1 /* Type object implementation */
2 
3 #include "Python.h"
4 #include "pycore_call.h"
5 #include "pycore_code.h"          // CO_FAST_FREE
6 #include "pycore_compile.h"       // _Py_Mangle()
7 #include "pycore_initconfig.h"    // _PyStatus_OK()
8 #include "pycore_moduleobject.h"  // _PyModule_GetDef()
9 #include "pycore_object.h"        // _PyType_HasFeature()
10 #include "pycore_pyerrors.h"      // _PyErr_Occurred()
11 #include "pycore_pystate.h"       // _PyThreadState_GET()
12 #include "pycore_unionobject.h"   // _Py_union_type_or
13 #include "frameobject.h"          // PyFrameObject
14 #include "pycore_frame.h"         // InterpreterFrame
15 #include "opcode.h"               // MAKE_CELL
16 #include "structmember.h"         // PyMemberDef
17 
18 #include <ctype.h>
19 
20 /*[clinic input]
21 class type "PyTypeObject *" "&PyType_Type"
22 class object "PyObject *" "&PyBaseObject_Type"
23 [clinic start generated code]*/
24 /*[clinic end generated code: output=da39a3ee5e6b4b0d input=4b94608d231c434b]*/
25 
26 #include "clinic/typeobject.c.h"
27 
28 /* Support type attribute lookup cache */
29 
30 /* The cache can keep references to the names alive for longer than
31    they normally would.  This is why the maximum size is limited to
32    MCACHE_MAX_ATTR_SIZE, since it might be a problem if very large
33    strings are used as attribute names. */
34 #define MCACHE_MAX_ATTR_SIZE    100
35 #define MCACHE_HASH(version, name_hash)                                 \
36         (((unsigned int)(version) ^ (unsigned int)(name_hash))          \
37          & ((1 << MCACHE_SIZE_EXP) - 1))
38 
39 #define MCACHE_HASH_METHOD(type, name)                                  \
40     MCACHE_HASH((type)->tp_version_tag, ((Py_ssize_t)(name)) >> 3)
41 #define MCACHE_CACHEABLE_NAME(name)                             \
42         PyUnicode_CheckExact(name) &&                           \
43         PyUnicode_IS_READY(name) &&                             \
44         (PyUnicode_GET_LENGTH(name) <= MCACHE_MAX_ATTR_SIZE)
45 
46 // bpo-42745: next_version_tag remains shared by all interpreters because of static types
47 // Used to set PyTypeObject.tp_version_tag
48 static unsigned int next_version_tag = 1;
49 
50 typedef struct PySlot_Offset {
51     short subslot_offset;
52     short slot_offset;
53 } PySlot_Offset;
54 
55 
56 /* alphabetical order */
57 _Py_IDENTIFIER(__abstractmethods__);
58 _Py_IDENTIFIER(__annotations__);
59 _Py_IDENTIFIER(__class__);
60 _Py_IDENTIFIER(__class_getitem__);
61 _Py_IDENTIFIER(__classcell__);
62 _Py_IDENTIFIER(__delitem__);
63 _Py_IDENTIFIER(__dict__);
64 _Py_IDENTIFIER(__doc__);
65 _Py_IDENTIFIER(__getattribute__);
66 _Py_IDENTIFIER(__getitem__);
67 _Py_IDENTIFIER(__hash__);
68 _Py_IDENTIFIER(__init_subclass__);
69 _Py_IDENTIFIER(__len__);
70 _Py_IDENTIFIER(__module__);
71 _Py_IDENTIFIER(__name__);
72 _Py_IDENTIFIER(__new__);
73 _Py_IDENTIFIER(__qualname__);
74 _Py_IDENTIFIER(__set_name__);
75 _Py_IDENTIFIER(__setitem__);
76 _Py_IDENTIFIER(__weakref__);
77 _Py_IDENTIFIER(builtins);
78 _Py_IDENTIFIER(mro);
79 
80 static PyObject *
81 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
82 
83 static void
84 clear_slotdefs(void);
85 
86 static PyObject *
87 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound);
88 
89 static int
90 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value);
91 
92 /*
93  * finds the beginning of the docstring's introspection signature.
94  * if present, returns a pointer pointing to the first '('.
95  * otherwise returns NULL.
96  *
97  * doesn't guarantee that the signature is valid, only that it
98  * has a valid prefix.  (the signature must also pass skip_signature.)
99  */
100 static const char *
find_signature(const char * name,const char * doc)101 find_signature(const char *name, const char *doc)
102 {
103     const char *dot;
104     size_t length;
105 
106     if (!doc)
107         return NULL;
108 
109     assert(name != NULL);
110 
111     /* for dotted names like classes, only use the last component */
112     dot = strrchr(name, '.');
113     if (dot)
114         name = dot + 1;
115 
116     length = strlen(name);
117     if (strncmp(doc, name, length))
118         return NULL;
119     doc += length;
120     if (*doc != '(')
121         return NULL;
122     return doc;
123 }
124 
125 #define SIGNATURE_END_MARKER         ")\n--\n\n"
126 #define SIGNATURE_END_MARKER_LENGTH  6
127 /*
128  * skips past the end of the docstring's introspection signature.
129  * (assumes doc starts with a valid signature prefix.)
130  */
131 static const char *
skip_signature(const char * doc)132 skip_signature(const char *doc)
133 {
134     while (*doc) {
135         if ((*doc == *SIGNATURE_END_MARKER) &&
136             !strncmp(doc, SIGNATURE_END_MARKER, SIGNATURE_END_MARKER_LENGTH))
137             return doc + SIGNATURE_END_MARKER_LENGTH;
138         if ((*doc == '\n') && (doc[1] == '\n'))
139             return NULL;
140         doc++;
141     }
142     return NULL;
143 }
144 
145 int
_PyType_CheckConsistency(PyTypeObject * type)146 _PyType_CheckConsistency(PyTypeObject *type)
147 {
148 #define CHECK(expr) \
149     do { if (!(expr)) { _PyObject_ASSERT_FAILED_MSG((PyObject *)type, Py_STRINGIFY(expr)); } } while (0)
150 
151     CHECK(!_PyObject_IsFreed((PyObject *)type));
152 
153     if (!(type->tp_flags & Py_TPFLAGS_READY)) {
154         /* don't check static types before PyType_Ready() */
155         return 1;
156     }
157 
158     CHECK(Py_REFCNT(type) >= 1);
159     CHECK(PyType_Check(type));
160 
161     CHECK(!(type->tp_flags & Py_TPFLAGS_READYING));
162     CHECK(type->tp_dict != NULL);
163 
164     if (type->tp_flags & Py_TPFLAGS_HAVE_GC) {
165         // bpo-44263: tp_traverse is required if Py_TPFLAGS_HAVE_GC is set.
166         // Note: tp_clear is optional.
167         CHECK(type->tp_traverse != NULL);
168     }
169 
170     if (type->tp_flags & Py_TPFLAGS_DISALLOW_INSTANTIATION) {
171         CHECK(type->tp_new == NULL);
172         CHECK(_PyDict_ContainsId(type->tp_dict, &PyId___new__) == 0);
173     }
174 
175     return 1;
176 #undef CHECK
177 }
178 
179 static const char *
_PyType_DocWithoutSignature(const char * name,const char * internal_doc)180 _PyType_DocWithoutSignature(const char *name, const char *internal_doc)
181 {
182     const char *doc = find_signature(name, internal_doc);
183 
184     if (doc) {
185         doc = skip_signature(doc);
186         if (doc)
187             return doc;
188         }
189     return internal_doc;
190 }
191 
192 PyObject *
_PyType_GetDocFromInternalDoc(const char * name,const char * internal_doc)193 _PyType_GetDocFromInternalDoc(const char *name, const char *internal_doc)
194 {
195     const char *doc = _PyType_DocWithoutSignature(name, internal_doc);
196 
197     if (!doc || *doc == '\0') {
198         Py_RETURN_NONE;
199     }
200 
201     return PyUnicode_FromString(doc);
202 }
203 
204 PyObject *
_PyType_GetTextSignatureFromInternalDoc(const char * name,const char * internal_doc)205 _PyType_GetTextSignatureFromInternalDoc(const char *name, const char *internal_doc)
206 {
207     const char *start = find_signature(name, internal_doc);
208     const char *end;
209 
210     if (start)
211         end = skip_signature(start);
212     else
213         end = NULL;
214     if (!end) {
215         Py_RETURN_NONE;
216     }
217 
218     /* back "end" up until it points just past the final ')' */
219     end -= SIGNATURE_END_MARKER_LENGTH - 1;
220     assert((end - start) >= 2); /* should be "()" at least */
221     assert(end[-1] == ')');
222     assert(end[0] == '\n');
223     return PyUnicode_FromStringAndSize(start, end - start);
224 }
225 
226 
227 static struct type_cache*
get_type_cache(void)228 get_type_cache(void)
229 {
230     PyInterpreterState *interp = _PyInterpreterState_GET();
231     return &interp->type_cache;
232 }
233 
234 
235 static void
type_cache_clear(struct type_cache * cache,PyObject * value)236 type_cache_clear(struct type_cache *cache, PyObject *value)
237 {
238     for (Py_ssize_t i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
239         struct type_cache_entry *entry = &cache->hashtable[i];
240         entry->version = 0;
241         Py_XSETREF(entry->name, _Py_XNewRef(value));
242         entry->value = NULL;
243     }
244 }
245 
246 
247 void
_PyType_InitCache(PyInterpreterState * interp)248 _PyType_InitCache(PyInterpreterState *interp)
249 {
250     struct type_cache *cache = &interp->type_cache;
251     for (Py_ssize_t i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
252         struct type_cache_entry *entry = &cache->hashtable[i];
253         assert(entry->name == NULL);
254 
255         entry->version = 0;
256         // Set to None so _PyType_Lookup() can use Py_SETREF(),
257         // rather than using slower Py_XSETREF().
258         entry->name = Py_NewRef(Py_None);
259         entry->value = NULL;
260     }
261 }
262 
263 
264 static unsigned int
_PyType_ClearCache(PyInterpreterState * interp)265 _PyType_ClearCache(PyInterpreterState *interp)
266 {
267     struct type_cache *cache = &interp->type_cache;
268 #if MCACHE_STATS
269     size_t total = cache->hits + cache->collisions + cache->misses;
270     fprintf(stderr, "-- Method cache hits        = %zd (%d%%)\n",
271             cache->hits, (int) (100.0 * cache->hits / total));
272     fprintf(stderr, "-- Method cache true misses = %zd (%d%%)\n",
273             cache->misses, (int) (100.0 * cache->misses / total));
274     fprintf(stderr, "-- Method cache collisions  = %zd (%d%%)\n",
275             cache->collisions, (int) (100.0 * cache->collisions / total));
276     fprintf(stderr, "-- Method cache size        = %zd KiB\n",
277             sizeof(cache->hashtable) / 1024);
278 #endif
279 
280     // Set to None, rather than NULL, so _PyType_Lookup() can
281     // use Py_SETREF() rather than using slower Py_XSETREF().
282     type_cache_clear(cache, Py_None);
283 
284     return next_version_tag - 1;
285 }
286 
287 
288 unsigned int
PyType_ClearCache(void)289 PyType_ClearCache(void)
290 {
291     PyInterpreterState *interp = _PyInterpreterState_GET();
292     return _PyType_ClearCache(interp);
293 }
294 
295 
296 void
_PyType_Fini(PyInterpreterState * interp)297 _PyType_Fini(PyInterpreterState *interp)
298 {
299     struct type_cache *cache = &interp->type_cache;
300     type_cache_clear(cache, NULL);
301     if (_Py_IsMainInterpreter(interp)) {
302         clear_slotdefs();
303     }
304 }
305 
306 
307 void
PyType_Modified(PyTypeObject * type)308 PyType_Modified(PyTypeObject *type)
309 {
310     /* Invalidate any cached data for the specified type and all
311        subclasses.  This function is called after the base
312        classes, mro, or attributes of the type are altered.
313 
314        Invariants:
315 
316        - before Py_TPFLAGS_VALID_VERSION_TAG can be set on a type,
317          it must first be set on all super types.
318 
319        This function clears the Py_TPFLAGS_VALID_VERSION_TAG of a
320        type (so it must first clear it on all subclasses).  The
321        tp_version_tag value is meaningless unless this flag is set.
322        We don't assign new version tags eagerly, but only as
323        needed.
324      */
325     PyObject *raw, *ref;
326     Py_ssize_t i;
327 
328     if (!_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
329         return;
330 
331     raw = type->tp_subclasses;
332     if (raw != NULL) {
333         assert(PyDict_CheckExact(raw));
334         i = 0;
335         while (PyDict_Next(raw, &i, NULL, &ref)) {
336             assert(PyWeakref_CheckRef(ref));
337             ref = PyWeakref_GET_OBJECT(ref);
338             if (ref != Py_None) {
339                 PyType_Modified((PyTypeObject *)ref);
340             }
341         }
342     }
343     type->tp_flags &= ~Py_TPFLAGS_VALID_VERSION_TAG;
344     type->tp_version_tag = 0; /* 0 is not a valid version tag */
345 }
346 
347 static void
type_mro_modified(PyTypeObject * type,PyObject * bases)348 type_mro_modified(PyTypeObject *type, PyObject *bases) {
349     /*
350        Check that all base classes or elements of the MRO of type are
351        able to be cached.  This function is called after the base
352        classes or mro of the type are altered.
353 
354        Unset HAVE_VERSION_TAG and VALID_VERSION_TAG if the type
355        has a custom MRO that includes a type which is not officially
356        super type, or if the type implements its own mro() method.
357 
358        Called from mro_internal, which will subsequently be called on
359        each subclass when their mro is recursively updated.
360      */
361     Py_ssize_t i, n;
362     int custom = !Py_IS_TYPE(type, &PyType_Type);
363     int unbound;
364     PyObject *mro_meth = NULL;
365     PyObject *type_mro_meth = NULL;
366 
367     if (custom) {
368         mro_meth = lookup_maybe_method(
369             (PyObject *)type, &PyId_mro, &unbound);
370         if (mro_meth == NULL)
371             goto clear;
372         type_mro_meth = lookup_maybe_method(
373             (PyObject *)&PyType_Type, &PyId_mro, &unbound);
374         if (type_mro_meth == NULL)
375             goto clear;
376         if (mro_meth != type_mro_meth)
377             goto clear;
378         Py_XDECREF(mro_meth);
379         Py_XDECREF(type_mro_meth);
380     }
381     n = PyTuple_GET_SIZE(bases);
382     for (i = 0; i < n; i++) {
383         PyObject *b = PyTuple_GET_ITEM(bases, i);
384         PyTypeObject *cls;
385 
386         assert(PyType_Check(b));
387         cls = (PyTypeObject *)b;
388 
389         if (!PyType_IsSubtype(type, cls)) {
390             goto clear;
391         }
392     }
393     return;
394  clear:
395     Py_XDECREF(mro_meth);
396     Py_XDECREF(type_mro_meth);
397     type->tp_flags &= ~Py_TPFLAGS_VALID_VERSION_TAG;
398     type->tp_version_tag = 0; /* 0 is not a valid version tag */
399 }
400 
401 static int
assign_version_tag(struct type_cache * cache,PyTypeObject * type)402 assign_version_tag(struct type_cache *cache, PyTypeObject *type)
403 {
404     /* Ensure that the tp_version_tag is valid and set
405        Py_TPFLAGS_VALID_VERSION_TAG.  To respect the invariant, this
406        must first be done on all super classes.  Return 0 if this
407        cannot be done, 1 if Py_TPFLAGS_VALID_VERSION_TAG.
408     */
409     Py_ssize_t i, n;
410     PyObject *bases;
411 
412     if (_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
413         return 1;
414     if (!_PyType_HasFeature(type, Py_TPFLAGS_READY))
415         return 0;
416 
417     if (next_version_tag == 0) {
418         /* We have run out of version numbers */
419         return 0;
420     }
421     type->tp_version_tag = next_version_tag++;
422     assert (type->tp_version_tag != 0);
423 
424     bases = type->tp_bases;
425     n = PyTuple_GET_SIZE(bases);
426     for (i = 0; i < n; i++) {
427         PyObject *b = PyTuple_GET_ITEM(bases, i);
428         assert(PyType_Check(b));
429         if (!assign_version_tag(cache, (PyTypeObject *)b))
430             return 0;
431     }
432     type->tp_flags |= Py_TPFLAGS_VALID_VERSION_TAG;
433     return 1;
434 }
435 
436 
437 static PyMemberDef type_members[] = {
438     {"__basicsize__", T_PYSSIZET, offsetof(PyTypeObject,tp_basicsize),READONLY},
439     {"__itemsize__", T_PYSSIZET, offsetof(PyTypeObject, tp_itemsize), READONLY},
440     {"__flags__", T_ULONG, offsetof(PyTypeObject, tp_flags), READONLY},
441     {"__weakrefoffset__", T_PYSSIZET,
442      offsetof(PyTypeObject, tp_weaklistoffset), READONLY},
443     {"__base__", T_OBJECT, offsetof(PyTypeObject, tp_base), READONLY},
444     {"__dictoffset__", T_PYSSIZET,
445      offsetof(PyTypeObject, tp_dictoffset), READONLY},
446     {"__mro__", T_OBJECT, offsetof(PyTypeObject, tp_mro), READONLY},
447     {0}
448 };
449 
450 static int
check_set_special_type_attr(PyTypeObject * type,PyObject * value,const char * name)451 check_set_special_type_attr(PyTypeObject *type, PyObject *value, const char *name)
452 {
453     if (_PyType_HasFeature(type, Py_TPFLAGS_IMMUTABLETYPE)) {
454         PyErr_Format(PyExc_TypeError,
455                      "cannot set '%s' attribute of immutable type '%s'",
456                      name, type->tp_name);
457         return 0;
458     }
459     if (!value) {
460         PyErr_Format(PyExc_TypeError,
461                      "cannot delete '%s' attribute of immutable type '%s'",
462                      name, type->tp_name);
463         return 0;
464     }
465 
466     if (PySys_Audit("object.__setattr__", "OsO",
467                     type, name, value) < 0) {
468         return 0;
469     }
470 
471     return 1;
472 }
473 
474 const char *
_PyType_Name(PyTypeObject * type)475 _PyType_Name(PyTypeObject *type)
476 {
477     assert(type->tp_name != NULL);
478     const char *s = strrchr(type->tp_name, '.');
479     if (s == NULL) {
480         s = type->tp_name;
481     }
482     else {
483         s++;
484     }
485     return s;
486 }
487 
488 static PyObject *
type_name(PyTypeObject * type,void * context)489 type_name(PyTypeObject *type, void *context)
490 {
491     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
492         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
493 
494         Py_INCREF(et->ht_name);
495         return et->ht_name;
496     }
497     else {
498         return PyUnicode_FromString(_PyType_Name(type));
499     }
500 }
501 
502 static PyObject *
type_qualname(PyTypeObject * type,void * context)503 type_qualname(PyTypeObject *type, void *context)
504 {
505     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
506         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
507         Py_INCREF(et->ht_qualname);
508         return et->ht_qualname;
509     }
510     else {
511         return PyUnicode_FromString(_PyType_Name(type));
512     }
513 }
514 
515 static int
type_set_name(PyTypeObject * type,PyObject * value,void * context)516 type_set_name(PyTypeObject *type, PyObject *value, void *context)
517 {
518     const char *tp_name;
519     Py_ssize_t name_size;
520 
521     if (!check_set_special_type_attr(type, value, "__name__"))
522         return -1;
523     if (!PyUnicode_Check(value)) {
524         PyErr_Format(PyExc_TypeError,
525                      "can only assign string to %s.__name__, not '%s'",
526                      type->tp_name, Py_TYPE(value)->tp_name);
527         return -1;
528     }
529 
530     tp_name = PyUnicode_AsUTF8AndSize(value, &name_size);
531     if (tp_name == NULL)
532         return -1;
533     if (strlen(tp_name) != (size_t)name_size) {
534         PyErr_SetString(PyExc_ValueError,
535                         "type name must not contain null characters");
536         return -1;
537     }
538 
539     type->tp_name = tp_name;
540     Py_INCREF(value);
541     Py_SETREF(((PyHeapTypeObject*)type)->ht_name, value);
542 
543     return 0;
544 }
545 
546 static int
type_set_qualname(PyTypeObject * type,PyObject * value,void * context)547 type_set_qualname(PyTypeObject *type, PyObject *value, void *context)
548 {
549     PyHeapTypeObject* et;
550 
551     if (!check_set_special_type_attr(type, value, "__qualname__"))
552         return -1;
553     if (!PyUnicode_Check(value)) {
554         PyErr_Format(PyExc_TypeError,
555                      "can only assign string to %s.__qualname__, not '%s'",
556                      type->tp_name, Py_TYPE(value)->tp_name);
557         return -1;
558     }
559 
560     et = (PyHeapTypeObject*)type;
561     Py_INCREF(value);
562     Py_SETREF(et->ht_qualname, value);
563     return 0;
564 }
565 
566 static PyObject *
type_module(PyTypeObject * type,void * context)567 type_module(PyTypeObject *type, void *context)
568 {
569     PyObject *mod;
570 
571     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
572         mod = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___module__);
573         if (mod == NULL) {
574             if (!PyErr_Occurred()) {
575                 PyErr_Format(PyExc_AttributeError, "__module__");
576             }
577             return NULL;
578         }
579         Py_INCREF(mod);
580     }
581     else {
582         const char *s = strrchr(type->tp_name, '.');
583         if (s != NULL) {
584             mod = PyUnicode_FromStringAndSize(
585                 type->tp_name, (Py_ssize_t)(s - type->tp_name));
586             if (mod != NULL)
587                 PyUnicode_InternInPlace(&mod);
588         }
589         else {
590             mod = _PyUnicode_FromId(&PyId_builtins);
591             Py_XINCREF(mod);
592         }
593     }
594     return mod;
595 }
596 
597 static int
type_set_module(PyTypeObject * type,PyObject * value,void * context)598 type_set_module(PyTypeObject *type, PyObject *value, void *context)
599 {
600     if (!check_set_special_type_attr(type, value, "__module__"))
601         return -1;
602 
603     PyType_Modified(type);
604 
605     return _PyDict_SetItemId(type->tp_dict, &PyId___module__, value);
606 }
607 
608 static PyObject *
type_abstractmethods(PyTypeObject * type,void * context)609 type_abstractmethods(PyTypeObject *type, void *context)
610 {
611     PyObject *mod = NULL;
612     /* type itself has an __abstractmethods__ descriptor (this). Don't return
613        that. */
614     if (type != &PyType_Type)
615         mod = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___abstractmethods__);
616     if (!mod) {
617         if (!PyErr_Occurred()) {
618             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
619             if (message)
620                 PyErr_SetObject(PyExc_AttributeError, message);
621         }
622         return NULL;
623     }
624     Py_INCREF(mod);
625     return mod;
626 }
627 
628 static int
type_set_abstractmethods(PyTypeObject * type,PyObject * value,void * context)629 type_set_abstractmethods(PyTypeObject *type, PyObject *value, void *context)
630 {
631     /* __abstractmethods__ should only be set once on a type, in
632        abc.ABCMeta.__new__, so this function doesn't do anything
633        special to update subclasses.
634     */
635     int abstract, res;
636     if (value != NULL) {
637         abstract = PyObject_IsTrue(value);
638         if (abstract < 0)
639             return -1;
640         res = _PyDict_SetItemId(type->tp_dict, &PyId___abstractmethods__, value);
641     }
642     else {
643         abstract = 0;
644         res = _PyDict_DelItemId(type->tp_dict, &PyId___abstractmethods__);
645         if (res && PyErr_ExceptionMatches(PyExc_KeyError)) {
646             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
647             if (message)
648                 PyErr_SetObject(PyExc_AttributeError, message);
649             return -1;
650         }
651     }
652     if (res == 0) {
653         PyType_Modified(type);
654         if (abstract)
655             type->tp_flags |= Py_TPFLAGS_IS_ABSTRACT;
656         else
657             type->tp_flags &= ~Py_TPFLAGS_IS_ABSTRACT;
658     }
659     return res;
660 }
661 
662 static PyObject *
type_get_bases(PyTypeObject * type,void * context)663 type_get_bases(PyTypeObject *type, void *context)
664 {
665     Py_INCREF(type->tp_bases);
666     return type->tp_bases;
667 }
668 
669 static PyTypeObject *best_base(PyObject *);
670 static int mro_internal(PyTypeObject *, PyObject **);
671 static int type_is_subtype_base_chain(PyTypeObject *, PyTypeObject *);
672 static int compatible_for_assignment(PyTypeObject *, PyTypeObject *, const char *);
673 static int add_subclass(PyTypeObject*, PyTypeObject*);
674 static int add_all_subclasses(PyTypeObject *type, PyObject *bases);
675 static void remove_subclass(PyTypeObject *, PyTypeObject *);
676 static void remove_all_subclasses(PyTypeObject *type, PyObject *bases);
677 static void update_all_slots(PyTypeObject *);
678 
679 typedef int (*update_callback)(PyTypeObject *, void *);
680 static int update_subclasses(PyTypeObject *type, PyObject *name,
681                              update_callback callback, void *data);
682 static int recurse_down_subclasses(PyTypeObject *type, PyObject *name,
683                                    update_callback callback, void *data);
684 
685 static int
mro_hierarchy(PyTypeObject * type,PyObject * temp)686 mro_hierarchy(PyTypeObject *type, PyObject *temp)
687 {
688     int res;
689     PyObject *new_mro, *old_mro;
690     PyObject *tuple;
691     PyObject *subclasses;
692     Py_ssize_t i, n;
693 
694     res = mro_internal(type, &old_mro);
695     if (res <= 0)
696         /* error / reentrance */
697         return res;
698     new_mro = type->tp_mro;
699 
700     if (old_mro != NULL)
701         tuple = PyTuple_Pack(3, type, new_mro, old_mro);
702     else
703         tuple = PyTuple_Pack(2, type, new_mro);
704 
705     if (tuple != NULL)
706         res = PyList_Append(temp, tuple);
707     else
708         res = -1;
709     Py_XDECREF(tuple);
710 
711     if (res < 0) {
712         type->tp_mro = old_mro;
713         Py_DECREF(new_mro);
714         return -1;
715     }
716     Py_XDECREF(old_mro);
717 
718     /* Obtain a copy of subclasses list to iterate over.
719 
720        Otherwise type->tp_subclasses might be altered
721        in the middle of the loop, for example, through a custom mro(),
722        by invoking type_set_bases on some subclass of the type
723        which in turn calls remove_subclass/add_subclass on this type.
724 
725        Finally, this makes things simple avoiding the need to deal
726        with dictionary iterators and weak references.
727     */
728     subclasses = type___subclasses___impl(type);
729     if (subclasses == NULL)
730         return -1;
731     n = PyList_GET_SIZE(subclasses);
732     for (i = 0; i < n; i++) {
733         PyTypeObject *subclass;
734         subclass = (PyTypeObject *)PyList_GET_ITEM(subclasses, i);
735         res = mro_hierarchy(subclass, temp);
736         if (res < 0)
737             break;
738     }
739     Py_DECREF(subclasses);
740 
741     return res;
742 }
743 
744 static int
type_set_bases(PyTypeObject * type,PyObject * new_bases,void * context)745 type_set_bases(PyTypeObject *type, PyObject *new_bases, void *context)
746 {
747     int res = 0;
748     PyObject *temp;
749     PyObject *old_bases;
750     PyTypeObject *new_base, *old_base;
751     Py_ssize_t i;
752 
753     if (!check_set_special_type_attr(type, new_bases, "__bases__"))
754         return -1;
755     if (!PyTuple_Check(new_bases)) {
756         PyErr_Format(PyExc_TypeError,
757              "can only assign tuple to %s.__bases__, not %s",
758                  type->tp_name, Py_TYPE(new_bases)->tp_name);
759         return -1;
760     }
761     if (PyTuple_GET_SIZE(new_bases) == 0) {
762         PyErr_Format(PyExc_TypeError,
763              "can only assign non-empty tuple to %s.__bases__, not ()",
764                  type->tp_name);
765         return -1;
766     }
767     for (i = 0; i < PyTuple_GET_SIZE(new_bases); i++) {
768         PyObject *ob;
769         PyTypeObject *base;
770 
771         ob = PyTuple_GET_ITEM(new_bases, i);
772         if (!PyType_Check(ob)) {
773             PyErr_Format(PyExc_TypeError,
774                          "%s.__bases__ must be tuple of classes, not '%s'",
775                          type->tp_name, Py_TYPE(ob)->tp_name);
776             return -1;
777         }
778 
779         base = (PyTypeObject*)ob;
780         if (PyType_IsSubtype(base, type) ||
781             /* In case of reentering here again through a custom mro()
782                the above check is not enough since it relies on
783                base->tp_mro which would gonna be updated inside
784                mro_internal only upon returning from the mro().
785 
786                However, base->tp_base has already been assigned (see
787                below), which in turn may cause an inheritance cycle
788                through tp_base chain.  And this is definitely
789                not what you want to ever happen.  */
790             (base->tp_mro != NULL && type_is_subtype_base_chain(base, type))) {
791 
792             PyErr_SetString(PyExc_TypeError,
793                             "a __bases__ item causes an inheritance cycle");
794             return -1;
795         }
796     }
797 
798     new_base = best_base(new_bases);
799     if (new_base == NULL)
800         return -1;
801 
802     if (!compatible_for_assignment(type->tp_base, new_base, "__bases__"))
803         return -1;
804 
805     Py_INCREF(new_bases);
806     Py_INCREF(new_base);
807 
808     old_bases = type->tp_bases;
809     old_base = type->tp_base;
810 
811     type->tp_bases = new_bases;
812     type->tp_base = new_base;
813 
814     temp = PyList_New(0);
815     if (temp == NULL)
816         goto bail;
817     if (mro_hierarchy(type, temp) < 0)
818         goto undo;
819     Py_DECREF(temp);
820 
821     /* Take no action in case if type->tp_bases has been replaced
822        through reentrance.  */
823     if (type->tp_bases == new_bases) {
824         /* any base that was in __bases__ but now isn't, we
825            need to remove |type| from its tp_subclasses.
826            conversely, any class now in __bases__ that wasn't
827            needs to have |type| added to its subclasses. */
828 
829         /* for now, sod that: just remove from all old_bases,
830            add to all new_bases */
831         remove_all_subclasses(type, old_bases);
832         res = add_all_subclasses(type, new_bases);
833         update_all_slots(type);
834     }
835 
836     Py_DECREF(old_bases);
837     Py_DECREF(old_base);
838 
839     assert(_PyType_CheckConsistency(type));
840     return res;
841 
842   undo:
843     for (i = PyList_GET_SIZE(temp) - 1; i >= 0; i--) {
844         PyTypeObject *cls;
845         PyObject *new_mro, *old_mro = NULL;
846 
847         PyArg_UnpackTuple(PyList_GET_ITEM(temp, i),
848                           "", 2, 3, &cls, &new_mro, &old_mro);
849         /* Do not rollback if cls has a newer version of MRO.  */
850         if (cls->tp_mro == new_mro) {
851             Py_XINCREF(old_mro);
852             cls->tp_mro = old_mro;
853             Py_DECREF(new_mro);
854         }
855     }
856     Py_DECREF(temp);
857 
858   bail:
859     if (type->tp_bases == new_bases) {
860         assert(type->tp_base == new_base);
861 
862         type->tp_bases = old_bases;
863         type->tp_base = old_base;
864 
865         Py_DECREF(new_bases);
866         Py_DECREF(new_base);
867     }
868     else {
869         Py_DECREF(old_bases);
870         Py_DECREF(old_base);
871     }
872 
873     assert(_PyType_CheckConsistency(type));
874     return -1;
875 }
876 
877 static PyObject *
type_dict(PyTypeObject * type,void * context)878 type_dict(PyTypeObject *type, void *context)
879 {
880     if (type->tp_dict == NULL) {
881         Py_RETURN_NONE;
882     }
883     return PyDictProxy_New(type->tp_dict);
884 }
885 
886 static PyObject *
type_get_doc(PyTypeObject * type,void * context)887 type_get_doc(PyTypeObject *type, void *context)
888 {
889     PyObject *result;
890     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE) && type->tp_doc != NULL) {
891         return _PyType_GetDocFromInternalDoc(type->tp_name, type->tp_doc);
892     }
893     result = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___doc__);
894     if (result == NULL) {
895         if (!PyErr_Occurred()) {
896             result = Py_None;
897             Py_INCREF(result);
898         }
899     }
900     else if (Py_TYPE(result)->tp_descr_get) {
901         result = Py_TYPE(result)->tp_descr_get(result, NULL,
902                                                (PyObject *)type);
903     }
904     else {
905         Py_INCREF(result);
906     }
907     return result;
908 }
909 
910 static PyObject *
type_get_text_signature(PyTypeObject * type,void * context)911 type_get_text_signature(PyTypeObject *type, void *context)
912 {
913     return _PyType_GetTextSignatureFromInternalDoc(type->tp_name, type->tp_doc);
914 }
915 
916 static int
type_set_doc(PyTypeObject * type,PyObject * value,void * context)917 type_set_doc(PyTypeObject *type, PyObject *value, void *context)
918 {
919     if (!check_set_special_type_attr(type, value, "__doc__"))
920         return -1;
921     PyType_Modified(type);
922     return _PyDict_SetItemId(type->tp_dict, &PyId___doc__, value);
923 }
924 
925 static PyObject *
type_get_annotations(PyTypeObject * type,void * context)926 type_get_annotations(PyTypeObject *type, void *context)
927 {
928     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
929         PyErr_Format(PyExc_AttributeError, "type object '%s' has no attribute '__annotations__'", type->tp_name);
930         return NULL;
931     }
932 
933     PyObject *annotations;
934     /* there's no _PyDict_GetItemId without WithError, so let's LBYL. */
935     if (_PyDict_ContainsId(type->tp_dict, &PyId___annotations__)) {
936         annotations = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___annotations__);
937         /*
938         ** _PyDict_GetItemIdWithError could still fail,
939         ** for instance with a well-timed Ctrl-C or a MemoryError.
940         ** so let's be totally safe.
941         */
942         if (annotations) {
943             if (Py_TYPE(annotations)->tp_descr_get) {
944                 annotations = Py_TYPE(annotations)->tp_descr_get(annotations, NULL,
945                                                        (PyObject *)type);
946             } else {
947                 Py_INCREF(annotations);
948             }
949         }
950     } else {
951         annotations = PyDict_New();
952         if (annotations) {
953             int result = _PyDict_SetItemId(type->tp_dict, &PyId___annotations__, annotations);
954             if (result) {
955                 Py_CLEAR(annotations);
956             } else {
957                 PyType_Modified(type);
958             }
959         }
960     }
961     return annotations;
962 }
963 
964 static int
type_set_annotations(PyTypeObject * type,PyObject * value,void * context)965 type_set_annotations(PyTypeObject *type, PyObject *value, void *context)
966 {
967     if (_PyType_HasFeature(type, Py_TPFLAGS_IMMUTABLETYPE)) {
968         PyErr_Format(PyExc_TypeError,
969                      "cannot set '__annotations__' attribute of immutable type '%s'",
970                      type->tp_name);
971         return -1;
972     }
973 
974     int result;
975     if (value != NULL) {
976         /* set */
977         result = _PyDict_SetItemId(type->tp_dict, &PyId___annotations__, value);
978     } else {
979         /* delete */
980         if (!_PyDict_ContainsId(type->tp_dict, &PyId___annotations__)) {
981             PyErr_Format(PyExc_AttributeError, "__annotations__");
982             return -1;
983         }
984         result = _PyDict_DelItemId(type->tp_dict, &PyId___annotations__);
985     }
986 
987     if (result == 0) {
988         PyType_Modified(type);
989     }
990     return result;
991 }
992 
993 
994 /*[clinic input]
995 type.__instancecheck__ -> bool
996 
997     instance: object
998     /
999 
1000 Check if an object is an instance.
1001 [clinic start generated code]*/
1002 
1003 static int
type___instancecheck___impl(PyTypeObject * self,PyObject * instance)1004 type___instancecheck___impl(PyTypeObject *self, PyObject *instance)
1005 /*[clinic end generated code: output=08b6bf5f591c3618 input=cdbfeaee82c01a0f]*/
1006 {
1007     return _PyObject_RealIsInstance(instance, (PyObject *)self);
1008 }
1009 
1010 /*[clinic input]
1011 type.__subclasscheck__ -> bool
1012 
1013     subclass: object
1014     /
1015 
1016 Check if a class is a subclass.
1017 [clinic start generated code]*/
1018 
1019 static int
type___subclasscheck___impl(PyTypeObject * self,PyObject * subclass)1020 type___subclasscheck___impl(PyTypeObject *self, PyObject *subclass)
1021 /*[clinic end generated code: output=97a4e51694500941 input=071b2ca9e03355f4]*/
1022 {
1023     return _PyObject_RealIsSubclass(subclass, (PyObject *)self);
1024 }
1025 
1026 
1027 static PyGetSetDef type_getsets[] = {
1028     {"__name__", (getter)type_name, (setter)type_set_name, NULL},
1029     {"__qualname__", (getter)type_qualname, (setter)type_set_qualname, NULL},
1030     {"__bases__", (getter)type_get_bases, (setter)type_set_bases, NULL},
1031     {"__module__", (getter)type_module, (setter)type_set_module, NULL},
1032     {"__abstractmethods__", (getter)type_abstractmethods,
1033      (setter)type_set_abstractmethods, NULL},
1034     {"__dict__",  (getter)type_dict,  NULL, NULL},
1035     {"__doc__", (getter)type_get_doc, (setter)type_set_doc, NULL},
1036     {"__text_signature__", (getter)type_get_text_signature, NULL, NULL},
1037     {"__annotations__", (getter)type_get_annotations, (setter)type_set_annotations, NULL},
1038     {0}
1039 };
1040 
1041 static PyObject *
type_repr(PyTypeObject * type)1042 type_repr(PyTypeObject *type)
1043 {
1044     if (type->tp_name == NULL) {
1045         // type_repr() called before the type is fully initialized
1046         // by PyType_Ready().
1047         return PyUnicode_FromFormat("<class at %p>", type);
1048     }
1049 
1050     PyObject *mod, *name, *rtn;
1051 
1052     mod = type_module(type, NULL);
1053     if (mod == NULL)
1054         PyErr_Clear();
1055     else if (!PyUnicode_Check(mod)) {
1056         Py_DECREF(mod);
1057         mod = NULL;
1058     }
1059     name = type_qualname(type, NULL);
1060     if (name == NULL) {
1061         Py_XDECREF(mod);
1062         return NULL;
1063     }
1064 
1065     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
1066         rtn = PyUnicode_FromFormat("<class '%U.%U'>", mod, name);
1067     else
1068         rtn = PyUnicode_FromFormat("<class '%s'>", type->tp_name);
1069 
1070     Py_XDECREF(mod);
1071     Py_DECREF(name);
1072     return rtn;
1073 }
1074 
1075 static PyObject *
type_call(PyTypeObject * type,PyObject * args,PyObject * kwds)1076 type_call(PyTypeObject *type, PyObject *args, PyObject *kwds)
1077 {
1078     PyObject *obj;
1079     PyThreadState *tstate = _PyThreadState_GET();
1080 
1081 #ifdef Py_DEBUG
1082     /* type_call() must not be called with an exception set,
1083        because it can clear it (directly or indirectly) and so the
1084        caller loses its exception */
1085     assert(!_PyErr_Occurred(tstate));
1086 #endif
1087 
1088     /* Special case: type(x) should return Py_TYPE(x) */
1089     /* We only want type itself to accept the one-argument form (#27157) */
1090     if (type == &PyType_Type) {
1091         assert(args != NULL && PyTuple_Check(args));
1092         assert(kwds == NULL || PyDict_Check(kwds));
1093         Py_ssize_t nargs = PyTuple_GET_SIZE(args);
1094 
1095         if (nargs == 1 && (kwds == NULL || !PyDict_GET_SIZE(kwds))) {
1096             obj = (PyObject *) Py_TYPE(PyTuple_GET_ITEM(args, 0));
1097             Py_INCREF(obj);
1098             return obj;
1099         }
1100 
1101         /* SF bug 475327 -- if that didn't trigger, we need 3
1102            arguments. But PyArg_ParseTuple in type_new may give
1103            a msg saying type() needs exactly 3. */
1104         if (nargs != 3) {
1105             PyErr_SetString(PyExc_TypeError,
1106                             "type() takes 1 or 3 arguments");
1107             return NULL;
1108         }
1109     }
1110 
1111     if (type->tp_new == NULL) {
1112         _PyErr_Format(tstate, PyExc_TypeError,
1113                       "cannot create '%s' instances", type->tp_name);
1114         return NULL;
1115     }
1116 
1117     obj = type->tp_new(type, args, kwds);
1118     obj = _Py_CheckFunctionResult(tstate, (PyObject*)type, obj, NULL);
1119     if (obj == NULL)
1120         return NULL;
1121 
1122     /* If the returned object is not an instance of type,
1123        it won't be initialized. */
1124     if (!PyObject_TypeCheck(obj, type))
1125         return obj;
1126 
1127     type = Py_TYPE(obj);
1128     if (type->tp_init != NULL) {
1129         int res = type->tp_init(obj, args, kwds);
1130         if (res < 0) {
1131             assert(_PyErr_Occurred(tstate));
1132             Py_DECREF(obj);
1133             obj = NULL;
1134         }
1135         else {
1136             assert(!_PyErr_Occurred(tstate));
1137         }
1138     }
1139     return obj;
1140 }
1141 
1142 PyObject *
_PyType_AllocNoTrack(PyTypeObject * type,Py_ssize_t nitems)1143 _PyType_AllocNoTrack(PyTypeObject *type, Py_ssize_t nitems)
1144 {
1145     PyObject *obj;
1146     const size_t size = _PyObject_VAR_SIZE(type, nitems+1);
1147     /* note that we need to add one, for the sentinel */
1148 
1149     const size_t presize = _PyType_PreHeaderSize(type);
1150     char *alloc = PyObject_Malloc(size + presize);
1151     if (alloc  == NULL) {
1152         return PyErr_NoMemory();
1153     }
1154     obj = (PyObject *)(alloc + presize);
1155     if (presize) {
1156         ((PyObject **)alloc)[0] = NULL;
1157         ((PyObject **)alloc)[1] = NULL;
1158         _PyObject_GC_Link(obj);
1159     }
1160     memset(obj, '\0', size);
1161 
1162     if (type->tp_itemsize == 0) {
1163         _PyObject_Init(obj, type);
1164     }
1165     else {
1166         _PyObject_InitVar((PyVarObject *)obj, type, nitems);
1167     }
1168     return obj;
1169 }
1170 
1171 PyObject *
PyType_GenericAlloc(PyTypeObject * type,Py_ssize_t nitems)1172 PyType_GenericAlloc(PyTypeObject *type, Py_ssize_t nitems)
1173 {
1174     PyObject *obj = _PyType_AllocNoTrack(type, nitems);
1175     if (obj == NULL) {
1176         return NULL;
1177     }
1178 
1179     if (_PyType_IS_GC(type)) {
1180         _PyObject_GC_TRACK(obj);
1181     }
1182     return obj;
1183 }
1184 
1185 PyObject *
PyType_GenericNew(PyTypeObject * type,PyObject * args,PyObject * kwds)1186 PyType_GenericNew(PyTypeObject *type, PyObject *args, PyObject *kwds)
1187 {
1188     return type->tp_alloc(type, 0);
1189 }
1190 
1191 /* Helpers for subtyping */
1192 
1193 static int
traverse_slots(PyTypeObject * type,PyObject * self,visitproc visit,void * arg)1194 traverse_slots(PyTypeObject *type, PyObject *self, visitproc visit, void *arg)
1195 {
1196     Py_ssize_t i, n;
1197     PyMemberDef *mp;
1198 
1199     n = Py_SIZE(type);
1200     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1201     for (i = 0; i < n; i++, mp++) {
1202         if (mp->type == T_OBJECT_EX) {
1203             char *addr = (char *)self + mp->offset;
1204             PyObject *obj = *(PyObject **)addr;
1205             if (obj != NULL) {
1206                 int err = visit(obj, arg);
1207                 if (err)
1208                     return err;
1209             }
1210         }
1211     }
1212     return 0;
1213 }
1214 
1215 static int
subtype_traverse(PyObject * self,visitproc visit,void * arg)1216 subtype_traverse(PyObject *self, visitproc visit, void *arg)
1217 {
1218     PyTypeObject *type, *base;
1219     traverseproc basetraverse;
1220 
1221     /* Find the nearest base with a different tp_traverse,
1222        and traverse slots while we're at it */
1223     type = Py_TYPE(self);
1224     base = type;
1225     while ((basetraverse = base->tp_traverse) == subtype_traverse) {
1226         if (Py_SIZE(base)) {
1227             int err = traverse_slots(base, self, visit, arg);
1228             if (err)
1229                 return err;
1230         }
1231         base = base->tp_base;
1232         assert(base);
1233     }
1234 
1235     if (type->tp_flags & Py_TPFLAGS_MANAGED_DICT) {
1236         assert(type->tp_dictoffset);
1237         int err = _PyObject_VisitInstanceAttributes(self, visit, arg);
1238         if (err) {
1239             return err;
1240         }
1241     }
1242 
1243     if (type->tp_dictoffset != base->tp_dictoffset) {
1244         PyObject **dictptr = _PyObject_DictPointer(self);
1245         if (dictptr && *dictptr)
1246             Py_VISIT(*dictptr);
1247     }
1248 
1249     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1250         && (!basetraverse || !(base->tp_flags & Py_TPFLAGS_HEAPTYPE))) {
1251         /* For a heaptype, the instances count as references
1252            to the type.          Traverse the type so the collector
1253            can find cycles involving this link.
