1 /* Type object implementation */
2 
3 #include "Python.h"
4 #include "internal/pystate.h"
5 #include "frameobject.h"
6 #include "structmember.h"
7 
8 #include <ctype.h>
9 
10 /*[clinic input]
11 class type "PyTypeObject *" "&PyType_Type"
12 class object "PyObject *" "&PyBaseObject_Type"
13 [clinic start generated code]*/
14 /*[clinic end generated code: output=da39a3ee5e6b4b0d input=4b94608d231c434b]*/
15 
16 #include "clinic/typeobject.c.h"
17 
18 /* Support type attribute cache */
19 
20 /* The cache can keep references to the names alive for longer than
21    they normally would.  This is why the maximum size is limited to
22    MCACHE_MAX_ATTR_SIZE, since it might be a problem if very large
23    strings are used as attribute names. */
24 #define MCACHE_MAX_ATTR_SIZE    100
25 #define MCACHE_SIZE_EXP         12
26 #define MCACHE_HASH(version, name_hash)                                 \
27         (((unsigned int)(version) ^ (unsigned int)(name_hash))          \
28          & ((1 << MCACHE_SIZE_EXP) - 1))
29 
30 #define MCACHE_HASH_METHOD(type, name)                                  \
31         MCACHE_HASH((type)->tp_version_tag,                     \
32                     ((PyASCIIObject *)(name))->hash)
33 #define MCACHE_CACHEABLE_NAME(name)                             \
34         PyUnicode_CheckExact(name) &&                           \
35         PyUnicode_IS_READY(name) &&                             \
36         PyUnicode_GET_LENGTH(name) <= MCACHE_MAX_ATTR_SIZE
37 
38 struct method_cache_entry {
39     unsigned int version;
40     PyObject *name;             /* reference to exactly a str or None */
41     PyObject *value;            /* borrowed */
42 };
43 
44 static struct method_cache_entry method_cache[1 << MCACHE_SIZE_EXP];
45 static unsigned int next_version_tag = 0;
46 
47 #define MCACHE_STATS 0
48 
49 #if MCACHE_STATS
50 static size_t method_cache_hits = 0;
51 static size_t method_cache_misses = 0;
52 static size_t method_cache_collisions = 0;
53 #endif
54 
55 /* alphabetical order */
56 _Py_IDENTIFIER(__abstractmethods__);
57 _Py_IDENTIFIER(__class__);
58 _Py_IDENTIFIER(__class_getitem__);
59 _Py_IDENTIFIER(__delitem__);
60 _Py_IDENTIFIER(__dict__);
61 _Py_IDENTIFIER(__doc__);
62 _Py_IDENTIFIER(__getattribute__);
63 _Py_IDENTIFIER(__getitem__);
64 _Py_IDENTIFIER(__hash__);
65 _Py_IDENTIFIER(__init_subclass__);
66 _Py_IDENTIFIER(__len__);
67 _Py_IDENTIFIER(__module__);
68 _Py_IDENTIFIER(__name__);
69 _Py_IDENTIFIER(__new__);
70 _Py_IDENTIFIER(__set_name__);
71 _Py_IDENTIFIER(__setitem__);
72 _Py_IDENTIFIER(builtins);
73 
74 static PyObject *
75 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
76 
77 static void
78 clear_slotdefs(void);
79 
80 static PyObject *
81 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound);
82 
83 /*
84  * finds the beginning of the docstring's introspection signature.
85  * if present, returns a pointer pointing to the first '('.
86  * otherwise returns NULL.
87  *
88  * doesn't guarantee that the signature is valid, only that it
89  * has a valid prefix.  (the signature must also pass skip_signature.)
90  */
91 static const char *
find_signature(const char * name,const char * doc)92 find_signature(const char *name, const char *doc)
93 {
94     const char *dot;
95     size_t length;
96 
97     if (!doc)
98         return NULL;
99 
100     assert(name != NULL);
101 
102     /* for dotted names like classes, only use the last component */
103     dot = strrchr(name, '.');
104     if (dot)
105         name = dot + 1;
106 
107     length = strlen(name);
108     if (strncmp(doc, name, length))
109         return NULL;
110     doc += length;
111     if (*doc != '(')
112         return NULL;
113     return doc;
114 }
115 
116 #define SIGNATURE_END_MARKER         ")\n--\n\n"
117 #define SIGNATURE_END_MARKER_LENGTH  6
118 /*
119  * skips past the end of the docstring's instrospection signature.
120  * (assumes doc starts with a valid signature prefix.)
121  */
122 static const char *
skip_signature(const char * doc)123 skip_signature(const char *doc)
124 {
125     while (*doc) {
126         if ((*doc == *SIGNATURE_END_MARKER) &&
127             !strncmp(doc, SIGNATURE_END_MARKER, SIGNATURE_END_MARKER_LENGTH))
128             return doc + SIGNATURE_END_MARKER_LENGTH;
129         if ((*doc == '\n') && (doc[1] == '\n'))
130             return NULL;
131         doc++;
132     }
133     return NULL;
134 }
135 
136 #ifndef NDEBUG
137 static int
_PyType_CheckConsistency(PyTypeObject * type)138 _PyType_CheckConsistency(PyTypeObject *type)
139 {
140     if (!(type->tp_flags & Py_TPFLAGS_READY)) {
141         /* don't check types before PyType_Ready() */
142         return 1;
143     }
144 
145     assert(!(type->tp_flags & Py_TPFLAGS_READYING));
146     assert(type->tp_mro != NULL && PyTuple_Check(type->tp_mro));
147     assert(type->tp_dict != NULL);
148     return 1;
149 }
150 #endif
151 
152 static const char *
_PyType_DocWithoutSignature(const char * name,const char * internal_doc)153 _PyType_DocWithoutSignature(const char *name, const char *internal_doc)
154 {
155     const char *doc = find_signature(name, internal_doc);
156 
157     if (doc) {
158         doc = skip_signature(doc);
159         if (doc)
160             return doc;
161         }
162     return internal_doc;
163 }
164 
165 PyObject *
_PyType_GetDocFromInternalDoc(const char * name,const char * internal_doc)166 _PyType_GetDocFromInternalDoc(const char *name, const char *internal_doc)
167 {
168     const char *doc = _PyType_DocWithoutSignature(name, internal_doc);
169 
170     if (!doc || *doc == '\0') {
171         Py_RETURN_NONE;
172     }
173 
174     return PyUnicode_FromString(doc);
175 }
176 
177 PyObject *
_PyType_GetTextSignatureFromInternalDoc(const char * name,const char * internal_doc)178 _PyType_GetTextSignatureFromInternalDoc(const char *name, const char *internal_doc)
179 {
180     const char *start = find_signature(name, internal_doc);
181     const char *end;
182 
183     if (start)
184         end = skip_signature(start);
185     else
186         end = NULL;
187     if (!end) {
188         Py_RETURN_NONE;
189     }
190 
191     /* back "end" up until it points just past the final ')' */
192     end -= SIGNATURE_END_MARKER_LENGTH - 1;
193     assert((end - start) >= 2); /* should be "()" at least */
194     assert(end[-1] == ')');
195     assert(end[0] == '\n');
196     return PyUnicode_FromStringAndSize(start, end - start);
197 }
198 
199 unsigned int
PyType_ClearCache(void)200 PyType_ClearCache(void)
201 {
202     Py_ssize_t i;
203     unsigned int cur_version_tag = next_version_tag - 1;
204 
205 #if MCACHE_STATS
206     size_t total = method_cache_hits + method_cache_collisions + method_cache_misses;
207     fprintf(stderr, "-- Method cache hits        = %zd (%d%%)\n",
208             method_cache_hits, (int) (100.0 * method_cache_hits / total));
209     fprintf(stderr, "-- Method cache true misses = %zd (%d%%)\n",
210             method_cache_misses, (int) (100.0 * method_cache_misses / total));
211     fprintf(stderr, "-- Method cache collisions  = %zd (%d%%)\n",
212             method_cache_collisions, (int) (100.0 * method_cache_collisions / total));
213     fprintf(stderr, "-- Method cache size        = %zd KiB\n",
214             sizeof(method_cache) / 1024);
215 #endif
216 
217     for (i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
218         method_cache[i].version = 0;
219         Py_CLEAR(method_cache[i].name);
220         method_cache[i].value = NULL;
221     }
222     next_version_tag = 0;
223     /* mark all version tags as invalid */
224     PyType_Modified(&PyBaseObject_Type);
225     return cur_version_tag;
226 }
227 
228 void
_PyType_Fini(void)229 _PyType_Fini(void)
230 {
231     PyType_ClearCache();
232     clear_slotdefs();
233 }
234 
235 void
PyType_Modified(PyTypeObject * type)236 PyType_Modified(PyTypeObject *type)
237 {
238     /* Invalidate any cached data for the specified type and all
239        subclasses.  This function is called after the base
240        classes, mro, or attributes of the type are altered.
241 
242        Invariants:
243 
244        - Py_TPFLAGS_VALID_VERSION_TAG is never set if
245          Py_TPFLAGS_HAVE_VERSION_TAG is not set (e.g. on type
246          objects coming from non-recompiled extension modules)
247 
248        - before Py_TPFLAGS_VALID_VERSION_TAG can be set on a type,
249          it must first be set on all super types.
250 
251        This function clears the Py_TPFLAGS_VALID_VERSION_TAG of a
252        type (so it must first clear it on all subclasses).  The
253        tp_version_tag value is meaningless unless this flag is set.
254        We don't assign new version tags eagerly, but only as
255        needed.
256      */
257     PyObject *raw, *ref;
258     Py_ssize_t i;
259 
260     if (!PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
261         return;
262 
263     raw = type->tp_subclasses;
264     if (raw != NULL) {
265         assert(PyDict_CheckExact(raw));
266         i = 0;
267         while (PyDict_Next(raw, &i, NULL, &ref)) {
268             assert(PyWeakref_CheckRef(ref));
269             ref = PyWeakref_GET_OBJECT(ref);
270             if (ref != Py_None) {
271                 PyType_Modified((PyTypeObject *)ref);
272             }
273         }
274     }
275     type->tp_flags &= ~Py_TPFLAGS_VALID_VERSION_TAG;
276 }
277 
278 static void
type_mro_modified(PyTypeObject * type,PyObject * bases)279 type_mro_modified(PyTypeObject *type, PyObject *bases) {
280     /*
281        Check that all base classes or elements of the MRO of type are
282        able to be cached.  This function is called after the base
283        classes or mro of the type are altered.
284 
285        Unset HAVE_VERSION_TAG and VALID_VERSION_TAG if the type
286        has a custom MRO that includes a type which is not officially
287        super type, or if the type implements its own mro() method.
288 
289        Called from mro_internal, which will subsequently be called on
290        each subclass when their mro is recursively updated.
291      */
292     Py_ssize_t i, n;
293     int custom = (Py_TYPE(type) != &PyType_Type);
294     int unbound;
295     PyObject *mro_meth = NULL;
296     PyObject *type_mro_meth = NULL;
297 
298     if (!PyType_HasFeature(type, Py_TPFLAGS_HAVE_VERSION_TAG))
299         return;
300 
301     if (custom) {
302         _Py_IDENTIFIER(mro);
303         mro_meth = lookup_maybe_method(
304             (PyObject *)type, &PyId_mro, &unbound);
305         if (mro_meth == NULL)
306             goto clear;
307         type_mro_meth = lookup_maybe_method(
308             (PyObject *)&PyType_Type, &PyId_mro, &unbound);
309         if (type_mro_meth == NULL)
310             goto clear;
311         if (mro_meth != type_mro_meth)
312             goto clear;
313         Py_XDECREF(mro_meth);
314         Py_XDECREF(type_mro_meth);
315     }
316     n = PyTuple_GET_SIZE(bases);
317     for (i = 0; i < n; i++) {
318         PyObject *b = PyTuple_GET_ITEM(bases, i);
319         PyTypeObject *cls;
320 
321         assert(PyType_Check(b));
322         cls = (PyTypeObject *)b;
323 
324         if (!PyType_HasFeature(cls, Py_TPFLAGS_HAVE_VERSION_TAG) ||
325             !PyType_IsSubtype(type, cls)) {
326             goto clear;
327         }
328     }
329     return;
330  clear:
331     Py_XDECREF(mro_meth);
332     Py_XDECREF(type_mro_meth);
333     type->tp_flags &= ~(Py_TPFLAGS_HAVE_VERSION_TAG|
334                         Py_TPFLAGS_VALID_VERSION_TAG);
335 }
336 
337 static int
assign_version_tag(PyTypeObject * type)338 assign_version_tag(PyTypeObject *type)
339 {
340     /* Ensure that the tp_version_tag is valid and set
341        Py_TPFLAGS_VALID_VERSION_TAG.  To respect the invariant, this
342        must first be done on all super classes.  Return 0 if this
343        cannot be done, 1 if Py_TPFLAGS_VALID_VERSION_TAG.
344     */
345     Py_ssize_t i, n;
346     PyObject *bases;
347 
348     if (PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
349         return 1;
350     if (!PyType_HasFeature(type, Py_TPFLAGS_HAVE_VERSION_TAG))
351         return 0;
352     if (!PyType_HasFeature(type, Py_TPFLAGS_READY))
353         return 0;
354 
355     type->tp_version_tag = next_version_tag++;
356     /* for stress-testing: next_version_tag &= 0xFF; */
357 
358     if (type->tp_version_tag == 0) {
359         /* wrap-around or just starting Python - clear the whole
360            cache by filling names with references to Py_None.
