1 /* Type object implementation */
2 
3 #include "Python.h"
4 #include "pycore_call.h"
5 #include "pycore_compile.h"       // _Py_Mangle()
6 #include "pycore_initconfig.h"
7 #include "pycore_moduleobject.h"  // _PyModule_GetDef()
8 #include "pycore_object.h"
9 #include "pycore_pyerrors.h"
10 #include "pycore_pystate.h"       // _PyThreadState_GET()
11 #include "pycore_unionobject.h"   // _Py_union_type_or
12 #include "frameobject.h"
13 #include "structmember.h"         // PyMemberDef
14 
15 #include <ctype.h>
16 
17 /*[clinic input]
18 class type "PyTypeObject *" "&PyType_Type"
19 class object "PyObject *" "&PyBaseObject_Type"
20 [clinic start generated code]*/
21 /*[clinic end generated code: output=da39a3ee5e6b4b0d input=4b94608d231c434b]*/
22 
23 #include "clinic/typeobject.c.h"
24 
25 /* Support type attribute lookup cache */
26 
27 /* The cache can keep references to the names alive for longer than
28    they normally would.  This is why the maximum size is limited to
29    MCACHE_MAX_ATTR_SIZE, since it might be a problem if very large
30    strings are used as attribute names. */
31 #define MCACHE_MAX_ATTR_SIZE    100
32 #define MCACHE_HASH(version, name_hash)                                 \
33         (((unsigned int)(version) ^ (unsigned int)(name_hash))          \
34          & ((1 << MCACHE_SIZE_EXP) - 1))
35 
36 #define MCACHE_HASH_METHOD(type, name)                                  \
37     MCACHE_HASH((type)->tp_version_tag, ((Py_ssize_t)(name)) >> 3)
38 #define MCACHE_CACHEABLE_NAME(name)                             \
39         PyUnicode_CheckExact(name) &&                           \
40         PyUnicode_IS_READY(name) &&                             \
41         (PyUnicode_GET_LENGTH(name) <= MCACHE_MAX_ATTR_SIZE)
42 
43 // bpo-42745: next_version_tag remains shared by all interpreters because of static types
44 // Used to set PyTypeObject.tp_version_tag
45 static unsigned int next_version_tag = 0;
46 
47 typedef struct PySlot_Offset {
48     short subslot_offset;
49     short slot_offset;
50 } PySlot_Offset;
51 
52 
53 /* alphabetical order */
54 _Py_IDENTIFIER(__abstractmethods__);
55 _Py_IDENTIFIER(__annotations__);
56 _Py_IDENTIFIER(__class__);
57 _Py_IDENTIFIER(__class_getitem__);
58 _Py_IDENTIFIER(__classcell__);
59 _Py_IDENTIFIER(__delitem__);
60 _Py_IDENTIFIER(__dict__);
61 _Py_IDENTIFIER(__doc__);
62 _Py_IDENTIFIER(__getattribute__);
63 _Py_IDENTIFIER(__getitem__);
64 _Py_IDENTIFIER(__hash__);
65 _Py_IDENTIFIER(__init_subclass__);
66 _Py_IDENTIFIER(__len__);
67 _Py_IDENTIFIER(__module__);
68 _Py_IDENTIFIER(__name__);
69 _Py_IDENTIFIER(__new__);
70 _Py_IDENTIFIER(__qualname__);
71 _Py_IDENTIFIER(__set_name__);
72 _Py_IDENTIFIER(__setitem__);
73 _Py_IDENTIFIER(__weakref__);
74 _Py_IDENTIFIER(builtins);
75 _Py_IDENTIFIER(mro);
76 
77 static PyObject *
78 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
79 
80 static void
81 clear_slotdefs(void);
82 
83 static PyObject *
84 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound);
85 
86 static int
87 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value);
88 
89 /*
90  * finds the beginning of the docstring's introspection signature.
91  * if present, returns a pointer pointing to the first '('.
92  * otherwise returns NULL.
93  *
94  * doesn't guarantee that the signature is valid, only that it
95  * has a valid prefix.  (the signature must also pass skip_signature.)
96  */
97 static const char *
find_signature(const char * name,const char * doc)98 find_signature(const char *name, const char *doc)
99 {
100     const char *dot;
101     size_t length;
102 
103     if (!doc)
104         return NULL;
105 
106     assert(name != NULL);
107 
108     /* for dotted names like classes, only use the last component */
109     dot = strrchr(name, '.');
110     if (dot)
111         name = dot + 1;
112 
113     length = strlen(name);
114     if (strncmp(doc, name, length))
115         return NULL;
116     doc += length;
117     if (*doc != '(')
118         return NULL;
119     return doc;
120 }
121 
122 #define SIGNATURE_END_MARKER         ")\n--\n\n"
123 #define SIGNATURE_END_MARKER_LENGTH  6
124 /*
125  * skips past the end of the docstring's introspection signature.
126  * (assumes doc starts with a valid signature prefix.)
127  */
128 static const char *
skip_signature(const char * doc)129 skip_signature(const char *doc)
130 {
131     while (*doc) {
132         if ((*doc == *SIGNATURE_END_MARKER) &&
133             !strncmp(doc, SIGNATURE_END_MARKER, SIGNATURE_END_MARKER_LENGTH))
134             return doc + SIGNATURE_END_MARKER_LENGTH;
135         if ((*doc == '\n') && (doc[1] == '\n'))
136             return NULL;
137         doc++;
138     }
139     return NULL;
140 }
141 
142 int
_PyType_CheckConsistency(PyTypeObject * type)143 _PyType_CheckConsistency(PyTypeObject *type)
144 {
145 #define CHECK(expr) \
146     do { if (!(expr)) { _PyObject_ASSERT_FAILED_MSG((PyObject *)type, Py_STRINGIFY(expr)); } } while (0)
147 
148     CHECK(!_PyObject_IsFreed((PyObject *)type));
149 
150     if (!(type->tp_flags & Py_TPFLAGS_READY)) {
151         /* don't check static types before PyType_Ready() */
152         return 1;
153     }
154 
155     CHECK(Py_REFCNT(type) >= 1);
156     CHECK(PyType_Check(type));
157 
158     CHECK(!(type->tp_flags & Py_TPFLAGS_READYING));
159     CHECK(type->tp_dict != NULL);
160 
161     if (type->tp_flags & Py_TPFLAGS_DISALLOW_INSTANTIATION) {
162         CHECK(type->tp_new == NULL);
163         CHECK(_PyDict_ContainsId(type->tp_dict, &PyId___new__) == 0);
164     }
165 
166     return 1;
167 #undef CHECK
168 }
169 
170 static const char *
_PyType_DocWithoutSignature(const char * name,const char * internal_doc)171 _PyType_DocWithoutSignature(const char *name, const char *internal_doc)
172 {
173     const char *doc = find_signature(name, internal_doc);
174 
175     if (doc) {
176         doc = skip_signature(doc);
177         if (doc)
178             return doc;
179         }
180     return internal_doc;
181 }
182 
183 PyObject *
_PyType_GetDocFromInternalDoc(const char * name,const char * internal_doc)184 _PyType_GetDocFromInternalDoc(const char *name, const char *internal_doc)
185 {
186     const char *doc = _PyType_DocWithoutSignature(name, internal_doc);
187 
188     if (!doc || *doc == '\0') {
189         Py_RETURN_NONE;
190     }
191 
192     return PyUnicode_FromString(doc);
193 }
194 
195 PyObject *
_PyType_GetTextSignatureFromInternalDoc(const char * name,const char * internal_doc)196 _PyType_GetTextSignatureFromInternalDoc(const char *name, const char *internal_doc)
197 {
198     const char *start = find_signature(name, internal_doc);
199     const char *end;
200 
201     if (start)
202         end = skip_signature(start);
203     else
204         end = NULL;
205     if (!end) {
206         Py_RETURN_NONE;
207     }
208 
209     /* back "end" up until it points just past the final ')' */
210     end -= SIGNATURE_END_MARKER_LENGTH - 1;
211     assert((end - start) >= 2); /* should be "()" at least */
212     assert(end[-1] == ')');
213     assert(end[0] == '\n');
214     return PyUnicode_FromStringAndSize(start, end - start);
215 }
216 
217 
218 static struct type_cache*
get_type_cache(void)219 get_type_cache(void)
220 {
221     PyInterpreterState *interp = _PyInterpreterState_GET();
222     return &interp->type_cache;
223 }
224 
225 
226 static void
type_cache_clear(struct type_cache * cache,int use_none)227 type_cache_clear(struct type_cache *cache, int use_none)
228 {
229     for (Py_ssize_t i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
230         struct type_cache_entry *entry = &cache->hashtable[i];
231         entry->version = 0;
232         if (use_none) {
233             // Set to None so _PyType_Lookup() can use Py_SETREF(),
234             // rather than using slower Py_XSETREF().
235             Py_XSETREF(entry->name, Py_NewRef(Py_None));
236         }
237         else {
238             Py_CLEAR(entry->name);
239         }
240         entry->value = NULL;
241     }
242 
243     // Mark all version tags as invalid
244     PyType_Modified(&PyBaseObject_Type);
245 }
246 
247 
248 void
_PyType_InitCache(PyInterpreterState * interp)249 _PyType_InitCache(PyInterpreterState *interp)
250 {
251     struct type_cache *cache = &interp->type_cache;
252     for (Py_ssize_t i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
253         struct type_cache_entry *entry = &cache->hashtable[i];
254         assert(entry->name == NULL);
255 
256         entry->version = 0;
257         // Set to None so _PyType_Lookup() can use Py_SETREF(),
258         // rather than using slower Py_XSETREF().
259         entry->name = Py_NewRef(Py_None);
260         entry->value = NULL;
261     }
262 }
263 
264 
265 static unsigned int
_PyType_ClearCache(PyInterpreterState * interp)266 _PyType_ClearCache(PyInterpreterState *interp)
267 {
268     struct type_cache *cache = &interp->type_cache;
269 #if MCACHE_STATS
270     size_t total = cache->hits + cache->collisions + cache->misses;
271     fprintf(stderr, "-- Method cache hits        = %zd (%d%%)\n",
272             cache->hits, (int) (100.0 * cache->hits / total));
273     fprintf(stderr, "-- Method cache true misses = %zd (%d%%)\n",
274             cache->misses, (int) (100.0 * cache->misses / total));
275     fprintf(stderr, "-- Method cache collisions  = %zd (%d%%)\n",
276             cache->collisions, (int) (100.0 * cache->collisions / total));
277     fprintf(stderr, "-- Method cache size        = %zd KiB\n",
278             sizeof(cache->hashtable) / 1024);
279 #endif
280 
281     unsigned int cur_version_tag = next_version_tag - 1;
282     if (_Py_IsMainInterpreter(interp)) {
283         next_version_tag = 0;
284     }
285 
286     type_cache_clear(cache, 0);
287 
288     return cur_version_tag;
289 }
290 
291 
292 unsigned int
PyType_ClearCache(void)293 PyType_ClearCache(void)
294 {
295     PyInterpreterState *interp = _PyInterpreterState_GET();
296     return _PyType_ClearCache(interp);
297 }
298 
299 
300 void
_PyType_Fini(PyInterpreterState * interp)301 _PyType_Fini(PyInterpreterState *interp)
302 {
303     _PyType_ClearCache(interp);
304     if (_Py_IsMainInterpreter(interp)) {
305         clear_slotdefs();
306     }
307 }
308 
309 
310 void
PyType_Modified(PyTypeObject * type)311 PyType_Modified(PyTypeObject *type)
312 {
313     /* Invalidate any cached data for the specified type and all
314        subclasses.  This function is called after the base
315        classes, mro, or attributes of the type are altered.
316 
317        Invariants:
318 
319        - before Py_TPFLAGS_VALID_VERSION_TAG can be set on a type,
320          it must first be set on all super types.
321 
322        This function clears the Py_TPFLAGS_VALID_VERSION_TAG of a
323        type (so it must first clear it on all subclasses).  The
324        tp_version_tag value is meaningless unless this flag is set.
325        We don't assign new version tags eagerly, but only as
326        needed.
327      */
328     PyObject *raw, *ref;
329     Py_ssize_t i;
330 
331     if (!_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
332         return;
333 
334     raw = type->tp_subclasses;
335     if (raw != NULL) {
336         assert(PyDict_CheckExact(raw));
337         i = 0;
338         while (PyDict_Next(raw, &i, NULL, &ref)) {
339             assert(PyWeakref_CheckRef(ref));
340             ref = PyWeakref_GET_OBJECT(ref);
341             if (ref != Py_None) {
342                 PyType_Modified((PyTypeObject *)ref);
343             }
344         }
345     }
346     type->tp_flags &= ~Py_TPFLAGS_VALID_VERSION_TAG;
347     type->tp_version_tag = 0; /* 0 is not a valid version tag */
348 }
349 
350 static void
type_mro_modified(PyTypeObject * type,PyObject * bases)351 type_mro_modified(PyTypeObject *type, PyObject *bases) {
352     /*
353        Check that all base classes or elements of the MRO of type are
354        able to be cached.  This function is called after the base
355        classes or mro of the type are altered.
356 
357        Unset HAVE_VERSION_TAG and VALID_VERSION_TAG if the type
358        has a custom MRO that includes a type which is not officially
359        super type, or if the type implements its own mro() method.
360 
361        Called from mro_internal, which will subsequently be called on
362        each subclass when their mro is recursively updated.
363      */
364     Py_ssize_t i, n;
365     int custom = !Py_IS_TYPE(type, &PyType_Type);
366     int unbound;
367     PyObject *mro_meth = NULL;
368     PyObject *type_mro_meth = NULL;
369 
370     if (custom) {
371         mro_meth = lookup_maybe_method(
372             (PyObject *)type, &PyId_mro, &unbound);
373         if (mro_meth == NULL)
374             goto clear;
375         type_mro_meth = lookup_maybe_method(
376             (PyObject *)&PyType_Type, &PyId_mro, &unbound);
377         if (type_mro_meth == NULL)
378             goto clear;
379         if (mro_meth != type_mro_meth)
380             goto clear;
381         Py_XDECREF(mro_meth);
382         Py_XDECREF(type_mro_meth);
383     }
384     n = PyTuple_GET_SIZE(bases);
385     for (i = 0; i < n; i++) {
386         PyObject *b = PyTuple_GET_ITEM(bases, i);
387         PyTypeObject *cls;
388 
389         assert(PyType_Check(b));
390         cls = (PyTypeObject *)b;
391 
392         if (!PyType_IsSubtype(type, cls)) {
393             goto clear;
394         }
395     }
396     return;
397  clear:
398     Py_XDECREF(mro_meth);
399     Py_XDECREF(type_mro_meth);
400     type->tp_flags &= ~Py_TPFLAGS_VALID_VERSION_TAG;
401     type->tp_version_tag = 0; /* 0 is not a valid version tag */
402 }
403 
404 static int
assign_version_tag(struct type_cache * cache,PyTypeObject * type)405 assign_version_tag(struct type_cache *cache, PyTypeObject *type)
406 {
407     /* Ensure that the tp_version_tag is valid and set
408        Py_TPFLAGS_VALID_VERSION_TAG.  To respect the invariant, this
409        must first be done on all super classes.  Return 0 if this
410        cannot be done, 1 if Py_TPFLAGS_VALID_VERSION_TAG.
411     */
412     Py_ssize_t i, n;
413     PyObject *bases;
414 
415     if (_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
416         return 1;
417     if (!_PyType_HasFeature(type, Py_TPFLAGS_READY))
418         return 0;
419 
420     type->tp_version_tag = next_version_tag++;
421     /* for stress-testing: next_version_tag &= 0xFF; */
422 
423     if (type->tp_version_tag == 0) {
424         // Wrap-around or just starting Python - clear the whole cache
425         type_cache_clear(cache, 1);
426         return 0;
427     }
428 
429     bases = type->tp_bases;
430     n = PyTuple_GET_SIZE(bases);
431     for (i = 0; i < n; i++) {
432         PyObject *b = PyTuple_GET_ITEM(bases, i);
433         assert(PyType_Check(b));
434         if (!assign_version_tag(cache, (PyTypeObject *)b))
435             return 0;
436     }
437     type->tp_flags |= Py_TPFLAGS_VALID_VERSION_TAG;
438     return 1;
439 }
440 
441 
442 static PyMemberDef type_members[] = {
443     {"__basicsize__", T_PYSSIZET, offsetof(PyTypeObject,tp_basicsize),READONLY},
444     {"__itemsize__", T_PYSSIZET, offsetof(PyTypeObject, tp_itemsize), READONLY},
445     {"__flags__", T_ULONG, offsetof(PyTypeObject, tp_flags), READONLY},
446     {"__weakrefoffset__", T_PYSSIZET,
447      offsetof(PyTypeObject, tp_weaklistoffset), READONLY},
448     {"__base__", T_OBJECT, offsetof(PyTypeObject, tp_base), READONLY},
449     {"__dictoffset__", T_PYSSIZET,
450      offsetof(PyTypeObject, tp_dictoffset), READONLY},
451     {"__mro__", T_OBJECT, offsetof(PyTypeObject, tp_mro), READONLY},
452     {0}
453 };
454 
455 static int
check_set_special_type_attr(PyTypeObject * type,PyObject * value,const char * name)456 check_set_special_type_attr(PyTypeObject *type, PyObject *value, const char *name)
457 {
458     if (_PyType_HasFeature(type, Py_TPFLAGS_IMMUTABLETYPE)) {
459         PyErr_Format(PyExc_TypeError,
460                      "cannot set '%s' attribute of immutable type '%s'",
461                      name, type->tp_name);
462         return 0;
463     }
464     if (!value) {
465         PyErr_Format(PyExc_TypeError,
466                      "cannot delete '%s' attribute of immutable type '%s'",
467                      name, type->tp_name);
468         return 0;
469     }
470 
471     if (PySys_Audit("object.__setattr__", "OsO",
472                     type, name, value) < 0) {
473         return 0;
474     }
475 
476     return 1;
477 }
478 
479 const char *
_PyType_Name(PyTypeObject * type)480 _PyType_Name(PyTypeObject *type)
481 {
482     assert(type->tp_name != NULL);
483     const char *s = strrchr(type->tp_name, '.');
484     if (s == NULL) {
485         s = type->tp_name;
486     }
487     else {
488         s++;
489     }
490     return s;
491 }
492 
493 static PyObject *
type_name(PyTypeObject * type,void * context)494 type_name(PyTypeObject *type, void *context)
495 {
496     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
497         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
498 
499         Py_INCREF(et->ht_name);
500         return et->ht_name;
501     }
502     else {
503         return PyUnicode_FromString(_PyType_Name(type));
504     }
505 }
506 
507 static PyObject *
type_qualname(PyTypeObject * type,void * context)508 type_qualname(PyTypeObject *type, void *context)
509 {
510     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
511         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
512         Py_INCREF(et->ht_qualname);
513         return et->ht_qualname;
514     }
515     else {
516         return PyUnicode_FromString(_PyType_Name(type));
517     }
518 }
519 
520 static int
type_set_name(PyTypeObject * type,PyObject * value,void * context)521 type_set_name(PyTypeObject *type, PyObject *value, void *context)
522 {
523     const char *tp_name;
524     Py_ssize_t name_size;
525 
526     if (!check_set_special_type_attr(type, value, "__name__"))
527         return -1;
528     if (!PyUnicode_Check(value)) {
529         PyErr_Format(PyExc_TypeError,
530                      "can only assign string to %s.__name__, not '%s'",
531                      type->tp_name, Py_TYPE(value)->tp_name);
532         return -1;
533     }
534 
535     tp_name = PyUnicode_AsUTF8AndSize(value, &name_size);
536     if (tp_name == NULL)
537         return -1;
538     if (strlen(tp_name) != (size_t)name_size) {
539         PyErr_SetString(PyExc_ValueError,
540                         "type name must not contain null characters");
541         return -1;
542     }
543 
544     type->tp_name = tp_name;
545     Py_INCREF(value);
546     Py_SETREF(((PyHeapTypeObject*)type)->ht_name, value);
547 
548     return 0;
549 }
550 
551 static int
type_set_qualname(PyTypeObject * type,PyObject * value,void * context)552 type_set_qualname(PyTypeObject *type, PyObject *value, void *context)
553 {
554     PyHeapTypeObject* et;
555 
556     if (!check_set_special_type_attr(type, value, "__qualname__"))
557         return -1;
558     if (!PyUnicode_Check(value)) {
559         PyErr_Format(PyExc_TypeError,
560                      "can only assign string to %s.__qualname__, not '%s'",
561                      type->tp_name, Py_TYPE(value)->tp_name);
562         return -1;
563     }
564 
565     et = (PyHeapTypeObject*)type;
566     Py_INCREF(value);
567     Py_SETREF(et->ht_qualname, value);
568     return 0;
569 }
570 
571 static PyObject *
type_module(PyTypeObject * type,void * context)572 type_module(PyTypeObject *type, void *context)
573 {
574     PyObject *mod;
575 
576     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
577         mod = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___module__);
578         if (mod == NULL) {
579             if (!PyErr_Occurred()) {
580                 PyErr_Format(PyExc_AttributeError, "__module__");
581             }
582             return NULL;
583         }
584         Py_INCREF(mod);
585     }
586     else {
587         const char *s = strrchr(type->tp_name, '.');
588         if (s != NULL) {
589             mod = PyUnicode_FromStringAndSize(
590                 type->tp_name, (Py_ssize_t)(s - type->tp_name));
591             if (mod != NULL)
592                 PyUnicode_InternInPlace(&mod);
593         }
594         else {
595             mod = _PyUnicode_FromId(&PyId_builtins);
596             Py_XINCREF(mod);
597         }
598     }
599     return mod;
600 }
601 
602 static int
type_set_module(PyTypeObject * type,PyObject * value,void * context)603 type_set_module(PyTypeObject *type, PyObject *value, void *context)
604 {
605     if (!check_set_special_type_attr(type, value, "__module__"))
606         return -1;
607 
608     PyType_Modified(type);
609 
610     return _PyDict_SetItemId(type->tp_dict, &PyId___module__, value);
611 }
612 
613 static PyObject *
type_abstractmethods(PyTypeObject * type,void * context)614 type_abstractmethods(PyTypeObject *type, void *context)
615 {
616     PyObject *mod = NULL;
617     /* type itself has an __abstractmethods__ descriptor (this). Don't return
618        that. */
619     if (type != &PyType_Type)
620         mod = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___abstractmethods__);
621     if (!mod) {
622         if (!PyErr_Occurred()) {
623             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
624             if (message)
625                 PyErr_SetObject(PyExc_AttributeError, message);
626         }
627         return NULL;
628     }
629     Py_INCREF(mod);
630     return mod;
631 }
632 
633 static int
type_set_abstractmethods(PyTypeObject * type,PyObject * value,void * context)634 type_set_abstractmethods(PyTypeObject *type, PyObject *value, void *context)
635 {
636     /* __abstractmethods__ should only be set once on a type, in
637        abc.ABCMeta.__new__, so this function doesn't do anything
638        special to update subclasses.
639     */
640     int abstract, res;
641     if (value != NULL) {
642         abstract = PyObject_IsTrue(value);
643         if (abstract < 0)
644             return -1;
645         res = _PyDict_SetItemId(type->tp_dict, &PyId___abstractmethods__, value);
646     }
647     else {
648         abstract = 0;
649         res = _PyDict_DelItemId(type->tp_dict, &PyId___abstractmethods__);
650         if (res && PyErr_ExceptionMatches(PyExc_KeyError)) {
651             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
652             if (message)
653                 PyErr_SetObject(PyExc_AttributeError, message);
654             return -1;
655         }
656     }
657     if (res == 0) {
658         PyType_Modified(type);
659         if (abstract)
660             type->tp_flags |= Py_TPFLAGS_IS_ABSTRACT;
661         else
662             type->tp_flags &= ~Py_TPFLAGS_IS_ABSTRACT;
663     }
664     return res;
665 }
666 
667 static PyObject *
type_get_bases(PyTypeObject * type,void * context)668 type_get_bases(PyTypeObject *type, void *context)
669 {
670     Py_INCREF(type->tp_bases);
671     return type->tp_bases;
672 }
673 
674 static PyTypeObject *best_base(PyObject *);
675 static int mro_internal(PyTypeObject *, PyObject **);
676 static int type_is_subtype_base_chain(PyTypeObject *, PyTypeObject *);
677 static int compatible_for_assignment(PyTypeObject *, PyTypeObject *, const char *);
678 static int add_subclass(PyTypeObject*, PyTypeObject*);
679 static int add_all_subclasses(PyTypeObject *type, PyObject *bases);
680 static void remove_subclass(PyTypeObject *, PyTypeObject *);
681 static void remove_all_subclasses(PyTypeObject *type, PyObject *bases);
682 static void update_all_slots(PyTypeObject *);
683 
684 typedef int (*update_callback)(PyTypeObject *, void *);
685 static int update_subclasses(PyTypeObject *type, PyObject *name,
686                              update_callback callback, void *data);
687 static int recurse_down_subclasses(PyTypeObject *type, PyObject *name,
688                                    update_callback callback, void *data);
689 
690 static int
mro_hierarchy(PyTypeObject * type,PyObject * temp)691 mro_hierarchy(PyTypeObject *type, PyObject *temp)
692 {
693     int res;
694     PyObject *new_mro, *old_mro;
695     PyObject *tuple;
696     PyObject *subclasses;
697     Py_ssize_t i, n;
698 
699     res = mro_internal(type, &old_mro);
700     if (res <= 0)
701         /* error / reentrance */
702         return res;
703     new_mro = type->tp_mro;
704 
705     if (old_mro != NULL)
706         tuple = PyTuple_Pack(3, type, new_mro, old_mro);
707     else
708         tuple = PyTuple_Pack(2, type, new_mro);
709 
710     if (tuple != NULL)
711         res = PyList_Append(temp, tuple);
712     else
713         res = -1;
714     Py_XDECREF(tuple);
715 
716     if (res < 0) {
717         type->tp_mro = old_mro;
718         Py_DECREF(new_mro);
719         return -1;
720     }
721     Py_XDECREF(old_mro);
722 
723     /* Obtain a copy of subclasses list to iterate over.
724 
725        Otherwise type->tp_subclasses might be altered
726        in the middle of the loop, for example, through a custom mro(),
727        by invoking type_set_bases on some subclass of the type
728        which in turn calls remove_subclass/add_subclass on this type.
729 
730        Finally, this makes things simple avoiding the need to deal
731        with dictionary iterators and weak references.
732     */
733     subclasses = type___subclasses___impl(type);
734     if (subclasses == NULL)
735         return -1;
736     n = PyList_GET_SIZE(subclasses);
737     for (i = 0; i < n; i++) {
738         PyTypeObject *subclass;
739         subclass = (PyTypeObject *)PyList_GET_ITEM(subclasses, i);
740         res = mro_hierarchy(subclass, temp);
741         if (res < 0)
742             break;
743     }
744     Py_DECREF(subclasses);
745 
746     return res;
747 }
748 
749 static int
type_set_bases(PyTypeObject * type,PyObject * new_bases,void * context)750 type_set_bases(PyTypeObject *type, PyObject *new_bases, void *context)
751 {
752     int res = 0;
753     PyObject *temp;
754     PyObject *old_bases;
755     PyTypeObject *new_base, *old_base;
756     Py_ssize_t i;
757 
758     if (!check_set_special_type_attr(type, new_bases, "__bases__"))
759         return -1;
760     if (!PyTuple_Check(new_bases)) {
761         PyErr_Format(PyExc_TypeError,
762              "can only assign tuple to %s.__bases__, not %s",
763                  type->tp_name, Py_TYPE(new_bases)->tp_name);
764         return -1;
765     }
766     if (PyTuple_GET_SIZE(new_bases) == 0) {
767         PyErr_Format(PyExc_TypeError,
768              "can only assign non-empty tuple to %s.__bases__, not ()",
769                  type->tp_name);
770         return -1;
771     }
772     for (i = 0; i < PyTuple_GET_SIZE(new_bases); i++) {
773         PyObject *ob;
774         PyTypeObject *base;
775 
776         ob = PyTuple_GET_ITEM(new_bases, i);
777         if (!PyType_Check(ob)) {
778             PyErr_Format(PyExc_TypeError,
779                          "%s.__bases__ must be tuple of classes, not '%s'",
780                          type->tp_name, Py_TYPE(ob)->tp_name);
781             return -1;
782         }
783 
784         base = (PyTypeObject*)ob;
785         if (PyType_IsSubtype(base, type) ||
786             /* In case of reentering here again through a custom mro()
787                the above check is not enough since it relies on
788                base->tp_mro which would gonna be updated inside
789                mro_internal only upon returning from the mro().
790 
791                However, base->tp_base has already been assigned (see
792                below), which in turn may cause an inheritance cycle
793                through tp_base chain.  And this is definitely
794                not what you want to ever happen.  */
795             (base->tp_mro != NULL && type_is_subtype_base_chain(base, type))) {
796 
797             PyErr_SetString(PyExc_TypeError,
798                             "a __bases__ item causes an inheritance cycle");
799             return -1;
800         }
801     }
802 
803     new_base = best_base(new_bases);
804     if (new_base == NULL)
805         return -1;
806 
807     if (!compatible_for_assignment(type->tp_base, new_base, "__bases__"))
808         return -1;
809 
810     Py_INCREF(new_bases);
811     Py_INCREF(new_base);
812 
813     old_bases = type->tp_bases;
814     old_base = type->tp_base;
815 
816     type->tp_bases = new_bases;
817     type->tp_base = new_base;
818 
819     temp = PyList_New(0);
820     if (temp == NULL)
821         goto bail;
822     if (mro_hierarchy(type, temp) < 0)
823         goto undo;
824     Py_DECREF(temp);
825 
826     /* Take no action in case if type->tp_bases has been replaced
827        through reentrance.  */
828     if (type->tp_bases == new_bases) {
829         /* any base that was in __bases__ but now isn't, we
830            need to remove |type| from its tp_subclasses.
831            conversely, any class now in __bases__ that wasn't
832            needs to have |type| added to its subclasses. */
833 
834         /* for now, sod that: just remove from all old_bases,
835            add to all new_bases */
836         remove_all_subclasses(type, old_bases);
837         res = add_all_subclasses(type, new_bases);
838         update_all_slots(type);
839     }
840 
841     Py_DECREF(old_bases);
842     Py_DECREF(old_base);
843 
844     assert(_PyType_CheckConsistency(type));
845     return res;
846 
847   undo:
848     for (i = PyList_GET_SIZE(temp) - 1; i >= 0; i--) {
849         PyTypeObject *cls;
850         PyObject *new_mro, *old_mro = NULL;
851 
852         PyArg_UnpackTuple(PyList_GET_ITEM(temp, i),
853                           "", 2, 3, &cls, &new_mro, &old_mro);
854         /* Do not rollback if cls has a newer version of MRO.  */
855         if (cls->tp_mro == new_mro) {
856             Py_XINCREF(old_mro);
857             cls->tp_mro = old_mro;
858             Py_DECREF(new_mro);
859         }
860     }
861     Py_DECREF(temp);
862 
863   bail:
864     if (type->tp_bases == new_bases) {
865         assert(type->tp_base == new_base);
866 
867         type->tp_bases = old_bases;
868         type->tp_base = old_base;
869 
870         Py_DECREF(new_bases);
871         Py_DECREF(new_base);
872     }
873     else {
874         Py_DECREF(old_bases);
875         Py_DECREF(old_base);
876     }
877 
878     assert(_PyType_CheckConsistency(type));
879     return -1;
880 }
881 
882 static PyObject *
type_dict(PyTypeObject * type,void * context)883 type_dict(PyTypeObject *type, void *context)
884 {
885     if (type->tp_dict == NULL) {
886         Py_RETURN_NONE;
887     }
888     return PyDictProxy_New(type->tp_dict);
889 }
890 
891 static PyObject *
type_get_doc(PyTypeObject * type,void * context)892 type_get_doc(PyTypeObject *type, void *context)
893 {
894     PyObject *result;
895     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE) && type->tp_doc != NULL) {
896         return _PyType_GetDocFromInternalDoc(type->tp_name, type->tp_doc);
897     }
898     result = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___doc__);
899     if (result == NULL) {
900         if (!PyErr_Occurred()) {
901             result = Py_None;
902             Py_INCREF(result);
903         }
904     }
905     else if (Py_TYPE(result)->tp_descr_get) {
906         result = Py_TYPE(result)->tp_descr_get(result, NULL,
907                                                (PyObject *)type);
908     }
909     else {
910         Py_INCREF(result);
911     }
912     return result;
913 }
914 
915 static PyObject *
type_get_text_signature(PyTypeObject * type,void * context)916 type_get_text_signature(PyTypeObject *type, void *context)
917 {
918     return _PyType_GetTextSignatureFromInternalDoc(type->tp_name, type->tp_doc);
919 }
920 
921 static int
type_set_doc(PyTypeObject * type,PyObject * value,void * context)922 type_set_doc(PyTypeObject *type, PyObject *value, void *context)
923 {
924     if (!check_set_special_type_attr(type, value, "__doc__"))
925         return -1;
926     PyType_Modified(type);
927     return _PyDict_SetItemId(type->tp_dict, &PyId___doc__, value);
928 }
929 
930 static PyObject *
type_get_annotations(PyTypeObject * type,void * context)931 type_get_annotations(PyTypeObject *type, void *context)
932 {
933     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
934         PyErr_Format(PyExc_AttributeError, "type object '%s' has no attribute '__annotations__'", type->tp_name);
935         return NULL;
936     }
937 
938     PyObject *annotations;
939     /* there's no _PyDict_GetItemId without WithError, so let's LBYL. */
940     if (_PyDict_ContainsId(type->tp_dict, &PyId___annotations__)) {
941         annotations = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___annotations__);
942         /*
943         ** _PyDict_GetItemIdWithError could still fail,
944         ** for instance with a well-timed Ctrl-C or a MemoryError.
945         ** so let's be totally safe.
946         */
947         if (annotations) {
948             if (Py_TYPE(annotations)->tp_descr_get) {
949                 annotations = Py_TYPE(annotations)->tp_descr_get(annotations, NULL,
950                                                        (PyObject *)type);
951             } else {
952                 Py_INCREF(annotations);
953             }
954         }
955     } else {
956         annotations = PyDict_New();
957         if (annotations) {
958             int result = _PyDict_SetItemId(type->tp_dict, &PyId___annotations__, annotations);
959             if (result) {
960                 Py_CLEAR(annotations);
961             } else {
962                 PyType_Modified(type);
963             }
964         }
965     }
966     return annotations;
967 }
968 
969 static int
type_set_annotations(PyTypeObject * type,PyObject * value,void * context)970 type_set_annotations(PyTypeObject *type, PyObject *value, void *context)
971 {
972     if (_PyType_HasFeature(type, Py_TPFLAGS_IMMUTABLETYPE)) {
973         PyErr_Format(PyExc_TypeError,
974                      "cannot set '__annotations__' attribute of immutable type '%s'",
975                      type->tp_name);
976         return -1;
977     }
978 
979     int result;
980     if (value != NULL) {
981         /* set */
982         result = _PyDict_SetItemId(type->tp_dict, &PyId___annotations__, value);
983     } else {
984         /* delete */
985         if (!_PyDict_ContainsId(type->tp_dict, &PyId___annotations__)) {
986             PyErr_Format(PyExc_AttributeError, "__annotations__");
987             return -1;
988         }
989         result = _PyDict_DelItemId(type->tp_dict, &PyId___annotations__);
990     }
991 
992     if (result == 0) {
993         PyType_Modified(type);
994     }
995     return result;
996 }
997 
998 
999 /*[clinic input]
1000 type.__instancecheck__ -> bool
1001 
1002     instance: object
1003     /
1004 
1005 Check if an object is an instance.
1006 [clinic start generated code]*/
1007 
1008 static int
type___instancecheck___impl(PyTypeObject * self,PyObject * instance)1009 type___instancecheck___impl(PyTypeObject *self, PyObject *instance)
1010 /*[clinic end generated code: output=08b6bf5f591c3618 input=cdbfeaee82c01a0f]*/
1011 {
1012     return _PyObject_RealIsInstance(instance, (PyObject *)self);
1013 }
1014 
1015 /*[clinic input]
1016 type.__subclasscheck__ -> bool
1017 
1018     subclass: object
1019     /
1020 
1021 Check if a class is a subclass.
1022 [clinic start generated code]*/
1023 
1024 static int
type___subclasscheck___impl(PyTypeObject * self,PyObject * subclass)1025 type___subclasscheck___impl(PyTypeObject *self, PyObject *subclass)
1026 /*[clinic end generated code: output=97a4e51694500941 input=071b2ca9e03355f4]*/
1027 {
1028     return _PyObject_RealIsSubclass(subclass, (PyObject *)self);
1029 }
1030 
1031 
1032 static PyGetSetDef type_getsets[] = {
1033     {"__name__", (getter)type_name, (setter)type_set_name, NULL},
1034     {"__qualname__", (getter)type_qualname, (setter)type_set_qualname, NULL},
1035     {"__bases__", (getter)type_get_bases, (setter)type_set_bases, NULL},
1036     {"__module__", (getter)type_module, (setter)type_set_module, NULL},
1037     {"__abstractmethods__", (getter)type_abstractmethods,
1038      (setter)type_set_abstractmethods, NULL},
1039     {"__dict__",  (getter)type_dict,  NULL, NULL},
1040     {"__doc__", (getter)type_get_doc, (setter)type_set_doc, NULL},
1041     {"__text_signature__", (getter)type_get_text_signature, NULL, NULL},
1042     {"__annotations__", (getter)type_get_annotations, (setter)type_set_annotations, NULL},
1043     {0}
1044 };
1045 
1046 static PyObject *
type_repr(PyTypeObject * type)1047 type_repr(PyTypeObject *type)
1048 {
1049     PyObject *mod, *name, *rtn;
1050 
1051     mod = type_module(type, NULL);
1052     if (mod == NULL)
1053         PyErr_Clear();
1054     else if (!PyUnicode_Check(mod)) {
1055         Py_DECREF(mod);
1056         mod = NULL;
1057     }
1058     name = type_qualname(type, NULL);
1059     if (name == NULL) {
1060         Py_XDECREF(mod);
1061         return NULL;
1062     }
1063 
1064     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
1065         rtn = PyUnicode_FromFormat("<class '%U.%U'>", mod, name);
1066     else
1067         rtn = PyUnicode_FromFormat("<class '%s'>", type->tp_name);
1068 
1069     Py_XDECREF(mod);
1070     Py_DECREF(name);
1071     return rtn;
1072 }
1073 
1074 static PyObject *
type_call(PyTypeObject * type,PyObject * args,PyObject * kwds)1075 type_call(PyTypeObject *type, PyObject *args, PyObject *kwds)
1076 {
1077     PyObject *obj;
1078     PyThreadState *tstate = _PyThreadState_GET();
1079 
1080 #ifdef Py_DEBUG
1081     /* type_call() must not be called with an exception set,
1082        because it can clear it (directly or indirectly) and so the
1083        caller loses its exception */
1084     assert(!_PyErr_Occurred(tstate));
1085 #endif
1086 
1087     /* Special case: type(x) should return Py_TYPE(x) */
1088     /* We only want type itself to accept the one-argument form (#27157) */
1089     if (type == &PyType_Type) {
1090         assert(args != NULL && PyTuple_Check(args));
1091         assert(kwds == NULL || PyDict_Check(kwds));
1092         Py_ssize_t nargs = PyTuple_GET_SIZE(args);
1093 
1094         if (nargs == 1 && (kwds == NULL || !PyDict_GET_SIZE(kwds))) {
1095             obj = (PyObject *) Py_TYPE(PyTuple_GET_ITEM(args, 0));
1096             Py_INCREF(obj);
1097             return obj;
1098         }
1099 
1100         /* SF bug 475327 -- if that didn't trigger, we need 3
1101            arguments. But PyArg_ParseTuple in type_new may give
1102            a msg saying type() needs exactly 3. */
1103         if (nargs != 3) {
1104             PyErr_SetString(PyExc_TypeError,
1105                             "type() takes 1 or 3 arguments");
1106             return NULL;
1107         }
1108     }
1109 
1110     if (type->tp_new == NULL) {
1111         _PyErr_Format(tstate, PyExc_TypeError,
1112                       "cannot create '%s' instances", type->tp_name);
1113         return NULL;
1114     }
1115 
1116     obj = type->tp_new(type, args, kwds);
1117     obj = _Py_CheckFunctionResult(tstate, (PyObject*)type, obj, NULL);
1118     if (obj == NULL)
1119         return NULL;
1120 
1121     /* If the returned object is not an instance of type,
1122        it won't be initialized. */
1123     if (!PyType_IsSubtype(Py_TYPE(obj), type))
1124         return obj;
1125 
1126     type = Py_TYPE(obj);
1127     if (type->tp_init != NULL) {
1128         int res = type->tp_init(obj, args, kwds);
1129         if (res < 0) {
1130             assert(_PyErr_Occurred(tstate));
1131             Py_DECREF(obj);
1132             obj = NULL;
1133         }
1134         else {
1135             assert(!_PyErr_Occurred(tstate));
1136         }
1137     }
1138     return obj;
1139 }
1140 
1141 PyObject *
PyType_GenericAlloc(PyTypeObject * type,Py_ssize_t nitems)1142 PyType_GenericAlloc(PyTypeObject *type, Py_ssize_t nitems)
1143 {
1144     PyObject *obj;
1145     const size_t size = _PyObject_VAR_SIZE(type, nitems+1);
1146     /* note that we need to add one, for the sentinel */
1147 
1148     if (_PyType_IS_GC(type)) {
1149         obj = _PyObject_GC_Malloc(size);
1150     }
1151     else {
1152         obj = (PyObject *)PyObject_Malloc(size);
1153     }
1154 
1155     if (obj == NULL) {
1156         return PyErr_NoMemory();
1157     }
1158 
1159     memset(obj, '\0', size);
1160 
1161     if (type->tp_itemsize == 0) {
1162         _PyObject_Init(obj, type);
1163     }
1164     else {
1165         _PyObject_InitVar((PyVarObject *)obj, type, nitems);
1166     }
1167 
1168     if (_PyType_IS_GC(type)) {
1169         _PyObject_GC_TRACK(obj);
1170     }
1171     return obj;
1172 }
1173 
1174 PyObject *
PyType_GenericNew(PyTypeObject * type,PyObject * args,PyObject * kwds)1175 PyType_GenericNew(PyTypeObject *type, PyObject *args, PyObject *kwds)
1176 {
1177     return type->tp_alloc(type, 0);
1178 }
1179 
1180 /* Helpers for subtyping */
1181 
1182 static int
traverse_slots(PyTypeObject * type,PyObject * self,visitproc visit,void * arg)1183 traverse_slots(PyTypeObject *type, PyObject *self, visitproc visit, void *arg)
1184 {
1185     Py_ssize_t i, n;
1186     PyMemberDef *mp;
1187 
1188     n = Py_SIZE(type);
1189     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1190     for (i = 0; i < n; i++, mp++) {
1191         if (mp->type == T_OBJECT_EX) {
1192             char *addr = (char *)self + mp->offset;
1193             PyObject *obj = *(PyObject **)addr;
1194             if (obj != NULL) {
1195                 int err = visit(obj, arg);
1196                 if (err)
1197                     return err;
1198             }
1199         }
1200     }
1201     return 0;
1202 }
1203 
1204 static int
subtype_traverse(PyObject * self,visitproc visit,void * arg)1205 subtype_traverse(PyObject *self, visitproc visit, void *arg)
1206 {
1207     PyTypeObject *type, *base;
1208     traverseproc basetraverse;
1209 
1210     /* Find the nearest base with a different tp_traverse,
1211        and traverse slots while we're at it */
1212     type = Py_TYPE(self);
1213     base = type;
1214     while ((basetraverse = base->tp_traverse) == subtype_traverse) {
1215         if (Py_SIZE(base)) {
1216             int err = traverse_slots(base, self, visit, arg);
1217             if (err)
1218                 return err;
1219         }
1220         base = base->tp_base;
1221         assert(base);
1222     }
1223 
1224     if (type->tp_dictoffset != base->tp_dictoffset) {
1225         PyObject **dictptr = _PyObject_GetDictPtr(self);
1226         if (dictptr && *dictptr)
1227             Py_VISIT(*dictptr);
1228     }
1229 
1230     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1231         && (!basetraverse || !(base->tp_flags & Py_TPFLAGS_HEAPTYPE))) {
1232         /* For a heaptype, the instances count as references
1233            to the type.          Traverse the type so the collector
1234            can find cycles involving this link.
