,PyObject * kwds)6780 slot_tp_init(PyObject *self, PyObject *args, PyObject *kwds)
6781 {
6782     _Py_IDENTIFIER(__init__);
6783     int unbound;
6784     PyObject *meth = lookup_method(self, &PyId___init__, &unbound);
6785     PyObject *res;
6786 
6787     if (meth == NULL)
6788         return -1;
6789     if (unbound) {
6790         res = _PyObject_Call_Prepend(meth, self, args, kwds);
6791     }
6792     else {
6793         res = PyObject_Call(meth, args, kwds);
6794     }
6795     Py_DECREF(meth);
6796     if (res == NULL)
6797         return -1;
6798     if (res != Py_None) {
6799         PyErr_Format(PyExc_TypeError,
6800                      "__init__() should return None, not '%.200s'",
6801                      Py_TYPE(res)->tp_name);
6802         Py_DECREF(res);
6803         return -1;
6804     }
6805     Py_DECREF(res);
6806     return 0;
6807 }
6808 
6809 static PyObject *
slot_tp_new(PyTypeObject * type,PyObject * args,PyObject * kwds)6810 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
6811 {
6812     PyObject *func, *result;
6813 
6814     func = _PyObject_GetAttrId((PyObject *)type, &PyId___new__);
6815     if (func == NULL) {
6816         return NULL;
6817     }
6818 
6819     result = _PyObject_Call_Prepend(func, (PyObject *)type, args, kwds);
6820     Py_DECREF(func);
6821     return result;
6822 }
6823 
6824 static void
slot_tp_finalize(PyObject * self)6825 slot_tp_finalize(PyObject *self)
6826 {
6827     _Py_IDENTIFIER(__del__);
6828     int unbound;
6829     PyObject *del, *res;
6830     PyObject *error_type, *error_value, *error_traceback;
6831 
6832     /* Save the current exception, if any. */
6833     PyErr_Fetch(&error_type, &error_value, &error_traceback);
6834 
6835     /* Execute __del__ method, if any. */
6836     del = lookup_maybe_method(self, &PyId___del__, &unbound);
6837     if (del != NULL) {
6838         res = call_unbound_noarg(unbound, del, self);
6839         if (res == NULL)
6840             PyErr_WriteUnraisable(del);
6841         else
6842             Py_DECREF(res);
6843         Py_DECREF(del);
6844     }
6845 
6846     /* Restore the saved exception. */
6847     PyErr_Restore(error_type, error_value, error_traceback);
6848 }
6849 
6850 static PyObject *
slot_am_await(PyObject * self)6851 slot_am_await(PyObject *self)
6852 {
6853     int unbound;
6854     PyObject *func, *res;
6855     _Py_IDENTIFIER(__await__);
6856 
6857     func = lookup_maybe_method(self, &PyId___await__, &unbound);
6858     if (func != NULL) {
6859         res = call_unbound_noarg(unbound, func, self);
6860         Py_DECREF(func);
6861         return res;
6862     }
6863     PyErr_Format(PyExc_AttributeError,
6864                  "object %.50s does not have __await__ method",
6865                  Py_TYPE(self)->tp_name);
6866     return NULL;
6867 }
6868 
6869 static PyObject *
slot_am_aiter(PyObject * self)6870 slot_am_aiter(PyObject *self)
6871 {
6872     int unbound;
6873     PyObject *func, *res;
6874     _Py_IDENTIFIER(__aiter__);
6875 
6876     func = lookup_maybe_method(self, &PyId___aiter__, &unbound);
6877     if (func != NULL) {
6878         res = call_unbound_noarg(unbound, func, self);
6879         Py_DECREF(func);
6880         return res;
6881     }
6882     PyErr_Format(PyExc_AttributeError,
6883                  "object %.50s does not have __aiter__ method",
6884                  Py_TYPE(self)->tp_name);
6885     return NULL;
6886 }
6887 
6888 static PyObject *
slot_am_anext(PyObject * self)6889 slot_am_anext(PyObject *self)
6890 {
6891     int unbound;
6892     PyObject *func, *res;
6893     _Py_IDENTIFIER(__anext__);
6894 
6895     func = lookup_maybe_method(self, &PyId___anext__, &unbound);
6896     if (func != NULL) {
6897         res = call_unbound_noarg(unbound, func, self);
6898         Py_DECREF(func);
6899         return res;
6900     }
6901     PyErr_Format(PyExc_AttributeError,
6902                  "object %.50s does not have __anext__ method",
6903                  Py_TYPE(self)->tp_name);
6904     return NULL;
6905 }
6906 
6907 /*
6908 Table mapping __foo__ names to tp_foo offsets and slot_tp_foo wrapper functions.
6909 
6910 The table is ordered by offsets relative to the 'PyHeapTypeObject' structure,
6911 which incorporates the additional structures used for numbers, sequences and
6912 mappings.  Note that multiple names may map to the same slot (e.g. __eq__,
6913 __ne__ etc. all map to tp_richcompare) and one name may map to multiple slots
6914 (e.g. __str__ affects tp_str as well as tp_repr). The table is terminated with
6915 an all-zero entry.  (This table is further initialized in init_slotdefs().)
6916 */
6917 
6918 typedef struct wrapperbase slotdef;
6919 
6920 #undef TPSLOT
6921 #undef FLSLOT
6922 #undef AMSLOT
6923 #undef ETSLOT
6924 #undef SQSLOT
6925 #undef MPSLOT
6926 #undef NBSLOT
6927 #undef UNSLOT
6928 #undef IBSLOT
6929 #undef BINSLOT
6930 #undef RBINSLOT
6931 
6932 #define TPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6933     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
6934      PyDoc_STR(DOC)}
6935 #define FLSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC, FLAGS) \
6936     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
6937      PyDoc_STR(DOC), FLAGS}
6938 #define ETSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6939     {NAME, offsetof(PyHeapTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
6940      PyDoc_STR(DOC)}
6941 #define AMSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6942     ETSLOT(NAME, as_async.SLOT, FUNCTION, WRAPPER, DOC)
6943 #define SQSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6944     ETSLOT(NAME, as_sequence.SLOT, FUNCTION, WRAPPER, DOC)
6945 #define MPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6946     ETSLOT(NAME, as_mapping.SLOT, FUNCTION, WRAPPER, DOC)
6947 #define NBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6948     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, DOC)
6949 #define UNSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6950     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
6951            NAME "($self, /)\n--\n\n" DOC)
6952 #define IBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6953     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