1254            Skip this visit if basetraverse belongs to a heap type: in that
1255            case, basetraverse will visit the type when we call it later.
1256            */
1257         Py_VISIT(type);
1258     }
1259 
1260     if (basetraverse)
1261         return basetraverse(self, visit, arg);
1262     return 0;
1263 }
1264 
1265 static void
clear_slots(PyTypeObject * type,PyObject * self)1266 clear_slots(PyTypeObject *type, PyObject *self)
1267 {
1268     Py_ssize_t i, n;
1269     PyMemberDef *mp;
1270 
1271     n = Py_SIZE(type);
1272     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1273     for (i = 0; i < n; i++, mp++) {
1274         if (mp->type == T_OBJECT_EX && !(mp->flags & READONLY)) {
1275             char *addr = (char *)self + mp->offset;
1276             PyObject *obj = *(PyObject **)addr;
1277             if (obj != NULL) {
1278                 *(PyObject **)addr = NULL;
1279                 Py_DECREF(obj);
1280             }
1281         }
1282     }
1283 }
1284 
1285 static int
subtype_clear(PyObject * self)1286 subtype_clear(PyObject *self)
1287 {
1288     PyTypeObject *type, *base;
1289     inquiry baseclear;
1290 
1291     /* Find the nearest base with a different tp_clear
1292        and clear slots while we're at it */
1293     type = Py_TYPE(self);
1294     base = type;
1295     while ((baseclear = base->tp_clear) == subtype_clear) {
1296         if (Py_SIZE(base))
1297             clear_slots(base, self);
1298         base = base->tp_base;
1299         assert(base);
1300     }
1301 
1302     /* Clear the instance dict (if any), to break cycles involving only
1303        __dict__ slots (as in the case 'self.__dict__ is self'). */
1304     if (type->tp_flags & Py_TPFLAGS_MANAGED_DICT) {
1305         _PyObject_ClearInstanceAttributes(self);
1306     }
1307     if (type->tp_dictoffset != base->tp_dictoffset) {
1308         PyObject **dictptr = _PyObject_DictPointer(self);
1309         if (dictptr && *dictptr)
1310             Py_CLEAR(*dictptr);
1311     }
1312 
1313     if (baseclear)
1314         return baseclear(self);
1315     return 0;
1316 }
1317 
1318 static void
subtype_dealloc(PyObject * self)1319 subtype_dealloc(PyObject *self)
1320 {
1321     PyTypeObject *type, *base;
1322     destructor basedealloc;
1323     int has_finalizer;
1324 
1325     /* Extract the type; we expect it to be a heap type */
1326     type = Py_TYPE(self);
1327     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
1328 
1329     /* Test whether the type has GC exactly once */
1330 
1331     if (!_PyType_IS_GC(type)) {
1332         /* A non GC dynamic type allows certain simplifications:
1333            there's no need to call clear_slots(), or DECREF the dict,
1334            or clear weakrefs. */
1335 
1336         /* Maybe call finalizer; exit early if resurrected */
1337         if (type->tp_finalize) {
1338             if (PyObject_CallFinalizerFromDealloc(self) < 0)
1339                 return;
1340         }
1341         if (type->tp_del) {
1342             type->tp_del(self);
1343             if (Py_REFCNT(self) > 0) {
1344                 return;
1345             }
1346         }
1347 
1348         /* Find the nearest base with a different tp_dealloc */
1349         base = type;
1350         while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1351             base = base->tp_base;
1352             assert(base);
1353         }
1354 
1355         /* Extract the type again; tp_del may have changed it */
1356         type = Py_TYPE(self);
1357 
1358         // Don't read type memory after calling basedealloc() since basedealloc()
1359         // can deallocate the type and free its memory.
1360         int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1361                                  && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE));
1362 
1363         assert((type->tp_flags & Py_TPFLAGS_MANAGED_DICT) == 0);
1364 
1365         /* Call the base tp_dealloc() */
1366         assert(basedealloc);
1367         basedealloc(self);
1368 
1369         /* Can't reference self beyond this point. It's possible tp_del switched
1370            our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
1371            reference counting. Only decref if the base type is not already a heap
1372            allocated type. Otherwise, basedealloc should have decref'd it already */
1373         if (type_needs_decref) {
1374             Py_DECREF(type);
1375         }
1376 
1377         /* Done */
1378         return;
1379     }
1380 
1381     /* We get here only if the type has GC */
1382 
1383     /* UnTrack and re-Track around the trashcan macro, alas */
1384     /* See explanation at end of function for full disclosure */
1385     PyObject_GC_UnTrack(self);
1386     Py_TRASHCAN_BEGIN(self, subtype_dealloc);
1387 
1388     /* Find the nearest base with a different tp_dealloc */
1389     base = type;
1390     while ((/*basedealloc =*/ base->tp_dealloc) == subtype_dealloc) {
1391         base = base->tp_base;
1392         assert(base);
1393     }
1394 
1395     has_finalizer = type->tp_finalize || type->tp_del;
1396 
1397     if (type->tp_finalize) {
1398         _PyObject_GC_TRACK(self);
1399         if (PyObject_CallFinalizerFromDealloc(self) < 0) {
1400             /* Resurrected */
1401             goto endlabel;
1402         }
1403         _PyObject_GC_UNTRACK(self);
1404     }
1405     /*
1406       If we added a weaklist, we clear it. Do this *before* calling tp_del,
1407       clearing slots, or clearing the instance dict.
1408 
1409       GC tracking must be off at this point. weakref callbacks (if any, and
1410       whether directly here or indirectly in something we call) may trigger GC,
1411       and if self is tracked at that point, it will look like trash to GC and GC
1412       will try to delete self again.
1413     */
1414     if (type->tp_weaklistoffset && !base->tp_weaklistoffset)
1415         PyObject_ClearWeakRefs(self);
1416 
1417     if (type->tp_del) {
1418         _PyObject_GC_TRACK(self);
1419         type->tp_del(self);
1420         if (Py_REFCNT(self) > 0) {
1421             /* Resurrected */
1422             goto endlabel;
1423         }
1424         _PyObject_GC_UNTRACK(self);
1425     }
1426     if (has_finalizer) {
1427         /* New weakrefs could be created during the finalizer call.
1428            If this occurs, clear them out without calling their
1429            finalizers since they might rely on part of the object
1430            being finalized that has already been destroyed. */
1431         if (type->tp_weaklistoffset && !base->tp_weaklistoffset) {
1432             /* Modeled after GET_WEAKREFS_LISTPTR() */
1433             PyWeakReference **list = (PyWeakReference **) \
1434                 _PyObject_GET_WEAKREFS_LISTPTR(self);
1435             while (*list)
1436                 _PyWeakref_ClearRef(*list);
1437         }
1438     }
1439 
1440     /*  Clear slots up to the nearest base with a different tp_dealloc */
1441     base = type;
1442     while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1443         if (Py_SIZE(base))
1444             clear_slots(base, self);
1445         base = base->tp_base;
1446         assert(base);
1447     }
1448 
1449     /* If we added a dict, DECREF it, or free inline values. */
1450     if (type->tp_flags & Py_TPFLAGS_MANAGED_DICT) {
1451         PyObject **dictptr = _PyObject_ManagedDictPointer(self);
1452         if (*dictptr != NULL) {
1453             assert(*_PyObject_ValuesPointer(self) == NULL);
1454             Py_DECREF(*dictptr);
1455             *dictptr = NULL;
1456         }
1457         else {
1458             _PyObject_FreeInstanceAttributes(self);
1459         }
1460     }
1461     else if (type->tp_dictoffset && !base->tp_dictoffset) {
1462         PyObject **dictptr = _PyObject_DictPointer(self);
1463         if (dictptr != NULL) {
1464             PyObject *dict = *dictptr;
1465             if (dict != NULL) {
1466                 Py_DECREF(dict);
1467                 *dictptr = NULL;
1468             }
1469         }
1470     }
1471 
1472     /* Extract the type again; tp_del may have changed it */
1473     type = Py_TYPE(self);
1474 
1475     /* Call the base tp_dealloc(); first retrack self if
1476      * basedealloc knows about gc.
1477      */
1478     if (_PyType_IS_GC(base)) {
1479         _PyObject_GC_TRACK(self);
1480     }
1481 
1482     // Don't read type memory after calling basedealloc() since basedealloc()
1483     // can deallocate the type and free its memory.
1484     int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1485                              && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE));
1486 
1487     assert(basedealloc);
1488     basedealloc(self);
1489 
1490     /* Can't reference self beyond this point. It's possible tp_del switched
1491        our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
1492        reference counting. Only decref if the base type is not already a heap
1493        allocated type. Otherwise, basedealloc should have decref'd it already */
1494     if (type_needs_decref) {
1495         Py_DECREF(type);
1496     }
1497 
1498   endlabel:
1499     Py_TRASHCAN_END
1500 
1501     /* Explanation of the weirdness around the trashcan macros:
1502 
1503        Q. What do the trashcan macros do?
1504 
1505        A. Read the comment titled "Trashcan mechanism" in object.h.
1506           For one, this explains why there must be a call to GC-untrack
1507           before the trashcan begin macro.      Without understanding the
1508           trashcan code, the answers to the following questions don't make
1509           sense.
1510 
1511        Q. Why do we GC-untrack before the trashcan and then immediately
1512           GC-track again afterward?
1513 
1514        A. In the case that the base class is GC-aware, the base class
1515           probably GC-untracks the object.      If it does that using the
1516           UNTRACK macro, this will crash when the object is already
1517           untracked.  Because we don't know what the base class does, the
1518           only safe thing is to make sure the object is tracked when we
1519           call the base class dealloc.  But...  The trashcan begin macro
1520           requires that the object is *untracked* before it is called.  So
1521           the dance becomes:
1522 
1523          GC untrack
1524          trashcan begin
1525          GC track
1526 
1527        Q. Why did the last question say "immediately GC-track again"?
1528           It's nowhere near immediately.
1529 
1530        A. Because the code *used* to re-track immediately.      Bad Idea.
1531           self has a refcount of 0, and if gc ever gets its hands on it
1532           (which can happen if any weakref callback gets invoked), it
1533           looks like trash to gc too, and gc also tries to delete self
1534           then.  But we're already deleting self.  Double deallocation is
1535           a subtle disaster.
1536     */
1537 }
1538 
1539 static PyTypeObject *solid_base(PyTypeObject *type);
1540 
1541 /* type test with subclassing support */
1542 
1543 static int
type_is_subtype_base_chain(PyTypeObject * a,PyTypeObject * b)1544 type_is_subtype_base_chain(PyTypeObject *a, PyTypeObject *b)
1545 {
1546     do {
1547         if (a == b)
1548             return 1;
1549         a = a->tp_base;
1550     } while (a != NULL);
1551 
1552     return (b == &PyBaseObject_Type);
1553 }
1554 
1555 int
PyType_IsSubtype(PyTypeObject * a,PyTypeObject * b)1556 PyType_IsSubtype(PyTypeObject *a, PyTypeObject *b)
1557 {
1558     PyObject *mro;
1559 
1560     mro = a->tp_mro;
1561     if (mro != NULL) {
1562         /* Deal with multiple inheritance without recursion
1563            by walking the MRO tuple */
1564         Py_ssize_t i, n;
1565         assert(PyTuple_Check(mro));
1566         n = PyTuple_GET_SIZE(mro);
1567         for (i = 0; i < n; i++) {
1568             if (PyTuple_GET_ITEM(mro, i) == (PyObject *)b)
1569                 return 1;
1570         }
1571         return 0;
1572     }
1573     else
1574         /* a is not completely initialized yet; follow tp_base */
1575         return type_is_subtype_base_chain(a, b);
1576 }
1577 
1578 /* Routines to do a method lookup in the type without looking in the
1579    instance dictionary (so we can't use PyObject_GetAttr) but still
1580    binding it to the instance.
1581 
1582    Variants:
1583 
1584    - _PyObject_LookupSpecial() returns NULL without raising an exception
1585      when the _PyType_Lookup() call fails;
1586 
1587    - lookup_maybe_method() and lookup_method() are internal routines similar
1588      to _PyObject_LookupSpecial(), but can return unbound PyFunction
1589      to avoid temporary method object. Pass self as first argument when
1590      unbound == 1.
1591 */
1592 
1593 PyObject *
_PyObject_LookupSpecial(PyObject * self,_Py_Identifier * attrid)1594 _PyObject_LookupSpecial(PyObject *self, _Py_Identifier *attrid)
1595 {
1596     PyObject *res;
1597 
1598     res = _PyType_LookupId(Py_TYPE(self), attrid);
1599     if (res != NULL) {
1600         descrgetfunc f;
1601         if ((f = Py_TYPE(res)->tp_descr_get) == NULL)
1602             Py_INCREF(res);
1603         else
1604             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1605     }
1606     return res;
1607 }
1608 
1609 static PyObject *
lookup_maybe_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1610 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1611 {
1612     PyObject *res = _PyType_LookupId(Py_TYPE(self), attrid);
1613     if (res == NULL) {
1614         return NULL;
1615     }
1616 
1617     if (_PyType_HasFeature(Py_TYPE(res), Py_TPFLAGS_METHOD_DESCRIPTOR)) {
1618         /* Avoid temporary PyMethodObject */
1619         *unbound = 1;
1620         Py_INCREF(res);
1621     }
1622     else {
1623         *unbound = 0;
1624         descrgetfunc f = Py_TYPE(res)->tp_descr_get;
1625         if (f == NULL) {
1626             Py_INCREF(res);
1627         }
1628         else {
1629             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1630         }
1631     }
1632     return res;
1633 }
1634 
1635 static PyObject *
lookup_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1636 lookup_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1637 {
1638     PyObject *res = lookup_maybe_method(self, attrid, unbound);
1639     if (res == NULL && !PyErr_Occurred()) {
1640         PyErr_SetObject(PyExc_AttributeError, _PyUnicode_FromId(attrid));
1641     }
1642     return res;
1643 }
1644 
1645 
1646 static inline PyObject*
vectorcall_unbound(PyThreadState * tstate,int unbound,PyObject * func,PyObject * const * args,Py_ssize_t nargs)1647 vectorcall_unbound(PyThreadState *tstate, int unbound, PyObject *func,
1648                    PyObject *const *args, Py_ssize_t nargs)
1649 {
1650     size_t nargsf = nargs;
1651     if (!unbound) {
1652         /* Skip self argument, freeing up args[0] to use for
1653          * PY_VECTORCALL_ARGUMENTS_OFFSET */
1654         args++;
1655         nargsf = nargsf - 1 + PY_VECTORCALL_ARGUMENTS_OFFSET;
1656     }
1657     return _PyObject_VectorcallTstate(tstate, func, args, nargsf, NULL);
1658 }
1659 
1660 static PyObject*
call_unbound_noarg(int unbound,PyObject * func,PyObject * self)1661 call_unbound_noarg(int unbound, PyObject *func, PyObject *self)
1662 {
1663     if (unbound) {
1664         return PyObject_CallOneArg(func, self);
1665     }
1666     else {
1667         return _PyObject_CallNoArgs(func);
1668     }
1669 }
1670 
1671 /* A variation of PyObject_CallMethod* that uses lookup_method()
1672    instead of PyObject_GetAttrString().
1673 
1674    args is an argument vector of length nargs. The first element in this
1675    vector is the special object "self" which is used for the method lookup */
1676 static PyObject *
vectorcall_method(_Py_Identifier * name,PyObject * const * args,Py_ssize_t nargs)1677 vectorcall_method(_Py_Identifier *name,
1678                   PyObject *const *args, Py_ssize_t nargs)
1679 {
1680     assert(nargs >= 1);
1681 
1682     PyThreadState *tstate = _PyThreadState_GET();
1683     int unbound;
1684     PyObject *self = args[0];
1685     PyObject *func = lookup_method(self, name, &unbound);
1686     if (func == NULL) {
1687         return NULL;
1688     }
1689     PyObject *retval = vectorcall_unbound(tstate, unbound, func, args, nargs);
1690     Py_DECREF(func);
1691     return retval;
1692 }
1693 
1694 /* Clone of vectorcall_method() that returns NotImplemented
1695  * when the lookup fails. */
1696 static PyObject *
vectorcall_maybe(PyThreadState * tstate,_Py_Identifier * name,PyObject * const * args,Py_ssize_t nargs)1697 vectorcall_maybe(PyThreadState *tstate, _Py_Identifier *name,
1698                  PyObject *const *args, Py_ssize_t nargs)
1699 {
1700     assert(nargs >= 1);
1701 
1702     int unbound;
1703     PyObject *self = args[0];
1704     PyObject *func = lookup_maybe_method(self, name, &unbound);
1705     if (func == NULL) {
1706         if (!PyErr_Occurred())
1707             Py_RETURN_NOTIMPLEMENTED;
1708         return NULL;
1709     }
1710     PyObject *retval = vectorcall_unbound(tstate, unbound, func, args, nargs);
1711     Py_DECREF(func);
1712     return retval;
1713 }
1714 
1715 /*
1716     Method resolution order algorithm C3 described in
1717     "A Monotonic Superclass Linearization for Dylan",
1718     by Kim Barrett, Bob Cassel, Paul Haahr,
1719     David A. Moon, Keith Playford, and P. Tucker Withington.
1720     (OOPSLA 1996)
1721 
1722     Some notes about the rules implied by C3:
1723 
1724     No duplicate bases.
1725     It isn't legal to repeat a class in a list of base classes.
1726 
1727     The next three properties are the 3 constraints in "C3".
1728 
1729     Local precedence order.
1730     If A precedes B in C's MRO, then A will precede B in the MRO of all
1731     subclasses of C.
1732 
1733     Monotonicity.
1734     The MRO of a class must be an extension without reordering of the
1735     MRO of each of its superclasses.
1736 
1737     Extended Precedence Graph (EPG).
1738     Linearization is consistent if there is a path in the EPG from
1739     each class to all its successors in the linearization.  See
1740     the paper for definition of EPG.
1741  */
1742 
1743 static int
tail_contains(PyObject * tuple,int whence,PyObject * o)1744 tail_contains(PyObject *tuple, int whence, PyObject *o)
1745 {
1746     Py_ssize_t j, size;
1747     size = PyTuple_GET_SIZE(tuple);
1748 
1749     for (j = whence+1; j < size; j++) {
1750         if (PyTuple_GET_ITEM(tuple, j) == o)
1751             return 1;
1752     }
1753     return 0;
1754 }
1755 
1756 static PyObject *
class_name(PyObject * cls)1757 class_name(PyObject *cls)
1758 {
1759     PyObject *name;
1760     if (_PyObject_LookupAttrId(cls, &PyId___name__, &name) == 0) {
1761         name = PyObject_Repr(cls);
1762     }
1763     return name;
1764 }
1765 
1766 static int
check_duplicates(PyObject * tuple)1767 check_duplicates(PyObject *tuple)
1768 {
1769     Py_ssize_t i, j, n;
1770     /* Let's use a quadratic time algorithm,
1771        assuming that the bases tuples is short.
1772     */
1773     n = PyTuple_GET_SIZE(tuple);
1774     for (i = 0; i < n; i++) {
1775         PyObject *o = PyTuple_GET_ITEM(tuple, i);
1776         for (j = i + 1; j < n; j++) {
1777             if (PyTuple_GET_ITEM(tuple, j) == o) {
1778                 o = class_name(o);
1779                 if (o != NULL) {
1780                     if (PyUnicode_Check(o)) {
1781                         PyErr_Format(PyExc_TypeError,
1782                                      "duplicate base class %U", o);
1783                     }
1784                     else {
1785                         PyErr_SetString(PyExc_TypeError,
1786                                         "duplicate base class");
1787                     }
1788                     Py_DECREF(o);
1789                 }
1790                 return -1;
1791             }
1792         }
1793     }
1794     return 0;
1795 }
1796 
1797 /* Raise a TypeError for an MRO order disagreement.
1798 
1799    It's hard to produce a good error message.  In the absence of better
1800    insight into error reporting, report the classes that were candidates
1801    to be put next into the MRO.  There is some conflict between the
1802    order in which they should be put in the MRO, but it's hard to
1803    diagnose what constraint can't be satisfied.
1804 */
1805 
1806 static void
set_mro_error(PyObject ** to_merge,Py_ssize_t to_merge_size,int * remain)1807 set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain)
1808 {
1809     Py_ssize_t i, n, off;
1810     char buf[1000];
1811     PyObject *k, *v;
1812     PyObject *set = PyDict_New();
1813     if (!set) return;
1814 
1815     for (i = 0; i < to_merge_size; i++) {
1816         PyObject *L = to_merge[i];
1817         if (remain[i] < PyTuple_GET_SIZE(L)) {
1818             PyObject *c = PyTuple_GET_ITEM(L, remain[i]);
1819             if (PyDict_SetItem(set, c, Py_None) < 0) {
1820                 Py_DECREF(set);
1821                 return;
1822             }
1823         }
1824     }
1825     n = PyDict_GET_SIZE(set);
1826 
1827     off = PyOS_snprintf(buf, sizeof(buf), "Cannot create a \
1828 consistent method resolution\norder (MRO) for bases");
1829     i = 0;
1830     while (PyDict_Next(set, &i, &k, &v) && (size_t)off < sizeof(buf)) {
1831         PyObject *name = class_name(k);
1832         const char *name_str = NULL;
1833         if (name != NULL) {
1834             if (PyUnicode_Check(name)) {
1835                 name_str = PyUnicode_AsUTF8(name);
1836             }
1837             else {
1838                 name_str = "?";
1839             }
1840         }
1841         if (name_str == NULL) {
1842             Py_XDECREF(name);
1843             Py_DECREF(set);
1844             return;
1845         }
1846         off += PyOS_snprintf(buf + off, sizeof(buf) - off, " %s", name_str);
1847         Py_XDECREF(name);
1848         if (--n && (size_t)(off+1) < sizeof(buf)) {
1849             buf[off++] = ',';
1850             buf[off] = '\0';
1851         }
1852     }
1853     PyErr_SetString(PyExc_TypeError, buf);
1854     Py_DECREF(set);
1855 }
1856 
1857 static int
pmerge(PyObject * acc,PyObject ** to_merge,Py_ssize_t to_merge_size)1858 pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
1859 {
1860     int res = 0;
1861     Py_ssize_t i, j, empty_cnt;
1862     int *remain;
1863 
1864     /* remain stores an index into each sublist of to_merge.
1865        remain[i] is the index of the next base in to_merge[i]
1866        that is not included in acc.
1867     */
1868     remain = PyMem_New(int, to_merge_size);
1869     if (remain == NULL) {
1870         PyErr_NoMemory();
1871         return -1;
1872     }
1873     for (i = 0; i < to_merge_size; i++)
1874         remain[i] = 0;
1875 
1876   again:
1877     empty_cnt = 0;
1878     for (i = 0; i < to_merge_size; i++) {
1879         PyObject *candidate;
1880 
1881         PyObject *cur_tuple = to_merge[i];
1882 
1883         if (remain[i] >= PyTuple_GET_SIZE(cur_tuple)) {
1884             empty_cnt++;
1885             continue;
1886         }
1887 
1888         /* Choose next candidate for MRO.
1889 
1890            The input sequences alone can determine the choice.
1891            If not, choose the class which appears in the MRO
1892            of the earliest direct superclass of the new class.
1893         */
1894 
1895         candidate = PyTuple_GET_ITEM(cur_tuple, remain[i]);
1896         for (j = 0; j < to_merge_size; j++) {
1897             PyObject *j_lst = to_merge[j];
1898             if (tail_contains(j_lst, remain[j], candidate))
1899                 goto skip; /* continue outer loop */
1900         }
1901         res = PyList_Append(acc, candidate);
1902         if (res < 0)
1903             goto out;
1904 
1905         for (j = 0; j < to_merge_size; j++) {
1906             PyObject *j_lst = to_merge[j];
1907             if (remain[j] < PyTuple_GET_SIZE(j_lst) &&
1908                 PyTuple_GET_ITEM(j_lst, remain[j]) == candidate) {
1909                 remain[j]++;
1910             }
1911         }
1912         goto again;
1913       skip: ;
1914     }
1915 
1916     if (empty_cnt != to_merge_size) {
1917         set_mro_error(to_merge, to_merge_size, remain);
1918         res = -1;
1919     }
1920 
1921   out:
1922     PyMem_Free(remain);
1923 
1924     return res;
1925 }
1926 
1927 static PyObject *
mro_implementation(PyTypeObject * type)1928 mro_implementation(PyTypeObject *type)
1929 {
1930     PyObject *result;
1931     PyObject *bases;
1932     PyObject **to_merge;
1933     Py_ssize_t i, n;
1934 
1935     if (!_PyType_IsReady(type)) {
1936         if (PyType_Ready(type) < 0)
1937             return NULL;
1938     }
1939 
1940     bases = type->tp_bases;
1941     assert(PyTuple_Check(bases));
1942     n = PyTuple_GET_SIZE(bases);
1943     for (i = 0; i < n; i++) {
1944         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1945         if (base->tp_mro == NULL) {
1946             PyErr_Format(PyExc_TypeError,
1947                          "Cannot extend an incomplete type '%.100s'",
1948                          base->tp_name);
1949             return NULL;
1950         }
1951         assert(PyTuple_Check(base->tp_mro));
1952     }
1953 
1954     if (n == 1) {
1955         /* Fast path: if there is a single base, constructing the MRO
1956          * is trivial.
1957          */
1958         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, 0);
1959         Py_ssize_t k = PyTuple_GET_SIZE(base->tp_mro);
1960         result = PyTuple_New(k + 1);
1961         if (result == NULL) {
1962             return NULL;
1963         }
1964         Py_INCREF(type);
1965         PyTuple_SET_ITEM(result, 0, (PyObject *) type);
1966         for (i = 0; i < k; i++) {
1967             PyObject *cls = PyTuple_GET_ITEM(base->tp_mro, i);
1968             Py_INCREF(cls);
1969             PyTuple_SET_ITEM(result, i + 1, cls);
1970         }
1971         return result;
1972     }
1973 
1974     /* This is just a basic sanity check. */
1975     if (check_duplicates(bases) < 0) {
1976         return NULL;
1977     }
1978 
1979     /* Find a superclass linearization that honors the constraints
1980        of the explicit tuples of bases and the constraints implied by
1981        each base class.
1982 
1983        to_merge is an array of tuples, where each tuple is a superclass
1984        linearization implied by a base class.  The last element of
1985        to_merge is the declared tuple of bases.
1986     */
1987 
1988     to_merge = PyMem_New(PyObject *, n + 1);
1989     if (to_merge == NULL) {
1990         PyErr_NoMemory();
1991         return NULL;
1992     }
1993 
1994     for (i = 0; i < n; i++) {
1995         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1996         to_merge[i] = base->tp_mro;
1997     }
1998     to_merge[n] = bases;
1999 
2000     result = PyList_New(1);
2001     if (result == NULL) {
2002         PyMem_Free(to_merge);
2003         return NULL;
2004     }
2005 
2006     Py_INCREF(type);
2007     PyList_SET_ITEM(result, 0, (PyObject *)type);
2008     if (pmerge(result, to_merge, n + 1) < 0) {
2009         Py_CLEAR(result);
2010     }
2011 
2012     PyMem_Free(to_merge);
2013     return result;
2014 }
2015 
2016 /*[clinic input]
2017 type.mro
2018 
2019 Return a type's method resolution order.
2020 [clinic start generated code]*/
2021 
2022 static PyObject *
type_mro_impl(PyTypeObject * self)2023 type_mro_impl(PyTypeObject *self)
2024 /*[clinic end generated code: output=bffc4a39b5b57027 input=28414f4e156db28d]*/
2025 {
2026     PyObject *seq;
2027     seq = mro_implementation(self);
2028     if (seq != NULL && !PyList_Check(seq)) {
2029         Py_SETREF(seq, PySequence_List(seq));
2030     }
2031     return seq;
2032 }
2033 
2034 static int
mro_check(PyTypeObject * type,PyObject * mro)2035 mro_check(PyTypeObject *type, PyObject *mro)
2036 {
2037     PyTypeObject *solid;
2038     Py_ssize_t i, n;
2039 
2040     solid = solid_base(type);
2041 
2042     n = PyTuple_GET_SIZE(mro);
2043     for (i = 0; i < n; i++) {
2044         PyTypeObject *base;
2045         PyObject *tmp;
2046 
2047         tmp = PyTuple_GET_ITEM(mro, i);
2048         if (!PyType_Check(tmp)) {
2049             PyErr_Format(
2050                 PyExc_TypeError,
2051                 "mro() returned a non-class ('%.500s')",
2052                 Py_TYPE(tmp)->tp_name);
2053             return -1;
2054         }
2055 
2056         base = (PyTypeObject*)tmp;
2057         if (!PyType_IsSubtype(solid, solid_base(base))) {
2058             PyErr_Format(
2059                 PyExc_TypeError,
2060                 "mro() returned base with unsuitable layout ('%.500s')",
2061                 base->tp_name);
2062             return -1;
2063         }
2064     }
2065 
2066     return 0;
2067 }
2068 
2069 /* Lookups an mcls.mro method, invokes it and checks the result (if needed,
2070    in case of a custom mro() implementation).
2071 
2072    Keep in mind that during execution of this function type->tp_mro
2073    can be replaced due to possible reentrance (for example,
2074    through type_set_bases):
2075 
2076       - when looking up the mcls.mro attribute (it could be
2077         a user-provided descriptor);
2078 
2079       - from inside a custom mro() itself;
2080 
2081       - through a finalizer of the return value of mro().
2082 */
2083 static PyObject *
mro_invoke(PyTypeObject * type)2084 mro_invoke(PyTypeObject *type)
2085 {
2086     PyObject *mro_result;
2087     PyObject *new_mro;
2088     const int custom = !Py_IS_TYPE(type, &PyType_Type);
2089 
2090     if (custom) {
2091         int unbound;
2092         PyObject *mro_meth = lookup_method((PyObject *)type, &PyId_mro,
2093                                            &unbound);
2094         if (mro_meth == NULL)
2095             return NULL;
2096         mro_result = call_unbound_noarg(unbound, mro_meth, (PyObject *)type);
2097         Py_DECREF(mro_meth);
2098     }
2099     else {
2100         mro_result = mro_implementation(type);
2101     }
2102     if (mro_result == NULL)
2103         return NULL;
2104 
2105     new_mro = PySequence_Tuple(mro_result);
2106     Py_DECREF(mro_result);
2107     if (new_mro == NULL) {
2108         return NULL;
2109     }
2110 
2111     if (PyTuple_GET_SIZE(new_mro) == 0) {
2112         Py_DECREF(new_mro);
2113         PyErr_Format(PyExc_TypeError, "type MRO must not be empty");
2114         return NULL;
2115     }
2116 
2117     if (custom && mro_check(type, new_mro) < 0) {
2118         Py_DECREF(new_mro);
2119         return NULL;
2120     }
2121     return new_mro;
2122 }
2123 
2124 /* Calculates and assigns a new MRO to type->tp_mro.
2125    Return values and invariants:
2126 
2127      - Returns 1 if a new MRO value has been set to type->tp_mro due to
2128        this call of mro_internal (no tricky reentrancy and no errors).
2129 
2130        In case if p_old_mro argument is not NULL, a previous value
2131        of type->tp_mro is put there, and the ownership of this
2132        reference is transferred to a caller.
2133        Otherwise, the previous value (if any) is decref'ed.
2134 
2135      - Returns 0 in case when type->tp_mro gets changed because of
2136        reentering here through a custom mro() (see a comment to mro_invoke).
2137 
2138        In this case, a refcount of an old type->tp_mro is adjusted
2139        somewhere deeper in the call stack (by the innermost mro_internal
2140        or its caller) and may become zero upon returning from here.
2141        This also implies that the whole hierarchy of subclasses of the type
2142        has seen the new value and updated their MRO accordingly.
2143 
2144      - Returns -1 in case of an error.
2145 */
2146 static int
mro_internal(PyTypeObject * type,PyObject ** p_old_mro)2147 mro_internal(PyTypeObject *type, PyObject **p_old_mro)
2148 {
2149     PyObject *new_mro, *old_mro;
2150     int reent;
2151 
2152     /* Keep a reference to be able to do a reentrancy check below.
2153        Don't let old_mro be GC'ed and its address be reused for
2154        another object, like (suddenly!) a new tp_mro.  */
2155     old_mro = type->tp_mro;
2156     Py_XINCREF(old_mro);
2157     new_mro = mro_invoke(type);  /* might cause reentrance */
2158     reent = (type->tp_mro != old_mro);
2159     Py_XDECREF(old_mro);
2160     if (new_mro == NULL) {
2161         return -1;
2162     }
2163 
2164     if (reent) {
2165         Py_DECREF(new_mro);
2166         return 0;
2167     }
2168 
2169     type->tp_mro = new_mro;
2170 
2171     type_mro_modified(type, type->tp_mro);
2172     /* corner case: the super class might have been hidden
2173        from the custom MRO */
2174     type_mro_modified(type, type->tp_bases);
2175 
2176     PyType_Modified(type);
2177 
2178     if (p_old_mro != NULL)
2179         *p_old_mro = old_mro;  /* transfer the ownership */
2180     else
2181         Py_XDECREF(old_mro);
2182 
2183     return 1;
2184 }
2185 
2186 /* Calculate the best base amongst multiple base classes.
2187    This is the first one that's on the path to the "solid base". */
2188 
2189 static PyTypeObject *
best_base(PyObject * bases)2190 best_base(PyObject *bases)
2191 {
2192     Py_ssize_t i, n;
2193     PyTypeObject *base, *winner, *candidate, *base_i;
2194     PyObject *base_proto;
2195 
2196     assert(PyTuple_Check(bases));
2197     n = PyTuple_GET_SIZE(bases);
2198     assert(n > 0);
2199     base = NULL;
2200     winner = NULL;
2201     for (i = 0; i < n; i++) {
2202         base_proto = PyTuple_GET_ITEM(bases, i);
2203         if (!PyType_Check(base_proto)) {
2204             PyErr_SetString(
2205                 PyExc_TypeError,
2206                 "bases must be types");
2207             return NULL;
2208         }
2209         base_i = (PyTypeObject *)base_proto;
2210         if (!_PyType_IsReady(base_i)) {
2211             if (PyType_Ready(base_i) < 0)
2212                 return NULL;
2213         }
2214         if (!_PyType_HasFeature(base_i, Py_TPFLAGS_BASETYPE)) {
2215             PyErr_Format(PyExc_TypeError,
2216                          "type '%.100s' is not an acceptable base type",
2217                          base_i->tp_name);
2218             return NULL;
2219         }
2220         candidate = solid_base(base_i);
2221         if (winner == NULL) {
2222             winner = candidate;
2223             base = base_i;
2224         }
2225         else if (PyType_IsSubtype(winner, candidate))
2226             ;
2227         else if (PyType_IsSubtype(candidate, winner)) {
2228             winner = candidate;
2229             base = base_i;
2230         }
2231         else {
2232             PyErr_SetString(
2233                 PyExc_TypeError,
2234                 "multiple bases have "
2235                 "instance lay-out conflict");
2236             return NULL;
2237         }
2238     }
2239     assert (base != NULL);
2240 
2241     return base;
2242 }
2243 
2244 static int
extra_ivars(PyTypeObject * type,PyTypeObject * base)2245 extra_ivars(PyTypeObject *type, PyTypeObject *base)
2246 {
2247     size_t t_size = type->tp_basicsize;
2248     size_t b_size = base->tp_basicsize;
2249 
2250     assert(t_size >= b_size); /* Else type smaller than base! */
2251     if (type->tp_itemsize || base->tp_itemsize) {
2252         /* If itemsize is involved, stricter rules */
2253         return t_size != b_size ||
2254             type->tp_itemsize != base->tp_itemsize;
2255     }
2256     if (type->tp_weaklistoffset && base->tp_weaklistoffset == 0 &&
2257         type->tp_weaklistoffset + sizeof(PyObject *) == t_size &&
2258         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2259         t_size -= sizeof(PyObject *);
2260     return t_size != b_size;
2261 }
2262 
2263 static PyTypeObject *
solid_base(PyTypeObject * type)2264 solid_base(PyTypeObject *type)
2265 {
2266     PyTypeObject *base;
2267 
2268     if (type->tp_base)
2269         base = solid_base(type->tp_base);
2270     else
2271         base = &PyBaseObject_Type;
2272     if (extra_ivars(type, base))
2273         return type;
2274     else
2275         return base;
2276 }
2277 
2278 static void object_dealloc(PyObject *);
2279 static PyObject *object_new(PyTypeObject *, PyObject *, PyObject *);
2280 static int object_init(PyObject *, PyObject *, PyObject *);
2281 static int update_slot(PyTypeObject *, PyObject *);
2282 static void fixup_slot_dispatchers(PyTypeObject *);
2283 static int type_new_set_names(PyTypeObject *);
2284 static int type_new_init_subclass(PyTypeObject *, PyObject *);
2285 
2286 /*
2287  * Helpers for  __dict__ descriptor.  We don't want to expose the dicts
2288  * inherited from various builtin types.  The builtin base usually provides
2289  * its own __dict__ descriptor, so we use that when we can.
2290  */
2291 static PyTypeObject *
get_builtin_base_with_dict(PyTypeObject * type)2292 get_builtin_base_with_dict(PyTypeObject *type)
2293 {
2294     while (type->tp_base != NULL) {
2295         if (type->tp_dictoffset != 0 &&
2296             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
2297             return type;
2298         type = type->tp_base;
2299     }
2300     return NULL;
2301 }
2302 
2303 static PyObject *
get_dict_descriptor(PyTypeObject * type)2304 get_dict_descriptor(PyTypeObject *type)
2305 {
2306     PyObject *descr;
2307 
2308     descr = _PyType_LookupId(type, &PyId___dict__);
2309     if (descr == NULL || !PyDescr_IsData(descr))
2310         return NULL;
2311 
2312     return descr;
2313 }
2314 
2315 static void
raise_dict_descr_error(PyObject * obj)2316 raise_dict_descr_error(PyObject *obj)
2317 {
2318     PyErr_Format(PyExc_TypeError,
2319                  "this __dict__ descriptor does not support "
2320                  "'%.200s' objects", Py_TYPE(obj)->tp_name);
2321 }
2322 
2323 static PyObject *
subtype_dict(PyObject * obj,void * context)2324 subtype_dict(PyObject *obj, void *context)
2325 {
2326     PyTypeObject *base;
2327 
2328     base = get_builtin_base_with_dict(Py_TYPE(obj));
2329     if (base != NULL) {
2330         descrgetfunc func;
2331         PyObject *descr = get_dict_descriptor(base);
2332         if (descr == NULL) {
2333             raise_dict_descr_error(obj);
2334             return NULL;
2335         }
2336         func = Py_TYPE(descr)->tp_descr_get;
2337         if (func == NULL) {
2338             raise_dict_descr_error(obj);
2339             return NULL;
2340         }
2341         return func(descr, obj, (PyObject *)(Py_TYPE(obj)));
2342     }
2343     return PyObject_GenericGetDict(obj, context);
2344 }
2345 
2346 static int
subtype_setdict(PyObject * obj,PyObject * value,void * context)2347 subtype_setdict(PyObject *obj, PyObject *value, void *context)
2348 {
2349     PyObject **dictptr;
2350     PyTypeObject *base;
2351 
2352     base = get_builtin_base_with_dict(Py_TYPE(obj));
2353     if (base != NULL) {
2354         descrsetfunc func;
2355         PyObject *descr = get_dict_descriptor(base);
2356         if (descr == NULL) {
2357             raise_dict_descr_error(obj);
2358             return -1;
2359         }
2360         func = Py_TYPE(descr)->tp_descr_set;
2361         if (func == NULL) {
2362             raise_dict_descr_error(obj);
2363             return -1;
2364         }
2365         return func(descr, obj, value);
2366     }
2367     /* Almost like PyObject_GenericSetDict, but allow __dict__ to be deleted. */
2368     dictptr = _PyObject_GetDictPtr(obj);
2369     if (dictptr == NULL) {
2370         PyErr_SetString(PyExc_AttributeError,
2371                         "This object has no __dict__");
2372         return -1;
2373     }
2374     if (value != NULL && !PyDict_Check(value)) {
2375         PyErr_Format(PyExc_TypeError,
2376                      "__dict__ must be set to a dictionary, "
2377                      "not a '%.200s'", Py_TYPE(value)->tp_name);
2378         return -1;
2379     }
2380     Py_XINCREF(value);
2381     Py_XSETREF(*dictptr, value);
2382     return 0;
2383 }
2384 
2385 static PyObject *
subtype_getweakref(PyObject * obj,void * context)2386 subtype_getweakref(PyObject *obj, void *context)
2387 {
2388     PyObject **weaklistptr;
2389     PyObject *result;
2390     PyTypeObject *type = Py_TYPE(obj);
2391 
2392     if (type->tp_weaklistoffset == 0) {
2393         PyErr_SetString(PyExc_AttributeError,
2394                         "This object has no __weakref__");
2395         return NULL;
2396     }
2397     _PyObject_ASSERT((PyObject *)type,
2398                      type->tp_weaklistoffset > 0);
2399     _PyObject_ASSERT((PyObject *)type,
2400                      ((type->tp_weaklistoffset + sizeof(PyObject *))
2401                       <= (size_t)(type->tp_basicsize)));
2402     weaklistptr = (PyObject **)((char *)obj + type->tp_weaklistoffset);
2403     if (*weaklistptr == NULL)
2404         result = Py_None;
2405     else
2406         result = *weaklistptr;
2407     Py_INCREF(result);
2408     return result;
2409 }
2410 
2411 /* Three variants on the subtype_getsets list. */
2412 
2413 static PyGetSetDef subtype_getsets_full[] = {
2414     {"__dict__", subtype_dict, subtype_setdict,
2415      PyDoc_STR("dictionary for instance variables (if defined)")},
2416     {"__weakref__", subtype_getweakref, NULL,
2417      PyDoc_STR("list of weak references to the object (if defined)")},
2418     {0}
2419 };
2420 
2421 static PyGetSetDef subtype_getsets_dict_only[] = {
2422     {"__dict__", subtype_dict, subtype_setdict,
2423      PyDoc_STR("dictionary for instance variables (if defined)")},
2424     {0}
2425 };
2426 
2427 static PyGetSetDef subtype_getsets_weakref_only[] = {
2428     {"__weakref__", subtype_getweakref, NULL,
2429      PyDoc_STR("list of weak references to the object (if defined)")},
2430     {0}
2431 };
2432 
2433 static int
valid_identifier(PyObject * s)2434 valid_identifier(PyObject *s)
2435 {
2436     if (!PyUnicode_Check(s)) {
2437         PyErr_Format(PyExc_TypeError,
2438                      "__slots__ items must be strings, not '%.200s'",
2439                      Py_TYPE(s)->tp_name);
2440         return 0;
2441     }
2442     if (!PyUnicode_IsIdentifier(s)) {
2443         PyErr_SetString(PyExc_TypeError,
2444                         "__slots__ must be identifiers");
2445         return 0;
2446     }
2447     return 1;
2448 }
2449 
2450 static int
type_init(PyObject * cls,PyObject * args,PyObject * kwds)2451 type_init(PyObject *cls, PyObject *args, PyObject *kwds)
2452 {
2453     assert(args != NULL && PyTuple_Check(args));
2454     assert(kwds == NULL || PyDict_Check(kwds));
2455 
2456     if (kwds != NULL && PyTuple_GET_SIZE(args) == 1 &&
2457         PyDict_GET_SIZE(kwds) != 0) {
2458         PyErr_SetString(PyExc_TypeError,
2459                         "type.__init__() takes no keyword arguments");
2460         return -1;
2461     }
2462 
2463     if ((PyTuple_GET_SIZE(args) != 1 && PyTuple_GET_SIZE(args) != 3)) {
2464         PyErr_SetString(PyExc_TypeError,
2465                         "type.__init__() takes 1 or 3 arguments");
2466         return -1;
2467     }
2468 
2469     return 0;
2470 }
2471 
2472 unsigned long
PyType_GetFlags(PyTypeObject * type)2473 PyType_GetFlags(PyTypeObject *type)
2474 {
2475     return type->tp_flags;
2476 }
2477 
2478 /* Determine the most derived metatype. */
2479 PyTypeObject *
_PyType_CalculateMetaclass(PyTypeObject * metatype,PyObject * bases)2480 _PyType_CalculateMetaclass(PyTypeObject *metatype, PyObject *bases)
2481 {
2482     Py_ssize_t i, nbases;
2483     PyTypeObject *winner;
2484     PyObject *tmp;
2485     PyTypeObject *tmptype;
2486 
2487     /* Determine the proper metatype to deal with this,
2488        and check for metatype conflicts while we're at it.