1235            Skip this visit if basetraverse belongs to a heap type: in that
1236            case, basetraverse will visit the type when we call it later.
1237            */
1238         Py_VISIT(type);
1239     }
1240 
1241     if (basetraverse)
1242         return basetraverse(self, visit, arg);
1243     return 0;
1244 }
1245 
1246 static void
clear_slots(PyTypeObject * type,PyObject * self)1247 clear_slots(PyTypeObject *type, PyObject *self)
1248 {
1249     Py_ssize_t i, n;
1250     PyMemberDef *mp;
1251 
1252     n = Py_SIZE(type);
1253     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1254     for (i = 0; i < n; i++, mp++) {
1255         if (mp->type == T_OBJECT_EX && !(mp->flags & READONLY)) {
1256             char *addr = (char *)self + mp->offset;
1257             PyObject *obj = *(PyObject **)addr;
1258             if (obj != NULL) {
1259                 *(PyObject **)addr = NULL;
1260                 Py_DECREF(obj);
1261             }
1262         }
1263     }
1264 }
1265 
1266 static int
subtype_clear(PyObject * self)1267 subtype_clear(PyObject *self)
1268 {
1269     PyTypeObject *type, *base;
1270     inquiry baseclear;
1271 
1272     /* Find the nearest base with a different tp_clear
1273        and clear slots while we're at it */
1274     type = Py_TYPE(self);
1275     base = type;
1276     while ((baseclear = base->tp_clear) == subtype_clear) {
1277         if (Py_SIZE(base))
1278             clear_slots(base, self);
1279         base = base->tp_base;
1280         assert(base);
1281     }
1282 
1283     /* Clear the instance dict (if any), to break cycles involving only
1284        __dict__ slots (as in the case 'self.__dict__ is self'). */
1285     if (type->tp_dictoffset != base->tp_dictoffset) {
1286         PyObject **dictptr = _PyObject_GetDictPtr(self);
1287         if (dictptr && *dictptr)
1288             Py_CLEAR(*dictptr);
1289     }
1290 
1291     if (baseclear)
1292         return baseclear(self);
1293     return 0;
1294 }
1295 
1296 static void
subtype_dealloc(PyObject * self)1297 subtype_dealloc(PyObject *self)
1298 {
1299     PyTypeObject *type, *base;
1300     destructor basedealloc;
1301     int has_finalizer;
1302 
1303     /* Extract the type; we expect it to be a heap type */
1304     type = Py_TYPE(self);
1305     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
1306 
1307     /* Test whether the type has GC exactly once */
1308 
1309     if (!_PyType_IS_GC(type)) {
1310         /* A non GC dynamic type allows certain simplifications:
1311            there's no need to call clear_slots(), or DECREF the dict,
1312            or clear weakrefs. */
1313 
1314         /* Maybe call finalizer; exit early if resurrected */
1315         if (type->tp_finalize) {
1316             if (PyObject_CallFinalizerFromDealloc(self) < 0)
1317                 return;
1318         }
1319         if (type->tp_del) {
1320             type->tp_del(self);
1321             if (Py_REFCNT(self) > 0) {
1322                 return;
1323             }
1324         }
1325 
1326         /* Find the nearest base with a different tp_dealloc */
1327         base = type;
1328         while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1329             base = base->tp_base;
1330             assert(base);
1331         }
1332 
1333         /* Extract the type again; tp_del may have changed it */
1334         type = Py_TYPE(self);
1335 
1336         // Don't read type memory after calling basedealloc() since basedealloc()
1337         // can deallocate the type and free its memory.
1338         int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1339                                  && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE));
1340 
1341         /* Call the base tp_dealloc() */
1342         assert(basedealloc);
1343         basedealloc(self);
1344 
1345         /* Can't reference self beyond this point. It's possible tp_del switched
1346            our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
1347            reference counting. Only decref if the base type is not already a heap
1348            allocated type. Otherwise, basedealloc should have decref'd it already */
1349         if (type_needs_decref) {
1350             Py_DECREF(type);
1351         }
1352 
1353         /* Done */
1354         return;
1355     }
1356 
1357     /* We get here only if the type has GC */
1358 
1359     /* UnTrack and re-Track around the trashcan macro, alas */
1360     /* See explanation at end of function for full disclosure */
1361     PyObject_GC_UnTrack(self);
1362     Py_TRASHCAN_BEGIN(self, subtype_dealloc);
1363 
1364     /* Find the nearest base with a different tp_dealloc */
1365     base = type;
1366     while ((/*basedealloc =*/ base->tp_dealloc) == subtype_dealloc) {
1367         base = base->tp_base;
1368         assert(base);
1369     }
1370 
1371     has_finalizer = type->tp_finalize || type->tp_del;
1372 
1373     if (type->tp_finalize) {
1374         _PyObject_GC_TRACK(self);
1375         if (PyObject_CallFinalizerFromDealloc(self) < 0) {
1376             /* Resurrected */
1377             goto endlabel;
1378         }
1379         _PyObject_GC_UNTRACK(self);
1380     }
1381     /*
1382       If we added a weaklist, we clear it. Do this *before* calling tp_del,
1383       clearing slots, or clearing the instance dict.
1384 
1385       GC tracking must be off at this point. weakref callbacks (if any, and
1386       whether directly here or indirectly in something we call) may trigger GC,
1387       and if self is tracked at that point, it will look like trash to GC and GC
1388       will try to delete self again.
1389     */
1390     if (type->tp_weaklistoffset && !base->tp_weaklistoffset)
1391         PyObject_ClearWeakRefs(self);
1392 
1393     if (type->tp_del) {
1394         _PyObject_GC_TRACK(self);
1395         type->tp_del(self);
1396         if (Py_REFCNT(self) > 0) {
1397             /* Resurrected */
1398             goto endlabel;
1399         }
1400         _PyObject_GC_UNTRACK(self);
1401     }
1402     if (has_finalizer) {
1403         /* New weakrefs could be created during the finalizer call.
1404            If this occurs, clear them out without calling their
1405            finalizers since they might rely on part of the object
1406            being finalized that has already been destroyed. */
1407         if (type->tp_weaklistoffset && !base->tp_weaklistoffset) {
1408             /* Modeled after GET_WEAKREFS_LISTPTR() */
1409             PyWeakReference **list = (PyWeakReference **) \
1410                 _PyObject_GET_WEAKREFS_LISTPTR(self);
1411             while (*list)
1412                 _PyWeakref_ClearRef(*list);
1413         }
1414     }
1415 
1416     /*  Clear slots up to the nearest base with a different tp_dealloc */
1417     base = type;
1418     while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1419         if (Py_SIZE(base))
1420             clear_slots(base, self);
1421         base = base->tp_base;
1422         assert(base);
1423     }
1424 
1425     /* If we added a dict, DECREF it */
1426     if (type->tp_dictoffset && !base->tp_dictoffset) {
1427         PyObject **dictptr = _PyObject_GetDictPtr(self);
1428         if (dictptr != NULL) {
1429             PyObject *dict = *dictptr;
1430             if (dict != NULL) {
1431                 Py_DECREF(dict);
1432                 *dictptr = NULL;
1433             }
1434         }
1435     }
1436 
1437     /* Extract the type again; tp_del may have changed it */
1438     type = Py_TYPE(self);
1439 
1440     /* Call the base tp_dealloc(); first retrack self if
1441      * basedealloc knows about gc.
1442      */
1443     if (_PyType_IS_GC(base)) {
1444         _PyObject_GC_TRACK(self);
1445     }
1446 
1447     // Don't read type memory after calling basedealloc() since basedealloc()
1448     // can deallocate the type and free its memory.
1449     int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1450                              && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE));
1451 
1452     assert(basedealloc);
1453     basedealloc(self);
1454 
1455     /* Can't reference self beyond this point. It's possible tp_del switched
1456        our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
1457        reference counting. Only decref if the base type is not already a heap
1458        allocated type. Otherwise, basedealloc should have decref'd it already */
1459     if (type_needs_decref) {
1460         Py_DECREF(type);
1461     }
1462 
1463   endlabel:
1464     Py_TRASHCAN_END
1465 
1466     /* Explanation of the weirdness around the trashcan macros:
1467 
1468        Q. What do the trashcan macros do?
1469 
1470        A. Read the comment titled "Trashcan mechanism" in object.h.
1471           For one, this explains why there must be a call to GC-untrack
1472           before the trashcan begin macro.      Without understanding the
1473           trashcan code, the answers to the following questions don't make
1474           sense.
1475 
1476        Q. Why do we GC-untrack before the trashcan and then immediately
1477           GC-track again afterward?
1478 
1479        A. In the case that the base class is GC-aware, the base class
1480           probably GC-untracks the object.      If it does that using the
1481           UNTRACK macro, this will crash when the object is already
1482           untracked.  Because we don't know what the base class does, the
1483           only safe thing is to make sure the object is tracked when we
1484           call the base class dealloc.  But...  The trashcan begin macro
1485           requires that the object is *untracked* before it is called.  So
1486           the dance becomes:
1487 
1488          GC untrack
1489          trashcan begin
1490          GC track
1491 
1492        Q. Why did the last question say "immediately GC-track again"?
1493           It's nowhere near immediately.
1494 
1495        A. Because the code *used* to re-track immediately.      Bad Idea.
1496           self has a refcount of 0, and if gc ever gets its hands on it
1497           (which can happen if any weakref callback gets invoked), it
1498           looks like trash to gc too, and gc also tries to delete self
1499           then.  But we're already deleting self.  Double deallocation is
1500           a subtle disaster.
1501     */
1502 }
1503 
1504 static PyTypeObject *solid_base(PyTypeObject *type);
1505 
1506 /* type test with subclassing support */
1507 
1508 static int
type_is_subtype_base_chain(PyTypeObject * a,PyTypeObject * b)1509 type_is_subtype_base_chain(PyTypeObject *a, PyTypeObject *b)
1510 {
1511     do {
1512         if (a == b)
1513             return 1;
1514         a = a->tp_base;
1515     } while (a != NULL);
1516 
1517     return (b == &PyBaseObject_Type);
1518 }
1519 
1520 int
PyType_IsSubtype(PyTypeObject * a,PyTypeObject * b)1521 PyType_IsSubtype(PyTypeObject *a, PyTypeObject *b)
1522 {
1523     PyObject *mro;
1524 
1525     mro = a->tp_mro;
1526     if (mro != NULL) {
1527         /* Deal with multiple inheritance without recursion
1528            by walking the MRO tuple */
1529         Py_ssize_t i, n;
1530         assert(PyTuple_Check(mro));
1531         n = PyTuple_GET_SIZE(mro);
1532         for (i = 0; i < n; i++) {
1533             if (PyTuple_GET_ITEM(mro, i) == (PyObject *)b)
1534                 return 1;
1535         }
1536         return 0;
1537     }
1538     else
1539         /* a is not completely initialized yet; follow tp_base */
1540         return type_is_subtype_base_chain(a, b);
1541 }
1542 
1543 /* Routines to do a method lookup in the type without looking in the
1544    instance dictionary (so we can't use PyObject_GetAttr) but still
1545    binding it to the instance.
1546 
1547    Variants:
1548 
1549    - _PyObject_LookupSpecial() returns NULL without raising an exception
1550      when the _PyType_Lookup() call fails;
1551 
1552    - lookup_maybe_method() and lookup_method() are internal routines similar
1553      to _PyObject_LookupSpecial(), but can return unbound PyFunction
1554      to avoid temporary method object. Pass self as first argument when
1555      unbound == 1.
1556 */
1557 
1558 PyObject *
_PyObject_LookupSpecial(PyObject * self,_Py_Identifier * attrid)1559 _PyObject_LookupSpecial(PyObject *self, _Py_Identifier *attrid)
1560 {
1561     PyObject *res;
1562 
1563     res = _PyType_LookupId(Py_TYPE(self), attrid);
1564     if (res != NULL) {
1565         descrgetfunc f;
1566         if ((f = Py_TYPE(res)->tp_descr_get) == NULL)
1567             Py_INCREF(res);
1568         else
1569             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1570     }
1571     return res;
1572 }
1573 
1574 static PyObject *
lookup_maybe_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1575 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1576 {
1577     PyObject *res = _PyType_LookupId(Py_TYPE(self), attrid);
1578     if (res == NULL) {
1579         return NULL;
1580     }
1581 
1582     if (_PyType_HasFeature(Py_TYPE(res), Py_TPFLAGS_METHOD_DESCRIPTOR)) {
1583         /* Avoid temporary PyMethodObject */
1584         *unbound = 1;
1585         Py_INCREF(res);
1586     }
1587     else {
1588         *unbound = 0;
1589         descrgetfunc f = Py_TYPE(res)->tp_descr_get;
1590         if (f == NULL) {
1591             Py_INCREF(res);
1592         }
1593         else {
1594             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1595         }
1596     }
1597     return res;
1598 }
1599 
1600 static PyObject *
lookup_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1601 lookup_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1602 {
1603     PyObject *res = lookup_maybe_method(self, attrid, unbound);
1604     if (res == NULL && !PyErr_Occurred()) {
1605         PyErr_SetObject(PyExc_AttributeError, _PyUnicode_FromId(attrid));
1606     }
1607     return res;
1608 }
1609 
1610 
1611 static inline PyObject*
vectorcall_unbound(PyThreadState * tstate,int unbound,PyObject * func,PyObject * const * args,Py_ssize_t nargs)1612 vectorcall_unbound(PyThreadState *tstate, int unbound, PyObject *func,
1613                    PyObject *const *args, Py_ssize_t nargs)
1614 {
1615     size_t nargsf = nargs;
1616     if (!unbound) {
1617         /* Skip self argument, freeing up args[0] to use for
1618          * PY_VECTORCALL_ARGUMENTS_OFFSET */
1619         args++;
1620         nargsf = nargsf - 1 + PY_VECTORCALL_ARGUMENTS_OFFSET;
1621     }
1622     return _PyObject_VectorcallTstate(tstate, func, args, nargsf, NULL);
1623 }
1624 
1625 static PyObject*
call_unbound_noarg(int unbound,PyObject * func,PyObject * self)1626 call_unbound_noarg(int unbound, PyObject *func, PyObject *self)
1627 {
1628     if (unbound) {
1629         return PyObject_CallOneArg(func, self);
1630     }
1631     else {
1632         return _PyObject_CallNoArg(func);
1633     }
1634 }
1635 
1636 /* A variation of PyObject_CallMethod* that uses lookup_method()
1637    instead of PyObject_GetAttrString().
1638 
1639    args is an argument vector of length nargs. The first element in this
1640    vector is the special object "self" which is used for the method lookup */
1641 static PyObject *
vectorcall_method(_Py_Identifier * name,PyObject * const * args,Py_ssize_t nargs)1642 vectorcall_method(_Py_Identifier *name,
1643                   PyObject *const *args, Py_ssize_t nargs)
1644 {
1645     assert(nargs >= 1);
1646 
1647     PyThreadState *tstate = _PyThreadState_GET();
1648     int unbound;
1649     PyObject *self = args[0];
1650     PyObject *func = lookup_method(self, name, &unbound);
1651     if (func == NULL) {
1652         return NULL;
1653     }
1654     PyObject *retval = vectorcall_unbound(tstate, unbound, func, args, nargs);
1655     Py_DECREF(func);
1656     return retval;
1657 }
1658 
1659 /* Clone of vectorcall_method() that returns NotImplemented
1660  * when the lookup fails. */
1661 static PyObject *
vectorcall_maybe(PyThreadState * tstate,_Py_Identifier * name,PyObject * const * args,Py_ssize_t nargs)1662 vectorcall_maybe(PyThreadState *tstate, _Py_Identifier *name,
1663                  PyObject *const *args, Py_ssize_t nargs)
1664 {
1665     assert(nargs >= 1);
1666 
1667     int unbound;
1668     PyObject *self = args[0];
1669     PyObject *func = lookup_maybe_method(self, name, &unbound);
1670     if (func == NULL) {
1671         if (!PyErr_Occurred())
1672             Py_RETURN_NOTIMPLEMENTED;
1673         return NULL;
1674     }
1675     PyObject *retval = vectorcall_unbound(tstate, unbound, func, args, nargs);
1676     Py_DECREF(func);
1677     return retval;
1678 }
1679 
1680 /*
1681     Method resolution order algorithm C3 described in
1682     "A Monotonic Superclass Linearization for Dylan",
1683     by Kim Barrett, Bob Cassel, Paul Haahr,
1684     David A. Moon, Keith Playford, and P. Tucker Withington.
1685     (OOPSLA 1996)
1686 
1687     Some notes about the rules implied by C3:
1688 
1689     No duplicate bases.
1690     It isn't legal to repeat a class in a list of base classes.
1691 
1692     The next three properties are the 3 constraints in "C3".
1693 
1694     Local precedence order.
1695     If A precedes B in C's MRO, then A will precede B in the MRO of all
1696     subclasses of C.
1697 
1698     Monotonicity.
1699     The MRO of a class must be an extension without reordering of the
1700     MRO of each of its superclasses.
1701 
1702     Extended Precedence Graph (EPG).
1703     Linearization is consistent if there is a path in the EPG from
1704     each class to all its successors in the linearization.  See
1705     the paper for definition of EPG.
1706  */
1707 
1708 static int
tail_contains(PyObject * tuple,int whence,PyObject * o)1709 tail_contains(PyObject *tuple, int whence, PyObject *o)
1710 {
1711     Py_ssize_t j, size;
1712     size = PyTuple_GET_SIZE(tuple);
1713 
1714     for (j = whence+1; j < size; j++) {
1715         if (PyTuple_GET_ITEM(tuple, j) == o)
1716             return 1;
1717     }
1718     return 0;
1719 }
1720 
1721 static PyObject *
class_name(PyObject * cls)1722 class_name(PyObject *cls)
1723 {
1724     PyObject *name;
1725     if (_PyObject_LookupAttrId(cls, &PyId___name__, &name) == 0) {
1726         name = PyObject_Repr(cls);
1727     }
1728     return name;
1729 }
1730 
1731 static int
check_duplicates(PyObject * tuple)1732 check_duplicates(PyObject *tuple)
1733 {
1734     Py_ssize_t i, j, n;
1735     /* Let's use a quadratic time algorithm,
1736        assuming that the bases tuples is short.
1737     */
1738     n = PyTuple_GET_SIZE(tuple);
1739     for (i = 0; i < n; i++) {
1740         PyObject *o = PyTuple_GET_ITEM(tuple, i);
1741         for (j = i + 1; j < n; j++) {
1742             if (PyTuple_GET_ITEM(tuple, j) == o) {
1743                 o = class_name(o);
1744                 if (o != NULL) {
1745                     if (PyUnicode_Check(o)) {
1746                         PyErr_Format(PyExc_TypeError,
1747                                      "duplicate base class %U", o);
1748                     }
1749                     else {
1750                         PyErr_SetString(PyExc_TypeError,
1751                                         "duplicate base class");
1752                     }
1753                     Py_DECREF(o);
1754                 }
1755                 return -1;
1756             }
1757         }
1758     }
1759     return 0;
1760 }
1761 
1762 /* Raise a TypeError for an MRO order disagreement.
1763 
1764    It's hard to produce a good error message.  In the absence of better
1765    insight into error reporting, report the classes that were candidates
1766    to be put next into the MRO.  There is some conflict between the
1767    order in which they should be put in the MRO, but it's hard to
1768    diagnose what constraint can't be satisfied.
1769 */
1770 
1771 static void
set_mro_error(PyObject ** to_merge,Py_ssize_t to_merge_size,int * remain)1772 set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain)
1773 {
1774     Py_ssize_t i, n, off;
1775     char buf[1000];
1776     PyObject *k, *v;
1777     PyObject *set = PyDict_New();
1778     if (!set) return;
1779 
1780     for (i = 0; i < to_merge_size; i++) {
1781         PyObject *L = to_merge[i];
1782         if (remain[i] < PyTuple_GET_SIZE(L)) {
1783             PyObject *c = PyTuple_GET_ITEM(L, remain[i]);
1784             if (PyDict_SetItem(set, c, Py_None) < 0) {
1785                 Py_DECREF(set);
1786                 return;
1787             }
1788         }
1789     }
1790     n = PyDict_GET_SIZE(set);
1791 
1792     off = PyOS_snprintf(buf, sizeof(buf), "Cannot create a \
1793 consistent method resolution\norder (MRO) for bases");
1794     i = 0;
1795     while (PyDict_Next(set, &i, &k, &v) && (size_t)off < sizeof(buf)) {
1796         PyObject *name = class_name(k);
1797         const char *name_str = NULL;
1798         if (name != NULL) {
1799             if (PyUnicode_Check(name)) {
1800                 name_str = PyUnicode_AsUTF8(name);
1801             }
1802             else {
1803                 name_str = "?";
1804             }
1805         }
1806         if (name_str == NULL) {
1807             Py_XDECREF(name);
1808             Py_DECREF(set);
1809             return;
1810         }
1811         off += PyOS_snprintf(buf + off, sizeof(buf) - off, " %s", name_str);
1812         Py_XDECREF(name);
1813         if (--n && (size_t)(off+1) < sizeof(buf)) {
1814             buf[off++] = ',';
1815             buf[off] = '\0';
1816         }
1817     }
1818     PyErr_SetString(PyExc_TypeError, buf);
1819     Py_DECREF(set);
1820 }
1821 
1822 static int
pmerge(PyObject * acc,PyObject ** to_merge,Py_ssize_t to_merge_size)1823 pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
1824 {
1825     int res = 0;
1826     Py_ssize_t i, j, empty_cnt;
1827     int *remain;
1828 
1829     /* remain stores an index into each sublist of to_merge.
1830        remain[i] is the index of the next base in to_merge[i]
1831        that is not included in acc.
1832     */
1833     remain = PyMem_New(int, to_merge_size);
1834     if (remain == NULL) {
1835         PyErr_NoMemory();
1836         return -1;
1837     }
1838     for (i = 0; i < to_merge_size; i++)
1839         remain[i] = 0;
1840 
1841   again:
1842     empty_cnt = 0;
1843     for (i = 0; i < to_merge_size; i++) {
1844         PyObject *candidate;
1845 
1846         PyObject *cur_tuple = to_merge[i];
1847 
1848         if (remain[i] >= PyTuple_GET_SIZE(cur_tuple)) {
1849             empty_cnt++;
1850             continue;
1851         }
1852 
1853         /* Choose next candidate for MRO.
1854 
1855            The input sequences alone can determine the choice.
1856            If not, choose the class which appears in the MRO
1857            of the earliest direct superclass of the new class.
1858         */
1859 
1860         candidate = PyTuple_GET_ITEM(cur_tuple, remain[i]);
1861         for (j = 0; j < to_merge_size; j++) {
1862             PyObject *j_lst = to_merge[j];
1863             if (tail_contains(j_lst, remain[j], candidate))
1864                 goto skip; /* continue outer loop */
1865         }
1866         res = PyList_Append(acc, candidate);
1867         if (res < 0)
1868             goto out;
1869 
1870         for (j = 0; j < to_merge_size; j++) {
1871             PyObject *j_lst = to_merge[j];
1872             if (remain[j] < PyTuple_GET_SIZE(j_lst) &&
1873                 PyTuple_GET_ITEM(j_lst, remain[j]) == candidate) {
1874                 remain[j]++;
1875             }
1876         }
1877         goto again;
1878       skip: ;
1879     }
1880 
1881     if (empty_cnt != to_merge_size) {
1882         set_mro_error(to_merge, to_merge_size, remain);
1883         res = -1;
1884     }
1885 
1886   out:
1887     PyMem_Free(remain);
1888 
1889     return res;
1890 }
1891 
1892 static PyObject *
mro_implementation(PyTypeObject * type)1893 mro_implementation(PyTypeObject *type)
1894 {
1895     PyObject *result;
1896     PyObject *bases;
1897     PyObject **to_merge;
1898     Py_ssize_t i, n;
1899 
1900     if (!_PyType_IsReady(type)) {
1901         if (PyType_Ready(type) < 0)
1902             return NULL;
1903     }
1904 
1905     bases = type->tp_bases;
1906     assert(PyTuple_Check(bases));
1907     n = PyTuple_GET_SIZE(bases);
1908     for (i = 0; i < n; i++) {
1909         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1910         if (base->tp_mro == NULL) {
1911             PyErr_Format(PyExc_TypeError,
1912                          "Cannot extend an incomplete type '%.100s'",
1913                          base->tp_name);
1914             return NULL;
1915         }
1916         assert(PyTuple_Check(base->tp_mro));
1917     }
1918 
1919     if (n == 1) {
1920         /* Fast path: if there is a single base, constructing the MRO
1921          * is trivial.
1922          */
1923         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, 0);
1924         Py_ssize_t k = PyTuple_GET_SIZE(base->tp_mro);
1925         result = PyTuple_New(k + 1);
1926         if (result == NULL) {
1927             return NULL;
1928         }
1929         Py_INCREF(type);
1930         PyTuple_SET_ITEM(result, 0, (PyObject *) type);
1931         for (i = 0; i < k; i++) {
1932             PyObject *cls = PyTuple_GET_ITEM(base->tp_mro, i);
1933             Py_INCREF(cls);
1934             PyTuple_SET_ITEM(result, i + 1, cls);
1935         }
1936         return result;
1937     }
1938 
1939     /* This is just a basic sanity check. */
1940     if (check_duplicates(bases) < 0) {
1941         return NULL;
1942     }
1943 
1944     /* Find a superclass linearization that honors the constraints
1945        of the explicit tuples of bases and the constraints implied by
1946        each base class.
1947 
1948        to_merge is an array of tuples, where each tuple is a superclass
1949        linearization implied by a base class.  The last element of
1950        to_merge is the declared tuple of bases.
1951     */
1952 
1953     to_merge = PyMem_New(PyObject *, n + 1);
1954     if (to_merge == NULL) {
1955         PyErr_NoMemory();
1956         return NULL;
1957     }
1958 
1959     for (i = 0; i < n; i++) {
1960         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1961         to_merge[i] = base->tp_mro;
1962     }
1963     to_merge[n] = bases;
1964 
1965     result = PyList_New(1);
1966     if (result == NULL) {
1967         PyMem_Free(to_merge);
1968         return NULL;
1969     }
1970 
1971     Py_INCREF(type);
1972     PyList_SET_ITEM(result, 0, (PyObject *)type);
1973     if (pmerge(result, to_merge, n + 1) < 0) {
1974         Py_CLEAR(result);
1975     }
1976 
1977     PyMem_Free(to_merge);
1978     return result;
1979 }
1980 
1981 /*[clinic input]
1982 type.mro
1983 
1984 Return a type's method resolution order.
1985 [clinic start generated code]*/
1986 
1987 static PyObject *
type_mro_impl(PyTypeObject * self)1988 type_mro_impl(PyTypeObject *self)
1989 /*[clinic end generated code: output=bffc4a39b5b57027 input=28414f4e156db28d]*/
1990 {
1991     PyObject *seq;
1992     seq = mro_implementation(self);
1993     if (seq != NULL && !PyList_Check(seq)) {
1994         Py_SETREF(seq, PySequence_List(seq));
1995     }
1996     return seq;
1997 }
1998 
1999 static int
mro_check(PyTypeObject * type,PyObject * mro)2000 mro_check(PyTypeObject *type, PyObject *mro)
2001 {
2002     PyTypeObject *solid;
2003     Py_ssize_t i, n;
2004 
2005     solid = solid_base(type);
2006 
2007     n = PyTuple_GET_SIZE(mro);
2008     for (i = 0; i < n; i++) {
2009         PyTypeObject *base;
2010         PyObject *tmp;
2011 
2012         tmp = PyTuple_GET_ITEM(mro, i);
2013         if (!PyType_Check(tmp)) {
2014             PyErr_Format(
2015                 PyExc_TypeError,
2016                 "mro() returned a non-class ('%.500s')",
2017                 Py_TYPE(tmp)->tp_name);
2018             return -1;
2019         }
2020 
2021         base = (PyTypeObject*)tmp;
2022         if (!PyType_IsSubtype(solid, solid_base(base))) {
2023             PyErr_Format(
2024                 PyExc_TypeError,
2025                 "mro() returned base with unsuitable layout ('%.500s')",
2026                 base->tp_name);
2027             return -1;
2028         }
2029     }
2030 
2031     return 0;
2032 }
2033 
2034 /* Lookups an mcls.mro method, invokes it and checks the result (if needed,
2035    in case of a custom mro() implementation).
2036 
2037    Keep in mind that during execution of this function type->tp_mro
2038    can be replaced due to possible reentrance (for example,
2039    through type_set_bases):
2040 
2041       - when looking up the mcls.mro attribute (it could be
2042         a user-provided descriptor);
2043 
2044       - from inside a custom mro() itself;
2045 
2046       - through a finalizer of the return value of mro().
2047 */
2048 static PyObject *
mro_invoke(PyTypeObject * type)2049 mro_invoke(PyTypeObject *type)
2050 {
2051     PyObject *mro_result;
2052     PyObject *new_mro;
2053     const int custom = !Py_IS_TYPE(type, &PyType_Type);
2054 
2055     if (custom) {
2056         int unbound;
2057         PyObject *mro_meth = lookup_method((PyObject *)type, &PyId_mro,
2058                                            &unbound);
2059         if (mro_meth == NULL)
2060             return NULL;
2061         mro_result = call_unbound_noarg(unbound, mro_meth, (PyObject *)type);
2062         Py_DECREF(mro_meth);
2063     }
2064     else {
2065         mro_result = mro_implementation(type);
2066     }
2067     if (mro_result == NULL)
2068         return NULL;
2069 
2070     new_mro = PySequence_Tuple(mro_result);
2071     Py_DECREF(mro_result);
2072     if (new_mro == NULL) {
2073         return NULL;
2074     }
2075 
2076     if (PyTuple_GET_SIZE(new_mro) == 0) {
2077         Py_DECREF(new_mro);
2078         PyErr_Format(PyExc_TypeError, "type MRO must not be empty");
2079         return NULL;
2080     }
2081 
2082     if (custom && mro_check(type, new_mro) < 0) {
2083         Py_DECREF(new_mro);
2084         return NULL;
2085     }
2086     return new_mro;
2087 }
2088 
2089 /* Calculates and assigns a new MRO to type->tp_mro.
2090    Return values and invariants:
2091 
2092      - Returns 1 if a new MRO value has been set to type->tp_mro due to
2093        this call of mro_internal (no tricky reentrancy and no errors).
2094 
2095        In case if p_old_mro argument is not NULL, a previous value
2096        of type->tp_mro is put there, and the ownership of this
2097        reference is transferred to a caller.
2098        Otherwise, the previous value (if any) is decref'ed.
2099 
2100      - Returns 0 in case when type->tp_mro gets changed because of
2101        reentering here through a custom mro() (see a comment to mro_invoke).
2102 
2103        In this case, a refcount of an old type->tp_mro is adjusted
2104        somewhere deeper in the call stack (by the innermost mro_internal
2105        or its caller) and may become zero upon returning from here.
2106        This also implies that the whole hierarchy of subclasses of the type
2107        has seen the new value and updated their MRO accordingly.
2108 
2109      - Returns -1 in case of an error.
2110 */
2111 static int
mro_internal(PyTypeObject * type,PyObject ** p_old_mro)2112 mro_internal(PyTypeObject *type, PyObject **p_old_mro)
2113 {
2114     PyObject *new_mro, *old_mro;
2115     int reent;
2116 
2117     /* Keep a reference to be able to do a reentrancy check below.
2118        Don't let old_mro be GC'ed and its address be reused for
2119        another object, like (suddenly!) a new tp_mro.  */
2120     old_mro = type->tp_mro;
2121     Py_XINCREF(old_mro);
2122     new_mro = mro_invoke(type);  /* might cause reentrance */
2123     reent = (type->tp_mro != old_mro);
2124     Py_XDECREF(old_mro);
2125     if (new_mro == NULL) {
2126         return -1;
2127     }
2128 
2129     if (reent) {
2130         Py_DECREF(new_mro);
2131         return 0;
2132     }
2133 
2134     type->tp_mro = new_mro;
2135 
2136     type_mro_modified(type, type->tp_mro);
2137     /* corner case: the super class might have been hidden
2138        from the custom MRO */
2139     type_mro_modified(type, type->tp_bases);
2140 
2141     PyType_Modified(type);
2142 
2143     if (p_old_mro != NULL)
2144         *p_old_mro = old_mro;  /* transfer the ownership */
2145     else
2146         Py_XDECREF(old_mro);
2147 
2148     return 1;
2149 }
2150 
2151 
2152 /* Calculate the best base amongst multiple base classes.
2153    This is the first one that's on the path to the "solid base". */
2154 
2155 static PyTypeObject *
best_base(PyObject * bases)2156 best_base(PyObject *bases)
2157 {
2158     Py_ssize_t i, n;
2159     PyTypeObject *base, *winner, *candidate, *base_i;
2160     PyObject *base_proto;
2161 
2162     assert(PyTuple_Check(bases));
2163     n = PyTuple_GET_SIZE(bases);
2164     assert(n > 0);
2165     base = NULL;
2166     winner = NULL;
2167     for (i = 0; i < n; i++) {
2168         base_proto = PyTuple_GET_ITEM(bases, i);
2169         if (!PyType_Check(base_proto)) {
2170             PyErr_SetString(
2171                 PyExc_TypeError,
2172                 "bases must be types");
2173             return NULL;
2174         }
2175         base_i = (PyTypeObject *)base_proto;
2176         if (!_PyType_IsReady(base_i)) {
2177             if (PyType_Ready(base_i) < 0)
2178                 return NULL;
2179         }
2180         if (!_PyType_HasFeature(base_i, Py_TPFLAGS_BASETYPE)) {
2181             PyErr_Format(PyExc_TypeError,
2182                          "type '%.100s' is not an acceptable base type",
2183                          base_i->tp_name);
2184             return NULL;
2185         }
2186         candidate = solid_base(base_i);
2187         if (winner == NULL) {
2188             winner = candidate;
2189             base = base_i;
2190         }
2191         else if (PyType_IsSubtype(winner, candidate))
2192             ;
2193         else if (PyType_IsSubtype(candidate, winner)) {
2194             winner = candidate;
2195             base = base_i;
2196         }
2197         else {
2198             PyErr_SetString(
2199                 PyExc_TypeError,
2200                 "multiple bases have "
2201                 "instance lay-out conflict");
2202             return NULL;
2203         }
2204     }
2205     assert (base != NULL);
2206 
2207     return base;
2208 }
2209 
2210 static int
extra_ivars(PyTypeObject * type,PyTypeObject * base)2211 extra_ivars(PyTypeObject *type, PyTypeObject *base)
2212 {
2213     size_t t_size = type->tp_basicsize;
2214     size_t b_size = base->tp_basicsize;
2215 
2216     assert(t_size >= b_size); /* Else type smaller than base! */
2217     if (type->tp_itemsize || base->tp_itemsize) {
2218         /* If itemsize is involved, stricter rules */
2219         return t_size != b_size ||
2220             type->tp_itemsize != base->tp_itemsize;
2221     }
2222     if (type->tp_weaklistoffset && base->tp_weaklistoffset == 0 &&
2223         type->tp_weaklistoffset + sizeof(PyObject *) == t_size &&
2224         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2225         t_size -= sizeof(PyObject *);
2226     if (type->tp_dictoffset && base->tp_dictoffset == 0 &&
2227         type->tp_dictoffset + sizeof(PyObject *) == t_size &&
2228         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2229         t_size -= sizeof(PyObject *);
2230 
2231     return t_size != b_size;
2232 }
2233 
2234 static PyTypeObject *
solid_base(PyTypeObject * type)2235 solid_base(PyTypeObject *type)
2236 {
2237     PyTypeObject *base;
2238 
2239     if (type->tp_base)
2240         base = solid_base(type->tp_base);
2241     else
2242         base = &PyBaseObject_Type;
2243     if (extra_ivars(type, base))
2244         return type;
2245     else
2246         return base;
2247 }
2248 
2249 static void object_dealloc(PyObject *);
2250 static int object_init(PyObject *, PyObject *, PyObject *);
2251 static int update_slot(PyTypeObject *, PyObject *);
2252 static void fixup_slot_dispatchers(PyTypeObject *);
2253 static int type_new_set_names(PyTypeObject *);
2254 static int type_new_init_subclass(PyTypeObject *, PyObject *);
2255 
2256 /*
2257  * Helpers for  __dict__ descriptor.  We don't want to expose the dicts
2258  * inherited from various builtin types.  The builtin base usually provides
2259  * its own __dict__ descriptor, so we use that when we can.
2260  */
2261 static PyTypeObject *
get_builtin_base_with_dict(PyTypeObject * type)2262 get_builtin_base_with_dict(PyTypeObject *type)
2263 {
2264     while (type->tp_base != NULL) {
2265         if (type->tp_dictoffset != 0 &&
2266             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
2267             return type;
2268         type = type->tp_base;
2269     }
2270     return NULL;
2271 }
2272 
2273 static PyObject *
get_dict_descriptor(PyTypeObject * type)2274 get_dict_descriptor(PyTypeObject *type)
2275 {
2276     PyObject *descr;
2277 
2278     descr = _PyType_LookupId(type, &PyId___dict__);
2279     if (descr == NULL || !PyDescr_IsData(descr))
2280         return NULL;
2281 
2282     return descr;
2283 }
2284 
2285 static void
raise_dict_descr_error(PyObject * obj)2286 raise_dict_descr_error(PyObject *obj)
2287 {
2288     PyErr_Format(PyExc_TypeError,
2289                  "this __dict__ descriptor does not support "
2290                  "'%.200s' objects", Py_TYPE(obj)->tp_name);
2291 }
2292 
2293 static PyObject *
subtype_dict(PyObject * obj,void * context)2294 subtype_dict(PyObject *obj, void *context)
2295 {
2296     PyTypeObject *base;
2297 
2298     base = get_builtin_base_with_dict(Py_TYPE(obj));
2299     if (base != NULL) {
2300         descrgetfunc func;
2301         PyObject *descr = get_dict_descriptor(base);
2302         if (descr == NULL) {
2303             raise_dict_descr_error(obj);
2304             return NULL;
2305         }
2306         func = Py_TYPE(descr)->tp_descr_get;
2307         if (func == NULL) {
2308             raise_dict_descr_error(obj);
2309             return NULL;
2310         }
2311         return func(descr, obj, (PyObject *)(Py_TYPE(obj)));
2312     }
2313     return PyObject_GenericGetDict(obj, context);
2314 }
2315 
2316 static int
subtype_setdict(PyObject * obj,PyObject * value,void * context)2317 subtype_setdict(PyObject *obj, PyObject *value, void *context)
2318 {
2319     PyObject **dictptr;
2320     PyTypeObject *base;
2321 
2322     base = get_builtin_base_with_dict(Py_TYPE(obj));
2323     if (base != NULL) {
2324         descrsetfunc func;
2325         PyObject *descr = get_dict_descriptor(base);
2326         if (descr == NULL) {
2327             raise_dict_descr_error(obj);
2328             return -1;
2329         }
2330         func = Py_TYPE(descr)->tp_descr_set;
2331         if (func == NULL) {
2332             raise_dict_descr_error(obj);
2333             return -1;
2334         }
2335         return func(descr, obj, value);
2336     }
2337     /* Almost like PyObject_GenericSetDict, but allow __dict__ to be deleted. */
2338     dictptr = _PyObject_GetDictPtr(obj);
2339     if (dictptr == NULL) {
2340         PyErr_SetString(PyExc_AttributeError,
2341                         "This object has no __dict__");
2342         return -1;
2343     }
2344     if (value != NULL && !PyDict_Check(value)) {
2345         PyErr_Format(PyExc_TypeError,
2346                      "__dict__ must be set to a dictionary, "
2347                      "not a '%.200s'", Py_TYPE(value)->tp_name);
2348         return -1;
2349     }
2350     Py_XINCREF(value);
2351     Py_XSETREF(*dictptr, value);
2352     return 0;
2353 }
2354 
2355 static PyObject *
subtype_getweakref(PyObject * obj,void * context)2356 subtype_getweakref(PyObject *obj, void *context)
2357 {
2358     PyObject **weaklistptr;
2359     PyObject *result;
2360     PyTypeObject *type = Py_TYPE(obj);
2361 
2362     if (type->tp_weaklistoffset == 0) {
2363         PyErr_SetString(PyExc_AttributeError,
2364                         "This object has no __weakref__");
2365         return NULL;
2366     }
2367     _PyObject_ASSERT((PyObject *)type,
2368                      type->tp_weaklistoffset > 0);
2369     _PyObject_ASSERT((PyObject *)type,
2370                      ((type->tp_weaklistoffset + sizeof(PyObject *))
2371                       <= (size_t)(type->tp_basicsize)));
2372     weaklistptr = (PyObject **)((char *)obj + type->tp_weaklistoffset);
2373     if (*weaklistptr == NULL)
2374         result = Py_None;
2375     else
2376         result = *weaklistptr;
2377     Py_INCREF(result);
2378     return result;
2379 }
2380 
2381 /* Three variants on the subtype_getsets list. */
2382 
2383 static PyGetSetDef subtype_getsets_full[] = {
2384     {"__dict__", subtype_dict, subtype_setdict,
2385      PyDoc_STR("dictionary for instance variables (if defined)")},
2386     {"__weakref__", subtype_getweakref, NULL,
2387      PyDoc_STR("list of weak references to the object (if defined)")},
2388     {0}
2389 };
2390 
2391 static PyGetSetDef subtype_getsets_dict_only[] = {
2392     {"__dict__", subtype_dict, subtype_setdict,
2393      PyDoc_STR("dictionary for instance variables (if defined)")},
2394     {0}
2395 };
2396 
2397 static PyGetSetDef subtype_getsets_weakref_only[] = {
2398     {"__weakref__", subtype_getweakref, NULL,
2399      PyDoc_STR("list of weak references to the object (if defined)")},
2400     {0}
2401 };
2402 
2403 static int
valid_identifier(PyObject * s)2404 valid_identifier(PyObject *s)
2405 {
2406     if (!PyUnicode_Check(s)) {
2407         PyErr_Format(PyExc_TypeError,
2408                      "__slots__ items must be strings, not '%.200s'",
2409                      Py_TYPE(s)->tp_name);
2410         return 0;
2411     }
2412     if (!PyUnicode_IsIdentifier(s)) {
2413         PyErr_SetString(PyExc_TypeError,
2414                         "__slots__ must be identifiers");
2415         return 0;
2416     }
2417     return 1;
2418 }
2419 
2420 /* Forward */
2421 static int
2422 object_init(PyObject *self, PyObject *args, PyObject *kwds);
2423 
2424 static int
type_init(PyObject * cls,PyObject * args,PyObject * kwds)2425 type_init(PyObject *cls, PyObject *args, PyObject *kwds)
2426 {
2427     int res;
2428 
2429     assert(args != NULL && PyTuple_Check(args));
2430     assert(kwds == NULL || PyDict_Check(kwds));
2431 
2432     if (kwds != NULL && PyTuple_Check(args) && PyTuple_GET_SIZE(args) == 1 &&
2433         PyDict_Check(kwds) && PyDict_GET_SIZE(kwds) != 0) {
2434         PyErr_SetString(PyExc_TypeError,
2435                         "type.__init__() takes no keyword arguments");
2436         return -1;
2437     }
2438 
2439     if (args != NULL && PyTuple_Check(args) &&
2440         (PyTuple_GET_SIZE(args) != 1 && PyTuple_GET_SIZE(args) != 3)) {
2441         PyErr_SetString(PyExc_TypeError,
2442                         "type.__init__() takes 1 or 3 arguments");
2443         return -1;
2444     }
2445 
2446     /* Call object.__init__(self) now. */
2447     /* XXX Could call super(type, cls).__init__() but what's the point? */
2448     args = PyTuple_GetSlice(args, 0, 0);
2449     if (args == NULL) {
2450         return -1;
2451     }
2452     res = object_init(cls, args, NULL);
2453     Py_DECREF(args);
2454     return res;
2455 }
2456 
2457 unsigned long
PyType_GetFlags(PyTypeObject * type)2458 PyType_GetFlags(PyTypeObject *type)
2459 {
2460     return type->tp_flags;
2461 }
2462 
2463 /* Determine the most derived metatype. */
2464 PyTypeObject *
_PyType_CalculateMetaclass(PyTypeObject * metatype,PyObject * bases)2465 _PyType_CalculateMetaclass(PyTypeObject *metatype, PyObject *bases)
2466 {
2467     Py_ssize_t i, nbases;
2468     PyTypeObject *winner;
2469     PyObject *tmp;
2470     PyTypeObject *tmptype;
2471 
2472     /* Determine the proper metatype to deal with this,
2473        and check for metatype conflicts while we're at it.