6954            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
6955 #define BINSLOT(NAME, SLOT, FUNCTION, DOC) \
6956     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
6957            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
6958 #define RBINSLOT(NAME, SLOT, FUNCTION, DOC) \
6959     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
6960            NAME "($self, value, /)\n--\n\nReturn value" DOC "self.")
6961 #define BINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
6962     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
6963            NAME "($self, value, /)\n--\n\n" DOC)
6964 #define RBINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
6965     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
6966            NAME "($self, value, /)\n--\n\n" DOC)
6967 
6968 static slotdef slotdefs[] = {
6969     TPSLOT("__getattribute__", tp_getattr, NULL, NULL, ""),
6970     TPSLOT("__getattr__", tp_getattr, NULL, NULL, ""),
6971     TPSLOT("__setattr__", tp_setattr, NULL, NULL, ""),
6972     TPSLOT("__delattr__", tp_setattr, NULL, NULL, ""),
6973     TPSLOT("__repr__", tp_repr, slot_tp_repr, wrap_unaryfunc,
6974            "__repr__($self, /)\n--\n\nReturn repr(self)."),
6975     TPSLOT("__hash__", tp_hash, slot_tp_hash, wrap_hashfunc,
6976            "__hash__($self, /)\n--\n\nReturn hash(self)."),
6977     FLSLOT("__call__", tp_call, slot_tp_call, (wrapperfunc)(void(*)(void))wrap_call,
6978            "__call__($self, /, *args, **kwargs)\n--\n\nCall self as a function.",
6979            PyWrapperFlag_KEYWORDS),
6980     TPSLOT("__str__", tp_str, slot_tp_str, wrap_unaryfunc,
6981            "__str__($self, /)\n--\n\nReturn str(self)."),
6982     TPSLOT("__getattribute__", tp_getattro, slot_tp_getattr_hook,
6983            wrap_binaryfunc,
6984            "__getattribute__($self, name, /)\n--\n\nReturn getattr(self, name)."),
6985     TPSLOT("__getattr__", tp_getattro, slot_tp_getattr_hook, NULL, ""),
6986     TPSLOT("__setattr__", tp_setattro, slot_tp_setattro, wrap_setattr,
6987            "__setattr__($self, name, value, /)\n--\n\nImplement setattr(self, name, value)."),
6988     TPSLOT("__delattr__", tp_setattro, slot_tp_setattro, wrap_delattr,
6989            "__delattr__($self, name, /)\n--\n\nImplement delattr(self, name)."),
6990     TPSLOT("__lt__", tp_richcompare, slot_tp_richcompare, richcmp_lt,
6991            "__lt__($self, value, /)\n--\n\nReturn self<value."),
6992     TPSLOT("__le__", tp_richcompare, slot_tp_richcompare, richcmp_le,
6993            "__le__($self, value, /)\n--\n\nReturn self<=value."),
6994     TPSLOT("__eq__", tp_richcompare, slot_tp_richcompare, richcmp_eq,
6995            "__eq__($self, value, /)\n--\n\nReturn self==value."),
6996     TPSLOT("__ne__", tp_richcompare, slot_tp_richcompare, richcmp_ne,
6997            "__ne__($self, value, /)\n--\n\nReturn self!=value."),
6998     TPSLOT("__gt__", tp_richcompare, slot_tp_richcompare, richcmp_gt,
6999            "__gt__($self, value, /)\n--\n\nReturn self>value."),
7000     TPSLOT("__ge__", tp_richcompare, slot_tp_richcompare, richcmp_ge,
7001            "__ge__($self, value, /)\n--\n\nReturn self>=value."),
7002     TPSLOT("__iter__", tp_iter, slot_tp_iter, wrap_unaryfunc,
7003            "__iter__($self, /)\n--\n\nImplement iter(self)."),
7004     TPSLOT("__next__", tp_iternext, slot_tp_iternext, wrap_next,
7005            "__next__($self, /)\n--\n\nImplement next(self)."),
7006     TPSLOT("__get__", tp_descr_get, slot_tp_descr_get, wrap_descr_get,
7007            "__get__($self, instance, owner, /)\n--\n\nReturn an attribute of instance, which is of type owner."),
7008     TPSLOT("__set__", tp_descr_set, slot_tp_descr_set, wrap_descr_set,
7009            "__set__($self, instance, value, /)\n--\n\nSet an attribute of instance to value."),
7010     TPSLOT("__delete__", tp_descr_set, slot_tp_descr_set,
7011            wrap_descr_delete,
7012            "__delete__($self, instance, /)\n--\n\nDelete an attribute of instance."),
7013     FLSLOT("__init__", tp_init, slot_tp_init, (wrapperfunc)(void(*)(void))wrap_init,
7014            "__init__($self, /, *args, **kwargs)\n--\n\n"
7015            "Initialize self.  See help(type(self)) for accurate signature.",
7016            PyWrapperFlag_KEYWORDS),
7017     TPSLOT("__new__", tp_new, slot_tp_new, NULL,
7018            "__new__(type, /, *args, **kwargs)\n--\n\n"
7019            "Create and return new object.  See help(type) for accurate signature."),
7020     TPSLOT("__del__", tp_finalize, slot_tp_finalize, (wrapperfunc)wrap_del, ""),
7021 
7022     AMSLOT("__await__", am_await, slot_am_await, wrap_unaryfunc,
7023            "__await__($self, /)\n--\n\nReturn an iterator to be used in await expression."),
7024     AMSLOT("__aiter__", am_aiter, slot_am_aiter, wrap_unaryfunc,
7025            "__aiter__($self, /)\n--\n\nReturn an awaitable, that resolves in asynchronous iterator."),
7026     AMSLOT("__anext__", am_anext, slot_am_anext, wrap_unaryfunc,
7027            "__anext__($self, /)\n--\n\nReturn a value or raise StopAsyncIteration."),
7028 
7029     BINSLOT("__add__", nb_add, slot_nb_add,
7030            "+"),
7031     RBINSLOT("__radd__", nb_add, slot_nb_add,
7032            "+"),
7033     BINSLOT("__sub__", nb_subtract, slot_nb_subtract,
7034            "-"),