361            Values are also set to NULL for added protection, as they
362            are borrowed reference */
363         for (i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
364             method_cache[i].value = NULL;
365             Py_INCREF(Py_None);
366             Py_XSETREF(method_cache[i].name, Py_None);
367         }
368         /* mark all version tags as invalid */
369         PyType_Modified(&PyBaseObject_Type);
370         return 1;
371     }
372     bases = type->tp_bases;
373     n = PyTuple_GET_SIZE(bases);
374     for (i = 0; i < n; i++) {
375         PyObject *b = PyTuple_GET_ITEM(bases, i);
376         assert(PyType_Check(b));
377         if (!assign_version_tag((PyTypeObject *)b))
378             return 0;
379     }
380     type->tp_flags |= Py_TPFLAGS_VALID_VERSION_TAG;
381     return 1;
382 }
383 
384 
385 static PyMemberDef type_members[] = {
386     {"__basicsize__", T_PYSSIZET, offsetof(PyTypeObject,tp_basicsize),READONLY},
387     {"__itemsize__", T_PYSSIZET, offsetof(PyTypeObject, tp_itemsize), READONLY},
388     {"__flags__", T_ULONG, offsetof(PyTypeObject, tp_flags), READONLY},
389     {"__weakrefoffset__", T_PYSSIZET,
390      offsetof(PyTypeObject, tp_weaklistoffset), READONLY},
391     {"__base__", T_OBJECT, offsetof(PyTypeObject, tp_base), READONLY},
392     {"__dictoffset__", T_PYSSIZET,
393      offsetof(PyTypeObject, tp_dictoffset), READONLY},
394     {"__mro__", T_OBJECT, offsetof(PyTypeObject, tp_mro), READONLY},
395     {0}
396 };
397 
398 static int
check_set_special_type_attr(PyTypeObject * type,PyObject * value,const char * name)399 check_set_special_type_attr(PyTypeObject *type, PyObject *value, const char *name)
400 {
401     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
402         PyErr_Format(PyExc_TypeError,
403                      "can't set %s.%s", type->tp_name, name);
404         return 0;
405     }
406     if (!value) {
407         PyErr_Format(PyExc_TypeError,
408                      "can't delete %s.%s", type->tp_name, name);
409         return 0;
410     }
411     return 1;
412 }
413 
414 const char *
_PyType_Name(PyTypeObject * type)415 _PyType_Name(PyTypeObject *type)
416 {
417     const char *s = strrchr(type->tp_name, '.');
418     if (s == NULL) {
419         s = type->tp_name;
420     }
421     else {
422         s++;
423     }
424     return s;
425 }
426 
427 static PyObject *
type_name(PyTypeObject * type,void * context)428 type_name(PyTypeObject *type, void *context)
429 {
430     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
431         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
432 
433         Py_INCREF(et->ht_name);
434         return et->ht_name;
435     }
436     else {
437         return PyUnicode_FromString(_PyType_Name(type));
438     }
439 }
440 
441 static PyObject *
type_qualname(PyTypeObject * type,void * context)442 type_qualname(PyTypeObject *type, void *context)
443 {
444     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
445         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
446         Py_INCREF(et->ht_qualname);
447         return et->ht_qualname;
448     }
449     else {
450         return PyUnicode_FromString(_PyType_Name(type));
451     }
452 }
453 
454 static int
type_set_name(PyTypeObject * type,PyObject * value,void * context)455 type_set_name(PyTypeObject *type, PyObject *value, void *context)
456 {
457     const char *tp_name;
458     Py_ssize_t name_size;
459 
460     if (!check_set_special_type_attr(type, value, "__name__"))
461         return -1;
462     if (!PyUnicode_Check(value)) {
463         PyErr_Format(PyExc_TypeError,
464                      "can only assign string to %s.__name__, not '%s'",
465                      type->tp_name, Py_TYPE(value)->tp_name);
466         return -1;
467     }
468 
469     tp_name = PyUnicode_AsUTF8AndSize(value, &name_size);
470     if (tp_name == NULL)
471         return -1;
472     if (strlen(tp_name) != (size_t)name_size) {
473         PyErr_SetString(PyExc_ValueError,
474                         "type name must not contain null characters");
475         return -1;
476     }
477 
478     type->tp_name = tp_name;
479     Py_INCREF(value);
480     Py_SETREF(((PyHeapTypeObject*)type)->ht_name, value);
481 
482     return 0;
483 }
484 
485 static int
type_set_qualname(PyTypeObject * type,PyObject * value,void * context)486 type_set_qualname(PyTypeObject *type, PyObject *value, void *context)
487 {
488     PyHeapTypeObject* et;
489 
490     if (!check_set_special_type_attr(type, value, "__qualname__"))
491         return -1;
492     if (!PyUnicode_Check(value)) {
493         PyErr_Format(PyExc_TypeError,
494                      "can only assign string to %s.__qualname__, not '%s'",
495                      type->tp_name, Py_TYPE(value)->tp_name);
496         return -1;
497     }
498 
499     et = (PyHeapTypeObject*)type;
500     Py_INCREF(value);
501     Py_SETREF(et->ht_qualname, value);
502     return 0;
503 }
504 
505 static PyObject *
type_module(PyTypeObject * type,void * context)506 type_module(PyTypeObject *type, void *context)
507 {
508     PyObject *mod;
509 
510     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
511         mod = _PyDict_GetItemId(type->tp_dict, &PyId___module__);
512         if (mod == NULL) {
513             PyErr_Format(PyExc_AttributeError, "__module__");
514             return NULL;
515         }
516         Py_INCREF(mod);
517     }
518     else {
519         const char *s = strrchr(type->tp_name, '.');
520         if (s != NULL) {
521             mod = PyUnicode_FromStringAndSize(
522                 type->tp_name, (Py_ssize_t)(s - type->tp_name));
523             if (mod != NULL)
524                 PyUnicode_InternInPlace(&mod);
525         }
526         else {
527             mod = _PyUnicode_FromId(&PyId_builtins);
528             Py_XINCREF(mod);
529         }
530     }
531     return mod;
532 }
533 
534 static int
type_set_module(PyTypeObject * type,PyObject * value,void * context)535 type_set_module(PyTypeObject *type, PyObject *value, void *context)
536 {
537     if (!check_set_special_type_attr(type, value, "__module__"))
538         return -1;
539 
540     PyType_Modified(type);
541 
542     return _PyDict_SetItemId(type->tp_dict, &PyId___module__, value);
543 }
544 
545 static PyObject *
type_abstractmethods(PyTypeObject * type,void * context)546 type_abstractmethods(PyTypeObject *type, void *context)
547 {
548     PyObject *mod = NULL;
549     /* type itself has an __abstractmethods__ descriptor (this). Don't return
550        that. */
551     if (type != &PyType_Type)
552         mod = _PyDict_GetItemId(type->tp_dict, &PyId___abstractmethods__);
553     if (!mod) {
554         PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
555         if (message)
556             PyErr_SetObject(PyExc_AttributeError, message);
557         return NULL;
558     }
559     Py_INCREF(mod);
560     return mod;
561 }
562 
563 static int
type_set_abstractmethods(PyTypeObject * type,PyObject * value,void * context)564 type_set_abstractmethods(PyTypeObject *type, PyObject *value, void *context)
565 {
566     /* __abstractmethods__ should only be set once on a type, in
567        abc.ABCMeta.__new__, so this function doesn't do anything
568        special to update subclasses.
569     */
570     int abstract, res;
571     if (value != NULL) {
572         abstract = PyObject_IsTrue(value);
573         if (abstract < 0)
574             return -1;
575         res = _PyDict_SetItemId(type->tp_dict, &PyId___abstractmethods__, value);
576     }
577     else {
578         abstract = 0;
579         res = _PyDict_DelItemId(type->tp_dict, &PyId___abstractmethods__);
580         if (res && PyErr_ExceptionMatches(PyExc_KeyError)) {
581             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
582             if (message)
583                 PyErr_SetObject(PyExc_AttributeError, message);
584             return -1;
585         }
586     }
587     if (res == 0) {
588         PyType_Modified(type);
589         if (abstract)
590             type->tp_flags |= Py_TPFLAGS_IS_ABSTRACT;
591         else
592             type->tp_flags &= ~Py_TPFLAGS_IS_ABSTRACT;
593     }
594     return res;
595 }
596 
597 static PyObject *
type_get_bases(PyTypeObject * type,void * context)598 type_get_bases(PyTypeObject *type, void *context)
599 {
600     Py_INCREF(type->tp_bases);
601     return type->tp_bases;
602 }
603 
604 static PyTypeObject *best_base(PyObject *);
605 static int mro_internal(PyTypeObject *, PyObject **);
606 static int type_is_subtype_base_chain(PyTypeObject *, PyTypeObject *);
607 static int compatible_for_assignment(PyTypeObject *, PyTypeObject *, const char *);
608 static int add_subclass(PyTypeObject*, PyTypeObject*);
609 static int add_all_subclasses(PyTypeObject *type, PyObject *bases);
610 static void remove_subclass(PyTypeObject *, PyTypeObject *);
611 static void remove_all_subclasses(PyTypeObject *type, PyObject *bases);
612 static void update_all_slots(PyTypeObject *);
613 
614 typedef int (*update_callback)(PyTypeObject *, void *);
615 static int update_subclasses(PyTypeObject *type, PyObject *name,
616                              update_callback callback, void *data);
617 static int recurse_down_subclasses(PyTypeObject *type, PyObject *name,
618                                    update_callback callback, void *data);
619 
620 static int
mro_hierarchy(PyTypeObject * type,PyObject * temp)621 mro_hierarchy(PyTypeObject *type, PyObject *temp)
622 {
623     int res;
624     PyObject *new_mro, *old_mro;
625     PyObject *tuple;
626     PyObject *subclasses;
627     Py_ssize_t i, n;
628 
629     res = mro_internal(type, &old_mro);
630     if (res <= 0)
631         /* error / reentrance */
632         return res;
633     new_mro = type->tp_mro;
634 
635     if (old_mro != NULL)
636         tuple = PyTuple_Pack(3, type, new_mro, old_mro);
637     else
638         tuple = PyTuple_Pack(2, type, new_mro);
639 
640     if (tuple != NULL)
641         res = PyList_Append(temp, tuple);
642     else
643         res = -1;
644     Py_XDECREF(tuple);
645 
646     if (res < 0) {
647         type->tp_mro = old_mro;
648         Py_DECREF(new_mro);
649         return -1;
650     }
651     Py_XDECREF(old_mro);
652 
653     /* Obtain a copy of subclasses list to iterate over.
654 
655        Otherwise type->tp_subclasses might be altered
656        in the middle of the loop, for example, through a custom mro(),
657        by invoking type_set_bases on some subclass of the type
658        which in turn calls remove_subclass/add_subclass on this type.
659 
660        Finally, this makes things simple avoiding the need to deal
661        with dictionary iterators and weak references.
662     */
663     subclasses = type___subclasses___impl(type);
664     if (subclasses == NULL)
665         return -1;
666     n = PyList_GET_SIZE(subclasses);
667     for (i = 0; i < n; i++) {
668         PyTypeObject *subclass;
669         subclass = (PyTypeObject *)PyList_GET_ITEM(subclasses, i);
670         res = mro_hierarchy(subclass, temp);
671         if (res < 0)
672             break;
673     }
674     Py_DECREF(subclasses);
675 
676     return res;
677 }
678 
679 static int
type_set_bases(PyTypeObject * type,PyObject * new_bases,void * context)680 type_set_bases(PyTypeObject *type, PyObject *new_bases, void *context)
681 {
682     int res = 0;
683     PyObject *temp;
684     PyObject *old_bases;
685     PyTypeObject *new_base, *old_base;
686     Py_ssize_t i;
687 
688     if (!check_set_special_type_attr(type, new_bases, "__bases__"))
689         return -1;
690     if (!PyTuple_Check(new_bases)) {
691         PyErr_Format(PyExc_TypeError,
692              "can only assign tuple to %s.__bases__, not %s",
693                  type->tp_name, Py_TYPE(new_bases)->tp_name);
694         return -1;
695     }
696     if (PyTuple_GET_SIZE(new_bases) == 0) {
697         PyErr_Format(PyExc_TypeError,
698              "can only assign non-empty tuple to %s.__bases__, not ()",
699                  type->tp_name);
700         return -1;
701     }
702     for (i = 0; i < PyTuple_GET_SIZE(new_bases); i++) {
703         PyObject *ob;
704         PyTypeObject *base;
705 
706         ob = PyTuple_GET_ITEM(new_bases, i);
707         if (!PyType_Check(ob)) {
708             PyErr_Format(PyExc_TypeError,
709                          "%s.__bases__ must be tuple of classes, not '%s'",
710                          type->tp_name, Py_TYPE(ob)->tp_name);
711             return -1;
712         }
713 
714         base = (PyTypeObject*)ob;
715         if (PyType_IsSubtype(base, type) ||
716             /* In case of reentering here again through a custom mro()
717                the above check is not enough since it relies on
718                base->tp_mro which would gonna be updated inside
719                mro_internal only upon returning from the mro().
720 
721                However, base->tp_base has already been assigned (see
722                below), which in turn may cause an inheritance cycle
723                through tp_base chain.  And this is definitely
724                not what you want to ever happen.  */
725             (base->tp_mro != NULL && type_is_subtype_base_chain(base, type))) {
726 
727             PyErr_SetString(PyExc_TypeError,
728                             "a __bases__ item causes an inheritance cycle");
729             return -1;
730         }
731     }
732 
733     new_base = best_base(new_bases);
734     if (new_base == NULL)
735         return -1;
736 
737     if (!compatible_for_assignment(type->tp_base, new_base, "__bases__"))
738         return -1;
739 
740     Py_INCREF(new_bases);
741     Py_INCREF(new_base);
742 
743     old_bases = type->tp_bases;
744     old_base = type->tp_base;
745 
746     type->tp_bases = new_bases;
747     type->tp_base = new_base;
748 
749     temp = PyList_New(0);
750     if (temp == NULL)
751         goto bail;
752     if (mro_hierarchy(type, temp) < 0)
753         goto undo;
754     Py_DECREF(temp);
755 
756     /* Take no action in case if type->tp_bases has been replaced
757        through reentrance.  */
758     if (type->tp_bases == new_bases) {
759         /* any base that was in __bases__ but now isn't, we
760            need to remove |type| from its tp_subclasses.