2474        Note that if some other metatype wins to contract,
2475        it's possible that its instances are not types. */
2476 
2477     nbases = PyTuple_GET_SIZE(bases);
2478     winner = metatype;
2479     for (i = 0; i < nbases; i++) {
2480         tmp = PyTuple_GET_ITEM(bases, i);
2481         tmptype = Py_TYPE(tmp);
2482         if (PyType_IsSubtype(winner, tmptype))
2483             continue;
2484         if (PyType_IsSubtype(tmptype, winner)) {
2485             winner = tmptype;
2486             continue;
2487         }
2488         /* else: */
2489         PyErr_SetString(PyExc_TypeError,
2490                         "metaclass conflict: "
2491                         "the metaclass of a derived class "
2492                         "must be a (non-strict) subclass "
2493                         "of the metaclasses of all its bases");
2494         return NULL;
2495     }
2496     return winner;
2497 }
2498 
2499 
2500 // Forward declaration
2501 static PyObject *
2502 type_new(PyTypeObject *metatype, PyObject *args, PyObject *kwds);
2503 
2504 typedef struct {
2505     PyTypeObject *metatype;
2506     PyObject *args;
2507     PyObject *kwds;
2508     PyObject *orig_dict;
2509     PyObject *name;
2510     PyObject *bases;
2511     PyTypeObject *base;
2512     PyObject *slots;
2513     Py_ssize_t nslot;
2514     int add_dict;
2515     int add_weak;
2516     int may_add_dict;
2517     int may_add_weak;
2518 } type_new_ctx;
2519 
2520 
2521 /* Check for valid slot names and two special cases */
2522 static int
type_new_visit_slots(type_new_ctx * ctx)2523 type_new_visit_slots(type_new_ctx *ctx)
2524 {
2525     PyObject *slots = ctx->slots;
2526     Py_ssize_t nslot = ctx->nslot;
2527     for (Py_ssize_t i = 0; i < nslot; i++) {
2528         PyObject *name = PyTuple_GET_ITEM(slots, i);
2529         if (!valid_identifier(name)) {
2530             return -1;
2531         }
2532         assert(PyUnicode_Check(name));
2533         if (_PyUnicode_EqualToASCIIId(name, &PyId___dict__)) {
2534             if (!ctx->may_add_dict || ctx->add_dict != 0) {
2535                 PyErr_SetString(PyExc_TypeError,
2536                     "__dict__ slot disallowed: "
2537                     "we already got one");
2538                 return -1;
2539             }
2540             ctx->add_dict++;
2541         }
2542         if (_PyUnicode_EqualToASCIIId(name, &PyId___weakref__)) {
2543             if (!ctx->may_add_weak || ctx->add_weak != 0) {
2544                 PyErr_SetString(PyExc_TypeError,
2545                     "__weakref__ slot disallowed: "
2546                     "either we already got one, "
2547                     "or __itemsize__ != 0");
2548                 return -1;
2549             }
2550             ctx->add_weak++;
2551         }
2552     }
2553     return 0;
2554 }
2555 
2556 
2557 /* Copy slots into a list, mangle names and sort them.
2558    Sorted names are needed for __class__ assignment.
2559    Convert them back to tuple at the end.
2560 */
2561 static PyObject*
type_new_copy_slots(type_new_ctx * ctx,PyObject * dict)2562 type_new_copy_slots(type_new_ctx *ctx, PyObject *dict)
2563 {
2564     PyObject *slots = ctx->slots;
2565     Py_ssize_t nslot = ctx->nslot;
2566 
2567     Py_ssize_t new_nslot = nslot - ctx->add_dict - ctx->add_weak;
2568     PyObject *new_slots = PyList_New(new_nslot);
2569     if (new_slots == NULL) {
2570         return NULL;
2571     }
2572 
2573     Py_ssize_t j = 0;
2574     for (Py_ssize_t i = 0; i < nslot; i++) {
2575         PyObject *slot = PyTuple_GET_ITEM(slots, i);
2576         if ((ctx->add_dict &&
2577              _PyUnicode_EqualToASCIIId(slot, &PyId___dict__)) ||
2578             (ctx->add_weak &&
2579              _PyUnicode_EqualToASCIIString(slot, "__weakref__")))
2580         {
2581             continue;
2582         }
2583 
2584         slot =_Py_Mangle(ctx->name, slot);
2585         if (!slot) {
2586             goto error;
2587         }
2588         PyList_SET_ITEM(new_slots, j, slot);
2589 
2590         int r = PyDict_Contains(dict, slot);
2591         if (r < 0) {
2592             goto error;
2593         }
2594         if (r > 0) {
2595             /* CPython inserts __qualname__ and __classcell__ (when needed)
2596                into the namespace when creating a class.  They will be deleted
2597                below so won't act as class variables. */
2598             if (!_PyUnicode_EqualToASCIIId(slot, &PyId___qualname__) &&
2599                 !_PyUnicode_EqualToASCIIId(slot, &PyId___classcell__))
2600             {
2601                 PyErr_Format(PyExc_ValueError,
2602                              "%R in __slots__ conflicts with class variable",
2603                              slot);
2604                 goto error;
2605             }
2606         }
2607 
2608         j++;
2609     }
2610     assert(j == new_nslot);
2611 
2612     if (PyList_Sort(new_slots) == -1) {
2613         goto error;
2614     }
2615 
2616     PyObject *tuple = PyList_AsTuple(new_slots);
2617     Py_DECREF(new_slots);
2618     if (tuple == NULL) {
2619         return NULL;
2620     }
2621 
2622     assert(PyTuple_GET_SIZE(tuple) == new_nslot);
2623     return tuple;
2624 
2625 error:
2626     Py_DECREF(new_slots);
2627     return NULL;
2628 }
2629 
2630 
2631 static void
type_new_slots_bases(type_new_ctx * ctx)2632 type_new_slots_bases(type_new_ctx *ctx)
2633 {
2634     Py_ssize_t nbases = PyTuple_GET_SIZE(ctx->bases);
2635     if (nbases > 1 &&
2636         ((ctx->may_add_dict && ctx->add_dict == 0) ||
2637          (ctx->may_add_weak && ctx->add_weak == 0)))
2638     {
2639         for (Py_ssize_t i = 0; i < nbases; i++) {
2640             PyObject *base = PyTuple_GET_ITEM(ctx->bases, i);
2641             if (base == (PyObject *)ctx->base) {
2642                 /* Skip primary base */
2643                 continue;
2644             }
2645 
2646             assert(PyType_Check(base));
2647             PyTypeObject *type = (PyTypeObject *)base;
2648             if (ctx->may_add_dict && ctx->add_dict == 0 &&
2649                 type->tp_dictoffset != 0)
2650             {
2651                 ctx->add_dict++;
2652             }
2653             if (ctx->may_add_weak && ctx->add_weak == 0 &&
2654                 type->tp_weaklistoffset != 0)
2655             {
2656                 ctx->add_weak++;
2657             }
2658             if (ctx->may_add_dict && ctx->add_dict == 0) {
2659                 continue;
2660             }
2661             if (ctx->may_add_weak && ctx->add_weak == 0) {
2662                 continue;
2663             }
2664             /* Nothing more to check */
2665             break;
2666         }
2667     }
2668 }
2669 
2670 
2671 static int
type_new_slots_impl(type_new_ctx * ctx,PyObject * dict)2672 type_new_slots_impl(type_new_ctx *ctx, PyObject *dict)
2673 {
2674     /* Are slots allowed? */
2675     if (ctx->nslot > 0 && ctx->base->tp_itemsize != 0) {
2676         PyErr_Format(PyExc_TypeError,
2677                      "nonempty __slots__ not supported for subtype of '%s'",
2678                      ctx->base->tp_name);
2679         return -1;
2680     }
2681 
2682     if (type_new_visit_slots(ctx) < 0) {
2683         return -1;
2684     }
2685 
2686     PyObject *new_slots = type_new_copy_slots(ctx, dict);
2687     if (new_slots == NULL) {
2688         return -1;
2689     }
2690     assert(PyTuple_CheckExact(new_slots));
2691 
2692     Py_XSETREF(ctx->slots, new_slots);
2693     ctx->nslot = PyTuple_GET_SIZE(new_slots);
2694 
2695     /* Secondary bases may provide weakrefs or dict */
2696     type_new_slots_bases(ctx);
2697     return 0;
2698 }
2699 
2700 
2701 static Py_ssize_t
type_new_slots(type_new_ctx * ctx,PyObject * dict)2702 type_new_slots(type_new_ctx *ctx, PyObject *dict)
2703 {
2704     // Check for a __slots__ sequence variable in dict, and count it
2705     ctx->add_dict = 0;
2706     ctx->add_weak = 0;
2707     ctx->may_add_dict = (ctx->base->tp_dictoffset == 0);
2708     ctx->may_add_weak = (ctx->base->tp_weaklistoffset == 0
2709                          && ctx->base->tp_itemsize == 0);
2710 
2711     if (ctx->slots == NULL) {
2712         if (ctx->may_add_dict) {
2713             ctx->add_dict++;
2714         }
2715         if (ctx->may_add_weak) {
2716             ctx->add_weak++;
2717         }
2718     }
2719     else {
2720         /* Have slots */
2721         if (type_new_slots_impl(ctx, dict) < 0) {
2722             return -1;
2723         }
2724     }
2725     return 0;
2726 }
2727 
2728 
2729 static PyTypeObject*
type_new_alloc(type_new_ctx * ctx)2730 type_new_alloc(type_new_ctx *ctx)
2731 {
2732     PyTypeObject *metatype = ctx->metatype;
2733     PyTypeObject *type;
2734 
2735     // Allocate the type object
2736     type = (PyTypeObject *)metatype->tp_alloc(metatype, ctx->nslot);
2737     if (type == NULL) {
2738         return NULL;
2739     }
2740     PyHeapTypeObject *et = (PyHeapTypeObject *)type;
2741 
2742     // Initialize tp_flags.
2743     // All heap types need GC, since we can create a reference cycle by storing
2744     // an instance on one of its parents.
2745     type->tp_flags = (Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HEAPTYPE |
2746                       Py_TPFLAGS_BASETYPE | Py_TPFLAGS_HAVE_GC);
2747 
2748     // Initialize essential fields
2749     type->tp_as_async = &et->as_async;
2750     type->tp_as_number = &et->as_number;
2751     type->tp_as_sequence = &et->as_sequence;
2752     type->tp_as_mapping = &et->as_mapping;
2753     type->tp_as_buffer = &et->as_buffer;
2754 
2755     type->tp_bases = Py_NewRef(ctx->bases);
2756     type->tp_base = (PyTypeObject *)Py_NewRef(ctx->base);
2757 
2758     type->tp_dealloc = subtype_dealloc;
2759     /* Always override allocation strategy to use regular heap */
2760     type->tp_alloc = PyType_GenericAlloc;
2761     type->tp_free = PyObject_GC_Del;
2762 
2763     type->tp_traverse = subtype_traverse;
2764     type->tp_clear = subtype_clear;
2765 
2766     et->ht_name = Py_NewRef(ctx->name);
2767     et->ht_module = NULL;
2768 
2769     return type;
2770 }
2771 
2772 
2773 static int
type_new_set_name(const type_new_ctx * ctx,PyTypeObject * type)2774 type_new_set_name(const type_new_ctx *ctx, PyTypeObject *type)
2775 {
2776     Py_ssize_t name_size;
2777     type->tp_name = PyUnicode_AsUTF8AndSize(ctx->name, &name_size);
2778     if (!type->tp_name) {
2779         return -1;
2780     }
2781     if (strlen(type->tp_name) != (size_t)name_size) {
2782         PyErr_SetString(PyExc_ValueError,
2783                         "type name must not contain null characters");
2784         return -1;
2785     }
2786     return 0;
2787 }
2788 
2789 
2790 /* Set __module__ in the dict */
2791 static int
type_new_set_module(PyTypeObject * type)2792 type_new_set_module(PyTypeObject *type)
2793 {
2794     int r = _PyDict_ContainsId(type->tp_dict, &PyId___module__);
2795     if (r < 0) {
2796         return -1;
2797     }
2798     if (r > 0) {
2799         return 0;
2800     }
2801 
2802     PyObject *globals = PyEval_GetGlobals();
2803     if (globals == NULL) {
2804         return 0;
2805     }
2806 
2807     PyObject *module = _PyDict_GetItemIdWithError(globals, &PyId___name__);
2808     if (module == NULL) {
2809         if (PyErr_Occurred()) {
2810             return -1;
2811         }
2812         return 0;
2813     }
2814 
2815     if (_PyDict_SetItemId(type->tp_dict, &PyId___module__, module) < 0) {
2816         return -1;
2817     }
2818     return 0;
2819 }
2820 
2821 
2822 /* Set ht_qualname to dict['__qualname__'] if available, else to
2823    __name__.  The __qualname__ accessor will look for ht_qualname. */
2824 static int
type_new_set_ht_name(PyTypeObject * type)2825 type_new_set_ht_name(PyTypeObject *type)
2826 {
2827     PyHeapTypeObject *et = (PyHeapTypeObject *)type;
2828     PyObject *qualname = _PyDict_GetItemIdWithError(type->tp_dict,
2829                                                     &PyId___qualname__);
2830     if (qualname != NULL) {
2831         if (!PyUnicode_Check(qualname)) {
2832             PyErr_Format(PyExc_TypeError,
2833                     "type __qualname__ must be a str, not %s",
2834                     Py_TYPE(qualname)->tp_name);
2835             return -1;
2836         }
2837         et->ht_qualname = Py_NewRef(qualname);
2838         if (_PyDict_DelItemId(type->tp_dict, &PyId___qualname__) < 0) {
2839             return -1;
2840         }
2841     }
2842     else {
2843         if (PyErr_Occurred()) {
2844             return -1;
2845         }
2846         et->ht_qualname = Py_NewRef(et->ht_name);
2847     }
2848     return 0;
2849 }
2850 
2851 
2852 /* Set tp_doc to a copy of dict['__doc__'], if the latter is there
2853    and is a string.  The __doc__ accessor will first look for tp_doc;
2854    if that fails, it will still look into __dict__. */
2855 static int
type_new_set_doc(PyTypeObject * type)2856 type_new_set_doc(PyTypeObject *type)
2857 {
2858     PyObject *doc = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___doc__);
2859     if (doc == NULL) {
2860         if (PyErr_Occurred()) {
2861             return -1;
2862         }
2863         // no __doc__ key
2864         return 0;
2865     }
2866     if (!PyUnicode_Check(doc)) {
2867         // ignore non-string __doc__
2868         return 0;
2869     }
2870 
2871     const char *doc_str = PyUnicode_AsUTF8(doc);
2872     if (doc_str == NULL) {
2873         return -1;
2874     }
2875 
2876     // Silently truncate the docstring if it contains a null byte
2877     Py_ssize_t size = strlen(doc_str) + 1;
2878     char *tp_doc = (char *)PyObject_Malloc(size);
2879     if (tp_doc == NULL) {
2880         PyErr_NoMemory();
2881         return -1;
2882     }
2883 
2884     memcpy(tp_doc, doc_str, size);
2885     type->tp_doc = tp_doc;
2886     return 0;
2887 }
2888 
2889 
2890 static int
type_new_staticmethod(PyTypeObject * type,_Py_Identifier * attr_id)2891 type_new_staticmethod(PyTypeObject *type, _Py_Identifier *attr_id)
2892 {
2893     PyObject *func = _PyDict_GetItemIdWithError(type->tp_dict, attr_id);
2894     if (func == NULL) {
2895         if (PyErr_Occurred()) {
2896             return -1;
2897         }
2898         return 0;
2899     }
2900     if (!PyFunction_Check(func)) {
2901         return 0;
2902     }
2903 
2904     PyObject *static_func = PyStaticMethod_New(func);
2905     if (static_func == NULL) {
2906         return -1;
2907     }
2908     if (_PyDict_SetItemId(type->tp_dict, attr_id, static_func) < 0) {
2909         Py_DECREF(static_func);
2910         return -1;
2911     }
2912     Py_DECREF(static_func);
2913     return 0;
2914 }
2915 
2916 
2917 static int
type_new_classmethod(PyTypeObject * type,_Py_Identifier * attr_id)2918 type_new_classmethod(PyTypeObject *type, _Py_Identifier *attr_id)
2919 {
2920     PyObject *func = _PyDict_GetItemIdWithError(type->tp_dict, attr_id);
2921     if (func == NULL) {
2922         if (PyErr_Occurred()) {
2923             return -1;
2924         }
2925         return 0;
2926     }
2927     if (!PyFunction_Check(func)) {
2928         return 0;
2929     }
2930 
2931     PyObject *method = PyClassMethod_New(func);
2932     if (method == NULL) {
2933         return -1;
2934     }
2935 
2936     if (_PyDict_SetItemId(type->tp_dict, attr_id, method) < 0) {
2937         Py_DECREF(method);
2938         return -1;
2939     }
2940     Py_DECREF(method);
2941     return 0;
2942 }
2943 
2944 
2945 /* Add descriptors for custom slots from __slots__, or for __dict__ */
2946 static int
type_new_descriptors(const type_new_ctx * ctx,PyTypeObject * type)2947 type_new_descriptors(const type_new_ctx *ctx, PyTypeObject *type)
2948 {
2949     PyHeapTypeObject *et = (PyHeapTypeObject *)type;
2950     Py_ssize_t slotoffset = ctx->base->tp_basicsize;
2951     if (et->ht_slots != NULL) {
2952         PyMemberDef *mp = PyHeapType_GET_MEMBERS(et);
2953         Py_ssize_t nslot = PyTuple_GET_SIZE(et->ht_slots);
2954         for (Py_ssize_t i = 0; i < nslot; i++, mp++) {
2955             mp->name = PyUnicode_AsUTF8(
2956                 PyTuple_GET_ITEM(et->ht_slots, i));
2957             if (mp->name == NULL) {
2958                 return -1;
2959             }
2960             mp->type = T_OBJECT_EX;
2961             mp->offset = slotoffset;
2962 
2963             /* __dict__ and __weakref__ are already filtered out */
2964             assert(strcmp(mp->name, "__dict__") != 0);
2965             assert(strcmp(mp->name, "__weakref__") != 0);
2966 
2967             slotoffset += sizeof(PyObject *);
2968         }
2969     }
2970 
2971     if (ctx->add_dict) {
2972         if (ctx->base->tp_itemsize) {
2973             type->tp_dictoffset = -(long)sizeof(PyObject *);
2974         }
2975         else {
2976             type->tp_dictoffset = slotoffset;
2977         }
2978         slotoffset += sizeof(PyObject *);
2979     }
2980 
2981     if (ctx->add_weak) {
2982         assert(!ctx->base->tp_itemsize);
2983         type->tp_weaklistoffset = slotoffset;
2984         slotoffset += sizeof(PyObject *);
2985     }
2986 
2987     type->tp_basicsize = slotoffset;
2988     type->tp_itemsize = ctx->base->tp_itemsize;
2989     type->tp_members = PyHeapType_GET_MEMBERS(et);
2990     return 0;
2991 }
2992 
2993 
2994 static void
type_new_set_slots(const type_new_ctx * ctx,PyTypeObject * type)2995 type_new_set_slots(const type_new_ctx *ctx, PyTypeObject *type)
2996 {
2997     if (type->tp_weaklistoffset && type->tp_dictoffset) {
2998         type->tp_getset = subtype_getsets_full;
2999     }
3000     else if (type->tp_weaklistoffset && !type->tp_dictoffset) {
3001         type->tp_getset = subtype_getsets_weakref_only;
3002     }
3003     else if (!type->tp_weaklistoffset && type->tp_dictoffset) {
3004         type->tp_getset = subtype_getsets_dict_only;
3005     }
3006     else {
3007         type->tp_getset = NULL;
3008     }
3009 
3010     /* Special case some slots */
3011     if (type->tp_dictoffset != 0 || ctx->nslot > 0) {
3012         PyTypeObject *base = ctx->base;
3013         if (base->tp_getattr == NULL && base->tp_getattro == NULL) {
3014             type->tp_getattro = PyObject_GenericGetAttr;
3015         }
3016         if (base->tp_setattr == NULL && base->tp_setattro == NULL) {
3017             type->tp_setattro = PyObject_GenericSetAttr;
3018         }
3019     }
3020 }
3021 
3022 
3023 /* store type in class' cell if one is supplied */
3024 static int
type_new_set_classcell(PyTypeObject * type)3025 type_new_set_classcell(PyTypeObject *type)
3026 {
3027     PyObject *cell = _PyDict_GetItemIdWithError(type->tp_dict,
3028                                                 &PyId___classcell__);
3029     if (cell == NULL) {
3030         if (PyErr_Occurred()) {
3031             return -1;
3032         }
3033         return 0;
3034     }
3035 
3036     /* At least one method requires a reference to its defining class */
3037     if (!PyCell_Check(cell)) {
3038         PyErr_Format(PyExc_TypeError,
3039                      "__classcell__ must be a nonlocal cell, not %.200R",
3040                      Py_TYPE(cell));
3041         return -1;
3042     }
3043 
3044     (void)PyCell_Set(cell, (PyObject *) type);
3045     if (_PyDict_DelItemId(type->tp_dict, &PyId___classcell__) < 0) {
3046         return -1;
3047     }
3048     return 0;
3049 }
3050 
3051 
3052 static int
type_new_set_attrs(const type_new_ctx * ctx,PyTypeObject * type)3053 type_new_set_attrs(const type_new_ctx *ctx, PyTypeObject *type)
3054 {
3055     if (type_new_set_name(ctx, type) < 0) {
3056         return -1;
3057     }
3058 
3059     if (type_new_set_module(type) < 0) {
3060         return -1;
3061     }
3062 
3063     if (type_new_set_ht_name(type) < 0) {
3064         return -1;
3065     }
3066 
3067     if (type_new_set_doc(type) < 0) {
3068         return -1;
3069     }
3070 
3071     /* Special-case __new__: if it's a plain function,
3072        make it a static function */
3073     if (type_new_staticmethod(type, &PyId___new__) < 0) {
3074         return -1;
3075     }
3076 
3077     /* Special-case __init_subclass__ and __class_getitem__:
3078        if they are plain functions, make them classmethods */
3079     if (type_new_classmethod(type, &PyId___init_subclass__) < 0) {
3080         return -1;
3081     }
3082     if (type_new_classmethod(type, &PyId___class_getitem__) < 0) {
3083         return -1;
3084     }
3085 
3086     if (type_new_descriptors(ctx, type) < 0) {
3087         return -1;
3088     }
3089 
3090     type_new_set_slots(ctx, type);
3091 
3092     if (type_new_set_classcell(type) < 0) {
3093         return -1;
3094     }
3095     return 0;
3096 }
3097 
3098 
3099 static int
type_new_get_slots(type_new_ctx * ctx,PyObject * dict)3100 type_new_get_slots(type_new_ctx *ctx, PyObject *dict)
3101 {
3102     _Py_IDENTIFIER(__slots__);
3103     PyObject *slots = _PyDict_GetItemIdWithError(dict, &PyId___slots__);
3104     if (slots == NULL) {
3105         if (PyErr_Occurred()) {
3106             return -1;
3107         }
3108         ctx->slots = NULL;
3109         ctx->nslot = 0;
3110         return 0;
3111     }
3112 
3113     // Make it into a tuple
3114     PyObject *new_slots;
3115     if (PyUnicode_Check(slots)) {
3116         new_slots = PyTuple_Pack(1, slots);
3117     }
3118     else {
3119         new_slots = PySequence_Tuple(slots);
3120     }
3121     if (new_slots == NULL) {
3122         return -1;
3123     }
3124     assert(PyTuple_CheckExact(new_slots));
3125     ctx->slots = new_slots;
3126     ctx->nslot = PyTuple_GET_SIZE(new_slots);
3127     return 0;
3128 }
3129 
3130 
3131 static PyTypeObject*
type_new_init(type_new_ctx * ctx)3132 type_new_init(type_new_ctx *ctx)
3133 {
3134     PyObject *dict = PyDict_Copy(ctx->orig_dict);
3135     if (dict == NULL) {
3136         goto error;
3137     }
3138 
3139     if (type_new_get_slots(ctx, dict) < 0) {
3140         goto error;
3141     }
3142     assert(!PyErr_Occurred());
3143 
3144     if (type_new_slots(ctx, dict) < 0) {
3145         goto error;
3146     }
3147 
3148     PyTypeObject *type = type_new_alloc(ctx);
3149     if (type == NULL) {
3150         goto error;
3151     }
3152 
3153     type->tp_dict = dict;
3154 
3155     PyHeapTypeObject *et = (PyHeapTypeObject*)type;
3156     et->ht_slots = ctx->slots;
3157     ctx->slots = NULL;
3158 
3159     return type;
3160 
3161 error:
3162     Py_CLEAR(ctx->slots);
3163     Py_XDECREF(dict);
3164     return NULL;
3165 }
3166 
3167 
3168 static PyObject*
type_new_impl(type_new_ctx * ctx)3169 type_new_impl(type_new_ctx *ctx)
3170 {
3171     PyTypeObject *type = type_new_init(ctx);
3172     if (type == NULL) {
3173         return NULL;
3174     }
3175 
3176     if (type_new_set_attrs(ctx, type) < 0) {
3177         goto error;
3178     }
3179 
3180     /* Initialize the rest */
3181     if (PyType_Ready(type) < 0) {
3182         goto error;
3183     }
3184 
3185     // Put the proper slots in place
3186     fixup_slot_dispatchers(type);
3187 
3188     if (type->tp_dictoffset) {
3189         PyHeapTypeObject *et = (PyHeapTypeObject*)type;
3190         et->ht_cached_keys = _PyDict_NewKeysForClass();
3191     }
3192 
3193     if (type_new_set_names(type) < 0) {
3194         goto error;
3195     }
3196 
3197     if (type_new_init_subclass(type, ctx->kwds) < 0) {
3198         goto error;
3199     }
3200 
3201     assert(_PyType_CheckConsistency(type));
3202     return (PyObject *)type;
3203 
3204 error:
3205     Py_DECREF(type);
3206     return NULL;
3207 }
3208 
3209 
3210 static int
type_new_get_bases(type_new_ctx * ctx,PyObject ** type)3211 type_new_get_bases(type_new_ctx *ctx, PyObject **type)
3212 {
3213     Py_ssize_t nbases = PyTuple_GET_SIZE(ctx->bases);
3214     if (nbases == 0) {
3215         // Adjust for empty tuple bases
3216         ctx->base = &PyBaseObject_Type;
3217         PyObject *new_bases = PyTuple_Pack(1, ctx->base);
3218         if (new_bases == NULL) {
3219             return -1;
3220         }
3221         ctx->bases = new_bases;
3222         return 0;
3223     }
3224 
3225     _Py_IDENTIFIER(__mro_entries__);
3226     for (Py_ssize_t i = 0; i < nbases; i++) {
3227         PyObject *base = PyTuple_GET_ITEM(ctx->bases, i);
3228         if (PyType_Check(base)) {
3229             continue;
3230         }
3231         PyObject *mro_entries;
3232         if (_PyObject_LookupAttrId(base, &PyId___mro_entries__,
3233                                    &mro_entries) < 0) {
3234             return -1;
3235         }
3236         if (mro_entries != NULL) {
3237             PyErr_SetString(PyExc_TypeError,
3238                             "type() doesn't support MRO entry resolution; "
3239                             "use types.new_class()");
3240             Py_DECREF(mro_entries);
3241             return -1;
3242         }
3243     }
3244 
3245     // Search the bases for the proper metatype to deal with this
3246     PyTypeObject *winner;
3247     winner = _PyType_CalculateMetaclass(ctx->metatype, ctx->bases);
3248     if (winner == NULL) {
3249         return -1;
3250     }
3251 
3252     if (winner != ctx->metatype) {
3253         if (winner->tp_new != type_new) {
3254             /* Pass it to the winner */
3255             *type = winner->tp_new(winner, ctx->args, ctx->kwds);
3256             if (*type == NULL) {
3257                 return -1;
3258             }
3259             return 1;
3260         }
3261 
3262         ctx->metatype = winner;
3263     }
3264 
3265     /* Calculate best base, and check that all bases are type objects */
3266     PyTypeObject *base = best_base(ctx->bases);
3267     if (base == NULL) {
3268         return -1;
3269     }
3270 
3271     ctx->base = base;
3272     ctx->bases = Py_NewRef(ctx->bases);
3273     return 0;
3274 }
3275 
3276 
3277 static PyObject *
type_new(PyTypeObject * metatype,PyObject * args,PyObject * kwds)3278 type_new(PyTypeObject *metatype, PyObject *args, PyObject *kwds)
3279 {
3280     assert(args != NULL && PyTuple_Check(args));
3281     assert(kwds == NULL || PyDict_Check(kwds));
3282 
3283     /* Parse arguments: (name, bases, dict) */
3284     PyObject *name, *bases, *orig_dict;
3285     if (!PyArg_ParseTuple(args, "UO!O!:type.__new__",
3286                           &name,
3287                           &PyTuple_Type, &bases,
3288                           &PyDict_Type, &orig_dict))
3289     {
3290         return NULL;
3291     }
3292 
3293     type_new_ctx ctx = {
3294         .metatype = metatype,
3295         .args = args,
3296         .kwds = kwds,
3297         .orig_dict = orig_dict,
3298         .name = name,
3299         .bases = bases,
3300         .base = NULL,
3301         .slots = NULL,
3302         .nslot = 0,
3303         .add_dict = 0,
3304         .add_weak = 0,
3305         .may_add_dict = 0,
3306         .may_add_weak = 0};
3307     PyObject *type = NULL;
3308     int res = type_new_get_bases(&ctx, &type);
3309     if (res < 0) {
3310         assert(PyErr_Occurred());
3311         return NULL;
3312     }
3313     if (res == 1) {
3314         assert(type != NULL);
3315         return type;
3316     }
3317     assert(ctx.base != NULL);
3318     assert(ctx.bases != NULL);
3319 
3320     type = type_new_impl(&ctx);
3321     Py_DECREF(ctx.bases);
3322     return type;
3323 }
3324 
3325 
3326 static PyObject *
type_vectorcall(PyObject * metatype,PyObject * const * args,size_t nargsf,PyObject * kwnames)3327 type_vectorcall(PyObject *metatype, PyObject *const *args,
3328                  size_t nargsf, PyObject *kwnames)
3329 {
3330     Py_ssize_t nargs = PyVectorcall_NARGS(nargsf);
3331     if (nargs == 1 && metatype == (PyObject *)&PyType_Type){
3332         if (!_PyArg_NoKwnames("type", kwnames)) {
3333             return NULL;
3334         }
3335         return Py_NewRef(Py_TYPE(args[0]));
3336     }
3337     /* In other (much less common) cases, fall back to
3338        more flexible calling conventions. */
3339     PyThreadState *tstate = PyThreadState_GET();
3340     return _PyObject_MakeTpCall(tstate, metatype, args, nargs, kwnames);
3341 }
3342 
3343 /* An array of type slot offsets corresponding to Py_tp_* constants,
3344   * for use in e.g. PyType_Spec and PyType_GetSlot.
3345   * Each entry has two offsets: "slot_offset" and "subslot_offset".
3346   * If is subslot_offset is -1, slot_offset is an offset within the
3347   * PyTypeObject struct.
3348   * Otherwise slot_offset is an offset to a pointer to a sub-slots struct
3349   * (such as "tp_as_number"), and subslot_offset is the offset within
3350   * that struct.
3351   * The actual table is generated by a script.
3352   */
3353 static const PySlot_Offset pyslot_offsets[] = {
3354     {0, 0},
3355 #include "typeslots.inc"
3356 };
3357 
3358 PyObject *
PyType_FromSpecWithBases(PyType_Spec * spec,PyObject * bases)3359 PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
3360 {
3361     return PyType_FromModuleAndSpec(NULL, spec, bases);
3362 }
3363 
3364 PyObject *
PyType_FromModuleAndSpec(PyObject * module,PyType_Spec * spec,PyObject * bases)3365 PyType_FromModuleAndSpec(PyObject *module, PyType_Spec *spec, PyObject *bases)
3366 {
3367     PyHeapTypeObject *res;
3368     PyObject *modname;
3369     PyTypeObject *type, *base;
3370     int r;
3371 
3372     const PyType_Slot *slot;
3373     Py_ssize_t nmembers, weaklistoffset, dictoffset, vectorcalloffset;
3374     char *res_start;
3375     short slot_offset, subslot_offset;
3376 
3377     nmembers = weaklistoffset = dictoffset = vectorcalloffset = 0;
3378     for (slot = spec->slots; slot->slot; slot++) {
3379         if (slot->slot == Py_tp_members) {
3380             nmembers = 0;
3381             for (const PyMemberDef *memb = slot->pfunc; memb->name != NULL; memb++) {
3382                 nmembers++;
3383                 if (strcmp(memb->name, "__weaklistoffset__") == 0) {
3384                     // The PyMemberDef must be a Py_ssize_t and readonly
3385                     assert(memb->type == T_PYSSIZET);
3386                     assert(memb->flags == READONLY);
3387                     weaklistoffset = memb->offset;
3388                 }
3389                 if (strcmp(memb->name, "__dictoffset__") == 0) {
3390                     // The PyMemberDef must be a Py_ssize_t and readonly
3391                     assert(memb->type == T_PYSSIZET);
3392                     assert(memb->flags == READONLY);
3393                     dictoffset = memb->offset;
3394                 }
3395                 if (strcmp(memb->name, "__vectorcalloffset__") == 0) {
3396                     // The PyMemberDef must be a Py_ssize_t and readonly
3397                     assert(memb->type == T_PYSSIZET);
3398                     assert(memb->flags == READONLY);
3399                     vectorcalloffset = memb->offset;
3400                 }
3401             }
3402         }
3403     }
3404 
3405     res = (PyHeapTypeObject*)PyType_GenericAlloc(&PyType_Type, nmembers);
3406     if (res == NULL)
3407         return NULL;
3408     res_start = (char*)res;
3409 
3410     if (spec->name == NULL) {
3411         PyErr_SetString(PyExc_SystemError,
3412                         "Type spec does not define the name field.");
3413         goto fail;
3414     }
3415 
3416     /* Set the type name and qualname */
3417     const char *s = strrchr(spec->name, '.');
3418     if (s == NULL)
3419         s = spec->name;
3420     else
3421         s++;
3422 
3423     type = &res->ht_type;
3424     /* The flags must be initialized early, before the GC traverses us */
3425     type->tp_flags = spec->flags | Py_TPFLAGS_HEAPTYPE;
3426     res->ht_name = PyUnicode_FromString(s);
3427     if (!res->ht_name)
3428         goto fail;
3429     res->ht_qualname = res->ht_name;
3430     Py_INCREF(res->ht_qualname);
3431     type->tp_name = spec->name;
3432 
3433     Py_XINCREF(module);
3434     res->ht_module = module;
3435 
3436     /* Adjust for empty tuple bases */
3437     if (!bases) {
3438         base = &PyBaseObject_Type;
3439         /* See whether Py_tp_base(s) was specified */
3440         for (slot = spec->slots; slot->slot; slot++) {
3441             if (slot->slot == Py_tp_base)
3442                 base = slot->pfunc;
3443             else if (slot->slot == Py_tp_bases) {
3444                 bases = slot->pfunc;
3445             }
3446         }
3447         if (!bases) {
3448             bases = PyTuple_Pack(1, base);
3449             if (!bases)
3450                 goto fail;
3451         }
3452         else if (!PyTuple_Check(bases)) {
3453             PyErr_SetString(PyExc_SystemError, "Py_tp_bases is not a tuple");
3454             goto fail;
3455         }
3456         else {
3457             Py_INCREF(bases);
3458         }
3459     }
3460     else if (!PyTuple_Check(bases)) {
3461         bases = PyTuple_Pack(1, bases);
3462         if (!bases)
3463             goto fail;
3464     }
3465     else {
3466         Py_INCREF(bases);
3467     }
3468 
3469     /* Calculate best base, and check that all bases are type objects */
3470     base = best_base(bases);
3471     if (base == NULL) {
3472         Py_DECREF(bases);
3473         goto fail;
3474     }
3475     if (!_PyType_HasFeature(base, Py_TPFLAGS_BASETYPE)) {
3476         PyErr_Format(PyExc_TypeError,
3477                      "type '%.100s' is not an acceptable base type",
3478                      base->tp_name);
3479         Py_DECREF(bases);
3480         goto fail;
3481     }
3482 
3483     /* Initialize essential fields */
3484     type->tp_as_async = &res->as_async;
3485     type->tp_as_number = &res->as_number;
3486     type->tp_as_sequence = &res->as_sequence;
3487     type->tp_as_mapping = &res->as_mapping;
3488     type->tp_as_buffer = &res->as_buffer;
3489     /* Set tp_base and tp_bases */
3490     type->tp_bases = bases;
3491     Py_INCREF(base);
3492     type->tp_base = base;
3493 
3494     type->tp_basicsize = spec->basicsize;
3495     type->tp_itemsize = spec->itemsize;
3496 
3497     for (slot = spec->slots; slot->slot; slot++) {
3498         if (slot->slot < 0
3499             || (size_t)slot->slot >= Py_ARRAY_LENGTH(pyslot_offsets)) {
3500             PyErr_SetString(PyExc_RuntimeError, "invalid slot offset");
3501             goto fail;
3502         }
3503         else if (slot->slot == Py_tp_base || slot->slot == Py_tp_bases) {
3504             /* Processed above */
3505             continue;
3506         }
3507         else if (slot->slot == Py_tp_doc) {
3508             /* For the docstring slot, which usually points to a static string
3509                literal, we need to make a copy */
3510             if (slot->pfunc == NULL) {
3511                 type->tp_doc = NULL;
3512                 continue;
3513             }
3514             size_t len = strlen(slot->pfunc)+1;
3515             char *tp_doc = PyObject_Malloc(len);
3516             if (tp_doc == NULL) {
3517                 type->tp_doc = NULL;
3518                 PyErr_NoMemory();
3519                 goto fail;
3520             }
3521             memcpy(tp_doc, slot->pfunc, len);
3522             type->tp_doc = tp_doc;
3523         }
3524         else if (slot->slot == Py_tp_members) {
3525             /* Move the slots to the heap type itself */
3526             size_t len = Py_TYPE(type)->tp_itemsize * nmembers;
3527             memcpy(PyHeapType_GET_MEMBERS(res), slot->pfunc, len);
3528             type->tp_members = PyHeapType_GET_MEMBERS(res);
3529         }
3530         else {
3531             /* Copy other slots directly */
3532             PySlot_Offset slotoffsets = pyslot_offsets[slot->slot];
3533             slot_offset = slotoffsets.slot_offset;
3534             if (slotoffsets.subslot_offset == -1) {
3535                 *(void**)((char*)res_start + slot_offset) = slot->pfunc;
3536             } else {
3537                 void *parent_slot = *(void**)((char*)res_start + slot_offset);
3538                 subslot_offset = slotoffsets.subslot_offset;
3539                 *(void**)((char*)parent_slot + subslot_offset) = slot->pfunc;
3540             }
3541         }
3542     }
3543     if (type->tp_dealloc == NULL) {
3544         /* It's a heap type, so needs the heap types' dealloc.