7035     RBINSLOT("__rsub__", nb_subtract, slot_nb_subtract,
7036            "-"),
7037     BINSLOT("__mul__", nb_multiply, slot_nb_multiply,
7038            "*"),
7039     RBINSLOT("__rmul__", nb_multiply, slot_nb_multiply,
7040            "*"),
7041     BINSLOT("__mod__", nb_remainder, slot_nb_remainder,
7042            "%"),
7043     RBINSLOT("__rmod__", nb_remainder, slot_nb_remainder,
7044            "%"),
7045     BINSLOTNOTINFIX("__divmod__", nb_divmod, slot_nb_divmod,
7046            "Return divmod(self, value)."),
7047     RBINSLOTNOTINFIX("__rdivmod__", nb_divmod, slot_nb_divmod,
7048            "Return divmod(value, self)."),
7049     NBSLOT("__pow__", nb_power, slot_nb_power, wrap_ternaryfunc,
7050            "__pow__($self, value, mod=None, /)\n--\n\nReturn pow(self, value, mod)."),
7051     NBSLOT("__rpow__", nb_power, slot_nb_power, wrap_ternaryfunc_r,
7052            "__rpow__($self, value, mod=None, /)\n--\n\nReturn pow(value, self, mod)."),
7053     UNSLOT("__neg__", nb_negative, slot_nb_negative, wrap_unaryfunc, "-self"),
7054     UNSLOT("__pos__", nb_positive, slot_nb_positive, wrap_unaryfunc, "+self"),
7055     UNSLOT("__abs__", nb_absolute, slot_nb_absolute, wrap_unaryfunc,
7056            "abs(self)"),
7057     UNSLOT("__bool__", nb_bool, slot_nb_bool, wrap_inquirypred,
7058            "self != 0"),
7059     UNSLOT("__invert__", nb_invert, slot_nb_invert, wrap_unaryfunc, "~self"),
7060     BINSLOT("__lshift__", nb_lshift, slot_nb_lshift, "<<"),
7061     RBINSLOT("__rlshift__", nb_lshift, slot_nb_lshift, "<<"),
7062     BINSLOT("__rshift__", nb_rshift, slot_nb_rshift, ">>"),
7063     RBINSLOT("__rrshift__", nb_rshift, slot_nb_rshift, ">>"),
7064     BINSLOT("__and__", nb_and, slot_nb_and, "&"),
7065     RBINSLOT("__rand__", nb_and, slot_nb_and, "&"),
7066     BINSLOT("__xor__", nb_xor, slot_nb_xor, "^"),
7067     RBINSLOT("__rxor__", nb_xor, slot_nb_xor, "^"),
7068     BINSLOT("__or__", nb_or, slot_nb_or, "|"),
7069     RBINSLOT("__ror__", nb_or, slot_nb_or, "|"),
7070     UNSLOT("__int__", nb_int, slot_nb_int, wrap_unaryfunc,
7071            "int(self)"),
7072     UNSLOT("__float__", nb_float, slot_nb_float, wrap_unaryfunc,
7073            "float(self)"),
7074     IBSLOT("__iadd__", nb_inplace_add, slot_nb_inplace_add,
7075            wrap_binaryfunc, "+="),
7076     IBSLOT("__isub__", nb_inplace_subtract, slot_nb_inplace_subtract,
7077            wrap_binaryfunc, "-="),
7078     IBSLOT("__imul__", nb_inplace_multiply, slot_nb_inplace_multiply,
7079            wrap_binaryfunc, "*="),
7080     IBSLOT("__imod__", nb_inplace_remainder, slot_nb_inplace_remainder,
7081            wrap_binaryfunc, "%="),
7082     IBSLOT("__ipow__", nb_inplace_power, slot_nb_inplace_power,
7083            wrap_ternaryfunc, "**="),
7084     IBSLOT("__ilshift__", nb_inplace_lshift, slot_nb_inplace_lshift,
7085            wrap_binaryfunc, "<<="),
7086     IBSLOT("__irshift__", nb_inplace_rshift, slot_nb_inplace_rshift,
7087            wrap_binaryfunc, ">>="),
7088     IBSLOT("__iand__", nb_inplace_and, slot_nb_inplace_and,
7089            wrap_binaryfunc, "&="),
7090     IBSLOT("__ixor__", nb_inplace_xor, slot_nb_inplace_xor,
7091            wrap_binaryfunc, "^="),
7092     IBSLOT("__ior__", nb_inplace_or, slot_nb_inplace_or,
7093            wrap_binaryfunc, "|="),
7094     BINSLOT("__floordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
7095     RBINSLOT("__rfloordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
7096     BINSLOT("__truediv__", nb_true_divide, slot_nb_true_divide, "/"),
7097     RBINSLOT("__rtruediv__", nb_true_divide, slot_nb_true_divide, "/"),
7098     IBSLOT("__ifloordiv__", nb_inplace_floor_divide,
7099            slot_nb_inplace_floor_divide, wrap_binaryfunc, "//="),
7100     IBSLOT("__itruediv__", nb_inplace_true_divide,
7101            slot_nb_inplace_true_divide, wrap_binaryfunc, "/="),
7102     NBSLOT("__index__", nb_index, slot_nb_index, wrap_unaryfunc,
7103            "__index__($self, /)\n--\n\n"
7104            "Return self converted to an integer, if self is suitable "
7105            "for use as an index into a list."),
7106     BINSLOT("__matmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
7107             "@"),
7108     RBINSLOT("__rmatmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
7109              "@"),
7110     IBSLOT("__imatmul__", nb_inplace_matrix_multiply, slot_nb_inplace_matrix_multiply,
7111            wrap_binaryfunc, "@="),
7112     MPSLOT("__len__", mp_length, slot_mp_length, wrap_lenfunc,
7113            "__len__($self, /)\n--\n\nReturn len(self)."),
7114     MPSLOT("__getitem__", mp_subscript, slot_mp_subscript,
7115            wrap_binaryfunc,
7116            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
7117     MPSLOT("__setitem__", mp_ass_subscript, slot_mp_ass_subscript,
7118            wrap_objobjargproc,
7119            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
7120     MPSLOT("__delitem__", mp_ass_subscript, slot_mp_ass_subscript,
7121            wrap_delitem,
7122            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
7123 
7124     SQSLOT("__len__", sq_length, slot_sq_length, wrap_lenfunc,
7125            "__len__($self, /)\n--\n\nReturn len(self)."),
7126     /* Heap types defining __add__/__mul__ have sq_concat/sq_repeat == NULL.