761            conversely, any class now in __bases__ that wasn't
762            needs to have |type| added to its subclasses. */
763 
764         /* for now, sod that: just remove from all old_bases,
765            add to all new_bases */
766         remove_all_subclasses(type, old_bases);
767         res = add_all_subclasses(type, new_bases);
768         update_all_slots(type);
769     }
770 
771     Py_DECREF(old_bases);
772     Py_DECREF(old_base);
773 
774     assert(_PyType_CheckConsistency(type));
775     return res;
776 
777   undo:
778     for (i = PyList_GET_SIZE(temp) - 1; i >= 0; i--) {
779         PyTypeObject *cls;
780         PyObject *new_mro, *old_mro = NULL;
781 
782         PyArg_UnpackTuple(PyList_GET_ITEM(temp, i),
783                           "", 2, 3, &cls, &new_mro, &old_mro);
784         /* Do not rollback if cls has a newer version of MRO.  */
785         if (cls->tp_mro == new_mro) {
786             Py_XINCREF(old_mro);
787             cls->tp_mro = old_mro;
788             Py_DECREF(new_mro);
789         }
790     }
791     Py_DECREF(temp);
792 
793   bail:
794     if (type->tp_bases == new_bases) {
795         assert(type->tp_base == new_base);
796 
797         type->tp_bases = old_bases;
798         type->tp_base = old_base;
799 
800         Py_DECREF(new_bases);
801         Py_DECREF(new_base);
802     }
803     else {
804         Py_DECREF(old_bases);
805         Py_DECREF(old_base);
806     }
807 
808     assert(_PyType_CheckConsistency(type));
809     return -1;
810 }
811 
812 static PyObject *
type_dict(PyTypeObject * type,void * context)813 type_dict(PyTypeObject *type, void *context)
814 {
815     if (type->tp_dict == NULL) {
816         Py_RETURN_NONE;
817     }
818     return PyDictProxy_New(type->tp_dict);
819 }
820 
821 static PyObject *
type_get_doc(PyTypeObject * type,void * context)822 type_get_doc(PyTypeObject *type, void *context)
823 {
824     PyObject *result;
825     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE) && type->tp_doc != NULL) {
826         return _PyType_GetDocFromInternalDoc(type->tp_name, type->tp_doc);
827     }
828     result = _PyDict_GetItemId(type->tp_dict, &PyId___doc__);
829     if (result == NULL) {
830         result = Py_None;
831         Py_INCREF(result);
832     }
833     else if (Py_TYPE(result)->tp_descr_get) {
834         result = Py_TYPE(result)->tp_descr_get(result, NULL,
835                                                (PyObject *)type);
836     }
837     else {
838         Py_INCREF(result);
839     }
840     return result;
841 }
842 
843 static PyObject *
type_get_text_signature(PyTypeObject * type,void * context)844 type_get_text_signature(PyTypeObject *type, void *context)
845 {
846     return _PyType_GetTextSignatureFromInternalDoc(type->tp_name, type->tp_doc);
847 }
848 
849 static int
type_set_doc(PyTypeObject * type,PyObject * value,void * context)850 type_set_doc(PyTypeObject *type, PyObject *value, void *context)
851 {
852     if (!check_set_special_type_attr(type, value, "__doc__"))
853         return -1;
854     PyType_Modified(type);
855     return _PyDict_SetItemId(type->tp_dict, &PyId___doc__, value);
856 }
857 
858 /*[clinic input]
859 type.__instancecheck__ -> bool
860 
861     instance: object
862     /
863 
864 Check if an object is an instance.
865 [clinic start generated code]*/
866 
867 static int
type___instancecheck___impl(PyTypeObject * self,PyObject * instance)868 type___instancecheck___impl(PyTypeObject *self, PyObject *instance)
869 /*[clinic end generated code: output=08b6bf5f591c3618 input=cdbfeaee82c01a0f]*/
870 {
871     return _PyObject_RealIsInstance(instance, (PyObject *)self);
872 }
873 
874 /*[clinic input]
875 type.__subclasscheck__ -> bool
876 
877     subclass: object
878     /
879 
880 Check if a class is a subclass.
881 [clinic start generated code]*/
882 
883 static int
type___subclasscheck___impl(PyTypeObject * self,PyObject * subclass)884 type___subclasscheck___impl(PyTypeObject *self, PyObject *subclass)
885 /*[clinic end generated code: output=97a4e51694500941 input=071b2ca9e03355f4]*/
886 {
887     return _PyObject_RealIsSubclass(subclass, (PyObject *)self);
888 }
889 
890 
891 static PyGetSetDef type_getsets[] = {
892     {"__name__", (getter)type_name, (setter)type_set_name, NULL},
893     {"__qualname__", (getter)type_qualname, (setter)type_set_qualname, NULL},
894     {"__bases__", (getter)type_get_bases, (setter)type_set_bases, NULL},
895     {"__module__", (getter)type_module, (setter)type_set_module, NULL},
896     {"__abstractmethods__", (getter)type_abstractmethods,
897      (setter)type_set_abstractmethods, NULL},
898     {"__dict__",  (getter)type_dict,  NULL, NULL},
899     {"__doc__", (getter)type_get_doc, (setter)type_set_doc, NULL},
900     {"__text_signature__", (getter)type_get_text_signature, NULL, NULL},
901     {0}
902 };
903 
904 static PyObject *
type_repr(PyTypeObject * type)905 type_repr(PyTypeObject *type)
906 {
907     PyObject *mod, *name, *rtn;
908 
909     mod = type_module(type, NULL);
910     if (mod == NULL)
911         PyErr_Clear();
912     else if (!PyUnicode_Check(mod)) {
913         Py_DECREF(mod);
914         mod = NULL;
915     }
916     name = type_qualname(type, NULL);
917     if (name == NULL) {
918         Py_XDECREF(mod);
919         return NULL;
920     }
921 
922     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
923         rtn = PyUnicode_FromFormat("<class '%U.%U'>", mod, name);
924     else
925         rtn = PyUnicode_FromFormat("<class '%s'>", type->tp_name);
926 
927     Py_XDECREF(mod);
928     Py_DECREF(name);
929     return rtn;
930 }
931 
932 static PyObject *
type_call(PyTypeObject * type,PyObject * args,PyObject * kwds)933 type_call(PyTypeObject *type, PyObject *args, PyObject *kwds)
934 {
935     PyObject *obj;
936 
937     if (type->tp_new == NULL) {
938         PyErr_Format(PyExc_TypeError,
939                      "cannot create '%.100s' instances",
940                      type->tp_name);
941         return NULL;
942     }
943 
944 #ifdef Py_DEBUG
945     /* type_call() must not be called with an exception set,
946        because it can clear it (directly or indirectly) and so the
947        caller loses its exception */
948     assert(!PyErr_Occurred());
949 #endif
950 
951     obj = type->tp_new(type, args, kwds);
952     obj = _Py_CheckFunctionResult((PyObject*)type, obj, NULL);
953     if (obj == NULL)
954         return NULL;
955 
956     /* Ugly exception: when the call was type(something),
957        don't call tp_init on the result. */
958     if (type == &PyType_Type &&
959         PyTuple_Check(args) && PyTuple_GET_SIZE(args) == 1 &&
960         (kwds == NULL ||
961          (PyDict_Check(kwds) && PyDict_GET_SIZE(kwds) == 0)))
962         return obj;
963 
964     /* If the returned object is not an instance of type,
965        it won't be initialized. */
966     if (!PyType_IsSubtype(Py_TYPE(obj), type))
967         return obj;
968 
969     type = Py_TYPE(obj);
970     if (type->tp_init != NULL) {
971         int res = type->tp_init(obj, args, kwds);
972         if (res < 0) {
973             assert(PyErr_Occurred());
974             Py_DECREF(obj);
975             obj = NULL;
976         }
977         else {
978             assert(!PyErr_Occurred());
979         }
980     }
981     return obj;
982 }
983 
984 PyObject *
PyType_GenericAlloc(PyTypeObject * type,Py_ssize_t nitems)985 PyType_GenericAlloc(PyTypeObject *type, Py_ssize_t nitems)
986 {
987     PyObject *obj;
988     const size_t size = _PyObject_VAR_SIZE(type, nitems+1);
989     /* note that we need to add one, for the sentinel */
990 
991     if (PyType_IS_GC(type))
992         obj = _PyObject_GC_Malloc(size);
993     else
994         obj = (PyObject *)PyObject_MALLOC(size);
995 
996     if (obj == NULL)
997         return PyErr_NoMemory();
998 
999     memset(obj, '\0', size);
1000 
1001     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE)
1002         Py_INCREF(type);
1003 
1004     if (type->tp_itemsize == 0)
1005         (void)PyObject_INIT(obj, type);
1006     else
1007         (void) PyObject_INIT_VAR((PyVarObject *)obj, type, nitems);
1008 
1009     if (PyType_IS_GC(type))
1010         _PyObject_GC_TRACK(obj);
1011     return obj;
1012 }
1013 
1014 PyObject *
PyType_GenericNew(PyTypeObject * type,PyObject * args,PyObject * kwds)1015 PyType_GenericNew(PyTypeObject *type, PyObject *args, PyObject *kwds)
1016 {
1017     return type->tp_alloc(type, 0);
1018 }
1019 
1020 /* Helpers for subtyping */
1021 
1022 static int
traverse_slots(PyTypeObject * type,PyObject * self,visitproc visit,void * arg)1023 traverse_slots(PyTypeObject *type, PyObject *self, visitproc visit, void *arg)
1024 {
1025     Py_ssize_t i, n;
1026     PyMemberDef *mp;
1027 
1028     n = Py_SIZE(type);
1029     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1030     for (i = 0; i < n; i++, mp++) {
1031         if (mp->type == T_OBJECT_EX) {
1032             char *addr = (char *)self + mp->offset;
1033             PyObject *obj = *(PyObject **)addr;
1034             if (obj != NULL) {
1035                 int err = visit(obj, arg);
1036                 if (err)
1037                     return err;
1038             }
1039         }
1040     }
1041     return 0;
1042 }
1043 
1044 static int
subtype_traverse(PyObject * self,visitproc visit,void * arg)1045 subtype_traverse(PyObject *self, visitproc visit, void *arg)
1046 {
1047     PyTypeObject *type, *base;
1048     traverseproc basetraverse;
1049 
1050     /* Find the nearest base with a different tp_traverse,
1051        and traverse slots while we're at it */
1052     type = Py_TYPE(self);
1053     base = type;
1054     while ((basetraverse = base->tp_traverse) == subtype_traverse) {
1055         if (Py_SIZE(base)) {
1056             int err = traverse_slots(base, self, visit, arg);
1057             if (err)
1058                 return err;
1059         }
1060         base = base->tp_base;
1061         assert(base);
1062     }
1063 
1064     if (type->tp_dictoffset != base->tp_dictoffset) {
1065         PyObject **dictptr = _PyObject_GetDictPtr(self);
1066         if (dictptr && *dictptr)
1067             Py_VISIT(*dictptr);
1068     }
1069 
1070     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE)
1071         /* For a heaptype, the instances count as references
1072            to the type.          Traverse the type so the collector
1073            can find cycles involving this link. */
1074         Py_VISIT(type);
1075 
1076     if (basetraverse)
1077         return basetraverse(self, visit, arg);
1078     return 0;
1079 }
1080 
1081 static void
clear_slots(PyTypeObject * type,PyObject * self)1082 clear_slots(PyTypeObject *type, PyObject *self)
1083 {
1084     Py_ssize_t i, n;
1085     PyMemberDef *mp;
1086 
1087     n = Py_SIZE(type);
1088     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1089     for (i = 0; i < n; i++, mp++) {
1090         if (mp->type == T_OBJECT_EX && !(mp->flags & READONLY)) {
1091             char *addr = (char *)self + mp->offset;
1092             PyObject *obj = *(PyObject **)addr;
1093             if (obj != NULL) {
1094                 *(PyObject **)addr = NULL;
1095                 Py_DECREF(obj);
1096             }
1097         }
1098     }
1099 }
1100 
1101 static int
subtype_clear(PyObject * self)1102 subtype_clear(PyObject *self)
1103 {
1104     PyTypeObject *type, *base;
1105     inquiry baseclear;
1106 
1107     /* Find the nearest base with a different tp_clear
1108        and clear slots while we're at it */
1109     type = Py_TYPE(self);
1110     base = type;
1111     while ((baseclear = base->tp_clear) == subtype_clear) {
1112         if (Py_SIZE(base))
1113             clear_slots(base, self);
1114         base = base->tp_base;
1115         assert(base);
1116     }
1117 
1118     /* Clear the instance dict (if any), to break cycles involving only
1119        __dict__ slots (as in the case 'self.__dict__ is self'). */
1120     if (type->tp_dictoffset != base->tp_dictoffset) {
1121         PyObject **dictptr = _PyObject_GetDictPtr(self);
1122         if (dictptr && *dictptr)
1123             Py_CLEAR(*dictptr);
1124     }
1125 
1126     if (baseclear)
1127         return baseclear(self);
1128     return 0;
1129 }
1130 
1131 static void
subtype_dealloc(PyObject * self)1132 subtype_dealloc(PyObject *self)
1133 {
1134     PyTypeObject *type, *base;
1135     destructor basedealloc;
1136     PyThreadState *tstate = PyThreadState_GET();
1137     int has_finalizer;
1138 
1139     /* Extract the type; we expect it to be a heap type */
1140     type = Py_TYPE(self);
1141     assert(type->tp_flags & Py_TPFLAGS_HEAPTYPE);
1142 
1143     /* Test whether the type has GC exactly once */
1144 
1145     if (!PyType_IS_GC(type)) {
1146         /* It's really rare to find a dynamic type that doesn't have
1147            GC; it can only happen when deriving from 'object' and not
1148            adding any slots or instance variables.  This allows
1149            certain simplifications: there's no need to call
1150            clear_slots(), or DECREF the dict, or clear weakrefs. */
1151 
1152         /* Maybe call finalizer; exit early if resurrected */
1153         if (type->tp_finalize) {
1154             if (PyObject_CallFinalizerFromDealloc(self) < 0)
1155                 return;
1156         }
1157         if (type->tp_del) {
1158             type->tp_del(self);
1159             if (self->ob_refcnt > 0)
1160                 return;
1161         }
1162 
1163         /* Find the nearest base with a different tp_dealloc */
1164         base = type;
1165         while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1166             assert(Py_SIZE(base) == 0);
1167             base = base->tp_base;
1168             assert(base);
1169         }
1170 
1171         /* Extract the type again; tp_del may have changed it */
1172         type = Py_TYPE(self);
1173 
1174         /* Call the base tp_dealloc() */
1175         assert(basedealloc);
1176         basedealloc(self);
1177 
1178         /* Can't reference self beyond this point */
1179         Py_DECREF(type);
1180 
1181         /* Done */
1182         return;
1183     }
1184 
1185     /* We get here only if the type has GC */
1186 
1187     /* UnTrack and re-Track around the trashcan macro, alas */
1188     /* See explanation at end of function for full disclosure */
1189     PyObject_GC_UnTrack(self);
1190     ++_PyRuntime.gc.trash_delete_nesting;
1191     ++ tstate->trash_delete_nesting;
1192     Py_TRASHCAN_SAFE_BEGIN(self);
1193     --_PyRuntime.gc.trash_delete_nesting;
1194     -- tstate->trash_delete_nesting;
1195 
1196     /* Find the nearest base with a different tp_dealloc */
1197     base = type;
1198     while ((/*basedealloc =*/ base->tp_dealloc) == subtype_dealloc) {
1199         base = base->tp_base;
1200         assert(base);
1201     }
1202 
1203     has_finalizer = type->tp_finalize || type->tp_del;
1204 
1205     if (type->tp_finalize) {
1206         _PyObject_GC_TRACK(self);
1207         if (PyObject_CallFinalizerFromDealloc(self) < 0) {
1208             /* Resurrected */
1209             goto endlabel;
1210         }
1211         _PyObject_GC_UNTRACK(self);
1212     }
1213     /*
1214       If we added a weaklist, we clear it. Do this *before* calling tp_del,
1215       clearing slots, or clearing the instance dict.