3545            subtype_dealloc will call the base type's tp_dealloc, if
3546            necessary. */
3547         type->tp_dealloc = subtype_dealloc;
3548     }
3549 
3550     if (vectorcalloffset) {
3551         type->tp_vectorcall_offset = vectorcalloffset;
3552     }
3553 
3554     if (PyType_Ready(type) < 0)
3555         goto fail;
3556 
3557     if (type->tp_dictoffset) {
3558         res->ht_cached_keys = _PyDict_NewKeysForClass();
3559     }
3560 
3561     if (type->tp_doc) {
3562         PyObject *__doc__ = PyUnicode_FromString(_PyType_DocWithoutSignature(type->tp_name, type->tp_doc));
3563         if (!__doc__)
3564             goto fail;
3565         r = _PyDict_SetItemId(type->tp_dict, &PyId___doc__, __doc__);
3566         Py_DECREF(__doc__);
3567         if (r < 0)
3568             goto fail;
3569     }
3570 
3571     if (weaklistoffset) {
3572         type->tp_weaklistoffset = weaklistoffset;
3573         if (PyDict_DelItemString((PyObject *)type->tp_dict, "__weaklistoffset__") < 0)
3574             goto fail;
3575     }
3576     if (dictoffset) {
3577         type->tp_dictoffset = dictoffset;
3578         if (PyDict_DelItemString((PyObject *)type->tp_dict, "__dictoffset__") < 0)
3579             goto fail;
3580     }
3581 
3582     /* Set type.__module__ */
3583     r = _PyDict_ContainsId(type->tp_dict, &PyId___module__);
3584     if (r < 0) {
3585         goto fail;
3586     }
3587     if (r == 0) {
3588         s = strrchr(spec->name, '.');
3589         if (s != NULL) {
3590             modname = PyUnicode_FromStringAndSize(
3591                     spec->name, (Py_ssize_t)(s - spec->name));
3592             if (modname == NULL) {
3593                 goto fail;
3594             }
3595             r = _PyDict_SetItemId(type->tp_dict, &PyId___module__, modname);
3596             Py_DECREF(modname);
3597             if (r != 0)
3598                 goto fail;
3599         } else {
3600             if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
3601                     "builtin type %.200s has no __module__ attribute",
3602                     spec->name))
3603                 goto fail;
3604         }
3605     }
3606 
3607     return (PyObject*)res;
3608 
3609  fail:
3610     Py_DECREF(res);
3611     return NULL;
3612 }
3613 
3614 PyObject *
PyType_FromSpec(PyType_Spec * spec)3615 PyType_FromSpec(PyType_Spec *spec)
3616 {
3617     return PyType_FromSpecWithBases(spec, NULL);
3618 }
3619 
3620 /* private in 3.10 and 3.9.8+; public in 3.11 */
3621 PyObject *
_PyType_GetQualName(PyTypeObject * type)3622 _PyType_GetQualName(PyTypeObject *type)
3623 {
3624     return type_qualname(type, NULL);
3625 }
3626 
3627 
3628 void *
PyType_GetSlot(PyTypeObject * type,int slot)3629 PyType_GetSlot(PyTypeObject *type, int slot)
3630 {
3631     void *parent_slot;
3632     int slots_len = Py_ARRAY_LENGTH(pyslot_offsets);
3633 
3634     if (slot <= 0 || slot >= slots_len) {
3635         PyErr_BadInternalCall();
3636         return NULL;
3637     }
3638 
3639     parent_slot = *(void**)((char*)type + pyslot_offsets[slot].slot_offset);
3640     if (parent_slot == NULL) {
3641         return NULL;
3642     }
3643     /* Return slot directly if we have no sub slot. */
3644     if (pyslot_offsets[slot].subslot_offset == -1) {
3645         return parent_slot;
3646     }
3647     return *(void**)((char*)parent_slot + pyslot_offsets[slot].subslot_offset);
3648 }
3649 
3650 PyObject *
PyType_GetModule(PyTypeObject * type)3651 PyType_GetModule(PyTypeObject *type)
3652 {
3653     assert(PyType_Check(type));
3654     if (!_PyType_HasFeature(type, Py_TPFLAGS_HEAPTYPE)) {
3655         PyErr_Format(
3656             PyExc_TypeError,
3657             "PyType_GetModule: Type '%s' is not a heap type",
3658             type->tp_name);
3659         return NULL;
3660     }
3661 
3662     PyHeapTypeObject* et = (PyHeapTypeObject*)type;
3663     if (!et->ht_module) {
3664         PyErr_Format(
3665             PyExc_TypeError,
3666             "PyType_GetModule: Type '%s' has no associated module",
3667             type->tp_name);
3668         return NULL;
3669     }
3670     return et->ht_module;
3671 
3672 }
3673 
3674 void *
PyType_GetModuleState(PyTypeObject * type)3675 PyType_GetModuleState(PyTypeObject *type)
3676 {
3677     PyObject *m = PyType_GetModule(type);
3678     if (m == NULL) {
3679         return NULL;
3680     }
3681     return _PyModule_GetState(m);
3682 }
3683 
3684 
3685 /* Get the module of the first superclass where the module has the
3686  * given PyModuleDef.
3687  * Implemented by walking the MRO, is relatively slow.
3688  *
3689  * This is internal API for experimentation within stdlib. Discussion:
3690  * https://mail.python.org/archives/list/capi-sig@python.org/thread/T3P2QNLNLBRFHWSKYSTPMVEIL2EEKFJU/
3691  */
3692 PyObject *
_PyType_GetModuleByDef(PyTypeObject * type,struct PyModuleDef * def)3693 _PyType_GetModuleByDef(PyTypeObject *type, struct PyModuleDef *def)
3694 {
3695     assert(PyType_Check(type));
3696 
3697     PyObject *mro = type->tp_mro;
3698     // The type must be ready
3699     assert(mro != NULL);
3700     assert(PyTuple_Check(mro));
3701     // mro_invoke() ensures that the type MRO cannot be empty, so we don't have
3702     // to check i < PyTuple_GET_SIZE(mro) at the first loop iteration.
3703     assert(PyTuple_GET_SIZE(mro) >= 1);
3704 
3705     Py_ssize_t i = 0;
3706     do {
3707         PyObject *super = PyTuple_GET_ITEM(mro, i);
3708         // _PyType_GetModuleByDef() must only be called on a heap type created
3709         // by PyType_FromModuleAndSpec() or on its subclasses.
3710         // type_ready_mro() ensures that a static type cannot inherit from a
3711         // heap type.
3712         assert(_PyType_HasFeature((PyTypeObject *)type, Py_TPFLAGS_HEAPTYPE));
3713 
3714         PyHeapTypeObject *ht = (PyHeapTypeObject*)super;
3715         PyObject *module = ht->ht_module;
3716         if (module && _PyModule_GetDef(module) == def) {
3717             return module;
3718         }
3719         i++;
3720     } while (i < PyTuple_GET_SIZE(mro));
3721 
3722     PyErr_Format(
3723         PyExc_TypeError,
3724         "_PyType_GetModuleByDef: No superclass of '%s' has the given module",
3725         type->tp_name);
3726     return NULL;
3727 }
3728 
3729 
3730 /* Internal API to look for a name through the MRO, bypassing the method cache.
3731    This returns a borrowed reference, and might set an exception.
3732    'error' is set to: -1: error with exception; 1: error without exception; 0: ok */
3733 static PyObject *
find_name_in_mro(PyTypeObject * type,PyObject * name,int * error)3734 find_name_in_mro(PyTypeObject *type, PyObject *name, int *error)
3735 {
3736     Py_ssize_t i, n;
3737     PyObject *mro, *res, *base, *dict;
3738     Py_hash_t hash;
3739 
3740     if (!PyUnicode_CheckExact(name) ||
3741         (hash = ((PyASCIIObject *) name)->hash) == -1)
3742     {
3743         hash = PyObject_Hash(name);
3744         if (hash == -1) {
3745             *error = -1;
3746             return NULL;
3747         }
3748     }
3749 
3750     /* Look in tp_dict of types in MRO */
3751     mro = type->tp_mro;
3752 
3753     if (mro == NULL) {
3754         if ((type->tp_flags & Py_TPFLAGS_READYING) == 0) {
3755             if (PyType_Ready(type) < 0) {
3756                 *error = -1;
3757                 return NULL;
3758             }
3759             mro = type->tp_mro;
3760         }
3761         if (mro == NULL) {
3762             *error = 1;
3763             return NULL;
3764         }
3765     }
3766 
3767     res = NULL;
3768     /* Keep a strong reference to mro because type->tp_mro can be replaced
3769        during dict lookup, e.g. when comparing to non-string keys. */
3770     Py_INCREF(mro);
3771     assert(PyTuple_Check(mro));
3772     n = PyTuple_GET_SIZE(mro);
3773     for (i = 0; i < n; i++) {
3774         base = PyTuple_GET_ITEM(mro, i);
3775         assert(PyType_Check(base));
3776         dict = ((PyTypeObject *)base)->tp_dict;
3777         assert(dict && PyDict_Check(dict));
3778         res = _PyDict_GetItem_KnownHash(dict, name, hash);
3779         if (res != NULL)
3780             break;
3781         if (PyErr_Occurred()) {
3782             *error = -1;
3783             goto done;
3784         }
3785     }
3786     *error = 0;
3787 done:
3788     Py_DECREF(mro);
3789     return res;
3790 }
3791 
3792 /* Internal API to look for a name through the MRO.
3793    This returns a borrowed reference, and doesn't set an exception! */
3794 PyObject *
_PyType_Lookup(PyTypeObject * type,PyObject * name)3795 _PyType_Lookup(PyTypeObject *type, PyObject *name)
3796 {
3797     PyObject *res;
3798     int error;
3799 
3800     unsigned int h = MCACHE_HASH_METHOD(type, name);
3801     struct type_cache *cache = get_type_cache();
3802     struct type_cache_entry *entry = &cache->hashtable[h];
3803     if (entry->version == type->tp_version_tag &&
3804         entry->name == name) {
3805 #if MCACHE_STATS
3806         cache->hits++;
3807 #endif
3808         assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));
3809         return entry->value;
3810     }
3811 
3812     /* We may end up clearing live exceptions below, so make sure it's ours. */
3813     assert(!PyErr_Occurred());
3814 
3815     res = find_name_in_mro(type, name, &error);
3816     /* Only put NULL results into cache if there was no error. */
3817     if (error) {
3818         /* It's not ideal to clear the error condition,
3819            but this function is documented as not setting
3820            an exception, and I don't want to change that.
3821            E.g., when PyType_Ready() can't proceed, it won't
3822            set the "ready" flag, so future attempts to ready
3823            the same type will call it again -- hopefully
3824            in a context that propagates the exception out.
3825         */
3826         if (error == -1) {
3827             PyErr_Clear();
3828         }
3829         return NULL;
3830     }
3831 
3832     if (MCACHE_CACHEABLE_NAME(name) && assign_version_tag(cache, type)) {
3833         h = MCACHE_HASH_METHOD(type, name);
3834         struct type_cache_entry *entry = &cache->hashtable[h];
3835         entry->version = type->tp_version_tag;
3836         entry->value = res;  /* borrowed */
3837         assert(((PyASCIIObject *)(name))->hash != -1);
3838 #if MCACHE_STATS
3839         if (entry->name != Py_None && entry->name != name) {
3840             cache->collisions++;
3841         }
3842         else {
3843             cache->misses++;
3844         }
3845 #endif
3846         assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));
3847         Py_SETREF(entry->name, Py_NewRef(name));
3848     }
3849     return res;
3850 }
3851 
3852 PyObject *
_PyType_LookupId(PyTypeObject * type,struct _Py_Identifier * name)3853 _PyType_LookupId(PyTypeObject *type, struct _Py_Identifier *name)
3854 {
3855     PyObject *oname;
3856     oname = _PyUnicode_FromId(name);   /* borrowed */
3857     if (oname == NULL)
3858         return NULL;
3859     return _PyType_Lookup(type, oname);
3860 }
3861 
3862 /* Check if the "readied" PyUnicode name
3863    is a double-underscore special name. */
3864 static int
is_dunder_name(PyObject * name)3865 is_dunder_name(PyObject *name)
3866 {
3867     Py_ssize_t length = PyUnicode_GET_LENGTH(name);
3868     int kind = PyUnicode_KIND(name);
3869     /* Special names contain at least "__x__" and are always ASCII. */
3870     if (length > 4 && kind == PyUnicode_1BYTE_KIND) {
3871         const Py_UCS1 *characters = PyUnicode_1BYTE_DATA(name);
3872         return (
3873             ((characters[length-2] == '_') && (characters[length-1] == '_')) &&
3874             ((characters[0] == '_') && (characters[1] == '_'))
3875         );
3876     }
3877     return 0;
3878 }
3879 
3880 /* This is similar to PyObject_GenericGetAttr(),
3881    but uses _PyType_Lookup() instead of just looking in type->tp_dict. */
3882 static PyObject *
type_getattro(PyTypeObject * type,PyObject * name)3883 type_getattro(PyTypeObject *type, PyObject *name)
3884 {
3885     PyTypeObject *metatype = Py_TYPE(type);
3886     PyObject *meta_attribute, *attribute;
3887     descrgetfunc meta_get;
3888     PyObject* res;
3889 
3890     if (!PyUnicode_Check(name)) {
3891         PyErr_Format(PyExc_TypeError,
3892                      "attribute name must be string, not '%.200s'",
3893                      Py_TYPE(name)->tp_name);
3894         return NULL;
3895     }
3896 
3897     /* Initialize this type (we'll assume the metatype is initialized) */
3898     if (!_PyType_IsReady(type)) {
3899         if (PyType_Ready(type) < 0)
3900             return NULL;
3901     }
3902 
3903     /* No readable descriptor found yet */
3904     meta_get = NULL;
3905 
3906     /* Look for the attribute in the metatype */
3907     meta_attribute = _PyType_Lookup(metatype, name);
3908 
3909     if (meta_attribute != NULL) {
3910         Py_INCREF(meta_attribute);
3911         meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
3912 
3913         if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
3914             /* Data descriptors implement tp_descr_set to intercept
3915              * writes. Assume the attribute is not overridden in
3916              * type's tp_dict (and bases): call the descriptor now.
3917              */
3918             res = meta_get(meta_attribute, (PyObject *)type,
3919                            (PyObject *)metatype);
3920             Py_DECREF(meta_attribute);
3921             return res;
3922         }
3923     }
3924 
3925     /* No data descriptor found on metatype. Look in tp_dict of this
3926      * type and its bases */
3927     attribute = _PyType_Lookup(type, name);
3928     if (attribute != NULL) {
3929         /* Implement descriptor functionality, if any */
3930         Py_INCREF(attribute);
3931         descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
3932 
3933         Py_XDECREF(meta_attribute);
3934 
3935         if (local_get != NULL) {
3936             /* NULL 2nd argument indicates the descriptor was
3937              * found on the target object itself (or a base)  */
3938             res = local_get(attribute, (PyObject *)NULL,
3939                             (PyObject *)type);
3940             Py_DECREF(attribute);
3941             return res;
3942         }
3943 
3944         return attribute;
3945     }
3946 
3947     /* No attribute found in local __dict__ (or bases): use the
3948      * descriptor from the metatype, if any */
3949     if (meta_get != NULL) {
3950         PyObject *res;
3951         res = meta_get(meta_attribute, (PyObject *)type,
3952                        (PyObject *)metatype);
3953         Py_DECREF(meta_attribute);
3954         return res;
3955     }
3956 
3957     /* If an ordinary attribute was found on the metatype, return it now */
3958     if (meta_attribute != NULL) {
3959         return meta_attribute;
3960     }
3961 
3962     /* Give up */
3963     PyErr_Format(PyExc_AttributeError,
3964                  "type object '%.50s' has no attribute '%U'",
3965                  type->tp_name, name);
3966     return NULL;
3967 }
3968 
3969 static int
type_setattro(PyTypeObject * type,PyObject * name,PyObject * value)3970 type_setattro(PyTypeObject *type, PyObject *name, PyObject *value)
3971 {
3972     int res;
3973     if (type->tp_flags & Py_TPFLAGS_IMMUTABLETYPE) {
3974         PyErr_Format(
3975             PyExc_TypeError,
3976             "cannot set %R attribute of immutable type '%s'",
3977             name, type->tp_name);
3978         return -1;
3979     }
3980     if (PyUnicode_Check(name)) {
3981         if (PyUnicode_CheckExact(name)) {
3982             if (PyUnicode_READY(name) == -1)
3983                 return -1;
3984             Py_INCREF(name);
3985         }
3986         else {
3987             name = _PyUnicode_Copy(name);
3988             if (name == NULL)
3989                 return -1;
3990         }
3991         if (!PyUnicode_CHECK_INTERNED(name)) {
3992             PyUnicode_InternInPlace(&name);
3993             if (!PyUnicode_CHECK_INTERNED(name)) {
3994                 PyErr_SetString(PyExc_MemoryError,
3995                                 "Out of memory interning an attribute name");
3996                 Py_DECREF(name);
3997                 return -1;
3998             }
3999         }
4000     }
4001     else {
4002         /* Will fail in _PyObject_GenericSetAttrWithDict. */
4003         Py_INCREF(name);
4004     }
4005     res = _PyObject_GenericSetAttrWithDict((PyObject *)type, name, value, NULL);
4006     if (res == 0) {
4007         /* Clear the VALID_VERSION flag of 'type' and all its
4008            subclasses.  This could possibly be unified with the
4009            update_subclasses() recursion in update_slot(), but carefully:
4010            they each have their own conditions on which to stop
4011            recursing into subclasses. */
4012         PyType_Modified(type);
4013 
4014         if (is_dunder_name(name)) {
4015             res = update_slot(type, name);
4016         }
4017         assert(_PyType_CheckConsistency(type));
4018     }
4019     Py_DECREF(name);
4020     return res;
4021 }
4022 
4023 extern void
4024 _PyDictKeys_DecRef(PyDictKeysObject *keys);
4025 
4026 static void
type_dealloc(PyTypeObject * type)4027 type_dealloc(PyTypeObject *type)
4028 {
4029     PyHeapTypeObject *et;
4030     PyObject *tp, *val, *tb;
4031 
4032     /* Assert this is a heap-allocated type object */
4033     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
4034     _PyObject_GC_UNTRACK(type);
4035     PyErr_Fetch(&tp, &val, &tb);
4036     remove_all_subclasses(type, type->tp_bases);
4037     PyErr_Restore(tp, val, tb);
4038     PyObject_ClearWeakRefs((PyObject *)type);
4039     et = (PyHeapTypeObject *)type;
4040     Py_XDECREF(type->tp_base);
4041     Py_XDECREF(type->tp_dict);
4042     Py_XDECREF(type->tp_bases);
4043     Py_XDECREF(type->tp_mro);
4044     Py_XDECREF(type->tp_cache);
4045     Py_XDECREF(type->tp_subclasses);
4046     /* A type's tp_doc is heap allocated, unlike the tp_doc slots
4047      * of most other objects.  It's okay to cast it to char *.
4048      */
4049     PyObject_Free((char *)type->tp_doc);
4050     Py_XDECREF(et->ht_name);
4051     Py_XDECREF(et->ht_qualname);
4052     Py_XDECREF(et->ht_slots);
4053     if (et->ht_cached_keys) {
4054         _PyDictKeys_DecRef(et->ht_cached_keys);
4055     }
4056     Py_XDECREF(et->ht_module);
4057     Py_TYPE(type)->tp_free((PyObject *)type);
4058 }
4059 
4060 /*[clinic input]
4061 type.__subclasses__
4062 
4063 Return a list of immediate subclasses.
4064 [clinic start generated code]*/
4065 
4066 static PyObject *
type___subclasses___impl(PyTypeObject * self)4067 type___subclasses___impl(PyTypeObject *self)
4068 /*[clinic end generated code: output=eb5eb54485942819 input=5af66132436f9a7b]*/
4069 {
4070     PyObject *list, *raw, *ref;
4071     Py_ssize_t i;
4072 
4073     list = PyList_New(0);
4074     if (list == NULL)
4075         return NULL;
4076     raw = self->tp_subclasses;
4077     if (raw == NULL)
4078         return list;
4079     assert(PyDict_CheckExact(raw));
4080     i = 0;
4081     while (PyDict_Next(raw, &i, NULL, &ref)) {
4082         assert(PyWeakref_CheckRef(ref));
4083         ref = PyWeakref_GET_OBJECT(ref);
4084         if (ref != Py_None) {
4085             if (PyList_Append(list, ref) < 0) {
4086                 Py_DECREF(list);
4087                 return NULL;
4088             }
4089         }
4090     }
4091     return list;
4092 }
4093 
4094 static PyObject *
type_prepare(PyObject * self,PyObject * const * args,Py_ssize_t nargs,PyObject * kwnames)4095 type_prepare(PyObject *self, PyObject *const *args, Py_ssize_t nargs,
4096              PyObject *kwnames)
4097 {
4098     return PyDict_New();
4099 }
4100 
4101 /*
4102    Merge the __dict__ of aclass into dict, and recursively also all
4103    the __dict__s of aclass's base classes.  The order of merging isn't
4104    defined, as it's expected that only the final set of dict keys is
4105    interesting.
4106    Return 0 on success, -1 on error.
4107 */
4108 
4109 static int
merge_class_dict(PyObject * dict,PyObject * aclass)4110 merge_class_dict(PyObject *dict, PyObject *aclass)
4111 {
4112     PyObject *classdict;
4113     PyObject *bases;
4114     _Py_IDENTIFIER(__bases__);
4115 
4116     assert(PyDict_Check(dict));
4117     assert(aclass);
4118 
4119     /* Merge in the type's dict (if any). */
4120     if (_PyObject_LookupAttrId(aclass, &PyId___dict__, &classdict) < 0) {
4121         return -1;
4122     }
4123     if (classdict != NULL) {
4124         int status = PyDict_Update(dict, classdict);
4125         Py_DECREF(classdict);
4126         if (status < 0)
4127             return -1;
4128     }
4129 
4130     /* Recursively merge in the base types' (if any) dicts. */
4131     if (_PyObject_LookupAttrId(aclass, &PyId___bases__, &bases) < 0) {
4132         return -1;
4133     }
4134     if (bases != NULL) {
4135         /* We have no guarantee that bases is a real tuple */
4136         Py_ssize_t i, n;
4137         n = PySequence_Size(bases); /* This better be right */
4138         if (n < 0) {
4139             Py_DECREF(bases);
4140             return -1;
4141         }
4142         else {
4143             for (i = 0; i < n; i++) {
4144                 int status;
4145                 PyObject *base = PySequence_GetItem(bases, i);
4146                 if (base == NULL) {
4147                     Py_DECREF(bases);
4148                     return -1;
4149                 }
4150                 status = merge_class_dict(dict, base);
4151                 Py_DECREF(base);
4152                 if (status < 0) {
4153                     Py_DECREF(bases);
4154                     return -1;
4155                 }
4156             }
4157         }
4158         Py_DECREF(bases);
4159     }
4160     return 0;
4161 }
4162 
4163 /* __dir__ for type objects: returns __dict__ and __bases__.
4164    We deliberately don't suck up its __class__, as methods belonging to the
4165    metaclass would probably be more confusing than helpful.
4166 */
4167 /*[clinic input]
4168 type.__dir__
4169 
4170 Specialized __dir__ implementation for types.
4171 [clinic start generated code]*/
4172 
4173 static PyObject *
type___dir___impl(PyTypeObject * self)4174 type___dir___impl(PyTypeObject *self)
4175 /*[clinic end generated code: output=69d02fe92c0f15fa input=7733befbec645968]*/
4176 {
4177     PyObject *result = NULL;
4178     PyObject *dict = PyDict_New();
4179 
4180     if (dict != NULL && merge_class_dict(dict, (PyObject *)self) == 0)
4181         result = PyDict_Keys(dict);
4182 
4183     Py_XDECREF(dict);
4184     return result;
4185 }
4186 
4187 /*[clinic input]
4188 type.__sizeof__
4189 
4190 Return memory consumption of the type object.
4191 [clinic start generated code]*/
4192 
4193 static PyObject *
type___sizeof___impl(PyTypeObject * self)4194 type___sizeof___impl(PyTypeObject *self)
4195 /*[clinic end generated code: output=766f4f16cd3b1854 input=99398f24b9cf45d6]*/
4196 {
4197     Py_ssize_t size;
4198     if (self->tp_flags & Py_TPFLAGS_HEAPTYPE) {
4199         PyHeapTypeObject* et = (PyHeapTypeObject*)self;
4200         size = sizeof(PyHeapTypeObject);
4201         if (et->ht_cached_keys)
4202             size += _PyDict_KeysSize(et->ht_cached_keys);
4203     }
4204     else
4205         size = sizeof(PyTypeObject);
4206     return PyLong_FromSsize_t(size);
4207 }
4208 
4209 static PyMethodDef type_methods[] = {
4210     TYPE_MRO_METHODDEF
4211     TYPE___SUBCLASSES___METHODDEF
4212     {"__prepare__", (PyCFunction)(void(*)(void))type_prepare,
4213      METH_FASTCALL | METH_KEYWORDS | METH_CLASS,
4214      PyDoc_STR("__prepare__() -> dict\n"
4215                "used to create the namespace for the class statement")},
4216     TYPE___INSTANCECHECK___METHODDEF
4217     TYPE___SUBCLASSCHECK___METHODDEF
4218     TYPE___DIR___METHODDEF
4219     TYPE___SIZEOF___METHODDEF
4220     {0}
4221 };
4222 
4223 PyDoc_STRVAR(type_doc,
4224 "type(object) -> the object's type\n"
4225 "type(name, bases, dict, **kwds) -> a new type");
4226 
4227 static int
type_traverse(PyTypeObject * type,visitproc visit,void * arg)4228 type_traverse(PyTypeObject *type, visitproc visit, void *arg)
4229 {
4230     /* Because of type_is_gc(), the collector only calls this
4231        for heaptypes. */
4232     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
4233         char msg[200];
4234         sprintf(msg, "type_traverse() called on non-heap type '%.100s'",
4235                 type->tp_name);
4236         _PyObject_ASSERT_FAILED_MSG((PyObject *)type, msg);
4237     }
4238 
4239     Py_VISIT(type->tp_dict);
4240     Py_VISIT(type->tp_cache);
4241     Py_VISIT(type->tp_mro);
4242     Py_VISIT(type->tp_bases);
4243     Py_VISIT(type->tp_base);
4244     Py_VISIT(((PyHeapTypeObject *)type)->ht_module);
4245 
4246     /* There's no need to visit type->tp_subclasses or
4247        ((PyHeapTypeObject *)type)->ht_slots, because they can't be involved
4248        in cycles; tp_subclasses is a list of weak references,
4249        and slots is a tuple of strings. */
4250 
4251     return 0;
4252 }
4253 
4254 static int
type_clear(PyTypeObject * type)4255 type_clear(PyTypeObject *type)
4256 {
4257     PyDictKeysObject *cached_keys;
4258     /* Because of type_is_gc(), the collector only calls this
4259        for heaptypes. */
4260     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
4261 
4262     /* We need to invalidate the method cache carefully before clearing
4263        the dict, so that other objects caught in a reference cycle
4264        don't start calling destroyed methods.
4265 
4266        Otherwise, the we need to clear tp_mro, which is
4267        part of a hard cycle (its first element is the class itself) that
4268        won't be broken otherwise (it's a tuple and tuples don't have a
4269        tp_clear handler).
4270        We also need to clear ht_module, if present: the module usually holds a
4271        reference to its class. None of the other fields need to be
4272 
4273        cleared, and here's why:
4274 
4275        tp_cache:
4276            Not used; if it were, it would be a dict.
4277 
4278        tp_bases, tp_base:
4279            If these are involved in a cycle, there must be at least
4280            one other, mutable object in the cycle, e.g. a base
4281            class's dict; the cycle will be broken that way.
4282 
4283        tp_subclasses:
4284            A dict of weak references can't be part of a cycle; and
4285            dicts have their own tp_clear.
4286 
4287        slots (in PyHeapTypeObject):
4288            A tuple of strings can't be part of a cycle.
4289     */
4290 
4291     PyType_Modified(type);
4292     cached_keys = ((PyHeapTypeObject *)type)->ht_cached_keys;
4293     if (cached_keys != NULL) {
4294         ((PyHeapTypeObject *)type)->ht_cached_keys = NULL;
4295         _PyDictKeys_DecRef(cached_keys);
4296     }
4297     if (type->tp_dict) {
4298         PyDict_Clear(type->tp_dict);
4299     }
4300     Py_CLEAR(((PyHeapTypeObject *)type)->ht_module);
4301 
4302     Py_CLEAR(type->tp_mro);
4303 
4304     return 0;
4305 }
4306 
4307 static int
type_is_gc(PyTypeObject * type)4308 type_is_gc(PyTypeObject *type)
4309 {
4310     return type->tp_flags & Py_TPFLAGS_HEAPTYPE;
4311 }
4312 
4313 
4314 static PyNumberMethods type_as_number = {
4315         .nb_or = _Py_union_type_or, // Add __or__ function
4316 };
4317 
4318 PyTypeObject PyType_Type = {
4319     PyVarObject_HEAD_INIT(&PyType_Type, 0)
4320     "type",                                     /* tp_name */
4321     sizeof(PyHeapTypeObject),                   /* tp_basicsize */
4322     sizeof(PyMemberDef),                        /* tp_itemsize */
4323     (destructor)type_dealloc,                   /* tp_dealloc */
4324     offsetof(PyTypeObject, tp_vectorcall),      /* tp_vectorcall_offset */
4325     0,                                          /* tp_getattr */
4326     0,                                          /* tp_setattr */
4327     0,                                          /* tp_as_async */
4328     (reprfunc)type_repr,                        /* tp_repr */
4329     &type_as_number,                            /* tp_as_number */
4330     0,                                          /* tp_as_sequence */
4331     0,                                          /* tp_as_mapping */
4332     0,                                          /* tp_hash */
4333     (ternaryfunc)type_call,                     /* tp_call */
4334     0,                                          /* tp_str */
4335     (getattrofunc)type_getattro,                /* tp_getattro */
4336     (setattrofunc)type_setattro,                /* tp_setattro */
4337     0,                                          /* tp_as_buffer */
4338     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
4339     Py_TPFLAGS_BASETYPE | Py_TPFLAGS_TYPE_SUBCLASS |
4340     Py_TPFLAGS_HAVE_VECTORCALL,                 /* tp_flags */
4341     type_doc,                                   /* tp_doc */
4342     (traverseproc)type_traverse,                /* tp_traverse */
4343     (inquiry)type_clear,                        /* tp_clear */
4344     0,                                          /* tp_richcompare */
4345     offsetof(PyTypeObject, tp_weaklist),        /* tp_weaklistoffset */
4346     0,                                          /* tp_iter */
4347     0,                                          /* tp_iternext */
4348     type_methods,                               /* tp_methods */
4349     type_members,                               /* tp_members */
4350     type_getsets,                               /* tp_getset */
4351     0,                                          /* tp_base */
4352     0,                                          /* tp_dict */
4353     0,                                          /* tp_descr_get */
4354     0,                                          /* tp_descr_set */
4355     offsetof(PyTypeObject, tp_dict),            /* tp_dictoffset */
4356     type_init,                                  /* tp_init */
4357     0,                                          /* tp_alloc */
4358     type_new,                                   /* tp_new */
4359     PyObject_GC_Del,                            /* tp_free */
4360     (inquiry)type_is_gc,                        /* tp_is_gc */
4361     .tp_vectorcall = type_vectorcall,
4362 };
4363 
4364 
4365 /* The base type of all types (eventually)... except itself. */
4366 
4367 /* You may wonder why object.__new__() only complains about arguments
4368    when object.__init__() is not overridden, and vice versa.
4369 
4370    Consider the use cases:
4371 
4372    1. When neither is overridden, we want to hear complaints about
4373       excess (i.e., any) arguments, since their presence could
4374       indicate there's a bug.
4375 
4376    2. When defining an Immutable type, we are likely to override only
4377       __new__(), since __init__() is called too late to initialize an
4378       Immutable object.  Since __new__() defines the signature for the
4379       type, it would be a pain to have to override __init__() just to
4380       stop it from complaining about excess arguments.
4381 
4382    3. When defining a Mutable type, we are likely to override only
4383       __init__().  So here the converse reasoning applies: we don't
4384       want to have to override __new__() just to stop it from
4385       complaining.
4386 
4387    4. When __init__() is overridden, and the subclass __init__() calls
4388       object.__init__(), the latter should complain about excess
4389       arguments; ditto for __new__().
4390 
4391    Use cases 2 and 3 make it unattractive to unconditionally check for
4392    excess arguments.  The best solution that addresses all four use
4393    cases is as follows: __init__() complains about excess arguments
4394    unless __new__() is overridden and __init__() is not overridden
4395    (IOW, if __init__() is overridden or __new__() is not overridden);
4396    symmetrically, __new__() complains about excess arguments unless
4397    __init__() is overridden and __new__() is not overridden
4398    (IOW, if __new__() is overridden or __init__() is not overridden).
4399 
4400    However, for backwards compatibility, this breaks too much code.
4401    Therefore, in 2.6, we'll *warn* about excess arguments when both
4402    methods are overridden; for all other cases we'll use the above
4403    rules.
4404 
4405 */
4406 
4407 /* Forward */
4408 static PyObject *
4409 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
4410 
4411 static int
excess_args(PyObject * args,PyObject * kwds)4412 excess_args(PyObject *args, PyObject *kwds)
4413 {
4414     return PyTuple_GET_SIZE(args) ||
4415         (kwds && PyDict_Check(kwds) && PyDict_GET_SIZE(kwds));
4416 }
4417 
4418 static int
object_init(PyObject * self,PyObject * args,PyObject * kwds)4419 object_init(PyObject *self, PyObject *args, PyObject *kwds)
4420 {
4421     PyTypeObject *type = Py_TYPE(self);
4422     if (excess_args(args, kwds)) {
4423         if (type->tp_init != object_init) {
4424             PyErr_SetString(PyExc_TypeError,
4425                             "object.__init__() takes exactly one argument (the instance to initialize)");
4426             return -1;
4427         }
4428         if (type->tp_new == object_new) {
4429             PyErr_Format(PyExc_TypeError,
4430                          "%.200s.__init__() takes exactly one argument (the instance to initialize)",
4431                          type->tp_name);
4432             return -1;
4433         }
4434     }
4435     return 0;
4436 }
4437 
4438 static PyObject *
object_new(PyTypeObject * type,PyObject * args,PyObject * kwds)4439 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
4440 {
4441     if (excess_args(args, kwds)) {
4442         if (type->tp_new != object_new) {
4443             PyErr_SetString(PyExc_TypeError,
4444                             "object.__new__() takes exactly one argument (the type to instantiate)");
4445             return NULL;
4446         }
4447         if (type->tp_init == object_init) {
4448             PyErr_Format(PyExc_TypeError, "%.200s() takes no arguments",
4449                          type->tp_name);
4450             return NULL;
4451         }
4452     }
4453 
4454     if (type->tp_flags & Py_TPFLAGS_IS_ABSTRACT) {
4455         PyObject *abstract_methods;
4456         PyObject *sorted_methods;
4457         PyObject *joined;
4458         PyObject *comma;
4459         _Py_static_string(comma_id, ", ");
4460         Py_ssize_t method_count;
4461 
4462         /* Compute ", ".join(sorted(type.__abstractmethods__))
4463            into joined. */
4464         abstract_methods = type_abstractmethods(type, NULL);
4465         if (abstract_methods == NULL)
4466             return NULL;
4467         sorted_methods = PySequence_List(abstract_methods);
4468         Py_DECREF(abstract_methods);
4469         if (sorted_methods == NULL)
4470             return NULL;
4471         if (PyList_Sort(sorted_methods)) {
4472             Py_DECREF(sorted_methods);
4473             return NULL;
4474         }
4475         comma = _PyUnicode_FromId(&comma_id);
4476         if (comma == NULL) {
4477             Py_DECREF(sorted_methods);
4478             return NULL;
4479         }
4480         joined = PyUnicode_Join(comma, sorted_methods);
4481         method_count = PyObject_Length(sorted_methods);
4482         Py_DECREF(sorted_methods);
4483         if (joined == NULL)
4484             return NULL;
4485         if (method_count == -1)
4486             return NULL;
4487 
4488         PyErr_Format(PyExc_TypeError,
4489                      "Can't instantiate abstract class %s "
4490                      "with abstract method%s %U",
4491                      type->tp_name,
4492                      method_count > 1 ? "s" : "",
4493                      joined);
4494         Py_DECREF(joined);
4495         return NULL;
4496     }
4497     return type->tp_alloc(type, 0);
4498 }
4499 
4500 static void
object_dealloc(PyObject * self)4501 object_dealloc(PyObject *self)
4502 {
4503     Py_TYPE(self)->tp_free(self);
4504 }
4505 
4506 static PyObject *
object_repr(PyObject * self)4507 object_repr(PyObject *self)
4508 {
4509     PyTypeObject *type;
4510     PyObject *mod, *name, *rtn;
4511 
4512     type = Py_TYPE(self);
4513     mod = type_module(type, NULL);
4514     if (mod == NULL)
4515         PyErr_Clear();
4516     else if (!PyUnicode_Check(mod)) {
4517         Py_DECREF(mod);
4518         mod = NULL;
4519     }
4520     name = type_qualname(type, NULL);
4521     if (name == NULL) {
4522         Py_XDECREF(mod);
4523         return NULL;
4524     }
4525     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
4526         rtn = PyUnicode_FromFormat("<%U.%U object at %p>", mod, name, self);
4527     else
4528         rtn = PyUnicode_FromFormat("<%s object at %p>",
4529                                   type->tp_name, self);
4530     Py_XDECREF(mod);
4531     Py_DECREF(name);
4532     return rtn;
4533 }
4534 
4535 static PyObject *
object_str(PyObject * self)4536 object_str(PyObject *self)
4537 {
4538     unaryfunc f;
4539 
4540     f = Py_TYPE(self)->tp_repr;
4541     if (f == NULL)
4542         f = object_repr;
4543     return f(self);
4544 }
4545 
4546 static PyObject *
object_richcompare(PyObject * self,PyObject * other,int op)4547 object_richcompare(PyObject *self, PyObject *other, int op)
4548 {
4549     PyObject *res;
4550 
4551     switch (op) {
4552 
4553     case Py_EQ:
4554         /* Return NotImplemented instead of False, so if two
4555            objects are compared, both get a chance at the
4556            comparison.  See issue #1393. */
4557         res = (self == other) ? Py_True : Py_NotImplemented;
4558         Py_INCREF(res);
4559         break;
4560 
4561     case Py_NE:
4562         /* By default, __ne__() delegates to __eq__() and inverts the result,
4563            unless the latter returns NotImplemented. */
4564         if (Py_TYPE(self)->tp_richcompare == NULL) {
4565             res = Py_NotImplemented;
4566             Py_INCREF(res);
4567             break;
4568         }
4569         res = (*Py_TYPE(self)->tp_richcompare)(self, other, Py_EQ);
4570         if (res != NULL && res != Py_NotImplemented) {
4571             int ok = PyObject_IsTrue(res);
4572             Py_DECREF(res);
4573             if (ok < 0)
4574                 res = NULL;
4575             else {
4576                 if (ok)
4577                     res = Py_False;
4578                 else
4579                     res = Py_True;
4580                 Py_INCREF(res);
4581             }
4582         }
4583         break;
4584 
4585     default:
4586         res = Py_NotImplemented;
4587         Py_INCREF(res);
4588         break;
4589     }
4590 
4591     return res;
4592 }
4593 
4594 static PyObject *
object_get_class(PyObject * self,void * closure)4595 object_get_class(PyObject *self, void *closure)
4596 {
4597     Py_INCREF(Py_TYPE(self));
4598     return (PyObject *)(Py_TYPE(self));
4599 }
4600 
4601 static int
compatible_with_tp_base(PyTypeObject * child)4602 compatible_with_tp_base(PyTypeObject *child)
4603 {
4604     PyTypeObject *parent = child->tp_base;
4605     return (parent != NULL &&
4606             child->tp_basicsize == parent->tp_basicsize &&
4607             child->tp_itemsize == parent->tp_itemsize &&
4608             child->tp_dictoffset == parent->tp_dictoffset &&
4609             child->tp_weaklistoffset == parent->tp_weaklistoffset &&
4610             ((child->tp_flags & Py_TPFLAGS_HAVE_GC) ==
4611              (parent->tp_flags & Py_TPFLAGS_HAVE_GC)) &&
4612             (child->tp_dealloc == subtype_dealloc ||
4613              child->tp_dealloc == parent->tp_dealloc));
4614 }
4615 
4616 static int
same_slots_added(PyTypeObject * a,PyTypeObject * b)4617 same_slots_added(PyTypeObject *a, PyTypeObject *b)
4618 {
4619     PyTypeObject *base = a->tp_base;
4620     Py_ssize_t size;
4621     PyObject *slots_a, *slots_b;
4622 
4623     assert(base == b->tp_base);
4624     size = base->tp_basicsize;
4625     if (a->tp_dictoffset == size && b->tp_dictoffset == size)
4626         size += sizeof(PyObject *);
4627     if (a->tp_weaklistoffset == size && b->tp_weaklistoffset == size)
4628         size += sizeof(PyObject *);
4629 
4630     /* Check slots compliance */
4631     if (!(a->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
4632         !(b->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
4633         return 0;
4634     }
4635     slots_a = ((PyHeapTypeObject *)a)->ht_slots;
4636     slots_b = ((PyHeapTypeObject *)b)->ht_slots;
4637     if (slots_a && slots_b) {
4638         if (PyObject_RichCompareBool(slots_a, slots_b, Py_EQ) != 1)
4639             return 0;
4640         size += sizeof(PyObject *) * PyTuple_GET_SIZE(slots_a);
4641     }
4642     return size == a->tp_basicsize && size == b->tp_basicsize;
4643 }
4644 
4645 static int
compatible_for_assignment(PyTypeObject * oldto,PyTypeObject * newto,const char * attr)4646 compatible_for_assignment(PyTypeObject* oldto, PyTypeObject* newto, const char* attr)
4647 {
4648     PyTypeObject *newbase, *oldbase;
4649 
4650     if (newto->tp_free != oldto->tp_free) {
4651         PyErr_Format(PyExc_TypeError,
4652                      "%s assignment: "
4653                      "'%s' deallocator differs from '%s'",
4654                      attr,
4655                      newto->tp_name,
4656                      oldto->tp_name);
4657         return 0;
4658     }
4659     /*
4660      It's tricky to tell if two arbitrary types are sufficiently compatible as
4661      to be interchangeable; e.g., even if they have the same tp_basicsize, they
4662      might have totally different struct fields. It's much easier to tell if a
4663      type and its supertype are compatible; e.g., if they have the same
4664      tp_basicsize, then that means they have identical fields. So to check
4665      whether two arbitrary types are compatible, we first find the highest
4666      supertype that each is compatible with, and then if those supertypes are
4667      compatible then the original types must also be compatible.
4668     */
4669     newbase = newto;
4670     oldbase = oldto;
4671     while (compatible_with_tp_base(newbase))
4672         newbase = newbase->tp_base;
4673     while (compatible_with_tp_base(oldbase))
4674         oldbase = oldbase->tp_base;
4675     if (newbase != oldbase &&
4676         (newbase->tp_base != oldbase->tp_base ||
4677          !same_slots_added(newbase, oldbase))) {
4678         PyErr_Format(PyExc_TypeError,
4679                      "%s assignment: "
4680                      "'%s' object layout differs from '%s'",
4681                      attr,
4682                      newto->tp_name,
4683                      oldto->tp_name);
4684         return 0;
4685     }
4686 
4687     return 1;
4688 }
4689 
4690 static int
object_set_class(PyObject * self,PyObject * value,void * closure)4691 object_set_class(PyObject *self, PyObject *value, void *closure)
4692 {
4693     PyTypeObject *oldto = Py_TYPE(self);
4694     PyTypeObject *newto;
4695 
4696     if (value == NULL) {
4697         PyErr_SetString(PyExc_TypeError,
4698                         "can't delete __class__ attribute");
4699         return -1;
4700     }
4701     if (!PyType_Check(value)) {
4702         PyErr_Format(PyExc_TypeError,
4703           "__class__ must be set to a class, not '%s' object",
4704           Py_TYPE(value)->tp_name);
4705         return -1;
4706     }
4707     if (PySys_Audit("object.__setattr__", "OsO",
4708                     self, "__class__", value) < 0) {
4709         return -1;
4710     }
4711 
4712     newto = (PyTypeObject *)value;
4713     /* In versions of CPython prior to 3.5, the code in
4714        compatible_for_assignment was not set up to correctly check for memory
4715        layout / slot / etc. compatibility for non-HEAPTYPE classes, so we just
4716        disallowed __class__ assignment in any case that wasn't HEAPTYPE ->
4717        HEAPTYPE.
4718 
4719        During the 3.5 development cycle, we fixed the code in
4720        compatible_for_assignment to correctly check compatibility between
4721        arbitrary types, and started allowing __class__ assignment in all cases
4722        where the old and new types did in fact have compatible slots and
4723        memory layout (regardless of whether they were implemented as HEAPTYPEs
4724        or not).