2489        Note that if some other metatype wins to contract,
2490        it's possible that its instances are not types. */
2491 
2492     nbases = PyTuple_GET_SIZE(bases);
2493     winner = metatype;
2494     for (i = 0; i < nbases; i++) {
2495         tmp = PyTuple_GET_ITEM(bases, i);
2496         tmptype = Py_TYPE(tmp);
2497         if (PyType_IsSubtype(winner, tmptype))
2498             continue;
2499         if (PyType_IsSubtype(tmptype, winner)) {
2500             winner = tmptype;
2501             continue;
2502         }
2503         /* else: */
2504         PyErr_SetString(PyExc_TypeError,
2505                         "metaclass conflict: "
2506                         "the metaclass of a derived class "
2507                         "must be a (non-strict) subclass "
2508                         "of the metaclasses of all its bases");
2509         return NULL;
2510     }
2511     return winner;
2512 }
2513 
2514 
2515 // Forward declaration
2516 static PyObject *
2517 type_new(PyTypeObject *metatype, PyObject *args, PyObject *kwds);
2518 
2519 typedef struct {
2520     PyTypeObject *metatype;
2521     PyObject *args;
2522     PyObject *kwds;
2523     PyObject *orig_dict;
2524     PyObject *name;
2525     PyObject *bases;
2526     PyTypeObject *base;
2527     PyObject *slots;
2528     Py_ssize_t nslot;
2529     int add_dict;
2530     int add_weak;
2531     int may_add_dict;
2532     int may_add_weak;
2533 } type_new_ctx;
2534 
2535 
2536 /* Check for valid slot names and two special cases */
2537 static int
type_new_visit_slots(type_new_ctx * ctx)2538 type_new_visit_slots(type_new_ctx *ctx)
2539 {
2540     PyObject *slots = ctx->slots;
2541     Py_ssize_t nslot = ctx->nslot;
2542     for (Py_ssize_t i = 0; i < nslot; i++) {
2543         PyObject *name = PyTuple_GET_ITEM(slots, i);
2544         if (!valid_identifier(name)) {
2545             return -1;
2546         }
2547         assert(PyUnicode_Check(name));
2548         if (_PyUnicode_EqualToASCIIId(name, &PyId___dict__)) {
2549             if (!ctx->may_add_dict || ctx->add_dict != 0) {
2550                 PyErr_SetString(PyExc_TypeError,
2551                     "__dict__ slot disallowed: "
2552                     "we already got one");
2553                 return -1;
2554             }
2555             ctx->add_dict++;
2556         }
2557         if (_PyUnicode_EqualToASCIIId(name, &PyId___weakref__)) {
2558             if (!ctx->may_add_weak || ctx->add_weak != 0) {
2559                 PyErr_SetString(PyExc_TypeError,
2560                     "__weakref__ slot disallowed: "
2561                     "either we already got one, "
2562                     "or __itemsize__ != 0");
2563                 return -1;
2564             }
2565             ctx->add_weak++;
2566         }
2567     }
2568     return 0;
2569 }
2570 
2571 
2572 /* Copy slots into a list, mangle names and sort them.
2573    Sorted names are needed for __class__ assignment.
2574    Convert them back to tuple at the end.
2575 */
2576 static PyObject*
type_new_copy_slots(type_new_ctx * ctx,PyObject * dict)2577 type_new_copy_slots(type_new_ctx *ctx, PyObject *dict)
2578 {
2579     PyObject *slots = ctx->slots;
2580     Py_ssize_t nslot = ctx->nslot;
2581 
2582     Py_ssize_t new_nslot = nslot - ctx->add_dict - ctx->add_weak;
2583     PyObject *new_slots = PyList_New(new_nslot);
2584     if (new_slots == NULL) {
2585         return NULL;
2586     }
2587 
2588     Py_ssize_t j = 0;
2589     for (Py_ssize_t i = 0; i < nslot; i++) {
2590         PyObject *slot = PyTuple_GET_ITEM(slots, i);
2591         if ((ctx->add_dict &&
2592              _PyUnicode_EqualToASCIIId(slot, &PyId___dict__)) ||
2593             (ctx->add_weak &&
2594              _PyUnicode_EqualToASCIIString(slot, "__weakref__")))
2595         {
2596             continue;
2597         }
2598 
2599         slot =_Py_Mangle(ctx->name, slot);
2600         if (!slot) {
2601             goto error;
2602         }
2603         PyList_SET_ITEM(new_slots, j, slot);
2604 
2605         int r = PyDict_Contains(dict, slot);
2606         if (r < 0) {
2607             goto error;
2608         }
2609         if (r > 0) {
2610             /* CPython inserts __qualname__ and __classcell__ (when needed)
2611                into the namespace when creating a class.  They will be deleted
2612                below so won't act as class variables. */
2613             if (!_PyUnicode_EqualToASCIIId(slot, &PyId___qualname__) &&
2614                 !_PyUnicode_EqualToASCIIId(slot, &PyId___classcell__))
2615             {
2616                 PyErr_Format(PyExc_ValueError,
2617                              "%R in __slots__ conflicts with class variable",
2618                              slot);
2619                 goto error;
2620             }
2621         }
2622 
2623         j++;
2624     }
2625     assert(j == new_nslot);
2626 
2627     if (PyList_Sort(new_slots) == -1) {
2628         goto error;
2629     }
2630 
2631     PyObject *tuple = PyList_AsTuple(new_slots);
2632     Py_DECREF(new_slots);
2633     if (tuple == NULL) {
2634         return NULL;
2635     }
2636 
2637     assert(PyTuple_GET_SIZE(tuple) == new_nslot);
2638     return tuple;
2639 
2640 error:
2641     Py_DECREF(new_slots);
2642     return NULL;
2643 }
2644 
2645 
2646 static void
type_new_slots_bases(type_new_ctx * ctx)2647 type_new_slots_bases(type_new_ctx *ctx)
2648 {
2649     Py_ssize_t nbases = PyTuple_GET_SIZE(ctx->bases);
2650     if (nbases > 1 &&
2651         ((ctx->may_add_dict && ctx->add_dict == 0) ||
2652          (ctx->may_add_weak && ctx->add_weak == 0)))
2653     {
2654         for (Py_ssize_t i = 0; i < nbases; i++) {
2655             PyObject *base = PyTuple_GET_ITEM(ctx->bases, i);
2656             if (base == (PyObject *)ctx->base) {
2657                 /* Skip primary base */
2658                 continue;
2659             }
2660 
2661             assert(PyType_Check(base));
2662             PyTypeObject *type = (PyTypeObject *)base;
2663             if (ctx->may_add_dict && ctx->add_dict == 0 &&
2664                 type->tp_dictoffset != 0)
2665             {
2666                 ctx->add_dict++;
2667             }
2668             if (ctx->may_add_weak && ctx->add_weak == 0 &&
2669                 type->tp_weaklistoffset != 0)
2670             {
2671                 ctx->add_weak++;
2672             }
2673             if (ctx->may_add_dict && ctx->add_dict == 0) {
2674                 continue;
2675             }
2676             if (ctx->may_add_weak && ctx->add_weak == 0) {
2677                 continue;
2678             }
2679             /* Nothing more to check */
2680             break;
2681         }
2682     }
2683 }
2684 
2685 
2686 static int
type_new_slots_impl(type_new_ctx * ctx,PyObject * dict)2687 type_new_slots_impl(type_new_ctx *ctx, PyObject *dict)
2688 {
2689     /* Are slots allowed? */
2690     if (ctx->nslot > 0 && ctx->base->tp_itemsize != 0) {
2691         PyErr_Format(PyExc_TypeError,
2692                      "nonempty __slots__ not supported for subtype of '%s'",
2693                      ctx->base->tp_name);
2694         return -1;
2695     }
2696 
2697     if (type_new_visit_slots(ctx) < 0) {
2698         return -1;
2699     }
2700 
2701     PyObject *new_slots = type_new_copy_slots(ctx, dict);
2702     if (new_slots == NULL) {
2703         return -1;
2704     }
2705     assert(PyTuple_CheckExact(new_slots));
2706 
2707     Py_XSETREF(ctx->slots, new_slots);
2708     ctx->nslot = PyTuple_GET_SIZE(new_slots);
2709 
2710     /* Secondary bases may provide weakrefs or dict */
2711     type_new_slots_bases(ctx);
2712     return 0;
2713 }
2714 
2715 
2716 static Py_ssize_t
type_new_slots(type_new_ctx * ctx,PyObject * dict)2717 type_new_slots(type_new_ctx *ctx, PyObject *dict)
2718 {
2719     // Check for a __slots__ sequence variable in dict, and count it
2720     ctx->add_dict = 0;
2721     ctx->add_weak = 0;
2722     ctx->may_add_dict = (ctx->base->tp_dictoffset == 0);
2723     ctx->may_add_weak = (ctx->base->tp_weaklistoffset == 0
2724                          && ctx->base->tp_itemsize == 0);
2725 
2726     if (ctx->slots == NULL) {
2727         if (ctx->may_add_dict) {
2728             ctx->add_dict++;
2729         }
2730         if (ctx->may_add_weak) {
2731             ctx->add_weak++;
2732         }
2733     }
2734     else {
2735         /* Have slots */
2736         if (type_new_slots_impl(ctx, dict) < 0) {
2737             return -1;
2738         }
2739     }
2740     return 0;
2741 }
2742 
2743 
2744 static PyTypeObject*
type_new_alloc(type_new_ctx * ctx)2745 type_new_alloc(type_new_ctx *ctx)
2746 {
2747     PyTypeObject *metatype = ctx->metatype;
2748     PyTypeObject *type;
2749 
2750     // Allocate the type object
2751     type = (PyTypeObject *)metatype->tp_alloc(metatype, ctx->nslot);
2752     if (type == NULL) {
2753         return NULL;
2754     }
2755     PyHeapTypeObject *et = (PyHeapTypeObject *)type;
2756 
2757     // Initialize tp_flags.
2758     // All heap types need GC, since we can create a reference cycle by storing
2759     // an instance on one of its parents.
2760     type->tp_flags = (Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HEAPTYPE |
2761                       Py_TPFLAGS_BASETYPE | Py_TPFLAGS_HAVE_GC);
2762 
2763     // Initialize essential fields
2764     type->tp_as_async = &et->as_async;
2765     type->tp_as_number = &et->as_number;
2766     type->tp_as_sequence = &et->as_sequence;
2767     type->tp_as_mapping = &et->as_mapping;
2768     type->tp_as_buffer = &et->as_buffer;
2769 
2770     type->tp_bases = Py_NewRef(ctx->bases);
2771     type->tp_base = (PyTypeObject *)Py_NewRef(ctx->base);
2772 
2773     type->tp_dealloc = subtype_dealloc;
2774     /* Always override allocation strategy to use regular heap */
2775     type->tp_alloc = PyType_GenericAlloc;
2776     type->tp_free = PyObject_GC_Del;
2777 
2778     type->tp_traverse = subtype_traverse;
2779     type->tp_clear = subtype_clear;
2780 
2781     et->ht_name = Py_NewRef(ctx->name);
2782     et->ht_module = NULL;
2783     et->_ht_tpname = NULL;
2784 
2785     return type;
2786 }
2787 
2788 
2789 static int
type_new_set_name(const type_new_ctx * ctx,PyTypeObject * type)2790 type_new_set_name(const type_new_ctx *ctx, PyTypeObject *type)
2791 {
2792     Py_ssize_t name_size;
2793     type->tp_name = PyUnicode_AsUTF8AndSize(ctx->name, &name_size);
2794     if (!type->tp_name) {
2795         return -1;
2796     }
2797     if (strlen(type->tp_name) != (size_t)name_size) {
2798         PyErr_SetString(PyExc_ValueError,
2799                         "type name must not contain null characters");
2800         return -1;
2801     }
2802     return 0;
2803 }
2804 
2805 
2806 /* Set __module__ in the dict */
2807 static int
type_new_set_module(PyTypeObject * type)2808 type_new_set_module(PyTypeObject *type)
2809 {
2810     int r = _PyDict_ContainsId(type->tp_dict, &PyId___module__);
2811     if (r < 0) {
2812         return -1;
2813     }
2814     if (r > 0) {
2815         return 0;
2816     }
2817 
2818     PyObject *globals = PyEval_GetGlobals();
2819     if (globals == NULL) {
2820         return 0;
2821     }
2822 
2823     PyObject *module = _PyDict_GetItemIdWithError(globals, &PyId___name__);
2824     if (module == NULL) {
2825         if (PyErr_Occurred()) {
2826             return -1;
2827         }
2828         return 0;
2829     }
2830 
2831     if (_PyDict_SetItemId(type->tp_dict, &PyId___module__, module) < 0) {
2832         return -1;
2833     }
2834     return 0;
2835 }
2836 
2837 
2838 /* Set ht_qualname to dict['__qualname__'] if available, else to
2839    __name__.  The __qualname__ accessor will look for ht_qualname. */
2840 static int
type_new_set_ht_name(PyTypeObject * type)2841 type_new_set_ht_name(PyTypeObject *type)
2842 {
2843     PyHeapTypeObject *et = (PyHeapTypeObject *)type;
2844     PyObject *qualname = _PyDict_GetItemIdWithError(type->tp_dict,
2845                                                     &PyId___qualname__);
2846     if (qualname != NULL) {
2847         if (!PyUnicode_Check(qualname)) {
2848             PyErr_Format(PyExc_TypeError,
2849                     "type __qualname__ must be a str, not %s",
2850                     Py_TYPE(qualname)->tp_name);
2851             return -1;
2852         }
2853         et->ht_qualname = Py_NewRef(qualname);
2854         if (_PyDict_DelItemId(type->tp_dict, &PyId___qualname__) < 0) {
2855             return -1;
2856         }
2857     }
2858     else {
2859         if (PyErr_Occurred()) {
2860             return -1;
2861         }
2862         et->ht_qualname = Py_NewRef(et->ht_name);
2863     }
2864     return 0;
2865 }
2866 
2867 
2868 /* Set tp_doc to a copy of dict['__doc__'], if the latter is there
2869    and is a string.  The __doc__ accessor will first look for tp_doc;
2870    if that fails, it will still look into __dict__. */
2871 static int
type_new_set_doc(PyTypeObject * type)2872 type_new_set_doc(PyTypeObject *type)
2873 {
2874     PyObject *doc = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___doc__);
2875     if (doc == NULL) {
2876         if (PyErr_Occurred()) {
2877             return -1;
2878         }
2879         // no __doc__ key
2880         return 0;
2881     }
2882     if (!PyUnicode_Check(doc)) {
2883         // ignore non-string __doc__
2884         return 0;
2885     }
2886 
2887     const char *doc_str = PyUnicode_AsUTF8(doc);
2888     if (doc_str == NULL) {
2889         return -1;
2890     }
2891 
2892     // Silently truncate the docstring if it contains a null byte
2893     Py_ssize_t size = strlen(doc_str) + 1;
2894     char *tp_doc = (char *)PyObject_Malloc(size);
2895     if (tp_doc == NULL) {
2896         PyErr_NoMemory();
2897         return -1;
2898     }
2899 
2900     memcpy(tp_doc, doc_str, size);
2901     type->tp_doc = tp_doc;
2902     return 0;
2903 }
2904 
2905 
2906 static int
type_new_staticmethod(PyTypeObject * type,_Py_Identifier * attr_id)2907 type_new_staticmethod(PyTypeObject *type, _Py_Identifier *attr_id)
2908 {
2909     PyObject *func = _PyDict_GetItemIdWithError(type->tp_dict, attr_id);
2910     if (func == NULL) {
2911         if (PyErr_Occurred()) {
2912             return -1;
2913         }
2914         return 0;
2915     }
2916     if (!PyFunction_Check(func)) {
2917         return 0;
2918     }
2919 
2920     PyObject *static_func = PyStaticMethod_New(func);
2921     if (static_func == NULL) {
2922         return -1;
2923     }
2924     if (_PyDict_SetItemId(type->tp_dict, attr_id, static_func) < 0) {
2925         Py_DECREF(static_func);
2926         return -1;
2927     }
2928     Py_DECREF(static_func);
2929     return 0;
2930 }
2931 
2932 
2933 static int
type_new_classmethod(PyTypeObject * type,_Py_Identifier * attr_id)2934 type_new_classmethod(PyTypeObject *type, _Py_Identifier *attr_id)
2935 {
2936     PyObject *func = _PyDict_GetItemIdWithError(type->tp_dict, attr_id);
2937     if (func == NULL) {
2938         if (PyErr_Occurred()) {
2939             return -1;
2940         }
2941         return 0;
2942     }
2943     if (!PyFunction_Check(func)) {
2944         return 0;
2945     }
2946 
2947     PyObject *method = PyClassMethod_New(func);
2948     if (method == NULL) {
2949         return -1;
2950     }
2951 
2952     if (_PyDict_SetItemId(type->tp_dict, attr_id, method) < 0) {
2953         Py_DECREF(method);
2954         return -1;
2955     }
2956     Py_DECREF(method);
2957     return 0;
2958 }
2959 
2960 
2961 /* Add descriptors for custom slots from __slots__, or for __dict__ */
2962 static int
type_new_descriptors(const type_new_ctx * ctx,PyTypeObject * type)2963 type_new_descriptors(const type_new_ctx *ctx, PyTypeObject *type)
2964 {
2965     PyHeapTypeObject *et = (PyHeapTypeObject *)type;
2966     Py_ssize_t slotoffset = ctx->base->tp_basicsize;
2967     if (et->ht_slots != NULL) {
2968         PyMemberDef *mp = PyHeapType_GET_MEMBERS(et);
2969         Py_ssize_t nslot = PyTuple_GET_SIZE(et->ht_slots);
2970         for (Py_ssize_t i = 0; i < nslot; i++, mp++) {
2971             mp->name = PyUnicode_AsUTF8(
2972                 PyTuple_GET_ITEM(et->ht_slots, i));
2973             if (mp->name == NULL) {
2974                 return -1;
2975             }
2976             mp->type = T_OBJECT_EX;
2977             mp->offset = slotoffset;
2978 
2979             /* __dict__ and __weakref__ are already filtered out */
2980             assert(strcmp(mp->name, "__dict__") != 0);
2981             assert(strcmp(mp->name, "__weakref__") != 0);
2982 
2983             slotoffset += sizeof(PyObject *);
2984         }
2985     }
2986 
2987     if (ctx->add_dict && ctx->base->tp_itemsize) {
2988         type->tp_dictoffset = -(long)sizeof(PyObject *);
2989         slotoffset += sizeof(PyObject *);
2990     }
2991 
2992     if (ctx->add_weak) {
2993         assert(!ctx->base->tp_itemsize);
2994         type->tp_weaklistoffset = slotoffset;
2995         slotoffset += sizeof(PyObject *);
2996     }
2997     if (ctx->add_dict && ctx->base->tp_itemsize == 0) {
2998         assert((type->tp_flags & Py_TPFLAGS_MANAGED_DICT) == 0);
2999         type->tp_flags |= Py_TPFLAGS_MANAGED_DICT;
3000         type->tp_dictoffset = -slotoffset - sizeof(PyObject *)*3;
3001     }
3002 
3003     type->tp_basicsize = slotoffset;
3004     type->tp_itemsize = ctx->base->tp_itemsize;
3005     type->tp_members = PyHeapType_GET_MEMBERS(et);
3006     return 0;
3007 }
3008 
3009 
3010 static void
type_new_set_slots(const type_new_ctx * ctx,PyTypeObject * type)3011 type_new_set_slots(const type_new_ctx *ctx, PyTypeObject *type)
3012 {
3013     if (type->tp_weaklistoffset && type->tp_dictoffset) {
3014         type->tp_getset = subtype_getsets_full;
3015     }
3016     else if (type->tp_weaklistoffset && !type->tp_dictoffset) {
3017         type->tp_getset = subtype_getsets_weakref_only;
3018     }
3019     else if (!type->tp_weaklistoffset && type->tp_dictoffset) {
3020         type->tp_getset = subtype_getsets_dict_only;
3021     }
3022     else {
3023         type->tp_getset = NULL;
3024     }
3025 
3026     /* Special case some slots */
3027     if (type->tp_dictoffset != 0 || ctx->nslot > 0) {
3028         PyTypeObject *base = ctx->base;
3029         if (base->tp_getattr == NULL && base->tp_getattro == NULL) {
3030             type->tp_getattro = PyObject_GenericGetAttr;
3031         }
3032         if (base->tp_setattr == NULL && base->tp_setattro == NULL) {
3033             type->tp_setattro = PyObject_GenericSetAttr;
3034         }
3035     }
3036 }
3037 
3038 
3039 /* store type in class' cell if one is supplied */
3040 static int
type_new_set_classcell(PyTypeObject * type)3041 type_new_set_classcell(PyTypeObject *type)
3042 {
3043     PyObject *cell = _PyDict_GetItemIdWithError(type->tp_dict,
3044                                                 &PyId___classcell__);
3045     if (cell == NULL) {
3046         if (PyErr_Occurred()) {
3047             return -1;
3048         }
3049         return 0;
3050     }
3051 
3052     /* At least one method requires a reference to its defining class */
3053     if (!PyCell_Check(cell)) {
3054         PyErr_Format(PyExc_TypeError,
3055                      "__classcell__ must be a nonlocal cell, not %.200R",
3056                      Py_TYPE(cell));
3057         return -1;
3058     }
3059 
3060     (void)PyCell_Set(cell, (PyObject *) type);
3061     if (_PyDict_DelItemId(type->tp_dict, &PyId___classcell__) < 0) {
3062         return -1;
3063     }
3064     return 0;
3065 }
3066 
3067 
3068 static int
type_new_set_attrs(const type_new_ctx * ctx,PyTypeObject * type)3069 type_new_set_attrs(const type_new_ctx *ctx, PyTypeObject *type)
3070 {
3071     if (type_new_set_name(ctx, type) < 0) {
3072         return -1;
3073     }
3074 
3075     if (type_new_set_module(type) < 0) {
3076         return -1;
3077     }
3078 
3079     if (type_new_set_ht_name(type) < 0) {
3080         return -1;
3081     }
3082 
3083     if (type_new_set_doc(type) < 0) {
3084         return -1;
3085     }
3086 
3087     /* Special-case __new__: if it's a plain function,
3088        make it a static function */
3089     if (type_new_staticmethod(type, &PyId___new__) < 0) {
3090         return -1;
3091     }
3092 
3093     /* Special-case __init_subclass__ and __class_getitem__:
3094        if they are plain functions, make them classmethods */
3095     if (type_new_classmethod(type, &PyId___init_subclass__) < 0) {
3096         return -1;
3097     }
3098     if (type_new_classmethod(type, &PyId___class_getitem__) < 0) {
3099         return -1;
3100     }
3101 
3102     if (type_new_descriptors(ctx, type) < 0) {
3103         return -1;
3104     }
3105 
3106     type_new_set_slots(ctx, type);
3107 
3108     if (type_new_set_classcell(type) < 0) {
3109         return -1;
3110     }
3111     return 0;
3112 }
3113 
3114 
3115 static int
type_new_get_slots(type_new_ctx * ctx,PyObject * dict)3116 type_new_get_slots(type_new_ctx *ctx, PyObject *dict)
3117 {
3118     _Py_IDENTIFIER(__slots__);
3119     PyObject *slots = _PyDict_GetItemIdWithError(dict, &PyId___slots__);
3120     if (slots == NULL) {
3121         if (PyErr_Occurred()) {
3122             return -1;
3123         }
3124         ctx->slots = NULL;
3125         ctx->nslot = 0;
3126         return 0;
3127     }
3128 
3129     // Make it into a tuple
3130     PyObject *new_slots;
3131     if (PyUnicode_Check(slots)) {
3132         new_slots = PyTuple_Pack(1, slots);
3133     }
3134     else {
3135         new_slots = PySequence_Tuple(slots);
3136     }
3137     if (new_slots == NULL) {
3138         return -1;
3139     }
3140     assert(PyTuple_CheckExact(new_slots));
3141     ctx->slots = new_slots;
3142     ctx->nslot = PyTuple_GET_SIZE(new_slots);
3143     return 0;
3144 }
3145 
3146 
3147 static PyTypeObject*
type_new_init(type_new_ctx * ctx)3148 type_new_init(type_new_ctx *ctx)
3149 {
3150     PyObject *dict = PyDict_Copy(ctx->orig_dict);
3151     if (dict == NULL) {
3152         goto error;
3153     }
3154 
3155     if (type_new_get_slots(ctx, dict) < 0) {
3156         goto error;
3157     }
3158     assert(!PyErr_Occurred());
3159 
3160     if (type_new_slots(ctx, dict) < 0) {
3161         goto error;
3162     }
3163 
3164     PyTypeObject *type = type_new_alloc(ctx);
3165     if (type == NULL) {
3166         goto error;
3167     }
3168 
3169     type->tp_dict = dict;
3170 
3171     PyHeapTypeObject *et = (PyHeapTypeObject*)type;
3172     et->ht_slots = ctx->slots;
3173     ctx->slots = NULL;
3174 
3175     return type;
3176 
3177 error:
3178     Py_CLEAR(ctx->slots);
3179     Py_XDECREF(dict);
3180     return NULL;
3181 }
3182 
3183 
3184 static PyObject*
type_new_impl(type_new_ctx * ctx)3185 type_new_impl(type_new_ctx *ctx)
3186 {
3187     PyTypeObject *type = type_new_init(ctx);
3188     if (type == NULL) {
3189         return NULL;
3190     }
3191 
3192     if (type_new_set_attrs(ctx, type) < 0) {
3193         goto error;
3194     }
3195 
3196     /* Initialize the rest */
3197     if (PyType_Ready(type) < 0) {
3198         goto error;
3199     }
3200 
3201     // Put the proper slots in place
3202     fixup_slot_dispatchers(type);
3203 
3204     if (type->tp_flags & Py_TPFLAGS_MANAGED_DICT) {
3205         PyHeapTypeObject *et = (PyHeapTypeObject*)type;
3206         et->ht_cached_keys = _PyDict_NewKeysForClass();
3207     }
3208 
3209     if (type_new_set_names(type) < 0) {
3210         goto error;
3211     }
3212 
3213     if (type_new_init_subclass(type, ctx->kwds) < 0) {
3214         goto error;
3215     }
3216 
3217     assert(_PyType_CheckConsistency(type));
3218 
3219     return (PyObject *)type;
3220 
3221 error:
3222     Py_DECREF(type);
3223     return NULL;
3224 }
3225 
3226 
3227 static int
type_new_get_bases(type_new_ctx * ctx,PyObject ** type)3228 type_new_get_bases(type_new_ctx *ctx, PyObject **type)
3229 {
3230     Py_ssize_t nbases = PyTuple_GET_SIZE(ctx->bases);
3231     if (nbases == 0) {
3232         // Adjust for empty tuple bases
3233         ctx->base = &PyBaseObject_Type;
3234         PyObject *new_bases = PyTuple_Pack(1, ctx->base);
3235         if (new_bases == NULL) {
3236             return -1;
3237         }
3238         ctx->bases = new_bases;
3239         return 0;
3240     }
3241 
3242     _Py_IDENTIFIER(__mro_entries__);
3243     for (Py_ssize_t i = 0; i < nbases; i++) {
3244         PyObject *base = PyTuple_GET_ITEM(ctx->bases, i);
3245         if (PyType_Check(base)) {
3246             continue;
3247         }
3248         PyObject *mro_entries;
3249         if (_PyObject_LookupAttrId(base, &PyId___mro_entries__,
3250                                    &mro_entries) < 0) {
3251             return -1;
3252         }
3253         if (mro_entries != NULL) {
3254             PyErr_SetString(PyExc_TypeError,
3255                             "type() doesn't support MRO entry resolution; "
3256                             "use types.new_class()");
3257             Py_DECREF(mro_entries);
3258             return -1;
3259         }
3260     }
3261 
3262     // Search the bases for the proper metatype to deal with this
3263     PyTypeObject *winner;
3264     winner = _PyType_CalculateMetaclass(ctx->metatype, ctx->bases);
3265     if (winner == NULL) {
3266         return -1;
3267     }
3268 
3269     if (winner != ctx->metatype) {
3270         if (winner->tp_new != type_new) {
3271             /* Pass it to the winner */
3272             *type = winner->tp_new(winner, ctx->args, ctx->kwds);
3273             if (*type == NULL) {
3274                 return -1;
3275             }
3276             return 1;
3277         }
3278 
3279         ctx->metatype = winner;
3280     }
3281 
3282     /* Calculate best base, and check that all bases are type objects */
3283     PyTypeObject *base = best_base(ctx->bases);
3284     if (base == NULL) {
3285         return -1;
3286     }
3287 
3288     ctx->base = base;
3289     ctx->bases = Py_NewRef(ctx->bases);
3290     return 0;
3291 }
3292 
3293 
3294 static PyObject *
type_new(PyTypeObject * metatype,PyObject * args,PyObject * kwds)3295 type_new(PyTypeObject *metatype, PyObject *args, PyObject *kwds)
3296 {
3297     assert(args != NULL && PyTuple_Check(args));
3298     assert(kwds == NULL || PyDict_Check(kwds));
3299 
3300     /* Parse arguments: (name, bases, dict) */
3301     PyObject *name, *bases, *orig_dict;
3302     if (!PyArg_ParseTuple(args, "UO!O!:type.__new__",
3303                           &name,
3304                           &PyTuple_Type, &bases,
3305                           &PyDict_Type, &orig_dict))
3306     {
3307         return NULL;
3308     }
3309 
3310     type_new_ctx ctx = {
3311         .metatype = metatype,
3312         .args = args,
3313         .kwds = kwds,
3314         .orig_dict = orig_dict,
3315         .name = name,
3316         .bases = bases,
3317         .base = NULL,
3318         .slots = NULL,
3319         .nslot = 0,
3320         .add_dict = 0,
3321         .add_weak = 0,
3322         .may_add_dict = 0,
3323         .may_add_weak = 0};
3324     PyObject *type = NULL;
3325     int res = type_new_get_bases(&ctx, &type);
3326     if (res < 0) {
3327         assert(PyErr_Occurred());
3328         return NULL;
3329     }
3330     if (res == 1) {
3331         assert(type != NULL);
3332         return type;
3333     }
3334     assert(ctx.base != NULL);
3335     assert(ctx.bases != NULL);
3336 
3337     type = type_new_impl(&ctx);
3338     Py_DECREF(ctx.bases);
3339     return type;
3340 }
3341 
3342 
3343 static PyObject *
type_vectorcall(PyObject * metatype,PyObject * const * args,size_t nargsf,PyObject * kwnames)3344 type_vectorcall(PyObject *metatype, PyObject *const *args,
3345                  size_t nargsf, PyObject *kwnames)
3346 {
3347     Py_ssize_t nargs = PyVectorcall_NARGS(nargsf);
3348     if (nargs == 1 && metatype == (PyObject *)&PyType_Type){
3349         if (!_PyArg_NoKwnames("type", kwnames)) {
3350             return NULL;
3351         }
3352         return Py_NewRef(Py_TYPE(args[0]));
3353     }
3354     /* In other (much less common) cases, fall back to
3355        more flexible calling conventions. */
3356     PyThreadState *tstate = _PyThreadState_GET();
3357     return _PyObject_MakeTpCall(tstate, metatype, args, nargs, kwnames);
3358 }
3359 
3360 /* An array of type slot offsets corresponding to Py_tp_* constants,
3361   * for use in e.g. PyType_Spec and PyType_GetSlot.
3362   * Each entry has two offsets: "slot_offset" and "subslot_offset".
3363   * If is subslot_offset is -1, slot_offset is an offset within the
3364   * PyTypeObject struct.
3365   * Otherwise slot_offset is an offset to a pointer to a sub-slots struct
3366   * (such as "tp_as_number"), and subslot_offset is the offset within
3367   * that struct.
3368   * The actual table is generated by a script.
3369   */
3370 static const PySlot_Offset pyslot_offsets[] = {
3371     {0, 0},
3372 #include "typeslots.inc"
3373 };
3374 
3375 PyObject *
PyType_FromSpecWithBases(PyType_Spec * spec,PyObject * bases)3376 PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
3377 {
3378     return PyType_FromModuleAndSpec(NULL, spec, bases);
3379 }
3380 
3381 PyObject *
PyType_FromModuleAndSpec(PyObject * module,PyType_Spec * spec,PyObject * bases)3382 PyType_FromModuleAndSpec(PyObject *module, PyType_Spec *spec, PyObject *bases)
3383 {
3384     PyHeapTypeObject *res;
3385     PyObject *modname;
3386     PyTypeObject *type, *base;
3387     int r;
3388 
3389     const PyType_Slot *slot;
3390     Py_ssize_t nmembers, weaklistoffset, dictoffset, vectorcalloffset;
3391     char *res_start;
3392     short slot_offset, subslot_offset;
3393 
3394     nmembers = weaklistoffset = dictoffset = vectorcalloffset = 0;
3395     for (slot = spec->slots; slot->slot; slot++) {
3396         if (slot->slot == Py_tp_members) {
3397             nmembers = 0;
3398             for (const PyMemberDef *memb = slot->pfunc; memb->name != NULL; memb++) {
3399                 nmembers++;
3400                 if (strcmp(memb->name, "__weaklistoffset__") == 0) {
3401                     // The PyMemberDef must be a Py_ssize_t and readonly
3402                     assert(memb->type == T_PYSSIZET);
3403                     assert(memb->flags == READONLY);
3404                     weaklistoffset = memb->offset;
3405                 }
3406                 if (strcmp(memb->name, "__dictoffset__") == 0) {
3407                     // The PyMemberDef must be a Py_ssize_t and readonly
3408                     assert(memb->type == T_PYSSIZET);
3409                     assert(memb->flags == READONLY);
3410                     dictoffset = memb->offset;
3411                 }
3412                 if (strcmp(memb->name, "__vectorcalloffset__") == 0) {
3413                     // The PyMemberDef must be a Py_ssize_t and readonly
3414                     assert(memb->type == T_PYSSIZET);
3415                     assert(memb->flags == READONLY);
3416                     vectorcalloffset = memb->offset;
3417                 }
3418             }
3419         }
3420     }
3421 
3422     res = (PyHeapTypeObject*)PyType_GenericAlloc(&PyType_Type, nmembers);
3423     if (res == NULL)
3424         return NULL;
3425     res_start = (char*)res;
3426 
3427     if (spec->name == NULL) {
3428         PyErr_SetString(PyExc_SystemError,
3429                         "Type spec does not define the name field.");
3430         goto fail;
3431     }
3432 
3433     type = &res->ht_type;
3434     /* The flags must be initialized early, before the GC traverses us */
3435     type->tp_flags = spec->flags | Py_TPFLAGS_HEAPTYPE;
3436 
3437     /* Set the type name and qualname */
3438     const char *s = strrchr(spec->name, '.');
3439     if (s == NULL) {
3440         s = spec->name;
3441     }
3442     else {
3443         s++;
3444     }
3445 
3446     res->ht_name = PyUnicode_FromString(s);
3447     if (!res->ht_name) {
3448         goto fail;
3449     }
3450     res->ht_qualname = Py_NewRef(res->ht_name);
3451 
3452     /* Copy spec->name to a buffer we own.
3453     *
3454     * Unfortunately, we can't use tp_name directly (with some
3455     * flag saying that it should be deallocated with the type),
3456     * because tp_name is public API and may be set independently
3457     * of any such flag.
3458     * So, we use a separate buffer, _ht_tpname, that's always
3459     * deallocated with the type (if it's non-NULL).
3460     */
3461     Py_ssize_t name_buf_len = strlen(spec->name) + 1;
3462     res->_ht_tpname = PyMem_Malloc(name_buf_len);
3463     if (res->_ht_tpname == NULL) {
3464         goto fail;
3465     }
3466     type->tp_name = memcpy(res->_ht_tpname, spec->name, name_buf_len);
3467 
3468     res->ht_module = Py_XNewRef(module);
3469 
3470     /* Adjust for empty tuple bases */
3471     if (!bases) {
3472         base = &PyBaseObject_Type;
3473         /* See whether Py_tp_base(s) was specified */
3474         for (slot = spec->slots; slot->slot; slot++) {
3475             if (slot->slot == Py_tp_base)
3476                 base = slot->pfunc;
3477             else if (slot->slot == Py_tp_bases) {
3478                 bases = slot->pfunc;
3479             }
3480         }
3481         if (!bases) {
3482             bases = PyTuple_Pack(1, base);
3483             if (!bases)
3484                 goto fail;
3485         }
3486         else if (!PyTuple_Check(bases)) {
3487             PyErr_SetString(PyExc_SystemError, "Py_tp_bases is not a tuple");
3488             goto fail;
3489         }
3490         else {
3491             Py_INCREF(bases);
3492         }
3493     }
3494     else if (!PyTuple_Check(bases)) {
3495         bases = PyTuple_Pack(1, bases);
3496         if (!bases)
3497             goto fail;
3498     }
3499     else {
3500         Py_INCREF(bases);
3501     }
3502 
3503     /* Calculate best base, and check that all bases are type objects */
3504     base = best_base(bases);
3505     if (base == NULL) {
3506         Py_DECREF(bases);
3507         goto fail;
3508     }
3509     if (!_PyType_HasFeature(base, Py_TPFLAGS_BASETYPE)) {
3510         PyErr_Format(PyExc_TypeError,
3511                      "type '%.100s' is not an acceptable base type",
3512                      base->tp_name);
3513         Py_DECREF(bases);
3514         goto fail;
3515     }
3516 
3517     /* Initialize essential fields */
3518     type->tp_as_async = &res->as_async;
3519     type->tp_as_number = &res->as_number;
3520     type->tp_as_sequence = &res->as_sequence;
3521     type->tp_as_mapping = &res->as_mapping;
3522     type->tp_as_buffer = &res->as_buffer;
3523     /* Set tp_base and tp_bases */
3524     type->tp_bases = bases;
3525     Py_INCREF(base);
3526     type->tp_base = base;
3527 
3528     type->tp_basicsize = spec->basicsize;
3529     type->tp_itemsize = spec->itemsize;
3530 
3531     for (slot = spec->slots; slot->slot; slot++) {
3532         if (slot->slot < 0
3533             || (size_t)slot->slot >= Py_ARRAY_LENGTH(pyslot_offsets)) {
3534             PyErr_SetString(PyExc_RuntimeError, "invalid slot offset");
3535             goto fail;
3536         }
3537         else if (slot->slot == Py_tp_base || slot->slot == Py_tp_bases) {
3538             /* Processed above */
3539             continue;
3540         }
3541         else if (slot->slot == Py_tp_doc) {
3542             /* For the docstring slot, which usually points to a static string
3543                literal, we need to make a copy */
3544             if (slot->pfunc == NULL) {
3545                 type->tp_doc = NULL;
3546                 continue;
3547             }
3548             size_t len = strlen(slot->pfunc)+1;
3549             char *tp_doc = PyObject_Malloc(len);
3550             if (tp_doc == NULL) {
3551                 type->tp_doc = NULL;
3552                 PyErr_NoMemory();
3553                 goto fail;
3554             }
3555             memcpy(tp_doc, slot->pfunc, len);
3556             type->tp_doc = tp_doc;
3557         }
3558         else if (slot->slot == Py_tp_members) {
3559             /* Move the slots to the heap type itself */
3560             size_t len = Py_TYPE(type)->tp_itemsize * nmembers;
3561             memcpy(PyHeapType_GET_MEMBERS(res), slot->pfunc, len);
3562             type->tp_members = PyHeapType_GET_MEMBERS(res);
3563         }
3564         else {
3565             /* Copy other slots directly */
3566             PySlot_Offset slotoffsets = pyslot_offsets[slot->slot];
3567             slot_offset = slotoffsets.slot_offset;
3568             if (slotoffsets.subslot_offset == -1) {
3569                 *(void**)((char*)res_start + slot_offset) = slot->pfunc;
3570             } else {
3571                 void *parent_slot = *(void**)((char*)res_start + slot_offset);
3572                 subslot_offset = slotoffsets.subslot_offset;
3573                 *(void**)((char*)parent_slot + subslot_offset) = slot->pfunc;
3574             }
3575         }
3576     }
3577     if (type->tp_dealloc == NULL) {
3578         /* It's a heap type, so needs the heap types' dealloc.