1216 
1217       GC tracking must be off at this point. weakref callbacks (if any, and
1218       whether directly here or indirectly in something we call) may trigger GC,
1219       and if self is tracked at that point, it will look like trash to GC and GC
1220       will try to delete self again.
1221     */
1222     if (type->tp_weaklistoffset && !base->tp_weaklistoffset)
1223         PyObject_ClearWeakRefs(self);
1224 
1225     if (type->tp_del) {
1226         _PyObject_GC_TRACK(self);
1227         type->tp_del(self);
1228         if (self->ob_refcnt > 0) {
1229             /* Resurrected */
1230             goto endlabel;
1231         }
1232         _PyObject_GC_UNTRACK(self);
1233     }
1234     if (has_finalizer) {
1235         /* New weakrefs could be created during the finalizer call.
1236            If this occurs, clear them out without calling their
1237            finalizers since they might rely on part of the object
1238            being finalized that has already been destroyed. */
1239         if (type->tp_weaklistoffset && !base->tp_weaklistoffset) {
1240             /* Modeled after GET_WEAKREFS_LISTPTR() */
1241             PyWeakReference **list = (PyWeakReference **) \
1242                 PyObject_GET_WEAKREFS_LISTPTR(self);
1243             while (*list)
1244                 _PyWeakref_ClearRef(*list);
1245         }
1246     }
1247 
1248     /*  Clear slots up to the nearest base with a different tp_dealloc */
1249     base = type;
1250     while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1251         if (Py_SIZE(base))
1252             clear_slots(base, self);
1253         base = base->tp_base;
1254         assert(base);
1255     }
1256 
1257     /* If we added a dict, DECREF it */
1258     if (type->tp_dictoffset && !base->tp_dictoffset) {
1259         PyObject **dictptr = _PyObject_GetDictPtr(self);
1260         if (dictptr != NULL) {
1261             PyObject *dict = *dictptr;
1262             if (dict != NULL) {
1263                 Py_DECREF(dict);
1264                 *dictptr = NULL;
1265             }
1266         }
1267     }
1268 
1269     /* Extract the type again; tp_del may have changed it */
1270     type = Py_TYPE(self);
1271 
1272     /* Call the base tp_dealloc(); first retrack self if
1273      * basedealloc knows about gc.
1274      */
1275     if (PyType_IS_GC(base))
1276         _PyObject_GC_TRACK(self);
1277     assert(basedealloc);
1278     basedealloc(self);
1279 
1280     /* Can't reference self beyond this point. It's possible tp_del switched
1281        our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
1282        reference counting. */
1283     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE)
1284       Py_DECREF(type);
1285 
1286   endlabel:
1287     ++_PyRuntime.gc.trash_delete_nesting;
1288     ++ tstate->trash_delete_nesting;
1289     Py_TRASHCAN_SAFE_END(self);
1290     --_PyRuntime.gc.trash_delete_nesting;
1291     -- tstate->trash_delete_nesting;
1292 
1293     /* Explanation of the weirdness around the trashcan macros:
1294 
1295        Q. What do the trashcan macros do?
1296 
1297        A. Read the comment titled "Trashcan mechanism" in object.h.
1298           For one, this explains why there must be a call to GC-untrack
1299           before the trashcan begin macro.      Without understanding the
1300           trashcan code, the answers to the following questions don't make
1301           sense.
1302 
1303        Q. Why do we GC-untrack before the trashcan and then immediately
1304           GC-track again afterward?
1305 
1306        A. In the case that the base class is GC-aware, the base class
1307           probably GC-untracks the object.      If it does that using the
1308           UNTRACK macro, this will crash when the object is already
1309           untracked.  Because we don't know what the base class does, the
1310           only safe thing is to make sure the object is tracked when we
1311           call the base class dealloc.  But...  The trashcan begin macro
1312           requires that the object is *untracked* before it is called.  So
1313           the dance becomes:
1314 
1315          GC untrack
1316          trashcan begin
1317          GC track
1318 
1319        Q. Why did the last question say "immediately GC-track again"?
1320           It's nowhere near immediately.
1321 
1322        A. Because the code *used* to re-track immediately.      Bad Idea.
1323           self has a refcount of 0, and if gc ever gets its hands on it
1324           (which can happen if any weakref callback gets invoked), it
1325           looks like trash to gc too, and gc also tries to delete self
1326           then.  But we're already deleting self.  Double deallocation is
1327           a subtle disaster.
1328 
1329        Q. Why the bizarre (net-zero) manipulation of
1330           _PyRuntime.trash_delete_nesting around the trashcan macros?
1331 
1332        A. Some base classes (e.g. list) also use the trashcan mechanism.
1333           The following scenario used to be possible:
1334 
1335           - suppose the trashcan level is one below the trashcan limit
1336 
1337           - subtype_dealloc() is called
1338 
1339           - the trashcan limit is not yet reached, so the trashcan level
1340         is incremented and the code between trashcan begin and end is
1341         executed
1342 
1343           - this destroys much of the object's contents, including its
1344         slots and __dict__
1345 
1346           - basedealloc() is called; this is really list_dealloc(), or
1347         some other type which also uses the trashcan macros
1348 
1349           - the trashcan limit is now reached, so the object is put on the
1350         trashcan's to-be-deleted-later list
1351 
1352           - basedealloc() returns
1353 
1354           - subtype_dealloc() decrefs the object's type
1355 
1356           - subtype_dealloc() returns
1357 
1358           - later, the trashcan code starts deleting the objects from its
1359         to-be-deleted-later list
1360 
1361           - subtype_dealloc() is called *AGAIN* for the same object
1362 
1363           - at the very least (if the destroyed slots and __dict__ don't
1364         cause problems) the object's type gets decref'ed a second
1365         time, which is *BAD*!!!
1366 
1367           The remedy is to make sure that if the code between trashcan
1368           begin and end in subtype_dealloc() is called, the code between
1369           trashcan begin and end in basedealloc() will also be called.
1370           This is done by decrementing the level after passing into the
1371           trashcan block, and incrementing it just before leaving the
1372           block.
1373 
1374           But now it's possible that a chain of objects consisting solely
1375           of objects whose deallocator is subtype_dealloc() will defeat
1376           the trashcan mechanism completely: the decremented level means
1377           that the effective level never reaches the limit.      Therefore, we
1378           *increment* the level *before* entering the trashcan block, and
1379           matchingly decrement it after leaving.  This means the trashcan
1380           code will trigger a little early, but that's no big deal.
1381 
1382        Q. Are there any live examples of code in need of all this
1383           complexity?
1384 
1385        A. Yes.  See SF bug 668433 for code that crashed (when Python was
1386           compiled in debug mode) before the trashcan level manipulations
1387           were added.  For more discussion, see SF patches 581742, 575073
1388           and bug 574207.
1389     */
1390 }
1391 
1392 static PyTypeObject *solid_base(PyTypeObject *type);
1393 
1394 /* type test with subclassing support */
1395 
1396 static int
type_is_subtype_base_chain(PyTypeObject * a,PyTypeObject * b)1397 type_is_subtype_base_chain(PyTypeObject *a, PyTypeObject *b)
1398 {
1399     do {
1400         if (a == b)
1401             return 1;
1402         a = a->tp_base;
1403     } while (a != NULL);
1404 
1405     return (b == &PyBaseObject_Type);
1406 }
1407 
1408 int
PyType_IsSubtype(PyTypeObject * a,PyTypeObject * b)1409 PyType_IsSubtype(PyTypeObject *a, PyTypeObject *b)
1410 {
1411     PyObject *mro;
1412 
1413     mro = a->tp_mro;
1414     if (mro != NULL) {
1415         /* Deal with multiple inheritance without recursion
1416            by walking the MRO tuple */
1417         Py_ssize_t i, n;
1418         assert(PyTuple_Check(mro));
1419         n = PyTuple_GET_SIZE(mro);
1420         for (i = 0; i < n; i++) {
1421             if (PyTuple_GET_ITEM(mro, i) == (PyObject *)b)
1422                 return 1;
1423         }
1424         return 0;
1425     }
1426     else
1427         /* a is not completely initilized yet; follow tp_base */
1428         return type_is_subtype_base_chain(a, b);
1429 }
1430 
1431 /* Routines to do a method lookup in the type without looking in the
1432    instance dictionary (so we can't use PyObject_GetAttr) but still
1433    binding it to the instance.
1434 
1435    Variants:
1436 
1437    - _PyObject_LookupSpecial() returns NULL without raising an exception
1438      when the _PyType_Lookup() call fails;
1439 
1440    - lookup_maybe_method() and lookup_method() are internal routines similar
1441      to _PyObject_LookupSpecial(), but can return unbound PyFunction
1442      to avoid temporary method object. Pass self as first argument when
1443      unbound == 1.
1444 */
1445 
1446 PyObject *
_PyObject_LookupSpecial(PyObject * self,_Py_Identifier * attrid)1447 _PyObject_LookupSpecial(PyObject *self, _Py_Identifier *attrid)
1448 {
1449     PyObject *res;
1450 
1451     res = _PyType_LookupId(Py_TYPE(self), attrid);
1452     if (res != NULL) {
1453         descrgetfunc f;
1454         if ((f = Py_TYPE(res)->tp_descr_get) == NULL)
1455             Py_INCREF(res);
1456         else
1457             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1458     }
1459     return res;
1460 }
1461 
1462 static PyObject *
lookup_maybe_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1463 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1464 {
1465     PyObject *res = _PyType_LookupId(Py_TYPE(self), attrid);
1466     if (res == NULL) {
1467         return NULL;
1468     }
1469 
1470     if (PyFunction_Check(res)) {
1471         /* Avoid temporary PyMethodObject */
1472         *unbound = 1;
1473         Py_INCREF(res);
1474     }
1475     else {
1476         *unbound = 0;
1477         descrgetfunc f = Py_TYPE(res)->tp_descr_get;
1478         if (f == NULL) {
1479             Py_INCREF(res);
1480         }
1481         else {
1482             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1483         }
1484     }
1485     return res;
1486 }
1487 
1488 static PyObject *
lookup_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1489 lookup_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1490 {
1491     PyObject *res = lookup_maybe_method(self, attrid, unbound);
1492     if (res == NULL && !PyErr_Occurred()) {
1493         PyErr_SetObject(PyExc_AttributeError, attrid->object);
1494     }
1495     return res;
1496 }
1497 
1498 static PyObject*
call_unbound(int unbound,PyObject * func,PyObject * self,PyObject ** args,Py_ssize_t nargs)1499 call_unbound(int unbound, PyObject *func, PyObject *self,
1500              PyObject **args, Py_ssize_t nargs)
1501 {
1502     if (unbound) {
1503         return _PyObject_FastCall_Prepend(func, self, args, nargs);
1504     }
1505     else {
1506         return _PyObject_FastCall(func, args, nargs);
1507     }
1508 }
1509 
1510 static PyObject*
call_unbound_noarg(int unbound,PyObject * func,PyObject * self)1511 call_unbound_noarg(int unbound, PyObject *func, PyObject *self)
1512 {
1513     if (unbound) {
1514         PyObject *args[1] = {self};
1515         return _PyObject_FastCall(func, args, 1);
1516     }
1517     else {
1518         return _PyObject_CallNoArg(func);
1519     }
1520 }
1521 
1522 /* A variation of PyObject_CallMethod* that uses lookup_maybe_method()
1523    instead of PyObject_GetAttrString(). */
1524 static PyObject *
call_method(PyObject * obj,_Py_Identifier * name,PyObject ** args,Py_ssize_t nargs)1525 call_method(PyObject *obj, _Py_Identifier *name,
1526             PyObject **args, Py_ssize_t nargs)
1527 {
1528     int unbound;
1529     PyObject *func, *retval;
1530 
1531     func = lookup_method(obj, name, &unbound);
1532     if (func == NULL) {
1533         return NULL;
1534     }
1535     retval = call_unbound(unbound, func, obj, args, nargs);
1536     Py_DECREF(func);
1537     return retval;
1538 }
1539 
1540 /* Clone of call_method() that returns NotImplemented when the lookup fails. */
1541 
1542 static PyObject *
call_maybe(PyObject * obj,_Py_Identifier * name,PyObject ** args,Py_ssize_t nargs)1543 call_maybe(PyObject *obj, _Py_Identifier *name,
1544            PyObject **args, Py_ssize_t nargs)
1545 {
1546     int unbound;
1547     PyObject *func, *retval;
1548 
1549     func = lookup_maybe_method(obj, name, &unbound);
1550     if (func == NULL) {
1551         if (!PyErr_Occurred())
1552             Py_RETURN_NOTIMPLEMENTED;
1553         return NULL;
1554     }
1555 
1556     retval = call_unbound(unbound, func, obj, args, nargs);
1557     Py_DECREF(func);
1558     return retval;
1559 }
1560 
1561 /*
1562     Method resolution order algorithm C3 described in
1563     "A Monotonic Superclass Linearization for Dylan",
1564     by Kim Barrett, Bob Cassel, Paul Haahr,
1565     David A. Moon, Keith Playford, and P. Tucker Withington.
1566     (OOPSLA 1996)
1567 
1568     Some notes about the rules implied by C3:
1569 
1570     No duplicate bases.
1571     It isn't legal to repeat a class in a list of base classes.
1572 
1573     The next three properties are the 3 constraints in "C3".
1574 
1575     Local precedence order.
1576     If A precedes B in C's MRO, then A will precede B in the MRO of all
1577     subclasses of C.