4725 
4726        Just before 3.5 was released, though, we discovered that this led to
4727        problems with immutable types like int, where the interpreter assumes
4728        they are immutable and interns some values. Formerly this wasn't a
4729        problem, because they really were immutable -- in particular, all the
4730        types where the interpreter applied this interning trick happened to
4731        also be statically allocated, so the old HEAPTYPE rules were
4732        "accidentally" stopping them from allowing __class__ assignment. But
4733        with the changes to __class__ assignment, we started allowing code like
4734 
4735          class MyInt(int):
4736              ...
4737          # Modifies the type of *all* instances of 1 in the whole program,
4738          # including future instances (!), because the 1 object is interned.
4739          (1).__class__ = MyInt
4740 
4741        (see https://bugs.python.org/issue24912).
4742 
4743        In theory the proper fix would be to identify which classes rely on
4744        this invariant and somehow disallow __class__ assignment only for them,
4745        perhaps via some mechanism like a new Py_TPFLAGS_IMMUTABLE flag (a
4746        "denylisting" approach). But in practice, since this problem wasn't
4747        noticed late in the 3.5 RC cycle, we're taking the conservative
4748        approach and reinstating the same HEAPTYPE->HEAPTYPE check that we used
4749        to have, plus an "allowlist". For now, the allowlist consists only of
4750        ModuleType subtypes, since those are the cases that motivated the patch
4751        in the first place -- see https://bugs.python.org/issue22986 -- and
4752        since module objects are mutable we can be sure that they are
4753        definitely not being interned. So now we allow HEAPTYPE->HEAPTYPE *or*
4754        ModuleType subtype -> ModuleType subtype.
4755 
4756        So far as we know, all the code beyond the following 'if' statement
4757        will correctly handle non-HEAPTYPE classes, and the HEAPTYPE check is
4758        needed only to protect that subset of non-HEAPTYPE classes for which
4759        the interpreter has baked in the assumption that all instances are
4760        truly immutable.
4761     */
4762     if (!(PyType_IsSubtype(newto, &PyModule_Type) &&
4763           PyType_IsSubtype(oldto, &PyModule_Type)) &&
4764         (_PyType_HasFeature(newto, Py_TPFLAGS_IMMUTABLETYPE) ||
4765          _PyType_HasFeature(oldto, Py_TPFLAGS_IMMUTABLETYPE))) {
4766         PyErr_Format(PyExc_TypeError,
4767                      "__class__ assignment only supported for mutable types "
4768                      "or ModuleType subclasses");
4769         return -1;
4770     }
4771 
4772     if (compatible_for_assignment(oldto, newto, "__class__")) {
4773         if (newto->tp_flags & Py_TPFLAGS_HEAPTYPE) {
4774             Py_INCREF(newto);
4775         }
4776         Py_SET_TYPE(self, newto);
4777         if (oldto->tp_flags & Py_TPFLAGS_HEAPTYPE)
4778             Py_DECREF(oldto);
4779         return 0;
4780     }
4781     else {
4782         return -1;
4783     }
4784 }
4785 
4786 static PyGetSetDef object_getsets[] = {
4787     {"__class__", object_get_class, object_set_class,
4788      PyDoc_STR("the object's class")},
4789     {0}
4790 };
4791 
4792 
4793 /* Stuff to implement __reduce_ex__ for pickle protocols >= 2.
4794    We fall back to helpers in copyreg for:
4795    - pickle protocols < 2
4796    - calculating the list of slot names (done only once per class)
4797    - the __newobj__ function (which is used as a token but never called)
4798 */
4799 
4800 static PyObject *
import_copyreg(void)4801 import_copyreg(void)
4802 {
4803     PyObject *copyreg_str;
4804     PyObject *copyreg_module;
4805     _Py_IDENTIFIER(copyreg);
4806 
4807     copyreg_str = _PyUnicode_FromId(&PyId_copyreg);
4808     if (copyreg_str == NULL) {
4809         return NULL;
4810     }
4811     /* Try to fetch cached copy of copyreg from sys.modules first in an
4812        attempt to avoid the import overhead. Previously this was implemented
4813        by storing a reference to the cached module in a static variable, but
4814        this broke when multiple embedded interpreters were in use (see issue
4815        #17408 and #19088). */
4816     copyreg_module = PyImport_GetModule(copyreg_str);
4817     if (copyreg_module != NULL) {
4818         return copyreg_module;
4819     }
4820     if (PyErr_Occurred()) {
4821         return NULL;
4822     }
4823     return PyImport_Import(copyreg_str);
4824 }
4825 
4826 static PyObject *
_PyType_GetSlotNames(PyTypeObject * cls)4827 _PyType_GetSlotNames(PyTypeObject *cls)
4828 {
4829     PyObject *copyreg;
4830     PyObject *slotnames;
4831     _Py_IDENTIFIER(__slotnames__);
4832     _Py_IDENTIFIER(_slotnames);
4833 
4834     assert(PyType_Check(cls));
4835 
4836     /* Get the slot names from the cache in the class if possible. */
4837     slotnames = _PyDict_GetItemIdWithError(cls->tp_dict, &PyId___slotnames__);
4838     if (slotnames != NULL) {
4839         if (slotnames != Py_None && !PyList_Check(slotnames)) {
4840             PyErr_Format(PyExc_TypeError,
4841                          "%.200s.__slotnames__ should be a list or None, "
4842                          "not %.200s",
4843                          cls->tp_name, Py_TYPE(slotnames)->tp_name);
4844             return NULL;
4845         }
4846         Py_INCREF(slotnames);
4847         return slotnames;
4848     }
4849     else {
4850         if (PyErr_Occurred()) {
4851             return NULL;
4852         }
4853         /* The class does not have the slot names cached yet. */
4854     }
4855 
4856     copyreg = import_copyreg();
4857     if (copyreg == NULL)
4858         return NULL;
4859 
4860     /* Use _slotnames function from the copyreg module to find the slots
4861        by this class and its bases. This function will cache the result
4862        in __slotnames__. */
4863     slotnames = _PyObject_CallMethodIdOneArg(copyreg, &PyId__slotnames,
4864                                              (PyObject *)cls);
4865     Py_DECREF(copyreg);
4866     if (slotnames == NULL)
4867         return NULL;
4868 
4869     if (slotnames != Py_None && !PyList_Check(slotnames)) {
4870         PyErr_SetString(PyExc_TypeError,
4871                         "copyreg._slotnames didn't return a list or None");
4872         Py_DECREF(slotnames);
4873         return NULL;
4874     }
4875 
4876     return slotnames;
4877 }
4878 
4879 static PyObject *
_PyObject_GetState(PyObject * obj,int required)4880 _PyObject_GetState(PyObject *obj, int required)
4881 {
4882     PyObject *state;
4883     PyObject *getstate;
4884     _Py_IDENTIFIER(__getstate__);
4885 
4886     if (_PyObject_LookupAttrId(obj, &PyId___getstate__, &getstate) < 0) {
4887         return NULL;
4888     }
4889     if (getstate == NULL) {
4890         PyObject *slotnames;
4891 
4892         if (required && Py_TYPE(obj)->tp_itemsize) {
4893             PyErr_Format(PyExc_TypeError,
4894                          "cannot pickle '%.200s' object",
4895                          Py_TYPE(obj)->tp_name);
4896             return NULL;
4897         }
4898 
4899         {
4900             PyObject **dict;
4901             dict = _PyObject_GetDictPtr(obj);
4902             /* It is possible that the object's dict is not initialized
4903                yet. In this case, we will return None for the state.
4904                We also return None if the dict is empty to make the behavior
4905                consistent regardless whether the dict was initialized or not.
4906                This make unit testing easier. */
4907             if (dict != NULL && *dict != NULL && PyDict_GET_SIZE(*dict)) {
4908                 state = *dict;
4909             }
4910             else {
4911                 state = Py_None;
4912             }
4913             Py_INCREF(state);
4914         }
4915 
4916         slotnames = _PyType_GetSlotNames(Py_TYPE(obj));
4917         if (slotnames == NULL) {
4918             Py_DECREF(state);
4919             return NULL;
4920         }
4921 
4922         assert(slotnames == Py_None || PyList_Check(slotnames));
4923         if (required) {
4924             Py_ssize_t basicsize = PyBaseObject_Type.tp_basicsize;
4925             if (Py_TYPE(obj)->tp_dictoffset)
4926                 basicsize += sizeof(PyObject *);
4927             if (Py_TYPE(obj)->tp_weaklistoffset)
4928                 basicsize += sizeof(PyObject *);
4929             if (slotnames != Py_None)
4930                 basicsize += sizeof(PyObject *) * PyList_GET_SIZE(slotnames);
4931             if (Py_TYPE(obj)->tp_basicsize > basicsize) {
4932                 Py_DECREF(slotnames);
4933                 Py_DECREF(state);
4934                 PyErr_Format(PyExc_TypeError,
4935                              "cannot pickle '%.200s' object",
4936                              Py_TYPE(obj)->tp_name);
4937                 return NULL;
4938             }
4939         }
4940 
4941         if (slotnames != Py_None && PyList_GET_SIZE(slotnames) > 0) {
4942             PyObject *slots;
4943             Py_ssize_t slotnames_size, i;
4944 
4945             slots = PyDict_New();
4946             if (slots == NULL) {
4947                 Py_DECREF(slotnames);
4948                 Py_DECREF(state);
4949                 return NULL;
4950             }
4951 
4952             slotnames_size = PyList_GET_SIZE(slotnames);
4953             for (i = 0; i < slotnames_size; i++) {
4954                 PyObject *name, *value;
4955 
4956                 name = PyList_GET_ITEM(slotnames, i);
4957                 Py_INCREF(name);
4958                 if (_PyObject_LookupAttr(obj, name, &value) < 0) {
4959                     goto error;
4960                 }
4961                 if (value == NULL) {
4962                     Py_DECREF(name);
4963                     /* It is not an error if the attribute is not present. */
4964                 }
4965                 else {
4966                     int err = PyDict_SetItem(slots, name, value);
4967                     Py_DECREF(name);
4968                     Py_DECREF(value);
4969                     if (err) {
4970                         goto error;
4971                     }
4972                 }
4973 
4974                 /* The list is stored on the class so it may mutate while we
4975                    iterate over it */
4976                 if (slotnames_size != PyList_GET_SIZE(slotnames)) {
4977                     PyErr_Format(PyExc_RuntimeError,
4978                                  "__slotsname__ changed size during iteration");
4979                     goto error;
4980                 }
4981 
4982                 /* We handle errors within the loop here. */
4983                 if (0) {
4984                   error:
4985                     Py_DECREF(slotnames);
4986                     Py_DECREF(slots);
4987                     Py_DECREF(state);
4988                     return NULL;
4989                 }
4990             }
4991 
4992             /* If we found some slot attributes, pack them in a tuple along
4993                the original attribute dictionary. */
4994             if (PyDict_GET_SIZE(slots) > 0) {
4995                 PyObject *state2;
4996 
4997                 state2 = PyTuple_Pack(2, state, slots);
4998                 Py_DECREF(state);
4999                 if (state2 == NULL) {
5000                     Py_DECREF(slotnames);
5001                     Py_DECREF(slots);
5002                     return NULL;
5003                 }
5004                 state = state2;
5005             }
5006             Py_DECREF(slots);
5007         }
5008         Py_DECREF(slotnames);
5009     }
5010     else { /* getstate != NULL */
5011         state = _PyObject_CallNoArg(getstate);
5012         Py_DECREF(getstate);
5013         if (state == NULL)
5014             return NULL;
5015     }
5016 
5017     return state;
5018 }
5019 
5020 static int
_PyObject_GetNewArguments(PyObject * obj,PyObject ** args,PyObject ** kwargs)5021 _PyObject_GetNewArguments(PyObject *obj, PyObject **args, PyObject **kwargs)
5022 {
5023     PyObject *getnewargs, *getnewargs_ex;
5024     _Py_IDENTIFIER(__getnewargs_ex__);
5025     _Py_IDENTIFIER(__getnewargs__);
5026 
5027     if (args == NULL || kwargs == NULL) {
5028         PyErr_BadInternalCall();
5029         return -1;
5030     }
5031 
5032     /* We first attempt to fetch the arguments for __new__ by calling
5033        __getnewargs_ex__ on the object. */
5034     getnewargs_ex = _PyObject_LookupSpecial(obj, &PyId___getnewargs_ex__);
5035     if (getnewargs_ex != NULL) {
5036         PyObject *newargs = _PyObject_CallNoArg(getnewargs_ex);
5037         Py_DECREF(getnewargs_ex);
5038         if (newargs == NULL) {
5039             return -1;
5040         }
5041         if (!PyTuple_Check(newargs)) {
5042             PyErr_Format(PyExc_TypeError,
5043                          "__getnewargs_ex__ should return a tuple, "
5044                          "not '%.200s'", Py_TYPE(newargs)->tp_name);
5045             Py_DECREF(newargs);
5046             return -1;
5047         }
5048         if (PyTuple_GET_SIZE(newargs) != 2) {
5049             PyErr_Format(PyExc_ValueError,
5050                          "__getnewargs_ex__ should return a tuple of "
5051                          "length 2, not %zd", PyTuple_GET_SIZE(newargs));
5052             Py_DECREF(newargs);
5053             return -1;
5054         }
5055         *args = PyTuple_GET_ITEM(newargs, 0);
5056         Py_INCREF(*args);
5057         *kwargs = PyTuple_GET_ITEM(newargs, 1);
5058         Py_INCREF(*kwargs);
5059         Py_DECREF(newargs);
5060 
5061         /* XXX We should perhaps allow None to be passed here. */
5062         if (!PyTuple_Check(*args)) {
5063             PyErr_Format(PyExc_TypeError,
5064                          "first item of the tuple returned by "
5065                          "__getnewargs_ex__ must be a tuple, not '%.200s'",
5066                          Py_TYPE(*args)->tp_name);
5067             Py_CLEAR(*args);
5068             Py_CLEAR(*kwargs);
5069             return -1;
5070         }
5071         if (!PyDict_Check(*kwargs)) {
5072             PyErr_Format(PyExc_TypeError,
5073                          "second item of the tuple returned by "
5074                          "__getnewargs_ex__ must be a dict, not '%.200s'",
5075                          Py_TYPE(*kwargs)->tp_name);
5076             Py_CLEAR(*args);
5077             Py_CLEAR(*kwargs);
5078             return -1;
5079         }
5080         return 0;
5081     } else if (PyErr_Occurred()) {
5082         return -1;
5083     }
5084 
5085     /* The object does not have __getnewargs_ex__ so we fallback on using
5086        __getnewargs__ instead. */
5087     getnewargs = _PyObject_LookupSpecial(obj, &PyId___getnewargs__);
5088     if (getnewargs != NULL) {
5089         *args = _PyObject_CallNoArg(getnewargs);
5090         Py_DECREF(getnewargs);
5091         if (*args == NULL) {
5092             return -1;
5093         }
5094         if (!PyTuple_Check(*args)) {
5095             PyErr_Format(PyExc_TypeError,
5096                          "__getnewargs__ should return a tuple, "
5097                          "not '%.200s'", Py_TYPE(*args)->tp_name);
5098             Py_CLEAR(*args);
5099             return -1;
5100         }
5101         *kwargs = NULL;
5102         return 0;
5103     } else if (PyErr_Occurred()) {
5104         return -1;
5105     }
5106 
5107     /* The object does not have __getnewargs_ex__ and __getnewargs__. This may
5108        mean __new__ does not takes any arguments on this object, or that the
5109        object does not implement the reduce protocol for pickling or
5110        copying. */
5111     *args = NULL;
5112     *kwargs = NULL;
5113     return 0;
5114 }
5115 
5116 static int
_PyObject_GetItemsIter(PyObject * obj,PyObject ** listitems,PyObject ** dictitems)5117 _PyObject_GetItemsIter(PyObject *obj, PyObject **listitems,
5118                        PyObject **dictitems)
5119 {
5120     if (listitems == NULL || dictitems == NULL) {
5121         PyErr_BadInternalCall();
5122         return -1;
5123     }
5124 
5125     if (!PyList_Check(obj)) {
5126         *listitems = Py_None;
5127         Py_INCREF(*listitems);
5128     }
5129     else {
5130         *listitems = PyObject_GetIter(obj);
5131         if (*listitems == NULL)
5132             return -1;
5133     }
5134 
5135     if (!PyDict_Check(obj)) {
5136         *dictitems = Py_None;
5137         Py_INCREF(*dictitems);
5138     }
5139     else {
5140         PyObject *items;
5141         _Py_IDENTIFIER(items);
5142 
5143         items = _PyObject_CallMethodIdNoArgs(obj, &PyId_items);
5144         if (items == NULL) {
5145             Py_CLEAR(*listitems);
5146             return -1;
5147         }
5148         *dictitems = PyObject_GetIter(items);
5149         Py_DECREF(items);
5150         if (*dictitems == NULL) {
5151             Py_CLEAR(*listitems);
5152             return -1;
5153         }
5154     }
5155 
5156     assert(*listitems != NULL && *dictitems != NULL);
5157 
5158     return 0;
5159 }
5160 
5161 static PyObject *
reduce_newobj(PyObject * obj)5162 reduce_newobj(PyObject *obj)
5163 {
5164     PyObject *args = NULL, *kwargs = NULL;
5165     PyObject *copyreg;
5166     PyObject *newobj, *newargs, *state, *listitems, *dictitems;
5167     PyObject *result;
5168     int hasargs;
5169 
5170     if (Py_TYPE(obj)->tp_new == NULL) {
5171         PyErr_Format(PyExc_TypeError,
5172                      "cannot pickle '%.200s' object",
5173                      Py_TYPE(obj)->tp_name);
5174         return NULL;
5175     }
5176     if (_PyObject_GetNewArguments(obj, &args, &kwargs) < 0)
5177         return NULL;
5178 
5179     copyreg = import_copyreg();
5180     if (copyreg == NULL) {
5181         Py_XDECREF(args);
5182         Py_XDECREF(kwargs);
5183         return NULL;
5184     }
5185     hasargs = (args != NULL);
5186     if (kwargs == NULL || PyDict_GET_SIZE(kwargs) == 0) {
5187         _Py_IDENTIFIER(__newobj__);
5188         PyObject *cls;
5189         Py_ssize_t i, n;
5190 
5191         Py_XDECREF(kwargs);
5192         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj__);
5193         Py_DECREF(copyreg);
5194         if (newobj == NULL) {
5195             Py_XDECREF(args);
5196             return NULL;
5197         }
5198         n = args ? PyTuple_GET_SIZE(args) : 0;
5199         newargs = PyTuple_New(n+1);
5200         if (newargs == NULL) {
5201             Py_XDECREF(args);
5202             Py_DECREF(newobj);
5203             return NULL;
5204         }
5205         cls = (PyObject *) Py_TYPE(obj);
5206         Py_INCREF(cls);
5207         PyTuple_SET_ITEM(newargs, 0, cls);
5208         for (i = 0; i < n; i++) {
5209             PyObject *v = PyTuple_GET_ITEM(args, i);
5210             Py_INCREF(v);
5211             PyTuple_SET_ITEM(newargs, i+1, v);
5212         }
5213         Py_XDECREF(args);
5214     }
5215     else if (args != NULL) {
5216         _Py_IDENTIFIER(__newobj_ex__);
5217 
5218         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj_ex__);
5219         Py_DECREF(copyreg);
5220         if (newobj == NULL) {
5221             Py_DECREF(args);
5222             Py_DECREF(kwargs);
5223             return NULL;
5224         }
5225         newargs = PyTuple_Pack(3, Py_TYPE(obj), args, kwargs);
5226         Py_DECREF(args);
5227         Py_DECREF(kwargs);
5228         if (newargs == NULL) {
5229             Py_DECREF(newobj);
5230             return NULL;
5231         }
5232     }
5233     else {
5234         /* args == NULL */
5235         Py_DECREF(kwargs);
5236         PyErr_BadInternalCall();
5237         return NULL;
5238     }
5239 
5240     state = _PyObject_GetState(obj,
5241                 !hasargs && !PyList_Check(obj) && !PyDict_Check(obj));
5242     if (state == NULL) {
5243         Py_DECREF(newobj);
5244         Py_DECREF(newargs);
5245         return NULL;
5246     }
5247     if (_PyObject_GetItemsIter(obj, &listitems, &dictitems) < 0) {
5248         Py_DECREF(newobj);
5249         Py_DECREF(newargs);
5250         Py_DECREF(state);
5251         return NULL;
5252     }
5253 
5254     result = PyTuple_Pack(5, newobj, newargs, state, listitems, dictitems);
5255     Py_DECREF(newobj);
5256     Py_DECREF(newargs);
5257     Py_DECREF(state);
5258     Py_DECREF(listitems);
5259     Py_DECREF(dictitems);
5260     return result;
5261 }
5262 
5263 /*
5264  * There were two problems when object.__reduce__ and object.__reduce_ex__
5265  * were implemented in the same function:
5266  *  - trying to pickle an object with a custom __reduce__ method that
5267  *    fell back to object.__reduce__ in certain circumstances led to
5268  *    infinite recursion at Python level and eventual RecursionError.
5269  *  - Pickling objects that lied about their type by overwriting the
5270  *    __class__ descriptor could lead to infinite recursion at C level
5271  *    and eventual segfault.
5272  *
5273  * Because of backwards compatibility, the two methods still have to
5274  * behave in the same way, even if this is not required by the pickle
5275  * protocol. This common functionality was moved to the _common_reduce
5276  * function.
5277  */
5278 static PyObject *
_common_reduce(PyObject * self,int proto)5279 _common_reduce(PyObject *self, int proto)
5280 {
5281     PyObject *copyreg, *res;
5282 
5283     if (proto >= 2)
5284         return reduce_newobj(self);
5285 
5286     copyreg = import_copyreg();
5287     if (!copyreg)
5288         return NULL;
5289 
5290     res = PyObject_CallMethod(copyreg, "_reduce_ex", "Oi", self, proto);
5291     Py_DECREF(copyreg);
5292 
5293     return res;
5294 }
5295 
5296 /*[clinic input]
5297 object.__reduce__
5298 
5299 Helper for pickle.
5300 [clinic start generated code]*/
5301 
5302 static PyObject *
object___reduce___impl(PyObject * self)5303 object___reduce___impl(PyObject *self)
5304 /*[clinic end generated code: output=d4ca691f891c6e2f input=11562e663947e18b]*/
5305 {
5306     return _common_reduce(self, 0);
5307 }
5308 
5309 /*[clinic input]
5310 object.__reduce_ex__
5311 
5312   protocol: int
5313   /
5314 
5315 Helper for pickle.
5316 [clinic start generated code]*/
5317 
5318 static PyObject *
object___reduce_ex___impl(PyObject * self,int protocol)5319 object___reduce_ex___impl(PyObject *self, int protocol)
5320 /*[clinic end generated code: output=2e157766f6b50094 input=f326b43fb8a4c5ff]*/
5321 {
5322     static PyObject *objreduce;
5323     PyObject *reduce, *res;
5324     _Py_IDENTIFIER(__reduce__);
5325 
5326     if (objreduce == NULL) {
5327         objreduce = _PyDict_GetItemIdWithError(PyBaseObject_Type.tp_dict,
5328                                                &PyId___reduce__);
5329         if (objreduce == NULL && PyErr_Occurred()) {
5330             return NULL;
5331         }
5332     }
5333 
5334     if (_PyObject_LookupAttrId(self, &PyId___reduce__, &reduce) < 0) {
5335         return NULL;
5336     }
5337     if (reduce != NULL) {
5338         PyObject *cls, *clsreduce;
5339         int override;
5340 
5341         cls = (PyObject *) Py_TYPE(self);
5342         clsreduce = _PyObject_GetAttrId(cls, &PyId___reduce__);
5343         if (clsreduce == NULL) {
5344             Py_DECREF(reduce);
5345             return NULL;
5346         }
5347         override = (clsreduce != objreduce);
5348         Py_DECREF(clsreduce);
5349         if (override) {
5350             res = _PyObject_CallNoArg(reduce);
5351             Py_DECREF(reduce);
5352             return res;
5353         }
5354         else
5355             Py_DECREF(reduce);
5356     }
5357 
5358     return _common_reduce(self, protocol);
5359 }
5360 
5361 static PyObject *
object_subclasshook(PyObject * cls,PyObject * args)5362 object_subclasshook(PyObject *cls, PyObject *args)
5363 {
5364     Py_RETURN_NOTIMPLEMENTED;
5365 }
5366 
5367 PyDoc_STRVAR(object_subclasshook_doc,
5368 "Abstract classes can override this to customize issubclass().\n"
5369 "\n"
5370 "This is invoked early on by abc.ABCMeta.__subclasscheck__().\n"
5371 "It should return True, False or NotImplemented.  If it returns\n"
5372 "NotImplemented, the normal algorithm is used.  Otherwise, it\n"
5373 "overrides the normal algorithm (and the outcome is cached).\n");
5374 
5375 static PyObject *
object_init_subclass(PyObject * cls,PyObject * arg)5376 object_init_subclass(PyObject *cls, PyObject *arg)
5377 {
5378     Py_RETURN_NONE;
5379 }
5380 
5381 PyDoc_STRVAR(object_init_subclass_doc,
5382 "This method is called when a class is subclassed.\n"
5383 "\n"
5384 "The default implementation does nothing. It may be\n"
5385 "overridden to extend subclasses.\n");
5386 
5387 /*[clinic input]
5388 object.__format__
5389 
5390   format_spec: unicode
5391   /
5392 
5393 Default object formatter.
5394 [clinic start generated code]*/
5395 
5396 static PyObject *
object___format___impl(PyObject * self,PyObject * format_spec)5397 object___format___impl(PyObject *self, PyObject *format_spec)
5398 /*[clinic end generated code: output=34897efb543a974b input=7c3b3bc53a6fb7fa]*/
5399 {
5400     /* Issue 7994: If we're converting to a string, we
5401        should reject format specifications */
5402     if (PyUnicode_GET_LENGTH(format_spec) > 0) {
5403         PyErr_Format(PyExc_TypeError,
5404                      "unsupported format string passed to %.200s.__format__",
5405                      Py_TYPE(self)->tp_name);
5406         return NULL;
5407     }
5408     return PyObject_Str(self);
5409 }
5410 
5411 /*[clinic input]
5412 object.__sizeof__
5413 
5414 Size of object in memory, in bytes.
5415 [clinic start generated code]*/
5416 
5417 static PyObject *
object___sizeof___impl(PyObject * self)5418 object___sizeof___impl(PyObject *self)
5419 /*[clinic end generated code: output=73edab332f97d550 input=1200ff3dfe485306]*/
5420 {
5421     Py_ssize_t res, isize;
5422 
5423     res = 0;
5424     isize = Py_TYPE(self)->tp_itemsize;
5425     if (isize > 0)
5426         res = Py_SIZE(self) * isize;
5427     res += Py_TYPE(self)->tp_basicsize;
5428 
5429     return PyLong_FromSsize_t(res);
5430 }
5431 
5432 /* __dir__ for generic objects: returns __dict__, __class__,
5433    and recursively up the __class__.__bases__ chain.
5434 */
5435 /*[clinic input]
5436 object.__dir__
5437 
5438 Default dir() implementation.
5439 [clinic start generated code]*/
5440 
5441 static PyObject *
object___dir___impl(PyObject * self)5442 object___dir___impl(PyObject *self)
5443 /*[clinic end generated code: output=66dd48ea62f26c90 input=0a89305bec669b10]*/
5444 {
5445     PyObject *result = NULL;
5446     PyObject *dict = NULL;
5447     PyObject *itsclass = NULL;
5448 
5449     /* Get __dict__ (which may or may not be a real dict...) */
5450     if (_PyObject_LookupAttrId(self, &PyId___dict__, &dict) < 0) {
5451         return NULL;
5452     }
5453     if (dict == NULL) {
5454         dict = PyDict_New();
5455     }
5456     else if (!PyDict_Check(dict)) {
5457         Py_DECREF(dict);
5458         dict = PyDict_New();
5459     }
5460     else {
5461         /* Copy __dict__ to avoid mutating it. */
5462         PyObject *temp = PyDict_Copy(dict);
5463         Py_DECREF(dict);
5464         dict = temp;
5465     }
5466 
5467     if (dict == NULL)
5468         goto error;
5469 
5470     /* Merge in attrs reachable from its class. */
5471     if (_PyObject_LookupAttrId(self, &PyId___class__, &itsclass) < 0) {
5472         goto error;
5473     }
5474     /* XXX(tomer): Perhaps fall back to Py_TYPE(obj) if no
5475                    __class__ exists? */
5476     if (itsclass != NULL && merge_class_dict(dict, itsclass) < 0)
5477         goto error;
5478 
5479     result = PyDict_Keys(dict);
5480     /* fall through */
5481 error:
5482     Py_XDECREF(itsclass);
5483     Py_XDECREF(dict);
5484     return result;
5485 }
5486 
5487 static PyMethodDef object_methods[] = {
5488     OBJECT___REDUCE_EX___METHODDEF
5489     OBJECT___REDUCE___METHODDEF
5490     {"__subclasshook__", object_subclasshook, METH_CLASS | METH_VARARGS,
5491      object_subclasshook_doc},
5492     {"__init_subclass__", object_init_subclass, METH_CLASS | METH_NOARGS,
5493      object_init_subclass_doc},
5494     OBJECT___FORMAT___METHODDEF
5495     OBJECT___SIZEOF___METHODDEF
5496     OBJECT___DIR___METHODDEF
5497     {0}
5498 };
5499 
5500 PyDoc_STRVAR(object_doc,
5501 "object()\n--\n\n"
5502 "The base class of the class hierarchy.\n\n"
5503 "When called, it accepts no arguments and returns a new featureless\n"
5504 "instance that has no instance attributes and cannot be given any.\n");
5505 
5506 PyTypeObject PyBaseObject_Type = {
5507     PyVarObject_HEAD_INIT(&PyType_Type, 0)
5508     "object",                                   /* tp_name */
5509     sizeof(PyObject),                           /* tp_basicsize */
5510     0,                                          /* tp_itemsize */
5511     object_dealloc,                             /* tp_dealloc */
5512     0,                                          /* tp_vectorcall_offset */
5513     0,                                          /* tp_getattr */
5514     0,                                          /* tp_setattr */
5515     0,                                          /* tp_as_async */
5516     object_repr,                                /* tp_repr */
5517     0,                                          /* tp_as_number */
5518     0,                                          /* tp_as_sequence */
5519     0,                                          /* tp_as_mapping */
5520     (hashfunc)_Py_HashPointer,                  /* tp_hash */
5521     0,                                          /* tp_call */
5522     object_str,                                 /* tp_str */
5523     PyObject_GenericGetAttr,                    /* tp_getattro */
5524     PyObject_GenericSetAttr,                    /* tp_setattro */
5525     0,                                          /* tp_as_buffer */
5526     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,   /* tp_flags */
5527     object_doc,                                 /* tp_doc */
5528     0,                                          /* tp_traverse */
5529     0,                                          /* tp_clear */
5530     object_richcompare,                         /* tp_richcompare */
5531     0,                                          /* tp_weaklistoffset */
5532     0,                                          /* tp_iter */
5533     0,                                          /* tp_iternext */
5534     object_methods,                             /* tp_methods */
5535     0,                                          /* tp_members */
5536     object_getsets,                             /* tp_getset */
5537     0,                                          /* tp_base */
5538     0,                                          /* tp_dict */
5539     0,                                          /* tp_descr_get */
5540     0,                                          /* tp_descr_set */
5541     0,                                          /* tp_dictoffset */
5542     object_init,                                /* tp_init */
5543     PyType_GenericAlloc,                        /* tp_alloc */
5544     object_new,                                 /* tp_new */
5545     PyObject_Del,                               /* tp_free */
5546 };
5547 
5548 
5549 static int
type_add_method(PyTypeObject * type,PyMethodDef * meth)5550 type_add_method(PyTypeObject *type, PyMethodDef *meth)
5551 {
5552     PyObject *descr;
5553     int isdescr = 1;
5554     if (meth->ml_flags & METH_CLASS) {
5555         if (meth->ml_flags & METH_STATIC) {
5556             PyErr_SetString(PyExc_ValueError,
5557                     "method cannot be both class and static");
5558             return -1;
5559         }
5560         descr = PyDescr_NewClassMethod(type, meth);
5561     }
5562     else if (meth->ml_flags & METH_STATIC) {
5563         PyObject *cfunc = PyCFunction_NewEx(meth, (PyObject*)type, NULL);
5564         if (cfunc == NULL) {
5565             return -1;
5566         }
5567         descr = PyStaticMethod_New(cfunc);
5568         isdescr = 0;  // PyStaticMethod is not PyDescrObject
5569         Py_DECREF(cfunc);
5570     }
5571     else {
5572         descr = PyDescr_NewMethod(type, meth);
5573     }
5574     if (descr == NULL) {
5575         return -1;
5576     }
5577 
5578     PyObject *name;
5579     if (isdescr) {
5580         name = PyDescr_NAME(descr);
5581     }
5582     else {
5583         name = PyUnicode_FromString(meth->ml_name);
5584         if (name == NULL) {
5585             Py_DECREF(descr);
5586             return -1;
5587         }
5588     }
5589 
5590     int err;
5591     if (!(meth->ml_flags & METH_COEXIST)) {
5592         err = PyDict_SetDefault(type->tp_dict, name, descr) == NULL;
5593     }
5594     else {
5595         err = PyDict_SetItem(type->tp_dict, name, descr) < 0;
5596     }
5597     if (!isdescr) {
5598         Py_DECREF(name);
5599     }
5600     Py_DECREF(descr);
5601     if (err) {
5602         return -1;
5603     }
5604     return 0;
5605 }
5606 
5607 
5608 /* Add the methods from tp_methods to the __dict__ in a type object */
5609 static int
type_add_methods(PyTypeObject * type)5610 type_add_methods(PyTypeObject *type)
5611 {
5612     PyMethodDef *meth = type->tp_methods;
5613     if (meth == NULL) {
5614         return 0;
5615     }
5616 
5617     for (; meth->ml_name != NULL; meth++) {
5618         if (type_add_method(type, meth) < 0) {
5619             return -1;
5620         }
5621     }
5622     return 0;
5623 }
5624 
5625 
5626 static int
type_add_members(PyTypeObject * type)5627 type_add_members(PyTypeObject *type)
5628 {
5629     PyMemberDef *memb = type->tp_members;
5630     if (memb == NULL) {
5631         return 0;
5632     }
5633 
5634     PyObject *dict = type->tp_dict;
5635     for (; memb->name != NULL; memb++) {
5636         PyObject *descr = PyDescr_NewMember(type, memb);
5637         if (descr == NULL)
5638             return -1;
5639 
5640         if (PyDict_SetDefault(dict, PyDescr_NAME(descr), descr) == NULL) {
5641             Py_DECREF(descr);
5642             return -1;
5643         }
5644         Py_DECREF(descr);
5645     }
5646     return 0;
5647 }
5648 
5649 
5650 static int
type_add_getset(PyTypeObject * type)5651 type_add_getset(PyTypeObject *type)
5652 {
5653     PyGetSetDef *gsp = type->tp_getset;
5654     if (gsp == NULL) {
5655         return 0;
5656     }
5657 
5658     PyObject *dict = type->tp_dict;
5659     for (; gsp->name != NULL; gsp++) {
5660         PyObject *descr = PyDescr_NewGetSet(type, gsp);
5661         if (descr == NULL) {
5662             return -1;
5663         }
5664 
5665         if (PyDict_SetDefault(dict, PyDescr_NAME(descr), descr) == NULL) {
5666             Py_DECREF(descr);
5667             return -1;
5668         }
5669         Py_DECREF(descr);
5670     }
5671     return 0;
5672 }
5673 
5674 
5675 static void
inherit_special(PyTypeObject * type,PyTypeObject * base)5676 inherit_special(PyTypeObject *type, PyTypeObject *base)
5677 {
5678     /* Copying tp_traverse and tp_clear is connected to the GC flags */
5679     if (!(type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5680         (base->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5681         (!type->tp_traverse && !type->tp_clear)) {
5682         type->tp_flags |= Py_TPFLAGS_HAVE_GC;
5683         if (type->tp_traverse == NULL)
5684             type->tp_traverse = base->tp_traverse;
5685         if (type->tp_clear == NULL)
5686             type->tp_clear = base->tp_clear;
5687     }
5688 
5689     if (type->tp_basicsize == 0)
5690         type->tp_basicsize = base->tp_basicsize;
5691 
5692     /* Copy other non-function slots */
5693 
5694 #define COPYVAL(SLOT) \
5695     if (type->SLOT == 0) { type->SLOT = base->SLOT; }
5696 
5697     COPYVAL(tp_itemsize);
5698     COPYVAL(tp_weaklistoffset);
5699     COPYVAL(tp_dictoffset);
5700 #undef COPYVAL
5701 
5702     /* Setup fast subclass flags */
5703     if (PyType_IsSubtype(base, (PyTypeObject*)PyExc_BaseException)) {
5704         type->tp_flags |= Py_TPFLAGS_BASE_EXC_SUBCLASS;
5705     }
5706     else if (PyType_IsSubtype(base, &PyType_Type)) {
5707         type->tp_flags |= Py_TPFLAGS_TYPE_SUBCLASS;
5708     }
5709     else if (PyType_IsSubtype(base, &PyLong_Type)) {
5710         type->tp_flags |= Py_TPFLAGS_LONG_SUBCLASS;
5711     }
5712     else if (PyType_IsSubtype(base, &PyBytes_Type)) {
5713         type->tp_flags |= Py_TPFLAGS_BYTES_SUBCLASS;
5714     }
5715     else if (PyType_IsSubtype(base, &PyUnicode_Type)) {
5716         type->tp_flags |= Py_TPFLAGS_UNICODE_SUBCLASS;
5717     }
5718     else if (PyType_IsSubtype(base, &PyTuple_Type)) {
5719         type->tp_flags |= Py_TPFLAGS_TUPLE_SUBCLASS;
5720     }
5721     else if (PyType_IsSubtype(base, &PyList_Type)) {
5722         type->tp_flags |= Py_TPFLAGS_LIST_SUBCLASS;
5723     }
5724     else if (PyType_IsSubtype(base, &PyDict_Type)) {
5725         type->tp_flags |= Py_TPFLAGS_DICT_SUBCLASS;
5726     }
5727     if (PyType_HasFeature(base, _Py_TPFLAGS_MATCH_SELF)) {
5728         type->tp_flags |= _Py_TPFLAGS_MATCH_SELF;
5729     }
5730 }
5731 
5732 static int
overrides_hash(PyTypeObject * type)5733 overrides_hash(PyTypeObject *type)
5734 {
5735     PyObject *dict = type->tp_dict;
5736     _Py_IDENTIFIER(__eq__);
5737 
5738     assert(dict != NULL);
5739     int r = _PyDict_ContainsId(dict, &PyId___eq__);
5740     if (r == 0) {
5741         r = _PyDict_ContainsId(dict, &PyId___hash__);
5742     }
5743     return r;
5744 }
5745 
5746 static int
inherit_slots(PyTypeObject * type,PyTypeObject * base)5747 inherit_slots(PyTypeObject *type, PyTypeObject *base)
5748 {
5749     PyTypeObject *basebase;
5750 
5751 #undef SLOTDEFINED
5752 #undef COPYSLOT
5753 #undef COPYNUM
5754 #undef COPYSEQ
5755 #undef COPYMAP
5756 #undef COPYBUF
5757 
5758 #define SLOTDEFINED(SLOT) \
5759     (base->SLOT != 0 && \
5760      (basebase == NULL || base->SLOT != basebase->SLOT))
5761 
5762 #define COPYSLOT(SLOT) \
5763     if (!type->SLOT && SLOTDEFINED(SLOT)) type->SLOT = base->SLOT
5764 
5765 #define COPYASYNC(SLOT) COPYSLOT(tp_as_async->SLOT)
5766 #define COPYNUM(SLOT) COPYSLOT(tp_as_number->SLOT)
5767 #define COPYSEQ(SLOT) COPYSLOT(tp_as_sequence->SLOT)
5768 #define COPYMAP(SLOT) COPYSLOT(tp_as_mapping->SLOT)
5769 #define COPYBUF(SLOT) COPYSLOT(tp_as_buffer->SLOT)
5770 
5771     /* This won't inherit indirect slots (from tp_as_number etc.)
5772        if type doesn't provide the space. */
5773 
5774     if (type->tp_as_number != NULL && base->tp_as_number != NULL) {
5775         basebase = base->tp_base;
5776         if (basebase->tp_as_number == NULL)
5777             basebase = NULL;
5778         COPYNUM(nb_add);
5779         COPYNUM(nb_subtract);
5780         COPYNUM(nb_multiply);
5781         COPYNUM(nb_remainder);
5782         COPYNUM(nb_divmod);
5783         COPYNUM(nb_power);
5784         COPYNUM(nb_negative);
5785         COPYNUM(nb_positive);
5786         COPYNUM(nb_absolute);
5787         COPYNUM(nb_bool);
5788         COPYNUM(nb_invert);
5789         COPYNUM(nb_lshift);
5790         COPYNUM(nb_rshift);
5791         COPYNUM(nb_and);
5792         COPYNUM(nb_xor);
5793         COPYNUM(nb_or);
5794         COPYNUM(nb_int);
5795         COPYNUM(nb_float);
5796         COPYNUM(nb_inplace_add);
5797         COPYNUM(nb_inplace_subtract);
5798         COPYNUM(nb_inplace_multiply);
5799         COPYNUM(nb_inplace_remainder);
5800         COPYNUM(nb_inplace_power);
5801         COPYNUM(nb_inplace_lshift);
5802         COPYNUM(nb_inplace_rshift);
5803         COPYNUM(nb_inplace_and);
5804         COPYNUM(nb_inplace_xor);
5805         COPYNUM(nb_inplace_or);
5806         COPYNUM(nb_true_divide);
5807         COPYNUM(nb_floor_divide);
5808         COPYNUM(nb_inplace_true_divide);
5809         COPYNUM(nb_inplace_floor_divide);
5810         COPYNUM(nb_index);
5811         COPYNUM(nb_matrix_multiply);
5812         COPYNUM(nb_inplace_matrix_multiply);
5813     }
5814 
5815     if (type->tp_as_async != NULL && base->tp_as_async != NULL) {
5816         basebase = base->tp_base;
5817         if (basebase->tp_as_async == NULL)
5818             basebase = NULL;
5819         COPYASYNC(am_await);
5820         COPYASYNC(am_aiter);
5821         COPYASYNC(am_anext);
5822     }
5823 
5824     if (type->tp_as_sequence != NULL && base->tp_as_sequence != NULL) {
5825         basebase = base->tp_base;
5826         if (basebase->tp_as_sequence == NULL)
5827             basebase = NULL;
5828         COPYSEQ(sq_length);
5829         COPYSEQ(sq_concat);
5830         COPYSEQ(sq_repeat);
5831         COPYSEQ(sq_item);
5832         COPYSEQ(sq_ass_item);
5833         COPYSEQ(sq_contains);
5834         COPYSEQ(sq_inplace_concat);
5835         COPYSEQ(sq_inplace_repeat);
5836     }
5837 
5838     if (type->tp_as_mapping != NULL && base->tp_as_mapping != NULL) {
5839         basebase = base->tp_base;
5840         if (basebase->tp_as_mapping == NULL)
5841             basebase = NULL;
5842         COPYMAP(mp_length);
5843         COPYMAP(mp_subscript);
5844         COPYMAP(mp_ass_subscript);
5845     }
5846 
5847     if (type->tp_as_buffer != NULL && base->tp_as_buffer != NULL) {
5848         basebase = base->tp_base;
5849         if (basebase->tp_as_buffer == NULL)
5850             basebase = NULL;
5851         COPYBUF(bf_getbuffer);
5852         COPYBUF(bf_releasebuffer);
5853     }
5854 
5855     basebase = base->tp_base;
5856 
5857     COPYSLOT(tp_dealloc);
5858     if (type->tp_getattr == NULL && type->tp_getattro == NULL) {
5859         type->tp_getattr = base->tp_getattr;
5860         type->tp_getattro = base->tp_getattro;
5861     }
5862     if (type->tp_setattr == NULL && type->tp_setattro == NULL) {
5863         type->tp_setattr = base->tp_setattr;
5864         type->tp_setattro = base->tp_setattro;
5865     }
5866     COPYSLOT(tp_repr);
5867     /* tp_hash see tp_richcompare */
5868     {
5869         /* Always inherit tp_vectorcall_offset to support PyVectorcall_Call().