7127        The logic in abstract.c always falls back to nb_add/nb_multiply in
7128        this case.  Defining both the nb_* and the sq_* slots to call the
7129        user-defined methods has unexpected side-effects, as shown by
7130        test_descr.notimplemented() */
7131     SQSLOT("__add__", sq_concat, NULL, wrap_binaryfunc,
7132            "__add__($self, value, /)\n--\n\nReturn self+value."),
7133     SQSLOT("__mul__", sq_repeat, NULL, wrap_indexargfunc,
7134            "__mul__($self, value, /)\n--\n\nReturn self*value."),
7135     SQSLOT("__rmul__", sq_repeat, NULL, wrap_indexargfunc,
7136            "__rmul__($self, value, /)\n--\n\nReturn value*self."),
7137     SQSLOT("__getitem__", sq_item, slot_sq_item, wrap_sq_item,
7138            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
7139     SQSLOT("__setitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_setitem,
7140            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
7141     SQSLOT("__delitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_delitem,
7142            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
7143     SQSLOT("__contains__", sq_contains, slot_sq_contains, wrap_objobjproc,
7144            "__contains__($self, key, /)\n--\n\nReturn key in self."),
7145     SQSLOT("__iadd__", sq_inplace_concat, NULL,
7146            wrap_binaryfunc,
7147            "__iadd__($self, value, /)\n--\n\nImplement self+=value."),
7148     SQSLOT("__imul__", sq_inplace_repeat, NULL,
7149            wrap_indexargfunc,
7150            "__imul__($self, value, /)\n--\n\nImplement self*=value."),
7151 
7152     {NULL}
7153 };
7154 
7155 /* Given a type pointer and an offset gotten from a slotdef entry, return a
7156    pointer to the actual slot.  This is not quite the same as simply adding
7157    the offset to the type pointer, since it takes care to indirect through the
7158    proper indirection pointer (as_buffer, etc.); it returns NULL if the
7159    indirection pointer is NULL. */
7160 static void **
slotptr(PyTypeObject * type,int ioffset)7161 slotptr(PyTypeObject *type, int ioffset)
7162 {
7163     char *ptr;
7164     long offset = ioffset;
7165 
7166     /* Note: this depends on the order of the members of PyHeapTypeObject! */
7167     assert(offset >= 0);
7168     assert((size_t)offset < offsetof(PyHeapTypeObject, as_buffer));
7169     if ((size_t)offset >= offsetof(PyHeapTypeObject, as_sequence)) {
7170         ptr = (char *)type->tp_as_sequence;
7171         offset -= offsetof(PyHeapTypeObject, as_sequence);
7172     }
7173     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_mapping)) {
7174         ptr = (char *)type->tp_as_mapping;
7175         offset -= offsetof(PyHeapTypeObject, as_mapping);
7176     }
7177     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_number)) {
7178         ptr = (char *)type->tp_as_number;
7179         offset -= offsetof(PyHeapTypeObject, as_number);
7180     }
7181     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_async)) {
7182         ptr = (char *)type->tp_as_async;
7183         offset -= offsetof(PyHeapTypeObject, as_async);
7184     }
7185     else {
7186         ptr = (char *)type;
7187     }
7188     if (ptr != NULL)
7189         ptr += offset;
7190     return (void **)ptr;
7191 }
7192 
7193 /* Length of array of slotdef pointers used to store slots with the
7194    same __name__.  There should be at most MAX_EQUIV-1 slotdef entries with
7195    the same __name__, for any __name__. Since that's a static property, it is
7196    appropriate to declare fixed-size arrays for this. */
7197 #define MAX_EQUIV 10
7198 
7199 /* Return a slot pointer for a given name, but ONLY if the attribute has
7200    exactly one slot function.  The name must be an interned string. */
7201 static void **
resolve_slotdups(PyTypeObject * type,PyObject * name)7202 resolve_slotdups(PyTypeObject *type, PyObject *name)
7203 {
7204     /* XXX Maybe this could be optimized more -- but is it worth it? */
7205 
7206     /* pname and ptrs act as a little cache */
7207     static PyObject *pname;
7208     static slotdef *ptrs[MAX_EQUIV];
7209     slotdef *p, **pp;
7210     void **res, **ptr;
7211 
7212     if (pname != name) {
7213         /* Collect all slotdefs that match name into ptrs. */
7214         pname = name;
7215         pp = ptrs;
7216         for (p = slotdefs; p->name_strobj; p++) {
7217             if (p->name_strobj == name)
7218                 *pp++ = p;
7219         }
7220         *pp = NULL;
7221     }
7222 
7223     /* Look in all matching slots of the type; if exactly one of these has
7224        a filled-in slot, return its value.      Otherwise return NULL. */
7225     res = NULL;
7226     for (pp = ptrs; *pp; pp++) {
7227         ptr = slotptr(type, (*pp)->offset);
7228         if (ptr == NULL || *ptr == NULL)
7229             continue;
7230         if (res != NULL)
7231             return NULL;
7232         res = ptr;
7233     }
7234     return res;
7235 }
7236 
7237 /* Common code for update_slots_callback() and fixup_slot_dispatchers().  This
7238    does some incredibly complex thinking and then sticks something into the
7239    slot.  (It sees if the adjacent slotdefs for the same slot have conflicting
7240    interests, and then stores a generic wrapper or a specific function into
7241    the slot.)  Return a pointer to the next slotdef with a different offset,
7242    because that's convenient  for fixup_slot_dispatchers(). */
7243 static slotdef *
update_one_slot(PyTypeObject * type,slotdef * p)7244 update_one_slot(PyTypeObject *type, slotdef *p)
7245 {
7246     PyObject *descr;
7247     PyWrapperDescrObject *d;
7248     void *generic = NULL, *specific = NULL;
7249     int use_generic = 0;
7250     int offset = p->offset;
7251     int error;
7252     void **ptr = slotptr(type, offset);
7253 
7254     if (ptr == NULL) {
7255         do {
7256             ++p;
7257         } while (p->offset == offset);
7258         return p;
7259     }
7260     /* We may end up clearing live exceptions below, so make sure it's ours. */
7261     assert(!PyErr_Occurred());
7262     do {
7263         /* Use faster uncached lookup as we won't get any cache hits during type setup. */
7264         descr = find_name_in_mro(type, p->name_strobj, &error);
7265         if (descr == NULL) {
7266             if (error == -1) {
7267                 /* It is unlikely by not impossible that there has been an exception
7268                    during lookup. Since this function originally expected no errors,
7269                    we ignore them here in order to keep up the interface. */
7270                 PyErr_Clear();
7271             }
7272             if (ptr == (void**)&type->tp_iternext) {
7273                 specific = (void *)_PyObject_NextNotImplemented;
7274             }
7275             continue;
7276         }
7277         if (Py_TYPE(descr) == &PyWrapperDescr_Type &&
7278             ((PyWrapperDescrObject *)descr)->d_base->name_strobj == p->name_strobj) {
7279             void **tptr = resolve_slotdups(type, p->name_strobj);
7280             if (tptr == NULL || tptr == ptr)
7281                 generic = p->function;
7282             d = (PyWrapperDescrObject *)descr;
7283             if ((specific == NULL || specific == d->d_wrapped) &&
7284                 d->d_base->wrapper == p->wrapper &&
7285                 PyType_IsSubtype(type, PyDescr_TYPE(d)))
7286             {
7287                 specific = d->d_wrapped;
7288             }
7289             else {
7290                 /* We cannot use the specific slot function because either
7291                    - it is not unique: there are multiple methods for this
7292                      slot and they conflict
7293                    - the signature is wrong (as checked by the ->wrapper
7294                      comparison above)
7295                    - it's wrapping the wrong class
7296                  */
7297                 use_generic = 1;
7298             }
7299         }
7300         else if (Py_TYPE(descr) == &PyCFunction_Type &&
7301                  PyCFunction_GET_FUNCTION(descr) ==
7302                  (PyCFunction)(void(*)(void))tp_new_wrapper &&
7303                  ptr == (void**)&type->tp_new)
7304         {
7305             /* The __new__ wrapper is not a wrapper descriptor,
7306                so must be special-cased differently.