3579            subtype_dealloc will call the base type's tp_dealloc, if
3580            necessary. */
3581         type->tp_dealloc = subtype_dealloc;
3582     }
3583 
3584     if (vectorcalloffset) {
3585         type->tp_vectorcall_offset = vectorcalloffset;
3586     }
3587 
3588     if (PyType_Ready(type) < 0)
3589         goto fail;
3590 
3591     if (type->tp_flags & Py_TPFLAGS_MANAGED_DICT) {
3592         res->ht_cached_keys = _PyDict_NewKeysForClass();
3593     }
3594 
3595     if (type->tp_doc) {
3596         PyObject *__doc__ = PyUnicode_FromString(_PyType_DocWithoutSignature(type->tp_name, type->tp_doc));
3597         if (!__doc__)
3598             goto fail;
3599         r = _PyDict_SetItemId(type->tp_dict, &PyId___doc__, __doc__);
3600         Py_DECREF(__doc__);
3601         if (r < 0)
3602             goto fail;
3603     }
3604 
3605     if (weaklistoffset) {
3606         type->tp_weaklistoffset = weaklistoffset;
3607         if (PyDict_DelItemString((PyObject *)type->tp_dict, "__weaklistoffset__") < 0)
3608             goto fail;
3609     }
3610     if (dictoffset) {
3611         type->tp_dictoffset = dictoffset;
3612         if (PyDict_DelItemString((PyObject *)type->tp_dict, "__dictoffset__") < 0)
3613             goto fail;
3614     }
3615 
3616     /* Set type.__module__ */
3617     r = _PyDict_ContainsId(type->tp_dict, &PyId___module__);
3618     if (r < 0) {
3619         goto fail;
3620     }
3621     if (r == 0) {
3622         s = strrchr(spec->name, '.');
3623         if (s != NULL) {
3624             modname = PyUnicode_FromStringAndSize(
3625                     spec->name, (Py_ssize_t)(s - spec->name));
3626             if (modname == NULL) {
3627                 goto fail;
3628             }
3629             r = _PyDict_SetItemId(type->tp_dict, &PyId___module__, modname);
3630             Py_DECREF(modname);
3631             if (r != 0)
3632                 goto fail;
3633         } else {
3634             if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
3635                     "builtin type %.200s has no __module__ attribute",
3636                     spec->name))
3637                 goto fail;
3638         }
3639     }
3640 
3641     assert(_PyType_CheckConsistency(type));
3642     return (PyObject*)res;
3643 
3644  fail:
3645     Py_DECREF(res);
3646     return NULL;
3647 }
3648 
3649 PyObject *
PyType_FromSpec(PyType_Spec * spec)3650 PyType_FromSpec(PyType_Spec *spec)
3651 {
3652     return PyType_FromSpecWithBases(spec, NULL);
3653 }
3654 
3655 PyObject *
PyType_GetName(PyTypeObject * type)3656 PyType_GetName(PyTypeObject *type)
3657 {
3658     return type_name(type, NULL);
3659 }
3660 
3661 PyObject *
PyType_GetQualName(PyTypeObject * type)3662 PyType_GetQualName(PyTypeObject *type)
3663 {
3664     return type_qualname(type, NULL);
3665 }
3666 
3667 void *
PyType_GetSlot(PyTypeObject * type,int slot)3668 PyType_GetSlot(PyTypeObject *type, int slot)
3669 {
3670     void *parent_slot;
3671     int slots_len = Py_ARRAY_LENGTH(pyslot_offsets);
3672 
3673     if (slot <= 0 || slot >= slots_len) {
3674         PyErr_BadInternalCall();
3675         return NULL;
3676     }
3677 
3678     parent_slot = *(void**)((char*)type + pyslot_offsets[slot].slot_offset);
3679     if (parent_slot == NULL) {
3680         return NULL;
3681     }
3682     /* Return slot directly if we have no sub slot. */
3683     if (pyslot_offsets[slot].subslot_offset == -1) {
3684         return parent_slot;
3685     }
3686     return *(void**)((char*)parent_slot + pyslot_offsets[slot].subslot_offset);
3687 }
3688 
3689 PyObject *
PyType_GetModule(PyTypeObject * type)3690 PyType_GetModule(PyTypeObject *type)
3691 {
3692     assert(PyType_Check(type));
3693     if (!_PyType_HasFeature(type, Py_TPFLAGS_HEAPTYPE)) {
3694         PyErr_Format(
3695             PyExc_TypeError,
3696             "PyType_GetModule: Type '%s' is not a heap type",
3697             type->tp_name);
3698         return NULL;
3699     }
3700 
3701     PyHeapTypeObject* et = (PyHeapTypeObject*)type;
3702     if (!et->ht_module) {
3703         PyErr_Format(
3704             PyExc_TypeError,
3705             "PyType_GetModule: Type '%s' has no associated module",
3706             type->tp_name);
3707         return NULL;
3708     }
3709     return et->ht_module;
3710 
3711 }
3712 
3713 void *
PyType_GetModuleState(PyTypeObject * type)3714 PyType_GetModuleState(PyTypeObject *type)
3715 {
3716     PyObject *m = PyType_GetModule(type);
3717     if (m == NULL) {
3718         return NULL;
3719     }
3720     return _PyModule_GetState(m);
3721 }
3722 
3723 
3724 /* Get the module of the first superclass where the module has the
3725  * given PyModuleDef.
3726  * Implemented by walking the MRO, is relatively slow.
3727  *
3728  * This is internal API for experimentation within stdlib. Discussion:
3729  * https://mail.python.org/archives/list/capi-sig@python.org/thread/T3P2QNLNLBRFHWSKYSTPMVEIL2EEKFJU/
3730  */
3731 PyObject *
_PyType_GetModuleByDef(PyTypeObject * type,struct PyModuleDef * def)3732 _PyType_GetModuleByDef(PyTypeObject *type, struct PyModuleDef *def)
3733 {
3734     assert(PyType_Check(type));
3735 
3736     PyObject *mro = type->tp_mro;
3737     // The type must be ready
3738     assert(mro != NULL);
3739     assert(PyTuple_Check(mro));
3740     // mro_invoke() ensures that the type MRO cannot be empty, so we don't have
3741     // to check i < PyTuple_GET_SIZE(mro) at the first loop iteration.
3742     assert(PyTuple_GET_SIZE(mro) >= 1);
3743 
3744     Py_ssize_t i = 0;
3745     do {
3746         PyObject *super = PyTuple_GET_ITEM(mro, i);
3747         // _PyType_GetModuleByDef() must only be called on a heap type created
3748         // by PyType_FromModuleAndSpec() or on its subclasses.
3749         // type_ready_mro() ensures that a static type cannot inherit from a
3750         // heap type.
3751         assert(_PyType_HasFeature((PyTypeObject *)type, Py_TPFLAGS_HEAPTYPE));
3752 
3753         PyHeapTypeObject *ht = (PyHeapTypeObject*)super;
3754         PyObject *module = ht->ht_module;
3755         if (module && _PyModule_GetDef(module) == def) {
3756             return module;
3757         }
3758         i++;
3759     } while (i < PyTuple_GET_SIZE(mro));
3760 
3761     PyErr_Format(
3762         PyExc_TypeError,
3763         "_PyType_GetModuleByDef: No superclass of '%s' has the given module",
3764         type->tp_name);
3765     return NULL;
3766 }
3767 
3768 
3769 /* Internal API to look for a name through the MRO, bypassing the method cache.
3770    This returns a borrowed reference, and might set an exception.
3771    'error' is set to: -1: error with exception; 1: error without exception; 0: ok */
3772 static PyObject *
find_name_in_mro(PyTypeObject * type,PyObject * name,int * error)3773 find_name_in_mro(PyTypeObject *type, PyObject *name, int *error)
3774 {
3775     Py_ssize_t i, n;
3776     PyObject *mro, *res, *base, *dict;
3777     Py_hash_t hash;
3778 
3779     if (!PyUnicode_CheckExact(name) ||
3780         (hash = ((PyASCIIObject *) name)->hash) == -1)
3781     {
3782         hash = PyObject_Hash(name);
3783         if (hash == -1) {
3784             *error = -1;
3785             return NULL;
3786         }
3787     }
3788 
3789     /* Look in tp_dict of types in MRO */
3790     mro = type->tp_mro;
3791 
3792     if (mro == NULL) {
3793         if ((type->tp_flags & Py_TPFLAGS_READYING) == 0) {
3794             if (PyType_Ready(type) < 0) {
3795                 *error = -1;
3796                 return NULL;
3797             }
3798             mro = type->tp_mro;
3799         }
3800         if (mro == NULL) {
3801             *error = 1;
3802             return NULL;
3803         }
3804     }
3805 
3806     res = NULL;
3807     /* Keep a strong reference to mro because type->tp_mro can be replaced
3808        during dict lookup, e.g. when comparing to non-string keys. */
3809     Py_INCREF(mro);
3810     assert(PyTuple_Check(mro));
3811     n = PyTuple_GET_SIZE(mro);
3812     for (i = 0; i < n; i++) {
3813         base = PyTuple_GET_ITEM(mro, i);
3814         assert(PyType_Check(base));
3815         dict = ((PyTypeObject *)base)->tp_dict;
3816         assert(dict && PyDict_Check(dict));
3817         res = _PyDict_GetItem_KnownHash(dict, name, hash);
3818         if (res != NULL)
3819             break;
3820         if (PyErr_Occurred()) {
3821             *error = -1;
3822             goto done;
3823         }
3824     }
3825     *error = 0;
3826 done:
3827     Py_DECREF(mro);
3828     return res;
3829 }
3830 
3831 /* Internal API to look for a name through the MRO.
3832    This returns a borrowed reference, and doesn't set an exception! */
3833 PyObject *
_PyType_Lookup(PyTypeObject * type,PyObject * name)3834 _PyType_Lookup(PyTypeObject *type, PyObject *name)
3835 {
3836     PyObject *res;
3837     int error;
3838 
3839     unsigned int h = MCACHE_HASH_METHOD(type, name);
3840     struct type_cache *cache = get_type_cache();
3841     struct type_cache_entry *entry = &cache->hashtable[h];
3842     if (entry->version == type->tp_version_tag &&
3843         entry->name == name) {
3844 #if MCACHE_STATS
3845         cache->hits++;
3846 #endif
3847         assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));
3848         return entry->value;
3849     }
3850 
3851     /* We may end up clearing live exceptions below, so make sure it's ours. */
3852     assert(!PyErr_Occurred());
3853 
3854     res = find_name_in_mro(type, name, &error);
3855     /* Only put NULL results into cache if there was no error. */
3856     if (error) {
3857         /* It's not ideal to clear the error condition,
3858            but this function is documented as not setting
3859            an exception, and I don't want to change that.
3860            E.g., when PyType_Ready() can't proceed, it won't
3861            set the "ready" flag, so future attempts to ready
3862            the same type will call it again -- hopefully
3863            in a context that propagates the exception out.
3864         */
3865         if (error == -1) {
3866             PyErr_Clear();
3867         }
3868         return NULL;
3869     }
3870 
3871     if (MCACHE_CACHEABLE_NAME(name) && assign_version_tag(cache, type)) {
3872         h = MCACHE_HASH_METHOD(type, name);
3873         struct type_cache_entry *entry = &cache->hashtable[h];
3874         entry->version = type->tp_version_tag;
3875         entry->value = res;  /* borrowed */
3876         assert(((PyASCIIObject *)(name))->hash != -1);
3877 #if MCACHE_STATS
3878         if (entry->name != Py_None && entry->name != name) {
3879             cache->collisions++;
3880         }
3881         else {
3882             cache->misses++;
3883         }
3884 #endif
3885         assert(_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG));
3886         Py_SETREF(entry->name, Py_NewRef(name));
3887     }
3888     return res;
3889 }
3890 
3891 PyObject *
_PyType_LookupId(PyTypeObject * type,struct _Py_Identifier * name)3892 _PyType_LookupId(PyTypeObject *type, struct _Py_Identifier *name)
3893 {
3894     PyObject *oname;
3895     oname = _PyUnicode_FromId(name);   /* borrowed */
3896     if (oname == NULL)
3897         return NULL;
3898     return _PyType_Lookup(type, oname);
3899 }
3900 
3901 /* Check if the "readied" PyUnicode name
3902    is a double-underscore special name. */
3903 static int
is_dunder_name(PyObject * name)3904 is_dunder_name(PyObject *name)
3905 {
3906     Py_ssize_t length = PyUnicode_GET_LENGTH(name);
3907     int kind = PyUnicode_KIND(name);
3908     /* Special names contain at least "__x__" and are always ASCII. */
3909     if (length > 4 && kind == PyUnicode_1BYTE_KIND) {
3910         const Py_UCS1 *characters = PyUnicode_1BYTE_DATA(name);
3911         return (
3912             ((characters[length-2] == '_') && (characters[length-1] == '_')) &&
3913             ((characters[0] == '_') && (characters[1] == '_'))
3914         );
3915     }
3916     return 0;
3917 }
3918 
3919 /* This is similar to PyObject_GenericGetAttr(),
3920    but uses _PyType_Lookup() instead of just looking in type->tp_dict. */
3921 static PyObject *
type_getattro(PyTypeObject * type,PyObject * name)3922 type_getattro(PyTypeObject *type, PyObject *name)
3923 {
3924     PyTypeObject *metatype = Py_TYPE(type);
3925     PyObject *meta_attribute, *attribute;
3926     descrgetfunc meta_get;
3927     PyObject* res;
3928 
3929     if (!PyUnicode_Check(name)) {
3930         PyErr_Format(PyExc_TypeError,
3931                      "attribute name must be string, not '%.200s'",
3932                      Py_TYPE(name)->tp_name);
3933         return NULL;
3934     }
3935 
3936     /* Initialize this type (we'll assume the metatype is initialized) */
3937     if (!_PyType_IsReady(type)) {
3938         if (PyType_Ready(type) < 0)
3939             return NULL;
3940     }
3941 
3942     /* No readable descriptor found yet */
3943     meta_get = NULL;
3944 
3945     /* Look for the attribute in the metatype */
3946     meta_attribute = _PyType_Lookup(metatype, name);
3947 
3948     if (meta_attribute != NULL) {
3949         Py_INCREF(meta_attribute);
3950         meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
3951 
3952         if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
3953             /* Data descriptors implement tp_descr_set to intercept
3954              * writes. Assume the attribute is not overridden in
3955              * type's tp_dict (and bases): call the descriptor now.
3956              */
3957             res = meta_get(meta_attribute, (PyObject *)type,
3958                            (PyObject *)metatype);
3959             Py_DECREF(meta_attribute);
3960             return res;
3961         }
3962     }
3963 
3964     /* No data descriptor found on metatype. Look in tp_dict of this
3965      * type and its bases */
3966     attribute = _PyType_Lookup(type, name);
3967     if (attribute != NULL) {
3968         /* Implement descriptor functionality, if any */
3969         Py_INCREF(attribute);
3970         descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
3971 
3972         Py_XDECREF(meta_attribute);
3973 
3974         if (local_get != NULL) {
3975             /* NULL 2nd argument indicates the descriptor was
3976              * found on the target object itself (or a base)  */
3977             res = local_get(attribute, (PyObject *)NULL,
3978                             (PyObject *)type);
3979             Py_DECREF(attribute);
3980             return res;
3981         }
3982 
3983         return attribute;
3984     }
3985 
3986     /* No attribute found in local __dict__ (or bases): use the
3987      * descriptor from the metatype, if any */
3988     if (meta_get != NULL) {
3989         PyObject *res;
3990         res = meta_get(meta_attribute, (PyObject *)type,
3991                        (PyObject *)metatype);
3992         Py_DECREF(meta_attribute);
3993         return res;
3994     }
3995 
3996     /* If an ordinary attribute was found on the metatype, return it now */
3997     if (meta_attribute != NULL) {
3998         return meta_attribute;
3999     }
4000 
4001     /* Give up */
4002     PyErr_Format(PyExc_AttributeError,
4003                  "type object '%.50s' has no attribute '%U'",
4004                  type->tp_name, name);
4005     return NULL;
4006 }
4007 
4008 static int
type_setattro(PyTypeObject * type,PyObject * name,PyObject * value)4009 type_setattro(PyTypeObject *type, PyObject *name, PyObject *value)
4010 {
4011     int res;
4012     if (type->tp_flags & Py_TPFLAGS_IMMUTABLETYPE) {
4013         PyErr_Format(
4014             PyExc_TypeError,
4015             "cannot set %R attribute of immutable type '%s'",
4016             name, type->tp_name);
4017         return -1;
4018     }
4019     if (PyUnicode_Check(name)) {
4020         if (PyUnicode_CheckExact(name)) {
4021             if (PyUnicode_READY(name) == -1)
4022                 return -1;
4023             Py_INCREF(name);
4024         }
4025         else {
4026             name = _PyUnicode_Copy(name);
4027             if (name == NULL)
4028                 return -1;
4029         }
4030         if (!PyUnicode_CHECK_INTERNED(name)) {
4031             PyUnicode_InternInPlace(&name);
4032             if (!PyUnicode_CHECK_INTERNED(name)) {
4033                 PyErr_SetString(PyExc_MemoryError,
4034                                 "Out of memory interning an attribute name");
4035                 Py_DECREF(name);
4036                 return -1;
4037             }
4038         }
4039     }
4040     else {
4041         /* Will fail in _PyObject_GenericSetAttrWithDict. */
4042         Py_INCREF(name);
4043     }
4044     res = _PyObject_GenericSetAttrWithDict((PyObject *)type, name, value, NULL);
4045     if (res == 0) {
4046         /* Clear the VALID_VERSION flag of 'type' and all its
4047            subclasses.  This could possibly be unified with the
4048            update_subclasses() recursion in update_slot(), but carefully:
4049            they each have their own conditions on which to stop
4050            recursing into subclasses. */
4051         PyType_Modified(type);
4052 
4053         if (is_dunder_name(name)) {
4054             res = update_slot(type, name);
4055         }
4056         assert(_PyType_CheckConsistency(type));
4057     }
4058     Py_DECREF(name);
4059     return res;
4060 }
4061 
4062 extern void
4063 _PyDictKeys_DecRef(PyDictKeysObject *keys);
4064 
4065 static void
type_dealloc(PyTypeObject * type)4066 type_dealloc(PyTypeObject *type)
4067 {
4068     PyHeapTypeObject *et;
4069     PyObject *tp, *val, *tb;
4070 
4071     /* Assert this is a heap-allocated type object */
4072     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
4073     _PyObject_GC_UNTRACK(type);
4074     PyErr_Fetch(&tp, &val, &tb);
4075     remove_all_subclasses(type, type->tp_bases);
4076     PyErr_Restore(tp, val, tb);
4077     PyObject_ClearWeakRefs((PyObject *)type);
4078     et = (PyHeapTypeObject *)type;
4079     Py_XDECREF(type->tp_base);
4080     Py_XDECREF(type->tp_dict);
4081     Py_XDECREF(type->tp_bases);
4082     Py_XDECREF(type->tp_mro);
4083     Py_XDECREF(type->tp_cache);
4084     Py_XDECREF(type->tp_subclasses);
4085     /* A type's tp_doc is heap allocated, unlike the tp_doc slots
4086      * of most other objects.  It's okay to cast it to char *.
4087      */
4088     PyObject_Free((char *)type->tp_doc);
4089     Py_XDECREF(et->ht_name);
4090     Py_XDECREF(et->ht_qualname);
4091     Py_XDECREF(et->ht_slots);
4092     if (et->ht_cached_keys) {
4093         _PyDictKeys_DecRef(et->ht_cached_keys);
4094     }
4095     Py_XDECREF(et->ht_module);
4096     PyMem_Free(et->_ht_tpname);
4097     Py_TYPE(type)->tp_free((PyObject *)type);
4098 }
4099 
4100 /*[clinic input]
4101 type.__subclasses__
4102 
4103 Return a list of immediate subclasses.
4104 [clinic start generated code]*/
4105 
4106 static PyObject *
type___subclasses___impl(PyTypeObject * self)4107 type___subclasses___impl(PyTypeObject *self)
4108 /*[clinic end generated code: output=eb5eb54485942819 input=5af66132436f9a7b]*/
4109 {
4110     PyObject *list, *raw, *ref;
4111     Py_ssize_t i;
4112 
4113     list = PyList_New(0);
4114     if (list == NULL)
4115         return NULL;
4116     raw = self->tp_subclasses;
4117     if (raw == NULL)
4118         return list;
4119     assert(PyDict_CheckExact(raw));
4120     i = 0;
4121     while (PyDict_Next(raw, &i, NULL, &ref)) {
4122         assert(PyWeakref_CheckRef(ref));
4123         ref = PyWeakref_GET_OBJECT(ref);
4124         if (ref != Py_None) {
4125             if (PyList_Append(list, ref) < 0) {
4126                 Py_DECREF(list);
4127                 return NULL;
4128             }
4129         }
4130     }
4131     return list;
4132 }
4133 
4134 static PyObject *
type_prepare(PyObject * self,PyObject * const * args,Py_ssize_t nargs,PyObject * kwnames)4135 type_prepare(PyObject *self, PyObject *const *args, Py_ssize_t nargs,
4136              PyObject *kwnames)
4137 {
4138     return PyDict_New();
4139 }
4140 
4141 /*
4142    Merge the __dict__ of aclass into dict, and recursively also all
4143    the __dict__s of aclass's base classes.  The order of merging isn't
4144    defined, as it's expected that only the final set of dict keys is
4145    interesting.
4146    Return 0 on success, -1 on error.
4147 */
4148 
4149 static int
merge_class_dict(PyObject * dict,PyObject * aclass)4150 merge_class_dict(PyObject *dict, PyObject *aclass)
4151 {
4152     PyObject *classdict;
4153     PyObject *bases;
4154     _Py_IDENTIFIER(__bases__);
4155 
4156     assert(PyDict_Check(dict));
4157     assert(aclass);
4158 
4159     /* Merge in the type's dict (if any). */
4160     if (_PyObject_LookupAttrId(aclass, &PyId___dict__, &classdict) < 0) {
4161         return -1;
4162     }
4163     if (classdict != NULL) {
4164         int status = PyDict_Update(dict, classdict);
4165         Py_DECREF(classdict);
4166         if (status < 0)
4167             return -1;
4168     }
4169 
4170     /* Recursively merge in the base types' (if any) dicts. */
4171     if (_PyObject_LookupAttrId(aclass, &PyId___bases__, &bases) < 0) {
4172         return -1;
4173     }
4174     if (bases != NULL) {
4175         /* We have no guarantee that bases is a real tuple */
4176         Py_ssize_t i, n;
4177         n = PySequence_Size(bases); /* This better be right */
4178         if (n < 0) {
4179             Py_DECREF(bases);
4180             return -1;
4181         }
4182         else {
4183             for (i = 0; i < n; i++) {
4184                 int status;
4185                 PyObject *base = PySequence_GetItem(bases, i);
4186                 if (base == NULL) {
4187                     Py_DECREF(bases);
4188                     return -1;
4189                 }
4190                 status = merge_class_dict(dict, base);
4191                 Py_DECREF(base);
4192                 if (status < 0) {
4193                     Py_DECREF(bases);
4194                     return -1;
4195                 }
4196             }
4197         }
4198         Py_DECREF(bases);
4199     }
4200     return 0;
4201 }
4202 
4203 /* __dir__ for type objects: returns __dict__ and __bases__.
4204    We deliberately don't suck up its __class__, as methods belonging to the
4205    metaclass would probably be more confusing than helpful.
4206 */
4207 /*[clinic input]
4208 type.__dir__
4209 
4210 Specialized __dir__ implementation for types.
4211 [clinic start generated code]*/
4212 
4213 static PyObject *
type___dir___impl(PyTypeObject * self)4214 type___dir___impl(PyTypeObject *self)
4215 /*[clinic end generated code: output=69d02fe92c0f15fa input=7733befbec645968]*/
4216 {
4217     PyObject *result = NULL;
4218     PyObject *dict = PyDict_New();
4219 
4220     if (dict != NULL && merge_class_dict(dict, (PyObject *)self) == 0)
4221         result = PyDict_Keys(dict);
4222 
4223     Py_XDECREF(dict);
4224     return result;
4225 }
4226 
4227 /*[clinic input]
4228 type.__sizeof__
4229 
4230 Return memory consumption of the type object.
4231 [clinic start generated code]*/
4232 
4233 static PyObject *
type___sizeof___impl(PyTypeObject * self)4234 type___sizeof___impl(PyTypeObject *self)
4235 /*[clinic end generated code: output=766f4f16cd3b1854 input=99398f24b9cf45d6]*/
4236 {
4237     Py_ssize_t size;
4238     if (self->tp_flags & Py_TPFLAGS_HEAPTYPE) {
4239         PyHeapTypeObject* et = (PyHeapTypeObject*)self;
4240         size = sizeof(PyHeapTypeObject);
4241         if (et->ht_cached_keys)
4242             size += _PyDict_KeysSize(et->ht_cached_keys);
4243     }
4244     else
4245         size = sizeof(PyTypeObject);
4246     return PyLong_FromSsize_t(size);
4247 }
4248 
4249 static PyMethodDef type_methods[] = {
4250     TYPE_MRO_METHODDEF
4251     TYPE___SUBCLASSES___METHODDEF
4252     {"__prepare__", (PyCFunction)(void(*)(void))type_prepare,
4253      METH_FASTCALL | METH_KEYWORDS | METH_CLASS,
4254      PyDoc_STR("__prepare__() -> dict\n"
4255                "used to create the namespace for the class statement")},
4256     TYPE___INSTANCECHECK___METHODDEF
4257     TYPE___SUBCLASSCHECK___METHODDEF
4258     TYPE___DIR___METHODDEF
4259     TYPE___SIZEOF___METHODDEF
4260     {0}
4261 };
4262 
4263 PyDoc_STRVAR(type_doc,
4264 "type(object) -> the object's type\n"
4265 "type(name, bases, dict, **kwds) -> a new type");
4266 
4267 static int
type_traverse(PyTypeObject * type,visitproc visit,void * arg)4268 type_traverse(PyTypeObject *type, visitproc visit, void *arg)
4269 {
4270     /* Because of type_is_gc(), the collector only calls this
4271        for heaptypes. */
4272     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
4273         char msg[200];
4274         sprintf(msg, "type_traverse() called on non-heap type '%.100s'",
4275                 type->tp_name);
4276         _PyObject_ASSERT_FAILED_MSG((PyObject *)type, msg);
4277     }
4278 
4279     Py_VISIT(type->tp_dict);
4280     Py_VISIT(type->tp_cache);
4281     Py_VISIT(type->tp_mro);
4282     Py_VISIT(type->tp_bases);
4283     Py_VISIT(type->tp_base);
4284     Py_VISIT(((PyHeapTypeObject *)type)->ht_module);
4285 
4286     /* There's no need to visit others because they can't be involved
4287        in cycles:
4288        type->tp_subclasses is a list of weak references,
4289        ((PyHeapTypeObject *)type)->ht_slots is a tuple of strings,
4290        ((PyHeapTypeObject *)type)->ht_*name are strings.
4291        */
4292 
4293     return 0;
4294 }
4295 
4296 static int
type_clear(PyTypeObject * type)4297 type_clear(PyTypeObject *type)
4298 {
4299     /* Because of type_is_gc(), the collector only calls this
4300        for heaptypes. */
4301     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
4302 
4303     /* We need to invalidate the method cache carefully before clearing
4304        the dict, so that other objects caught in a reference cycle
4305        don't start calling destroyed methods.
4306 
4307        Otherwise, the we need to clear tp_mro, which is
4308        part of a hard cycle (its first element is the class itself) that
4309        won't be broken otherwise (it's a tuple and tuples don't have a
4310        tp_clear handler).
4311        We also need to clear ht_module, if present: the module usually holds a
4312        reference to its class. None of the other fields need to be
4313 
4314        cleared, and here's why:
4315 
4316        tp_cache:
4317            Not used; if it were, it would be a dict.
4318 
4319        tp_bases, tp_base:
4320            If these are involved in a cycle, there must be at least
4321            one other, mutable object in the cycle, e.g. a base
4322            class's dict; the cycle will be broken that way.
4323 
4324        tp_subclasses:
4325            A dict of weak references can't be part of a cycle; and
4326            dicts have their own tp_clear.
4327 
4328        slots (in PyHeapTypeObject):
4329            A tuple of strings can't be part of a cycle.
4330     */
4331 
4332     PyType_Modified(type);
4333     if (type->tp_dict) {
4334         PyDict_Clear(type->tp_dict);
4335     }
4336     Py_CLEAR(((PyHeapTypeObject *)type)->ht_module);
4337 
4338     Py_CLEAR(type->tp_mro);
4339 
4340     return 0;
4341 }
4342 
4343 static int
type_is_gc(PyTypeObject * type)4344 type_is_gc(PyTypeObject *type)
4345 {
4346     return type->tp_flags & Py_TPFLAGS_HEAPTYPE;
4347 }
4348 
4349 
4350 static PyNumberMethods type_as_number = {
4351         .nb_or = _Py_union_type_or, // Add __or__ function
4352 };
4353 
4354 PyTypeObject PyType_Type = {
4355     PyVarObject_HEAD_INIT(&PyType_Type, 0)
4356     "type",                                     /* tp_name */
4357     sizeof(PyHeapTypeObject),                   /* tp_basicsize */
4358     sizeof(PyMemberDef),                        /* tp_itemsize */
4359     (destructor)type_dealloc,                   /* tp_dealloc */
4360     offsetof(PyTypeObject, tp_vectorcall),      /* tp_vectorcall_offset */
4361     0,                                          /* tp_getattr */
4362     0,                                          /* tp_setattr */
4363     0,                                          /* tp_as_async */
4364     (reprfunc)type_repr,                        /* tp_repr */
4365     &type_as_number,                            /* tp_as_number */
4366     0,                                          /* tp_as_sequence */
4367     0,                                          /* tp_as_mapping */
4368     0,                                          /* tp_hash */
4369     (ternaryfunc)type_call,                     /* tp_call */
4370     0,                                          /* tp_str */
4371     (getattrofunc)type_getattro,                /* tp_getattro */
4372     (setattrofunc)type_setattro,                /* tp_setattro */
4373     0,                                          /* tp_as_buffer */
4374     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
4375     Py_TPFLAGS_BASETYPE | Py_TPFLAGS_TYPE_SUBCLASS |
4376     Py_TPFLAGS_HAVE_VECTORCALL,                 /* tp_flags */
4377     type_doc,                                   /* tp_doc */
4378     (traverseproc)type_traverse,                /* tp_traverse */
4379     (inquiry)type_clear,                        /* tp_clear */
4380     0,                                          /* tp_richcompare */
4381     offsetof(PyTypeObject, tp_weaklist),        /* tp_weaklistoffset */
4382     0,                                          /* tp_iter */
4383     0,                                          /* tp_iternext */
4384     type_methods,                               /* tp_methods */
4385     type_members,                               /* tp_members */
4386     type_getsets,                               /* tp_getset */
4387     0,                                          /* tp_base */
4388     0,                                          /* tp_dict */
4389     0,                                          /* tp_descr_get */
4390     0,                                          /* tp_descr_set */
4391     offsetof(PyTypeObject, tp_dict),            /* tp_dictoffset */
4392     type_init,                                  /* tp_init */
4393     0,                                          /* tp_alloc */
4394     type_new,                                   /* tp_new */
4395     PyObject_GC_Del,                            /* tp_free */
4396     (inquiry)type_is_gc,                        /* tp_is_gc */
4397     .tp_vectorcall = type_vectorcall,
4398 };
4399 
4400 
4401 /* The base type of all types (eventually)... except itself. */
4402 
4403 /* You may wonder why object.__new__() only complains about arguments
4404    when object.__init__() is not overridden, and vice versa.
4405 
4406    Consider the use cases:
4407 
4408    1. When neither is overridden, we want to hear complaints about
4409       excess (i.e., any) arguments, since their presence could
4410       indicate there's a bug.
4411 
4412    2. When defining an Immutable type, we are likely to override only
4413       __new__(), since __init__() is called too late to initialize an
4414       Immutable object.  Since __new__() defines the signature for the
4415       type, it would be a pain to have to override __init__() just to
4416       stop it from complaining about excess arguments.
4417 
4418    3. When defining a Mutable type, we are likely to override only
4419       __init__().  So here the converse reasoning applies: we don't
4420       want to have to override __new__() just to stop it from
4421       complaining.
4422 
4423    4. When __init__() is overridden, and the subclass __init__() calls
4424       object.__init__(), the latter should complain about excess
4425       arguments; ditto for __new__().
4426 
4427    Use cases 2 and 3 make it unattractive to unconditionally check for
4428    excess arguments.  The best solution that addresses all four use
4429    cases is as follows: __init__() complains about excess arguments
4430    unless __new__() is overridden and __init__() is not overridden
4431    (IOW, if __init__() is overridden or __new__() is not overridden);
4432    symmetrically, __new__() complains about excess arguments unless
4433    __init__() is overridden and __new__() is not overridden
4434    (IOW, if __new__() is overridden or __init__() is not overridden).
4435 
4436    However, for backwards compatibility, this breaks too much code.
4437    Therefore, in 2.6, we'll *warn* about excess arguments when both
4438    methods are overridden; for all other cases we'll use the above
4439    rules.
4440 
4441 */
4442 
4443 /* Forward */
4444 static PyObject *
4445 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
4446 
4447 static int
excess_args(PyObject * args,PyObject * kwds)4448 excess_args(PyObject *args, PyObject *kwds)
4449 {
4450     return PyTuple_GET_SIZE(args) ||
4451         (kwds && PyDict_Check(kwds) && PyDict_GET_SIZE(kwds));
4452 }
4453 
4454 static int
object_init(PyObject * self,PyObject * args,PyObject * kwds)4455 object_init(PyObject *self, PyObject *args, PyObject *kwds)
4456 {
4457     PyTypeObject *type = Py_TYPE(self);
4458     if (excess_args(args, kwds)) {
4459         if (type->tp_init != object_init) {
4460             PyErr_SetString(PyExc_TypeError,
4461                             "object.__init__() takes exactly one argument (the instance to initialize)");
4462             return -1;
4463         }
4464         if (type->tp_new == object_new) {
4465             PyErr_Format(PyExc_TypeError,
4466                          "%.200s.__init__() takes exactly one argument (the instance to initialize)",
4467                          type->tp_name);
4468             return -1;
4469         }
4470     }
4471     return 0;
4472 }
4473 
4474 static PyObject *
object_new(PyTypeObject * type,PyObject * args,PyObject * kwds)4475 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
4476 {
4477     if (excess_args(args, kwds)) {
4478         if (type->tp_new != object_new) {
4479             PyErr_SetString(PyExc_TypeError,
4480                             "object.__new__() takes exactly one argument (the type to instantiate)");
4481             return NULL;
4482         }
4483         if (type->tp_init == object_init) {
4484             PyErr_Format(PyExc_TypeError, "%.200s() takes no arguments",
4485                          type->tp_name);
4486             return NULL;
4487         }
4488     }
4489 
4490     if (type->tp_flags & Py_TPFLAGS_IS_ABSTRACT) {
4491         PyObject *abstract_methods;
4492         PyObject *sorted_methods;
4493         PyObject *joined;
4494         PyObject *comma;
4495         _Py_static_string(comma_id, ", ");
4496         Py_ssize_t method_count;
4497 
4498         /* Compute ", ".join(sorted(type.__abstractmethods__))
4499            into joined. */
4500         abstract_methods = type_abstractmethods(type, NULL);
4501         if (abstract_methods == NULL)
4502             return NULL;
4503         sorted_methods = PySequence_List(abstract_methods);
4504         Py_DECREF(abstract_methods);
4505         if (sorted_methods == NULL)
4506             return NULL;
4507         if (PyList_Sort(sorted_methods)) {
4508             Py_DECREF(sorted_methods);
4509             return NULL;
4510         }
4511         comma = _PyUnicode_FromId(&comma_id);
4512         if (comma == NULL) {
4513             Py_DECREF(sorted_methods);
4514             return NULL;
4515         }
4516         joined = PyUnicode_Join(comma, sorted_methods);
4517         method_count = PyObject_Length(sorted_methods);
4518         Py_DECREF(sorted_methods);
4519         if (joined == NULL)
4520             return NULL;
4521         if (method_count == -1)
4522             return NULL;
4523 
4524         PyErr_Format(PyExc_TypeError,
4525                      "Can't instantiate abstract class %s "
4526                      "with abstract method%s %U",
4527                      type->tp_name,
4528                      method_count > 1 ? "s" : "",
4529                      joined);
4530         Py_DECREF(joined);
4531         return NULL;
4532     }
4533     PyObject *obj = type->tp_alloc(type, 0);
4534     if (obj == NULL) {
4535         return NULL;
4536     }
4537     if (_PyObject_InitializeDict(obj)) {
4538         Py_DECREF(obj);
4539         return NULL;
4540     }
4541     return obj;
4542 }
4543 
4544 static void
object_dealloc(PyObject * self)4545 object_dealloc(PyObject *self)
4546 {
4547     Py_TYPE(self)->tp_free(self);
4548 }
4549 
4550 static PyObject *
object_repr(PyObject * self)4551 object_repr(PyObject *self)
4552 {
4553     PyTypeObject *type;
4554     PyObject *mod, *name, *rtn;
4555 
4556     type = Py_TYPE(self);
4557     mod = type_module(type, NULL);
4558     if (mod == NULL)
4559         PyErr_Clear();
4560     else if (!PyUnicode_Check(mod)) {
4561         Py_DECREF(mod);
4562         mod = NULL;
4563     }
4564     name = type_qualname(type, NULL);
4565     if (name == NULL) {
4566         Py_XDECREF(mod);
4567         return NULL;
4568     }
4569     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
4570         rtn = PyUnicode_FromFormat("<%U.%U object at %p>", mod, name, self);
4571     else
4572         rtn = PyUnicode_FromFormat("<%s object at %p>",
4573                                   type->tp_name, self);
4574     Py_XDECREF(mod);
4575     Py_DECREF(name);
4576     return rtn;
4577 }
4578 
4579 static PyObject *
object_str(PyObject * self)4580 object_str(PyObject *self)
4581 {
4582     unaryfunc f;
4583 
4584     f = Py_TYPE(self)->tp_repr;
4585     if (f == NULL)
4586         f = object_repr;
4587     return f(self);
4588 }
4589 
4590 static PyObject *
object_richcompare(PyObject * self,PyObject * other,int op)4591 object_richcompare(PyObject *self, PyObject *other, int op)
4592 {
4593     PyObject *res;
4594 
4595     switch (op) {
4596 
4597     case Py_EQ:
4598         /* Return NotImplemented instead of False, so if two
4599            objects are compared, both get a chance at the
4600            comparison.  See issue #1393. */
4601         res = (self == other) ? Py_True : Py_NotImplemented;
4602         Py_INCREF(res);
4603         break;
4604 
4605     case Py_NE:
4606         /* By default, __ne__() delegates to __eq__() and inverts the result,
4607            unless the latter returns NotImplemented. */
4608         if (Py_TYPE(self)->tp_richcompare == NULL) {
4609             res = Py_NotImplemented;
4610             Py_INCREF(res);
4611             break;
4612         }
4613         res = (*Py_TYPE(self)->tp_richcompare)(self, other, Py_EQ);
4614         if (res != NULL && res != Py_NotImplemented) {
4615             int ok = PyObject_IsTrue(res);
4616             Py_DECREF(res);
4617             if (ok < 0)
4618                 res = NULL;
4619             else {
4620                 if (ok)
4621                     res = Py_False;
4622                 else
4623                     res = Py_True;
4624                 Py_INCREF(res);
4625             }
4626         }
4627         break;
4628 
4629     default:
4630         res = Py_NotImplemented;
4631         Py_INCREF(res);
4632         break;
4633     }
4634 
4635     return res;
4636 }
4637 
4638 static PyObject *
object_get_class(PyObject * self,void * closure)4639 object_get_class(PyObject *self, void *closure)
4640 {
4641     Py_INCREF(Py_TYPE(self));
4642     return (PyObject *)(Py_TYPE(self));
4643 }
4644 
4645 static int
compatible_with_tp_base(PyTypeObject * child)4646 compatible_with_tp_base(PyTypeObject *child)
4647 {
4648     PyTypeObject *parent = child->tp_base;
4649     return (parent != NULL &&
4650             child->tp_basicsize == parent->tp_basicsize &&
4651             child->tp_itemsize == parent->tp_itemsize &&
4652             child->tp_dictoffset == parent->tp_dictoffset &&
4653             child->tp_weaklistoffset == parent->tp_weaklistoffset &&
4654             ((child->tp_flags & Py_TPFLAGS_HAVE_GC) ==
4655              (parent->tp_flags & Py_TPFLAGS_HAVE_GC)) &&
4656             (child->tp_dealloc == subtype_dealloc ||
4657              child->tp_dealloc == parent->tp_dealloc));
4658 }
4659 
4660 static int
same_slots_added(PyTypeObject * a,PyTypeObject * b)4661 same_slots_added(PyTypeObject *a, PyTypeObject *b)
4662 {
4663     PyTypeObject *base = a->tp_base;
4664     Py_ssize_t size;
4665     PyObject *slots_a, *slots_b;
4666 
4667     assert(base == b->tp_base);
4668     size = base->tp_basicsize;
4669     if (a->tp_dictoffset == size && b->tp_dictoffset == size)
4670         size += sizeof(PyObject *);
4671     if (a->tp_weaklistoffset == size && b->tp_weaklistoffset == size)
4672         size += sizeof(PyObject *);
4673 
4674     /* Check slots compliance */
4675     if (!(a->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
4676         !(b->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
4677         return 0;
4678     }
4679     slots_a = ((PyHeapTypeObject *)a)->ht_slots;
4680     slots_b = ((PyHeapTypeObject *)b)->ht_slots;
4681     if (slots_a && slots_b) {
4682         if (PyObject_RichCompareBool(slots_a, slots_b, Py_EQ) != 1)
4683             return 0;
4684         size += sizeof(PyObject *) * PyTuple_GET_SIZE(slots_a);
4685     }
4686     return size == a->tp_basicsize && size == b->tp_basicsize;
4687 }
4688 
4689 static int
compatible_for_assignment(PyTypeObject * oldto,PyTypeObject * newto,const char * attr)4690 compatible_for_assignment(PyTypeObject* oldto, PyTypeObject* newto, const char* attr)
4691 {
4692     PyTypeObject *newbase, *oldbase;
4693 
4694     if (newto->tp_free != oldto->tp_free) {
4695         PyErr_Format(PyExc_TypeError,
4696                      "%s assignment: "
4697                      "'%s' deallocator differs from '%s'",
4698                      attr,
4699                      newto->tp_name,
4700                      oldto->tp_name);
4701         return 0;
4702     }
4703     /*
4704      It's tricky to tell if two arbitrary types are sufficiently compatible as
4705      to be interchangeable; e.g., even if they have the same tp_basicsize, they
4706      might have totally different struct fields. It's much easier to tell if a
4707      type and its supertype are compatible; e.g., if they have the same
4708      tp_basicsize, then that means they have identical fields. So to check
4709      whether two arbitrary types are compatible, we first find the highest
4710      supertype that each is compatible with, and then if those supertypes are
4711      compatible then the original types must also be compatible.
4712     */
4713     newbase = newto;
4714     oldbase = oldto;
4715     while (compatible_with_tp_base(newbase))
4716         newbase = newbase->tp_base;
4717     while (compatible_with_tp_base(oldbase))
4718         oldbase = oldbase->tp_base;
4719     if (newbase != oldbase &&
4720         (newbase->tp_base != oldbase->tp_base ||
4721          !same_slots_added(newbase, oldbase))) {
4722         goto differs;
4723     }
4724     /* The above does not check for managed __dicts__ */
4725     if ((oldto->tp_flags & Py_TPFLAGS_MANAGED_DICT) ==
4726         ((newto->tp_flags & Py_TPFLAGS_MANAGED_DICT)))
4727     {
4728         return 1;
4729     }
4730 differs:
4731     PyErr_Format(PyExc_TypeError,
4732                     "%s assignment: "
4733                     "'%s' object layout differs from '%s'",
4734                     attr,
4735                     newto->tp_name,
4736                     oldto->tp_name);
4737     return 0;
4738 }
4739 
4740 static int
object_set_class(PyObject * self,PyObject * value,void * closure)4741 object_set_class(PyObject *self, PyObject *value, void *closure)
4742 {
4743     PyTypeObject *oldto = Py_TYPE(self);
4744     PyTypeObject *newto;
4745 
4746     if (value == NULL) {
4747         PyErr_SetString(PyExc_TypeError,
4748                         "can't delete __class__ attribute");
4749         return -1;
4750     }
4751     if (!PyType_Check(value)) {
4752         PyErr_Format(PyExc_TypeError,
4753           "__class__ must be set to a class, not '%s' object",
4754           Py_TYPE(value)->tp_name);
4755         return -1;
4756     }
4757     if (PySys_Audit("object.__setattr__", "OsO",
4758                     self, "__class__", value) < 0) {
4759         return -1;
4760     }
4761 
4762     newto = (PyTypeObject *)value;
4763     /* In versions of CPython prior to 3.5, the code in
4764        compatible_for_assignment was not set up to correctly check for memory
4765        layout / slot / etc. compatibility for non-HEAPTYPE classes, so we just
4766        disallowed __class__ assignment in any case that wasn't HEAPTYPE ->
4767        HEAPTYPE.
4768 
4769        During the 3.5 development cycle, we fixed the code in
4770        compatible_for_assignment to correctly check compatibility between
4771        arbitrary types, and started allowing __class__ assignment in all cases
4772        where the old and new types did in fact have compatible slots and
4773        memory layout (regardless of whether they were implemented as HEAPTYPEs
4774        or not).