1578 
1579     Monotonicity.
1580     The MRO of a class must be an extension without reordering of the
1581     MRO of each of its superclasses.
1582 
1583     Extended Precedence Graph (EPG).
1584     Linearization is consistent if there is a path in the EPG from
1585     each class to all its successors in the linearization.  See
1586     the paper for definition of EPG.
1587  */
1588 
1589 static int
tail_contains(PyObject * tuple,int whence,PyObject * o)1590 tail_contains(PyObject *tuple, int whence, PyObject *o)
1591 {
1592     Py_ssize_t j, size;
1593     size = PyTuple_GET_SIZE(tuple);
1594 
1595     for (j = whence+1; j < size; j++) {
1596         if (PyTuple_GET_ITEM(tuple, j) == o)
1597             return 1;
1598     }
1599     return 0;
1600 }
1601 
1602 static PyObject *
class_name(PyObject * cls)1603 class_name(PyObject *cls)
1604 {
1605     PyObject *name = _PyObject_GetAttrId(cls, &PyId___name__);
1606     if (name == NULL) {
1607         PyErr_Clear();
1608         name = PyObject_Repr(cls);
1609     }
1610     if (name == NULL)
1611         return NULL;
1612     if (!PyUnicode_Check(name)) {
1613         Py_DECREF(name);
1614         return NULL;
1615     }
1616     return name;
1617 }
1618 
1619 static int
check_duplicates(PyObject * tuple)1620 check_duplicates(PyObject *tuple)
1621 {
1622     Py_ssize_t i, j, n;
1623     /* Let's use a quadratic time algorithm,
1624        assuming that the bases tuples is short.
1625     */
1626     n = PyTuple_GET_SIZE(tuple);
1627     for (i = 0; i < n; i++) {
1628         PyObject *o = PyTuple_GET_ITEM(tuple, i);
1629         for (j = i + 1; j < n; j++) {
1630             if (PyTuple_GET_ITEM(tuple, j) == o) {
1631                 o = class_name(o);
1632                 if (o != NULL) {
1633                     PyErr_Format(PyExc_TypeError,
1634                                  "duplicate base class %U",
1635                                  o);
1636                     Py_DECREF(o);
1637                 } else {
1638                     PyErr_SetString(PyExc_TypeError,
1639                                  "duplicate base class");
1640                 }
1641                 return -1;
1642             }
1643         }
1644     }
1645     return 0;
1646 }
1647 
1648 /* Raise a TypeError for an MRO order disagreement.
1649 
1650    It's hard to produce a good error message.  In the absence of better
1651    insight into error reporting, report the classes that were candidates
1652    to be put next into the MRO.  There is some conflict between the
1653    order in which they should be put in the MRO, but it's hard to
1654    diagnose what constraint can't be satisfied.
1655 */
1656 
1657 static void
set_mro_error(PyObject ** to_merge,Py_ssize_t to_merge_size,int * remain)1658 set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain)
1659 {
1660     Py_ssize_t i, n, off;
1661     char buf[1000];
1662     PyObject *k, *v;
1663     PyObject *set = PyDict_New();
1664     if (!set) return;
1665 
1666     for (i = 0; i < to_merge_size; i++) {
1667         PyObject *L = to_merge[i];
1668         if (remain[i] < PyTuple_GET_SIZE(L)) {
1669             PyObject *c = PyTuple_GET_ITEM(L, remain[i]);
1670             if (PyDict_SetItem(set, c, Py_None) < 0) {
1671                 Py_DECREF(set);
1672                 return;
1673             }
1674         }
1675     }
1676     n = PyDict_GET_SIZE(set);
1677 
1678     off = PyOS_snprintf(buf, sizeof(buf), "Cannot create a \
1679 consistent method resolution\norder (MRO) for bases");
1680     i = 0;
1681     while (PyDict_Next(set, &i, &k, &v) && (size_t)off < sizeof(buf)) {
1682         PyObject *name = class_name(k);
1683         const char *name_str;
1684         if (name != NULL) {
1685             name_str = PyUnicode_AsUTF8(name);
1686             if (name_str == NULL)
1687                 name_str = "?";
1688         } else
1689             name_str = "?";
1690         off += PyOS_snprintf(buf + off, sizeof(buf) - off, " %s", name_str);
1691         Py_XDECREF(name);
1692         if (--n && (size_t)(off+1) < sizeof(buf)) {
1693             buf[off++] = ',';
1694             buf[off] = '\0';
1695         }
1696     }
1697     PyErr_SetString(PyExc_TypeError, buf);
1698     Py_DECREF(set);
1699 }
1700 
1701 static int
pmerge(PyObject * acc,PyObject ** to_merge,Py_ssize_t to_merge_size)1702 pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
1703 {
1704     int res = 0;
1705     Py_ssize_t i, j, empty_cnt;
1706     int *remain;
1707 
1708     /* remain stores an index into each sublist of to_merge.
1709        remain[i] is the index of the next base in to_merge[i]
1710        that is not included in acc.
1711     */
1712     remain = PyMem_New(int, to_merge_size);
1713     if (remain == NULL) {
1714         PyErr_NoMemory();
1715         return -1;
1716     }
1717     for (i = 0; i < to_merge_size; i++)
1718         remain[i] = 0;
1719 
1720   again:
1721     empty_cnt = 0;
1722     for (i = 0; i < to_merge_size; i++) {
1723         PyObject *candidate;
1724 
1725         PyObject *cur_tuple = to_merge[i];
1726 
1727         if (remain[i] >= PyTuple_GET_SIZE(cur_tuple)) {
1728             empty_cnt++;
1729             continue;
1730         }
1731 
1732         /* Choose next candidate for MRO.
1733 
1734            The input sequences alone can determine the choice.
1735            If not, choose the class which appears in the MRO
1736            of the earliest direct superclass of the new class.
1737         */
1738 
1739         candidate = PyTuple_GET_ITEM(cur_tuple, remain[i]);
1740         for (j = 0; j < to_merge_size; j++) {
1741             PyObject *j_lst = to_merge[j];
1742             if (tail_contains(j_lst, remain[j], candidate))
1743                 goto skip; /* continue outer loop */
1744         }
1745         res = PyList_Append(acc, candidate);
1746         if (res < 0)
1747             goto out;
1748 
1749         for (j = 0; j < to_merge_size; j++) {
1750             PyObject *j_lst = to_merge[j];
1751             if (remain[j] < PyTuple_GET_SIZE(j_lst) &&
1752                 PyTuple_GET_ITEM(j_lst, remain[j]) == candidate) {
1753                 remain[j]++;
1754             }
1755         }
1756         goto again;
1757       skip: ;
1758     }
1759 
1760     if (empty_cnt != to_merge_size) {
1761         set_mro_error(to_merge, to_merge_size, remain);
1762         res = -1;
1763     }
1764 
1765   out:
1766     PyMem_Del(remain);
1767 
1768     return res;
1769 }
1770 
1771 static PyObject *
mro_implementation(PyTypeObject * type)1772 mro_implementation(PyTypeObject *type)
1773 {
1774     PyObject *result;
1775     PyObject *bases;
1776     PyObject **to_merge;
1777     Py_ssize_t i, n;
1778 
1779     if (type->tp_dict == NULL) {
1780         if (PyType_Ready(type) < 0)
1781             return NULL;
1782     }
1783 
1784     bases = type->tp_bases;
1785     assert(PyTuple_Check(bases));
1786     n = PyTuple_GET_SIZE(bases);
1787     for (i = 0; i < n; i++) {
1788         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1789         if (base->tp_mro == NULL) {
1790             PyErr_Format(PyExc_TypeError,
1791                          "Cannot extend an incomplete type '%.100s'",
1792                          base->tp_name);
1793             return NULL;
1794         }
1795         assert(PyTuple_Check(base->tp_mro));
1796     }
1797 
1798     if (n == 1) {
1799         /* Fast path: if there is a single base, constructing the MRO
1800          * is trivial.
1801          */
1802         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, 0);
1803         Py_ssize_t k = PyTuple_GET_SIZE(base->tp_mro);
1804         result = PyTuple_New(k + 1);
1805         if (result == NULL) {
1806             return NULL;
1807         }
1808         Py_INCREF(type);
1809         PyTuple_SET_ITEM(result, 0, (PyObject *) type);
1810         for (i = 0; i < k; i++) {
1811             PyObject *cls = PyTuple_GET_ITEM(base->tp_mro, i);
1812             Py_INCREF(cls);
1813             PyTuple_SET_ITEM(result, i + 1, cls);
1814         }
1815         return result;
1816     }
1817 
1818     /* This is just a basic sanity check. */
1819     if (check_duplicates(bases) < 0) {
1820         return NULL;
1821     }
1822 
1823     /* Find a superclass linearization that honors the constraints
1824        of the explicit tuples of bases and the constraints implied by
1825        each base class.
1826 
1827        to_merge is an array of tuples, where each tuple is a superclass
1828        linearization implied by a base class.  The last element of
1829        to_merge is the declared tuple of bases.
1830     */
1831 
1832     to_merge = PyMem_New(PyObject *, n + 1);
1833     if (to_merge == NULL) {
1834         PyErr_NoMemory();
1835         return NULL;
1836     }
1837 
1838     for (i = 0; i < n; i++) {
1839         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1840         to_merge[i] = base->tp_mro;
1841     }
1842     to_merge[n] = bases;
1843 
1844     result = PyList_New(1);
1845     if (result == NULL) {
1846         PyMem_Del(to_merge);
1847         return NULL;
1848     }
1849 
1850     Py_INCREF(type);
1851     PyList_SET_ITEM(result, 0, (PyObject *)type);
1852     if (pmerge(result, to_merge, n + 1) < 0) {
1853         Py_CLEAR(result);
1854     }
1855 
1856     PyMem_Del(to_merge);
1857     return result;
1858 }
1859 
1860 /*[clinic input]
1861 type.mro
1862 
1863 Return a type's method resolution order.
1864 [clinic start generated code]*/
1865 
1866 static PyObject *
type_mro_impl(PyTypeObject * self)1867 type_mro_impl(PyTypeObject *self)
1868 /*[clinic end generated code: output=bffc4a39b5b57027 input=28414f4e156db28d]*/
1869 {
1870     PyObject *seq;
1871     seq = mro_implementation(self);
1872     if (seq != NULL && !PyList_Check(seq)) {
1873         Py_SETREF(seq, PySequence_List(seq));
1874     }
1875     return seq;
1876 }
1877 
1878 static int
mro_check(PyTypeObject * type,PyObject * mro)1879 mro_check(PyTypeObject *type, PyObject *mro)
1880 {
1881     PyTypeObject *solid;
1882     Py_ssize_t i, n;
1883 
1884     solid = solid_base(type);
1885 
1886     n = PyTuple_GET_SIZE(mro);
1887     for (i = 0; i < n; i++) {
1888         PyTypeObject *base;
1889         PyObject *tmp;
1890 
1891         tmp = PyTuple_GET_ITEM(mro, i);
1892         if (!PyType_Check(tmp)) {
1893             PyErr_Format(
1894                 PyExc_TypeError,
1895                 "mro() returned a non-class ('%.500s')",
1896                 Py_TYPE(tmp)->tp_name);
1897             return -1;
1898         }
1899 
1900         base = (PyTypeObject*)tmp;
1901         if (!PyType_IsSubtype(solid, solid_base(base))) {
1902             PyErr_Format(
1903                 PyExc_TypeError,
1904                 "mro() returned base with unsuitable layout ('%.500s')",
1905                 base->tp_name);
1906             return -1;
1907         }
1908     }
1909 
1910     return 0;
1911 }
1912 
1913 /* Lookups an mcls.mro method, invokes it and checks the result (if needed,
1914    in case of a custom mro() implementation).
1915 
1916    Keep in mind that during execution of this function type->tp_mro
1917    can be replaced due to possible reentrance (for example,
1918    through type_set_bases):
1919 
1920       - when looking up the mcls.mro attribute (it could be
1921         a user-provided descriptor);
1922 
1923       - from inside a custom mro() itself;
1924 
1925       - through a finalizer of the return value of mro().
1926 */
1927 static PyObject *
mro_invoke(PyTypeObject * type)1928 mro_invoke(PyTypeObject *type)
1929 {
1930     PyObject *mro_result;
1931     PyObject *new_mro;
1932     int custom = (Py_TYPE(type) != &PyType_Type);
1933 
1934     if (custom) {
1935         _Py_IDENTIFIER(mro);
1936         int unbound;
1937         PyObject *mro_meth = lookup_method((PyObject *)type, &PyId_mro,
1938                                            &unbound);
1939         if (mro_meth == NULL)
1940             return NULL;
1941         mro_result = call_unbound_noarg(unbound, mro_meth, (PyObject *)type);
1942         Py_DECREF(mro_meth);
1943     }
1944     else {
1945         mro_result = mro_implementation(type);
1946     }
1947     if (mro_result == NULL)
1948         return NULL;
1949 
1950     new_mro = PySequence_Tuple(mro_result);
1951     Py_DECREF(mro_result);
1952     if (new_mro == NULL)
1953         return NULL;
1954 
1955     if (custom && mro_check(type, new_mro) < 0) {
1956         Py_DECREF(new_mro);
1957         return NULL;
1958     }
1959 
1960     return new_mro;
1961 }
1962 
1963 /* Calculates and assigns a new MRO to type->tp_mro.
1964    Return values and invariants:
1965 
1966      - Returns 1 if a new MRO value has been set to type->tp_mro due to
1967        this call of mro_internal (no tricky reentrancy and no errors).