5870          * If Py_TPFLAGS_HAVE_VECTORCALL is not inherited, then vectorcall
5871          * won't be used automatically. */
5872         COPYSLOT(tp_vectorcall_offset);
5873 
5874         /* Inherit Py_TPFLAGS_HAVE_VECTORCALL for non-heap types
5875         * if tp_call is not overridden */
5876         if (!type->tp_call &&
5877             (base->tp_flags & Py_TPFLAGS_HAVE_VECTORCALL) &&
5878             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
5879         {
5880             type->tp_flags |= Py_TPFLAGS_HAVE_VECTORCALL;
5881         }
5882         COPYSLOT(tp_call);
5883     }
5884     COPYSLOT(tp_str);
5885     {
5886         /* Copy comparison-related slots only when
5887            not overriding them anywhere */
5888         if (type->tp_richcompare == NULL &&
5889             type->tp_hash == NULL)
5890         {
5891             int r = overrides_hash(type);
5892             if (r < 0) {
5893                 return -1;
5894             }
5895             if (!r) {
5896                 type->tp_richcompare = base->tp_richcompare;
5897                 type->tp_hash = base->tp_hash;
5898             }
5899         }
5900     }
5901     {
5902         COPYSLOT(tp_iter);
5903         COPYSLOT(tp_iternext);
5904     }
5905     {
5906         COPYSLOT(tp_descr_get);
5907         /* Inherit Py_TPFLAGS_METHOD_DESCRIPTOR if tp_descr_get was inherited,
5908          * but only for extension types */
5909         if (base->tp_descr_get &&
5910             type->tp_descr_get == base->tp_descr_get &&
5911             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE) &&
5912             (base->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR))
5913         {
5914             type->tp_flags |= Py_TPFLAGS_METHOD_DESCRIPTOR;
5915         }
5916         COPYSLOT(tp_descr_set);
5917         COPYSLOT(tp_dictoffset);
5918         COPYSLOT(tp_init);
5919         COPYSLOT(tp_alloc);
5920         COPYSLOT(tp_is_gc);
5921         COPYSLOT(tp_finalize);
5922         if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) ==
5923             (base->tp_flags & Py_TPFLAGS_HAVE_GC)) {
5924             /* They agree about gc. */
5925             COPYSLOT(tp_free);
5926         }
5927         else if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5928                  type->tp_free == NULL &&
5929                  base->tp_free == PyObject_Free) {
5930             /* A bit of magic to plug in the correct default
5931              * tp_free function when a derived class adds gc,
5932              * didn't define tp_free, and the base uses the
5933              * default non-gc tp_free.
5934              */
5935             type->tp_free = PyObject_GC_Del;
5936         }
5937         /* else they didn't agree about gc, and there isn't something
5938          * obvious to be done -- the type is on its own.
5939          */
5940     }
5941     return 0;
5942 }
5943 
5944 static int add_operators(PyTypeObject *);
5945 static int add_tp_new_wrapper(PyTypeObject *type);
5946 
5947 #define COLLECTION_FLAGS (Py_TPFLAGS_SEQUENCE | Py_TPFLAGS_MAPPING)
5948 
5949 static int
type_ready_checks(PyTypeObject * type)5950 type_ready_checks(PyTypeObject *type)
5951 {
5952     /* Consistency checks for PEP 590:
5953      * - Py_TPFLAGS_METHOD_DESCRIPTOR requires tp_descr_get
5954      * - Py_TPFLAGS_HAVE_VECTORCALL requires tp_call and
5955      *   tp_vectorcall_offset > 0
5956      * To avoid mistakes, we require this before inheriting.
5957      */
5958     if (type->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR) {
5959         _PyObject_ASSERT((PyObject *)type, type->tp_descr_get != NULL);
5960     }
5961     if (type->tp_flags & Py_TPFLAGS_HAVE_VECTORCALL) {
5962         _PyObject_ASSERT((PyObject *)type, type->tp_vectorcall_offset > 0);
5963         _PyObject_ASSERT((PyObject *)type, type->tp_call != NULL);
5964     }
5965 
5966     /* Consistency checks for pattern matching
5967      * Py_TPFLAGS_SEQUENCE and Py_TPFLAGS_MAPPING are mutually exclusive */
5968     _PyObject_ASSERT((PyObject *)type, (type->tp_flags & COLLECTION_FLAGS) != COLLECTION_FLAGS);
5969 
5970     if (type->tp_name == NULL) {
5971         PyErr_Format(PyExc_SystemError,
5972                      "Type does not define the tp_name field.");
5973         return -1;
5974     }
5975     return 0;
5976 }
5977 
5978 
5979 static int
type_ready_set_bases(PyTypeObject * type)5980 type_ready_set_bases(PyTypeObject *type)
5981 {
5982     /* Initialize tp_base (defaults to BaseObject unless that's us) */
5983     PyTypeObject *base = type->tp_base;
5984     if (base == NULL && type != &PyBaseObject_Type) {
5985         base = &PyBaseObject_Type;
5986         if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
5987             type->tp_base = (PyTypeObject*)Py_NewRef((PyObject*)base);
5988         }
5989         else {
5990             type->tp_base = base;
5991         }
5992     }
5993     assert(type->tp_base != NULL || type == &PyBaseObject_Type);
5994 
5995     /* Now the only way base can still be NULL is if type is
5996      * &PyBaseObject_Type. */
5997 
5998     /* Initialize the base class */
5999     if (base != NULL && !_PyType_IsReady(base)) {
6000         if (PyType_Ready(base) < 0) {
6001             return -1;
6002         }
6003     }
6004 
6005     /* Initialize ob_type if NULL.      This means extensions that want to be
6006        compilable separately on Windows can call PyType_Ready() instead of
6007        initializing the ob_type field of their type objects. */
6008     /* The test for base != NULL is really unnecessary, since base is only
6009        NULL when type is &PyBaseObject_Type, and we know its ob_type is
6010        not NULL (it's initialized to &PyType_Type).      But coverity doesn't
6011        know that. */
6012     if (Py_IS_TYPE(type, NULL) && base != NULL) {
6013         Py_SET_TYPE(type, Py_TYPE(base));
6014     }
6015 
6016     /* Initialize tp_bases */
6017     PyObject *bases = type->tp_bases;
6018     if (bases == NULL) {
6019         PyTypeObject *base = type->tp_base;
6020         if (base == NULL) {
6021             bases = PyTuple_New(0);
6022         }
6023         else {
6024             bases = PyTuple_Pack(1, base);
6025         }
6026         if (bases == NULL) {
6027             return -1;
6028         }
6029         type->tp_bases = bases;
6030     }
6031     return 0;
6032 }
6033 
6034 
6035 static int
type_ready_set_dict(PyTypeObject * type)6036 type_ready_set_dict(PyTypeObject *type)
6037 {
6038     if (type->tp_dict != NULL) {
6039         return 0;
6040     }
6041 
6042     PyObject *dict = PyDict_New();
6043     if (dict == NULL) {
6044         return -1;
6045     }
6046     type->tp_dict = dict;
6047     return 0;
6048 }
6049 
6050 
6051 /* If the type dictionary doesn't contain a __doc__, set it from
6052    the tp_doc slot. */
6053 static int
type_dict_set_doc(PyTypeObject * type)6054 type_dict_set_doc(PyTypeObject *type)
6055 {
6056     int r = _PyDict_ContainsId(type->tp_dict, &PyId___doc__);
6057     if (r < 0) {
6058         return -1;
6059     }
6060     if (r > 0) {
6061         return 0;
6062     }
6063 
6064     if (type->tp_doc != NULL) {
6065         const char *doc_str;
6066         doc_str = _PyType_DocWithoutSignature(type->tp_name, type->tp_doc);
6067         PyObject *doc = PyUnicode_FromString(doc_str);
6068         if (doc == NULL) {
6069             return -1;
6070         }
6071 
6072         if (_PyDict_SetItemId(type->tp_dict, &PyId___doc__, doc) < 0) {
6073             Py_DECREF(doc);
6074             return -1;
6075         }
6076         Py_DECREF(doc);
6077     }
6078     else {
6079         if (_PyDict_SetItemId(type->tp_dict, &PyId___doc__, Py_None) < 0) {
6080             return -1;
6081         }
6082     }
6083     return 0;
6084 }
6085 
6086 
6087 static int
type_ready_fill_dict(PyTypeObject * type)6088 type_ready_fill_dict(PyTypeObject *type)
6089 {
6090     /* Add type-specific descriptors to tp_dict */
6091     if (add_operators(type) < 0) {
6092         return -1;
6093     }
6094     if (type_add_methods(type) < 0) {
6095         return -1;
6096     }
6097     if (type_add_members(type) < 0) {
6098         return -1;
6099     }
6100     if (type_add_getset(type) < 0) {
6101         return -1;
6102     }
6103     if (type_dict_set_doc(type) < 0) {
6104         return -1;
6105     }
6106     return 0;
6107 }
6108 
6109 
6110 static int
type_ready_mro(PyTypeObject * type)6111 type_ready_mro(PyTypeObject *type)
6112 {
6113     /* Calculate method resolution order */
6114     if (mro_internal(type, NULL) < 0) {
6115         return -1;
6116     }
6117     assert(type->tp_mro != NULL);
6118     assert(PyTuple_Check(type->tp_mro));
6119 
6120     /* All bases of statically allocated type should be statically allocated */
6121     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
6122         PyObject *mro = type->tp_mro;
6123         Py_ssize_t n = PyTuple_GET_SIZE(mro);
6124         for (Py_ssize_t i = 0; i < n; i++) {
6125             PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(mro, i);
6126             if (PyType_Check(base) && (base->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
6127                 PyErr_Format(PyExc_TypeError,
6128                              "type '%.100s' is not dynamically allocated but "
6129                              "its base type '%.100s' is dynamically allocated",
6130                              type->tp_name, base->tp_name);
6131                 return -1;
6132             }
6133         }
6134     }
6135     return 0;
6136 }
6137 
6138 
6139 // For static types, inherit tp_as_xxx structures from the base class
6140 // if it's NULL.
6141 //
6142 // For heap types, tp_as_xxx structures are not NULL: they are set to the
6143 // PyHeapTypeObject.as_xxx fields by type_new_alloc().
6144 static void
type_ready_inherit_as_structs(PyTypeObject * type,PyTypeObject * base)6145 type_ready_inherit_as_structs(PyTypeObject *type, PyTypeObject *base)
6146 {
6147     if (type->tp_as_async == NULL) {
6148         type->tp_as_async = base->tp_as_async;
6149     }
6150     if (type->tp_as_number == NULL) {
6151         type->tp_as_number = base->tp_as_number;
6152     }
6153     if (type->tp_as_sequence == NULL) {
6154         type->tp_as_sequence = base->tp_as_sequence;
6155     }
6156     if (type->tp_as_mapping == NULL) {
6157         type->tp_as_mapping = base->tp_as_mapping;
6158     }
6159     if (type->tp_as_buffer == NULL) {
6160         type->tp_as_buffer = base->tp_as_buffer;
6161     }
6162 }
6163 
6164 static void
inherit_patma_flags(PyTypeObject * type,PyTypeObject * base)6165 inherit_patma_flags(PyTypeObject *type, PyTypeObject *base) {
6166     if ((type->tp_flags & COLLECTION_FLAGS) == 0) {
6167         type->tp_flags |= base->tp_flags & COLLECTION_FLAGS;
6168     }
6169 }
6170 
6171 static int
type_ready_inherit(PyTypeObject * type)6172 type_ready_inherit(PyTypeObject *type)
6173 {
6174     /* Inherit special flags from dominant base */
6175     PyTypeObject *base = type->tp_base;
6176     if (base != NULL) {
6177         inherit_special(type, base);
6178     }
6179 
6180     // Inherit slots
6181     PyObject *mro = type->tp_mro;
6182     Py_ssize_t n = PyTuple_GET_SIZE(type->tp_mro);
6183     for (Py_ssize_t i = 1; i < n; i++) {
6184         PyObject *b = PyTuple_GET_ITEM(mro, i);
6185         if (PyType_Check(b)) {
6186             if (inherit_slots(type, (PyTypeObject *)b) < 0) {
6187                 return -1;
6188             }
6189             inherit_patma_flags(type, (PyTypeObject *)b);
6190         }
6191     }
6192 
6193     if (base != NULL) {
6194         type_ready_inherit_as_structs(type, base);
6195     }
6196 
6197     /* Sanity check for tp_free. */
6198     if (_PyType_IS_GC(type) && (type->tp_flags & Py_TPFLAGS_BASETYPE) &&
6199         (type->tp_free == NULL || type->tp_free == PyObject_Del))
6200     {
6201         /* This base class needs to call tp_free, but doesn't have
6202          * one, or its tp_free is for non-gc'ed objects.
6203          */
6204         PyErr_Format(PyExc_TypeError, "type '%.100s' participates in "
6205                      "gc and is a base type but has inappropriate "
6206                      "tp_free slot",
6207                      type->tp_name);
6208         return -1;
6209     }
6210 
6211     return 0;
6212 }
6213 
6214 
6215 /* Hack for tp_hash and __hash__.
6216    If after all that, tp_hash is still NULL, and __hash__ is not in
6217    tp_dict, set tp_hash to PyObject_HashNotImplemented and
6218    tp_dict['__hash__'] equal to None.
6219    This signals that __hash__ is not inherited. */
6220 static int
type_ready_set_hash(PyTypeObject * type)6221 type_ready_set_hash(PyTypeObject *type)
6222 {
6223     if (type->tp_hash != NULL) {
6224         return 0;
6225     }
6226 
6227     int r = _PyDict_ContainsId(type->tp_dict, &PyId___hash__);
6228     if (r < 0) {
6229         return -1;
6230     }
6231     if (r > 0) {
6232         return 0;
6233     }
6234 
6235     if (_PyDict_SetItemId(type->tp_dict, &PyId___hash__, Py_None) < 0) {
6236         return -1;
6237     }
6238     type->tp_hash = PyObject_HashNotImplemented;
6239     return 0;
6240 }
6241 
6242 
6243 /* Link into each base class's list of subclasses */
6244 static int
type_ready_add_subclasses(PyTypeObject * type)6245 type_ready_add_subclasses(PyTypeObject *type)
6246 {
6247     PyObject *bases = type->tp_bases;
6248     Py_ssize_t nbase = PyTuple_GET_SIZE(bases);
6249     for (Py_ssize_t i = 0; i < nbase; i++) {
6250         PyObject *b = PyTuple_GET_ITEM(bases, i);
6251         if (PyType_Check(b) && add_subclass((PyTypeObject *)b, type) < 0) {
6252             return -1;
6253         }
6254     }
6255     return 0;
6256 }
6257 
6258 
6259 // Set tp_new and the "__new__" key in the type dictionary.
6260 // Use the Py_TPFLAGS_DISALLOW_INSTANTIATION flag.
6261 static int
type_ready_set_new(PyTypeObject * type)6262 type_ready_set_new(PyTypeObject *type)
6263 {
6264     PyTypeObject *base = type->tp_base;
6265     /* The condition below could use some explanation.
6266 
6267        It appears that tp_new is not inherited for static types whose base
6268        class is 'object'; this seems to be a precaution so that old extension
6269        types don't suddenly become callable (object.__new__ wouldn't insure the
6270        invariants that the extension type's own factory function ensures).
6271 
6272        Heap types, of course, are under our control, so they do inherit tp_new;
6273        static extension types that specify some other built-in type as the
6274        default also inherit object.__new__. */
6275     if (type->tp_new == NULL
6276         && base == &PyBaseObject_Type
6277         && !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
6278     {
6279         type->tp_flags |= Py_TPFLAGS_DISALLOW_INSTANTIATION;
6280     }
6281 
6282     if (!(type->tp_flags & Py_TPFLAGS_DISALLOW_INSTANTIATION)) {
6283         if (type->tp_new != NULL) {
6284             // If "__new__" key does not exists in the type dictionary,
6285             // set it to tp_new_wrapper().
6286             if (add_tp_new_wrapper(type) < 0) {
6287                 return -1;
6288             }
6289         }
6290         else {
6291             // tp_new is NULL: inherit tp_new from base
6292             type->tp_new = base->tp_new;
6293         }
6294     }
6295     else {
6296         // Py_TPFLAGS_DISALLOW_INSTANTIATION sets tp_new to NULL
6297         type->tp_new = NULL;
6298     }
6299     return 0;
6300 }
6301 
6302 
6303 static int
type_ready(PyTypeObject * type)6304 type_ready(PyTypeObject *type)
6305 {
6306     if (type_ready_checks(type) < 0) {
6307         return -1;
6308     }
6309 
6310 #ifdef Py_TRACE_REFS
6311     /* PyType_Ready is the closest thing we have to a choke point
6312      * for type objects, so is the best place I can think of to try
6313      * to get type objects into the doubly-linked list of all objects.
6314      * Still, not all type objects go through PyType_Ready.
6315      */
6316     _Py_AddToAllObjects((PyObject *)type, 0);
6317 #endif
6318 
6319     /* Initialize tp_dict: _PyType_IsReady() tests if tp_dict != NULL */
6320     if (type_ready_set_dict(type) < 0) {
6321         return -1;
6322     }
6323     if (type_ready_set_bases(type) < 0) {
6324         return -1;
6325     }
6326     if (type_ready_mro(type) < 0) {
6327         return -1;
6328     }
6329     if (type_ready_set_new(type) < 0) {
6330         return -1;
6331     }
6332     if (type_ready_fill_dict(type) < 0) {
6333         return -1;
6334     }
6335     if (type_ready_inherit(type) < 0) {
6336         return -1;
6337     }
6338     if (type_ready_set_hash(type) < 0) {
6339         return -1;
6340     }
6341     if (type_ready_add_subclasses(type) < 0) {
6342         return -1;
6343     }
6344     return 0;
6345 }
6346 
6347 
6348 int
PyType_Ready(PyTypeObject * type)6349 PyType_Ready(PyTypeObject *type)
6350 {
6351     if (type->tp_flags & Py_TPFLAGS_READY) {
6352         assert(_PyType_CheckConsistency(type));
6353         return 0;
6354     }
6355     _PyObject_ASSERT((PyObject *)type,
6356                      (type->tp_flags & Py_TPFLAGS_READYING) == 0);
6357 
6358     type->tp_flags |= Py_TPFLAGS_READYING;
6359 
6360     /* Historically, all static types were immutable. See bpo-43908 */
6361     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
6362         type->tp_flags |= Py_TPFLAGS_IMMUTABLETYPE;
6363     }
6364 
6365     if (type_ready(type) < 0) {
6366         type->tp_flags &= ~Py_TPFLAGS_READYING;
6367         return -1;
6368     }
6369 
6370     /* All done -- set the ready flag */
6371     type->tp_flags = (type->tp_flags & ~Py_TPFLAGS_READYING) | Py_TPFLAGS_READY;
6372     assert(_PyType_CheckConsistency(type));
6373     return 0;
6374 }
6375 
6376 
6377 static int
add_subclass(PyTypeObject * base,PyTypeObject * type)6378 add_subclass(PyTypeObject *base, PyTypeObject *type)
6379 {
6380     int result = -1;
6381     PyObject *dict, *key, *newobj;
6382 
6383     dict = base->tp_subclasses;
6384     if (dict == NULL) {
6385         base->tp_subclasses = dict = PyDict_New();
6386         if (dict == NULL)
6387             return -1;
6388     }
6389     assert(PyDict_CheckExact(dict));
6390     key = PyLong_FromVoidPtr((void *) type);
6391     if (key == NULL)
6392         return -1;
6393     newobj = PyWeakref_NewRef((PyObject *)type, NULL);
6394     if (newobj != NULL) {
6395         result = PyDict_SetItem(dict, key, newobj);
6396         Py_DECREF(newobj);
6397     }
6398     Py_DECREF(key);
6399     return result;
6400 }
6401 
6402 static int
add_all_subclasses(PyTypeObject * type,PyObject * bases)6403 add_all_subclasses(PyTypeObject *type, PyObject *bases)
6404 {
6405     int res = 0;
6406 
6407     if (bases) {
6408         Py_ssize_t i;
6409         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
6410             PyObject *base = PyTuple_GET_ITEM(bases, i);
6411             if (PyType_Check(base) &&
6412                 add_subclass((PyTypeObject*)base, type) < 0)
6413                 res = -1;
6414         }
6415     }
6416 
6417     return res;
6418 }
6419 
6420 static void
remove_subclass(PyTypeObject * base,PyTypeObject * type)6421 remove_subclass(PyTypeObject *base, PyTypeObject *type)
6422 {
6423     PyObject *dict, *key;
6424 
6425     dict = base->tp_subclasses;
6426     if (dict == NULL) {
6427         return;
6428     }
6429     assert(PyDict_CheckExact(dict));
6430     key = PyLong_FromVoidPtr((void *) type);
6431     if (key == NULL || PyDict_DelItem(dict, key)) {
6432         /* This can happen if the type initialization errored out before
6433            the base subclasses were updated (e.g. a non-str __qualname__
6434            was passed in the type dict). */
6435         PyErr_Clear();
6436     }
6437     Py_XDECREF(key);
6438 }
6439 
6440 static void
remove_all_subclasses(PyTypeObject * type,PyObject * bases)6441 remove_all_subclasses(PyTypeObject *type, PyObject *bases)
6442 {
6443     if (bases) {
6444         Py_ssize_t i;
6445         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
6446             PyObject *base = PyTuple_GET_ITEM(bases, i);
6447             if (PyType_Check(base))
6448                 remove_subclass((PyTypeObject*) base, type);
6449         }
6450     }
6451 }
6452 
6453 static int
check_num_args(PyObject * ob,int n)6454 check_num_args(PyObject *ob, int n)
6455 {
6456     if (!PyTuple_CheckExact(ob)) {
6457         PyErr_SetString(PyExc_SystemError,
6458             "PyArg_UnpackTuple() argument list is not a tuple");
6459         return 0;
6460     }
6461     if (n == PyTuple_GET_SIZE(ob))
6462         return 1;
6463     PyErr_Format(
6464         PyExc_TypeError,
6465         "expected %d argument%s, got %zd", n, n == 1 ? "" : "s", PyTuple_GET_SIZE(ob));
6466     return 0;
6467 }
6468 
6469 /* Generic wrappers for overloadable 'operators' such as __getitem__ */
6470 
6471 /* There's a wrapper *function* for each distinct function typedef used
6472    for type object slots (e.g. binaryfunc, ternaryfunc, etc.).  There's a
6473    wrapper *table* for each distinct operation (e.g. __len__, __add__).
6474    Most tables have only one entry; the tables for binary operators have two
6475    entries, one regular and one with reversed arguments. */
6476 
6477 static PyObject *
wrap_lenfunc(PyObject * self,PyObject * args,void * wrapped)6478 wrap_lenfunc(PyObject *self, PyObject *args, void *wrapped)
6479 {
6480     lenfunc func = (lenfunc)wrapped;
6481     Py_ssize_t res;
6482 
6483     if (!check_num_args(args, 0))
6484         return NULL;
6485     res = (*func)(self);
6486     if (res == -1 && PyErr_Occurred())
6487         return NULL;
6488     return PyLong_FromSsize_t(res);
6489 }
6490 
6491 static PyObject *
wrap_inquirypred(PyObject * self,PyObject * args,void * wrapped)6492 wrap_inquirypred(PyObject *self, PyObject *args, void *wrapped)
6493 {
6494     inquiry func = (inquiry)wrapped;
6495     int res;
6496 
6497     if (!check_num_args(args, 0))
6498         return NULL;
6499     res = (*func)(self);
6500     if (res == -1 && PyErr_Occurred())
6501         return NULL;
6502     return PyBool_FromLong((long)res);
6503 }
6504 
6505 static PyObject *
wrap_binaryfunc(PyObject * self,PyObject * args,void * wrapped)6506 wrap_binaryfunc(PyObject *self, PyObject *args, void *wrapped)
6507 {
6508     binaryfunc func = (binaryfunc)wrapped;
6509     PyObject *other;
6510 
6511     if (!check_num_args(args, 1))
6512         return NULL;
6513     other = PyTuple_GET_ITEM(args, 0);
6514     return (*func)(self, other);
6515 }
6516 
6517 static PyObject *
wrap_binaryfunc_l(PyObject * self,PyObject * args,void * wrapped)6518 wrap_binaryfunc_l(PyObject *self, PyObject *args, void *wrapped)
6519 {
6520     binaryfunc func = (binaryfunc)wrapped;
6521     PyObject *other;
6522 
6523     if (!check_num_args(args, 1))
6524         return NULL;
6525     other = PyTuple_GET_ITEM(args, 0);
6526     return (*func)(self, other);
6527 }
6528 
6529 static PyObject *
wrap_binaryfunc_r(PyObject * self,PyObject * args,void * wrapped)6530 wrap_binaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
6531 {
6532     binaryfunc func = (binaryfunc)wrapped;
6533     PyObject *other;
6534 
6535     if (!check_num_args(args, 1))
6536         return NULL;
6537     other = PyTuple_GET_ITEM(args, 0);
6538     return (*func)(other, self);
6539 }
6540 
6541 static PyObject *
wrap_ternaryfunc(PyObject * self,PyObject * args,void * wrapped)6542 wrap_ternaryfunc(PyObject *self, PyObject *args, void *wrapped)
6543 {
6544     ternaryfunc func = (ternaryfunc)wrapped;
6545     PyObject *other;
6546     PyObject *third = Py_None;
6547 
6548     /* Note: This wrapper only works for __pow__() */
6549 
6550     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
6551         return NULL;
6552     return (*func)(self, other, third);
6553 }
6554 
6555 static PyObject *
wrap_ternaryfunc_r(PyObject * self,PyObject * args,void * wrapped)6556 wrap_ternaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
6557 {
6558     ternaryfunc func = (ternaryfunc)wrapped;
6559     PyObject *other;
6560     PyObject *third = Py_None;
6561 
6562     /* Note: This wrapper only works for __pow__() */
6563 
6564     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
6565         return NULL;
6566     return (*func)(other, self, third);
6567 }
6568 
6569 static PyObject *
wrap_unaryfunc(PyObject * self,PyObject * args,void * wrapped)6570 wrap_unaryfunc(PyObject *self, PyObject *args, void *wrapped)
6571 {
6572     unaryfunc func = (unaryfunc)wrapped;
6573 
6574     if (!check_num_args(args, 0))
6575         return NULL;
6576     return (*func)(self);
6577 }
6578 
6579 static PyObject *
wrap_indexargfunc(PyObject * self,PyObject * args,void * wrapped)6580 wrap_indexargfunc(PyObject *self, PyObject *args, void *wrapped)
6581 {
6582     ssizeargfunc func = (ssizeargfunc)wrapped;
6583     PyObject* o;
6584     Py_ssize_t i;
6585 
6586     if (!PyArg_UnpackTuple(args, "", 1, 1, &o))
6587         return NULL;
6588     i = PyNumber_AsSsize_t(o, PyExc_OverflowError);
6589     if (i == -1 && PyErr_Occurred())
6590         return NULL;
6591     return (*func)(self, i);
6592 }
6593 
6594 static Py_ssize_t
getindex(PyObject * self,PyObject * arg)6595 getindex(PyObject *self, PyObject *arg)
6596 {
6597     Py_ssize_t i;
6598 
6599     i = PyNumber_AsSsize_t(arg, PyExc_OverflowError);
6600     if (i == -1 && PyErr_Occurred())
6601         return -1;
6602     if (i < 0) {
6603         PySequenceMethods *sq = Py_TYPE(self)->tp_as_sequence;
6604         if (sq && sq->sq_length) {
6605             Py_ssize_t n = (*sq->sq_length)(self);
6606             if (n < 0) {
6607                 assert(PyErr_Occurred());
6608                 return -1;
6609             }
6610             i += n;
6611         }
6612     }
6613     return i;
6614 }
6615 
6616 static PyObject *
wrap_sq_item(PyObject * self,PyObject * args,void * wrapped)6617 wrap_sq_item(PyObject *self, PyObject *args, void *wrapped)
6618 {
6619     ssizeargfunc func = (ssizeargfunc)wrapped;
6620     PyObject *arg;
6621     Py_ssize_t i;
6622 
6623     if (PyTuple_GET_SIZE(args) == 1) {
6624         arg = PyTuple_GET_ITEM(args, 0);
6625         i = getindex(self, arg);
6626         if (i == -1 && PyErr_Occurred())
6627             return NULL;
6628         return (*func)(self, i);
6629     }
6630     check_num_args(args, 1);
6631     assert(PyErr_Occurred());
6632     return NULL;
6633 }
6634 
6635 static PyObject *
wrap_sq_setitem(PyObject * self,PyObject * args,void * wrapped)6636 wrap_sq_setitem(PyObject *self, PyObject *args, void *wrapped)
6637 {
6638     ssizeobjargproc func = (ssizeobjargproc)wrapped;
6639     Py_ssize_t i;
6640     int res;
6641     PyObject *arg, *value;
6642 
6643     if (!PyArg_UnpackTuple(args, "", 2, 2, &arg, &value))
6644         return NULL;
6645     i = getindex(self, arg);
6646     if (i == -1 && PyErr_Occurred())
6647         return NULL;
6648     res = (*func)(self, i, value);
6649     if (res == -1 && PyErr_Occurred())
6650         return NULL;
6651     Py_RETURN_NONE;
6652 }
6653 
6654 static PyObject *
wrap_sq_delitem(PyObject * self,PyObject * args,void * wrapped)6655 wrap_sq_delitem(PyObject *self, PyObject *args, void *wrapped)
6656 {
6657     ssizeobjargproc func = (ssizeobjargproc)wrapped;
6658     Py_ssize_t i;
6659     int res;
6660     PyObject *arg;
6661 
6662     if (!check_num_args(args, 1))
6663         return NULL;
6664     arg = PyTuple_GET_ITEM(args, 0);
6665     i = getindex(self, arg);
6666     if (i == -1 && PyErr_Occurred())
6667         return NULL;
6668     res = (*func)(self, i, NULL);
6669     if (res == -1 && PyErr_Occurred())
6670         return NULL;
6671     Py_RETURN_NONE;
6672 }
6673 
6674 /* XXX objobjproc is a misnomer; should be objargpred */
6675 static PyObject *
wrap_objobjproc(PyObject * self,PyObject * args,void * wrapped)6676 wrap_objobjproc(PyObject *self, PyObject *args, void *wrapped)
6677 {
6678     objobjproc func = (objobjproc)wrapped;
6679     int res;
6680     PyObject *value;
6681 
6682     if (!check_num_args(args, 1))
6683         return NULL;
6684     value = PyTuple_GET_ITEM(args, 0);
6685     res = (*func)(self, value);
6686     if (res == -1 && PyErr_Occurred())
6687         return NULL;
6688     else
6689         return PyBool_FromLong(res);
6690 }
6691 
6692 static PyObject *
wrap_objobjargproc(PyObject * self,PyObject * args,void * wrapped)6693 wrap_objobjargproc(PyObject *self, PyObject *args, void *wrapped)
6694 {
6695     objobjargproc func = (objobjargproc)wrapped;
6696     int res;
6697     PyObject *key, *value;
6698 
6699     if (!PyArg_UnpackTuple(args, "", 2, 2, &key, &value))
6700         return NULL;
6701     res = (*func)(self, key, value);
6702     if (res == -1 && PyErr_Occurred())
6703         return NULL;
6704     Py_RETURN_NONE;
6705 }
6706 
6707 static PyObject *
wrap_delitem(PyObject * self,PyObject * args,void * wrapped)6708 wrap_delitem(PyObject *self, PyObject *args, void *wrapped)
6709 {
6710     objobjargproc func = (objobjargproc)wrapped;
6711     int res;
6712     PyObject *key;
6713 
6714     if (!check_num_args(args, 1))
6715         return NULL;
6716     key = PyTuple_GET_ITEM(args, 0);
6717     res = (*func)(self, key, NULL);
6718     if (res == -1 && PyErr_Occurred())
6719         return NULL;
6720     Py_RETURN_NONE;
6721 }
6722 
6723 /* Helper to check for object.__setattr__ or __delattr__ applied to a type.
6724    This is called the Carlo Verre hack after its discoverer.  See
6725    https://mail.python.org/pipermail/python-dev/2003-April/034535.html
6726    */
6727 static int
hackcheck(PyObject * self,setattrofunc func,const char * what)6728 hackcheck(PyObject *self, setattrofunc func, const char *what)
6729 {
6730     PyTypeObject *type = Py_TYPE(self);
6731     PyObject *mro = type->tp_mro;
6732     if (!mro) {
6733         /* Probably ok not to check the call in this case. */
6734         return 1;
6735     }
6736     assert(PyTuple_Check(mro));
6737 
6738     /* Find the (base) type that defined the type's slot function. */
6739     PyTypeObject *defining_type = type;
6740     Py_ssize_t i;
6741     for (i = PyTuple_GET_SIZE(mro) - 1; i >= 0; i--) {
6742         PyTypeObject *base = (PyTypeObject*) PyTuple_GET_ITEM(mro, i);
6743         if (base->tp_setattro == slot_tp_setattro) {
6744             /* Ignore Python classes:
6745                they never define their own C-level setattro. */
6746         }
6747         else if (base->tp_setattro == type->tp_setattro) {
6748             defining_type = base;
6749             break;
6750         }
6751     }
6752 
6753     /* Reject calls that jump over intermediate C-level overrides. */
6754     for (PyTypeObject *base = defining_type; base; base = base->tp_base) {
6755         if (base->tp_setattro == func) {
6756             /* 'func' is the right slot function to call. */
6757             break;
6758         }
6759         else if (base->tp_setattro != slot_tp_setattro) {
6760             /* 'base' is not a Python class and overrides 'func'.
6761                Its tp_setattro should be called instead. */
6762             PyErr_Format(PyExc_TypeError,
6763                          "can't apply this %s to %s object",
6764                          what,
6765                          type->tp_name);
6766             return 0;
6767         }
6768     }
6769     return 1;
6770 }
6771 
6772 static PyObject *
wrap_setattr(PyObject * self,PyObject * args,void * wrapped)6773 wrap_setattr(PyObject *self, PyObject *args, void *wrapped)
6774 {
6775     setattrofunc func = (setattrofunc)wrapped;
6776     int res;
6777     PyObject *name, *value;
6778 
6779     if (!PyArg_UnpackTuple(args, "", 2, 2, &name, &value))
6780         return NULL;
6781     if (!hackcheck(self, func, "__setattr__"))
6782         return NULL;
6783     res = (*func)(self, name, value);
6784     if (res < 0)
6785         return NULL;
6786     Py_RETURN_NONE;
6787 }
6788 
6789 static PyObject *
wrap_delattr(PyObject * self,PyObject * args,void * wrapped)6790 wrap_delattr(PyObject *self, PyObject *args, void *wrapped)
6791 {
6792     setattrofunc func = (setattrofunc)wrapped;
6793     int res;
6794     PyObject *name;
6795 
6796     if (!check_num_args(args, 1))
6797         return NULL;
6798     name = PyTuple_GET_ITEM(args, 0);
6799     if (!hackcheck(self, func, "__delattr__"))
6800         return NULL;
6801     res = (*func)(self, name, NULL);
6802     if (res < 0)
6803         return NULL;
6804     Py_RETURN_NONE;
6805 }
6806 
6807 static PyObject *
wrap_hashfunc(PyObject * self,PyObject * args,void * wrapped)6808 wrap_hashfunc(PyObject *self, PyObject *args, void *wrapped)
6809 {
6810     hashfunc func = (hashfunc)wrapped;
6811     Py_hash_t res;
6812 
6813     if (!check_num_args(args, 0))
6814         return NULL;
6815     res = (*func)(self);
6816     if (res == -1 && PyErr_Occurred())
6817         return NULL;
6818     return PyLong_FromSsize_t(res);
6819 }
6820 
6821 static PyObject *
wrap_call(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)6822 wrap_call(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
6823 {
6824     ternaryfunc func = (ternaryfunc)wrapped;
6825 
6826     return (*func)(self, args, kwds);
6827 }
6828 
6829 static PyObject *
wrap_del(PyObject * self,PyObject * args,void * wrapped)6830 wrap_del(PyObject *self, PyObject *args, void *wrapped)
6831 {
6832     destructor func = (destructor)wrapped;
6833 
6834     if (!check_num_args(args, 0))
6835         return NULL;
6836 
6837     (*func)(self);
6838     Py_RETURN_NONE;
6839 }
6840 
6841 static PyObject *
wrap_richcmpfunc(PyObject * self,PyObject * args,void * wrapped,int op)6842 wrap_richcmpfunc(PyObject *self, PyObject *args, void *wrapped, int op)
6843 {
6844     richcmpfunc func = (richcmpfunc)wrapped;
6845     PyObject *other;
6846 
6847     if (!check_num_args(args, 1))
6848         return NULL;
6849     other = PyTuple_GET_ITEM(args, 0);
6850     return (*func)(self, other, op);
6851 }
6852 
6853 #undef RICHCMP_WRAPPER
6854 #define RICHCMP_WRAPPER(NAME, OP) \
6855 static PyObject * \
6856 richcmp_##NAME(PyObject *self, PyObject *args, void *wrapped) \
6857 { \
6858     return wrap_richcmpfunc(self, args, wrapped, OP); \
6859 }
6860 
RICHCMP_WRAPPER(lt,Py_LT)6861 RICHCMP_WRAPPER(lt, Py_LT)
6862 RICHCMP_WRAPPER(le, Py_LE)
6863 RICHCMP_WRAPPER(eq, Py_EQ)
6864 RICHCMP_WRAPPER(ne, Py_NE)
6865 RICHCMP_WRAPPER(gt, Py_GT)
6866 RICHCMP_WRAPPER(ge, Py_GE)
6867 
6868 static PyObject *
6869 wrap_next(PyObject *self, PyObject *args, void *wrapped)
6870 {
6871     unaryfunc func = (unaryfunc)wrapped;
6872     PyObject *res;
6873 
6874     if (!check_num_args(args, 0))
6875         return NULL;
6876     res = (*func)(self);
6877     if (res == NULL && !PyErr_Occurred())
6878         PyErr_SetNone(PyExc_StopIteration);
6879     return res;
6880 }
6881 
6882 static PyObject *
wrap_descr_get(PyObject * self,PyObject * args,void * wrapped)6883 wrap_descr_get(PyObject *self, PyObject *args, void *wrapped)
6884 {
6885     descrgetfunc func = (descrgetfunc)wrapped;
6886     PyObject *obj;
6887     PyObject *type = NULL;
6888 
6889     if (!PyArg_UnpackTuple(args, "", 1, 2, &obj, &type))
6890         return NULL;
6891     if (obj == Py_None)
6892         obj = NULL;
6893     if (type == Py_None)
6894         type = NULL;
6895     if (type == NULL &&obj == NULL) {
6896         PyErr_SetString(PyExc_TypeError,
6897                         "__get__(None, None) is invalid");
6898         return NULL;
6899     }
6900     return (*func)(self, obj, type);
6901 }
6902 
6903 static PyObject *
wrap_descr_set(PyObject * self,PyObject * args,void * wrapped)6904 wrap_descr_set(PyObject *self, PyObject *args, void *wrapped)
6905 {
6906     descrsetfunc func = (descrsetfunc)wrapped;
6907     PyObject *obj, *value;
6908     int ret;
6909 
6910     if (!PyArg_UnpackTuple(args, "", 2, 2, &obj, &value))
6911         return NULL;
6912     ret = (*func)(self, obj, value);
6913     if (ret < 0)
6914         return NULL;
6915     Py_RETURN_NONE;
6916 }
6917 
6918 static PyObject *
wrap_descr_delete(PyObject * self,PyObject * args,void * wrapped)6919 wrap_descr_delete(PyObject *self, PyObject *args, void *wrapped)
6920 {
6921     descrsetfunc func = (descrsetfunc)wrapped;
6922     PyObject *obj;
6923     int ret;
6924 
6925     if (!check_num_args(args, 1))
6926         return NULL;
6927     obj = PyTuple_GET_ITEM(args, 0);
6928     ret = (*func)(self, obj, NULL);
6929     if (ret < 0)
6930         return NULL;
6931     Py_RETURN_NONE;
6932 }
6933 
6934 static PyObject *
wrap_init(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)6935 wrap_init(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
6936 {
6937     initproc func = (initproc)wrapped;
6938 
6939     if (func(self, args, kwds) < 0)
6940         return NULL;
6941     Py_RETURN_NONE;
6942 }
6943 
6944 static PyObject *
tp_new_wrapper(PyObject * self,PyObject * args,PyObject * kwds)6945 tp_new_wrapper(PyObject *self, PyObject *args, PyObject *kwds)
6946 {
6947     PyTypeObject *type, *subtype, *staticbase;
6948     PyObject *arg0, *res;
6949 
6950     if (self == NULL || !PyType_Check(self)) {
6951         PyErr_Format(PyExc_SystemError,
6952                      "__new__() called with non-type 'self'");
6953         return NULL;
6954     }
6955     type = (PyTypeObject *)self;
6956 
6957     if (!PyTuple_Check(args) || PyTuple_GET_SIZE(args) < 1) {
6958         PyErr_Format(PyExc_TypeError,
6959                      "%s.__new__(): not enough arguments",
6960                      type->tp_name);
6961         return NULL;
6962     }
6963     arg0 = PyTuple_GET_ITEM(args, 0);
6964     if (!PyType_Check(arg0)) {
6965         PyErr_Format(PyExc_TypeError,
6966                      "%s.__new__(X): X is not a type object (%s)",
6967                      type->tp_name,
6968                      Py_TYPE(arg0)->tp_name);
6969         return NULL;
6970     }
6971     subtype = (PyTypeObject *)arg0;
6972     if (!PyType_IsSubtype(subtype, type)) {
6973         PyErr_Format(PyExc_TypeError,
6974                      "%s.__new__(%s): %s is not a subtype of %s",
6975                      type->tp_name,
6976                      subtype->tp_name,
6977                      subtype->tp_name,
6978                      type->tp_name);
6979         return NULL;
6980     }
6981 
6982     /* Check that the use doesn't do something silly and unsafe like
6983        object.__new__(dict).  To do this, we check that the
6984        most derived base that's not a heap type is this type. */
6985     staticbase = subtype;
6986     while (staticbase && (staticbase->tp_new == slot_tp_new))
6987         staticbase = staticbase->tp_base;
6988     /* If staticbase is NULL now, it is a really weird type.