4775 
4776        Just before 3.5 was released, though, we discovered that this led to
4777        problems with immutable types like int, where the interpreter assumes
4778        they are immutable and interns some values. Formerly this wasn't a
4779        problem, because they really were immutable -- in particular, all the
4780        types where the interpreter applied this interning trick happened to
4781        also be statically allocated, so the old HEAPTYPE rules were
4782        "accidentally" stopping them from allowing __class__ assignment. But
4783        with the changes to __class__ assignment, we started allowing code like
4784 
4785          class MyInt(int):
4786              ...
4787          # Modifies the type of *all* instances of 1 in the whole program,
4788          # including future instances (!), because the 1 object is interned.
4789          (1).__class__ = MyInt
4790 
4791        (see https://bugs.python.org/issue24912).
4792 
4793        In theory the proper fix would be to identify which classes rely on
4794        this invariant and somehow disallow __class__ assignment only for them,
4795        perhaps via some mechanism like a new Py_TPFLAGS_IMMUTABLE flag (a
4796        "denylisting" approach). But in practice, since this problem wasn't
4797        noticed late in the 3.5 RC cycle, we're taking the conservative
4798        approach and reinstating the same HEAPTYPE->HEAPTYPE check that we used
4799        to have, plus an "allowlist". For now, the allowlist consists only of
4800        ModuleType subtypes, since those are the cases that motivated the patch
4801        in the first place -- see https://bugs.python.org/issue22986 -- and
4802        since module objects are mutable we can be sure that they are
4803        definitely not being interned. So now we allow HEAPTYPE->HEAPTYPE *or*
4804        ModuleType subtype -> ModuleType subtype.
4805 
4806        So far as we know, all the code beyond the following 'if' statement
4807        will correctly handle non-HEAPTYPE classes, and the HEAPTYPE check is
4808        needed only to protect that subset of non-HEAPTYPE classes for which
4809        the interpreter has baked in the assumption that all instances are
4810        truly immutable.
4811     */
4812     if (!(PyType_IsSubtype(newto, &PyModule_Type) &&
4813           PyType_IsSubtype(oldto, &PyModule_Type)) &&
4814         (_PyType_HasFeature(newto, Py_TPFLAGS_IMMUTABLETYPE) ||
4815          _PyType_HasFeature(oldto, Py_TPFLAGS_IMMUTABLETYPE))) {
4816         PyErr_Format(PyExc_TypeError,
4817                      "__class__ assignment only supported for mutable types "
4818                      "or ModuleType subclasses");
4819         return -1;
4820     }
4821 
4822     if (compatible_for_assignment(oldto, newto, "__class__")) {
4823         /* Changing the class will change the implicit dict keys,
4824          * so we must materialize the dictionary first. */
4825         assert((oldto->tp_flags & Py_TPFLAGS_MANAGED_DICT) == (newto->tp_flags & Py_TPFLAGS_MANAGED_DICT));
4826         _PyObject_GetDictPtr(self);
4827         if (oldto->tp_flags & Py_TPFLAGS_MANAGED_DICT && *_PyObject_ValuesPointer(self)) {
4828             /* Was unable to convert to dict */
4829             PyErr_NoMemory();
4830             return -1;
4831         }
4832         if (newto->tp_flags & Py_TPFLAGS_HEAPTYPE) {
4833             Py_INCREF(newto);
4834         }
4835         Py_SET_TYPE(self, newto);
4836         if (oldto->tp_flags & Py_TPFLAGS_HEAPTYPE)
4837             Py_DECREF(oldto);
4838         return 0;
4839     }
4840     else {
4841         return -1;
4842     }
4843 }
4844 
4845 static PyGetSetDef object_getsets[] = {
4846     {"__class__", object_get_class, object_set_class,
4847      PyDoc_STR("the object's class")},
4848     {0}
4849 };
4850 
4851 
4852 /* Stuff to implement __reduce_ex__ for pickle protocols >= 2.
4853    We fall back to helpers in copyreg for:
4854    - pickle protocols < 2
4855    - calculating the list of slot names (done only once per class)
4856    - the __newobj__ function (which is used as a token but never called)
4857 */
4858 
4859 static PyObject *
import_copyreg(void)4860 import_copyreg(void)
4861 {
4862     PyObject *copyreg_str;
4863     PyObject *copyreg_module;
4864     _Py_IDENTIFIER(copyreg);
4865 
4866     copyreg_str = _PyUnicode_FromId(&PyId_copyreg);
4867     if (copyreg_str == NULL) {
4868         return NULL;
4869     }
4870     /* Try to fetch cached copy of copyreg from sys.modules first in an
4871        attempt to avoid the import overhead. Previously this was implemented
4872        by storing a reference to the cached module in a static variable, but
4873        this broke when multiple embedded interpreters were in use (see issue
4874        #17408 and #19088). */
4875     copyreg_module = PyImport_GetModule(copyreg_str);
4876     if (copyreg_module != NULL) {
4877         return copyreg_module;
4878     }
4879     if (PyErr_Occurred()) {
4880         return NULL;
4881     }
4882     return PyImport_Import(copyreg_str);
4883 }
4884 
4885 static PyObject *
_PyType_GetSlotNames(PyTypeObject * cls)4886 _PyType_GetSlotNames(PyTypeObject *cls)
4887 {
4888     PyObject *copyreg;
4889     PyObject *slotnames;
4890     _Py_IDENTIFIER(__slotnames__);
4891     _Py_IDENTIFIER(_slotnames);
4892 
4893     assert(PyType_Check(cls));
4894 
4895     /* Get the slot names from the cache in the class if possible. */
4896     slotnames = _PyDict_GetItemIdWithError(cls->tp_dict, &PyId___slotnames__);
4897     if (slotnames != NULL) {
4898         if (slotnames != Py_None && !PyList_Check(slotnames)) {
4899             PyErr_Format(PyExc_TypeError,
4900                          "%.200s.__slotnames__ should be a list or None, "
4901                          "not %.200s",
4902                          cls->tp_name, Py_TYPE(slotnames)->tp_name);
4903             return NULL;
4904         }
4905         Py_INCREF(slotnames);
4906         return slotnames;
4907     }
4908     else {
4909         if (PyErr_Occurred()) {
4910             return NULL;
4911         }
4912         /* The class does not have the slot names cached yet. */
4913     }
4914 
4915     copyreg = import_copyreg();
4916     if (copyreg == NULL)
4917         return NULL;
4918 
4919     /* Use _slotnames function from the copyreg module to find the slots
4920        by this class and its bases. This function will cache the result
4921        in __slotnames__. */
4922     slotnames = _PyObject_CallMethodIdOneArg(copyreg, &PyId__slotnames,
4923                                              (PyObject *)cls);
4924     Py_DECREF(copyreg);
4925     if (slotnames == NULL)
4926         return NULL;
4927 
4928     if (slotnames != Py_None && !PyList_Check(slotnames)) {
4929         PyErr_SetString(PyExc_TypeError,
4930                         "copyreg._slotnames didn't return a list or None");
4931         Py_DECREF(slotnames);
4932         return NULL;
4933     }
4934 
4935     return slotnames;
4936 }
4937 
4938 static PyObject *
_PyObject_GetState(PyObject * obj,int required)4939 _PyObject_GetState(PyObject *obj, int required)
4940 {
4941     PyObject *state;
4942     PyObject *getstate;
4943     _Py_IDENTIFIER(__getstate__);
4944 
4945     if (_PyObject_LookupAttrId(obj, &PyId___getstate__, &getstate) < 0) {
4946         return NULL;
4947     }
4948     if (getstate == NULL) {
4949         PyObject *slotnames;
4950 
4951         if (required && Py_TYPE(obj)->tp_itemsize) {
4952             PyErr_Format(PyExc_TypeError,
4953                          "cannot pickle '%.200s' object",
4954                          Py_TYPE(obj)->tp_name);
4955             return NULL;
4956         }
4957         if (_PyObject_IsInstanceDictEmpty(obj)) {
4958             state = Py_None;
4959             Py_INCREF(state);
4960         }
4961         else {
4962             state = PyObject_GenericGetDict(obj, NULL);
4963             if (state == NULL) {
4964                 return NULL;
4965             }
4966         }
4967 
4968         slotnames = _PyType_GetSlotNames(Py_TYPE(obj));
4969         if (slotnames == NULL) {
4970             Py_DECREF(state);
4971             return NULL;
4972         }
4973 
4974         assert(slotnames == Py_None || PyList_Check(slotnames));
4975         if (required) {
4976             Py_ssize_t basicsize = PyBaseObject_Type.tp_basicsize;
4977             if (Py_TYPE(obj)->tp_dictoffset &&
4978                 (Py_TYPE(obj)->tp_flags & Py_TPFLAGS_MANAGED_DICT) == 0)
4979             {
4980                 basicsize += sizeof(PyObject *);
4981             }
4982             if (Py_TYPE(obj)->tp_weaklistoffset) {
4983                 basicsize += sizeof(PyObject *);
4984             }
4985             if (slotnames != Py_None) {
4986                 basicsize += sizeof(PyObject *) * PyList_GET_SIZE(slotnames);
4987             }
4988             if (Py_TYPE(obj)->tp_basicsize > basicsize) {
4989                 Py_DECREF(slotnames);
4990                 Py_DECREF(state);
4991                 PyErr_Format(PyExc_TypeError,
4992                              "cannot pickle '%.200s' object",
4993                              Py_TYPE(obj)->tp_name);
4994                 return NULL;
4995             }
4996         }
4997 
4998         if (slotnames != Py_None && PyList_GET_SIZE(slotnames) > 0) {
4999             PyObject *slots;
5000             Py_ssize_t slotnames_size, i;
5001 
5002             slots = PyDict_New();
5003             if (slots == NULL) {
5004                 Py_DECREF(slotnames);
5005                 Py_DECREF(state);
5006                 return NULL;
5007             }
5008 
5009             slotnames_size = PyList_GET_SIZE(slotnames);
5010             for (i = 0; i < slotnames_size; i++) {
5011                 PyObject *name, *value;
5012 
5013                 name = PyList_GET_ITEM(slotnames, i);
5014                 Py_INCREF(name);
5015                 if (_PyObject_LookupAttr(obj, name, &value) < 0) {
5016                     goto error;
5017                 }
5018                 if (value == NULL) {
5019                     Py_DECREF(name);
5020                     /* It is not an error if the attribute is not present. */
5021                 }
5022                 else {
5023                     int err = PyDict_SetItem(slots, name, value);
5024                     Py_DECREF(name);
5025                     Py_DECREF(value);
5026                     if (err) {
5027                         goto error;
5028                     }
5029                 }
5030 
5031                 /* The list is stored on the class so it may mutate while we
5032                    iterate over it */
5033                 if (slotnames_size != PyList_GET_SIZE(slotnames)) {
5034                     PyErr_Format(PyExc_RuntimeError,
5035                                  "__slotsname__ changed size during iteration");
5036                     goto error;
5037                 }
5038 
5039                 /* We handle errors within the loop here. */
5040                 if (0) {
5041                   error:
5042                     Py_DECREF(slotnames);
5043                     Py_DECREF(slots);
5044                     Py_DECREF(state);
5045                     return NULL;
5046                 }
5047             }
5048 
5049             /* If we found some slot attributes, pack them in a tuple along
5050                the original attribute dictionary. */
5051             if (PyDict_GET_SIZE(slots) > 0) {
5052                 PyObject *state2;
5053 
5054                 state2 = PyTuple_Pack(2, state, slots);
5055                 Py_DECREF(state);
5056                 if (state2 == NULL) {
5057                     Py_DECREF(slotnames);
5058                     Py_DECREF(slots);
5059                     return NULL;
5060                 }
5061                 state = state2;
5062             }
5063             Py_DECREF(slots);
5064         }
5065         Py_DECREF(slotnames);
5066     }
5067     else { /* getstate != NULL */
5068         state = _PyObject_CallNoArgs(getstate);
5069         Py_DECREF(getstate);
5070         if (state == NULL)
5071             return NULL;
5072     }
5073 
5074     return state;
5075 }
5076 
5077 static int
_PyObject_GetNewArguments(PyObject * obj,PyObject ** args,PyObject ** kwargs)5078 _PyObject_GetNewArguments(PyObject *obj, PyObject **args, PyObject **kwargs)
5079 {
5080     PyObject *getnewargs, *getnewargs_ex;
5081     _Py_IDENTIFIER(__getnewargs_ex__);
5082     _Py_IDENTIFIER(__getnewargs__);
5083 
5084     if (args == NULL || kwargs == NULL) {
5085         PyErr_BadInternalCall();
5086         return -1;
5087     }
5088 
5089     /* We first attempt to fetch the arguments for __new__ by calling
5090        __getnewargs_ex__ on the object. */
5091     getnewargs_ex = _PyObject_LookupSpecial(obj, &PyId___getnewargs_ex__);
5092     if (getnewargs_ex != NULL) {
5093         PyObject *newargs = _PyObject_CallNoArgs(getnewargs_ex);
5094         Py_DECREF(getnewargs_ex);
5095         if (newargs == NULL) {
5096             return -1;
5097         }
5098         if (!PyTuple_Check(newargs)) {
5099             PyErr_Format(PyExc_TypeError,
5100                          "__getnewargs_ex__ should return a tuple, "
5101                          "not '%.200s'", Py_TYPE(newargs)->tp_name);
5102             Py_DECREF(newargs);
5103             return -1;
5104         }
5105         if (PyTuple_GET_SIZE(newargs) != 2) {
5106             PyErr_Format(PyExc_ValueError,
5107                          "__getnewargs_ex__ should return a tuple of "
5108                          "length 2, not %zd", PyTuple_GET_SIZE(newargs));
5109             Py_DECREF(newargs);
5110             return -1;
5111         }
5112         *args = PyTuple_GET_ITEM(newargs, 0);
5113         Py_INCREF(*args);
5114         *kwargs = PyTuple_GET_ITEM(newargs, 1);
5115         Py_INCREF(*kwargs);
5116         Py_DECREF(newargs);
5117 
5118         /* XXX We should perhaps allow None to be passed here. */
5119         if (!PyTuple_Check(*args)) {
5120             PyErr_Format(PyExc_TypeError,
5121                          "first item of the tuple returned by "
5122                          "__getnewargs_ex__ must be a tuple, not '%.200s'",
5123                          Py_TYPE(*args)->tp_name);
5124             Py_CLEAR(*args);
5125             Py_CLEAR(*kwargs);
5126             return -1;
5127         }
5128         if (!PyDict_Check(*kwargs)) {
5129             PyErr_Format(PyExc_TypeError,
5130                          "second item of the tuple returned by "
5131                          "__getnewargs_ex__ must be a dict, not '%.200s'",
5132                          Py_TYPE(*kwargs)->tp_name);
5133             Py_CLEAR(*args);
5134             Py_CLEAR(*kwargs);
5135             return -1;
5136         }
5137         return 0;
5138     } else if (PyErr_Occurred()) {
5139         return -1;
5140     }
5141 
5142     /* The object does not have __getnewargs_ex__ so we fallback on using
5143        __getnewargs__ instead. */
5144     getnewargs = _PyObject_LookupSpecial(obj, &PyId___getnewargs__);
5145     if (getnewargs != NULL) {
5146         *args = _PyObject_CallNoArgs(getnewargs);
5147         Py_DECREF(getnewargs);
5148         if (*args == NULL) {
5149             return -1;
5150         }
5151         if (!PyTuple_Check(*args)) {
5152             PyErr_Format(PyExc_TypeError,
5153                          "__getnewargs__ should return a tuple, "
5154                          "not '%.200s'", Py_TYPE(*args)->tp_name);
5155             Py_CLEAR(*args);
5156             return -1;
5157         }
5158         *kwargs = NULL;
5159         return 0;
5160     } else if (PyErr_Occurred()) {
5161         return -1;
5162     }
5163 
5164     /* The object does not have __getnewargs_ex__ and __getnewargs__. This may
5165        mean __new__ does not takes any arguments on this object, or that the
5166        object does not implement the reduce protocol for pickling or
5167        copying. */
5168     *args = NULL;
5169     *kwargs = NULL;
5170     return 0;
5171 }
5172 
5173 static int
_PyObject_GetItemsIter(PyObject * obj,PyObject ** listitems,PyObject ** dictitems)5174 _PyObject_GetItemsIter(PyObject *obj, PyObject **listitems,
5175                        PyObject **dictitems)
5176 {
5177     if (listitems == NULL || dictitems == NULL) {
5178         PyErr_BadInternalCall();
5179         return -1;
5180     }
5181 
5182     if (!PyList_Check(obj)) {
5183         *listitems = Py_None;
5184         Py_INCREF(*listitems);
5185     }
5186     else {
5187         *listitems = PyObject_GetIter(obj);
5188         if (*listitems == NULL)
5189             return -1;
5190     }
5191 
5192     if (!PyDict_Check(obj)) {
5193         *dictitems = Py_None;
5194         Py_INCREF(*dictitems);
5195     }
5196     else {
5197         PyObject *items;
5198         _Py_IDENTIFIER(items);
5199 
5200         items = _PyObject_CallMethodIdNoArgs(obj, &PyId_items);
5201         if (items == NULL) {
5202             Py_CLEAR(*listitems);
5203             return -1;
5204         }
5205         *dictitems = PyObject_GetIter(items);
5206         Py_DECREF(items);
5207         if (*dictitems == NULL) {
5208             Py_CLEAR(*listitems);
5209             return -1;
5210         }
5211     }
5212 
5213     assert(*listitems != NULL && *dictitems != NULL);
5214 
5215     return 0;
5216 }
5217 
5218 static PyObject *
reduce_newobj(PyObject * obj)5219 reduce_newobj(PyObject *obj)
5220 {
5221     PyObject *args = NULL, *kwargs = NULL;
5222     PyObject *copyreg;
5223     PyObject *newobj, *newargs, *state, *listitems, *dictitems;
5224     PyObject *result;
5225     int hasargs;
5226 
5227     if (Py_TYPE(obj)->tp_new == NULL) {
5228         PyErr_Format(PyExc_TypeError,
5229                      "cannot pickle '%.200s' object",
5230                      Py_TYPE(obj)->tp_name);
5231         return NULL;
5232     }
5233     if (_PyObject_GetNewArguments(obj, &args, &kwargs) < 0)
5234         return NULL;
5235 
5236     copyreg = import_copyreg();
5237     if (copyreg == NULL) {
5238         Py_XDECREF(args);
5239         Py_XDECREF(kwargs);
5240         return NULL;
5241     }
5242     hasargs = (args != NULL);
5243     if (kwargs == NULL || PyDict_GET_SIZE(kwargs) == 0) {
5244         _Py_IDENTIFIER(__newobj__);
5245         PyObject *cls;
5246         Py_ssize_t i, n;
5247 
5248         Py_XDECREF(kwargs);
5249         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj__);
5250         Py_DECREF(copyreg);
5251         if (newobj == NULL) {
5252             Py_XDECREF(args);
5253             return NULL;
5254         }
5255         n = args ? PyTuple_GET_SIZE(args) : 0;
5256         newargs = PyTuple_New(n+1);
5257         if (newargs == NULL) {
5258             Py_XDECREF(args);
5259             Py_DECREF(newobj);
5260             return NULL;
5261         }
5262         cls = (PyObject *) Py_TYPE(obj);
5263         Py_INCREF(cls);
5264         PyTuple_SET_ITEM(newargs, 0, cls);
5265         for (i = 0; i < n; i++) {
5266             PyObject *v = PyTuple_GET_ITEM(args, i);
5267             Py_INCREF(v);
5268             PyTuple_SET_ITEM(newargs, i+1, v);
5269         }
5270         Py_XDECREF(args);
5271     }
5272     else if (args != NULL) {
5273         _Py_IDENTIFIER(__newobj_ex__);
5274 
5275         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj_ex__);
5276         Py_DECREF(copyreg);
5277         if (newobj == NULL) {
5278             Py_DECREF(args);
5279             Py_DECREF(kwargs);
5280             return NULL;
5281         }
5282         newargs = PyTuple_Pack(3, Py_TYPE(obj), args, kwargs);
5283         Py_DECREF(args);
5284         Py_DECREF(kwargs);
5285         if (newargs == NULL) {
5286             Py_DECREF(newobj);
5287             return NULL;
5288         }
5289     }
5290     else {
5291         /* args == NULL */
5292         Py_DECREF(kwargs);
5293         PyErr_BadInternalCall();
5294         return NULL;
5295     }
5296 
5297     state = _PyObject_GetState(obj,
5298                 !hasargs && !PyList_Check(obj) && !PyDict_Check(obj));
5299     if (state == NULL) {
5300         Py_DECREF(newobj);
5301         Py_DECREF(newargs);
5302         return NULL;
5303     }
5304     if (_PyObject_GetItemsIter(obj, &listitems, &dictitems) < 0) {
5305         Py_DECREF(newobj);
5306         Py_DECREF(newargs);
5307         Py_DECREF(state);
5308         return NULL;
5309     }
5310 
5311     result = PyTuple_Pack(5, newobj, newargs, state, listitems, dictitems);
5312     Py_DECREF(newobj);
5313     Py_DECREF(newargs);
5314     Py_DECREF(state);
5315     Py_DECREF(listitems);
5316     Py_DECREF(dictitems);
5317     return result;
5318 }
5319 
5320 /*
5321  * There were two problems when object.__reduce__ and object.__reduce_ex__
5322  * were implemented in the same function:
5323  *  - trying to pickle an object with a custom __reduce__ method that
5324  *    fell back to object.__reduce__ in certain circumstances led to
5325  *    infinite recursion at Python level and eventual RecursionError.
5326  *  - Pickling objects that lied about their type by overwriting the
5327  *    __class__ descriptor could lead to infinite recursion at C level
5328  *    and eventual segfault.
5329  *
5330  * Because of backwards compatibility, the two methods still have to
5331  * behave in the same way, even if this is not required by the pickle
5332  * protocol. This common functionality was moved to the _common_reduce
5333  * function.
5334  */
5335 static PyObject *
_common_reduce(PyObject * self,int proto)5336 _common_reduce(PyObject *self, int proto)
5337 {
5338     PyObject *copyreg, *res;
5339 
5340     if (proto >= 2)
5341         return reduce_newobj(self);
5342 
5343     copyreg = import_copyreg();
5344     if (!copyreg)
5345         return NULL;
5346 
5347     res = PyObject_CallMethod(copyreg, "_reduce_ex", "Oi", self, proto);
5348     Py_DECREF(copyreg);
5349 
5350     return res;
5351 }
5352 
5353 /*[clinic input]
5354 object.__reduce__
5355 
5356 Helper for pickle.
5357 [clinic start generated code]*/
5358 
5359 static PyObject *
object___reduce___impl(PyObject * self)5360 object___reduce___impl(PyObject *self)
5361 /*[clinic end generated code: output=d4ca691f891c6e2f input=11562e663947e18b]*/
5362 {
5363     return _common_reduce(self, 0);
5364 }
5365 
5366 /*[clinic input]
5367 object.__reduce_ex__
5368 
5369   protocol: int
5370   /
5371 
5372 Helper for pickle.
5373 [clinic start generated code]*/
5374 
5375 static PyObject *
object___reduce_ex___impl(PyObject * self,int protocol)5376 object___reduce_ex___impl(PyObject *self, int protocol)
5377 /*[clinic end generated code: output=2e157766f6b50094 input=f326b43fb8a4c5ff]*/
5378 {
5379     static PyObject *objreduce;
5380     PyObject *reduce, *res;
5381     _Py_IDENTIFIER(__reduce__);
5382 
5383     if (objreduce == NULL) {
5384         objreduce = _PyDict_GetItemIdWithError(PyBaseObject_Type.tp_dict,
5385                                                &PyId___reduce__);
5386         if (objreduce == NULL && PyErr_Occurred()) {
5387             return NULL;
5388         }
5389     }
5390 
5391     if (_PyObject_LookupAttrId(self, &PyId___reduce__, &reduce) < 0) {
5392         return NULL;
5393     }
5394     if (reduce != NULL) {
5395         PyObject *cls, *clsreduce;
5396         int override;
5397 
5398         cls = (PyObject *) Py_TYPE(self);
5399         clsreduce = _PyObject_GetAttrId(cls, &PyId___reduce__);
5400         if (clsreduce == NULL) {
5401             Py_DECREF(reduce);
5402             return NULL;
5403         }
5404         override = (clsreduce != objreduce);
5405         Py_DECREF(clsreduce);
5406         if (override) {
5407             res = _PyObject_CallNoArgs(reduce);
5408             Py_DECREF(reduce);
5409             return res;
5410         }
5411         else
5412             Py_DECREF(reduce);
5413     }
5414 
5415     return _common_reduce(self, protocol);
5416 }
5417 
5418 static PyObject *
object_subclasshook(PyObject * cls,PyObject * args)5419 object_subclasshook(PyObject *cls, PyObject *args)
5420 {
5421     Py_RETURN_NOTIMPLEMENTED;
5422 }
5423 
5424 PyDoc_STRVAR(object_subclasshook_doc,
5425 "Abstract classes can override this to customize issubclass().\n"
5426 "\n"
5427 "This is invoked early on by abc.ABCMeta.__subclasscheck__().\n"
5428 "It should return True, False or NotImplemented.  If it returns\n"
5429 "NotImplemented, the normal algorithm is used.  Otherwise, it\n"
5430 "overrides the normal algorithm (and the outcome is cached).\n");
5431 
5432 static PyObject *
object_init_subclass(PyObject * cls,PyObject * arg)5433 object_init_subclass(PyObject *cls, PyObject *arg)
5434 {
5435     Py_RETURN_NONE;
5436 }
5437 
5438 PyDoc_STRVAR(object_init_subclass_doc,
5439 "This method is called when a class is subclassed.\n"
5440 "\n"
5441 "The default implementation does nothing. It may be\n"
5442 "overridden to extend subclasses.\n");
5443 
5444 /*[clinic input]
5445 object.__format__
5446 
5447   format_spec: unicode
5448   /
5449 
5450 Default object formatter.
5451 [clinic start generated code]*/
5452 
5453 static PyObject *
object___format___impl(PyObject * self,PyObject * format_spec)5454 object___format___impl(PyObject *self, PyObject *format_spec)
5455 /*[clinic end generated code: output=34897efb543a974b input=7c3b3bc53a6fb7fa]*/
5456 {
5457     /* Issue 7994: If we're converting to a string, we
5458        should reject format specifications */
5459     if (PyUnicode_GET_LENGTH(format_spec) > 0) {
5460         PyErr_Format(PyExc_TypeError,
5461                      "unsupported format string passed to %.200s.__format__",
5462                      Py_TYPE(self)->tp_name);
5463         return NULL;
5464     }
5465     return PyObject_Str(self);
5466 }
5467 
5468 /*[clinic input]
5469 object.__sizeof__
5470 
5471 Size of object in memory, in bytes.
5472 [clinic start generated code]*/
5473 
5474 static PyObject *
object___sizeof___impl(PyObject * self)5475 object___sizeof___impl(PyObject *self)
5476 /*[clinic end generated code: output=73edab332f97d550 input=1200ff3dfe485306]*/
5477 {
5478     Py_ssize_t res, isize;
5479 
5480     res = 0;
5481     isize = Py_TYPE(self)->tp_itemsize;
5482     if (isize > 0)
5483         res = Py_SIZE(self) * isize;
5484     res += Py_TYPE(self)->tp_basicsize;
5485 
5486     return PyLong_FromSsize_t(res);
5487 }
5488 
5489 /* __dir__ for generic objects: returns __dict__, __class__,
5490    and recursively up the __class__.__bases__ chain.
5491 */
5492 /*[clinic input]
5493 object.__dir__
5494 
5495 Default dir() implementation.
5496 [clinic start generated code]*/
5497 
5498 static PyObject *
object___dir___impl(PyObject * self)5499 object___dir___impl(PyObject *self)
5500 /*[clinic end generated code: output=66dd48ea62f26c90 input=0a89305bec669b10]*/
5501 {
5502     PyObject *result = NULL;
5503     PyObject *dict = NULL;
5504     PyObject *itsclass = NULL;
5505 
5506     /* Get __dict__ (which may or may not be a real dict...) */
5507     if (_PyObject_LookupAttrId(self, &PyId___dict__, &dict) < 0) {
5508         return NULL;
5509     }
5510     if (dict == NULL) {
5511         dict = PyDict_New();
5512     }
5513     else if (!PyDict_Check(dict)) {
5514         Py_DECREF(dict);
5515         dict = PyDict_New();
5516     }
5517     else {
5518         /* Copy __dict__ to avoid mutating it. */
5519         PyObject *temp = PyDict_Copy(dict);
5520         Py_DECREF(dict);
5521         dict = temp;
5522     }
5523 
5524     if (dict == NULL)
5525         goto error;
5526 
5527     /* Merge in attrs reachable from its class. */
5528     if (_PyObject_LookupAttrId(self, &PyId___class__, &itsclass) < 0) {
5529         goto error;
5530     }
5531     /* XXX(tomer): Perhaps fall back to Py_TYPE(obj) if no
5532                    __class__ exists? */
5533     if (itsclass != NULL && merge_class_dict(dict, itsclass) < 0)
5534         goto error;
5535 
5536     result = PyDict_Keys(dict);
5537     /* fall through */
5538 error:
5539     Py_XDECREF(itsclass);
5540     Py_XDECREF(dict);
5541     return result;
5542 }
5543 
5544 static PyMethodDef object_methods[] = {
5545     OBJECT___REDUCE_EX___METHODDEF
5546     OBJECT___REDUCE___METHODDEF
5547     {"__subclasshook__", object_subclasshook, METH_CLASS | METH_VARARGS,
5548      object_subclasshook_doc},
5549     {"__init_subclass__", object_init_subclass, METH_CLASS | METH_NOARGS,
5550      object_init_subclass_doc},
5551     OBJECT___FORMAT___METHODDEF
5552     OBJECT___SIZEOF___METHODDEF
5553     OBJECT___DIR___METHODDEF
5554     {0}
5555 };
5556 
5557 PyDoc_STRVAR(object_doc,
5558 "object()\n--\n\n"
5559 "The base class of the class hierarchy.\n\n"
5560 "When called, it accepts no arguments and returns a new featureless\n"
5561 "instance that has no instance attributes and cannot be given any.\n");
5562 
5563 PyTypeObject PyBaseObject_Type = {
5564     PyVarObject_HEAD_INIT(&PyType_Type, 0)
5565     "object",                                   /* tp_name */
5566     sizeof(PyObject),                           /* tp_basicsize */
5567     0,                                          /* tp_itemsize */
5568     object_dealloc,                             /* tp_dealloc */
5569     0,                                          /* tp_vectorcall_offset */
5570     0,                                          /* tp_getattr */
5571     0,                                          /* tp_setattr */
5572     0,                                          /* tp_as_async */
5573     object_repr,                                /* tp_repr */
5574     0,                                          /* tp_as_number */
5575     0,                                          /* tp_as_sequence */
5576     0,                                          /* tp_as_mapping */
5577     (hashfunc)_Py_HashPointer,                  /* tp_hash */
5578     0,                                          /* tp_call */
5579     object_str,                                 /* tp_str */
5580     PyObject_GenericGetAttr,                    /* tp_getattro */
5581     PyObject_GenericSetAttr,                    /* tp_setattro */
5582     0,                                          /* tp_as_buffer */
5583     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,   /* tp_flags */
5584     object_doc,                                 /* tp_doc */
5585     0,                                          /* tp_traverse */
5586     0,                                          /* tp_clear */
5587     object_richcompare,                         /* tp_richcompare */
5588     0,                                          /* tp_weaklistoffset */
5589     0,                                          /* tp_iter */
5590     0,                                          /* tp_iternext */
5591     object_methods,                             /* tp_methods */
5592     0,                                          /* tp_members */
5593     object_getsets,                             /* tp_getset */
5594     0,                                          /* tp_base */
5595     0,                                          /* tp_dict */
5596     0,                                          /* tp_descr_get */
5597     0,                                          /* tp_descr_set */
5598     0,                                          /* tp_dictoffset */
5599     object_init,                                /* tp_init */
5600     PyType_GenericAlloc,                        /* tp_alloc */
5601     object_new,                                 /* tp_new */
5602     PyObject_Del,                               /* tp_free */
5603 };
5604 
5605 
5606 static int
type_add_method(PyTypeObject * type,PyMethodDef * meth)5607 type_add_method(PyTypeObject *type, PyMethodDef *meth)
5608 {
5609     PyObject *descr;
5610     int isdescr = 1;
5611     if (meth->ml_flags & METH_CLASS) {
5612         if (meth->ml_flags & METH_STATIC) {
5613             PyErr_SetString(PyExc_ValueError,
5614                     "method cannot be both class and static");
5615             return -1;
5616         }
5617         descr = PyDescr_NewClassMethod(type, meth);
5618     }
5619     else if (meth->ml_flags & METH_STATIC) {
5620         PyObject *cfunc = PyCFunction_NewEx(meth, (PyObject*)type, NULL);
5621         if (cfunc == NULL) {
5622             return -1;
5623         }
5624         descr = PyStaticMethod_New(cfunc);
5625         isdescr = 0;  // PyStaticMethod is not PyDescrObject
5626         Py_DECREF(cfunc);
5627     }
5628     else {
5629         descr = PyDescr_NewMethod(type, meth);
5630     }
5631     if (descr == NULL) {
5632         return -1;
5633     }
5634 
5635     PyObject *name;
5636     if (isdescr) {
5637         name = PyDescr_NAME(descr);
5638     }
5639     else {
5640         name = PyUnicode_FromString(meth->ml_name);
5641         if (name == NULL) {
5642             Py_DECREF(descr);
5643             return -1;
5644         }
5645     }
5646 
5647     int err;
5648     if (!(meth->ml_flags & METH_COEXIST)) {
5649         err = PyDict_SetDefault(type->tp_dict, name, descr) == NULL;
5650     }
5651     else {
5652         err = PyDict_SetItem(type->tp_dict, name, descr) < 0;
5653     }
5654     if (!isdescr) {
5655         Py_DECREF(name);
5656     }
5657     Py_DECREF(descr);
5658     if (err) {
5659         return -1;
5660     }
5661     return 0;
5662 }
5663 
5664 
5665 /* Add the methods from tp_methods to the __dict__ in a type object */
5666 static int
type_add_methods(PyTypeObject * type)5667 type_add_methods(PyTypeObject *type)
5668 {
5669     PyMethodDef *meth = type->tp_methods;
5670     if (meth == NULL) {
5671         return 0;
5672     }
5673 
5674     for (; meth->ml_name != NULL; meth++) {
5675         if (type_add_method(type, meth) < 0) {
5676             return -1;
5677         }
5678     }
5679     return 0;
5680 }
5681 
5682 
5683 static int
type_add_members(PyTypeObject * type)5684 type_add_members(PyTypeObject *type)
5685 {
5686     PyMemberDef *memb = type->tp_members;
5687     if (memb == NULL) {
5688         return 0;
5689     }
5690 
5691     PyObject *dict = type->tp_dict;
5692     for (; memb->name != NULL; memb++) {
5693         PyObject *descr = PyDescr_NewMember(type, memb);
5694         if (descr == NULL)
5695             return -1;
5696 
5697         if (PyDict_SetDefault(dict, PyDescr_NAME(descr), descr) == NULL) {
5698             Py_DECREF(descr);
5699             return -1;
5700         }
5701         Py_DECREF(descr);
5702     }
5703     return 0;
5704 }
5705 
5706 
5707 static int
type_add_getset(PyTypeObject * type)5708 type_add_getset(PyTypeObject *type)
5709 {
5710     PyGetSetDef *gsp = type->tp_getset;
5711     if (gsp == NULL) {
5712         return 0;
5713     }
5714 
5715     PyObject *dict = type->tp_dict;
5716     for (; gsp->name != NULL; gsp++) {
5717         PyObject *descr = PyDescr_NewGetSet(type, gsp);
5718         if (descr == NULL) {
5719             return -1;
5720         }
5721 
5722         if (PyDict_SetDefault(dict, PyDescr_NAME(descr), descr) == NULL) {
5723             Py_DECREF(descr);
5724             return -1;
5725         }
5726         Py_DECREF(descr);
5727     }
5728     return 0;
5729 }
5730 
5731 
5732 static void
inherit_special(PyTypeObject * type,PyTypeObject * base)5733 inherit_special(PyTypeObject *type, PyTypeObject *base)
5734 {
5735     /* Copying tp_traverse and tp_clear is connected to the GC flags */
5736     if (!(type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5737         (base->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5738         (!type->tp_traverse && !type->tp_clear)) {
5739         type->tp_flags |= Py_TPFLAGS_HAVE_GC;
5740         if (type->tp_traverse == NULL)
5741             type->tp_traverse = base->tp_traverse;
5742         if (type->tp_clear == NULL)
5743             type->tp_clear = base->tp_clear;
5744     }
5745     type->tp_flags |= (base->tp_flags & Py_TPFLAGS_MANAGED_DICT);
5746 
5747     if (type->tp_basicsize == 0)
5748         type->tp_basicsize = base->tp_basicsize;
5749 
5750     /* Copy other non-function slots */
5751 
5752 #define COPYVAL(SLOT) \
5753     if (type->SLOT == 0) { type->SLOT = base->SLOT; }
5754 
5755     COPYVAL(tp_itemsize);
5756     COPYVAL(tp_weaklistoffset);
5757     COPYVAL(tp_dictoffset);
5758 #undef COPYVAL
5759 
5760     /* Setup fast subclass flags */
5761     if (PyType_IsSubtype(base, (PyTypeObject*)PyExc_BaseException)) {
5762         type->tp_flags |= Py_TPFLAGS_BASE_EXC_SUBCLASS;
5763     }
5764     else if (PyType_IsSubtype(base, &PyType_Type)) {
5765         type->tp_flags |= Py_TPFLAGS_TYPE_SUBCLASS;
5766     }
5767     else if (PyType_IsSubtype(base, &PyLong_Type)) {
5768         type->tp_flags |= Py_TPFLAGS_LONG_SUBCLASS;
5769     }
5770     else if (PyType_IsSubtype(base, &PyBytes_Type)) {
5771         type->tp_flags |= Py_TPFLAGS_BYTES_SUBCLASS;
5772     }
5773     else if (PyType_IsSubtype(base, &PyUnicode_Type)) {
5774         type->tp_flags |= Py_TPFLAGS_UNICODE_SUBCLASS;
5775     }
5776     else if (PyType_IsSubtype(base, &PyTuple_Type)) {
5777         type->tp_flags |= Py_TPFLAGS_TUPLE_SUBCLASS;
5778     }
5779     else if (PyType_IsSubtype(base, &PyList_Type)) {
5780         type->tp_flags |= Py_TPFLAGS_LIST_SUBCLASS;
5781     }
5782     else if (PyType_IsSubtype(base, &PyDict_Type)) {
5783         type->tp_flags |= Py_TPFLAGS_DICT_SUBCLASS;
5784     }
5785     if (PyType_HasFeature(base, _Py_TPFLAGS_MATCH_SELF)) {
5786         type->tp_flags |= _Py_TPFLAGS_MATCH_SELF;
5787     }
5788 }
5789 
5790 static int
overrides_hash(PyTypeObject * type)5791 overrides_hash(PyTypeObject *type)
5792 {
5793     PyObject *dict = type->tp_dict;
5794     _Py_IDENTIFIER(__eq__);
5795 
5796     assert(dict != NULL);
5797     int r = _PyDict_ContainsId(dict, &PyId___eq__);
5798     if (r == 0) {
5799         r = _PyDict_ContainsId(dict, &PyId___hash__);
5800     }
5801     return r;
5802 }
5803 
5804 static int
inherit_slots(PyTypeObject * type,PyTypeObject * base)5805 inherit_slots(PyTypeObject *type, PyTypeObject *base)
5806 {
5807     PyTypeObject *basebase;
5808 
5809 #undef SLOTDEFINED
5810 #undef COPYSLOT
5811 #undef COPYNUM
5812 #undef COPYSEQ
5813 #undef COPYMAP
5814 #undef COPYBUF
5815 
5816 #define SLOTDEFINED(SLOT) \
5817     (base->SLOT != 0 && \
5818      (basebase == NULL || base->SLOT != basebase->SLOT))
5819 
5820 #define COPYSLOT(SLOT) \
5821     if (!type->SLOT && SLOTDEFINED(SLOT)) type->SLOT = base->SLOT
5822 
5823 #define COPYASYNC(SLOT) COPYSLOT(tp_as_async->SLOT)
5824 #define COPYNUM(SLOT) COPYSLOT(tp_as_number->SLOT)
5825 #define COPYSEQ(SLOT) COPYSLOT(tp_as_sequence->SLOT)
5826 #define COPYMAP(SLOT) COPYSLOT(tp_as_mapping->SLOT)
5827 #define COPYBUF(SLOT) COPYSLOT(tp_as_buffer->SLOT)
5828 
5829     /* This won't inherit indirect slots (from tp_as_number etc.)
5830        if type doesn't provide the space. */
5831 
5832     if (type->tp_as_number != NULL && base->tp_as_number != NULL) {
5833         basebase = base->tp_base;
5834         if (basebase->tp_as_number == NULL)
5835             basebase = NULL;
5836         COPYNUM(nb_add);
5837         COPYNUM(nb_subtract);
5838         COPYNUM(nb_multiply);
5839         COPYNUM(nb_remainder);
5840         COPYNUM(nb_divmod);
5841         COPYNUM(nb_power);
5842         COPYNUM(nb_negative);
5843         COPYNUM(nb_positive);
5844         COPYNUM(nb_absolute);
5845         COPYNUM(nb_bool);
5846         COPYNUM(nb_invert);
5847         COPYNUM(nb_lshift);
5848         COPYNUM(nb_rshift);
5849         COPYNUM(nb_and);
5850         COPYNUM(nb_xor);
5851         COPYNUM(nb_or);
5852         COPYNUM(nb_int);
5853         COPYNUM(nb_float);
5854         COPYNUM(nb_inplace_add);
5855         COPYNUM(nb_inplace_subtract);
5856         COPYNUM(nb_inplace_multiply);
5857         COPYNUM(nb_inplace_remainder);
5858         COPYNUM(nb_inplace_power);
5859         COPYNUM(nb_inplace_lshift);
5860         COPYNUM(nb_inplace_rshift);
5861         COPYNUM(nb_inplace_and);
5862         COPYNUM(nb_inplace_xor);
5863         COPYNUM(nb_inplace_or);
5864         COPYNUM(nb_true_divide);
5865         COPYNUM(nb_floor_divide);
5866         COPYNUM(nb_inplace_true_divide);
5867         COPYNUM(nb_inplace_floor_divide);
5868         COPYNUM(nb_index);
5869         COPYNUM(nb_matrix_multiply);
5870         COPYNUM(nb_inplace_matrix_multiply);
5871     }
5872 
5873     if (type->tp_as_async != NULL && base->tp_as_async != NULL) {
5874         basebase = base->tp_base;
5875         if (basebase->tp_as_async == NULL)
5876             basebase = NULL;
5877         COPYASYNC(am_await);
5878         COPYASYNC(am_aiter);
5879         COPYASYNC(am_anext);
5880     }
5881 
5882     if (type->tp_as_sequence != NULL && base->tp_as_sequence != NULL) {
5883         basebase = base->tp_base;
5884         if (basebase->tp_as_sequence == NULL)
5885             basebase = NULL;
5886         COPYSEQ(sq_length);
5887         COPYSEQ(sq_concat);
5888         COPYSEQ(sq_repeat);
5889         COPYSEQ(sq_item);
5890         COPYSEQ(sq_ass_item);
5891         COPYSEQ(sq_contains);
5892         COPYSEQ(sq_inplace_concat);
5893         COPYSEQ(sq_inplace_repeat);
5894     }
5895 
5896     if (type->tp_as_mapping != NULL && base->tp_as_mapping != NULL) {
5897         basebase = base->tp_base;
5898         if (basebase->tp_as_mapping == NULL)
5899             basebase = NULL;
5900         COPYMAP(mp_length);
5901         COPYMAP(mp_subscript);
5902         COPYMAP(mp_ass_subscript);
5903     }
5904 
5905     if (type->tp_as_buffer != NULL && base->tp_as_buffer != NULL) {
5906         basebase = base->tp_base;
5907         if (basebase->tp_as_buffer == NULL)
5908             basebase = NULL;
5909         COPYBUF(bf_getbuffer);
5910         COPYBUF(bf_releasebuffer);
5911     }
5912 
5913     basebase = base->tp_base;
5914 
5915     COPYSLOT(tp_dealloc);
5916     if (type->tp_getattr == NULL && type->tp_getattro == NULL) {
5917         type->tp_getattr = base->tp_getattr;
5918         type->tp_getattro = base->tp_getattro;
5919     }
5920     if (type->tp_setattr == NULL && type->tp_setattro == NULL) {
5921         type->tp_setattr = base->tp_setattr;
5922         type->tp_setattro = base->tp_setattro;
5923     }
5924     COPYSLOT(tp_repr);
5925     /* tp_hash see tp_richcompare */
5926     {
5927         /* Always inherit tp_vectorcall_offset to support PyVectorcall_Call().