1968 
1969        In case if p_old_mro argument is not NULL, a previous value
1970        of type->tp_mro is put there, and the ownership of this
1971        reference is transferred to a caller.
1972        Otherwise, the previous value (if any) is decref'ed.
1973 
1974      - Returns 0 in case when type->tp_mro gets changed because of
1975        reentering here through a custom mro() (see a comment to mro_invoke).
1976 
1977        In this case, a refcount of an old type->tp_mro is adjusted
1978        somewhere deeper in the call stack (by the innermost mro_internal
1979        or its caller) and may become zero upon returning from here.
1980        This also implies that the whole hierarchy of subclasses of the type
1981        has seen the new value and updated their MRO accordingly.
1982 
1983      - Returns -1 in case of an error.
1984 */
1985 static int
mro_internal(PyTypeObject * type,PyObject ** p_old_mro)1986 mro_internal(PyTypeObject *type, PyObject **p_old_mro)
1987 {
1988     PyObject *new_mro, *old_mro;
1989     int reent;
1990 
1991     /* Keep a reference to be able to do a reentrancy check below.
1992        Don't let old_mro be GC'ed and its address be reused for
1993        another object, like (suddenly!) a new tp_mro.  */
1994     old_mro = type->tp_mro;
1995     Py_XINCREF(old_mro);
1996     new_mro = mro_invoke(type);  /* might cause reentrance */
1997     reent = (type->tp_mro != old_mro);
1998     Py_XDECREF(old_mro);
1999     if (new_mro == NULL)
2000         return -1;
2001 
2002     if (reent) {
2003         Py_DECREF(new_mro);
2004         return 0;
2005     }
2006 
2007     type->tp_mro = new_mro;
2008 
2009     type_mro_modified(type, type->tp_mro);
2010     /* corner case: the super class might have been hidden
2011        from the custom MRO */
2012     type_mro_modified(type, type->tp_bases);
2013 
2014     PyType_Modified(type);
2015 
2016     if (p_old_mro != NULL)
2017         *p_old_mro = old_mro;  /* transfer the ownership */
2018     else
2019         Py_XDECREF(old_mro);
2020 
2021     return 1;
2022 }
2023 
2024 
2025 /* Calculate the best base amongst multiple base classes.
2026    This is the first one that's on the path to the "solid base". */
2027 
2028 static PyTypeObject *
best_base(PyObject * bases)2029 best_base(PyObject *bases)
2030 {
2031     Py_ssize_t i, n;
2032     PyTypeObject *base, *winner, *candidate, *base_i;
2033     PyObject *base_proto;
2034 
2035     assert(PyTuple_Check(bases));
2036     n = PyTuple_GET_SIZE(bases);
2037     assert(n > 0);
2038     base = NULL;
2039     winner = NULL;
2040     for (i = 0; i < n; i++) {
2041         base_proto = PyTuple_GET_ITEM(bases, i);
2042         if (!PyType_Check(base_proto)) {
2043             PyErr_SetString(
2044                 PyExc_TypeError,
2045                 "bases must be types");
2046             return NULL;
2047         }
2048         base_i = (PyTypeObject *)base_proto;
2049         if (base_i->tp_dict == NULL) {
2050             if (PyType_Ready(base_i) < 0)
2051                 return NULL;
2052         }
2053         if (!PyType_HasFeature(base_i, Py_TPFLAGS_BASETYPE)) {
2054             PyErr_Format(PyExc_TypeError,
2055                          "type '%.100s' is not an acceptable base type",
2056                          base_i->tp_name);
2057             return NULL;
2058         }
2059         candidate = solid_base(base_i);
2060         if (winner == NULL) {
2061             winner = candidate;
2062             base = base_i;
2063         }
2064         else if (PyType_IsSubtype(winner, candidate))
2065             ;
2066         else if (PyType_IsSubtype(candidate, winner)) {
2067             winner = candidate;
2068             base = base_i;
2069         }
2070         else {
2071             PyErr_SetString(
2072                 PyExc_TypeError,
2073                 "multiple bases have "
2074                 "instance lay-out conflict");
2075             return NULL;
2076         }
2077     }
2078     assert (base != NULL);
2079 
2080     return base;
2081 }
2082 
2083 static int
extra_ivars(PyTypeObject * type,PyTypeObject * base)2084 extra_ivars(PyTypeObject *type, PyTypeObject *base)
2085 {
2086     size_t t_size = type->tp_basicsize;
2087     size_t b_size = base->tp_basicsize;
2088 
2089     assert(t_size >= b_size); /* Else type smaller than base! */
2090     if (type->tp_itemsize || base->tp_itemsize) {
2091         /* If itemsize is involved, stricter rules */
2092         return t_size != b_size ||
2093             type->tp_itemsize != base->tp_itemsize;
2094     }
2095     if (type->tp_weaklistoffset && base->tp_weaklistoffset == 0 &&
2096         type->tp_weaklistoffset + sizeof(PyObject *) == t_size &&
2097         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2098         t_size -= sizeof(PyObject *);
2099     if (type->tp_dictoffset && base->tp_dictoffset == 0 &&
2100         type->tp_dictoffset + sizeof(PyObject *) == t_size &&
2101         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2102         t_size -= sizeof(PyObject *);
2103 
2104     return t_size != b_size;
2105 }
2106 
2107 static PyTypeObject *
solid_base(PyTypeObject * type)2108 solid_base(PyTypeObject *type)
2109 {
2110     PyTypeObject *base;
2111 
2112     if (type->tp_base)
2113         base = solid_base(type->tp_base);
2114     else
2115         base = &PyBaseObject_Type;
2116     if (extra_ivars(type, base))
2117         return type;
2118     else
2119         return base;
2120 }
2121 
2122 static void object_dealloc(PyObject *);
2123 static int object_init(PyObject *, PyObject *, PyObject *);
2124 static int update_slot(PyTypeObject *, PyObject *);
2125 static void fixup_slot_dispatchers(PyTypeObject *);
2126 static int set_names(PyTypeObject *);
2127 static int init_subclass(PyTypeObject *, PyObject *);
2128 
2129 /*
2130  * Helpers for  __dict__ descriptor.  We don't want to expose the dicts
2131  * inherited from various builtin types.  The builtin base usually provides
2132  * its own __dict__ descriptor, so we use that when we can.
2133  */
2134 static PyTypeObject *
get_builtin_base_with_dict(PyTypeObject * type)2135 get_builtin_base_with_dict(PyTypeObject *type)
2136 {
2137     while (type->tp_base != NULL) {
2138         if (type->tp_dictoffset != 0 &&
2139             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
2140             return type;
2141         type = type->tp_base;
2142     }
2143     return NULL;
2144 }
2145 
2146 static PyObject *
get_dict_descriptor(PyTypeObject * type)2147 get_dict_descriptor(PyTypeObject *type)
2148 {
2149     PyObject *descr;
2150 
2151     descr = _PyType_LookupId(type, &PyId___dict__);
2152     if (descr == NULL || !PyDescr_IsData(descr))
2153         return NULL;
2154 
2155     return descr;
2156 }
2157 
2158 static void
raise_dict_descr_error(PyObject * obj)2159 raise_dict_descr_error(PyObject *obj)
2160 {
2161     PyErr_Format(PyExc_TypeError,
2162                  "this __dict__ descriptor does not support "
2163                  "'%.200s' objects", Py_TYPE(obj)->tp_name);
2164 }
2165 
2166 static PyObject *
subtype_dict(PyObject * obj,void * context)2167 subtype_dict(PyObject *obj, void *context)
2168 {
2169     PyTypeObject *base;
2170 
2171     base = get_builtin_base_with_dict(Py_TYPE(obj));
2172     if (base != NULL) {
2173         descrgetfunc func;
2174         PyObject *descr = get_dict_descriptor(base);
2175         if (descr == NULL) {
2176             raise_dict_descr_error(obj);
2177             return NULL;
2178         }
2179         func = Py_TYPE(descr)->tp_descr_get;
2180         if (func == NULL) {
2181             raise_dict_descr_error(obj);
2182             return NULL;
2183         }
2184         return func(descr, obj, (PyObject *)(Py_TYPE(obj)));
2185     }
2186     return PyObject_GenericGetDict(obj, context);
2187 }
2188 
2189 static int
subtype_setdict(PyObject * obj,PyObject * value,void * context)2190 subtype_setdict(PyObject *obj, PyObject *value, void *context)
2191 {
2192     PyObject **dictptr;
2193     PyTypeObject *base;
2194 
2195     base = get_builtin_base_with_dict(Py_TYPE(obj));
2196     if (base != NULL) {
2197         descrsetfunc func;
2198         PyObject *descr = get_dict_descriptor(base);
2199         if (descr == NULL) {
2200             raise_dict_descr_error(obj);
2201             return -1;
2202         }
2203         func = Py_TYPE(descr)->tp_descr_set;
2204         if (func == NULL) {
2205             raise_dict_descr_error(obj);
2206             return -1;
2207         }
2208         return func(descr, obj, value);
2209     }
2210     /* Almost like PyObject_GenericSetDict, but allow __dict__ to be deleted. */
2211     dictptr = _PyObject_GetDictPtr(obj);
2212     if (dictptr == NULL) {
2213         PyErr_SetString(PyExc_AttributeError,
2214                         "This object has no __dict__");
2215         return -1;
2216     }
2217     if (value != NULL && !PyDict_Check(value)) {
2218         PyErr_Format(PyExc_TypeError,
2219                      "__dict__ must be set to a dictionary, "
2220                      "not a '%.200s'", Py_TYPE(value)->tp_name);
2221         return -1;
2222     }
2223     Py_XINCREF(value);
2224     Py_XSETREF(*dictptr, value);
2225     return 0;
2226 }
2227 
2228 static PyObject *
subtype_getweakref(PyObject * obj,void * context)2229 subtype_getweakref(PyObject *obj, void *context)
2230 {
2231     PyObject **weaklistptr;
2232     PyObject *result;
2233 
2234     if (Py_TYPE(obj)->tp_weaklistoffset == 0) {
2235         PyErr_SetString(PyExc_AttributeError,
2236                         "This object has no __weakref__");
2237         return NULL;
2238     }
2239     assert(Py_TYPE(obj)->tp_weaklistoffset > 0);
2240     assert(Py_TYPE(obj)->tp_weaklistoffset + sizeof(PyObject *) <=
2241            (size_t)(Py_TYPE(obj)->tp_basicsize));
2242     weaklistptr = (PyObject **)
2243         ((char *)obj + Py_TYPE(obj)->tp_weaklistoffset);
2244     if (*weaklistptr == NULL)
2245         result = Py_None;
2246     else
2247         result = *weaklistptr;
2248     Py_INCREF(result);
2249     return result;
2250 }
2251 
2252 /* Three variants on the subtype_getsets list. */
2253 
2254 static PyGetSetDef subtype_getsets_full[] = {
2255     {"__dict__", subtype_dict, subtype_setdict,
2256      PyDoc_STR("dictionary for instance variables (if defined)")},
2257     {"__weakref__", subtype_getweakref, NULL,
2258      PyDoc_STR("list of weak references to the object (if defined)")},
2259     {0}
2260 };
2261 
2262 static PyGetSetDef subtype_getsets_dict_only[] = {
2263     {"__dict__", subtype_dict, subtype_setdict,
2264      PyDoc_STR("dictionary for instance variables (if defined)")},
2265     {0}
2266 };
2267 
2268 static PyGetSetDef subtype_getsets_weakref_only[] = {
2269     {"__weakref__", subtype_getweakref, NULL,
2270      PyDoc_STR("list of weak references to the object (if defined)")},
2271     {0}
2272 };
2273 
2274 static int
valid_identifier(PyObject * s)2275 valid_identifier(PyObject *s)
2276 {
2277     if (!PyUnicode_Check(s)) {
2278         PyErr_Format(PyExc_TypeError,
2279                      "__slots__ items must be strings, not '%.200s'",
2280                      Py_TYPE(s)->tp_name);
2281         return 0;
2282     }
2283     if (!PyUnicode_IsIdentifier(s)) {
2284         PyErr_SetString(PyExc_TypeError,
2285                         "__slots__ must be identifiers");
2286         return 0;
2287     }
2288     return 1;
2289 }
2290 
2291 /* Forward */
2292 static int
2293 object_init(PyObject *self, PyObject *args, PyObject *kwds);
2294 
2295 static int
type_init(PyObject * cls,PyObject * args,PyObject * kwds)2296 type_init(PyObject *cls, PyObject *args, PyObject *kwds)
2297 {
2298     int res;
2299 
2300     assert(args != NULL && PyTuple_Check(args));
2301     assert(kwds == NULL || PyDict_Check(kwds));
2302 
2303     if (kwds != NULL && PyTuple_Check(args) && PyTuple_GET_SIZE(args) == 1 &&
2304         PyDict_Check(kwds) && PyDict_GET_SIZE(kwds) != 0) {
2305         PyErr_SetString(PyExc_TypeError,
2306                         "type.__init__() takes no keyword arguments");
2307         return -1;
2308     }
2309 
2310     if (args != NULL && PyTuple_Check(args) &&
2311         (PyTuple_GET_SIZE(args) != 1 && PyTuple_GET_SIZE(args) != 3)) {
2312         PyErr_SetString(PyExc_TypeError,
2313                         "type.__init__() takes 1 or 3 arguments");
2314         return -1;
2315     }
2316 
2317     /* Call object.__init__(self) now. */
2318     /* XXX Could call super(type, cls).__init__() but what's the point? */
2319     args = PyTuple_GetSlice(args, 0, 0);
2320     if (args == NULL) {
2321         return -1;
2322     }
2323     res = object_init(cls, args, NULL);
2324     Py_DECREF(args);
2325     return res;
2326 }
2327 
2328 unsigned long
PyType_GetFlags(PyTypeObject * type)2329 PyType_GetFlags(PyTypeObject *type)
2330 {
2331     return type->tp_flags;
2332 }
2333 
2334 /* Determine the most derived metatype. */
2335 PyTypeObject *
_PyType_CalculateMetaclass(PyTypeObject * metatype,PyObject * bases)2336 _PyType_CalculateMetaclass(PyTypeObject *metatype, PyObject *bases)
2337 {
2338     Py_ssize_t i, nbases;
2339     PyTypeObject *winner;
2340     PyObject *tmp;
2341     PyTypeObject *tmptype;
2342 
2343     /* Determine the proper metatype to deal with this,
2344        and check for metatype conflicts while we're at it.