7307                If we don't do this, creating an instance will
7308                always use slot_tp_new which will look up
7309                __new__ in the MRO which will call tp_new_wrapper
7310                which will look through the base classes looking
7311                for a static base and call its tp_new (usually
7312                PyType_GenericNew), after performing various
7313                sanity checks and constructing a new argument
7314                list.  Cut all that nonsense short -- this speeds
7315                up instance creation tremendously. */
7316             specific = (void *)type->tp_new;
7317             /* XXX I'm not 100% sure that there isn't a hole
7318                in this reasoning that requires additional
7319                sanity checks.  I'll buy the first person to
7320                point out a bug in this reasoning a beer. */
7321         }
7322         else if (descr == Py_None &&
7323                  ptr == (void**)&type->tp_hash) {
7324             /* We specifically allow __hash__ to be set to None
7325                to prevent inheritance of the default
7326                implementation from object.__hash__ */
7327             specific = (void *)PyObject_HashNotImplemented;
7328         }
7329         else {
7330             use_generic = 1;
7331             generic = p->function;
7332         }
7333     } while ((++p)->offset == offset);
7334     if (specific && !use_generic)
7335         *ptr = specific;
7336     else
7337         *ptr = generic;
7338     return p;
7339 }
7340 
7341 /* In the type, update the slots whose slotdefs are gathered in the pp array.
7342    This is a callback for update_subclasses(). */
7343 static int
update_slots_callback(PyTypeObject * type,void * data)7344 update_slots_callback(PyTypeObject *type, void *data)
7345 {
7346     slotdef **pp = (slotdef **)data;
7347 
7348     for (; *pp; pp++)
7349         update_one_slot(type, *pp);
7350     return 0;
7351 }
7352 
7353 static int slotdefs_initialized = 0;
7354 /* Initialize the slotdefs table by adding interned string objects for the
7355    names. */
7356 static void
init_slotdefs(void)7357 init_slotdefs(void)
7358 {
7359     slotdef *p;
7360 
7361     if (slotdefs_initialized)
7362         return;
7363     for (p = slotdefs; p->name; p++) {
7364         /* Slots must be ordered by their offset in the PyHeapTypeObject. */
7365         assert(!p[1].name || p->offset <= p[1].offset);
7366         p->name_strobj = PyUnicode_InternFromString(p->name);
7367         if (!p->name_strobj || !PyUnicode_CHECK_INTERNED(p->name_strobj))
7368             Py_FatalError("Out of memory interning slotdef names");
7369     }
7370     slotdefs_initialized = 1;
7371 }
7372 
7373 /* Undo init_slotdefs, releasing the interned strings. */
clear_slotdefs(void)7374 static void clear_slotdefs(void)
7375 {
7376     slotdef *p;
7377     for (p = slotdefs; p->name; p++) {
7378         Py_CLEAR(p->name_strobj);
7379     }
7380     slotdefs_initialized = 0;
7381 }
7382 
7383 /* Update the slots after assignment to a class (type) attribute. */
7384 static int
update_slot(PyTypeObject * type,PyObject * name)7385 update_slot(PyTypeObject *type, PyObject *name)
7386 {
7387     slotdef *ptrs[MAX_EQUIV];
7388     slotdef *p;
7389     slotdef **pp;
7390     int offset;
7391 
7392     assert(PyUnicode_CheckExact(name));
7393     assert(PyUnicode_CHECK_INTERNED(name));
7394 
7395     init_slotdefs();
7396     pp = ptrs;
7397     for (p = slotdefs; p->name; p++) {
7398         if (p->name_strobj == name)
7399             *pp++ = p;
7400     }
7401     *pp = NULL;
7402     for (pp = ptrs; *pp; pp++) {
7403         p = *pp;
7404         offset = p->offset;
7405         while (p > slotdefs && (p-1)->offset == offset)
7406             --p;
7407         *pp = p;
7408     }
7409     if (ptrs[0] == NULL)
7410         return 0; /* Not an attribute that affects any slots */
7411     return update_subclasses(type, name,
7412                              update_slots_callback, (void *)ptrs);
7413 }
7414 
7415 /* Store the proper functions in the slot dispatches at class (type)
7416    definition time, based upon which operations the class overrides in its
7417    dict. */
7418 static void
fixup_slot_dispatchers(PyTypeObject * type)7419 fixup_slot_dispatchers(PyTypeObject *type)
7420 {
7421     slotdef *p;
7422 
7423     init_slotdefs();
7424     for (p = slotdefs; p->name; )
7425         p = update_one_slot(type, p);
7426 }
7427 
7428 static void
update_all_slots(PyTypeObject * type)7429 update_all_slots(PyTypeObject* type)
7430 {
7431     slotdef *p;
7432 
7433     /* Clear the VALID_VERSION flag of 'type' and all its subclasses. */
7434     PyType_Modified(type);
7435 
7436     init_slotdefs();
7437     for (p = slotdefs; p->name; p++) {
7438         /* update_slot returns int but can't actually fail */
7439         update_slot(type, p->name_strobj);
7440     }
7441 }
7442 
7443 /* Call __set_name__ on all descriptors in a newly generated type */
7444 static int
set_names(PyTypeObject * type)7445 set_names(PyTypeObject *type)
7446 {
7447     PyObject *names_to_set, *key, *value, *set_name, *tmp;
7448     Py_ssize_t i = 0;
7449 
7450     names_to_set = PyDict_Copy(type->tp_dict);
7451     if (names_to_set == NULL)
7452         return -1;
7453 
7454     while (PyDict_Next(names_to_set, &i, &key, &value)) {
7455         set_name = _PyObject_LookupSpecial(value, &PyId___set_name__);
7456         if (set_name != NULL) {
7457             tmp = PyObject_CallFunctionObjArgs(set_name, type, key, NULL);
7458             Py_DECREF(set_name);
7459             if (tmp == NULL) {
7460                 _PyErr_FormatFromCause(PyExc_RuntimeError,
7461                     "Error calling __set_name__ on '%.100s' instance %R "
7462                     "in '%.100s'",
7463                     value->ob_type->tp_name, key, type->tp_name);
7464                 Py_DECREF(names_to_set);
7465                 return -1;
7466             }
7467             else
7468                 Py_DECREF(tmp);
7469         }
7470         else if (PyErr_Occurred()) {
7471             Py_DECREF(names_to_set);
7472             return -1;
7473         }
7474     }
7475 
7476     Py_DECREF(names_to_set);
7477     return 0;
7478 }
7479 
7480 /* Call __init_subclass__ on the parent of a newly generated type */
7481 static int
init_subclass(PyTypeObject * type,PyObject * kwds)7482 init_subclass(PyTypeObject *type, PyObject *kwds)
7483 {
7484     PyObject *super, *func, *result;
7485     PyObject *args[2] = {(PyObject *)type, (PyObject *)type};
7486 
7487     super = _PyObject_FastCall((PyObject *)&PySuper_Type, args, 2);
7488     if (super == NULL) {
7489         return -1;
7490     }
7491 
7492     func = _PyObject_GetAttrId(super, &PyId___init_subclass__);
7493     Py_DECREF(super);
7494     if (func == NULL) {
7495         return -1;
7496     }
7497 
7498 
7499     result = _PyObject_FastCallDict(func, NULL, 0, kwds);
7500     Py_DECREF(func);