5928          * If Py_TPFLAGS_HAVE_VECTORCALL is not inherited, then vectorcall
5929          * won't be used automatically. */
5930         COPYSLOT(tp_vectorcall_offset);
5931 
5932         /* Inherit Py_TPFLAGS_HAVE_VECTORCALL for non-heap types
5933         * if tp_call is not overridden */
5934         if (!type->tp_call &&
5935             _PyType_HasFeature(base, Py_TPFLAGS_HAVE_VECTORCALL) &&
5936             _PyType_HasFeature(type, Py_TPFLAGS_IMMUTABLETYPE))
5937         {
5938             type->tp_flags |= Py_TPFLAGS_HAVE_VECTORCALL;
5939         }
5940         COPYSLOT(tp_call);
5941     }
5942     COPYSLOT(tp_str);
5943     {
5944         /* Copy comparison-related slots only when
5945            not overriding them anywhere */
5946         if (type->tp_richcompare == NULL &&
5947             type->tp_hash == NULL)
5948         {
5949             int r = overrides_hash(type);
5950             if (r < 0) {
5951                 return -1;
5952             }
5953             if (!r) {
5954                 type->tp_richcompare = base->tp_richcompare;
5955                 type->tp_hash = base->tp_hash;
5956             }
5957         }
5958     }
5959     {
5960         COPYSLOT(tp_iter);
5961         COPYSLOT(tp_iternext);
5962     }
5963     {
5964         COPYSLOT(tp_descr_get);
5965         /* Inherit Py_TPFLAGS_METHOD_DESCRIPTOR if tp_descr_get was inherited,
5966          * but only for extension types */
5967         if (base->tp_descr_get &&
5968             type->tp_descr_get == base->tp_descr_get &&
5969             _PyType_HasFeature(type, Py_TPFLAGS_IMMUTABLETYPE) &&
5970             _PyType_HasFeature(base, Py_TPFLAGS_METHOD_DESCRIPTOR))
5971         {
5972             type->tp_flags |= Py_TPFLAGS_METHOD_DESCRIPTOR;
5973         }
5974         COPYSLOT(tp_descr_set);
5975         COPYSLOT(tp_dictoffset);
5976         COPYSLOT(tp_init);
5977         COPYSLOT(tp_alloc);
5978         COPYSLOT(tp_is_gc);
5979         COPYSLOT(tp_finalize);
5980         if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) ==
5981             (base->tp_flags & Py_TPFLAGS_HAVE_GC)) {
5982             /* They agree about gc. */
5983             COPYSLOT(tp_free);
5984         }
5985         else if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5986                  type->tp_free == NULL &&
5987                  base->tp_free == PyObject_Free) {
5988             /* A bit of magic to plug in the correct default
5989              * tp_free function when a derived class adds gc,
5990              * didn't define tp_free, and the base uses the
5991              * default non-gc tp_free.
5992              */
5993             type->tp_free = PyObject_GC_Del;
5994         }
5995         /* else they didn't agree about gc, and there isn't something
5996          * obvious to be done -- the type is on its own.
5997          */
5998     }
5999     return 0;
6000 }
6001 
6002 static int add_operators(PyTypeObject *);
6003 static int add_tp_new_wrapper(PyTypeObject *type);
6004 
6005 #define COLLECTION_FLAGS (Py_TPFLAGS_SEQUENCE | Py_TPFLAGS_MAPPING)
6006 
6007 static int
type_ready_pre_checks(PyTypeObject * type)6008 type_ready_pre_checks(PyTypeObject *type)
6009 {
6010     /* Consistency checks for PEP 590:
6011      * - Py_TPFLAGS_METHOD_DESCRIPTOR requires tp_descr_get
6012      * - Py_TPFLAGS_HAVE_VECTORCALL requires tp_call and
6013      *   tp_vectorcall_offset > 0
6014      * To avoid mistakes, we require this before inheriting.
6015      */
6016     if (type->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR) {
6017         _PyObject_ASSERT((PyObject *)type, type->tp_descr_get != NULL);
6018     }
6019     if (type->tp_flags & Py_TPFLAGS_HAVE_VECTORCALL) {
6020         _PyObject_ASSERT((PyObject *)type, type->tp_vectorcall_offset > 0);
6021         _PyObject_ASSERT((PyObject *)type, type->tp_call != NULL);
6022     }
6023 
6024     /* Consistency checks for pattern matching
6025      * Py_TPFLAGS_SEQUENCE and Py_TPFLAGS_MAPPING are mutually exclusive */
6026     _PyObject_ASSERT((PyObject *)type, (type->tp_flags & COLLECTION_FLAGS) != COLLECTION_FLAGS);
6027 
6028     if (type->tp_name == NULL) {
6029         PyErr_Format(PyExc_SystemError,
6030                      "Type does not define the tp_name field.");
6031         return -1;
6032     }
6033     return 0;
6034 }
6035 
6036 
6037 static int
type_ready_set_bases(PyTypeObject * type)6038 type_ready_set_bases(PyTypeObject *type)
6039 {
6040     /* Initialize tp_base (defaults to BaseObject unless that's us) */
6041     PyTypeObject *base = type->tp_base;
6042     if (base == NULL && type != &PyBaseObject_Type) {
6043         base = &PyBaseObject_Type;
6044         if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
6045             type->tp_base = (PyTypeObject*)Py_NewRef((PyObject*)base);
6046         }
6047         else {
6048             type->tp_base = base;
6049         }
6050     }
6051     assert(type->tp_base != NULL || type == &PyBaseObject_Type);
6052 
6053     /* Now the only way base can still be NULL is if type is
6054      * &PyBaseObject_Type. */
6055 
6056     /* Initialize the base class */
6057     if (base != NULL && !_PyType_IsReady(base)) {
6058         if (PyType_Ready(base) < 0) {
6059             return -1;
6060         }
6061     }
6062 
6063     /* Initialize ob_type if NULL.      This means extensions that want to be
6064        compilable separately on Windows can call PyType_Ready() instead of
6065        initializing the ob_type field of their type objects. */
6066     /* The test for base != NULL is really unnecessary, since base is only
6067        NULL when type is &PyBaseObject_Type, and we know its ob_type is
6068        not NULL (it's initialized to &PyType_Type).      But coverity doesn't
6069        know that. */
6070     if (Py_IS_TYPE(type, NULL) && base != NULL) {
6071         Py_SET_TYPE(type, Py_TYPE(base));
6072     }
6073 
6074     /* Initialize tp_bases */
6075     PyObject *bases = type->tp_bases;
6076     if (bases == NULL) {
6077         PyTypeObject *base = type->tp_base;
6078         if (base == NULL) {
6079             bases = PyTuple_New(0);
6080         }
6081         else {
6082             bases = PyTuple_Pack(1, base);
6083         }
6084         if (bases == NULL) {
6085             return -1;
6086         }
6087         type->tp_bases = bases;
6088     }
6089     return 0;
6090 }
6091 
6092 
6093 static int
type_ready_set_dict(PyTypeObject * type)6094 type_ready_set_dict(PyTypeObject *type)
6095 {
6096     if (type->tp_dict != NULL) {
6097         return 0;
6098     }
6099 
6100     PyObject *dict = PyDict_New();
6101     if (dict == NULL) {
6102         return -1;
6103     }
6104     type->tp_dict = dict;
6105     return 0;
6106 }
6107 
6108 
6109 /* If the type dictionary doesn't contain a __doc__, set it from
6110    the tp_doc slot. */
6111 static int
type_dict_set_doc(PyTypeObject * type)6112 type_dict_set_doc(PyTypeObject *type)
6113 {
6114     int r = _PyDict_ContainsId(type->tp_dict, &PyId___doc__);
6115     if (r < 0) {
6116         return -1;
6117     }
6118     if (r > 0) {
6119         return 0;
6120     }
6121 
6122     if (type->tp_doc != NULL) {
6123         const char *doc_str;
6124         doc_str = _PyType_DocWithoutSignature(type->tp_name, type->tp_doc);
6125         PyObject *doc = PyUnicode_FromString(doc_str);
6126         if (doc == NULL) {
6127             return -1;
6128         }
6129 
6130         if (_PyDict_SetItemId(type->tp_dict, &PyId___doc__, doc) < 0) {
6131             Py_DECREF(doc);
6132             return -1;
6133         }
6134         Py_DECREF(doc);
6135     }
6136     else {
6137         if (_PyDict_SetItemId(type->tp_dict, &PyId___doc__, Py_None) < 0) {
6138             return -1;
6139         }
6140     }
6141     return 0;
6142 }
6143 
6144 
6145 static int
type_ready_fill_dict(PyTypeObject * type)6146 type_ready_fill_dict(PyTypeObject *type)
6147 {
6148     /* Add type-specific descriptors to tp_dict */
6149     if (add_operators(type) < 0) {
6150         return -1;
6151     }
6152     if (type_add_methods(type) < 0) {
6153         return -1;
6154     }
6155     if (type_add_members(type) < 0) {
6156         return -1;
6157     }
6158     if (type_add_getset(type) < 0) {
6159         return -1;
6160     }
6161     if (type_dict_set_doc(type) < 0) {
6162         return -1;
6163     }
6164     return 0;
6165 }
6166 
6167 
6168 static int
type_ready_mro(PyTypeObject * type)6169 type_ready_mro(PyTypeObject *type)
6170 {
6171     /* Calculate method resolution order */
6172     if (mro_internal(type, NULL) < 0) {
6173         return -1;
6174     }
6175     assert(type->tp_mro != NULL);
6176     assert(PyTuple_Check(type->tp_mro));
6177 
6178     /* All bases of statically allocated type should be statically allocated */
6179     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
6180         PyObject *mro = type->tp_mro;
6181         Py_ssize_t n = PyTuple_GET_SIZE(mro);
6182         for (Py_ssize_t i = 0; i < n; i++) {
6183             PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(mro, i);
6184             if (PyType_Check(base) && (base->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
6185                 PyErr_Format(PyExc_TypeError,
6186                              "type '%.100s' is not dynamically allocated but "
6187                              "its base type '%.100s' is dynamically allocated",
6188                              type->tp_name, base->tp_name);
6189                 return -1;
6190             }
6191         }
6192     }
6193     return 0;
6194 }
6195 
6196 
6197 // For static types, inherit tp_as_xxx structures from the base class
6198 // if it's NULL.
6199 //
6200 // For heap types, tp_as_xxx structures are not NULL: they are set to the
6201 // PyHeapTypeObject.as_xxx fields by type_new_alloc().
6202 static void
type_ready_inherit_as_structs(PyTypeObject * type,PyTypeObject * base)6203 type_ready_inherit_as_structs(PyTypeObject *type, PyTypeObject *base)
6204 {
6205     if (type->tp_as_async == NULL) {
6206         type->tp_as_async = base->tp_as_async;
6207     }
6208     if (type->tp_as_number == NULL) {
6209         type->tp_as_number = base->tp_as_number;
6210     }
6211     if (type->tp_as_sequence == NULL) {
6212         type->tp_as_sequence = base->tp_as_sequence;
6213     }
6214     if (type->tp_as_mapping == NULL) {
6215         type->tp_as_mapping = base->tp_as_mapping;
6216     }
6217     if (type->tp_as_buffer == NULL) {
6218         type->tp_as_buffer = base->tp_as_buffer;
6219     }
6220 }
6221 
6222 static void
inherit_patma_flags(PyTypeObject * type,PyTypeObject * base)6223 inherit_patma_flags(PyTypeObject *type, PyTypeObject *base) {
6224     if ((type->tp_flags & COLLECTION_FLAGS) == 0) {
6225         type->tp_flags |= base->tp_flags & COLLECTION_FLAGS;
6226     }
6227 }
6228 
6229 static int
type_ready_inherit(PyTypeObject * type)6230 type_ready_inherit(PyTypeObject *type)
6231 {
6232     /* Inherit special flags from dominant base */
6233     PyTypeObject *base = type->tp_base;
6234     if (base != NULL) {
6235         inherit_special(type, base);
6236     }
6237 
6238     // Inherit slots
6239     PyObject *mro = type->tp_mro;
6240     Py_ssize_t n = PyTuple_GET_SIZE(type->tp_mro);
6241     for (Py_ssize_t i = 1; i < n; i++) {
6242         PyObject *b = PyTuple_GET_ITEM(mro, i);
6243         if (PyType_Check(b)) {
6244             if (inherit_slots(type, (PyTypeObject *)b) < 0) {
6245                 return -1;
6246             }
6247             inherit_patma_flags(type, (PyTypeObject *)b);
6248         }
6249     }
6250 
6251     if (base != NULL) {
6252         type_ready_inherit_as_structs(type, base);
6253     }
6254 
6255     /* Sanity check for tp_free. */
6256     if (_PyType_IS_GC(type) && (type->tp_flags & Py_TPFLAGS_BASETYPE) &&
6257         (type->tp_free == NULL || type->tp_free == PyObject_Del))
6258     {
6259         /* This base class needs to call tp_free, but doesn't have
6260          * one, or its tp_free is for non-gc'ed objects.
6261          */
6262         PyErr_Format(PyExc_TypeError, "type '%.100s' participates in "
6263                      "gc and is a base type but has inappropriate "
6264                      "tp_free slot",
6265                      type->tp_name);
6266         return -1;
6267     }
6268 
6269     return 0;
6270 }
6271 
6272 
6273 /* Hack for tp_hash and __hash__.
6274    If after all that, tp_hash is still NULL, and __hash__ is not in
6275    tp_dict, set tp_hash to PyObject_HashNotImplemented and
6276    tp_dict['__hash__'] equal to None.
6277    This signals that __hash__ is not inherited. */
6278 static int
type_ready_set_hash(PyTypeObject * type)6279 type_ready_set_hash(PyTypeObject *type)
6280 {
6281     if (type->tp_hash != NULL) {
6282         return 0;
6283     }
6284 
6285     int r = _PyDict_ContainsId(type->tp_dict, &PyId___hash__);
6286     if (r < 0) {
6287         return -1;
6288     }
6289     if (r > 0) {
6290         return 0;
6291     }
6292 
6293     if (_PyDict_SetItemId(type->tp_dict, &PyId___hash__, Py_None) < 0) {
6294         return -1;
6295     }
6296     type->tp_hash = PyObject_HashNotImplemented;
6297     return 0;
6298 }
6299 
6300 
6301 /* Link into each base class's list of subclasses */
6302 static int
type_ready_add_subclasses(PyTypeObject * type)6303 type_ready_add_subclasses(PyTypeObject *type)
6304 {
6305     PyObject *bases = type->tp_bases;
6306     Py_ssize_t nbase = PyTuple_GET_SIZE(bases);
6307     for (Py_ssize_t i = 0; i < nbase; i++) {
6308         PyObject *b = PyTuple_GET_ITEM(bases, i);
6309         if (PyType_Check(b) && add_subclass((PyTypeObject *)b, type) < 0) {
6310             return -1;
6311         }
6312     }
6313     return 0;
6314 }
6315 
6316 
6317 // Set tp_new and the "__new__" key in the type dictionary.
6318 // Use the Py_TPFLAGS_DISALLOW_INSTANTIATION flag.
6319 static int
type_ready_set_new(PyTypeObject * type)6320 type_ready_set_new(PyTypeObject *type)
6321 {
6322     PyTypeObject *base = type->tp_base;
6323     /* The condition below could use some explanation.
6324 
6325        It appears that tp_new is not inherited for static types whose base
6326        class is 'object'; this seems to be a precaution so that old extension
6327        types don't suddenly become callable (object.__new__ wouldn't insure the
6328        invariants that the extension type's own factory function ensures).
6329 
6330        Heap types, of course, are under our control, so they do inherit tp_new;
6331        static extension types that specify some other built-in type as the
6332        default also inherit object.__new__. */
6333     if (type->tp_new == NULL
6334         && base == &PyBaseObject_Type
6335         && !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
6336     {
6337         type->tp_flags |= Py_TPFLAGS_DISALLOW_INSTANTIATION;
6338     }
6339 
6340     if (!(type->tp_flags & Py_TPFLAGS_DISALLOW_INSTANTIATION)) {
6341         if (type->tp_new != NULL) {
6342             // If "__new__" key does not exists in the type dictionary,
6343             // set it to tp_new_wrapper().
6344             if (add_tp_new_wrapper(type) < 0) {
6345                 return -1;
6346             }
6347         }
6348         else {
6349             // tp_new is NULL: inherit tp_new from base
6350             type->tp_new = base->tp_new;
6351         }
6352     }
6353     else {
6354         // Py_TPFLAGS_DISALLOW_INSTANTIATION sets tp_new to NULL
6355         type->tp_new = NULL;
6356     }
6357     return 0;
6358 }
6359 
6360 
6361 static int
type_ready_post_checks(PyTypeObject * type)6362 type_ready_post_checks(PyTypeObject *type)
6363 {
6364     // bpo-44263: tp_traverse is required if Py_TPFLAGS_HAVE_GC is set.
6365     // Note: tp_clear is optional.
6366     if (type->tp_flags & Py_TPFLAGS_HAVE_GC
6367         && type->tp_traverse == NULL)
6368     {
6369         PyErr_Format(PyExc_SystemError,
6370                      "type %s has the Py_TPFLAGS_HAVE_GC flag "
6371                      "but has no traverse function",
6372                      type->tp_name);
6373         return -1;
6374     }
6375     return 0;
6376 }
6377 
6378 
6379 static int
type_ready(PyTypeObject * type)6380 type_ready(PyTypeObject *type)
6381 {
6382     if (type_ready_pre_checks(type) < 0) {
6383         return -1;
6384     }
6385 
6386 #ifdef Py_TRACE_REFS
6387     /* PyType_Ready is the closest thing we have to a choke point
6388      * for type objects, so is the best place I can think of to try
6389      * to get type objects into the doubly-linked list of all objects.
6390      * Still, not all type objects go through PyType_Ready.
6391      */
6392     _Py_AddToAllObjects((PyObject *)type, 0);
6393 #endif
6394 
6395     /* Initialize tp_dict: _PyType_IsReady() tests if tp_dict != NULL */
6396     if (type_ready_set_dict(type) < 0) {
6397         return -1;
6398     }
6399     if (type_ready_set_bases(type) < 0) {
6400         return -1;
6401     }
6402     if (type_ready_mro(type) < 0) {
6403         return -1;
6404     }
6405     if (type_ready_set_new(type) < 0) {
6406         return -1;
6407     }
6408     if (type_ready_fill_dict(type) < 0) {
6409         return -1;
6410     }
6411     if (type_ready_inherit(type) < 0) {
6412         return -1;
6413     }
6414     if (type_ready_set_hash(type) < 0) {
6415         return -1;
6416     }
6417     if (type_ready_add_subclasses(type) < 0) {
6418         return -1;
6419     }
6420     if (type_ready_post_checks(type) < 0) {
6421         return -1;
6422     }
6423     return 0;
6424 }
6425 
6426 
6427 int
PyType_Ready(PyTypeObject * type)6428 PyType_Ready(PyTypeObject *type)
6429 {
6430     if (type->tp_flags & Py_TPFLAGS_READY) {
6431         assert(_PyType_CheckConsistency(type));
6432         return 0;
6433     }
6434     _PyObject_ASSERT((PyObject *)type,
6435                      (type->tp_flags & Py_TPFLAGS_READYING) == 0);
6436 
6437     type->tp_flags |= Py_TPFLAGS_READYING;
6438 
6439     /* Historically, all static types were immutable. See bpo-43908 */
6440     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
6441         type->tp_flags |= Py_TPFLAGS_IMMUTABLETYPE;
6442     }
6443 
6444     if (type_ready(type) < 0) {
6445         type->tp_flags &= ~Py_TPFLAGS_READYING;
6446         return -1;
6447     }
6448 
6449     /* All done -- set the ready flag */
6450     type->tp_flags = (type->tp_flags & ~Py_TPFLAGS_READYING) | Py_TPFLAGS_READY;
6451     assert(_PyType_CheckConsistency(type));
6452     return 0;
6453 }
6454 
6455 
6456 static int
add_subclass(PyTypeObject * base,PyTypeObject * type)6457 add_subclass(PyTypeObject *base, PyTypeObject *type)
6458 {
6459     int result = -1;
6460     PyObject *dict, *key, *newobj;
6461 
6462     dict = base->tp_subclasses;
6463     if (dict == NULL) {
6464         base->tp_subclasses = dict = PyDict_New();
6465         if (dict == NULL)
6466             return -1;
6467     }
6468     assert(PyDict_CheckExact(dict));
6469     key = PyLong_FromVoidPtr((void *) type);
6470     if (key == NULL)
6471         return -1;
6472     newobj = PyWeakref_NewRef((PyObject *)type, NULL);
6473     if (newobj != NULL) {
6474         result = PyDict_SetItem(dict, key, newobj);
6475         Py_DECREF(newobj);
6476     }
6477     Py_DECREF(key);
6478     return result;
6479 }
6480 
6481 static int
add_all_subclasses(PyTypeObject * type,PyObject * bases)6482 add_all_subclasses(PyTypeObject *type, PyObject *bases)
6483 {
6484     int res = 0;
6485 
6486     if (bases) {
6487         Py_ssize_t i;
6488         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
6489             PyObject *base = PyTuple_GET_ITEM(bases, i);
6490             if (PyType_Check(base) &&
6491                 add_subclass((PyTypeObject*)base, type) < 0)
6492                 res = -1;
6493         }
6494     }
6495 
6496     return res;
6497 }
6498 
6499 static void
remove_subclass(PyTypeObject * base,PyTypeObject * type)6500 remove_subclass(PyTypeObject *base, PyTypeObject *type)
6501 {
6502     PyObject *dict, *key;
6503 
6504     dict = base->tp_subclasses;
6505     if (dict == NULL) {
6506         return;
6507     }
6508     assert(PyDict_CheckExact(dict));
6509     key = PyLong_FromVoidPtr((void *) type);
6510     if (key == NULL || PyDict_DelItem(dict, key)) {
6511         /* This can happen if the type initialization errored out before
6512            the base subclasses were updated (e.g. a non-str __qualname__
6513            was passed in the type dict). */
6514         PyErr_Clear();
6515     }
6516     Py_XDECREF(key);
6517 }
6518 
6519 static void
remove_all_subclasses(PyTypeObject * type,PyObject * bases)6520 remove_all_subclasses(PyTypeObject *type, PyObject *bases)
6521 {
6522     if (bases) {
6523         Py_ssize_t i;
6524         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
6525             PyObject *base = PyTuple_GET_ITEM(bases, i);
6526             if (PyType_Check(base))
6527                 remove_subclass((PyTypeObject*) base, type);
6528         }
6529     }
6530 }
6531 
6532 static int
check_num_args(PyObject * ob,int n)6533 check_num_args(PyObject *ob, int n)
6534 {
6535     if (!PyTuple_CheckExact(ob)) {
6536         PyErr_SetString(PyExc_SystemError,
6537             "PyArg_UnpackTuple() argument list is not a tuple");
6538         return 0;
6539     }
6540     if (n == PyTuple_GET_SIZE(ob))
6541         return 1;
6542     PyErr_Format(
6543         PyExc_TypeError,
6544         "expected %d argument%s, got %zd", n, n == 1 ? "" : "s", PyTuple_GET_SIZE(ob));
6545     return 0;
6546 }
6547 
6548 /* Generic wrappers for overloadable 'operators' such as __getitem__ */
6549 
6550 /* There's a wrapper *function* for each distinct function typedef used
6551    for type object slots (e.g. binaryfunc, ternaryfunc, etc.).  There's a
6552    wrapper *table* for each distinct operation (e.g. __len__, __add__).
6553    Most tables have only one entry; the tables for binary operators have two
6554    entries, one regular and one with reversed arguments. */
6555 
6556 static PyObject *
wrap_lenfunc(PyObject * self,PyObject * args,void * wrapped)6557 wrap_lenfunc(PyObject *self, PyObject *args, void *wrapped)
6558 {
6559     lenfunc func = (lenfunc)wrapped;
6560     Py_ssize_t res;
6561 
6562     if (!check_num_args(args, 0))
6563         return NULL;
6564     res = (*func)(self);
6565     if (res == -1 && PyErr_Occurred())
6566         return NULL;
6567     return PyLong_FromSsize_t(res);
6568 }
6569 
6570 static PyObject *
wrap_inquirypred(PyObject * self,PyObject * args,void * wrapped)6571 wrap_inquirypred(PyObject *self, PyObject *args, void *wrapped)
6572 {
6573     inquiry func = (inquiry)wrapped;
6574     int res;
6575 
6576     if (!check_num_args(args, 0))
6577         return NULL;
6578     res = (*func)(self);
6579     if (res == -1 && PyErr_Occurred())
6580         return NULL;
6581     return PyBool_FromLong((long)res);
6582 }
6583 
6584 static PyObject *
wrap_binaryfunc(PyObject * self,PyObject * args,void * wrapped)6585 wrap_binaryfunc(PyObject *self, PyObject *args, void *wrapped)
6586 {
6587     binaryfunc func = (binaryfunc)wrapped;
6588     PyObject *other;
6589 
6590     if (!check_num_args(args, 1))
6591         return NULL;
6592     other = PyTuple_GET_ITEM(args, 0);
6593     return (*func)(self, other);
6594 }
6595 
6596 static PyObject *
wrap_binaryfunc_l(PyObject * self,PyObject * args,void * wrapped)6597 wrap_binaryfunc_l(PyObject *self, PyObject *args, void *wrapped)
6598 {
6599     binaryfunc func = (binaryfunc)wrapped;
6600     PyObject *other;
6601 
6602     if (!check_num_args(args, 1))
6603         return NULL;
6604     other = PyTuple_GET_ITEM(args, 0);
6605     return (*func)(self, other);
6606 }
6607 
6608 static PyObject *
wrap_binaryfunc_r(PyObject * self,PyObject * args,void * wrapped)6609 wrap_binaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
6610 {
6611     binaryfunc func = (binaryfunc)wrapped;
6612     PyObject *other;
6613 
6614     if (!check_num_args(args, 1))
6615         return NULL;
6616     other = PyTuple_GET_ITEM(args, 0);
6617     return (*func)(other, self);
6618 }
6619 
6620 static PyObject *
wrap_ternaryfunc(PyObject * self,PyObject * args,void * wrapped)6621 wrap_ternaryfunc(PyObject *self, PyObject *args, void *wrapped)
6622 {
6623     ternaryfunc func = (ternaryfunc)wrapped;
6624     PyObject *other;
6625     PyObject *third = Py_None;
6626 
6627     /* Note: This wrapper only works for __pow__() */
6628 
6629     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
6630         return NULL;
6631     return (*func)(self, other, third);
6632 }
6633 
6634 static PyObject *
wrap_ternaryfunc_r(PyObject * self,PyObject * args,void * wrapped)6635 wrap_ternaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
6636 {
6637     ternaryfunc func = (ternaryfunc)wrapped;
6638     PyObject *other;
6639     PyObject *third = Py_None;
6640 
6641     /* Note: This wrapper only works for __pow__() */
6642 
6643     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
6644         return NULL;
6645     return (*func)(other, self, third);
6646 }
6647 
6648 static PyObject *
wrap_unaryfunc(PyObject * self,PyObject * args,void * wrapped)6649 wrap_unaryfunc(PyObject *self, PyObject *args, void *wrapped)
6650 {
6651     unaryfunc func = (unaryfunc)wrapped;
6652 
6653     if (!check_num_args(args, 0))
6654         return NULL;
6655     return (*func)(self);
6656 }
6657 
6658 static PyObject *
wrap_indexargfunc(PyObject * self,PyObject * args,void * wrapped)6659 wrap_indexargfunc(PyObject *self, PyObject *args, void *wrapped)
6660 {
6661     ssizeargfunc func = (ssizeargfunc)wrapped;
6662     PyObject* o;
6663     Py_ssize_t i;
6664 
6665     if (!PyArg_UnpackTuple(args, "", 1, 1, &o))
6666         return NULL;
6667     i = PyNumber_AsSsize_t(o, PyExc_OverflowError);
6668     if (i == -1 && PyErr_Occurred())
6669         return NULL;
6670     return (*func)(self, i);
6671 }
6672 
6673 static Py_ssize_t
getindex(PyObject * self,PyObject * arg)6674 getindex(PyObject *self, PyObject *arg)
6675 {
6676     Py_ssize_t i;
6677 
6678     i = PyNumber_AsSsize_t(arg, PyExc_OverflowError);
6679     if (i == -1 && PyErr_Occurred())
6680         return -1;
6681     if (i < 0) {
6682         PySequenceMethods *sq = Py_TYPE(self)->tp_as_sequence;
6683         if (sq && sq->sq_length) {
6684             Py_ssize_t n = (*sq->sq_length)(self);
6685             if (n < 0) {
6686                 assert(PyErr_Occurred());
6687                 return -1;
6688             }
6689             i += n;
6690         }
6691     }
6692     return i;
6693 }
6694 
6695 static PyObject *
wrap_sq_item(PyObject * self,PyObject * args,void * wrapped)6696 wrap_sq_item(PyObject *self, PyObject *args, void *wrapped)
6697 {
6698     ssizeargfunc func = (ssizeargfunc)wrapped;
6699     PyObject *arg;
6700     Py_ssize_t i;
6701 
6702     if (PyTuple_GET_SIZE(args) == 1) {
6703         arg = PyTuple_GET_ITEM(args, 0);
6704         i = getindex(self, arg);
6705         if (i == -1 && PyErr_Occurred())
6706             return NULL;
6707         return (*func)(self, i);
6708     }
6709     check_num_args(args, 1);
6710     assert(PyErr_Occurred());
6711     return NULL;
6712 }
6713 
6714 static PyObject *
wrap_sq_setitem(PyObject * self,PyObject * args,void * wrapped)6715 wrap_sq_setitem(PyObject *self, PyObject *args, void *wrapped)
6716 {
6717     ssizeobjargproc func = (ssizeobjargproc)wrapped;
6718     Py_ssize_t i;
6719     int res;
6720     PyObject *arg, *value;
6721 
6722     if (!PyArg_UnpackTuple(args, "", 2, 2, &arg, &value))
6723         return NULL;
6724     i = getindex(self, arg);
6725     if (i == -1 && PyErr_Occurred())
6726         return NULL;
6727     res = (*func)(self, i, value);
6728     if (res == -1 && PyErr_Occurred())
6729         return NULL;
6730     Py_RETURN_NONE;
6731 }
6732 
6733 static PyObject *
wrap_sq_delitem(PyObject * self,PyObject * args,void * wrapped)6734 wrap_sq_delitem(PyObject *self, PyObject *args, void *wrapped)
6735 {
6736     ssizeobjargproc func = (ssizeobjargproc)wrapped;
6737     Py_ssize_t i;
6738     int res;
6739     PyObject *arg;
6740 
6741     if (!check_num_args(args, 1))
6742         return NULL;
6743     arg = PyTuple_GET_ITEM(args, 0);
6744     i = getindex(self, arg);
6745     if (i == -1 && PyErr_Occurred())
6746         return NULL;
6747     res = (*func)(self, i, NULL);
6748     if (res == -1 && PyErr_Occurred())
6749         return NULL;
6750     Py_RETURN_NONE;
6751 }
6752 
6753 /* XXX objobjproc is a misnomer; should be objargpred */
6754 static PyObject *
wrap_objobjproc(PyObject * self,PyObject * args,void * wrapped)6755 wrap_objobjproc(PyObject *self, PyObject *args, void *wrapped)
6756 {
6757     objobjproc func = (objobjproc)wrapped;
6758     int res;
6759     PyObject *value;
6760 
6761     if (!check_num_args(args, 1))
6762         return NULL;
6763     value = PyTuple_GET_ITEM(args, 0);
6764     res = (*func)(self, value);
6765     if (res == -1 && PyErr_Occurred())
6766         return NULL;
6767     else
6768         return PyBool_FromLong(res);
6769 }
6770 
6771 static PyObject *
wrap_objobjargproc(PyObject * self,PyObject * args,void * wrapped)6772 wrap_objobjargproc(PyObject *self, PyObject *args, void *wrapped)
6773 {
6774     objobjargproc func = (objobjargproc)wrapped;
6775     int res;
6776     PyObject *key, *value;
6777 
6778     if (!PyArg_UnpackTuple(args, "", 2, 2, &key, &value))
6779         return NULL;
6780     res = (*func)(self, key, value);
6781     if (res == -1 && PyErr_Occurred())
6782         return NULL;
6783     Py_RETURN_NONE;
6784 }
6785 
6786 static PyObject *
wrap_delitem(PyObject * self,PyObject * args,void * wrapped)6787 wrap_delitem(PyObject *self, PyObject *args, void *wrapped)
6788 {
6789     objobjargproc func = (objobjargproc)wrapped;
6790     int res;
6791     PyObject *key;
6792 
6793     if (!check_num_args(args, 1))
6794         return NULL;
6795     key = PyTuple_GET_ITEM(args, 0);
6796     res = (*func)(self, key, NULL);
6797     if (res == -1 && PyErr_Occurred())
6798         return NULL;
6799     Py_RETURN_NONE;
6800 }
6801 
6802 /* Helper to check for object.__setattr__ or __delattr__ applied to a type.
6803    This is called the Carlo Verre hack after its discoverer.  See
6804    https://mail.python.org/pipermail/python-dev/2003-April/034535.html
6805    */
6806 static int
hackcheck(PyObject * self,setattrofunc func,const char * what)6807 hackcheck(PyObject *self, setattrofunc func, const char *what)
6808 {
6809     PyTypeObject *type = Py_TYPE(self);
6810     PyObject *mro = type->tp_mro;
6811     if (!mro) {
6812         /* Probably ok not to check the call in this case. */
6813         return 1;
6814     }
6815     assert(PyTuple_Check(mro));
6816 
6817     /* Find the (base) type that defined the type's slot function. */
6818     PyTypeObject *defining_type = type;
6819     Py_ssize_t i;
6820     for (i = PyTuple_GET_SIZE(mro) - 1; i >= 0; i--) {
6821         PyTypeObject *base = (PyTypeObject*) PyTuple_GET_ITEM(mro, i);
6822         if (base->tp_setattro == slot_tp_setattro) {
6823             /* Ignore Python classes:
6824                they never define their own C-level setattro. */
6825         }
6826         else if (base->tp_setattro == type->tp_setattro) {
6827             defining_type = base;
6828             break;
6829         }
6830     }
6831 
6832     /* Reject calls that jump over intermediate C-level overrides. */
6833     for (PyTypeObject *base = defining_type; base; base = base->tp_base) {
6834         if (base->tp_setattro == func) {
6835             /* 'func' is the right slot function to call. */
6836             break;
6837         }
6838         else if (base->tp_setattro != slot_tp_setattro) {
6839             /* 'base' is not a Python class and overrides 'func'.
6840                Its tp_setattro should be called instead. */
6841             PyErr_Format(PyExc_TypeError,
6842                          "can't apply this %s to %s object",
6843                          what,
6844                          type->tp_name);
6845             return 0;
6846         }
6847     }
6848     return 1;
6849 }
6850 
6851 static PyObject *
wrap_setattr(PyObject * self,PyObject * args,void * wrapped)6852 wrap_setattr(PyObject *self, PyObject *args, void *wrapped)
6853 {
6854     setattrofunc func = (setattrofunc)wrapped;
6855     int res;
6856     PyObject *name, *value;
6857 
6858     if (!PyArg_UnpackTuple(args, "", 2, 2, &name, &value))
6859         return NULL;
6860     if (!hackcheck(self, func, "__setattr__"))
6861         return NULL;
6862     res = (*func)(self, name, value);
6863     if (res < 0)
6864         return NULL;
6865     Py_RETURN_NONE;
6866 }
6867 
6868 static PyObject *
wrap_delattr(PyObject * self,PyObject * args,void * wrapped)6869 wrap_delattr(PyObject *self, PyObject *args, void *wrapped)
6870 {
6871     setattrofunc func = (setattrofunc)wrapped;
6872     int res;
6873     PyObject *name;
6874 
6875     if (!check_num_args(args, 1))
6876         return NULL;
6877     name = PyTuple_GET_ITEM(args, 0);
6878     if (!hackcheck(self, func, "__delattr__"))
6879         return NULL;
6880     res = (*func)(self, name, NULL);
6881     if (res < 0)
6882         return NULL;
6883     Py_RETURN_NONE;
6884 }
6885 
6886 static PyObject *
wrap_hashfunc(PyObject * self,PyObject * args,void * wrapped)6887 wrap_hashfunc(PyObject *self, PyObject *args, void *wrapped)
6888 {
6889     hashfunc func = (hashfunc)wrapped;
6890     Py_hash_t res;
6891 
6892     if (!check_num_args(args, 0))
6893         return NULL;
6894     res = (*func)(self);
6895     if (res == -1 && PyErr_Occurred())
6896         return NULL;
6897     return PyLong_FromSsize_t(res);
6898 }
6899 
6900 static PyObject *
wrap_call(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)6901 wrap_call(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
6902 {
6903     ternaryfunc func = (ternaryfunc)wrapped;
6904 
6905     return (*func)(self, args, kwds);
6906 }
6907 
6908 static PyObject *
wrap_del(PyObject * self,PyObject * args,void * wrapped)6909 wrap_del(PyObject *self, PyObject *args, void *wrapped)
6910 {
6911     destructor func = (destructor)wrapped;
6912 
6913     if (!check_num_args(args, 0))
6914         return NULL;
6915 
6916     (*func)(self);
6917     Py_RETURN_NONE;
6918 }
6919 
6920 static PyObject *
wrap_richcmpfunc(PyObject * self,PyObject * args,void * wrapped,int op)6921 wrap_richcmpfunc(PyObject *self, PyObject *args, void *wrapped, int op)
6922 {
6923     richcmpfunc func = (richcmpfunc)wrapped;
6924     PyObject *other;
6925 
6926     if (!check_num_args(args, 1))
6927         return NULL;
6928     other = PyTuple_GET_ITEM(args, 0);
6929     return (*func)(self, other, op);
6930 }
6931 
6932 #undef RICHCMP_WRAPPER
6933 #define RICHCMP_WRAPPER(NAME, OP) \
6934 static PyObject * \
6935 richcmp_##NAME(PyObject *self, PyObject *args, void *wrapped) \
6936 { \
6937     return wrap_richcmpfunc(self, args, wrapped, OP); \
6938 }
6939 
RICHCMP_WRAPPER(lt,Py_LT)6940 RICHCMP_WRAPPER(lt, Py_LT)
6941 RICHCMP_WRAPPER(le, Py_LE)
6942 RICHCMP_WRAPPER(eq, Py_EQ)
6943 RICHCMP_WRAPPER(ne, Py_NE)
6944 RICHCMP_WRAPPER(gt, Py_GT)
6945 RICHCMP_WRAPPER(ge, Py_GE)
6946 
6947 static PyObject *
6948 wrap_next(PyObject *self, PyObject *args, void *wrapped)
6949 {
6950     unaryfunc func = (unaryfunc)wrapped;
6951     PyObject *res;
6952 
6953     if (!check_num_args(args, 0))
6954         return NULL;
6955     res = (*func)(self);
6956     if (res == NULL && !PyErr_Occurred())
6957         PyErr_SetNone(PyExc_StopIteration);
6958     return res;
6959 }
6960 
6961 static PyObject *
wrap_descr_get(PyObject * self,PyObject * args,void * wrapped)6962 wrap_descr_get(PyObject *self, PyObject *args, void *wrapped)
6963 {
6964     descrgetfunc func = (descrgetfunc)wrapped;
6965     PyObject *obj;
6966     PyObject *type = NULL;
6967 
6968     if (!PyArg_UnpackTuple(args, "", 1, 2, &obj, &type))
6969         return NULL;
6970     if (obj == Py_None)
6971         obj = NULL;
6972     if (type == Py_None)
6973         type = NULL;
6974     if (type == NULL &&obj == NULL) {
6975         PyErr_SetString(PyExc_TypeError,
6976                         "__get__(None, None) is invalid");
6977         return NULL;
6978     }
6979     return (*func)(self, obj, type);
6980 }
6981 
6982 static PyObject *
wrap_descr_set(PyObject * self,PyObject * args,void * wrapped)6983 wrap_descr_set(PyObject *self, PyObject *args, void *wrapped)
6984 {
6985     descrsetfunc func = (descrsetfunc)wrapped;
6986     PyObject *obj, *value;
6987     int ret;
6988 
6989     if (!PyArg_UnpackTuple(args, "", 2, 2, &obj, &value))
6990         return NULL;
6991     ret = (*func)(self, obj, value);
6992     if (ret < 0)
6993         return NULL;
6994     Py_RETURN_NONE;
6995 }
6996 
6997 static PyObject *
wrap_descr_delete(PyObject * self,PyObject * args,void * wrapped)6998 wrap_descr_delete(PyObject *self, PyObject *args, void *wrapped)
6999 {
7000     descrsetfunc func = (descrsetfunc)wrapped;
7001     PyObject *obj;
7002     int ret;
7003 
7004     if (!check_num_args(args, 1))
7005         return NULL;
7006     obj = PyTuple_GET_ITEM(args, 0);
7007     ret = (*func)(self, obj, NULL);
7008     if (ret < 0)
7009         return NULL;
7010     Py_RETURN_NONE;
7011 }
7012 
7013 static PyObject *
wrap_init(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)7014 wrap_init(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
7015 {
7016     initproc func = (initproc)wrapped;
7017 
7018     if (func(self, args, kwds) < 0)
7019         return NULL;
7020     Py_RETURN_NONE;
7021 }
7022 
7023 static PyObject *
tp_new_wrapper(PyObject * self,PyObject * args,PyObject * kwds)7024 tp_new_wrapper(PyObject *self, PyObject *args, PyObject *kwds)
7025 {
7026     PyTypeObject *type, *subtype, *staticbase;
7027     PyObject *arg0, *res;
7028 
7029     if (self == NULL || !PyType_Check(self)) {
7030         PyErr_Format(PyExc_SystemError,
7031                      "__new__() called with non-type 'self'");
7032         return NULL;
7033     }
7034     type = (PyTypeObject *)self;
7035 
7036     if (!PyTuple_Check(args) || PyTuple_GET_SIZE(args) < 1) {
7037         PyErr_Format(PyExc_TypeError,
7038                      "%s.__new__(): not enough arguments",
7039                      type->tp_name);
7040         return NULL;
7041     }
7042     arg0 = PyTuple_GET_ITEM(args, 0);
7043     if (!PyType_Check(arg0)) {
7044         PyErr_Format(PyExc_TypeError,
7045                      "%s.__new__(X): X is not a type object (%s)",
7046                      type->tp_name,
7047                      Py_TYPE(arg0)->tp_name);
7048         return NULL;
7049     }
7050     subtype = (PyTypeObject *)arg0;
7051     if (!PyType_IsSubtype(subtype, type)) {
7052         PyErr_Format(PyExc_TypeError,
7053                      "%s.__new__(%s): %s is not a subtype of %s",
7054                      type->tp_name,
7055                      subtype->tp_name,
7056                      subtype->tp_name,
7057                      type->tp_name);
7058         return NULL;
7059     }
7060 
7061     /* Check that the use doesn't do something silly and unsafe like
7062        object.__new__(dict).  To do this, we check that the
7063        most derived base that's not a heap type is this type. */
7064     staticbase = subtype;
7065     while (staticbase && (staticbase->tp_new == slot_tp_new))
7066         staticbase = staticbase->tp_base;
7067     /* If staticbase is NULL now, it is a really weird type.