2345        Note that if some other metatype wins to contract,
2346        it's possible that its instances are not types. */
2347 
2348     nbases = PyTuple_GET_SIZE(bases);
2349     winner = metatype;
2350     for (i = 0; i < nbases; i++) {
2351         tmp = PyTuple_GET_ITEM(bases, i);
2352         tmptype = Py_TYPE(tmp);
2353         if (PyType_IsSubtype(winner, tmptype))
2354             continue;
2355         if (PyType_IsSubtype(tmptype, winner)) {
2356             winner = tmptype;
2357             continue;
2358         }
2359         /* else: */
2360         PyErr_SetString(PyExc_TypeError,
2361                         "metaclass conflict: "
2362                         "the metaclass of a derived class "
2363                         "must be a (non-strict) subclass "
2364                         "of the metaclasses of all its bases");
2365         return NULL;
2366     }
2367     return winner;
2368 }
2369 
2370 static PyObject *
type_new(PyTypeObject * metatype,PyObject * args,PyObject * kwds)2371 type_new(PyTypeObject *metatype, PyObject *args, PyObject *kwds)
2372 {
2373     PyObject *name, *bases = NULL, *orig_dict, *dict = NULL;
2374     PyObject *qualname, *slots = NULL, *tmp, *newslots, *cell;
2375     PyTypeObject *type = NULL, *base, *tmptype, *winner;
2376     PyHeapTypeObject *et;
2377     PyMemberDef *mp;
2378     Py_ssize_t i, nbases, nslots, slotoffset, name_size;
2379     int j, may_add_dict, may_add_weak, add_dict, add_weak;
2380     _Py_IDENTIFIER(__qualname__);
2381     _Py_IDENTIFIER(__slots__);
2382     _Py_IDENTIFIER(__classcell__);
2383 
2384     assert(args != NULL && PyTuple_Check(args));
2385     assert(kwds == NULL || PyDict_Check(kwds));
2386 
2387     /* Special case: type(x) should return x->ob_type */
2388     /* We only want type itself to accept the one-argument form (#27157)
2389        Note: We don't call PyType_CheckExact as that also allows subclasses */
2390     if (metatype == &PyType_Type) {
2391         const Py_ssize_t nargs = PyTuple_GET_SIZE(args);
2392         const Py_ssize_t nkwds = kwds == NULL ? 0 : PyDict_GET_SIZE(kwds);
2393 
2394         if (nargs == 1 && nkwds == 0) {
2395             PyObject *x = PyTuple_GET_ITEM(args, 0);
2396             Py_INCREF(Py_TYPE(x));
2397             return (PyObject *) Py_TYPE(x);
2398         }
2399 
2400         /* SF bug 475327 -- if that didn't trigger, we need 3
2401            arguments. but PyArg_ParseTuple below may give
2402            a msg saying type() needs exactly 3. */
2403         if (nargs != 3) {
2404             PyErr_SetString(PyExc_TypeError,
2405                             "type() takes 1 or 3 arguments");
2406             return NULL;
2407         }
2408     }
2409 
2410     /* Check arguments: (name, bases, dict) */
2411     if (!PyArg_ParseTuple(args, "UO!O!:type.__new__", &name, &PyTuple_Type,
2412                           &bases, &PyDict_Type, &orig_dict))
2413         return NULL;
2414 
2415     /* Adjust for empty tuple bases */
2416     nbases = PyTuple_GET_SIZE(bases);
2417     if (nbases == 0) {
2418         base = &PyBaseObject_Type;
2419         bases = PyTuple_Pack(1, base);
2420         if (bases == NULL)
2421             return NULL;
2422         nbases = 1;
2423     }
2424     else {
2425         _Py_IDENTIFIER(__mro_entries__);
2426         for (i = 0; i < nbases; i++) {
2427             tmp = PyTuple_GET_ITEM(bases, i);
2428             if (PyType_Check(tmp)) {
2429                 continue;
2430             }
2431             if (_PyObject_LookupAttrId(tmp, &PyId___mro_entries__, &tmp) < 0) {
2432                 return NULL;
2433             }
2434             if (tmp != NULL) {
2435                 PyErr_SetString(PyExc_TypeError,
2436                                 "type() doesn't support MRO entry resolution; "
2437                                 "use types.new_class()");
2438                 Py_DECREF(tmp);
2439                 return NULL;
2440             }
2441         }
2442         /* Search the bases for the proper metatype to deal with this: */
2443         winner = _PyType_CalculateMetaclass(metatype, bases);
2444         if (winner == NULL) {
2445             return NULL;
2446         }
2447 
2448         if (winner != metatype) {
2449             if (winner->tp_new != type_new) /* Pass it to the winner */
2450                 return winner->tp_new(winner, args, kwds);
2451             metatype = winner;
2452         }
2453 
2454         /* Calculate best base, and check that all bases are type objects */
2455         base = best_base(bases);
2456         if (base == NULL) {
2457             return NULL;
2458         }
2459 
2460         Py_INCREF(bases);
2461     }
2462 
2463     /* Use "goto error" from this point on as we now own the reference to "bases". */
2464 
2465     dict = PyDict_Copy(orig_dict);
2466     if (dict == NULL)
2467         goto error;
2468 
2469     /* Check for a __slots__ sequence variable in dict, and count it */
2470     slots = _PyDict_GetItemId(dict, &PyId___slots__);
2471     nslots = 0;
2472     add_dict = 0;
2473     add_weak = 0;
2474     may_add_dict = base->tp_dictoffset == 0;
2475     may_add_weak = base->tp_weaklistoffset == 0 && base->tp_itemsize == 0;
2476     if (slots == NULL) {
2477         if (may_add_dict) {
2478             add_dict++;
2479         }
2480         if (may_add_weak) {
2481             add_weak++;
2482         }
2483     }
2484     else {
2485         /* Have slots */
2486 
2487         /* Make it into a tuple */
2488         if (PyUnicode_Check(slots))
2489             slots = PyTuple_Pack(1, slots);
2490         else
2491             slots = PySequence_Tuple(slots);
2492         if (slots == NULL)
2493             goto error;
2494         assert(PyTuple_Check(slots));
2495 
2496         /* Are slots allowed? */
2497         nslots = PyTuple_GET_SIZE(slots);
2498         if (nslots > 0 && base->tp_itemsize != 0) {
2499             PyErr_Format(PyExc_TypeError,
2500                          "nonempty __slots__ "
2501                          "not supported for subtype of '%s'",
2502                          base->tp_name);
2503             goto error;
2504         }
2505 
2506         /* Check for valid slot names and two special cases */
2507         for (i = 0; i < nslots; i++) {
2508             PyObject *tmp = PyTuple_GET_ITEM(slots, i);
2509             if (!valid_identifier(tmp))
2510                 goto error;
2511             assert(PyUnicode_Check(tmp));
2512             if (_PyUnicode_EqualToASCIIId(tmp, &PyId___dict__)) {
2513                 if (!may_add_dict || add_dict) {
2514                     PyErr_SetString(PyExc_TypeError,
2515                         "__dict__ slot disallowed: "
2516                         "we already got one");
2517                     goto error;
2518                 }
2519                 add_dict++;
2520             }
2521             if (_PyUnicode_EqualToASCIIString(tmp, "__weakref__")) {
2522                 if (!may_add_weak || add_weak) {
2523                     PyErr_SetString(PyExc_TypeError,
2524                         "__weakref__ slot disallowed: "
2525                         "either we already got one, "
2526                         "or __itemsize__ != 0");
2527                     goto error;
2528                 }
2529                 add_weak++;
2530             }
2531         }
2532 
2533         /* Copy slots into a list, mangle names and sort them.
2534            Sorted names are needed for __class__ assignment.
2535            Convert them back to tuple at the end.
2536         */
2537         newslots = PyList_New(nslots - add_dict - add_weak);
2538         if (newslots == NULL)
2539             goto error;
2540         for (i = j = 0; i < nslots; i++) {
2541             tmp = PyTuple_GET_ITEM(slots, i);
2542             if ((add_dict &&
2543                  _PyUnicode_EqualToASCIIId(tmp, &PyId___dict__)) ||
2544                 (add_weak &&
2545                  _PyUnicode_EqualToASCIIString(tmp, "__weakref__")))
2546                 continue;
2547             tmp =_Py_Mangle(name, tmp);
2548             if (!tmp) {
2549                 Py_DECREF(newslots);
2550                 goto error;
2551             }
2552             PyList_SET_ITEM(newslots, j, tmp);
2553             if (PyDict_GetItem(dict, tmp)) {
2554                 /* CPython inserts __qualname__ and __classcell__ (when needed)
2555                    into the namespace when creating a class.  They will be deleted
2556                    below so won't act as class variables. */
2557                 if (!_PyUnicode_EqualToASCIIId(tmp, &PyId___qualname__) &&
2558                     !_PyUnicode_EqualToASCIIId(tmp, &PyId___classcell__)) {
2559                     PyErr_Format(PyExc_ValueError,
2560                                  "%R in __slots__ conflicts with class variable",
2561                                  tmp);
2562                     Py_DECREF(newslots);
2563                     goto error;
2564                 }
2565             }
2566             j++;
2567         }
2568         assert(j == nslots - add_dict - add_weak);
2569         nslots = j;
2570         Py_CLEAR(slots);
2571         if (PyList_Sort(newslots) == -1) {
2572             Py_DECREF(newslots);
2573             goto error;
2574         }
2575         slots = PyList_AsTuple(newslots);
2576         Py_DECREF(newslots);
2577         if (slots == NULL)
2578             goto error;
2579 
2580         /* Secondary bases may provide weakrefs or dict */
2581         if (nbases > 1 &&
2582             ((may_add_dict && !add_dict) ||
2583              (may_add_weak && !add_weak))) {
2584             for (i = 0; i < nbases; i++) {
2585                 tmp = PyTuple_GET_ITEM(bases, i);
2586                 if (tmp == (PyObject *)base)
2587                     continue; /* Skip primary base */
2588                 assert(PyType_Check(tmp));
2589                 tmptype = (PyTypeObject *)tmp;
2590                 if (may_add_dict && !add_dict &&
2591                     tmptype->tp_dictoffset != 0)
2592                     add_dict++;
2593                 if (may_add_weak && !add_weak &&
2594                     tmptype->tp_weaklistoffset != 0)
2595                     add_weak++;
2596                 if (may_add_dict && !add_dict)
2597                     continue;
2598                 if (may_add_weak && !add_weak)
2599                     continue;
2600                 /* Nothing more to check */
2601                 break;
2602             }
2603         }
2604     }
2605 
2606     /* Allocate the type object */
2607     type = (PyTypeObject *)metatype->tp_alloc(metatype, nslots);
2608     if (type == NULL)
2609         goto error;
2610 
2611     /* Keep name and slots alive in the extended type object */
2612     et = (PyHeapTypeObject *)type;
2613     Py_INCREF(name);
2614     et->ht_name = name;
2615     et->ht_slots = slots;
2616     slots = NULL;
2617 
2618     /* Initialize tp_flags */
2619     type->tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HEAPTYPE |
2620         Py_TPFLAGS_BASETYPE | Py_TPFLAGS_HAVE_FINALIZE;
2621     if (base->tp_flags & Py_TPFLAGS_HAVE_GC)
2622         type->tp_flags |= Py_TPFLAGS_HAVE_GC;
2623 
2624     /* Initialize essential fields */
2625     type->tp_as_async = &et->as_async;
2626     type->tp_as_number = &et->as_number;
2627     type->tp_as_sequence = &et->as_sequence;
2628     type->tp_as_mapping = &et->as_mapping;
2629     type->tp_as_buffer = &et->as_buffer;
2630     type->tp_name = PyUnicode_AsUTF8AndSize(name, &name_size);
2631     if (!type->tp_name)
2632         goto error;
2633     if (strlen(type->tp_name) != (size_t)name_size) {
2634         PyErr_SetString(PyExc_ValueError,
2635                         "type name must not contain null characters");
2636         goto error;
2637     }
2638 
2639     /* Set tp_base and tp_bases */
2640     type->tp_bases = bases;
2641     bases = NULL;
2642     Py_INCREF(base);
2643     type->tp_base = base;
2644 
2645     /* Initialize tp_dict from passed-in dict */
2646     Py_INCREF(dict);
2647     type->tp_dict = dict;
2648 
2649     /* Set __module__ in the dict */
2650     if (_PyDict_GetItemId(dict, &PyId___module__) == NULL) {
2651         tmp = PyEval_GetGlobals();
2652         if (tmp != NULL) {
2653             tmp = _PyDict_GetItemId(tmp, &PyId___name__);
2654             if (tmp != NULL) {
2655                 if (_PyDict_SetItemId(dict, &PyId___module__,
2656                                       tmp) < 0)
2657                     goto error;
2658             }
2659         }
2660     }
2661 
2662     /* Set ht_qualname to dict['__qualname__'] if available, else to
2663        __name__.  The __qualname__ accessor will look for ht_qualname.
2664     */
2665     qualname = _PyDict_GetItemId(dict, &PyId___qualname__);
2666     if (qualname != NULL) {
2667         if (!PyUnicode_Check(qualname)) {
2668             PyErr_Format(PyExc_TypeError,
2669                          "type __qualname__ must be a str, not %s",
2670                          Py_TYPE(qualname)->tp_name);
2671             goto error;
2672         }
2673     }
2674     et->ht_qualname = qualname ? qualname : et->ht_name;
2675     Py_INCREF(et->ht_qualname);
2676     if (qualname != NULL && _PyDict_DelItemId(dict, &PyId___qualname__) < 0)
2677         goto error;
2678 
2679     /* Set tp_doc to a copy of dict['__doc__'], if the latter is there
2680        and is a string.  The __doc__ accessor will first look for tp_doc;
2681        if that fails, it will still look into __dict__.