7501     if (result == NULL) {
7502         return -1;
7503     }
7504 
7505     Py_DECREF(result);
7506     return 0;
7507 }
7508 
7509 /* recurse_down_subclasses() and update_subclasses() are mutually
7510    recursive functions to call a callback for all subclasses,
7511    but refraining from recursing into subclasses that define 'name'. */
7512 
7513 static int
update_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)7514 update_subclasses(PyTypeObject *type, PyObject *name,
7515                   update_callback callback, void *data)
7516 {
7517     if (callback(type, data) < 0)
7518         return -1;
7519     return recurse_down_subclasses(type, name, callback, data);
7520 }
7521 
7522 static int
recurse_down_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)7523 recurse_down_subclasses(PyTypeObject *type, PyObject *name,
7524                         update_callback callback, void *data)
7525 {
7526     PyTypeObject *subclass;
7527     PyObject *ref, *subclasses, *dict;
7528     Py_ssize_t i;
7529 
7530     subclasses = type->tp_subclasses;
7531     if (subclasses == NULL)
7532         return 0;
7533     assert(PyDict_CheckExact(subclasses));
7534     i = 0;
7535     while (PyDict_Next(subclasses, &i, NULL, &ref)) {
7536         assert(PyWeakref_CheckRef(ref));
7537         subclass = (PyTypeObject *)PyWeakref_GET_OBJECT(ref);
7538         assert(subclass != NULL);
7539         if ((PyObject *)subclass == Py_None)
7540             continue;
7541         assert(PyType_Check(subclass));
7542         /* Avoid recursing down into unaffected classes */
7543         dict = subclass->tp_dict;
7544         if (dict != NULL && PyDict_Check(dict)) {
7545             if (PyDict_GetItemWithError(dict, name) != NULL) {
7546                 continue;
7547             }
7548             if (PyErr_Occurred()) {
7549                 return -1;
7550             }
7551         }
7552         if (update_subclasses(subclass, name, callback, data) < 0)
7553             return -1;
7554     }
7555     return 0;
7556 }
7557 
7558 /* This function is called by PyType_Ready() to populate the type's
7559    dictionary with method descriptors for function slots.  For each
7560    function slot (like tp_repr) that's defined in the type, one or more
7561    corresponding descriptors are added in the type's tp_dict dictionary
7562    under the appropriate name (like __repr__).  Some function slots
7563    cause more than one descriptor to be added (for example, the nb_add
7564    slot adds both __add__ and __radd__ descriptors) and some function
7565    slots compete for the same descriptor (for example both sq_item and
7566    mp_subscript generate a __getitem__ descriptor).
7567 
7568    In the latter case, the first slotdef entry encountered wins.  Since
7569    slotdef entries are sorted by the offset of the slot in the
7570    PyHeapTypeObject, this gives us some control over disambiguating
7571    between competing slots: the members of PyHeapTypeObject are listed
7572    from most general to least general, so the most general slot is
7573    preferred.  In particular, because as_mapping comes before as_sequence,
7574    for a type that defines both mp_subscript and sq_item, mp_subscript
7575    wins.
7576 
7577    This only adds new descriptors and doesn't overwrite entries in
7578    tp_dict that were previously defined.  The descriptors contain a
7579    reference to the C function they must call, so that it's safe if they
7580    are copied into a subtype's __dict__ and the subtype has a different
7581    C function in its slot -- calling the method defined by the
7582    descriptor will call the C function that was used to create it,
7583    rather than the C function present in the slot when it is called.
7584    (This is important because a subtype may have a C function in the
7585    slot that calls the method from the dictionary, and we want to avoid
7586    infinite recursion here.) */
7587 
7588 static int
add_operators(PyTypeObject * type)7589 add_operators(PyTypeObject *type)
7590 {
7591     PyObject *dict = type->tp_dict;
7592     slotdef *p;
7593     PyObject *descr;
7594     void **ptr;
7595 
7596     init_slotdefs();
7597     for (p = slotdefs; p->name; p++) {
7598         if (p->wrapper == NULL)
7599             continue;
7600         ptr = slotptr(type, p->offset);
7601         if (!ptr || !*ptr)
7602             continue;
7603         if (PyDict_GetItemWithError(dict, p->name_strobj))
7604             continue;
7605         if (PyErr_Occurred()) {
7606             return -1;
7607         }
7608         if (*ptr == (void *)PyObject_HashNotImplemented) {
7609             /* Classes may prevent the inheritance of the tp_hash
7610                slot by storing PyObject_HashNotImplemented in it. Make it
7611                visible as a None value for the __hash__ attribute. */
7612             if (PyDict_SetItem(dict, p->name_strobj, Py_None) < 0)
7613                 return -1;
7614         }
7615         else {
7616             descr = PyDescr_NewWrapper(type, p, *ptr);
7617             if (descr == NULL)
7618                 return -1;
7619             if (PyDict_SetItem(dict, p->name_strobj, descr) < 0) {
7620                 Py_DECREF(descr);
7621                 return -1;
7622             }
7623             Py_DECREF(descr);
7624         }
7625     }
7626     if (type->tp_new != NULL) {
7627         if (add_tp_new_wrapper(type) < 0)
7628             return -1;
7629     }
7630     return 0;
7631 }
7632 
7633 
7634 /* Cooperative 'super' */
7635 
7636 typedef struct {
7637     PyObject_HEAD
7638     PyTypeObject *type;
7639     PyObject *obj;
7640     PyTypeObject *obj_type;
7641 } superobject;
7642 
7643 static PyMemberDef super_members[] = {
7644     {"__thisclass__", T_OBJECT, offsetof(superobject, type), READONLY,
7645      "the class invoking super()"},
7646     {"__self__",  T_OBJECT, offsetof(superobject, obj), READONLY,
7647      "the instance invoking super(); may be None"},
7648     {"__self_class__", T_OBJECT, offsetof(superobject, obj_type), READONLY,
7649      "the type of the instance invoking super(); may be None"},
7650     {0}
7651 };
7652 
7653 static void
super_dealloc(PyObject * self)7654 super_dealloc(PyObject *self)
7655 {
7656     superobject *su = (superobject *)self;
7657 
7658     _PyObject_GC_UNTRACK(self);
7659     Py_XDECREF(su->obj);
7660     Py_XDECREF(su->type);
7661     Py_XDECREF(su->obj_type);
7662     Py_TYPE(self)->tp_free(self);
7663 }
7664 
7665 static PyObject *
super_repr(PyObject * self)7666 super_repr(PyObject *self)
7667 {
7668     superobject *su = (superobject *)self;
7669 
7670     if (su->obj_type)
7671         return PyUnicode_FromFormat(
7672             "<super: <class '%s'>, <%s object>>",
7673             su->type ? su->type->tp_name : "NULL",
7674             su->obj_type->tp_name);
7675     else
7676         return PyUnicode_FromFormat(
7677             "<super: <class '%s'>, NULL>",
7678             su->type ? su->type->tp_name : "NULL");