6989        In the spirit of backwards compatibility (?), just shut up. */
6990     if (staticbase && staticbase->tp_new != type->tp_new) {
6991         PyErr_Format(PyExc_TypeError,
6992                      "%s.__new__(%s) is not safe, use %s.__new__()",
6993                      type->tp_name,
6994                      subtype->tp_name,
6995                      staticbase->tp_name);
6996         return NULL;
6997     }
6998 
6999     args = PyTuple_GetSlice(args, 1, PyTuple_GET_SIZE(args));
7000     if (args == NULL)
7001         return NULL;
7002     res = type->tp_new(subtype, args, kwds);
7003     Py_DECREF(args);
7004     return res;
7005 }
7006 
7007 static struct PyMethodDef tp_new_methoddef[] = {
7008     {"__new__", (PyCFunction)(void(*)(void))tp_new_wrapper, METH_VARARGS|METH_KEYWORDS,
7009      PyDoc_STR("__new__($type, *args, **kwargs)\n--\n\n"
7010                "Create and return a new object.  "
7011                "See help(type) for accurate signature.")},
7012     {0}
7013 };
7014 
7015 static int
add_tp_new_wrapper(PyTypeObject * type)7016 add_tp_new_wrapper(PyTypeObject *type)
7017 {
7018     int r = _PyDict_ContainsId(type->tp_dict, &PyId___new__);
7019     if (r > 0) {
7020         return 0;
7021     }
7022     if (r < 0) {
7023         return -1;
7024     }
7025 
7026     PyObject *func = PyCFunction_NewEx(tp_new_methoddef, (PyObject *)type, NULL);
7027     if (func == NULL) {
7028         return -1;
7029     }
7030     r = _PyDict_SetItemId(type->tp_dict, &PyId___new__, func);
7031     Py_DECREF(func);
7032     return r;
7033 }
7034 
7035 /* Slot wrappers that call the corresponding __foo__ slot.  See comments
7036    below at override_slots() for more explanation. */
7037 
7038 #define SLOT0(FUNCNAME, OPSTR) \
7039 static PyObject * \
7040 FUNCNAME(PyObject *self) \
7041 { \
7042     PyObject* stack[1] = {self}; \
7043     _Py_static_string(id, OPSTR); \
7044     return vectorcall_method(&id, stack, 1); \
7045 }
7046 
7047 #define SLOT1(FUNCNAME, OPSTR, ARG1TYPE) \
7048 static PyObject * \
7049 FUNCNAME(PyObject *self, ARG1TYPE arg1) \
7050 { \
7051     PyObject* stack[2] = {self, arg1}; \
7052     _Py_static_string(id, OPSTR); \
7053     return vectorcall_method(&id, stack, 2); \
7054 }
7055 
7056 /* Boolean helper for SLOT1BINFULL().
7057    right.__class__ is a nontrivial subclass of left.__class__. */
7058 static int
method_is_overloaded(PyObject * left,PyObject * right,struct _Py_Identifier * name)7059 method_is_overloaded(PyObject *left, PyObject *right, struct _Py_Identifier *name)
7060 {
7061     PyObject *a, *b;
7062     int ok;
7063 
7064     if (_PyObject_LookupAttrId((PyObject *)(Py_TYPE(right)), name, &b) < 0) {
7065         return -1;
7066     }
7067     if (b == NULL) {
7068         /* If right doesn't have it, it's not overloaded */
7069         return 0;
7070     }
7071 
7072     if (_PyObject_LookupAttrId((PyObject *)(Py_TYPE(left)), name, &a) < 0) {
7073         Py_DECREF(b);
7074         return -1;
7075     }
7076     if (a == NULL) {
7077         Py_DECREF(b);
7078         /* If right has it but left doesn't, it's overloaded */
7079         return 1;
7080     }
7081 
7082     ok = PyObject_RichCompareBool(a, b, Py_NE);
7083     Py_DECREF(a);
7084     Py_DECREF(b);
7085     return ok;
7086 }
7087 
7088 
7089 #define SLOT1BINFULL(FUNCNAME, TESTFUNC, SLOTNAME, OPSTR, ROPSTR) \
7090 static PyObject * \
7091 FUNCNAME(PyObject *self, PyObject *other) \
7092 { \
7093     PyObject* stack[2]; \
7094     PyThreadState *tstate = _PyThreadState_GET(); \
7095     _Py_static_string(op_id, OPSTR); \
7096     _Py_static_string(rop_id, ROPSTR); \
7097     int do_other = !Py_IS_TYPE(self, Py_TYPE(other)) && \
7098         Py_TYPE(other)->tp_as_number != NULL && \
7099         Py_TYPE(other)->tp_as_number->SLOTNAME == TESTFUNC; \
7100     if (Py_TYPE(self)->tp_as_number != NULL && \
7101         Py_TYPE(self)->tp_as_number->SLOTNAME == TESTFUNC) { \
7102         PyObject *r; \
7103         if (do_other && PyType_IsSubtype(Py_TYPE(other), Py_TYPE(self))) { \
7104             int ok = method_is_overloaded(self, other, &rop_id); \
7105             if (ok < 0) { \
7106                 return NULL; \
7107             } \
7108             if (ok) { \
7109                 stack[0] = other; \
7110                 stack[1] = self; \
7111                 r = vectorcall_maybe(tstate, &rop_id, stack, 2); \
7112                 if (r != Py_NotImplemented) \
7113                     return r; \
7114                 Py_DECREF(r); \
7115                 do_other = 0; \
7116             } \
7117         } \
7118         stack[0] = self; \
7119         stack[1] = other; \
7120         r = vectorcall_maybe(tstate, &op_id, stack, 2); \
7121         if (r != Py_NotImplemented || \
7122             Py_IS_TYPE(other, Py_TYPE(self))) \
7123             return r; \
7124         Py_DECREF(r); \
7125     } \
7126     if (do_other) { \
7127         stack[0] = other; \
7128         stack[1] = self; \
7129         return vectorcall_maybe(tstate, &rop_id, stack, 2); \
7130     } \
7131     Py_RETURN_NOTIMPLEMENTED; \
7132 }
7133 
7134 #define SLOT1BIN(FUNCNAME, SLOTNAME, OPSTR, ROPSTR) \
7135     SLOT1BINFULL(FUNCNAME, FUNCNAME, SLOTNAME, OPSTR, ROPSTR)
7136 
7137 static Py_ssize_t
slot_sq_length(PyObject * self)7138 slot_sq_length(PyObject *self)
7139 {
7140     PyObject* stack[1] = {self};
7141     PyObject *res = vectorcall_method(&PyId___len__, stack, 1);
7142     Py_ssize_t len;
7143 
7144     if (res == NULL)
7145         return -1;
7146 
7147     Py_SETREF(res, _PyNumber_Index(res));
7148     if (res == NULL)
7149         return -1;
7150 
7151     assert(PyLong_Check(res));
7152     if (Py_SIZE(res) < 0) {
7153         Py_DECREF(res);
7154         PyErr_SetString(PyExc_ValueError,
7155                         "__len__() should return >= 0");
7156         return -1;
7157     }
7158 
7159     len = PyNumber_AsSsize_t(res, PyExc_OverflowError);
7160     assert(len >= 0 || PyErr_ExceptionMatches(PyExc_OverflowError));
7161     Py_DECREF(res);
7162     return len;
7163 }
7164 
7165 static PyObject *
slot_sq_item(PyObject * self,Py_ssize_t i)7166 slot_sq_item(PyObject *self, Py_ssize_t i)
7167 {
7168     PyObject *ival = PyLong_FromSsize_t(i);
7169     if (ival == NULL) {
7170         return NULL;
7171     }
7172     PyObject *stack[2] = {self, ival};
7173     PyObject *retval = vectorcall_method(&PyId___getitem__, stack, 2);
7174     Py_DECREF(ival);
7175     return retval;
7176 }
7177 
7178 static int
slot_sq_ass_item(PyObject * self,Py_ssize_t index,PyObject * value)7179 slot_sq_ass_item(PyObject *self, Py_ssize_t index, PyObject *value)
7180 {
7181     PyObject *stack[3];
7182     PyObject *res;
7183     PyObject *index_obj;
7184 
7185     index_obj = PyLong_FromSsize_t(index);
7186     if (index_obj == NULL) {
7187         return -1;
7188     }
7189 
7190     stack[0] = self;
7191     stack[1] = index_obj;
7192     if (value == NULL) {
7193         res = vectorcall_method(&PyId___delitem__, stack, 2);
7194     }
7195     else {
7196         stack[2] = value;
7197         res = vectorcall_method(&PyId___setitem__, stack, 3);
7198     }
7199     Py_DECREF(index_obj);
7200 
7201     if (res == NULL) {
7202         return -1;
7203     }
7204     Py_DECREF(res);
7205     return 0;
7206 }
7207 
7208 static int
slot_sq_contains(PyObject * self,PyObject * value)7209 slot_sq_contains(PyObject *self, PyObject *value)
7210 {
7211     PyThreadState *tstate = _PyThreadState_GET();
7212     PyObject *func, *res;
7213     int result = -1, unbound;
7214     _Py_IDENTIFIER(__contains__);
7215 
7216     func = lookup_maybe_method(self, &PyId___contains__, &unbound);
7217     if (func == Py_None) {
7218         Py_DECREF(func);
7219         PyErr_Format(PyExc_TypeError,
7220                      "'%.200s' object is not a container",
7221                      Py_TYPE(self)->tp_name);
7222         return -1;
7223     }
7224     if (func != NULL) {
7225         PyObject *args[2] = {self, value};
7226         res = vectorcall_unbound(tstate, unbound, func, args, 2);
7227         Py_DECREF(func);
7228         if (res != NULL) {
7229             result = PyObject_IsTrue(res);
7230             Py_DECREF(res);
7231         }
7232     }
7233     else if (! PyErr_Occurred()) {
7234         /* Possible results: -1 and 1 */
7235         result = (int)_PySequence_IterSearch(self, value,
7236                                          PY_ITERSEARCH_CONTAINS);
7237     }
7238     return result;
7239 }
7240 
7241 #define slot_mp_length slot_sq_length
7242 
7243 SLOT1(slot_mp_subscript, "__getitem__", PyObject *)
7244 
7245 static int
slot_mp_ass_subscript(PyObject * self,PyObject * key,PyObject * value)7246 slot_mp_ass_subscript(PyObject *self, PyObject *key, PyObject *value)
7247 {
7248     PyObject *stack[3];
7249     PyObject *res;
7250 
7251     stack[0] = self;
7252     stack[1] = key;
7253     if (value == NULL) {
7254         res = vectorcall_method(&PyId___delitem__, stack, 2);
7255     }
7256     else {
7257         stack[2] = value;
7258         res = vectorcall_method(&PyId___setitem__, stack, 3);
7259     }
7260 
7261     if (res == NULL)
7262         return -1;
7263     Py_DECREF(res);
7264     return 0;
7265 }
7266 
7267 SLOT1BIN(slot_nb_add, nb_add, "__add__", "__radd__")
7268 SLOT1BIN(slot_nb_subtract, nb_subtract, "__sub__", "__rsub__")
7269 SLOT1BIN(slot_nb_multiply, nb_multiply, "__mul__", "__rmul__")
7270 SLOT1BIN(slot_nb_matrix_multiply, nb_matrix_multiply, "__matmul__", "__rmatmul__")
7271 SLOT1BIN(slot_nb_remainder, nb_remainder, "__mod__", "__rmod__")
7272 SLOT1BIN(slot_nb_divmod, nb_divmod, "__divmod__", "__rdivmod__")
7273 
7274 static PyObject *slot_nb_power(PyObject *, PyObject *, PyObject *);
7275 
7276 SLOT1BINFULL(slot_nb_power_binary, slot_nb_power,
7277              nb_power, "__pow__", "__rpow__")
7278 
7279 static PyObject *
slot_nb_power(PyObject * self,PyObject * other,PyObject * modulus)7280 slot_nb_power(PyObject *self, PyObject *other, PyObject *modulus)
7281 {
7282     _Py_IDENTIFIER(__pow__);
7283 
7284     if (modulus == Py_None)
7285         return slot_nb_power_binary(self, other);
7286     /* Three-arg power doesn't use __rpow__.  But ternary_op
7287        can call this when the second argument's type uses
7288        slot_nb_power, so check before calling self.__pow__. */
7289     if (Py_TYPE(self)->tp_as_number != NULL &&
7290         Py_TYPE(self)->tp_as_number->nb_power == slot_nb_power) {
7291         PyObject* stack[3] = {self, other, modulus};
7292         return vectorcall_method(&PyId___pow__, stack, 3);
7293     }
7294     Py_RETURN_NOTIMPLEMENTED;
7295 }
7296 
7297 SLOT0(slot_nb_negative, "__neg__")
7298 SLOT0(slot_nb_positive, "__pos__")
7299 SLOT0(slot_nb_absolute, "__abs__")
7300 
7301 static int
slot_nb_bool(PyObject * self)7302 slot_nb_bool(PyObject *self)
7303 {
7304     PyObject *func, *value;
7305     int result, unbound;
7306     int using_len = 0;
7307     _Py_IDENTIFIER(__bool__);
7308 
7309     func = lookup_maybe_method(self, &PyId___bool__, &unbound);
7310     if (func == NULL) {
7311         if (PyErr_Occurred()) {
7312             return -1;
7313         }
7314 
7315         func = lookup_maybe_method(self, &PyId___len__, &unbound);
7316         if (func == NULL) {
7317             if (PyErr_Occurred()) {
7318                 return -1;
7319             }
7320             return 1;
7321         }
7322         using_len = 1;
7323     }
7324 
7325     value = call_unbound_noarg(unbound, func, self);
7326     if (value == NULL) {
7327         goto error;
7328     }
7329 
7330     if (using_len) {
7331         /* bool type enforced by slot_nb_len */
7332         result = PyObject_IsTrue(value);
7333     }
7334     else if (PyBool_Check(value)) {
7335         result = PyObject_IsTrue(value);
7336     }
7337     else {
7338         PyErr_Format(PyExc_TypeError,
7339                      "__bool__ should return "
7340                      "bool, returned %s",
7341                      Py_TYPE(value)->tp_name);
7342         result = -1;
7343     }
7344 
7345     Py_DECREF(value);
7346     Py_DECREF(func);
7347     return result;
7348 
7349 error:
7350     Py_DECREF(func);
7351     return -1;
7352 }
7353 
7354 
7355 static PyObject *
slot_nb_index(PyObject * self)7356 slot_nb_index(PyObject *self)
7357 {
7358     _Py_IDENTIFIER(__index__);
7359     PyObject *stack[1] = {self};
7360     return vectorcall_method(&PyId___index__, stack, 1);
7361 }
7362 
7363 
7364 SLOT0(slot_nb_invert, "__invert__")
7365 SLOT1BIN(slot_nb_lshift, nb_lshift, "__lshift__", "__rlshift__")
7366 SLOT1BIN(slot_nb_rshift, nb_rshift, "__rshift__", "__rrshift__")
7367 SLOT1BIN(slot_nb_and, nb_and, "__and__", "__rand__")
7368 SLOT1BIN(slot_nb_xor, nb_xor, "__xor__", "__rxor__")
7369 SLOT1BIN(slot_nb_or, nb_or, "__or__", "__ror__")
7370 
7371 SLOT0(slot_nb_int, "__int__")
7372 SLOT0(slot_nb_float, "__float__")
7373 SLOT1(slot_nb_inplace_add, "__iadd__", PyObject *)
7374 SLOT1(slot_nb_inplace_subtract, "__isub__", PyObject *)
7375 SLOT1(slot_nb_inplace_multiply, "__imul__", PyObject *)
7376 SLOT1(slot_nb_inplace_matrix_multiply, "__imatmul__", PyObject *)
7377 SLOT1(slot_nb_inplace_remainder, "__imod__", PyObject *)
7378 /* Can't use SLOT1 here, because nb_inplace_power is ternary */
7379 static PyObject *
slot_nb_inplace_power(PyObject * self,PyObject * arg1,PyObject * arg2)7380 slot_nb_inplace_power(PyObject *self, PyObject * arg1, PyObject *arg2)
7381 {
7382     PyObject *stack[2] = {self, arg1};
7383     _Py_IDENTIFIER(__ipow__);
7384     return vectorcall_method(&PyId___ipow__, stack, 2);
7385 }
7386 SLOT1(slot_nb_inplace_lshift, "__ilshift__", PyObject *)
7387 SLOT1(slot_nb_inplace_rshift, "__irshift__", PyObject *)
7388 SLOT1(slot_nb_inplace_and, "__iand__", PyObject *)
7389 SLOT1(slot_nb_inplace_xor, "__ixor__", PyObject *)
7390 SLOT1(slot_nb_inplace_or, "__ior__", PyObject *)
7391 SLOT1BIN(slot_nb_floor_divide, nb_floor_divide,
7392          "__floordiv__", "__rfloordiv__")
7393 SLOT1BIN(slot_nb_true_divide, nb_true_divide, "__truediv__", "__rtruediv__")
7394 SLOT1(slot_nb_inplace_floor_divide, "__ifloordiv__", PyObject *)
7395 SLOT1(slot_nb_inplace_true_divide, "__itruediv__", PyObject *)
7396 
7397 static PyObject *
slot_tp_repr(PyObject * self)7398 slot_tp_repr(PyObject *self)
7399 {
7400     PyObject *func, *res;
7401     _Py_IDENTIFIER(__repr__);
7402     int unbound;
7403 
7404     func = lookup_maybe_method(self, &PyId___repr__, &unbound);
7405     if (func != NULL) {
7406         res = call_unbound_noarg(unbound, func, self);
7407         Py_DECREF(func);
7408         return res;
7409     }
7410     PyErr_Clear();
7411     return PyUnicode_FromFormat("<%s object at %p>",
7412                                Py_TYPE(self)->tp_name, self);
7413 }
7414 
7415 SLOT0(slot_tp_str, "__str__")
7416 
7417 static Py_hash_t
slot_tp_hash(PyObject * self)7418 slot_tp_hash(PyObject *self)
7419 {
7420     PyObject *func, *res;
7421     Py_ssize_t h;
7422     int unbound;
7423 
7424     func = lookup_maybe_method(self, &PyId___hash__, &unbound);
7425 
7426     if (func == Py_None) {
7427         Py_DECREF(func);
7428         func = NULL;
7429     }
7430 
7431     if (func == NULL) {
7432         return PyObject_HashNotImplemented(self);
7433     }
7434 
7435     res = call_unbound_noarg(unbound, func, self);
7436     Py_DECREF(func);
7437     if (res == NULL)
7438         return -1;
7439 
7440     if (!PyLong_Check(res)) {
7441         PyErr_SetString(PyExc_TypeError,
7442                         "__hash__ method should return an integer");
7443         return -1;
7444     }
7445     /* Transform the PyLong `res` to a Py_hash_t `h`.  For an existing
7446        hashable Python object x, hash(x) will always lie within the range of
7447        Py_hash_t.  Therefore our transformation must preserve values that
7448        already lie within this range, to ensure that if x.__hash__() returns
7449        hash(y) then hash(x) == hash(y). */
7450     h = PyLong_AsSsize_t(res);
7451     if (h == -1 && PyErr_Occurred()) {
7452         /* res was not within the range of a Py_hash_t, so we're free to
7453            use any sufficiently bit-mixing transformation;
7454            long.__hash__ will do nicely. */
7455         PyErr_Clear();
7456         h = PyLong_Type.tp_hash(res);
7457     }
7458     /* -1 is reserved for errors. */
7459     if (h == -1)
7460         h = -2;
7461     Py_DECREF(res);
7462     return h;
7463 }
7464 
7465 static PyObject *
slot_tp_call(PyObject * self,PyObject * args,PyObject * kwds)7466 slot_tp_call(PyObject *self, PyObject *args, PyObject *kwds)
7467 {
7468     PyThreadState *tstate = _PyThreadState_GET();
7469     _Py_IDENTIFIER(__call__);
7470     int unbound;
7471 
7472     PyObject *meth = lookup_method(self, &PyId___call__, &unbound);
7473     if (meth == NULL) {
7474         return NULL;
7475     }
7476 
7477     PyObject *res;
7478     if (unbound) {
7479         res = _PyObject_Call_Prepend(tstate, meth, self, args, kwds);
7480     }
7481     else {
7482         res = _PyObject_Call(tstate, meth, args, kwds);
7483     }
7484 
7485     Py_DECREF(meth);
7486     return res;
7487 }
7488 
7489 /* There are two slot dispatch functions for tp_getattro.
7490 
7491    - slot_tp_getattro() is used when __getattribute__ is overridden
7492      but no __getattr__ hook is present;
7493 
7494    - slot_tp_getattr_hook() is used when a __getattr__ hook is present.
7495 
7496    The code in update_one_slot() always installs slot_tp_getattr_hook(); this
7497    detects the absence of __getattr__ and then installs the simpler slot if
7498    necessary. */
7499 
7500 static PyObject *
slot_tp_getattro(PyObject * self,PyObject * name)7501 slot_tp_getattro(PyObject *self, PyObject *name)
7502 {
7503     PyObject *stack[2] = {self, name};
7504     return vectorcall_method(&PyId___getattribute__, stack, 2);
7505 }
7506 
7507 static PyObject *
call_attribute(PyObject * self,PyObject * attr,PyObject * name)7508 call_attribute(PyObject *self, PyObject *attr, PyObject *name)
7509 {
7510     PyObject *res, *descr = NULL;
7511     descrgetfunc f = Py_TYPE(attr)->tp_descr_get;
7512 
7513     if (f != NULL) {
7514         descr = f(attr, self, (PyObject *)(Py_TYPE(self)));
7515         if (descr == NULL)
7516             return NULL;
7517         else
7518             attr = descr;
7519     }
7520     res = PyObject_CallOneArg(attr, name);
7521     Py_XDECREF(descr);
7522     return res;
7523 }
7524 
7525 static PyObject *
slot_tp_getattr_hook(PyObject * self,PyObject * name)7526 slot_tp_getattr_hook(PyObject *self, PyObject *name)
7527 {
7528     PyTypeObject *tp = Py_TYPE(self);
7529     PyObject *getattr, *getattribute, *res;
7530     _Py_IDENTIFIER(__getattr__);
7531 
7532     /* speed hack: we could use lookup_maybe, but that would resolve the
7533        method fully for each attribute lookup for classes with
7534        __getattr__, even when the attribute is present. So we use
7535        _PyType_Lookup and create the method only when needed, with
7536        call_attribute. */
7537     getattr = _PyType_LookupId(tp, &PyId___getattr__);
7538     if (getattr == NULL) {
7539         /* No __getattr__ hook: use a simpler dispatcher */
7540         tp->tp_getattro = slot_tp_getattro;
7541         return slot_tp_getattro(self, name);
7542     }
7543     Py_INCREF(getattr);
7544     /* speed hack: we could use lookup_maybe, but that would resolve the
7545        method fully for each attribute lookup for classes with
7546        __getattr__, even when self has the default __getattribute__
7547        method. So we use _PyType_Lookup and create the method only when
7548        needed, with call_attribute. */
7549     getattribute = _PyType_LookupId(tp, &PyId___getattribute__);
7550     if (getattribute == NULL ||
7551         (Py_IS_TYPE(getattribute, &PyWrapperDescr_Type) &&
7552          ((PyWrapperDescrObject *)getattribute)->d_wrapped ==
7553          (void *)PyObject_GenericGetAttr))
7554         res = PyObject_GenericGetAttr(self, name);
7555     else {
7556         Py_INCREF(getattribute);
7557         res = call_attribute(self, getattribute, name);
7558         Py_DECREF(getattribute);
7559     }
7560     if (res == NULL && PyErr_ExceptionMatches(PyExc_AttributeError)) {
7561         PyErr_Clear();
7562         res = call_attribute(self, getattr, name);
7563     }
7564     Py_DECREF(getattr);
7565     return res;
7566 }
7567 
7568 static int
slot_tp_setattro(PyObject * self,PyObject * name,PyObject * value)7569 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value)
7570 {
7571     PyObject *stack[3];
7572     PyObject *res;
7573     _Py_IDENTIFIER(__delattr__);
7574     _Py_IDENTIFIER(__setattr__);
7575 
7576     stack[0] = self;
7577     stack[1] = name;
7578     if (value == NULL) {
7579         res = vectorcall_method(&PyId___delattr__, stack, 2);
7580     }
7581     else {
7582         stack[2] = value;
7583         res = vectorcall_method(&PyId___setattr__, stack, 3);
7584     }
7585     if (res == NULL)
7586         return -1;
7587     Py_DECREF(res);
7588     return 0;
7589 }
7590 
7591 static _Py_Identifier name_op[] = {
7592     _Py_static_string_init("__lt__"),
7593     _Py_static_string_init("__le__"),
7594     _Py_static_string_init("__eq__"),
7595     _Py_static_string_init("__ne__"),
7596     _Py_static_string_init("__gt__"),
7597     _Py_static_string_init("__ge__"),
7598 };
7599 
7600 static PyObject *
slot_tp_richcompare(PyObject * self,PyObject * other,int op)7601 slot_tp_richcompare(PyObject *self, PyObject *other, int op)
7602 {
7603     PyThreadState *tstate = _PyThreadState_GET();
7604 
7605     int unbound;
7606     PyObject *func = lookup_maybe_method(self, &name_op[op], &unbound);
7607     if (func == NULL) {
7608         PyErr_Clear();
7609         Py_RETURN_NOTIMPLEMENTED;
7610     }
7611 
7612     PyObject *stack[2] = {self, other};
7613     PyObject *res = vectorcall_unbound(tstate, unbound, func, stack, 2);
7614     Py_DECREF(func);
7615     return res;
7616 }
7617 
7618 static PyObject *
slot_tp_iter(PyObject * self)7619 slot_tp_iter(PyObject *self)
7620 {
7621     int unbound;
7622     PyObject *func, *res;
7623     _Py_IDENTIFIER(__iter__);
7624 
7625     func = lookup_maybe_method(self, &PyId___iter__, &unbound);
7626     if (func == Py_None) {
7627         Py_DECREF(func);
7628         PyErr_Format(PyExc_TypeError,
7629                      "'%.200s' object is not iterable",
7630                      Py_TYPE(self)->tp_name);
7631         return NULL;
7632     }
7633 
7634     if (func != NULL) {
7635         res = call_unbound_noarg(unbound, func, self);
7636         Py_DECREF(func);
7637         return res;
7638     }
7639 
7640     PyErr_Clear();
7641     func = lookup_maybe_method(self, &PyId___getitem__, &unbound);
7642     if (func == NULL) {
7643         PyErr_Format(PyExc_TypeError,
7644                      "'%.200s' object is not iterable",
7645                      Py_TYPE(self)->tp_name);
7646         return NULL;
7647     }
7648     Py_DECREF(func);
7649     return PySeqIter_New(self);
7650 }
7651 
7652 static PyObject *
slot_tp_iternext(PyObject * self)7653 slot_tp_iternext(PyObject *self)
7654 {
7655     _Py_IDENTIFIER(__next__);
7656     PyObject *stack[1] = {self};
7657     return vectorcall_method(&PyId___next__, stack, 1);
7658 }
7659 
7660 static PyObject *
slot_tp_descr_get(PyObject * self,PyObject * obj,PyObject * type)7661 slot_tp_descr_get(PyObject *self, PyObject *obj, PyObject *type)
7662 {
7663     PyTypeObject *tp = Py_TYPE(self);
7664     PyObject *get;
7665     _Py_IDENTIFIER(__get__);
7666 
7667     get = _PyType_LookupId(tp, &PyId___get__);
7668     if (get == NULL) {
7669         /* Avoid further slowdowns */
7670         if (tp->tp_descr_get == slot_tp_descr_get)
7671             tp->tp_descr_get = NULL;
7672         Py_INCREF(self);
7673         return self;
7674     }
7675     if (obj == NULL)
7676         obj = Py_None;
7677     if (type == NULL)
7678         type = Py_None;
7679     return PyObject_CallFunctionObjArgs(get, self, obj, type, NULL);
7680 }
7681 
7682 static int
slot_tp_descr_set(PyObject * self,PyObject * target,PyObject * value)7683 slot_tp_descr_set(PyObject *self, PyObject *target, PyObject *value)
7684 {
7685     PyObject* stack[3];
7686     PyObject *res;
7687     _Py_IDENTIFIER(__delete__);
7688     _Py_IDENTIFIER(__set__);
7689 
7690     stack[0] = self;
7691     stack[1] = target;
7692     if (value == NULL) {
7693         res = vectorcall_method(&PyId___delete__, stack, 2);
7694     }
7695     else {
7696         stack[2] = value;
7697         res = vectorcall_method(&PyId___set__, stack, 3);
7698     }
7699     if (res == NULL)
7700         return -1;
7701     Py_DECREF(res);
7702     return 0;
7703 }
7704 
7705 static int
slot_tp_init(PyObject * self,PyObject * args,PyObject * kwds)7706 slot_tp_init(PyObject *self, PyObject *args, PyObject *kwds)
7707 {
7708     PyThreadState *tstate = _PyThreadState_GET();
7709 
7710     _Py_IDENTIFIER(__init__);
7711     int unbound;
7712     PyObject *meth = lookup_method(self, &PyId___init__, &unbound);
7713     if (meth == NULL) {
7714         return -1;
7715     }
7716 
7717     PyObject *res;
7718     if (unbound) {
7719         res = _PyObject_Call_Prepend(tstate, meth, self, args, kwds);
7720     }
7721     else {
7722         res = _PyObject_Call(tstate, meth, args, kwds);
7723     }
7724     Py_DECREF(meth);
7725     if (res == NULL)
7726         return -1;
7727     if (res != Py_None) {
7728         PyErr_Format(PyExc_TypeError,
7729                      "__init__() should return None, not '%.200s'",
7730                      Py_TYPE(res)->tp_name);
7731         Py_DECREF(res);
7732         return -1;
7733     }
7734     Py_DECREF(res);
7735     return 0;
7736 }
7737 
7738 static PyObject *
slot_tp_new(PyTypeObject * type,PyObject * args,PyObject * kwds)7739 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
7740 {
7741     PyThreadState *tstate = _PyThreadState_GET();
7742     PyObject *func, *result;
7743 
7744     func = _PyObject_GetAttrId((PyObject *)type, &PyId___new__);
7745     if (func == NULL) {
7746         return NULL;
7747     }
7748 
7749     result = _PyObject_Call_Prepend(tstate, func, (PyObject *)type, args, kwds);
7750     Py_DECREF(func);
7751     return result;
7752 }
7753 
7754 static void
slot_tp_finalize(PyObject * self)7755 slot_tp_finalize(PyObject *self)
7756 {
7757     _Py_IDENTIFIER(__del__);
7758     int unbound;
7759     PyObject *del, *res;
7760     PyObject *error_type, *error_value, *error_traceback;
7761 
7762     /* Save the current exception, if any. */
7763     PyErr_Fetch(&error_type, &error_value, &error_traceback);
7764 
7765     /* Execute __del__ method, if any. */
7766     del = lookup_maybe_method(self, &PyId___del__, &unbound);
7767     if (del != NULL) {
7768         res = call_unbound_noarg(unbound, del, self);
7769         if (res == NULL)
7770             PyErr_WriteUnraisable(del);
7771         else
7772             Py_DECREF(res);
7773         Py_DECREF(del);
7774     }
7775 
7776     /* Restore the saved exception. */
7777     PyErr_Restore(error_type, error_value, error_traceback);
7778 }
7779 
7780 static PyObject *
slot_am_await(PyObject * self)7781 slot_am_await(PyObject *self)
7782 {
7783     int unbound;
7784     PyObject *func, *res;
7785     _Py_IDENTIFIER(__await__);
7786 
7787     func = lookup_maybe_method(self, &PyId___await__, &unbound);
7788     if (func != NULL) {
7789         res = call_unbound_noarg(unbound, func, self);
7790         Py_DECREF(func);
7791         return res;
7792     }
7793     PyErr_Format(PyExc_AttributeError,
7794                  "object %.50s does not have __await__ method",
7795                  Py_TYPE(self)->tp_name);
7796     return NULL;
7797 }
7798 
7799 static PyObject *
slot_am_aiter(PyObject * self)7800 slot_am_aiter(PyObject *self)
7801 {
7802     int unbound;
7803     PyObject *func, *res;
7804     _Py_IDENTIFIER(__aiter__);
7805 
7806     func = lookup_maybe_method(self, &PyId___aiter__, &unbound);
7807     if (func != NULL) {
7808         res = call_unbound_noarg(unbound, func, self);
7809         Py_DECREF(func);
7810         return res;
7811     }
7812     PyErr_Format(PyExc_AttributeError,
7813                  "object %.50s does not have __aiter__ method",
7814                  Py_TYPE(self)->tp_name);
7815     return NULL;
7816 }
7817 
7818 static PyObject *
slot_am_anext(PyObject * self)7819 slot_am_anext(PyObject *self)
7820 {
7821     int unbound;
7822     PyObject *func, *res;
7823     _Py_IDENTIFIER(__anext__);
7824 
7825     func = lookup_maybe_method(self, &PyId___anext__, &unbound);
7826     if (func != NULL) {
7827         res = call_unbound_noarg(unbound, func, self);
7828         Py_DECREF(func);
7829         return res;
7830     }
7831     PyErr_Format(PyExc_AttributeError,
7832                  "object %.50s does not have __anext__ method",
7833                  Py_TYPE(self)->tp_name);
7834     return NULL;
7835 }
7836 
7837 /*
7838 Table mapping __foo__ names to tp_foo offsets and slot_tp_foo wrapper functions.
7839 
7840 The table is ordered by offsets relative to the 'PyHeapTypeObject' structure,
7841 which incorporates the additional structures used for numbers, sequences and
7842 mappings.  Note that multiple names may map to the same slot (e.g. __eq__,
7843 __ne__ etc. all map to tp_richcompare) and one name may map to multiple slots
7844 (e.g. __str__ affects tp_str as well as tp_repr). The table is terminated with
7845 an all-zero entry.  (This table is further initialized in
7846 _PyTypes_InitSlotDefs().)
7847 */
7848 
7849 typedef struct wrapperbase slotdef;
7850 
7851 #undef TPSLOT
7852 #undef FLSLOT
7853 #undef AMSLOT
7854 #undef ETSLOT
7855 #undef SQSLOT
7856 #undef MPSLOT
7857 #undef NBSLOT
7858 #undef UNSLOT
7859 #undef IBSLOT
7860 #undef BINSLOT
7861 #undef RBINSLOT
7862 
7863 #define TPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7864     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7865      PyDoc_STR(DOC)}
7866 #define FLSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC, FLAGS) \
7867     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7868      PyDoc_STR(DOC), FLAGS}
7869 #define ETSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7870     {NAME, offsetof(PyHeapTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7871      PyDoc_STR(DOC)}
7872 #define AMSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7873     ETSLOT(NAME, as_async.SLOT, FUNCTION, WRAPPER, DOC)
7874 #define SQSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7875     ETSLOT(NAME, as_sequence.SLOT, FUNCTION, WRAPPER, DOC)
7876 #define MPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7877     ETSLOT(NAME, as_mapping.SLOT, FUNCTION, WRAPPER, DOC)
7878 #define NBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7879     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, DOC)
7880 #define UNSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7881     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
7882            NAME "($self, /)\n--\n\n" DOC)
7883 #define IBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7884     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
7885            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
7886 #define BINSLOT(NAME, SLOT, FUNCTION, DOC) \
7887     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
7888            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
7889 #define RBINSLOT(NAME, SLOT, FUNCTION, DOC) \
7890     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
7891            NAME "($self, value, /)\n--\n\nReturn value" DOC "self.")
7892 #define BINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
7893     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
7894            NAME "($self, value, /)\n--\n\n" DOC)
7895 #define RBINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
7896     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
7897            NAME "($self, value, /)\n--\n\n" DOC)
7898 
7899 static slotdef slotdefs[] = {
7900     TPSLOT("__getattribute__", tp_getattr, NULL, NULL, ""),
7901     TPSLOT("__getattr__", tp_getattr, NULL, NULL, ""),
7902     TPSLOT("__setattr__", tp_setattr, NULL, NULL, ""),
7903     TPSLOT("__delattr__", tp_setattr, NULL, NULL, ""),
7904     TPSLOT("__repr__", tp_repr, slot_tp_repr, wrap_unaryfunc,
7905            "__repr__($self, /)\n--\n\nReturn repr(self)."),
7906     TPSLOT("__hash__", tp_hash, slot_tp_hash, wrap_hashfunc,
7907            "__hash__($self, /)\n--\n\nReturn hash(self)."),
7908     FLSLOT("__call__", tp_call, slot_tp_call, (wrapperfunc)(void(*)(void))wrap_call,
7909            "__call__($self, /, *args, **kwargs)\n--\n\nCall self as a function.",
7910            PyWrapperFlag_KEYWORDS),
7911     TPSLOT("__str__", tp_str, slot_tp_str, wrap_unaryfunc,
7912            "__str__($self, /)\n--\n\nReturn str(self)."),
7913     TPSLOT("__getattribute__", tp_getattro, slot_tp_getattr_hook,
7914            wrap_binaryfunc,
7915            "__getattribute__($self, name, /)\n--\n\nReturn getattr(self, name)."),
7916     TPSLOT("__getattr__", tp_getattro, slot_tp_getattr_hook, NULL, ""),
7917     TPSLOT("__setattr__", tp_setattro, slot_tp_setattro, wrap_setattr,
7918            "__setattr__($self, name, value, /)\n--\n\nImplement setattr(self, name, value)."),
7919     TPSLOT("__delattr__", tp_setattro, slot_tp_setattro, wrap_delattr,
7920            "__delattr__($self, name, /)\n--\n\nImplement delattr(self, name)."),
7921     TPSLOT("__lt__", tp_richcompare, slot_tp_richcompare, richcmp_lt,
7922            "__lt__($self, value, /)\n--\n\nReturn self<value."),
7923     TPSLOT("__le__", tp_richcompare, slot_tp_richcompare, richcmp_le,
7924            "__le__($self, value, /)\n--\n\nReturn self<=value."),
7925     TPSLOT("__eq__", tp_richcompare, slot_tp_richcompare, richcmp_eq,
7926            "__eq__($self, value, /)\n--\n\nReturn self==value."),
7927     TPSLOT("__ne__", tp_richcompare, slot_tp_richcompare, richcmp_ne,
7928            "__ne__($self, value, /)\n--\n\nReturn self!=value."),
7929     TPSLOT("__gt__", tp_richcompare, slot_tp_richcompare, richcmp_gt,
7930            "__gt__($self, value, /)\n--\n\nReturn self>value."),
7931     TPSLOT("__ge__", tp_richcompare, slot_tp_richcompare, richcmp_ge,
7932            "__ge__($self, value, /)\n--\n\nReturn self>=value."),
7933     TPSLOT("__iter__", tp_iter, slot_tp_iter, wrap_unaryfunc,
7934            "__iter__($self, /)\n--\n\nImplement iter(self)."),
7935     TPSLOT("__next__", tp_iternext, slot_tp_iternext, wrap_next,
7936            "__next__($self, /)\n--\n\nImplement next(self)."),
7937     TPSLOT("__get__", tp_descr_get, slot_tp_descr_get, wrap_descr_get,
7938            "__get__($self, instance, owner, /)\n--\n\nReturn an attribute of instance, which is of type owner."),
7939     TPSLOT("__set__", tp_descr_set, slot_tp_descr_set, wrap_descr_set,
7940            "__set__($self, instance, value, /)\n--\n\nSet an attribute of instance to value."),
7941     TPSLOT("__delete__", tp_descr_set, slot_tp_descr_set,
7942            wrap_descr_delete,
7943            "__delete__($self, instance, /)\n--\n\nDelete an attribute of instance."),
7944     FLSLOT("__init__", tp_init, slot_tp_init, (wrapperfunc)(void(*)(void))wrap_init,
7945            "__init__($self, /, *args, **kwargs)\n--\n\n"
7946            "Initialize self.  See help(type(self)) for accurate signature.",
7947            PyWrapperFlag_KEYWORDS),
7948     TPSLOT("__new__", tp_new, slot_tp_new, NULL,
7949            "__new__(type, /, *args, **kwargs)\n--\n\n"
7950            "Create and return new object.  See help(type) for accurate signature."),
7951     TPSLOT("__del__", tp_finalize, slot_tp_finalize, (wrapperfunc)wrap_del, ""),
7952 
7953     AMSLOT("__await__", am_await, slot_am_await, wrap_unaryfunc,
7954            "__await__($self, /)\n--\n\nReturn an iterator to be used in await expression."),
7955     AMSLOT("__aiter__", am_aiter, slot_am_aiter, wrap_unaryfunc,
7956            "__aiter__($self, /)\n--\n\nReturn an awaitable, that resolves in asynchronous iterator."),
7957     AMSLOT("__anext__", am_anext, slot_am_anext, wrap_unaryfunc,
7958            "__anext__($self, /)\n--\n\nReturn a value or raise StopAsyncIteration."),
7959 
7960     BINSLOT("__add__", nb_add, slot_nb_add,
7961            "+"),
7962     RBINSLOT("__radd__", nb_add, slot_nb_add,
7963            "+"),
7964     BINSLOT("__sub__", nb_subtract, slot_nb_subtract,
7965            "-"),
7966     RBINSLOT("__rsub__", nb_subtract, slot_nb_subtract,
7967            "-"),
7968     BINSLOT("__mul__", nb_multiply, slot_nb_multiply,
7969            "*"),
7970     RBINSLOT("__rmul__", nb_multiply, slot_nb_multiply,
7971            "*"),
7972     BINSLOT("__mod__", nb_remainder, slot_nb_remainder,
7973            "%"),
7974     RBINSLOT("__rmod__", nb_remainder, slot_nb_remainder,
7975            "%"),
7976     BINSLOTNOTINFIX("__divmod__", nb_divmod, slot_nb_divmod,
7977            "Return divmod(self, value)."),
7978     RBINSLOTNOTINFIX("__rdivmod__", nb_divmod, slot_nb_divmod,
7979            "Return divmod(value, self)."),
7980     NBSLOT("__pow__", nb_power, slot_nb_power, wrap_ternaryfunc,
7981            "__pow__($self, value, mod=None, /)\n--\n\nReturn pow(self, value, mod)."),
7982     NBSLOT("__rpow__", nb_power, slot_nb_power, wrap_ternaryfunc_r,
7983            "__rpow__($self, value, mod=None, /)\n--\n\nReturn pow(value, self, mod)."),
7984     UNSLOT("__neg__", nb_negative, slot_nb_negative, wrap_unaryfunc, "-self"),
7985     UNSLOT("__pos__", nb_positive, slot_nb_positive, wrap_unaryfunc, "+self"),
7986     UNSLOT("__abs__", nb_absolute, slot_nb_absolute, wrap_unaryfunc,
7987            "abs(self)"),
7988     UNSLOT("__bool__", nb_bool, slot_nb_bool, wrap_inquirypred,
7989            "self != 0"),
7990     UNSLOT("__invert__", nb_invert, slot_nb_invert, wrap_unaryfunc, "~self"),
7991     BINSLOT("__lshift__", nb_lshift, slot_nb_lshift, "<<"),
7992     RBINSLOT("__rlshift__", nb_lshift, slot_nb_lshift, "<<"),
7993     BINSLOT("__rshift__", nb_rshift, slot_nb_rshift, ">>"),
7994     RBINSLOT("__rrshift__", nb_rshift, slot_nb_rshift, ">>"),
7995     BINSLOT("__and__", nb_and, slot_nb_and, "&"),
7996     RBINSLOT("__rand__", nb_and, slot_nb_and, "&"),
7997     BINSLOT("__xor__", nb_xor, slot_nb_xor, "^"),
7998     RBINSLOT("__rxor__", nb_xor, slot_nb_xor, "^"),
7999     BINSLOT("__or__", nb_or, slot_nb_or, "|"),
8000     RBINSLOT("__ror__", nb_or, slot_nb_or, "|"),
8001     UNSLOT("__int__", nb_int, slot_nb_int, wrap_unaryfunc,
8002            "int(self)"),
8003     UNSLOT("__float__", nb_float, slot_nb_float, wrap_unaryfunc,
8004            "float(self)"),
8005     IBSLOT("__iadd__", nb_inplace_add, slot_nb_inplace_add,
8006            wrap_binaryfunc, "+="),
8007     IBSLOT("__isub__", nb_inplace_subtract, slot_nb_inplace_subtract,
8008            wrap_binaryfunc, "-="),
8009     IBSLOT("__imul__", nb_inplace_multiply, slot_nb_inplace_multiply,
8010            wrap_binaryfunc, "*="),
8011     IBSLOT("__imod__", nb_inplace_remainder, slot_nb_inplace_remainder,
8012            wrap_binaryfunc, "%="),
8013     IBSLOT("__ipow__", nb_inplace_power, slot_nb_inplace_power,
8014            wrap_ternaryfunc, "**="),
8015     IBSLOT("__ilshift__", nb_inplace_lshift, slot_nb_inplace_lshift,
8016            wrap_binaryfunc, "<<="),
8017     IBSLOT("__irshift__", nb_inplace_rshift, slot_nb_inplace_rshift,
8018            wrap_binaryfunc, ">>="),
8019     IBSLOT("__iand__", nb_inplace_and, slot_nb_inplace_and,
8020            wrap_binaryfunc, "&="),
8021     IBSLOT("__ixor__", nb_inplace_xor, slot_nb_inplace_xor,
8022            wrap_binaryfunc, "^="),
8023     IBSLOT("__ior__", nb_inplace_or, slot_nb_inplace_or,
8024            wrap_binaryfunc, "|="),
8025     BINSLOT("__floordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
8026     RBINSLOT("__rfloordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
8027     BINSLOT("__truediv__", nb_true_divide, slot_nb_true_divide, "/"),
8028     RBINSLOT("__rtruediv__", nb_true_divide, slot_nb_true_divide, "/"),
8029     IBSLOT("__ifloordiv__", nb_inplace_floor_divide,
8030            slot_nb_inplace_floor_divide, wrap_binaryfunc, "//="),
8031     IBSLOT("__itruediv__", nb_inplace_true_divide,
8032            slot_nb_inplace_true_divide, wrap_binaryfunc, "/="),
8033     NBSLOT("__index__", nb_index, slot_nb_index, wrap_unaryfunc,
8034            "__index__($self, /)\n--\n\n"
8035            "Return self converted to an integer, if self is suitable "
8036            "for use as an index into a list."),
8037     BINSLOT("__matmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
8038             "@"),
8039     RBINSLOT("__rmatmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
8040              "@"),
8041     IBSLOT("__imatmul__", nb_inplace_matrix_multiply, slot_nb_inplace_matrix_multiply,
8042            wrap_binaryfunc, "@="),
8043     MPSLOT("__len__", mp_length, slot_mp_length, wrap_lenfunc,
8044            "__len__($self, /)\n--\n\nReturn len(self)."),
8045     MPSLOT("__getitem__", mp_subscript, slot_mp_subscript,
8046            wrap_binaryfunc,
8047            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
8048     MPSLOT("__setitem__", mp_ass_subscript, slot_mp_ass_subscript,
8049            wrap_objobjargproc,
8050            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
8051     MPSLOT("__delitem__", mp_ass_subscript, slot_mp_ass_subscript,
8052            wrap_delitem,
8053            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
8054 
8055     SQSLOT("__len__", sq_length, slot_sq_length, wrap_lenfunc,
8056            "__len__($self, /)\n--\n\nReturn len(self)."),
8057     /* Heap types defining __add__/__mul__ have sq_concat/sq_repeat == NULL.