7068        In the spirit of backwards compatibility (?), just shut up. */
7069     if (staticbase && staticbase->tp_new != type->tp_new) {
7070         PyErr_Format(PyExc_TypeError,
7071                      "%s.__new__(%s) is not safe, use %s.__new__()",
7072                      type->tp_name,
7073                      subtype->tp_name,
7074                      staticbase->tp_name);
7075         return NULL;
7076     }
7077 
7078     args = PyTuple_GetSlice(args, 1, PyTuple_GET_SIZE(args));
7079     if (args == NULL)
7080         return NULL;
7081     res = type->tp_new(subtype, args, kwds);
7082     Py_DECREF(args);
7083     return res;
7084 }
7085 
7086 static struct PyMethodDef tp_new_methoddef[] = {
7087     {"__new__", (PyCFunction)(void(*)(void))tp_new_wrapper, METH_VARARGS|METH_KEYWORDS,
7088      PyDoc_STR("__new__($type, *args, **kwargs)\n--\n\n"
7089                "Create and return a new object.  "
7090                "See help(type) for accurate signature.")},
7091     {0}
7092 };
7093 
7094 static int
add_tp_new_wrapper(PyTypeObject * type)7095 add_tp_new_wrapper(PyTypeObject *type)
7096 {
7097     int r = _PyDict_ContainsId(type->tp_dict, &PyId___new__);
7098     if (r > 0) {
7099         return 0;
7100     }
7101     if (r < 0) {
7102         return -1;
7103     }
7104 
7105     PyObject *func = PyCFunction_NewEx(tp_new_methoddef, (PyObject *)type, NULL);
7106     if (func == NULL) {
7107         return -1;
7108     }
7109     r = _PyDict_SetItemId(type->tp_dict, &PyId___new__, func);
7110     Py_DECREF(func);
7111     return r;
7112 }
7113 
7114 /* Slot wrappers that call the corresponding __foo__ slot.  See comments
7115    below at override_slots() for more explanation. */
7116 
7117 #define SLOT0(FUNCNAME, OPSTR) \
7118 static PyObject * \
7119 FUNCNAME(PyObject *self) \
7120 { \
7121     PyObject* stack[1] = {self}; \
7122     _Py_static_string(id, OPSTR); \
7123     return vectorcall_method(&id, stack, 1); \
7124 }
7125 
7126 #define SLOT1(FUNCNAME, OPSTR, ARG1TYPE) \
7127 static PyObject * \
7128 FUNCNAME(PyObject *self, ARG1TYPE arg1) \
7129 { \
7130     PyObject* stack[2] = {self, arg1}; \
7131     _Py_static_string(id, OPSTR); \
7132     return vectorcall_method(&id, stack, 2); \
7133 }
7134 
7135 /* Boolean helper for SLOT1BINFULL().
7136    right.__class__ is a nontrivial subclass of left.__class__. */
7137 static int
method_is_overloaded(PyObject * left,PyObject * right,struct _Py_Identifier * name)7138 method_is_overloaded(PyObject *left, PyObject *right, struct _Py_Identifier *name)
7139 {
7140     PyObject *a, *b;
7141     int ok;
7142 
7143     if (_PyObject_LookupAttrId((PyObject *)(Py_TYPE(right)), name, &b) < 0) {
7144         return -1;
7145     }
7146     if (b == NULL) {
7147         /* If right doesn't have it, it's not overloaded */
7148         return 0;
7149     }
7150 
7151     if (_PyObject_LookupAttrId((PyObject *)(Py_TYPE(left)), name, &a) < 0) {
7152         Py_DECREF(b);
7153         return -1;
7154     }
7155     if (a == NULL) {
7156         Py_DECREF(b);
7157         /* If right has it but left doesn't, it's overloaded */
7158         return 1;
7159     }
7160 
7161     ok = PyObject_RichCompareBool(a, b, Py_NE);
7162     Py_DECREF(a);
7163     Py_DECREF(b);
7164     return ok;
7165 }
7166 
7167 
7168 #define SLOT1BINFULL(FUNCNAME, TESTFUNC, SLOTNAME, OPSTR, ROPSTR) \
7169 static PyObject * \
7170 FUNCNAME(PyObject *self, PyObject *other) \
7171 { \
7172     PyObject* stack[2]; \
7173     PyThreadState *tstate = _PyThreadState_GET(); \
7174     _Py_static_string(op_id, OPSTR); \
7175     _Py_static_string(rop_id, ROPSTR); \
7176     int do_other = !Py_IS_TYPE(self, Py_TYPE(other)) && \
7177         Py_TYPE(other)->tp_as_number != NULL && \
7178         Py_TYPE(other)->tp_as_number->SLOTNAME == TESTFUNC; \
7179     if (Py_TYPE(self)->tp_as_number != NULL && \
7180         Py_TYPE(self)->tp_as_number->SLOTNAME == TESTFUNC) { \
7181         PyObject *r; \
7182         if (do_other && PyType_IsSubtype(Py_TYPE(other), Py_TYPE(self))) { \
7183             int ok = method_is_overloaded(self, other, &rop_id); \
7184             if (ok < 0) { \
7185                 return NULL; \
7186             } \
7187             if (ok) { \
7188                 stack[0] = other; \
7189                 stack[1] = self; \
7190                 r = vectorcall_maybe(tstate, &rop_id, stack, 2); \
7191                 if (r != Py_NotImplemented) \
7192                     return r; \
7193                 Py_DECREF(r); \
7194                 do_other = 0; \
7195             } \
7196         } \
7197         stack[0] = self; \
7198         stack[1] = other; \
7199         r = vectorcall_maybe(tstate, &op_id, stack, 2); \
7200         if (r != Py_NotImplemented || \
7201             Py_IS_TYPE(other, Py_TYPE(self))) \
7202             return r; \
7203         Py_DECREF(r); \
7204     } \
7205     if (do_other) { \
7206         stack[0] = other; \
7207         stack[1] = self; \
7208         return vectorcall_maybe(tstate, &rop_id, stack, 2); \
7209     } \
7210     Py_RETURN_NOTIMPLEMENTED; \
7211 }
7212 
7213 #define SLOT1BIN(FUNCNAME, SLOTNAME, OPSTR, ROPSTR) \
7214     SLOT1BINFULL(FUNCNAME, FUNCNAME, SLOTNAME, OPSTR, ROPSTR)
7215 
7216 static Py_ssize_t
slot_sq_length(PyObject * self)7217 slot_sq_length(PyObject *self)
7218 {
7219     PyObject* stack[1] = {self};
7220     PyObject *res = vectorcall_method(&PyId___len__, stack, 1);
7221     Py_ssize_t len;
7222 
7223     if (res == NULL)
7224         return -1;
7225 
7226     Py_SETREF(res, _PyNumber_Index(res));
7227     if (res == NULL)
7228         return -1;
7229 
7230     assert(PyLong_Check(res));
7231     if (Py_SIZE(res) < 0) {
7232         Py_DECREF(res);
7233         PyErr_SetString(PyExc_ValueError,
7234                         "__len__() should return >= 0");
7235         return -1;
7236     }
7237 
7238     len = PyNumber_AsSsize_t(res, PyExc_OverflowError);
7239     assert(len >= 0 || PyErr_ExceptionMatches(PyExc_OverflowError));
7240     Py_DECREF(res);
7241     return len;
7242 }
7243 
7244 static PyObject *
slot_sq_item(PyObject * self,Py_ssize_t i)7245 slot_sq_item(PyObject *self, Py_ssize_t i)
7246 {
7247     PyObject *ival = PyLong_FromSsize_t(i);
7248     if (ival == NULL) {
7249         return NULL;
7250     }
7251     PyObject *stack[2] = {self, ival};
7252     PyObject *retval = vectorcall_method(&PyId___getitem__, stack, 2);
7253     Py_DECREF(ival);
7254     return retval;
7255 }
7256 
7257 static int
slot_sq_ass_item(PyObject * self,Py_ssize_t index,PyObject * value)7258 slot_sq_ass_item(PyObject *self, Py_ssize_t index, PyObject *value)
7259 {
7260     PyObject *stack[3];
7261     PyObject *res;
7262     PyObject *index_obj;
7263 
7264     index_obj = PyLong_FromSsize_t(index);
7265     if (index_obj == NULL) {
7266         return -1;
7267     }
7268 
7269     stack[0] = self;
7270     stack[1] = index_obj;
7271     if (value == NULL) {
7272         res = vectorcall_method(&PyId___delitem__, stack, 2);
7273     }
7274     else {
7275         stack[2] = value;
7276         res = vectorcall_method(&PyId___setitem__, stack, 3);
7277     }
7278     Py_DECREF(index_obj);
7279 
7280     if (res == NULL) {
7281         return -1;
7282     }
7283     Py_DECREF(res);
7284     return 0;
7285 }
7286 
7287 static int
slot_sq_contains(PyObject * self,PyObject * value)7288 slot_sq_contains(PyObject *self, PyObject *value)
7289 {
7290     PyThreadState *tstate = _PyThreadState_GET();
7291     PyObject *func, *res;
7292     int result = -1, unbound;
7293     _Py_IDENTIFIER(__contains__);
7294 
7295     func = lookup_maybe_method(self, &PyId___contains__, &unbound);
7296     if (func == Py_None) {
7297         Py_DECREF(func);
7298         PyErr_Format(PyExc_TypeError,
7299                      "'%.200s' object is not a container",
7300                      Py_TYPE(self)->tp_name);
7301         return -1;
7302     }
7303     if (func != NULL) {
7304         PyObject *args[2] = {self, value};
7305         res = vectorcall_unbound(tstate, unbound, func, args, 2);
7306         Py_DECREF(func);
7307         if (res != NULL) {
7308             result = PyObject_IsTrue(res);
7309             Py_DECREF(res);
7310         }
7311     }
7312     else if (! PyErr_Occurred()) {
7313         /* Possible results: -1 and 1 */
7314         result = (int)_PySequence_IterSearch(self, value,
7315                                          PY_ITERSEARCH_CONTAINS);
7316     }
7317     return result;
7318 }
7319 
7320 #define slot_mp_length slot_sq_length
7321 
7322 SLOT1(slot_mp_subscript, "__getitem__", PyObject *)
7323 
7324 static int
slot_mp_ass_subscript(PyObject * self,PyObject * key,PyObject * value)7325 slot_mp_ass_subscript(PyObject *self, PyObject *key, PyObject *value)
7326 {
7327     PyObject *stack[3];
7328     PyObject *res;
7329 
7330     stack[0] = self;
7331     stack[1] = key;
7332     if (value == NULL) {
7333         res = vectorcall_method(&PyId___delitem__, stack, 2);
7334     }
7335     else {
7336         stack[2] = value;
7337         res = vectorcall_method(&PyId___setitem__, stack, 3);
7338     }
7339 
7340     if (res == NULL)
7341         return -1;
7342     Py_DECREF(res);
7343     return 0;
7344 }
7345 
7346 SLOT1BIN(slot_nb_add, nb_add, "__add__", "__radd__")
7347 SLOT1BIN(slot_nb_subtract, nb_subtract, "__sub__", "__rsub__")
7348 SLOT1BIN(slot_nb_multiply, nb_multiply, "__mul__", "__rmul__")
7349 SLOT1BIN(slot_nb_matrix_multiply, nb_matrix_multiply, "__matmul__", "__rmatmul__")
7350 SLOT1BIN(slot_nb_remainder, nb_remainder, "__mod__", "__rmod__")
7351 SLOT1BIN(slot_nb_divmod, nb_divmod, "__divmod__", "__rdivmod__")
7352 
7353 static PyObject *slot_nb_power(PyObject *, PyObject *, PyObject *);
7354 
7355 SLOT1BINFULL(slot_nb_power_binary, slot_nb_power,
7356              nb_power, "__pow__", "__rpow__")
7357 
7358 static PyObject *
slot_nb_power(PyObject * self,PyObject * other,PyObject * modulus)7359 slot_nb_power(PyObject *self, PyObject *other, PyObject *modulus)
7360 {
7361     _Py_IDENTIFIER(__pow__);
7362 
7363     if (modulus == Py_None)
7364         return slot_nb_power_binary(self, other);
7365     /* Three-arg power doesn't use __rpow__.  But ternary_op
7366        can call this when the second argument's type uses
7367        slot_nb_power, so check before calling self.__pow__. */
7368     if (Py_TYPE(self)->tp_as_number != NULL &&
7369         Py_TYPE(self)->tp_as_number->nb_power == slot_nb_power) {
7370         PyObject* stack[3] = {self, other, modulus};
7371         return vectorcall_method(&PyId___pow__, stack, 3);
7372     }
7373     Py_RETURN_NOTIMPLEMENTED;
7374 }
7375 
7376 SLOT0(slot_nb_negative, "__neg__")
7377 SLOT0(slot_nb_positive, "__pos__")
7378 SLOT0(slot_nb_absolute, "__abs__")
7379 
7380 static int
slot_nb_bool(PyObject * self)7381 slot_nb_bool(PyObject *self)
7382 {
7383     PyObject *func, *value;
7384     int result, unbound;
7385     int using_len = 0;
7386     _Py_IDENTIFIER(__bool__);
7387 
7388     func = lookup_maybe_method(self, &PyId___bool__, &unbound);
7389     if (func == NULL) {
7390         if (PyErr_Occurred()) {
7391             return -1;
7392         }
7393 
7394         func = lookup_maybe_method(self, &PyId___len__, &unbound);
7395         if (func == NULL) {
7396             if (PyErr_Occurred()) {
7397                 return -1;
7398             }
7399             return 1;
7400         }
7401         using_len = 1;
7402     }
7403 
7404     value = call_unbound_noarg(unbound, func, self);
7405     if (value == NULL) {
7406         goto error;
7407     }
7408 
7409     if (using_len) {
7410         /* bool type enforced by slot_nb_len */
7411         result = PyObject_IsTrue(value);
7412     }
7413     else if (PyBool_Check(value)) {
7414         result = PyObject_IsTrue(value);
7415     }
7416     else {
7417         PyErr_Format(PyExc_TypeError,
7418                      "__bool__ should return "
7419                      "bool, returned %s",
7420                      Py_TYPE(value)->tp_name);
7421         result = -1;
7422     }
7423 
7424     Py_DECREF(value);
7425     Py_DECREF(func);
7426     return result;
7427 
7428 error:
7429     Py_DECREF(func);
7430     return -1;
7431 }
7432 
7433 
7434 static PyObject *
slot_nb_index(PyObject * self)7435 slot_nb_index(PyObject *self)
7436 {
7437     _Py_IDENTIFIER(__index__);
7438     PyObject *stack[1] = {self};
7439     return vectorcall_method(&PyId___index__, stack, 1);
7440 }
7441 
7442 
7443 SLOT0(slot_nb_invert, "__invert__")
7444 SLOT1BIN(slot_nb_lshift, nb_lshift, "__lshift__", "__rlshift__")
7445 SLOT1BIN(slot_nb_rshift, nb_rshift, "__rshift__", "__rrshift__")
7446 SLOT1BIN(slot_nb_and, nb_and, "__and__", "__rand__")
7447 SLOT1BIN(slot_nb_xor, nb_xor, "__xor__", "__rxor__")
7448 SLOT1BIN(slot_nb_or, nb_or, "__or__", "__ror__")
7449 
7450 SLOT0(slot_nb_int, "__int__")
7451 SLOT0(slot_nb_float, "__float__")
7452 SLOT1(slot_nb_inplace_add, "__iadd__", PyObject *)
7453 SLOT1(slot_nb_inplace_subtract, "__isub__", PyObject *)
7454 SLOT1(slot_nb_inplace_multiply, "__imul__", PyObject *)
7455 SLOT1(slot_nb_inplace_matrix_multiply, "__imatmul__", PyObject *)
7456 SLOT1(slot_nb_inplace_remainder, "__imod__", PyObject *)
7457 /* Can't use SLOT1 here, because nb_inplace_power is ternary */
7458 static PyObject *
slot_nb_inplace_power(PyObject * self,PyObject * arg1,PyObject * arg2)7459 slot_nb_inplace_power(PyObject *self, PyObject * arg1, PyObject *arg2)
7460 {
7461     PyObject *stack[2] = {self, arg1};
7462     _Py_IDENTIFIER(__ipow__);
7463     return vectorcall_method(&PyId___ipow__, stack, 2);
7464 }
7465 SLOT1(slot_nb_inplace_lshift, "__ilshift__", PyObject *)
7466 SLOT1(slot_nb_inplace_rshift, "__irshift__", PyObject *)
7467 SLOT1(slot_nb_inplace_and, "__iand__", PyObject *)
7468 SLOT1(slot_nb_inplace_xor, "__ixor__", PyObject *)
7469 SLOT1(slot_nb_inplace_or, "__ior__", PyObject *)
7470 SLOT1BIN(slot_nb_floor_divide, nb_floor_divide,
7471          "__floordiv__", "__rfloordiv__")
7472 SLOT1BIN(slot_nb_true_divide, nb_true_divide, "__truediv__", "__rtruediv__")
7473 SLOT1(slot_nb_inplace_floor_divide, "__ifloordiv__", PyObject *)
7474 SLOT1(slot_nb_inplace_true_divide, "__itruediv__", PyObject *)
7475 
7476 static PyObject *
slot_tp_repr(PyObject * self)7477 slot_tp_repr(PyObject *self)
7478 {
7479     PyObject *func, *res;
7480     _Py_IDENTIFIER(__repr__);
7481     int unbound;
7482 
7483     func = lookup_maybe_method(self, &PyId___repr__, &unbound);
7484     if (func != NULL) {
7485         res = call_unbound_noarg(unbound, func, self);
7486         Py_DECREF(func);
7487         return res;
7488     }
7489     PyErr_Clear();
7490     return PyUnicode_FromFormat("<%s object at %p>",
7491                                Py_TYPE(self)->tp_name, self);
7492 }
7493 
7494 SLOT0(slot_tp_str, "__str__")
7495 
7496 static Py_hash_t
slot_tp_hash(PyObject * self)7497 slot_tp_hash(PyObject *self)
7498 {
7499     PyObject *func, *res;
7500     Py_ssize_t h;
7501     int unbound;
7502 
7503     func = lookup_maybe_method(self, &PyId___hash__, &unbound);
7504 
7505     if (func == Py_None) {
7506         Py_DECREF(func);
7507         func = NULL;
7508     }
7509 
7510     if (func == NULL) {
7511         return PyObject_HashNotImplemented(self);
7512     }
7513 
7514     res = call_unbound_noarg(unbound, func, self);
7515     Py_DECREF(func);
7516     if (res == NULL)
7517         return -1;
7518 
7519     if (!PyLong_Check(res)) {
7520         PyErr_SetString(PyExc_TypeError,
7521                         "__hash__ method should return an integer");
7522         return -1;
7523     }
7524     /* Transform the PyLong `res` to a Py_hash_t `h`.  For an existing
7525        hashable Python object x, hash(x) will always lie within the range of
7526        Py_hash_t.  Therefore our transformation must preserve values that
7527        already lie within this range, to ensure that if x.__hash__() returns
7528        hash(y) then hash(x) == hash(y). */
7529     h = PyLong_AsSsize_t(res);
7530     if (h == -1 && PyErr_Occurred()) {
7531         /* res was not within the range of a Py_hash_t, so we're free to
7532            use any sufficiently bit-mixing transformation;
7533            long.__hash__ will do nicely. */
7534         PyErr_Clear();
7535         h = PyLong_Type.tp_hash(res);
7536     }
7537     /* -1 is reserved for errors. */
7538     if (h == -1)
7539         h = -2;
7540     Py_DECREF(res);
7541     return h;
7542 }
7543 
7544 static PyObject *
slot_tp_call(PyObject * self,PyObject * args,PyObject * kwds)7545 slot_tp_call(PyObject *self, PyObject *args, PyObject *kwds)
7546 {
7547     PyThreadState *tstate = _PyThreadState_GET();
7548     _Py_IDENTIFIER(__call__);
7549     int unbound;
7550 
7551     PyObject *meth = lookup_method(self, &PyId___call__, &unbound);
7552     if (meth == NULL) {
7553         return NULL;
7554     }
7555 
7556     PyObject *res;
7557     if (unbound) {
7558         res = _PyObject_Call_Prepend(tstate, meth, self, args, kwds);
7559     }
7560     else {
7561         res = _PyObject_Call(tstate, meth, args, kwds);
7562     }
7563 
7564     Py_DECREF(meth);
7565     return res;
7566 }
7567 
7568 /* There are two slot dispatch functions for tp_getattro.
7569 
7570    - slot_tp_getattro() is used when __getattribute__ is overridden
7571      but no __getattr__ hook is present;
7572 
7573    - slot_tp_getattr_hook() is used when a __getattr__ hook is present.
7574 
7575    The code in update_one_slot() always installs slot_tp_getattr_hook(); this
7576    detects the absence of __getattr__ and then installs the simpler slot if
7577    necessary. */
7578 
7579 static PyObject *
slot_tp_getattro(PyObject * self,PyObject * name)7580 slot_tp_getattro(PyObject *self, PyObject *name)
7581 {
7582     PyObject *stack[2] = {self, name};
7583     return vectorcall_method(&PyId___getattribute__, stack, 2);
7584 }
7585 
7586 static PyObject *
call_attribute(PyObject * self,PyObject * attr,PyObject * name)7587 call_attribute(PyObject *self, PyObject *attr, PyObject *name)
7588 {
7589     PyObject *res, *descr = NULL;
7590     descrgetfunc f = Py_TYPE(attr)->tp_descr_get;
7591 
7592     if (f != NULL) {
7593         descr = f(attr, self, (PyObject *)(Py_TYPE(self)));
7594         if (descr == NULL)
7595             return NULL;
7596         else
7597             attr = descr;
7598     }
7599     res = PyObject_CallOneArg(attr, name);
7600     Py_XDECREF(descr);
7601     return res;
7602 }
7603 
7604 static PyObject *
slot_tp_getattr_hook(PyObject * self,PyObject * name)7605 slot_tp_getattr_hook(PyObject *self, PyObject *name)
7606 {
7607     PyTypeObject *tp = Py_TYPE(self);
7608     PyObject *getattr, *getattribute, *res;
7609     _Py_IDENTIFIER(__getattr__);
7610 
7611     /* speed hack: we could use lookup_maybe, but that would resolve the
7612        method fully for each attribute lookup for classes with
7613        __getattr__, even when the attribute is present. So we use
7614        _PyType_Lookup and create the method only when needed, with
7615        call_attribute. */
7616     getattr = _PyType_LookupId(tp, &PyId___getattr__);
7617     if (getattr == NULL) {
7618         /* No __getattr__ hook: use a simpler dispatcher */
7619         tp->tp_getattro = slot_tp_getattro;
7620         return slot_tp_getattro(self, name);
7621     }
7622     Py_INCREF(getattr);
7623     /* speed hack: we could use lookup_maybe, but that would resolve the
7624        method fully for each attribute lookup for classes with
7625        __getattr__, even when self has the default __getattribute__
7626        method. So we use _PyType_Lookup and create the method only when
7627        needed, with call_attribute. */
7628     getattribute = _PyType_LookupId(tp, &PyId___getattribute__);
7629     if (getattribute == NULL ||
7630         (Py_IS_TYPE(getattribute, &PyWrapperDescr_Type) &&
7631          ((PyWrapperDescrObject *)getattribute)->d_wrapped ==
7632          (void *)PyObject_GenericGetAttr))
7633         res = PyObject_GenericGetAttr(self, name);
7634     else {
7635         Py_INCREF(getattribute);
7636         res = call_attribute(self, getattribute, name);
7637         Py_DECREF(getattribute);
7638     }
7639     if (res == NULL && PyErr_ExceptionMatches(PyExc_AttributeError)) {
7640         PyErr_Clear();
7641         res = call_attribute(self, getattr, name);
7642     }
7643     Py_DECREF(getattr);
7644     return res;
7645 }
7646 
7647 static int
slot_tp_setattro(PyObject * self,PyObject * name,PyObject * value)7648 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value)
7649 {
7650     PyObject *stack[3];
7651     PyObject *res;
7652     _Py_IDENTIFIER(__delattr__);
7653     _Py_IDENTIFIER(__setattr__);
7654 
7655     stack[0] = self;
7656     stack[1] = name;
7657     if (value == NULL) {
7658         res = vectorcall_method(&PyId___delattr__, stack, 2);
7659     }
7660     else {
7661         stack[2] = value;
7662         res = vectorcall_method(&PyId___setattr__, stack, 3);
7663     }
7664     if (res == NULL)
7665         return -1;
7666     Py_DECREF(res);
7667     return 0;
7668 }
7669 
7670 static _Py_Identifier name_op[] = {
7671     _Py_static_string_init("__lt__"),
7672     _Py_static_string_init("__le__"),
7673     _Py_static_string_init("__eq__"),
7674     _Py_static_string_init("__ne__"),
7675     _Py_static_string_init("__gt__"),
7676     _Py_static_string_init("__ge__"),
7677 };
7678 
7679 static PyObject *
slot_tp_richcompare(PyObject * self,PyObject * other,int op)7680 slot_tp_richcompare(PyObject *self, PyObject *other, int op)
7681 {
7682     PyThreadState *tstate = _PyThreadState_GET();
7683 
7684     int unbound;
7685     PyObject *func = lookup_maybe_method(self, &name_op[op], &unbound);
7686     if (func == NULL) {
7687         PyErr_Clear();
7688         Py_RETURN_NOTIMPLEMENTED;
7689     }
7690 
7691     PyObject *stack[2] = {self, other};
7692     PyObject *res = vectorcall_unbound(tstate, unbound, func, stack, 2);
7693     Py_DECREF(func);
7694     return res;
7695 }
7696 
7697 static PyObject *
slot_tp_iter(PyObject * self)7698 slot_tp_iter(PyObject *self)
7699 {
7700     int unbound;
7701     PyObject *func, *res;
7702     _Py_IDENTIFIER(__iter__);
7703 
7704     func = lookup_maybe_method(self, &PyId___iter__, &unbound);
7705     if (func == Py_None) {
7706         Py_DECREF(func);
7707         PyErr_Format(PyExc_TypeError,
7708                      "'%.200s' object is not iterable",
7709                      Py_TYPE(self)->tp_name);
7710         return NULL;
7711     }
7712 
7713     if (func != NULL) {
7714         res = call_unbound_noarg(unbound, func, self);
7715         Py_DECREF(func);
7716         return res;
7717     }
7718 
7719     PyErr_Clear();
7720     func = lookup_maybe_method(self, &PyId___getitem__, &unbound);
7721     if (func == NULL) {
7722         PyErr_Format(PyExc_TypeError,
7723                      "'%.200s' object is not iterable",
7724                      Py_TYPE(self)->tp_name);
7725         return NULL;
7726     }
7727     Py_DECREF(func);
7728     return PySeqIter_New(self);
7729 }
7730 
7731 static PyObject *
slot_tp_iternext(PyObject * self)7732 slot_tp_iternext(PyObject *self)
7733 {
7734     _Py_IDENTIFIER(__next__);
7735     PyObject *stack[1] = {self};
7736     return vectorcall_method(&PyId___next__, stack, 1);
7737 }
7738 
7739 static PyObject *
slot_tp_descr_get(PyObject * self,PyObject * obj,PyObject * type)7740 slot_tp_descr_get(PyObject *self, PyObject *obj, PyObject *type)
7741 {
7742     PyTypeObject *tp = Py_TYPE(self);
7743     PyObject *get;
7744     _Py_IDENTIFIER(__get__);
7745 
7746     get = _PyType_LookupId(tp, &PyId___get__);
7747     if (get == NULL) {
7748         /* Avoid further slowdowns */
7749         if (tp->tp_descr_get == slot_tp_descr_get)
7750             tp->tp_descr_get = NULL;
7751         Py_INCREF(self);
7752         return self;
7753     }
7754     if (obj == NULL)
7755         obj = Py_None;
7756     if (type == NULL)
7757         type = Py_None;
7758     return PyObject_CallFunctionObjArgs(get, self, obj, type, NULL);
7759 }
7760 
7761 static int
slot_tp_descr_set(PyObject * self,PyObject * target,PyObject * value)7762 slot_tp_descr_set(PyObject *self, PyObject *target, PyObject *value)
7763 {
7764     PyObject* stack[3];
7765     PyObject *res;
7766     _Py_IDENTIFIER(__delete__);
7767     _Py_IDENTIFIER(__set__);
7768 
7769     stack[0] = self;
7770     stack[1] = target;
7771     if (value == NULL) {
7772         res = vectorcall_method(&PyId___delete__, stack, 2);
7773     }
7774     else {
7775         stack[2] = value;
7776         res = vectorcall_method(&PyId___set__, stack, 3);
7777     }
7778     if (res == NULL)
7779         return -1;
7780     Py_DECREF(res);
7781     return 0;
7782 }
7783 
7784 static int
slot_tp_init(PyObject * self,PyObject * args,PyObject * kwds)7785 slot_tp_init(PyObject *self, PyObject *args, PyObject *kwds)
7786 {
7787     PyThreadState *tstate = _PyThreadState_GET();
7788 
7789     _Py_IDENTIFIER(__init__);
7790     int unbound;
7791     PyObject *meth = lookup_method(self, &PyId___init__, &unbound);
7792     if (meth == NULL) {
7793         return -1;
7794     }
7795 
7796     PyObject *res;
7797     if (unbound) {
7798         res = _PyObject_Call_Prepend(tstate, meth, self, args, kwds);
7799     }
7800     else {
7801         res = _PyObject_Call(tstate, meth, args, kwds);
7802     }
7803     Py_DECREF(meth);
7804     if (res == NULL)
7805         return -1;
7806     if (res != Py_None) {
7807         PyErr_Format(PyExc_TypeError,
7808                      "__init__() should return None, not '%.200s'",
7809                      Py_TYPE(res)->tp_name);
7810         Py_DECREF(res);
7811         return -1;
7812     }
7813     Py_DECREF(res);
7814     return 0;
7815 }
7816 
7817 static PyObject *
slot_tp_new(PyTypeObject * type,PyObject * args,PyObject * kwds)7818 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
7819 {
7820     PyThreadState *tstate = _PyThreadState_GET();
7821     PyObject *func, *result;
7822 
7823     func = _PyObject_GetAttrId((PyObject *)type, &PyId___new__);
7824     if (func == NULL) {
7825         return NULL;
7826     }
7827 
7828     result = _PyObject_Call_Prepend(tstate, func, (PyObject *)type, args, kwds);
7829     Py_DECREF(func);
7830     return result;
7831 }
7832 
7833 static void
slot_tp_finalize(PyObject * self)7834 slot_tp_finalize(PyObject *self)
7835 {
7836     _Py_IDENTIFIER(__del__);
7837     int unbound;
7838     PyObject *del, *res;
7839     PyObject *error_type, *error_value, *error_traceback;
7840 
7841     /* Save the current exception, if any. */
7842     PyErr_Fetch(&error_type, &error_value, &error_traceback);
7843 
7844     /* Execute __del__ method, if any. */
7845     del = lookup_maybe_method(self, &PyId___del__, &unbound);
7846     if (del != NULL) {
7847         res = call_unbound_noarg(unbound, del, self);
7848         if (res == NULL)
7849             PyErr_WriteUnraisable(del);
7850         else
7851             Py_DECREF(res);
7852         Py_DECREF(del);
7853     }
7854 
7855     /* Restore the saved exception. */
7856     PyErr_Restore(error_type, error_value, error_traceback);
7857 }
7858 
7859 static PyObject *
slot_am_await(PyObject * self)7860 slot_am_await(PyObject *self)
7861 {
7862     int unbound;
7863     PyObject *func, *res;
7864     _Py_IDENTIFIER(__await__);
7865 
7866     func = lookup_maybe_method(self, &PyId___await__, &unbound);
7867     if (func != NULL) {
7868         res = call_unbound_noarg(unbound, func, self);
7869         Py_DECREF(func);
7870         return res;
7871     }
7872     PyErr_Format(PyExc_AttributeError,
7873                  "object %.50s does not have __await__ method",
7874                  Py_TYPE(self)->tp_name);
7875     return NULL;
7876 }
7877 
7878 static PyObject *
slot_am_aiter(PyObject * self)7879 slot_am_aiter(PyObject *self)
7880 {
7881     int unbound;
7882     PyObject *func, *res;
7883     _Py_IDENTIFIER(__aiter__);
7884 
7885     func = lookup_maybe_method(self, &PyId___aiter__, &unbound);
7886     if (func != NULL) {
7887         res = call_unbound_noarg(unbound, func, self);
7888         Py_DECREF(func);
7889         return res;
7890     }
7891     PyErr_Format(PyExc_AttributeError,
7892                  "object %.50s does not have __aiter__ method",
7893                  Py_TYPE(self)->tp_name);
7894     return NULL;
7895 }
7896 
7897 static PyObject *
slot_am_anext(PyObject * self)7898 slot_am_anext(PyObject *self)
7899 {
7900     int unbound;
7901     PyObject *func, *res;
7902     _Py_IDENTIFIER(__anext__);
7903 
7904     func = lookup_maybe_method(self, &PyId___anext__, &unbound);
7905     if (func != NULL) {
7906         res = call_unbound_noarg(unbound, func, self);
7907         Py_DECREF(func);
7908         return res;
7909     }
7910     PyErr_Format(PyExc_AttributeError,
7911                  "object %.50s does not have __anext__ method",
7912                  Py_TYPE(self)->tp_name);
7913     return NULL;
7914 }
7915 
7916 /*
7917 Table mapping __foo__ names to tp_foo offsets and slot_tp_foo wrapper functions.
7918 
7919 The table is ordered by offsets relative to the 'PyHeapTypeObject' structure,
7920 which incorporates the additional structures used for numbers, sequences and
7921 mappings.  Note that multiple names may map to the same slot (e.g. __eq__,
7922 __ne__ etc. all map to tp_richcompare) and one name may map to multiple slots
7923 (e.g. __str__ affects tp_str as well as tp_repr). The table is terminated with
7924 an all-zero entry.  (This table is further initialized in
7925 _PyTypes_InitSlotDefs().)
7926 */
7927 
7928 typedef struct wrapperbase slotdef;
7929 
7930 #undef TPSLOT
7931 #undef FLSLOT
7932 #undef AMSLOT
7933 #undef ETSLOT
7934 #undef SQSLOT
7935 #undef MPSLOT
7936 #undef NBSLOT
7937 #undef UNSLOT
7938 #undef IBSLOT
7939 #undef BINSLOT
7940 #undef RBINSLOT
7941 
7942 #define TPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7943     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7944      PyDoc_STR(DOC)}
7945 #define FLSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC, FLAGS) \
7946     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7947      PyDoc_STR(DOC), FLAGS}
7948 #define ETSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7949     {NAME, offsetof(PyHeapTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7950      PyDoc_STR(DOC)}
7951 #define AMSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7952     ETSLOT(NAME, as_async.SLOT, FUNCTION, WRAPPER, DOC)
7953 #define SQSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7954     ETSLOT(NAME, as_sequence.SLOT, FUNCTION, WRAPPER, DOC)
7955 #define MPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7956     ETSLOT(NAME, as_mapping.SLOT, FUNCTION, WRAPPER, DOC)
7957 #define NBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7958     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, DOC)
7959 #define UNSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7960     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
7961            NAME "($self, /)\n--\n\n" DOC)
7962 #define IBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7963     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
7964            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
7965 #define BINSLOT(NAME, SLOT, FUNCTION, DOC) \
7966     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
7967            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
7968 #define RBINSLOT(NAME, SLOT, FUNCTION, DOC) \
7969     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
7970            NAME "($self, value, /)\n--\n\nReturn value" DOC "self.")
7971 #define BINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
7972     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
7973            NAME "($self, value, /)\n--\n\n" DOC)
7974 #define RBINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
7975     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
7976            NAME "($self, value, /)\n--\n\n" DOC)
7977 
7978 static slotdef slotdefs[] = {
7979     TPSLOT("__getattribute__", tp_getattr, NULL, NULL, ""),
7980     TPSLOT("__getattr__", tp_getattr, NULL, NULL, ""),
7981     TPSLOT("__setattr__", tp_setattr, NULL, NULL, ""),
7982     TPSLOT("__delattr__", tp_setattr, NULL, NULL, ""),
7983     TPSLOT("__repr__", tp_repr, slot_tp_repr, wrap_unaryfunc,
7984            "__repr__($self, /)\n--\n\nReturn repr(self)."),
7985     TPSLOT("__hash__", tp_hash, slot_tp_hash, wrap_hashfunc,
7986            "__hash__($self, /)\n--\n\nReturn hash(self)."),
7987     FLSLOT("__call__", tp_call, slot_tp_call, (wrapperfunc)(void(*)(void))wrap_call,
7988            "__call__($self, /, *args, **kwargs)\n--\n\nCall self as a function.",
7989            PyWrapperFlag_KEYWORDS),
7990     TPSLOT("__str__", tp_str, slot_tp_str, wrap_unaryfunc,
7991            "__str__($self, /)\n--\n\nReturn str(self)."),
7992     TPSLOT("__getattribute__", tp_getattro, slot_tp_getattr_hook,
7993            wrap_binaryfunc,
7994            "__getattribute__($self, name, /)\n--\n\nReturn getattr(self, name)."),
7995     TPSLOT("__getattr__", tp_getattro, slot_tp_getattr_hook, NULL, ""),
7996     TPSLOT("__setattr__", tp_setattro, slot_tp_setattro, wrap_setattr,
7997            "__setattr__($self, name, value, /)\n--\n\nImplement setattr(self, name, value)."),
7998     TPSLOT("__delattr__", tp_setattro, slot_tp_setattro, wrap_delattr,
7999            "__delattr__($self, name, /)\n--\n\nImplement delattr(self, name)."),
8000     TPSLOT("__lt__", tp_richcompare, slot_tp_richcompare, richcmp_lt,
8001            "__lt__($self, value, /)\n--\n\nReturn self<value."),
8002     TPSLOT("__le__", tp_richcompare, slot_tp_richcompare, richcmp_le,
8003            "__le__($self, value, /)\n--\n\nReturn self<=value."),
8004     TPSLOT("__eq__", tp_richcompare, slot_tp_richcompare, richcmp_eq,
8005            "__eq__($self, value, /)\n--\n\nReturn self==value."),
8006     TPSLOT("__ne__", tp_richcompare, slot_tp_richcompare, richcmp_ne,
8007            "__ne__($self, value, /)\n--\n\nReturn self!=value."),
8008     TPSLOT("__gt__", tp_richcompare, slot_tp_richcompare, richcmp_gt,
8009            "__gt__($self, value, /)\n--\n\nReturn self>value."),
8010     TPSLOT("__ge__", tp_richcompare, slot_tp_richcompare, richcmp_ge,
8011            "__ge__($self, value, /)\n--\n\nReturn self>=value."),
8012     TPSLOT("__iter__", tp_iter, slot_tp_iter, wrap_unaryfunc,
8013            "__iter__($self, /)\n--\n\nImplement iter(self)."),
8014     TPSLOT("__next__", tp_iternext, slot_tp_iternext, wrap_next,
8015            "__next__($self, /)\n--\n\nImplement next(self)."),
8016     TPSLOT("__get__", tp_descr_get, slot_tp_descr_get, wrap_descr_get,
8017            "__get__($self, instance, owner, /)\n--\n\nReturn an attribute of instance, which is of type owner."),
8018     TPSLOT("__set__", tp_descr_set, slot_tp_descr_set, wrap_descr_set,
8019            "__set__($self, instance, value, /)\n--\n\nSet an attribute of instance to value."),
8020     TPSLOT("__delete__", tp_descr_set, slot_tp_descr_set,
8021            wrap_descr_delete,
8022            "__delete__($self, instance, /)\n--\n\nDelete an attribute of instance."),
8023     FLSLOT("__init__", tp_init, slot_tp_init, (wrapperfunc)(void(*)(void))wrap_init,
8024            "__init__($self, /, *args, **kwargs)\n--\n\n"
8025            "Initialize self.  See help(type(self)) for accurate signature.",
8026            PyWrapperFlag_KEYWORDS),
8027     TPSLOT("__new__", tp_new, slot_tp_new, NULL,
8028            "__new__(type, /, *args, **kwargs)\n--\n\n"
8029            "Create and return new object.  See help(type) for accurate signature."),
8030     TPSLOT("__del__", tp_finalize, slot_tp_finalize, (wrapperfunc)wrap_del, ""),
8031 
8032     AMSLOT("__await__", am_await, slot_am_await, wrap_unaryfunc,
8033            "__await__($self, /)\n--\n\nReturn an iterator to be used in await expression."),
8034     AMSLOT("__aiter__", am_aiter, slot_am_aiter, wrap_unaryfunc,
8035            "__aiter__($self, /)\n--\n\nReturn an awaitable, that resolves in asynchronous iterator."),
8036     AMSLOT("__anext__", am_anext, slot_am_anext, wrap_unaryfunc,
8037            "__anext__($self, /)\n--\n\nReturn a value or raise StopAsyncIteration."),
8038 
8039     BINSLOT("__add__", nb_add, slot_nb_add,
8040            "+"),
8041     RBINSLOT("__radd__", nb_add, slot_nb_add,
8042            "+"),
8043     BINSLOT("__sub__", nb_subtract, slot_nb_subtract,
8044            "-"),
8045     RBINSLOT("__rsub__", nb_subtract, slot_nb_subtract,
8046            "-"),
8047     BINSLOT("__mul__", nb_multiply, slot_nb_multiply,
8048            "*"),
8049     RBINSLOT("__rmul__", nb_multiply, slot_nb_multiply,
8050            "*"),
8051     BINSLOT("__mod__", nb_remainder, slot_nb_remainder,
8052            "%"),
8053     RBINSLOT("__rmod__", nb_remainder, slot_nb_remainder,
8054            "%"),
8055     BINSLOTNOTINFIX("__divmod__", nb_divmod, slot_nb_divmod,
8056            "Return divmod(self, value)."),
8057     RBINSLOTNOTINFIX("__rdivmod__", nb_divmod, slot_nb_divmod,
8058            "Return divmod(value, self)."),
8059     NBSLOT("__pow__", nb_power, slot_nb_power, wrap_ternaryfunc,
8060            "__pow__($self, value, mod=None, /)\n--\n\nReturn pow(self, value, mod)."),
8061     NBSLOT("__rpow__", nb_power, slot_nb_power, wrap_ternaryfunc_r,
8062            "__rpow__($self, value, mod=None, /)\n--\n\nReturn pow(value, self, mod)."),
8063     UNSLOT("__neg__", nb_negative, slot_nb_negative, wrap_unaryfunc, "-self"),
8064     UNSLOT("__pos__", nb_positive, slot_nb_positive, wrap_unaryfunc, "+self"),
8065     UNSLOT("__abs__", nb_absolute, slot_nb_absolute, wrap_unaryfunc,
8066            "abs(self)"),
8067     UNSLOT("__bool__", nb_bool, slot_nb_bool, wrap_inquirypred,
8068            "self != 0"),
8069     UNSLOT("__invert__", nb_invert, slot_nb_invert, wrap_unaryfunc, "~self"),
8070     BINSLOT("__lshift__", nb_lshift, slot_nb_lshift, "<<"),
8071     RBINSLOT("__rlshift__", nb_lshift, slot_nb_lshift, "<<"),
8072     BINSLOT("__rshift__", nb_rshift, slot_nb_rshift, ">>"),
8073     RBINSLOT("__rrshift__", nb_rshift, slot_nb_rshift, ">>"),
8074     BINSLOT("__and__", nb_and, slot_nb_and, "&"),
8075     RBINSLOT("__rand__", nb_and, slot_nb_and, "&"),
8076     BINSLOT("__xor__", nb_xor, slot_nb_xor, "^"),
8077     RBINSLOT("__rxor__", nb_xor, slot_nb_xor, "^"),
8078     BINSLOT("__or__", nb_or, slot_nb_or, "|"),
8079     RBINSLOT("__ror__", nb_or, slot_nb_or, "|"),
8080     UNSLOT("__int__", nb_int, slot_nb_int, wrap_unaryfunc,
8081            "int(self)"),
8082     UNSLOT("__float__", nb_float, slot_nb_float, wrap_unaryfunc,
8083            "float(self)"),
8084     IBSLOT("__iadd__", nb_inplace_add, slot_nb_inplace_add,
8085            wrap_binaryfunc, "+="),
8086     IBSLOT("__isub__", nb_inplace_subtract, slot_nb_inplace_subtract,
8087            wrap_binaryfunc, "-="),
8088     IBSLOT("__imul__", nb_inplace_multiply, slot_nb_inplace_multiply,
8089            wrap_binaryfunc, "*="),
8090     IBSLOT("__imod__", nb_inplace_remainder, slot_nb_inplace_remainder,
8091            wrap_binaryfunc, "%="),
8092     IBSLOT("__ipow__", nb_inplace_power, slot_nb_inplace_power,
8093            wrap_ternaryfunc, "**="),
8094     IBSLOT("__ilshift__", nb_inplace_lshift, slot_nb_inplace_lshift,
8095            wrap_binaryfunc, "<<="),
8096     IBSLOT("__irshift__", nb_inplace_rshift, slot_nb_inplace_rshift,
8097            wrap_binaryfunc, ">>="),
8098     IBSLOT("__iand__", nb_inplace_and, slot_nb_inplace_and,
8099            wrap_binaryfunc, "&="),
8100     IBSLOT("__ixor__", nb_inplace_xor, slot_nb_inplace_xor,
8101            wrap_binaryfunc, "^="),
8102     IBSLOT("__ior__", nb_inplace_or, slot_nb_inplace_or,
8103            wrap_binaryfunc, "|="),
8104     BINSLOT("__floordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
8105     RBINSLOT("__rfloordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
8106     BINSLOT("__truediv__", nb_true_divide, slot_nb_true_divide, "/"),
8107     RBINSLOT("__rtruediv__", nb_true_divide, slot_nb_true_divide, "/"),
8108     IBSLOT("__ifloordiv__", nb_inplace_floor_divide,
8109            slot_nb_inplace_floor_divide, wrap_binaryfunc, "//="),
8110     IBSLOT("__itruediv__", nb_inplace_true_divide,
8111            slot_nb_inplace_true_divide, wrap_binaryfunc, "/="),
8112     NBSLOT("__index__", nb_index, slot_nb_index, wrap_unaryfunc,
8113            "__index__($self, /)\n--\n\n"
8114            "Return self converted to an integer, if self is suitable "
8115            "for use as an index into a list."),
8116     BINSLOT("__matmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
8117             "@"),
8118     RBINSLOT("__rmatmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
8119              "@"),
8120     IBSLOT("__imatmul__", nb_inplace_matrix_multiply, slot_nb_inplace_matrix_multiply,
8121            wrap_binaryfunc, "@="),
8122     MPSLOT("__len__", mp_length, slot_mp_length, wrap_lenfunc,
8123            "__len__($self, /)\n--\n\nReturn len(self)."),
8124     MPSLOT("__getitem__", mp_subscript, slot_mp_subscript,
8125            wrap_binaryfunc,
8126            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
8127     MPSLOT("__setitem__", mp_ass_subscript, slot_mp_ass_subscript,
8128            wrap_objobjargproc,
8129            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
8130     MPSLOT("__delitem__", mp_ass_subscript, slot_mp_ass_subscript,
8131            wrap_delitem,
8132            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
8133 
8134     SQSLOT("__len__", sq_length, slot_sq_length, wrap_lenfunc,
8135            "__len__($self, /)\n--\n\nReturn len(self)."),
8136     /* Heap types defining __add__/__mul__ have sq_concat/sq_repeat == NULL.