7679 }
7680 
7681 static PyObject *
super_getattro(PyObject * self,PyObject * name)7682 super_getattro(PyObject *self, PyObject *name)
7683 {
7684     superobject *su = (superobject *)self;
7685     PyTypeObject *starttype;
7686     PyObject *mro;
7687     Py_ssize_t i, n;
7688 
7689     starttype = su->obj_type;
7690     if (starttype == NULL)
7691         goto skip;
7692 
7693     /* We want __class__ to return the class of the super object
7694        (i.e. super, or a subclass), not the class of su->obj. */
7695     if (PyUnicode_Check(name) &&
7696         PyUnicode_GET_LENGTH(name) == 9 &&
7697         _PyUnicode_EqualToASCIIId(name, &PyId___class__))
7698         goto skip;
7699 
7700     mro = starttype->tp_mro;
7701     if (mro == NULL)
7702         goto skip;
7703 
7704     assert(PyTuple_Check(mro));
7705     n = PyTuple_GET_SIZE(mro);
7706 
7707     /* No need to check the last one: it's gonna be skipped anyway.  */
7708     for (i = 0; i+1 < n; i++) {
7709         if ((PyObject *)(su->type) == PyTuple_GET_ITEM(mro, i))
7710             break;
7711     }
7712     i++;  /* skip su->type (if any)  */
7713     if (i >= n)
7714         goto skip;
7715 
7716     /* keep a strong reference to mro because starttype->tp_mro can be
7717        replaced during PyDict_GetItemWithError(dict, name)  */
7718     Py_INCREF(mro);
7719     do {
7720         PyObject *res, *tmp, *dict;
7721         descrgetfunc f;
7722 
7723         tmp = PyTuple_GET_ITEM(mro, i);
7724         assert(PyType_Check(tmp));
7725 
7726         dict = ((PyTypeObject *)tmp)->tp_dict;
7727         assert(dict != NULL && PyDict_Check(dict));
7728 
7729         res = PyDict_GetItemWithError(dict, name);
7730         if (res != NULL) {
7731             Py_INCREF(res);
7732 
7733             f = Py_TYPE(res)->tp_descr_get;
7734             if (f != NULL) {
7735                 tmp = f(res,
7736                     /* Only pass 'obj' param if this is instance-mode super
7737                        (See SF ID #743627)  */
7738                     (su->obj == (PyObject *)starttype) ? NULL : su->obj,
7739                     (PyObject *)starttype);
7740                 Py_DECREF(res);
7741                 res = tmp;
7742             }
7743 
7744             Py_DECREF(mro);
7745             return res;
7746         }
7747         else if (PyErr_Occurred()) {
7748             Py_DECREF(mro);
7749             return NULL;
7750         }
7751 
7752         i++;
7753     } while (i < n);
7754     Py_DECREF(mro);
7755 
7756   skip:
7757     return PyObject_GenericGetAttr(self, name);
7758 }
7759 
7760 static PyTypeObject *
supercheck(PyTypeObject * type,PyObject * obj)7761 supercheck(PyTypeObject *type, PyObject *obj)
7762 {
7763     /* Check that a super() call makes sense.  Return a type object.
7764 
7765        obj can be a class, or an instance of one:
7766 
7767        - If it is a class, it must be a subclass of 'type'.      This case is
7768          used for class methods; the return value is obj.
7769 
7770        - If it is an instance, it must be an instance of 'type'.  This is
7771          the normal case; the return value is obj.__class__.
7772 
7773        But... when obj is an instance, we want to allow for the case where
7774        Py_TYPE(obj) is not a subclass of type, but obj.__class__ is!
7775        This will allow using super() with a proxy for obj.
7776     */
7777 
7778     /* Check for first bullet above (special case) */
7779     if (PyType_Check(obj) && PyType_IsSubtype((PyTypeObject *)obj, type)) {
7780         Py_INCREF(obj);
7781         return (PyTypeObject *)obj;
7782     }
7783 
7784     /* Normal case */
7785     if (PyType_IsSubtype(Py_TYPE(obj), type)) {
7786         Py_INCREF(Py_TYPE(obj));
7787         return Py_TYPE(obj);
7788     }
7789     else {
7790         /* Try the slow way */
7791         PyObject *class_attr;
7792 
7793         if (_PyObject_LookupAttrId(obj, &PyId___class__, &class_attr) < 0) {
7794             return NULL;
7795         }
7796         if (class_attr != NULL &&
7797             PyType_Check(class_attr) &&
7798             (PyTypeObject *)class_attr != Py_TYPE(obj))
7799         {
7800             int ok = PyType_IsSubtype(
7801                 (PyTypeObject *)class_attr, type);
7802             if (ok)
7803                 return (PyTypeObject *)class_attr;
7804         }
7805         Py_XDECREF(class_attr);
7806     }
7807 
7808     PyErr_SetString(PyExc_TypeError,
7809                     "super(type, obj): "
7810                     "obj must be an instance or subtype of type");
7811     return NULL;
7812 }
7813 
7814 static PyObject *
super_descr_get(PyObject * self,PyObject * obj,PyObject * type)7815 super_descr_get(PyObject *self, PyObject *obj, PyObject *type)
7816 {
7817     superobject *su = (superobject *)self;
7818     superobject *newobj;
7819 
7820     if (obj == NULL || obj == Py_None || su->obj != NULL) {
7821         /* Not binding to an object, or already bound */
7822         Py_INCREF(self);
7823         return self;
7824     }
7825     if (Py_TYPE(su) != &PySuper_Type)
7826         /* If su is an instance of a (strict) subclass of super,
7827            call its type */
7828         return PyObject_CallFunctionObjArgs((PyObject *)Py_TYPE(su),
7829                                             su->type, obj, NULL);
7830     else {
7831         /* Inline the common case */
7832         PyTypeObject *obj_type = supercheck(su->type, obj);
7833         if (obj_type == NULL)
7834             return NULL;
7835         newobj = (superobject *)PySuper_Type.tp_new(&PySuper_Type,
7836                                                  NULL, NULL);
7837         if (newobj == NULL)
7838             return NULL;
7839         Py_INCREF(su->type);
7840         Py_INCREF(obj);
7841         newobj->type = su->type;
7842         newobj->obj = obj;
7843         newobj->obj_type = obj_type;
7844         return (PyObject *)newobj;
7845     }
7846 }
7847 
7848 static int
super_init(PyObject * self,PyObject * args,PyObject * kwds)7849 super_init(PyObject *self, PyObject *args, PyObject *kwds)
7850 {
7851     superobject *su = (superobject *)self;
7852     PyTypeObject *type = NULL;
7853     PyObject *obj = NULL;
7854     PyTypeObject *obj_type = NULL;
7855 
7856     if (!_PyArg_NoKeywords("super", kwds))
7857         return -1;
7858     if (!PyArg_ParseTuple(args, "|O!O:super", &PyType_Type, &type, &obj))
7859         return -1;
7860 
7861     if (type == NULL) {
7862         /* Call super(), without args -- fill in from __class__
7863            and first local variable on the stack. */
7864         PyFrameObject *f;
7865         PyCodeObject *co;
7866         Py_ssize_t i, n;
7867         f = _PyThreadState_GET()->frame;
7868         if (f == NULL) {
7869             PyErr_SetString(PyExc_RuntimeError,
7870                             "super(): no current frame");
7871             return -1;
7872         }
7873         co = f->f_code;
7874         if (co == NULL) {