8058        The logic in abstract.c always falls back to nb_add/nb_multiply in
8059        this case.  Defining both the nb_* and the sq_* slots to call the
8060        user-defined methods has unexpected side-effects, as shown by
8061        test_descr.notimplemented() */
8062     SQSLOT("__add__", sq_concat, NULL, wrap_binaryfunc,
8063            "__add__($self, value, /)\n--\n\nReturn self+value."),
8064     SQSLOT("__mul__", sq_repeat, NULL, wrap_indexargfunc,
8065            "__mul__($self, value, /)\n--\n\nReturn self*value."),
8066     SQSLOT("__rmul__", sq_repeat, NULL, wrap_indexargfunc,
8067            "__rmul__($self, value, /)\n--\n\nReturn value*self."),
8068     SQSLOT("__getitem__", sq_item, slot_sq_item, wrap_sq_item,
8069            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
8070     SQSLOT("__setitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_setitem,
8071            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
8072     SQSLOT("__delitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_delitem,
8073            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
8074     SQSLOT("__contains__", sq_contains, slot_sq_contains, wrap_objobjproc,
8075            "__contains__($self, key, /)\n--\n\nReturn key in self."),
8076     SQSLOT("__iadd__", sq_inplace_concat, NULL,
8077            wrap_binaryfunc,
8078            "__iadd__($self, value, /)\n--\n\nImplement self+=value."),
8079     SQSLOT("__imul__", sq_inplace_repeat, NULL,
8080            wrap_indexargfunc,
8081            "__imul__($self, value, /)\n--\n\nImplement self*=value."),
8082 
8083     {NULL}
8084 };
8085 
8086 /* Given a type pointer and an offset gotten from a slotdef entry, return a
8087    pointer to the actual slot.  This is not quite the same as simply adding
8088    the offset to the type pointer, since it takes care to indirect through the
8089    proper indirection pointer (as_buffer, etc.); it returns NULL if the
8090    indirection pointer is NULL. */
8091 static void **
slotptr(PyTypeObject * type,int ioffset)8092 slotptr(PyTypeObject *type, int ioffset)
8093 {
8094     char *ptr;
8095     long offset = ioffset;
8096 
8097     /* Note: this depends on the order of the members of PyHeapTypeObject! */
8098     assert(offset >= 0);
8099     assert((size_t)offset < offsetof(PyHeapTypeObject, as_buffer));
8100     if ((size_t)offset >= offsetof(PyHeapTypeObject, as_sequence)) {
8101         ptr = (char *)type->tp_as_sequence;
8102         offset -= offsetof(PyHeapTypeObject, as_sequence);
8103     }
8104     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_mapping)) {
8105         ptr = (char *)type->tp_as_mapping;
8106         offset -= offsetof(PyHeapTypeObject, as_mapping);
8107     }
8108     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_number)) {
8109         ptr = (char *)type->tp_as_number;
8110         offset -= offsetof(PyHeapTypeObject, as_number);
8111     }
8112     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_async)) {
8113         ptr = (char *)type->tp_as_async;
8114         offset -= offsetof(PyHeapTypeObject, as_async);
8115     }
8116     else {
8117         ptr = (char *)type;
8118     }
8119     if (ptr != NULL)
8120         ptr += offset;
8121     return (void **)ptr;
8122 }
8123 
8124 /* Length of array of slotdef pointers used to store slots with the
8125    same __name__.  There should be at most MAX_EQUIV-1 slotdef entries with
8126    the same __name__, for any __name__. Since that's a static property, it is
8127    appropriate to declare fixed-size arrays for this. */
8128 #define MAX_EQUIV 10
8129 
8130 /* Return a slot pointer for a given name, but ONLY if the attribute has
8131    exactly one slot function.  The name must be an interned string. */
8132 static void **
resolve_slotdups(PyTypeObject * type,PyObject * name)8133 resolve_slotdups(PyTypeObject *type, PyObject *name)
8134 {
8135     /* XXX Maybe this could be optimized more -- but is it worth it? */
8136 
8137     /* pname and ptrs act as a little cache */
8138     static PyObject *pname;
8139     static slotdef *ptrs[MAX_EQUIV];
8140     slotdef *p, **pp;
8141     void **res, **ptr;
8142 
8143     if (pname != name) {
8144         /* Collect all slotdefs that match name into ptrs. */
8145         pname = name;
8146         pp = ptrs;
8147         for (p = slotdefs; p->name_strobj; p++) {
8148             if (p->name_strobj == name)
8149                 *pp++ = p;
8150         }
8151         *pp = NULL;
8152     }
8153 
8154     /* Look in all slots of the type matching the name. If exactly one of these
8155        has a filled-in slot, return a pointer to that slot.
8156        Otherwise, return NULL. */
8157     res = NULL;
8158     for (pp = ptrs; *pp; pp++) {
8159         ptr = slotptr(type, (*pp)->offset);
8160         if (ptr == NULL || *ptr == NULL)
8161             continue;
8162         if (res != NULL)
8163             return NULL;
8164         res = ptr;
8165     }
8166     return res;
8167 }
8168 
8169 
8170 /* Common code for update_slots_callback() and fixup_slot_dispatchers().
8171  *
8172  * This is meant to set a "slot" like type->tp_repr or
8173  * type->tp_as_sequence->sq_concat by looking up special methods like
8174  * __repr__ or __add__. The opposite (adding special methods from slots) is
8175  * done by add_operators(), called from PyType_Ready(). Since update_one_slot()
8176  * calls PyType_Ready() if needed, the special methods are already in place.
8177  *
8178  * The special methods corresponding to each slot are defined in the "slotdef"
8179  * array. Note that one slot may correspond to multiple special methods and vice
8180  * versa. For example, tp_richcompare uses 6 methods __lt__, ..., __ge__ and
8181  * tp_as_number->nb_add uses __add__ and __radd__. In the other direction,
8182  * __add__ is used by the number and sequence protocols and __getitem__ by the
8183  * sequence and mapping protocols. This causes a lot of complications.
8184  *
8185  * In detail, update_one_slot() does the following:
8186  *
8187  * First of all, if the slot in question does not exist, return immediately.
8188  * This can happen for example if it's tp_as_number->nb_add but tp_as_number
8189  * is NULL.
8190  *
8191  * For the given slot, we loop over all the special methods with a name
8192  * corresponding to that slot (for example, for tp_descr_set, this would be
8193  * __set__ and __delete__) and we look up these names in the MRO of the type.
8194  * If we don't find any special method, the slot is set to NULL (regardless of
8195  * what was in the slot before).
8196  *
8197  * Suppose that we find exactly one special method. If it's a wrapper_descriptor
8198  * (i.e. a special method calling a slot, for example str.__repr__ which calls
8199  * the tp_repr for the 'str' class) with the correct name ("__repr__" for
8200  * tp_repr), for the right class, calling the right wrapper C function (like
8201  * wrap_unaryfunc for tp_repr), then the slot is set to the slot that the
8202  * wrapper_descriptor originally wrapped. For example, a class inheriting
8203  * from 'str' and not redefining __repr__ will have tp_repr set to the tp_repr
8204  * of 'str'.
8205  * In all other cases where the special method exists, the slot is set to a
8206  * wrapper calling the special method. There is one exception: if the special
8207  * method is a wrapper_descriptor with the correct name but the type has
8208  * precisely one slot set for that name and that slot is not the one that we
8209  * are updating, then NULL is put in the slot (this exception is the only place
8210  * in update_one_slot() where the *existing* slots matter).
8211  *
8212  * When there are multiple special methods for the same slot, the above is
8213  * applied for each special method. As long as the results agree, the common
8214  * resulting slot is applied. If the results disagree, then a wrapper for
8215  * the special methods is installed. This is always safe, but less efficient
8216  * because it uses method lookup instead of direct C calls.
8217  *
8218  * There are some further special cases for specific slots, like supporting
8219  * __hash__ = None for tp_hash and special code for tp_new.
8220  *
8221  * When done, return a pointer to the next slotdef with a different offset,
8222  * because that's convenient for fixup_slot_dispatchers(). This function never
8223  * sets an exception: if an internal error happens (unlikely), it's ignored. */
8224 static slotdef *
update_one_slot(PyTypeObject * type,slotdef * p)8225 update_one_slot(PyTypeObject *type, slotdef *p)
8226 {
8227     PyObject *descr;
8228     PyWrapperDescrObject *d;
8229     void *generic = NULL, *specific = NULL;
8230     int use_generic = 0;
8231     int offset = p->offset;
8232     int error;
8233     void **ptr = slotptr(type, offset);
8234 
8235     if (ptr == NULL) {
8236         do {
8237             ++p;
8238         } while (p->offset == offset);
8239         return p;
8240     }
8241     /* We may end up clearing live exceptions below, so make sure it's ours. */
8242     assert(!PyErr_Occurred());
8243     do {
8244         /* Use faster uncached lookup as we won't get any cache hits during type setup. */
8245         descr = find_name_in_mro(type, p->name_strobj, &error);
8246         if (descr == NULL) {
8247             if (error == -1) {
8248                 /* It is unlikely but not impossible that there has been an exception
8249                    during lookup. Since this function originally expected no errors,
8250                    we ignore them here in order to keep up the interface. */
8251                 PyErr_Clear();
8252             }
8253             if (ptr == (void**)&type->tp_iternext) {
8254                 specific = (void *)_PyObject_NextNotImplemented;
8255             }
8256             continue;
8257         }
8258         if (Py_IS_TYPE(descr, &PyWrapperDescr_Type) &&
8259             ((PyWrapperDescrObject *)descr)->d_base->name_strobj == p->name_strobj) {
8260             void **tptr = resolve_slotdups(type, p->name_strobj);
8261             if (tptr == NULL || tptr == ptr)
8262                 generic = p->function;
8263             d = (PyWrapperDescrObject *)descr;
8264             if ((specific == NULL || specific == d->d_wrapped) &&
8265                 d->d_base->wrapper == p->wrapper &&
8266                 PyType_IsSubtype(type, PyDescr_TYPE(d)))
8267             {
8268                 specific = d->d_wrapped;
8269             }
8270             else {
8271                 /* We cannot use the specific slot function because either
8272                    - it is not unique: there are multiple methods for this
8273                      slot and they conflict
8274                    - the signature is wrong (as checked by the ->wrapper
8275                      comparison above)
8276                    - it's wrapping the wrong class
8277                  */
8278                 use_generic = 1;
8279             }
8280         }
8281         else if (Py_IS_TYPE(descr, &PyCFunction_Type) &&
8282                  PyCFunction_GET_FUNCTION(descr) ==
8283                  (PyCFunction)(void(*)(void))tp_new_wrapper &&
8284                  ptr == (void**)&type->tp_new)
8285         {
8286             /* The __new__ wrapper is not a wrapper descriptor,
8287                so must be special-cased differently.
8288                If we don't do this, creating an instance will
8289                always use slot_tp_new which will look up
8290                __new__ in the MRO which will call tp_new_wrapper
8291                which will look through the base classes looking
8292                for a static base and call its tp_new (usually
8293                PyType_GenericNew), after performing various
8294                sanity checks and constructing a new argument
8295                list.  Cut all that nonsense short -- this speeds
8296                up instance creation tremendously. */
8297             specific = (void *)type->tp_new;
8298             /* XXX I'm not 100% sure that there isn't a hole
8299                in this reasoning that requires additional
8300                sanity checks.  I'll buy the first person to
8301                point out a bug in this reasoning a beer. */
8302         }
8303         else if (descr == Py_None &&
8304                  ptr == (void**)&type->tp_hash) {
8305             /* We specifically allow __hash__ to be set to None
8306                to prevent inheritance of the default
8307                implementation from object.__hash__ */
8308             specific = (void *)PyObject_HashNotImplemented;
8309         }
8310         else {
8311             use_generic = 1;
8312             generic = p->function;
8313         }
8314     } while ((++p)->offset == offset);
8315     if (specific && !use_generic)
8316         *ptr = specific;
8317     else
8318         *ptr = generic;
8319     return p;
8320 }
8321 
8322 /* In the type, update the slots whose slotdefs are gathered in the pp array.
8323    This is a callback for update_subclasses(). */
8324 static int
update_slots_callback(PyTypeObject * type,void * data)8325 update_slots_callback(PyTypeObject *type, void *data)
8326 {
8327     slotdef **pp = (slotdef **)data;
8328 
8329     for (; *pp; pp++)
8330         update_one_slot(type, *pp);
8331     return 0;
8332 }
8333 
8334 static int slotdefs_initialized = 0;
8335 /* Initialize the slotdefs table by adding interned string objects for the
8336    names. */
8337 PyStatus
_PyTypes_InitSlotDefs(void)8338 _PyTypes_InitSlotDefs(void)
8339 {
8340     if (slotdefs_initialized) {
8341         return _PyStatus_OK();
8342     }
8343 
8344     for (slotdef *p = slotdefs; p->name; p++) {
8345         /* Slots must be ordered by their offset in the PyHeapTypeObject. */
8346         assert(!p[1].name || p->offset <= p[1].offset);
8347         p->name_strobj = PyUnicode_InternFromString(p->name);
8348         if (!p->name_strobj || !PyUnicode_CHECK_INTERNED(p->name_strobj)) {
8349             return _PyStatus_NO_MEMORY();
8350         }
8351     }
8352     slotdefs_initialized = 1;
8353     return _PyStatus_OK();
8354 }
8355 
8356 /* Undo _PyTypes_InitSlotDefs(), releasing the interned strings. */
clear_slotdefs(void)8357 static void clear_slotdefs(void)
8358 {
8359     for (slotdef *p = slotdefs; p->name; p++) {
8360         Py_CLEAR(p->name_strobj);
8361     }
8362     slotdefs_initialized = 0;
8363 }
8364 
8365 /* Update the slots after assignment to a class (type) attribute. */
8366 static int
update_slot(PyTypeObject * type,PyObject * name)8367 update_slot(PyTypeObject *type, PyObject *name)
8368 {
8369     slotdef *ptrs[MAX_EQUIV];
8370     slotdef *p;
8371     slotdef **pp;
8372     int offset;
8373 
8374     assert(PyUnicode_CheckExact(name));
8375     assert(PyUnicode_CHECK_INTERNED(name));
8376 
8377     assert(slotdefs_initialized);
8378     pp = ptrs;
8379     for (p = slotdefs; p->name; p++) {
8380         assert(PyUnicode_CheckExact(p->name_strobj));
8381         assert(PyUnicode_CheckExact(name));
8382         if (p->name_strobj == name) {
8383             *pp++ = p;
8384         }
8385     }
8386     *pp = NULL;
8387     for (pp = ptrs; *pp; pp++) {
8388         p = *pp;
8389         offset = p->offset;
8390         while (p > slotdefs && (p-1)->offset == offset)
8391             --p;
8392         *pp = p;
8393     }
8394     if (ptrs[0] == NULL)
8395         return 0; /* Not an attribute that affects any slots */
8396     return update_subclasses(type, name,
8397                              update_slots_callback, (void *)ptrs);
8398 }
8399 
8400 /* Store the proper functions in the slot dispatches at class (type)
8401    definition time, based upon which operations the class overrides in its
8402    dict. */
8403 static void
fixup_slot_dispatchers(PyTypeObject * type)8404 fixup_slot_dispatchers(PyTypeObject *type)
8405 {
8406     assert(!PyErr_Occurred());
8407     assert(slotdefs_initialized);
8408     for (slotdef *p = slotdefs; p->name; ) {
8409         p = update_one_slot(type, p);
8410     }
8411 }
8412 
8413 static void
update_all_slots(PyTypeObject * type)8414 update_all_slots(PyTypeObject* type)
8415 {
8416     slotdef *p;
8417 
8418     /* Clear the VALID_VERSION flag of 'type' and all its subclasses. */
8419     PyType_Modified(type);
8420 
8421     assert(slotdefs_initialized);
8422     for (p = slotdefs; p->name; p++) {
8423         /* update_slot returns int but can't actually fail */
8424         update_slot(type, p->name_strobj);
8425     }
8426 }
8427 
8428 
8429 /* Call __set_name__ on all attributes (including descriptors)
8430   in a newly generated type */
8431 static int
type_new_set_names(PyTypeObject * type)8432 type_new_set_names(PyTypeObject *type)
8433 {
8434     PyObject *names_to_set = PyDict_Copy(type->tp_dict);
8435     if (names_to_set == NULL) {
8436         return -1;
8437     }
8438 
8439     Py_ssize_t i = 0;
8440     PyObject *key, *value;
8441     while (PyDict_Next(names_to_set, &i, &key, &value)) {
8442         PyObject *set_name = _PyObject_LookupSpecial(value, &PyId___set_name__);
8443         if (set_name == NULL) {
8444             if (PyErr_Occurred()) {
8445                 goto error;
8446             }
8447             continue;
8448         }
8449 
8450         PyObject *res = PyObject_CallFunctionObjArgs(set_name, type, key, NULL);
8451         Py_DECREF(set_name);
8452 
8453         if (res == NULL) {
8454             _PyErr_FormatFromCause(PyExc_RuntimeError,
8455                 "Error calling __set_name__ on '%.100s' instance %R "
8456                 "in '%.100s'",
8457                 Py_TYPE(value)->tp_name, key, type->tp_name);
8458             goto error;
8459         }
8460         Py_DECREF(res);
8461     }
8462 
8463     Py_DECREF(names_to_set);
8464     return 0;
8465 
8466 error:
8467     Py_DECREF(names_to_set);
8468     return -1;
8469 }
8470 
8471 
8472 /* Call __init_subclass__ on the parent of a newly generated type */
8473 static int
type_new_init_subclass(PyTypeObject * type,PyObject * kwds)8474 type_new_init_subclass(PyTypeObject *type, PyObject *kwds)
8475 {
8476     PyObject *args[2] = {(PyObject *)type, (PyObject *)type};
8477     PyObject *super = _PyObject_FastCall((PyObject *)&PySuper_Type, args, 2);
8478     if (super == NULL) {
8479         return -1;
8480     }
8481 
8482     PyObject *func = _PyObject_GetAttrId(super, &PyId___init_subclass__);
8483     Py_DECREF(super);
8484     if (func == NULL) {
8485         return -1;
8486     }
8487 
8488     PyObject *result = PyObject_VectorcallDict(func, NULL, 0, kwds);
8489     Py_DECREF(func);
8490     if (result == NULL) {
8491         return -1;
8492     }
8493 
8494     Py_DECREF(result);
8495     return 0;
8496 }
8497 
8498 
8499 /* recurse_down_subclasses() and update_subclasses() are mutually
8500    recursive functions to call a callback for all subclasses,
8501    but refraining from recursing into subclasses that define 'name'. */
8502 
8503 static int
update_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)8504 update_subclasses(PyTypeObject *type, PyObject *name,
8505                   update_callback callback, void *data)
8506 {
8507     if (callback(type, data) < 0)
8508         return -1;
8509     return recurse_down_subclasses(type, name, callback, data);
8510 }
8511 
8512 static int
recurse_down_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)8513 recurse_down_subclasses(PyTypeObject *type, PyObject *name,
8514                         update_callback callback, void *data)
8515 {
8516     PyTypeObject *subclass;
8517     PyObject *ref, *subclasses, *dict;
8518     Py_ssize_t i;
8519 
8520     subclasses = type->tp_subclasses;
8521     if (subclasses == NULL)
8522         return 0;
8523     assert(PyDict_CheckExact(subclasses));
8524     i = 0;
8525     while (PyDict_Next(subclasses, &i, NULL, &ref)) {
8526         assert(PyWeakref_CheckRef(ref));
8527         subclass = (PyTypeObject *)PyWeakref_GET_OBJECT(ref);
8528         assert(subclass != NULL);
8529         if ((PyObject *)subclass == Py_None)
8530             continue;
8531         assert(PyType_Check(subclass));
8532         /* Avoid recursing down into unaffected classes */
8533         dict = subclass->tp_dict;
8534         if (dict != NULL && PyDict_Check(dict)) {
8535             int r = PyDict_Contains(dict, name);
8536             if (r > 0) {
8537                 continue;
8538             }
8539             if (r < 0) {
8540                 return -1;
8541             }
8542         }
8543         if (update_subclasses(subclass, name, callback, data) < 0)
8544             return -1;
8545     }
8546     return 0;
8547 }
8548 
8549 /* This function is called by PyType_Ready() to populate the type's
8550    dictionary with method descriptors for function slots.  For each
8551    function slot (like tp_repr) that's defined in the type, one or more
8552    corresponding descriptors are added in the type's tp_dict dictionary
8553    under the appropriate name (like __repr__).  Some function slots
8554    cause more than one descriptor to be added (for example, the nb_add
8555    slot adds both __add__ and __radd__ descriptors) and some function
8556    slots compete for the same descriptor (for example both sq_item and
8557    mp_subscript generate a __getitem__ descriptor).
8558 
8559    In the latter case, the first slotdef entry encountered wins.  Since
8560    slotdef entries are sorted by the offset of the slot in the
8561    PyHeapTypeObject, this gives us some control over disambiguating
8562    between competing slots: the members of PyHeapTypeObject are listed
8563    from most general to least general, so the most general slot is
8564    preferred.  In particular, because as_mapping comes before as_sequence,
8565    for a type that defines both mp_subscript and sq_item, mp_subscript
8566    wins.
8567 
8568    This only adds new descriptors and doesn't overwrite entries in
8569    tp_dict that were previously defined.  The descriptors contain a
8570    reference to the C function they must call, so that it's safe if they
8571    are copied into a subtype's __dict__ and the subtype has a different
8572    C function in its slot -- calling the method defined by the
8573    descriptor will call the C function that was used to create it,
8574    rather than the C function present in the slot when it is called.
8575    (This is important because a subtype may have a C function in the
8576    slot that calls the method from the dictionary, and we want to avoid
8577    infinite recursion here.) */
8578 
8579 static int
add_operators(PyTypeObject * type)8580 add_operators(PyTypeObject *type)
8581 {
8582     PyObject *dict = type->tp_dict;
8583     slotdef *p;
8584     PyObject *descr;
8585     void **ptr;
8586 
8587     assert(slotdefs_initialized);
8588     for (p = slotdefs; p->name; p++) {
8589         if (p->wrapper == NULL)
8590             continue;
8591         ptr = slotptr(type, p->offset);
8592         if (!ptr || !*ptr)
8593             continue;
8594         int r = PyDict_Contains(dict, p->name_strobj);
8595         if (r > 0)
8596             continue;
8597         if (r < 0) {
8598             return -1;
8599         }
8600         if (*ptr == (void *)PyObject_HashNotImplemented) {
8601             /* Classes may prevent the inheritance of the tp_hash
8602                slot by storing PyObject_HashNotImplemented in it. Make it
8603                visible as a None value for the __hash__ attribute. */
8604             if (PyDict_SetItem(dict, p->name_strobj, Py_None) < 0)
8605                 return -1;
8606         }
8607         else {
8608             descr = PyDescr_NewWrapper(type, p, *ptr);
8609             if (descr == NULL)
8610                 return -1;
8611             if (PyDict_SetItem(dict, p->name_strobj, descr) < 0) {
8612                 Py_DECREF(descr);
8613                 return -1;
8614             }
8615             Py_DECREF(descr);
8616         }
8617     }
8618     return 0;
8619 }
8620 
8621 
8622 /* Cooperative 'super' */
8623 
8624 typedef struct {
8625     PyObject_HEAD
8626     PyTypeObject *type;
8627     PyObject *obj;
8628     PyTypeObject *obj_type;
8629 } superobject;
8630 
8631 static PyMemberDef super_members[] = {
8632     {"__thisclass__", T_OBJECT, offsetof(superobject, type), READONLY,
8633      "the class invoking super()"},
8634     {"__self__",  T_OBJECT, offsetof(superobject, obj), READONLY,
8635      "the instance invoking super(); may be None"},
8636     {"__self_class__", T_OBJECT, offsetof(superobject, obj_type), READONLY,
8637      "the type of the instance invoking super(); may be None"},
8638     {0}
8639 };
8640 
8641 static void
super_dealloc(PyObject * self)8642 super_dealloc(PyObject *self)
8643 {
8644     superobject *su = (superobject *)self;
8645 
8646     _PyObject_GC_UNTRACK(self);
8647     Py_XDECREF(su->obj);
8648     Py_XDECREF(su->type);
8649     Py_XDECREF(su->obj_type);
8650     Py_TYPE(self)->tp_free(self);
8651 }
8652 
8653 static PyObject *
super_repr(PyObject * self)8654 super_repr(PyObject *self)
8655 {
8656     superobject *su = (superobject *)self;
8657 
8658     if (su->obj_type)
8659         return PyUnicode_FromFormat(
8660             "<super: <class '%s'>, <%s object>>",
8661             su->type ? su->type->tp_name : "NULL",
8662             su->obj_type->tp_name);
8663     else
8664         return PyUnicode_FromFormat(
8665             "<super: <class '%s'>, NULL>",
8666             su->type ? su->type->tp_name : "NULL");
8667 }
8668 
8669 static PyObject *
super_getattro(PyObject * self,PyObject * name)8670 super_getattro(PyObject *self, PyObject *name)
8671 {
8672     superobject *su = (superobject *)self;
8673     PyTypeObject *starttype;
8674     PyObject *mro;
8675     Py_ssize_t i, n;
8676 
8677     starttype = su->obj_type;
8678     if (starttype == NULL)
8679         goto skip;
8680 
8681     /* We want __class__ to return the class of the super object
8682        (i.e. super, or a subclass), not the class of su->obj. */
8683     if (PyUnicode_Check(name) &&
8684         PyUnicode_GET_LENGTH(name) == 9 &&
8685         _PyUnicode_EqualToASCIIId(name, &PyId___class__))
8686         goto skip;
8687 
8688     mro = starttype->tp_mro;
8689     if (mro == NULL)
8690         goto skip;
8691 
8692     assert(PyTuple_Check(mro));
8693     n = PyTuple_GET_SIZE(mro);
8694 
8695     /* No need to check the last one: it's gonna be skipped anyway.  */
8696     for (i = 0; i+1 < n; i++) {
8697         if ((PyObject *)(su->type) == PyTuple_GET_ITEM(mro, i))
8698             break;
8699     }
8700     i++;  /* skip su->type (if any)  */
8701     if (i >= n)
8702         goto skip;
8703 
8704     /* keep a strong reference to mro because starttype->tp_mro can be
8705        replaced during PyDict_GetItemWithError(dict, name)  */
8706     Py_INCREF(mro);
8707     do {
8708         PyObject *res, *tmp, *dict;
8709         descrgetfunc f;
8710 
8711         tmp = PyTuple_GET_ITEM(mro, i);
8712         assert(PyType_Check(tmp));
8713 
8714         dict = ((PyTypeObject *)tmp)->tp_dict;
8715         assert(dict != NULL && PyDict_Check(dict));
8716 
8717         res = PyDict_GetItemWithError(dict, name);
8718         if (res != NULL) {
8719             Py_INCREF(res);
8720 
8721             f = Py_TYPE(res)->tp_descr_get;
8722             if (f != NULL) {
8723                 tmp = f(res,
8724                     /* Only pass 'obj' param if this is instance-mode super
8725                        (See SF ID #743627)  */
8726                     (su->obj == (PyObject *)starttype) ? NULL : su->obj,
8727                     (PyObject *)starttype);
8728                 Py_DECREF(res);
8729                 res = tmp;
8730             }
8731 
8732             Py_DECREF(mro);
8733             return res;
8734         }
8735         else if (PyErr_Occurred()) {
8736             Py_DECREF(mro);
8737             return NULL;
8738         }
8739 
8740         i++;
8741     } while (i < n);
8742     Py_DECREF(mro);
8743 
8744   skip:
8745     return PyObject_GenericGetAttr(self, name);
8746 }
8747 
8748 static PyTypeObject *
supercheck(PyTypeObject * type,PyObject * obj)8749 supercheck(PyTypeObject *type, PyObject *obj)
8750 {
8751     /* Check that a super() call makes sense.  Return a type object.
8752 
8753        obj can be a class, or an instance of one:
8754 
8755        - If it is a class, it must be a subclass of 'type'.      This case is
8756          used for class methods; the return value is obj.
8757 
8758        - If it is an instance, it must be an instance of 'type'.  This is
8759          the normal case; the return value is obj.__class__.
8760 
8761        But... when obj is an instance, we want to allow for the case where
8762        Py_TYPE(obj) is not a subclass of type, but obj.__class__ is!
8763        This will allow using super() with a proxy for obj.
8764     */
8765 
8766     /* Check for first bullet above (special case) */
8767     if (PyType_Check(obj) && PyType_IsSubtype((PyTypeObject *)obj, type)) {
8768         Py_INCREF(obj);
8769         return (PyTypeObject *)obj;
8770     }
8771 
8772     /* Normal case */
8773     if (PyType_IsSubtype(Py_TYPE(obj), type)) {
8774         Py_INCREF(Py_TYPE(obj));
8775         return Py_TYPE(obj);
8776     }
8777     else {
8778         /* Try the slow way */
8779         PyObject *class_attr;
8780 
8781         if (_PyObject_LookupAttrId(obj, &PyId___class__, &class_attr) < 0) {
8782             return NULL;
8783         }
8784         if (class_attr != NULL &&
8785             PyType_Check(class_attr) &&
8786             (PyTypeObject *)class_attr != Py_TYPE(obj))
8787         {
8788             int ok = PyType_IsSubtype(
8789                 (PyTypeObject *)class_attr, type);
8790             if (ok)
8791                 return (PyTypeObject *)class_attr;
8792         }
8793         Py_XDECREF(class_attr);
8794     }
8795 
8796     PyErr_SetString(PyExc_TypeError,
8797                     "super(type, obj): "
8798                     "obj must be an instance or subtype of type");
8799     return NULL;
8800 }
8801 
8802 static PyObject *
super_descr_get(PyObject * self,PyObject * obj,PyObject * type)8803 super_descr_get(PyObject *self, PyObject *obj, PyObject *type)
8804 {
8805     superobject *su = (superobject *)self;
8806     superobject *newobj;
8807 
8808     if (obj == NULL || obj == Py_None || su->obj != NULL) {
8809         /* Not binding to an object, or already bound */
8810         Py_INCREF(self);
8811         return self;
8812     }
8813     if (!Py_IS_TYPE(su, &PySuper_Type))
8814         /* If su is an instance of a (strict) subclass of super,
8815            call its type */
8816         return PyObject_CallFunctionObjArgs((PyObject *)Py_TYPE(su),
8817                                             su->type, obj, NULL);
8818     else {
8819         /* Inline the common case */
8820         PyTypeObject *obj_type = supercheck(su->type, obj);
8821         if (obj_type == NULL)
8822             return NULL;
8823         newobj = (superobject *)PySuper_Type.tp_new(&PySuper_Type,
8824                                                  NULL, NULL);
8825         if (newobj == NULL)
8826             return NULL;
8827         Py_INCREF(su->type);
8828         Py_INCREF(obj);
8829         newobj->type = su->type;
8830         newobj->obj = obj;
8831         newobj->obj_type = obj_type;
8832         return (PyObject *)newobj;
8833     }
8834 }
8835 
8836 static int
super_init_without_args(PyFrameObject * f,PyCodeObject * co,PyTypeObject ** type_p,PyObject ** obj_p)8837 super_init_without_args(PyFrameObject *f, PyCodeObject *co,
8838                         PyTypeObject **type_p, PyObject **obj_p)
8839 {
8840     if (co->co_argcount == 0) {
8841         PyErr_SetString(PyExc_RuntimeError,
8842                         "super(): no arguments");
8843         return -1;
8844     }
8845 
8846     PyObject *obj = f->f_localsplus[0];
8847     Py_ssize_t i, n;
8848     if (obj == NULL && co->co_cell2arg) {
8849         /* The first argument might be a cell. */
8850         n = PyTuple_GET_SIZE(co->co_cellvars);
8851         for (i = 0; i < n; i++) {
8852             if (co->co_cell2arg[i] == 0) {
8853                 PyObject *cell = f->f_localsplus[co->co_nlocals + i];
8854                 assert(PyCell_Check(cell));
8855                 obj = PyCell_GET(cell);
8856                 break;
8857             }
8858         }
8859     }
8860     if (obj == NULL) {
8861         PyErr_SetString(PyExc_RuntimeError,
8862                         "super(): arg[0] deleted");
8863         return -1;
8864     }
8865 
8866     if (co->co_freevars == NULL) {
8867         n = 0;
8868     }
8869     else {
8870         assert(PyTuple_Check(co->co_freevars));
8871         n = PyTuple_GET_SIZE(co->co_freevars);
8872     }
8873 
8874     PyTypeObject *type = NULL;
8875     for (i = 0; i < n; i++) {
8876         PyObject *name = PyTuple_GET_ITEM(co->co_freevars, i);
8877         assert(PyUnicode_Check(name));
8878         if (_PyUnicode_EqualToASCIIId(name, &PyId___class__)) {
8879             Py_ssize_t index = co->co_nlocals +
8880                 PyTuple_GET_SIZE(co->co_cellvars) + i;
8881             PyObject *cell = f->f_localsplus[index];
8882             if (cell == NULL || !PyCell_Check(cell)) {
8883                 PyErr_SetString(PyExc_RuntimeError,
8884                   "super(): bad __class__ cell");
8885                 return -1;
8886             }
8887             type = (PyTypeObject *) PyCell_GET(cell);
8888             if (type == NULL) {
8889                 PyErr_SetString(PyExc_RuntimeError,
8890                   "super(): empty __class__ cell");
8891                 return -1;
8892             }
8893             if (!PyType_Check(type)) {
8894                 PyErr_Format(PyExc_RuntimeError,
8895                   "super(): __class__ is not a type (%s)",
8896                   Py_TYPE(type)->tp_name);
8897                 return -1;
8898             }
8899             break;
8900         }
8901     }
8902     if (type == NULL) {
8903         PyErr_SetString(PyExc_RuntimeError,
8904                         "super(): __class__ cell not found");
8905         return -1;
8906     }
8907 
8908     *type_p = type;
8909     *obj_p = obj;
8910     return 0;
8911 }
8912 
8913 static int
super_init(PyObject * self,PyObject * args,PyObject * kwds)8914 super_init(PyObject *self, PyObject *args, PyObject *kwds)
8915 {
8916     superobject *su = (superobject *)self;
8917     PyTypeObject *type = NULL;
8918     PyObject *obj = NULL;
8919     PyTypeObject *obj_type = NULL;
8920 
8921     if (!_PyArg_NoKeywords("super", kwds))
8922         return -1;
8923     if (!PyArg_ParseTuple(args, "|O!O:super", &PyType_Type, &type, &obj))
8924         return -1;
8925 
8926     if (type == NULL) {
8927         /* Call super(), without args -- fill in from __class__
8928            and first local variable on the stack. */
8929         PyThreadState *tstate = _PyThreadState_GET();
8930         PyFrameObject *frame = PyThreadState_GetFrame(tstate);
8931         if (frame == NULL) {
8932             PyErr_SetString(PyExc_RuntimeError,
8933                             "super(): no current frame");
8934             return -1;
8935         }
8936 
8937         PyCodeObject *code = PyFrame_GetCode(frame);
8938         int res = super_init_without_args(frame, code, &type, &obj);
8939         Py_DECREF(frame);
8940         Py_DECREF(code);
8941 
8942         if (res < 0) {
8943             return -1;
8944         }
8945     }
8946 
8947     if (obj == Py_None)
8948         obj = NULL;
8949     if (obj != NULL) {
8950         obj_type = supercheck(type, obj);
8951         if (obj_type == NULL)
8952             return -1;
8953         Py_INCREF(obj);
8954     }
8955     Py_INCREF(type);
8956     Py_XSETREF(su->type, type);
8957     Py_XSETREF(su->obj, obj);
8958     Py_XSETREF(su->obj_type, obj_type);
8959     return 0;
8960 }
8961 
8962 PyDoc_STRVAR(super_doc,
8963 "super() -> same as super(__class__, <first argument>)\n"
8964 "super(type) -> unbound super object\n"
8965 "super(type, obj) -> bound super object; requires isinstance(obj, type)\n"
8966 "super(type, type2) -> bound super object; requires issubclass(type2, type)\n"
8967 "Typical use to call a cooperative superclass method:\n"
8968 "class C(B):\n"
8969 "    def meth(self, arg):\n"
8970 "        super().meth(arg)\n"
8971 "This works for class methods too:\n"
8972 "class C(B):\n"
8973 "    @classmethod\n"
8974 "    def cmeth(cls, arg):\n"
8975 "        super().cmeth(arg)\n");
8976 
8977 static int
super_traverse(PyObject * self,visitproc visit,void * arg)8978 super_traverse(PyObject *self, visitproc visit, void *arg)
8979 {
8980     superobject *su = (superobject *)self;
8981 
8982     Py_VISIT(su->obj);
8983     Py_VISIT(su->type);
8984     Py_VISIT(su->obj_type);
8985 
8986     return 0;
8987 }
8988 
8989 PyTypeObject PySuper_Type = {
8990     PyVarObject_HEAD_INIT(&PyType_Type, 0)
8991     "super",                                    /* tp_name */
8992     sizeof(superobject),                        /* tp_basicsize */
8993     0,                                          /* tp_itemsize */
8994     /* methods */
8995     super_dealloc,                              /* tp_dealloc */
8996     0,                                          /* tp_vectorcall_offset */
8997     0,                                          /* tp_getattr */
8998     0,                                          /* tp_setattr */
8999     0,                                          /* tp_as_async */
9000     super_repr,                                 /* tp_repr */
9001     0,                                          /* tp_as_number */
9002     0,                                          /* tp_as_sequence */
9003     0,                                          /* tp_as_mapping */
9004     0,                                          /* tp_hash */
9005     0,                                          /* tp_call */
9006     0,                                          /* tp_str */
9007     super_getattro,                             /* tp_getattro */
9008     0,                                          /* tp_setattro */
9009     0,                                          /* tp_as_buffer */
9010     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
9011         Py_TPFLAGS_BASETYPE,                    /* tp_flags */
9012     super_doc,                                  /* tp_doc */
9013     super_traverse,                             /* tp_traverse */
9014     0,                                          /* tp_clear */
9015     0,                                          /* tp_richcompare */
9016     0,                                          /* tp_weaklistoffset */
9017     0,                                          /* tp_iter */
9018     0,                                          /* tp_iternext */
9019     0,                                          /* tp_methods */
9020     super_members,                              /* tp_members */
9021     0,                                          /* tp_getset */
9022     0,                                          /* tp_base */
9023     0,                                          /* tp_dict */
9024     super_descr_get,                            /* tp_descr_get */
9025     0,                                          /* tp_descr_set */
9026     0,                                          /* tp_dictoffset */
9027     super_init,                                 /* tp_init */
9028     PyType_GenericAlloc,                        /* tp_alloc */
9029     PyType_GenericNew,                          /* tp_new */
9030     PyObject_GC_Del,                            /* tp_free */
9031 };
9032