8137        The logic in abstract.c always falls back to nb_add/nb_multiply in
8138        this case.  Defining both the nb_* and the sq_* slots to call the
8139        user-defined methods has unexpected side-effects, as shown by
8140        test_descr.notimplemented() */
8141     SQSLOT("__add__", sq_concat, NULL, wrap_binaryfunc,
8142            "__add__($self, value, /)\n--\n\nReturn self+value."),
8143     SQSLOT("__mul__", sq_repeat, NULL, wrap_indexargfunc,
8144            "__mul__($self, value, /)\n--\n\nReturn self*value."),
8145     SQSLOT("__rmul__", sq_repeat, NULL, wrap_indexargfunc,
8146            "__rmul__($self, value, /)\n--\n\nReturn value*self."),
8147     SQSLOT("__getitem__", sq_item, slot_sq_item, wrap_sq_item,
8148            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
8149     SQSLOT("__setitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_setitem,
8150            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
8151     SQSLOT("__delitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_delitem,
8152            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
8153     SQSLOT("__contains__", sq_contains, slot_sq_contains, wrap_objobjproc,
8154            "__contains__($self, key, /)\n--\n\nReturn key in self."),
8155     SQSLOT("__iadd__", sq_inplace_concat, NULL,
8156            wrap_binaryfunc,
8157            "__iadd__($self, value, /)\n--\n\nImplement self+=value."),
8158     SQSLOT("__imul__", sq_inplace_repeat, NULL,
8159            wrap_indexargfunc,
8160            "__imul__($self, value, /)\n--\n\nImplement self*=value."),
8161 
8162     {NULL}
8163 };
8164 
8165 /* Given a type pointer and an offset gotten from a slotdef entry, return a
8166    pointer to the actual slot.  This is not quite the same as simply adding
8167    the offset to the type pointer, since it takes care to indirect through the
8168    proper indirection pointer (as_buffer, etc.); it returns NULL if the
8169    indirection pointer is NULL. */
8170 static void **
slotptr(PyTypeObject * type,int ioffset)8171 slotptr(PyTypeObject *type, int ioffset)
8172 {
8173     char *ptr;
8174     long offset = ioffset;
8175 
8176     /* Note: this depends on the order of the members of PyHeapTypeObject! */
8177     assert(offset >= 0);
8178     assert((size_t)offset < offsetof(PyHeapTypeObject, as_buffer));
8179     if ((size_t)offset >= offsetof(PyHeapTypeObject, as_sequence)) {
8180         ptr = (char *)type->tp_as_sequence;
8181         offset -= offsetof(PyHeapTypeObject, as_sequence);
8182     }
8183     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_mapping)) {
8184         ptr = (char *)type->tp_as_mapping;
8185         offset -= offsetof(PyHeapTypeObject, as_mapping);
8186     }
8187     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_number)) {
8188         ptr = (char *)type->tp_as_number;
8189         offset -= offsetof(PyHeapTypeObject, as_number);
8190     }
8191     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_async)) {
8192         ptr = (char *)type->tp_as_async;
8193         offset -= offsetof(PyHeapTypeObject, as_async);
8194     }
8195     else {
8196         ptr = (char *)type;
8197     }
8198     if (ptr != NULL)
8199         ptr += offset;
8200     return (void **)ptr;
8201 }
8202 
8203 /* Length of array of slotdef pointers used to store slots with the
8204    same __name__.  There should be at most MAX_EQUIV-1 slotdef entries with
8205    the same __name__, for any __name__. Since that's a static property, it is
8206    appropriate to declare fixed-size arrays for this. */
8207 #define MAX_EQUIV 10
8208 
8209 /* Return a slot pointer for a given name, but ONLY if the attribute has
8210    exactly one slot function.  The name must be an interned string. */
8211 static void **
resolve_slotdups(PyTypeObject * type,PyObject * name)8212 resolve_slotdups(PyTypeObject *type, PyObject *name)
8213 {
8214     /* XXX Maybe this could be optimized more -- but is it worth it? */
8215 
8216     /* pname and ptrs act as a little cache */
8217     static PyObject *pname;
8218     static slotdef *ptrs[MAX_EQUIV];
8219     slotdef *p, **pp;
8220     void **res, **ptr;
8221 
8222     if (pname != name) {
8223         /* Collect all slotdefs that match name into ptrs. */
8224         pname = name;
8225         pp = ptrs;
8226         for (p = slotdefs; p->name_strobj; p++) {
8227             if (p->name_strobj == name)
8228                 *pp++ = p;
8229         }
8230         *pp = NULL;
8231     }
8232 
8233     /* Look in all slots of the type matching the name. If exactly one of these
8234        has a filled-in slot, return a pointer to that slot.
8235        Otherwise, return NULL. */
8236     res = NULL;
8237     for (pp = ptrs; *pp; pp++) {
8238         ptr = slotptr(type, (*pp)->offset);
8239         if (ptr == NULL || *ptr == NULL)
8240             continue;
8241         if (res != NULL)
8242             return NULL;
8243         res = ptr;
8244     }
8245     return res;
8246 }
8247 
8248 
8249 /* Common code for update_slots_callback() and fixup_slot_dispatchers().
8250  *
8251  * This is meant to set a "slot" like type->tp_repr or
8252  * type->tp_as_sequence->sq_concat by looking up special methods like
8253  * __repr__ or __add__. The opposite (adding special methods from slots) is
8254  * done by add_operators(), called from PyType_Ready(). Since update_one_slot()
8255  * calls PyType_Ready() if needed, the special methods are already in place.
8256  *
8257  * The special methods corresponding to each slot are defined in the "slotdef"
8258  * array. Note that one slot may correspond to multiple special methods and vice
8259  * versa. For example, tp_richcompare uses 6 methods __lt__, ..., __ge__ and
8260  * tp_as_number->nb_add uses __add__ and __radd__. In the other direction,
8261  * __add__ is used by the number and sequence protocols and __getitem__ by the
8262  * sequence and mapping protocols. This causes a lot of complications.
8263  *
8264  * In detail, update_one_slot() does the following:
8265  *
8266  * First of all, if the slot in question does not exist, return immediately.
8267  * This can happen for example if it's tp_as_number->nb_add but tp_as_number
8268  * is NULL.
8269  *
8270  * For the given slot, we loop over all the special methods with a name
8271  * corresponding to that slot (for example, for tp_descr_set, this would be
8272  * __set__ and __delete__) and we look up these names in the MRO of the type.
8273  * If we don't find any special method, the slot is set to NULL (regardless of
8274  * what was in the slot before).
8275  *
8276  * Suppose that we find exactly one special method. If it's a wrapper_descriptor
8277  * (i.e. a special method calling a slot, for example str.__repr__ which calls
8278  * the tp_repr for the 'str' class) with the correct name ("__repr__" for
8279  * tp_repr), for the right class, calling the right wrapper C function (like
8280  * wrap_unaryfunc for tp_repr), then the slot is set to the slot that the
8281  * wrapper_descriptor originally wrapped. For example, a class inheriting
8282  * from 'str' and not redefining __repr__ will have tp_repr set to the tp_repr
8283  * of 'str'.
8284  * In all other cases where the special method exists, the slot is set to a
8285  * wrapper calling the special method. There is one exception: if the special
8286  * method is a wrapper_descriptor with the correct name but the type has
8287  * precisely one slot set for that name and that slot is not the one that we
8288  * are updating, then NULL is put in the slot (this exception is the only place
8289  * in update_one_slot() where the *existing* slots matter).
8290  *
8291  * When there are multiple special methods for the same slot, the above is
8292  * applied for each special method. As long as the results agree, the common
8293  * resulting slot is applied. If the results disagree, then a wrapper for
8294  * the special methods is installed. This is always safe, but less efficient
8295  * because it uses method lookup instead of direct C calls.
8296  *
8297  * There are some further special cases for specific slots, like supporting
8298  * __hash__ = None for tp_hash and special code for tp_new.
8299  *
8300  * When done, return a pointer to the next slotdef with a different offset,
8301  * because that's convenient for fixup_slot_dispatchers(). This function never
8302  * sets an exception: if an internal error happens (unlikely), it's ignored. */
8303 static slotdef *
update_one_slot(PyTypeObject * type,slotdef * p)8304 update_one_slot(PyTypeObject *type, slotdef *p)
8305 {
8306     PyObject *descr;
8307     PyWrapperDescrObject *d;
8308     void *generic = NULL, *specific = NULL;
8309     int use_generic = 0;
8310     int offset = p->offset;
8311     int error;
8312     void **ptr = slotptr(type, offset);
8313 
8314     if (ptr == NULL) {
8315         do {
8316             ++p;
8317         } while (p->offset == offset);
8318         return p;
8319     }
8320     /* We may end up clearing live exceptions below, so make sure it's ours. */
8321     assert(!PyErr_Occurred());
8322     do {
8323         /* Use faster uncached lookup as we won't get any cache hits during type setup. */
8324         descr = find_name_in_mro(type, p->name_strobj, &error);
8325         if (descr == NULL) {
8326             if (error == -1) {
8327                 /* It is unlikely but not impossible that there has been an exception
8328                    during lookup. Since this function originally expected no errors,
8329                    we ignore them here in order to keep up the interface. */
8330                 PyErr_Clear();
8331             }
8332             if (ptr == (void**)&type->tp_iternext) {
8333                 specific = (void *)_PyObject_NextNotImplemented;
8334             }
8335             continue;
8336         }
8337         if (Py_IS_TYPE(descr, &PyWrapperDescr_Type) &&
8338             ((PyWrapperDescrObject *)descr)->d_base->name_strobj == p->name_strobj) {
8339             void **tptr = resolve_slotdups(type, p->name_strobj);
8340             if (tptr == NULL || tptr == ptr)
8341                 generic = p->function;
8342             d = (PyWrapperDescrObject *)descr;
8343             if ((specific == NULL || specific == d->d_wrapped) &&
8344                 d->d_base->wrapper == p->wrapper &&
8345                 PyType_IsSubtype(type, PyDescr_TYPE(d)))
8346             {
8347                 specific = d->d_wrapped;
8348             }
8349             else {
8350                 /* We cannot use the specific slot function because either
8351                    - it is not unique: there are multiple methods for this
8352                      slot and they conflict
8353                    - the signature is wrong (as checked by the ->wrapper
8354                      comparison above)
8355                    - it's wrapping the wrong class
8356                  */
8357                 use_generic = 1;
8358             }
8359         }
8360         else if (Py_IS_TYPE(descr, &PyCFunction_Type) &&
8361                  PyCFunction_GET_FUNCTION(descr) ==
8362                  (PyCFunction)(void(*)(void))tp_new_wrapper &&
8363                  ptr == (void**)&type->tp_new)
8364         {
8365             /* The __new__ wrapper is not a wrapper descriptor,
8366                so must be special-cased differently.
8367                If we don't do this, creating an instance will
8368                always use slot_tp_new which will look up
8369                __new__ in the MRO which will call tp_new_wrapper
8370                which will look through the base classes looking
8371                for a static base and call its tp_new (usually
8372                PyType_GenericNew), after performing various
8373                sanity checks and constructing a new argument
8374                list.  Cut all that nonsense short -- this speeds
8375                up instance creation tremendously. */
8376             specific = (void *)type->tp_new;
8377             /* XXX I'm not 100% sure that there isn't a hole
8378                in this reasoning that requires additional
8379                sanity checks.  I'll buy the first person to
8380                point out a bug in this reasoning a beer. */
8381         }
8382         else if (descr == Py_None &&
8383                  ptr == (void**)&type->tp_hash) {
8384             /* We specifically allow __hash__ to be set to None
8385                to prevent inheritance of the default
8386                implementation from object.__hash__ */
8387             specific = (void *)PyObject_HashNotImplemented;
8388         }
8389         else {
8390             use_generic = 1;
8391             generic = p->function;
8392         }
8393     } while ((++p)->offset == offset);
8394     if (specific && !use_generic)
8395         *ptr = specific;
8396     else
8397         *ptr = generic;
8398     return p;
8399 }
8400 
8401 /* In the type, update the slots whose slotdefs are gathered in the pp array.
8402    This is a callback for update_subclasses(). */
8403 static int
update_slots_callback(PyTypeObject * type,void * data)8404 update_slots_callback(PyTypeObject *type, void *data)
8405 {
8406     slotdef **pp = (slotdef **)data;
8407 
8408     for (; *pp; pp++)
8409         update_one_slot(type, *pp);
8410     return 0;
8411 }
8412 
8413 static int slotdefs_initialized = 0;
8414 /* Initialize the slotdefs table by adding interned string objects for the
8415    names. */
8416 PyStatus
_PyTypes_InitSlotDefs(void)8417 _PyTypes_InitSlotDefs(void)
8418 {
8419     if (slotdefs_initialized) {
8420         return _PyStatus_OK();
8421     }
8422 
8423     for (slotdef *p = slotdefs; p->name; p++) {
8424         /* Slots must be ordered by their offset in the PyHeapTypeObject. */
8425         assert(!p[1].name || p->offset <= p[1].offset);
8426         p->name_strobj = PyUnicode_InternFromString(p->name);
8427         if (!p->name_strobj || !PyUnicode_CHECK_INTERNED(p->name_strobj)) {
8428             return _PyStatus_NO_MEMORY();
8429         }
8430     }
8431     slotdefs_initialized = 1;
8432     return _PyStatus_OK();
8433 }
8434 
8435 /* Undo _PyTypes_InitSlotDefs(), releasing the interned strings. */
clear_slotdefs(void)8436 static void clear_slotdefs(void)
8437 {
8438     for (slotdef *p = slotdefs; p->name; p++) {
8439         Py_CLEAR(p->name_strobj);
8440     }
8441     slotdefs_initialized = 0;
8442 }
8443 
8444 /* Update the slots after assignment to a class (type) attribute. */
8445 static int
update_slot(PyTypeObject * type,PyObject * name)8446 update_slot(PyTypeObject *type, PyObject *name)
8447 {
8448     slotdef *ptrs[MAX_EQUIV];
8449     slotdef *p;
8450     slotdef **pp;
8451     int offset;
8452 
8453     assert(PyUnicode_CheckExact(name));
8454     assert(PyUnicode_CHECK_INTERNED(name));
8455 
8456     assert(slotdefs_initialized);
8457     pp = ptrs;
8458     for (p = slotdefs; p->name; p++) {
8459         assert(PyUnicode_CheckExact(p->name_strobj));
8460         assert(PyUnicode_CheckExact(name));
8461         if (p->name_strobj == name) {
8462             *pp++ = p;
8463         }
8464     }
8465     *pp = NULL;
8466     for (pp = ptrs; *pp; pp++) {
8467         p = *pp;
8468         offset = p->offset;
8469         while (p > slotdefs && (p-1)->offset == offset)
8470             --p;
8471         *pp = p;
8472     }
8473     if (ptrs[0] == NULL)
8474         return 0; /* Not an attribute that affects any slots */
8475     return update_subclasses(type, name,
8476                              update_slots_callback, (void *)ptrs);
8477 }
8478 
8479 /* Store the proper functions in the slot dispatches at class (type)
8480    definition time, based upon which operations the class overrides in its
8481    dict. */
8482 static void
fixup_slot_dispatchers(PyTypeObject * type)8483 fixup_slot_dispatchers(PyTypeObject *type)
8484 {
8485     assert(!PyErr_Occurred());
8486     assert(slotdefs_initialized);
8487     for (slotdef *p = slotdefs; p->name; ) {
8488         p = update_one_slot(type, p);
8489     }
8490 }
8491 
8492 static void
update_all_slots(PyTypeObject * type)8493 update_all_slots(PyTypeObject* type)
8494 {
8495     slotdef *p;
8496 
8497     /* Clear the VALID_VERSION flag of 'type' and all its subclasses. */
8498     PyType_Modified(type);
8499 
8500     assert(slotdefs_initialized);
8501     for (p = slotdefs; p->name; p++) {
8502         /* update_slot returns int but can't actually fail */
8503         update_slot(type, p->name_strobj);
8504     }
8505 }
8506 
8507 
8508 /* Call __set_name__ on all attributes (including descriptors)
8509   in a newly generated type */
8510 static int
type_new_set_names(PyTypeObject * type)8511 type_new_set_names(PyTypeObject *type)
8512 {
8513     PyObject *names_to_set = PyDict_Copy(type->tp_dict);
8514     if (names_to_set == NULL) {
8515         return -1;
8516     }
8517 
8518     Py_ssize_t i = 0;
8519     PyObject *key, *value;
8520     while (PyDict_Next(names_to_set, &i, &key, &value)) {
8521         PyObject *set_name = _PyObject_LookupSpecial(value, &PyId___set_name__);
8522         if (set_name == NULL) {
8523             if (PyErr_Occurred()) {
8524                 goto error;
8525             }
8526             continue;
8527         }
8528 
8529         PyObject *res = PyObject_CallFunctionObjArgs(set_name, type, key, NULL);
8530         Py_DECREF(set_name);
8531 
8532         if (res == NULL) {
8533             _PyErr_FormatFromCause(PyExc_RuntimeError,
8534                 "Error calling __set_name__ on '%.100s' instance %R "
8535                 "in '%.100s'",
8536                 Py_TYPE(value)->tp_name, key, type->tp_name);
8537             goto error;
8538         }
8539         Py_DECREF(res);
8540     }
8541 
8542     Py_DECREF(names_to_set);
8543     return 0;
8544 
8545 error:
8546     Py_DECREF(names_to_set);
8547     return -1;
8548 }
8549 
8550 
8551 /* Call __init_subclass__ on the parent of a newly generated type */
8552 static int
type_new_init_subclass(PyTypeObject * type,PyObject * kwds)8553 type_new_init_subclass(PyTypeObject *type, PyObject *kwds)
8554 {
8555     PyObject *args[2] = {(PyObject *)type, (PyObject *)type};
8556     PyObject *super = _PyObject_FastCall((PyObject *)&PySuper_Type, args, 2);
8557     if (super == NULL) {
8558         return -1;
8559     }
8560 
8561     PyObject *func = _PyObject_GetAttrId(super, &PyId___init_subclass__);
8562     Py_DECREF(super);
8563     if (func == NULL) {
8564         return -1;
8565     }
8566 
8567     PyObject *result = PyObject_VectorcallDict(func, NULL, 0, kwds);
8568     Py_DECREF(func);
8569     if (result == NULL) {
8570         return -1;
8571     }
8572 
8573     Py_DECREF(result);
8574     return 0;
8575 }
8576 
8577 
8578 /* recurse_down_subclasses() and update_subclasses() are mutually
8579    recursive functions to call a callback for all subclasses,
8580    but refraining from recursing into subclasses that define 'name'. */
8581 
8582 static int
update_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)8583 update_subclasses(PyTypeObject *type, PyObject *name,
8584                   update_callback callback, void *data)
8585 {
8586     if (callback(type, data) < 0)
8587         return -1;
8588     return recurse_down_subclasses(type, name, callback, data);
8589 }
8590 
8591 static int
recurse_down_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)8592 recurse_down_subclasses(PyTypeObject *type, PyObject *name,
8593                         update_callback callback, void *data)
8594 {
8595     PyTypeObject *subclass;
8596     PyObject *ref, *subclasses, *dict;
8597     Py_ssize_t i;
8598 
8599     subclasses = type->tp_subclasses;
8600     if (subclasses == NULL)
8601         return 0;
8602     assert(PyDict_CheckExact(subclasses));
8603     i = 0;
8604     while (PyDict_Next(subclasses, &i, NULL, &ref)) {
8605         assert(PyWeakref_CheckRef(ref));
8606         subclass = (PyTypeObject *)PyWeakref_GET_OBJECT(ref);
8607         assert(subclass != NULL);
8608         if ((PyObject *)subclass == Py_None)
8609             continue;
8610         assert(PyType_Check(subclass));
8611         /* Avoid recursing down into unaffected classes */
8612         dict = subclass->tp_dict;
8613         if (dict != NULL && PyDict_Check(dict)) {
8614             int r = PyDict_Contains(dict, name);
8615             if (r > 0) {
8616                 continue;
8617             }
8618             if (r < 0) {
8619                 return -1;
8620             }
8621         }
8622         if (update_subclasses(subclass, name, callback, data) < 0)
8623             return -1;
8624     }
8625     return 0;
8626 }
8627 
8628 /* This function is called by PyType_Ready() to populate the type's
8629    dictionary with method descriptors for function slots.  For each
8630    function slot (like tp_repr) that's defined in the type, one or more
8631    corresponding descriptors are added in the type's tp_dict dictionary
8632    under the appropriate name (like __repr__).  Some function slots
8633    cause more than one descriptor to be added (for example, the nb_add
8634    slot adds both __add__ and __radd__ descriptors) and some function
8635    slots compete for the same descriptor (for example both sq_item and
8636    mp_subscript generate a __getitem__ descriptor).
8637 
8638    In the latter case, the first slotdef entry encountered wins.  Since
8639    slotdef entries are sorted by the offset of the slot in the
8640    PyHeapTypeObject, this gives us some control over disambiguating
8641    between competing slots: the members of PyHeapTypeObject are listed
8642    from most general to least general, so the most general slot is
8643    preferred.  In particular, because as_mapping comes before as_sequence,
8644    for a type that defines both mp_subscript and sq_item, mp_subscript
8645    wins.
8646 
8647    This only adds new descriptors and doesn't overwrite entries in
8648    tp_dict that were previously defined.  The descriptors contain a
8649    reference to the C function they must call, so that it's safe if they
8650    are copied into a subtype's __dict__ and the subtype has a different
8651    C function in its slot -- calling the method defined by the
8652    descriptor will call the C function that was used to create it,
8653    rather than the C function present in the slot when it is called.
8654    (This is important because a subtype may have a C function in the
8655    slot that calls the method from the dictionary, and we want to avoid
8656    infinite recursion here.) */
8657 
8658 static int
add_operators(PyTypeObject * type)8659 add_operators(PyTypeObject *type)
8660 {
8661     PyObject *dict = type->tp_dict;
8662     slotdef *p;
8663     PyObject *descr;
8664     void **ptr;
8665 
8666     assert(slotdefs_initialized);
8667     for (p = slotdefs; p->name; p++) {
8668         if (p->wrapper == NULL)
8669             continue;
8670         ptr = slotptr(type, p->offset);
8671         if (!ptr || !*ptr)
8672             continue;
8673         int r = PyDict_Contains(dict, p->name_strobj);
8674         if (r > 0)
8675             continue;
8676         if (r < 0) {
8677             return -1;
8678         }
8679         if (*ptr == (void *)PyObject_HashNotImplemented) {
8680             /* Classes may prevent the inheritance of the tp_hash
8681                slot by storing PyObject_HashNotImplemented in it. Make it
8682                visible as a None value for the __hash__ attribute. */
8683             if (PyDict_SetItem(dict, p->name_strobj, Py_None) < 0)
8684                 return -1;
8685         }
8686         else {
8687             descr = PyDescr_NewWrapper(type, p, *ptr);
8688             if (descr == NULL)
8689                 return -1;
8690             if (PyDict_SetItem(dict, p->name_strobj, descr) < 0) {
8691                 Py_DECREF(descr);
8692                 return -1;
8693             }
8694             Py_DECREF(descr);
8695         }
8696     }
8697     return 0;
8698 }
8699 
8700 
8701 /* Cooperative 'super' */
8702 
8703 typedef struct {
8704     PyObject_HEAD
8705     PyTypeObject *type;
8706     PyObject *obj;
8707     PyTypeObject *obj_type;
8708 } superobject;
8709 
8710 static PyMemberDef super_members[] = {
8711     {"__thisclass__", T_OBJECT, offsetof(superobject, type), READONLY,
8712      "the class invoking super()"},
8713     {"__self__",  T_OBJECT, offsetof(superobject, obj), READONLY,
8714      "the instance invoking super(); may be None"},
8715     {"__self_class__", T_OBJECT, offsetof(superobject, obj_type), READONLY,
8716      "the type of the instance invoking super(); may be None"},
8717     {0}
8718 };
8719 
8720 static void
super_dealloc(PyObject * self)8721 super_dealloc(PyObject *self)
8722 {
8723     superobject *su = (superobject *)self;
8724 
8725     _PyObject_GC_UNTRACK(self);
8726     Py_XDECREF(su->obj);
8727     Py_XDECREF(su->type);
8728     Py_XDECREF(su->obj_type);
8729     Py_TYPE(self)->tp_free(self);
8730 }
8731 
8732 static PyObject *
super_repr(PyObject * self)8733 super_repr(PyObject *self)
8734 {
8735     superobject *su = (superobject *)self;
8736 
8737     if (su->obj_type)
8738         return PyUnicode_FromFormat(
8739             "<super: <class '%s'>, <%s object>>",
8740             su->type ? su->type->tp_name : "NULL",
8741             su->obj_type->tp_name);
8742     else
8743         return PyUnicode_FromFormat(
8744             "<super: <class '%s'>, NULL>",
8745             su->type ? su->type->tp_name : "NULL");
8746 }
8747 
8748 static PyObject *
super_getattro(PyObject * self,PyObject * name)8749 super_getattro(PyObject *self, PyObject *name)
8750 {
8751     superobject *su = (superobject *)self;
8752     PyTypeObject *starttype;
8753     PyObject *mro;
8754     Py_ssize_t i, n;
8755 
8756     starttype = su->obj_type;
8757     if (starttype == NULL)
8758         goto skip;
8759 
8760     /* We want __class__ to return the class of the super object
8761        (i.e. super, or a subclass), not the class of su->obj. */
8762     if (PyUnicode_Check(name) &&
8763         PyUnicode_GET_LENGTH(name) == 9 &&
8764         _PyUnicode_EqualToASCIIId(name, &PyId___class__))
8765         goto skip;
8766 
8767     mro = starttype->tp_mro;
8768     if (mro == NULL)
8769         goto skip;
8770 
8771     assert(PyTuple_Check(mro));
8772     n = PyTuple_GET_SIZE(mro);
8773 
8774     /* No need to check the last one: it's gonna be skipped anyway.  */
8775     for (i = 0; i+1 < n; i++) {
8776         if ((PyObject *)(su->type) == PyTuple_GET_ITEM(mro, i))
8777             break;
8778     }
8779     i++;  /* skip su->type (if any)  */
8780     if (i >= n)
8781         goto skip;
8782 
8783     /* keep a strong reference to mro because starttype->tp_mro can be
8784        replaced during PyDict_GetItemWithError(dict, name)  */
8785     Py_INCREF(mro);
8786     do {
8787         PyObject *res, *tmp, *dict;
8788         descrgetfunc f;
8789 
8790         tmp = PyTuple_GET_ITEM(mro, i);
8791         assert(PyType_Check(tmp));
8792 
8793         dict = ((PyTypeObject *)tmp)->tp_dict;
8794         assert(dict != NULL && PyDict_Check(dict));
8795 
8796         res = PyDict_GetItemWithError(dict, name);
8797         if (res != NULL) {
8798             Py_INCREF(res);
8799 
8800             f = Py_TYPE(res)->tp_descr_get;
8801             if (f != NULL) {
8802                 tmp = f(res,
8803                     /* Only pass 'obj' param if this is instance-mode super
8804                        (See SF ID #743627)  */
8805                     (su->obj == (PyObject *)starttype) ? NULL : su->obj,
8806                     (PyObject *)starttype);
8807                 Py_DECREF(res);
8808                 res = tmp;
8809             }
8810 
8811             Py_DECREF(mro);
8812             return res;
8813         }
8814         else if (PyErr_Occurred()) {
8815             Py_DECREF(mro);
8816             return NULL;
8817         }
8818 
8819         i++;
8820     } while (i < n);
8821     Py_DECREF(mro);
8822 
8823   skip:
8824     return PyObject_GenericGetAttr(self, name);
8825 }
8826 
8827 static PyTypeObject *
supercheck(PyTypeObject * type,PyObject * obj)8828 supercheck(PyTypeObject *type, PyObject *obj)
8829 {
8830     /* Check that a super() call makes sense.  Return a type object.
8831 
8832        obj can be a class, or an instance of one:
8833 
8834        - If it is a class, it must be a subclass of 'type'.      This case is
8835          used for class methods; the return value is obj.
8836 
8837        - If it is an instance, it must be an instance of 'type'.  This is
8838          the normal case; the return value is obj.__class__.
8839 
8840        But... when obj is an instance, we want to allow for the case where
8841        Py_TYPE(obj) is not a subclass of type, but obj.__class__ is!
8842        This will allow using super() with a proxy for obj.
8843     */
8844 
8845     /* Check for first bullet above (special case) */
8846     if (PyType_Check(obj) && PyType_IsSubtype((PyTypeObject *)obj, type)) {
8847         Py_INCREF(obj);
8848         return (PyTypeObject *)obj;
8849     }
8850 
8851     /* Normal case */
8852     if (PyType_IsSubtype(Py_TYPE(obj), type)) {
8853         Py_INCREF(Py_TYPE(obj));
8854         return Py_TYPE(obj);
8855     }
8856     else {
8857         /* Try the slow way */
8858         PyObject *class_attr;
8859 
8860         if (_PyObject_LookupAttrId(obj, &PyId___class__, &class_attr) < 0) {
8861             return NULL;
8862         }
8863         if (class_attr != NULL &&
8864             PyType_Check(class_attr) &&
8865             (PyTypeObject *)class_attr != Py_TYPE(obj))
8866         {
8867             int ok = PyType_IsSubtype(
8868                 (PyTypeObject *)class_attr, type);
8869             if (ok)
8870                 return (PyTypeObject *)class_attr;
8871         }
8872         Py_XDECREF(class_attr);
8873     }
8874 
8875     PyErr_SetString(PyExc_TypeError,
8876                     "super(type, obj): "
8877                     "obj must be an instance or subtype of type");
8878     return NULL;
8879 }
8880 
8881 static PyObject *
super_descr_get(PyObject * self,PyObject * obj,PyObject * type)8882 super_descr_get(PyObject *self, PyObject *obj, PyObject *type)
8883 {
8884     superobject *su = (superobject *)self;
8885     superobject *newobj;
8886 
8887     if (obj == NULL || obj == Py_None || su->obj != NULL) {
8888         /* Not binding to an object, or already bound */
8889         Py_INCREF(self);
8890         return self;
8891     }
8892     if (!Py_IS_TYPE(su, &PySuper_Type))
8893         /* If su is an instance of a (strict) subclass of super,
8894            call its type */
8895         return PyObject_CallFunctionObjArgs((PyObject *)Py_TYPE(su),
8896                                             su->type, obj, NULL);
8897     else {
8898         /* Inline the common case */
8899         PyTypeObject *obj_type = supercheck(su->type, obj);
8900         if (obj_type == NULL)
8901             return NULL;
8902         newobj = (superobject *)PySuper_Type.tp_new(&PySuper_Type,
8903                                                  NULL, NULL);
8904         if (newobj == NULL)
8905             return NULL;
8906         Py_INCREF(su->type);
8907         Py_INCREF(obj);
8908         newobj->type = su->type;
8909         newobj->obj = obj;
8910         newobj->obj_type = obj_type;
8911         return (PyObject *)newobj;
8912     }
8913 }
8914 
8915 static int
super_init_without_args(PyFrameObject * f,PyCodeObject * co,PyTypeObject ** type_p,PyObject ** obj_p)8916 super_init_without_args(PyFrameObject *f, PyCodeObject *co,
8917                         PyTypeObject **type_p, PyObject **obj_p)
8918 {
8919     if (co->co_argcount == 0) {
8920         PyErr_SetString(PyExc_RuntimeError,
8921                         "super(): no arguments");
8922         return -1;
8923     }
8924 
8925     assert(f->f_frame->f_code->co_nlocalsplus > 0);
8926     PyObject *firstarg = _PyFrame_GetLocalsArray(f->f_frame)[0];
8927     // The first argument might be a cell.
8928     if (firstarg != NULL && (_PyLocals_GetKind(co->co_localspluskinds, 0) & CO_FAST_CELL)) {
8929         // "firstarg" is a cell here unless (very unlikely) super()
8930         // was called from the C-API before the first MAKE_CELL op.
8931         if (f->f_frame->f_lasti >= 0) {
8932             assert(_Py_OPCODE(*co->co_firstinstr) == MAKE_CELL || _Py_OPCODE(*co->co_firstinstr) == COPY_FREE_VARS);
8933             assert(PyCell_Check(firstarg));
8934             firstarg = PyCell_GET(firstarg);
8935         }
8936     }
8937     if (firstarg == NULL) {
8938         PyErr_SetString(PyExc_RuntimeError,
8939                         "super(): arg[0] deleted");
8940         return -1;
8941     }
8942 
8943     // Look for __class__ in the free vars.
8944     PyTypeObject *type = NULL;
8945     int i = co->co_nlocals + co->co_nplaincellvars;
8946     for (; i < co->co_nlocalsplus; i++) {
8947         assert((_PyLocals_GetKind(co->co_localspluskinds, i) & CO_FAST_FREE) != 0);
8948         PyObject *name = PyTuple_GET_ITEM(co->co_localsplusnames, i);
8949         assert(PyUnicode_Check(name));
8950         if (_PyUnicode_EqualToASCIIId(name, &PyId___class__)) {
8951             PyObject *cell = _PyFrame_GetLocalsArray(f->f_frame)[i];
8952             if (cell == NULL || !PyCell_Check(cell)) {
8953                 PyErr_SetString(PyExc_RuntimeError,
8954                   "super(): bad __class__ cell");
8955                 return -1;
8956             }
8957             type = (PyTypeObject *) PyCell_GET(cell);
8958             if (type == NULL) {
8959                 PyErr_SetString(PyExc_RuntimeError,
8960                   "super(): empty __class__ cell");
8961                 return -1;
8962             }
8963             if (!PyType_Check(type)) {
8964                 PyErr_Format(PyExc_RuntimeError,
8965                   "super(): __class__ is not a type (%s)",
8966                   Py_TYPE(type)->tp_name);
8967                 return -1;
8968             }
8969             break;
8970         }
8971     }
8972     if (type == NULL) {
8973         PyErr_SetString(PyExc_RuntimeError,
8974                         "super(): __class__ cell not found");
8975         return -1;
8976     }
8977 
8978     *type_p = type;
8979     *obj_p = firstarg;
8980     return 0;
8981 }
8982 
8983 static int
super_init(PyObject * self,PyObject * args,PyObject * kwds)8984 super_init(PyObject *self, PyObject *args, PyObject *kwds)
8985 {
8986     superobject *su = (superobject *)self;
8987     PyTypeObject *type = NULL;
8988     PyObject *obj = NULL;
8989     PyTypeObject *obj_type = NULL;
8990 
8991     if (!_PyArg_NoKeywords("super", kwds))
8992         return -1;
8993     if (!PyArg_ParseTuple(args, "|O!O:super", &PyType_Type, &type, &obj))
8994         return -1;
8995 
8996     if (type == NULL) {
8997         /* Call super(), without args -- fill in from __class__
8998            and first local variable on the stack. */
8999         PyThreadState *tstate = _PyThreadState_GET();
9000         PyFrameObject *frame = PyThreadState_GetFrame(tstate);
9001         if (frame == NULL) {
9002             PyErr_SetString(PyExc_RuntimeError,
9003                             "super(): no current frame");
9004             return -1;
9005         }
9006 
9007         PyCodeObject *code = PyFrame_GetCode(frame);
9008         int res = super_init_without_args(frame, code, &type, &obj);
9009         Py_DECREF(frame);
9010         Py_DECREF(code);
9011 
9012         if (res < 0) {
9013             return -1;
9014         }
9015     }
9016 
9017     if (obj == Py_None)
9018         obj = NULL;
9019     if (obj != NULL) {
9020         obj_type = supercheck(type, obj);
9021         if (obj_type == NULL)
9022             return -1;
9023         Py_INCREF(obj);
9024     }
9025     Py_INCREF(type);
9026     Py_XSETREF(su->type, type);
9027     Py_XSETREF(su->obj, obj);
9028     Py_XSETREF(su->obj_type, obj_type);
9029     return 0;
9030 }
9031 
9032 PyDoc_STRVAR(super_doc,
9033 "super() -> same as super(__class__, <first argument>)\n"
9034 "super(type) -> unbound super object\n"
9035 "super(type, obj) -> bound super object; requires isinstance(obj, type)\n"
9036 "super(type, type2) -> bound super object; requires issubclass(type2, type)\n"
9037 "Typical use to call a cooperative superclass method:\n"
9038 "class C(B):\n"
9039 "    def meth(self, arg):\n"
9040 "        super().meth(arg)\n"
9041 "This works for class methods too:\n"
9042 "class C(B):\n"
9043 "    @classmethod\n"
9044 "    def cmeth(cls, arg):\n"
9045 "        super().cmeth(arg)\n");
9046 
9047 static int
super_traverse(PyObject * self,visitproc visit,void * arg)9048 super_traverse(PyObject *self, visitproc visit, void *arg)
9049 {
9050     superobject *su = (superobject *)self;
9051 
9052     Py_VISIT(su->obj);
9053     Py_VISIT(su->type);
9054     Py_VISIT(su->obj_type);
9055 
9056     return 0;
9057 }
9058 
9059 PyTypeObject PySuper_Type = {
9060     PyVarObject_HEAD_INIT(&PyType_Type, 0)
9061     "super",                                    /* tp_name */
9062     sizeof(superobject),                        /* tp_basicsize */
9063     0,                                          /* tp_itemsize */
9064     /* methods */
9065     super_dealloc,                              /* tp_dealloc */
9066     0,                                          /* tp_vectorcall_offset */
9067     0,                                          /* tp_getattr */
9068     0,                                          /* tp_setattr */
9069     0,                                          /* tp_as_async */
9070     super_repr,                                 /* tp_repr */
9071     0,                                          /* tp_as_number */
9072     0,                                          /* tp_as_sequence */
9073     0,                                          /* tp_as_mapping */
9074     0,                                          /* tp_hash */
9075     0,                                          /* tp_call */
9076     0,                                          /* tp_str */
9077     super_getattro,                             /* tp_getattro */
9078     0,                                          /* tp_setattro */
9079     0,                                          /* tp_as_buffer */
9080     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
9081         Py_TPFLAGS_BASETYPE,                    /* tp_flags */
9082     super_doc,                                  /* tp_doc */
9083     super_traverse,                             /* tp_traverse */
9084     0,                                          /* tp_clear */
9085     0,                                          /* tp_richcompare */
9086     0,                                          /* tp_weaklistoffset */
9087     0,                                          /* tp_iter */
9088     0,                                          /* tp_iternext */
9089     0,                                          /* tp_methods */
9090     super_members,                              /* tp_members */
9091     0,                                          /* tp_getset */
9092     0,                                          /* tp_base */
9093     0,                                          /* tp_dict */
9094     super_descr_get,                            /* tp_descr_get */
9095     0,                                          /* tp_descr_set */
9096     0,                                          /* tp_dictoffset */
9097     super_init,                                 /* tp_init */
9098     PyType_GenericAlloc,                        /* tp_alloc */
9099     PyType_GenericNew,                          /* tp_new */
9100     PyObject_GC_Del,                            /* tp_free */
9101 };
9102