7875             PyErr_SetString(PyExc_RuntimeError,
7876                             "super(): no code object");
7877             return -1;
7878         }
7879         if (co->co_argcount == 0) {
7880             PyErr_SetString(PyExc_RuntimeError,
7881                             "super(): no arguments");
7882             return -1;
7883         }
7884         obj = f->f_localsplus[0];
7885         if (obj == NULL && co->co_cell2arg) {
7886             /* The first argument might be a cell. */
7887             n = PyTuple_GET_SIZE(co->co_cellvars);
7888             for (i = 0; i < n; i++) {
7889                 if (co->co_cell2arg[i] == 0) {
7890                     PyObject *cell = f->f_localsplus[co->co_nlocals + i];
7891                     assert(PyCell_Check(cell));
7892                     obj = PyCell_GET(cell);
7893                     break;
7894                 }
7895             }
7896         }
7897         if (obj == NULL) {
7898             PyErr_SetString(PyExc_RuntimeError,
7899                             "super(): arg[0] deleted");
7900             return -1;
7901         }
7902         if (co->co_freevars == NULL)
7903             n = 0;
7904         else {
7905             assert(PyTuple_Check(co->co_freevars));
7906             n = PyTuple_GET_SIZE(co->co_freevars);
7907         }
7908         for (i = 0; i < n; i++) {
7909             PyObject *name = PyTuple_GET_ITEM(co->co_freevars, i);
7910             assert(PyUnicode_Check(name));
7911             if (_PyUnicode_EqualToASCIIId(name, &PyId___class__)) {
7912                 Py_ssize_t index = co->co_nlocals +
7913                     PyTuple_GET_SIZE(co->co_cellvars) + i;
7914                 PyObject *cell = f->f_localsplus[index];
7915                 if (cell == NULL || !PyCell_Check(cell)) {
7916                     PyErr_SetString(PyExc_RuntimeError,
7917                       "super(): bad __class__ cell");
7918                     return -1;
7919                 }
7920                 type = (PyTypeObject *) PyCell_GET(cell);
7921                 if (type == NULL) {
7922                     PyErr_SetString(PyExc_RuntimeError,
7923                       "super(): empty __class__ cell");
7924                     return -1;
7925                 }
7926                 if (!PyType_Check(type)) {
7927                     PyErr_Format(PyExc_RuntimeError,
7928                       "super(): __class__ is not a type (%s)",
7929                       Py_TYPE(type)->tp_name);
7930                     return -1;
7931                 }
7932                 break;
7933             }
7934         }
7935         if (type == NULL) {
7936             PyErr_SetString(PyExc_RuntimeError,
7937                             "super(): __class__ cell not found");
7938             return -1;
7939         }
7940     }
7941 
7942     if (obj == Py_None)
7943         obj = NULL;
7944     if (obj != NULL) {
7945         obj_type = supercheck(type, obj);
7946         if (obj_type == NULL)
7947             return -1;
7948         Py_INCREF(obj);
7949     }
7950     Py_INCREF(type);
7951     Py_XSETREF(su->type, type);
7952     Py_XSETREF(su->obj, obj);
7953     Py_XSETREF(su->obj_type, obj_type);
7954     return 0;
7955 }
7956 
7957 PyDoc_STRVAR(super_doc,
7958 "super() -> same as super(__class__, <first argument>)\n"
7959 "super(type) -> unbound super object\n"
7960 "super(type, obj) -> bound super object; requires isinstance(obj, type)\n"
7961 "super(type, type2) -> bound super object; requires issubclass(type2, type)\n"
7962 "Typical use to call a cooperative superclass method:\n"
7963 "class C(B):\n"
7964 "    def meth(self, arg):\n"
7965 "        super().meth(arg)\n"
7966 "This works for class methods too:\n"
7967 "class C(B):\n"
7968 "    @classmethod\n"
7969 "    def cmeth(cls, arg):\n"
7970 "        super().cmeth(arg)\n");
7971 
7972 static int
super_traverse(PyObject * self,visitproc visit,void * arg)7973 super_traverse(PyObject *self, visitproc visit, void *arg)
7974 {
7975     superobject *su = (superobject *)self;
7976 
7977     Py_VISIT(su->obj);
7978     Py_VISIT(su->type);
7979     Py_VISIT(su->obj_type);
7980 
7981     return 0;
7982 }
7983 
7984 PyTypeObject PySuper_Type = {
7985     PyVarObject_HEAD_INIT(&PyType_Type, 0)
7986     "super",                                    /* tp_name */
7987     sizeof(superobject),                        /* tp_basicsize */
7988     0,                                          /* tp_itemsize */
7989     /* methods */
7990     super_dealloc,                              /* tp_dealloc */
7991     0,                                          /* tp_vectorcall_offset */
7992     0,                                          /* tp_getattr */
7993     0,                                          /* tp_setattr */
7994     0,                                          /* tp_as_async */
7995     super_repr,                                 /* tp_repr */
7996     0,                                          /* tp_as_number */
7997     0,                                          /* tp_as_sequence */
7998     0,                                          /* tp_as_mapping */
7999     0,                                          /* tp_hash */
8000     0,                                          /* tp_call */
8001     0,                                          /* tp_str */
8002     super_getattro,                             /* tp_getattro */
8003     0,                                          /* tp_setattro */
8004     0,                                          /* tp_as_buffer */
8005     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
8006         Py_TPFLAGS_BASETYPE,                    /* tp_flags */
8007     super_doc,                                  /* tp_doc */
8008     super_traverse,                             /* tp_traverse */
8009     0,                                          /* tp_clear */
8010     0,                                          /* tp_richcompare */
8011     0,                                          /* tp_weaklistoffset */
8012     0,                                          /* tp_iter */
8013     0,                                          /* tp_iternext */
8014     0,                                          /* tp_methods */
8015     super_members,                              /* tp_members */
8016     0,                                          /* tp_getset */
8017     0,                                          /* tp_base */
8018     0,                                          /* tp_dict */
8019     super_descr_get,                            /* tp_descr_get */
8020     0,                                          /* tp_descr_set */
8021     0,                                          /* tp_dictoffset */
8022     super_init,                                 /* tp_init */
8023     PyType_GenericAlloc,                        /* tp_alloc */
8024     PyType_GenericNew,                          /* tp_new */
8025     PyObject_GC_Del,                            /* tp_free */
8026 };
8027