2682     */
2683     {
2684         PyObject *doc = _PyDict_GetItemId(dict, &PyId___doc__);
2685         if (doc != NULL && PyUnicode_Check(doc)) {
2686             Py_ssize_t len;
2687             const char *doc_str;
2688             char *tp_doc;
2689 
2690             doc_str = PyUnicode_AsUTF8(doc);
2691             if (doc_str == NULL)
2692                 goto error;
2693             /* Silently truncate the docstring if it contains null bytes. */
2694             len = strlen(doc_str);
2695             tp_doc = (char *)PyObject_MALLOC(len + 1);
2696             if (tp_doc == NULL) {
2697                 PyErr_NoMemory();
2698                 goto error;
2699             }
2700             memcpy(tp_doc, doc_str, len + 1);
2701             type->tp_doc = tp_doc;
2702         }
2703     }
2704 
2705     /* Special-case __new__: if it's a plain function,
2706        make it a static function */
2707     tmp = _PyDict_GetItemId(dict, &PyId___new__);
2708     if (tmp != NULL && PyFunction_Check(tmp)) {
2709         tmp = PyStaticMethod_New(tmp);
2710         if (tmp == NULL)
2711             goto error;
2712         if (_PyDict_SetItemId(dict, &PyId___new__, tmp) < 0) {
2713             Py_DECREF(tmp);
2714             goto error;
2715         }
2716         Py_DECREF(tmp);
2717     }
2718 
2719     /* Special-case __init_subclass__ and __class_getitem__:
2720        if they are plain functions, make them classmethods */
2721     tmp = _PyDict_GetItemId(dict, &PyId___init_subclass__);
2722     if (tmp != NULL && PyFunction_Check(tmp)) {
2723         tmp = PyClassMethod_New(tmp);
2724         if (tmp == NULL)
2725             goto error;
2726         if (_PyDict_SetItemId(dict, &PyId___init_subclass__, tmp) < 0) {
2727             Py_DECREF(tmp);
2728             goto error;
2729         }
2730         Py_DECREF(tmp);
2731     }
2732 
2733     tmp = _PyDict_GetItemId(dict, &PyId___class_getitem__);
2734     if (tmp != NULL && PyFunction_Check(tmp)) {
2735         tmp = PyClassMethod_New(tmp);
2736         if (tmp == NULL)
2737             goto error;
2738         if (_PyDict_SetItemId(dict, &PyId___class_getitem__, tmp) < 0) {
2739             Py_DECREF(tmp);
2740             goto error;
2741         }
2742         Py_DECREF(tmp);
2743     }
2744 
2745     /* Add descriptors for custom slots from __slots__, or for __dict__ */
2746     mp = PyHeapType_GET_MEMBERS(et);
2747     slotoffset = base->tp_basicsize;
2748     if (et->ht_slots != NULL) {
2749         for (i = 0; i < nslots; i++, mp++) {
2750             mp->name = PyUnicode_AsUTF8(
2751                 PyTuple_GET_ITEM(et->ht_slots, i));
2752             if (mp->name == NULL)
2753                 goto error;
2754             mp->type = T_OBJECT_EX;
2755             mp->offset = slotoffset;
2756 
2757             /* __dict__ and __weakref__ are already filtered out */
2758             assert(strcmp(mp->name, "__dict__") != 0);
2759             assert(strcmp(mp->name, "__weakref__") != 0);
2760 
2761             slotoffset += sizeof(PyObject *);
2762         }
2763     }
2764     if (add_dict) {
2765         if (base->tp_itemsize)
2766             type->tp_dictoffset = -(long)sizeof(PyObject *);
2767         else
2768             type->tp_dictoffset = slotoffset;
2769         slotoffset += sizeof(PyObject *);
2770     }
2771     if (add_weak) {
2772         assert(!base->tp_itemsize);
2773         type->tp_weaklistoffset = slotoffset;
2774         slotoffset += sizeof(PyObject *);
2775     }
2776     type->tp_basicsize = slotoffset;
2777     type->tp_itemsize = base->tp_itemsize;
2778     type->tp_members = PyHeapType_GET_MEMBERS(et);
2779 
2780     if (type->tp_weaklistoffset && type->tp_dictoffset)
2781         type->tp_getset = subtype_getsets_full;
2782     else if (type->tp_weaklistoffset && !type->tp_dictoffset)
2783         type->tp_getset = subtype_getsets_weakref_only;
2784     else if (!type->tp_weaklistoffset && type->tp_dictoffset)
2785         type->tp_getset = subtype_getsets_dict_only;
2786     else
2787         type->tp_getset = NULL;
2788 
2789     /* Special case some slots */
2790     if (type->tp_dictoffset != 0 || nslots > 0) {
2791         if (base->tp_getattr == NULL && base->tp_getattro == NULL)
2792             type->tp_getattro = PyObject_GenericGetAttr;
2793         if (base->tp_setattr == NULL && base->tp_setattro == NULL)
2794             type->tp_setattro = PyObject_GenericSetAttr;
2795     }
2796     type->tp_dealloc = subtype_dealloc;
2797 
2798     /* Enable GC unless this class is not adding new instance variables and
2799        the base class did not use GC. */
2800     if ((base->tp_flags & Py_TPFLAGS_HAVE_GC) ||
2801         type->tp_basicsize > base->tp_basicsize)
2802         type->tp_flags |= Py_TPFLAGS_HAVE_GC;
2803 
2804     /* Always override allocation strategy to use regular heap */
2805     type->tp_alloc = PyType_GenericAlloc;
2806     if (type->tp_flags & Py_TPFLAGS_HAVE_GC) {
2807         type->tp_free = PyObject_GC_Del;
2808         type->tp_traverse = subtype_traverse;
2809         type->tp_clear = subtype_clear;
2810     }
2811     else
2812         type->tp_free = PyObject_Del;
2813 
2814     /* store type in class' cell if one is supplied */
2815     cell = _PyDict_GetItemId(dict, &PyId___classcell__);
2816     if (cell != NULL) {
2817         /* At least one method requires a reference to its defining class */
2818         if (!PyCell_Check(cell)) {
2819             PyErr_Format(PyExc_TypeError,
2820                          "__classcell__ must be a nonlocal cell, not %.200R",
2821                          Py_TYPE(cell));
2822             goto error;
2823         }
2824         PyCell_Set(cell, (PyObject *) type);
2825         _PyDict_DelItemId(dict, &PyId___classcell__);
2826         PyErr_Clear();
2827     }
2828 
2829     /* Initialize the rest */
2830     if (PyType_Ready(type) < 0)
2831         goto error;
2832 
2833     /* Put the proper slots in place */
2834     fixup_slot_dispatchers(type);
2835 
2836     if (type->tp_dictoffset) {
2837         et->ht_cached_keys = _PyDict_NewKeysForClass();
2838     }
2839 
2840     if (set_names(type) < 0)
2841         goto error;
2842 
2843     if (init_subclass(type, kwds) < 0)
2844         goto error;
2845 
2846     Py_DECREF(dict);
2847     return (PyObject *)type;
2848 
2849 error:
2850     Py_XDECREF(dict);
2851     Py_XDECREF(bases);
2852     Py_XDECREF(slots);
2853     Py_XDECREF(type);
2854     return NULL;
2855 }
2856 
2857 static const short slotoffsets[] = {
2858     -1, /* invalid slot */
2859 #include "typeslots.inc"
2860 };
2861 
2862 PyObject *
PyType_FromSpecWithBases(PyType_Spec * spec,PyObject * bases)2863 PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
2864 {
2865     PyHeapTypeObject *res = (PyHeapTypeObject*)PyType_GenericAlloc(&PyType_Type, 0);
2866     PyTypeObject *type, *base;
2867     PyObject *modname;
2868     char *s;
2869     char *res_start = (char*)res;
2870     PyType_Slot *slot;
2871 
2872     if (res == NULL)
2873         return NULL;
2874 
2875     if (spec->name == NULL) {
2876         PyErr_SetString(PyExc_SystemError,
2877                         "Type spec does not define the name field.");
2878         goto fail;
2879     }
2880 
2881     /* Set the type name and qualname */
2882     s = strrchr(spec->name, '.');
2883     if (s == NULL)
2884         s = (char*)spec->name;
2885     else
2886         s++;
2887 
2888     type = &res->ht_type;
2889     /* The flags must be initialized early, before the GC traverses us */
2890     type->tp_flags = spec->flags | Py_TPFLAGS_HEAPTYPE;
2891     res->ht_name = PyUnicode_FromString(s);
2892     if (!res->ht_name)
2893         goto fail;
2894     res->ht_qualname = res->ht_name;
2895     Py_INCREF(res->ht_qualname);
2896     type->tp_name = spec->name;
2897 
2898     /* Adjust for empty tuple bases */
2899     if (!bases) {
2900         base = &PyBaseObject_Type;
2901         /* See whether Py_tp_base(s) was specified */
2902         for (slot = spec->slots; slot->slot; slot++) {
2903             if (slot->slot == Py_tp_base)
2904                 base = slot->pfunc;
2905             else if (slot->slot == Py_tp_bases) {
2906                 bases = slot->pfunc;
2907                 Py_INCREF(bases);
2908             }
2909         }
2910         if (!bases)
2911             bases = PyTuple_Pack(1, base);
2912         if (!bases)
2913             goto fail;
2914     }
2915     else
2916         Py_INCREF(bases);
2917 
2918     /* Calculate best base, and check that all bases are type objects */
2919     base = best_base(bases);
2920     if (base == NULL) {
2921         goto fail;
2922     }
2923     if (!PyType_HasFeature(base, Py_TPFLAGS_BASETYPE)) {
2924         PyErr_Format(PyExc_TypeError,
2925                      "type '%.100s' is not an acceptable base type",
2926                      base->tp_name);
2927         goto fail;
2928     }
2929 
2930     /* Initialize essential fields */
2931     type->tp_as_async = &res->as_async;
2932     type->tp_as_number = &res->as_number;
2933     type->tp_as_sequence = &res->as_sequence;
2934     type->tp_as_mapping = &res->as_mapping;
2935     type->tp_as_buffer = &res->as_buffer;
2936     /* Set tp_base and tp_bases */
2937     type->tp_bases = bases;
2938     bases = NULL;
2939     Py_INCREF(base);
2940     type->tp_base = base;
2941 
2942     type->tp_basicsize = spec->basicsize;
2943     type->tp_itemsize = spec->itemsize;
2944 
2945     for (slot = spec->slots; slot->slot; slot++) {
2946         if (slot->slot < 0
2947             || (size_t)slot->slot >= Py_ARRAY_LENGTH(slotoffsets)) {
2948             PyErr_SetString(PyExc_RuntimeError, "invalid slot offset");
2949             goto fail;
2950         }
2951         if (slot->slot == Py_tp_base || slot->slot == Py_tp_bases)
2952             /* Processed above */
2953             continue;
2954         *(void**)(res_start + slotoffsets[slot->slot]) = slot->pfunc;
2955 
2956         /* need to make a copy of the docstring slot, which usually
2957            points to a static string literal */
2958         if (slot->slot == Py_tp_doc) {
2959             const char *old_doc = _PyType_DocWithoutSignature(type->tp_name, slot->pfunc);
2960             size_t len = strlen(old_doc)+1;
2961             char *tp_doc = PyObject_MALLOC(len);
2962             if (tp_doc == NULL) {
2963                 type->tp_doc = NULL;
2964                 PyErr_NoMemory();
2965                 goto fail;
2966             }
2967             memcpy(tp_doc, old_doc, len);
2968             type->tp_doc = tp_doc;
2969         }
2970     }
2971     if (type->tp_dealloc == NULL) {
2972         /* It's a heap type, so needs the heap types' dealloc.
2973            subtype_dealloc will call the base type's tp_dealloc, if
2974            necessary. */
2975         type->tp_dealloc = subtype_dealloc;
2976     }
2977 
2978     if (PyType_Ready(type) < 0)
2979         goto fail;
2980 
2981     if (type->tp_dictoffset) {
2982         res->ht_cached_keys = _PyDict_NewKeysForClass();
2983     }
2984 
2985     /* Set type.__module__ */
2986     s = strrchr(spec->name, '.');
2987     if (s != NULL) {
2988         int err;
2989         modname = PyUnicode_FromStringAndSize(
2990                 spec->name, (Py_ssize_t)(s - spec->name));
2991         if (modname == NULL) {
2992             goto fail;
2993         }
2994         err = _PyDict_SetItemId(type->tp_dict, &PyId___module__, modname);
2995         Py_DECREF(modname);
2996         if (err != 0)
2997             goto fail;
2998     } else {
2999         if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
3000                 "builtin type %.200s has no __module__ attribute",
3001                 spec->name))
3002             goto fail;
3003     }
3004 
3005     return (PyObject*)res;
3006 
3007  fail:
3008     Py_DECREF(res);
3009     return NULL;
3010 }
3011 
3012 PyObject *
PyType_FromSpec(PyType_Spec * spec)3013 PyType_FromSpec(PyType_Spec *spec)
3014 {
3015     return PyType_FromSpecWithBases(spec, NULL);
3016 }
3017 
3018 void *
PyType_GetSlot(PyTypeObject * type,int slot)3019 PyType_GetSlot(PyTypeObject *type, int slot)
3020 {
3021     if (!PyType_HasFeature(type, Py_TPFLAGS_HEAPTYPE) || slot < 0) {
3022         PyErr_BadInternalCall();
3023         return NULL;
3024     }
3025     if ((size_t)slot >= Py_ARRAY_LENGTH(slotoffsets)) {
3026         /* Extension module requesting slot from a future version */
3027         return NULL;
3028     }
3029     return  *(void**)(((char*)type) + slotoffsets[slot]);
3030 }
3031 
3032 /* Internal API to look for a name through the MRO, bypassing the method cache.
3033    This returns a borrowed reference, and might set an exception.
3034    'error' is set to: -1: error with exception; 1: error without exception; 0: ok */
3035 static PyObject *
find_name_in_mro(PyTypeObject * type,PyObject * name,int * error)3036 find_name_in_mro(PyTypeObject *type, PyObject *name, int *error)
3037 {
3038     Py_ssize_t i, n;
3039     PyObject *mro, *res, *base, *dict;
3040     Py_hash_t hash;
3041 
3042     if (!PyUnicode_CheckExact(name) ||
3043         (hash = ((PyASCIIObject *) name)->hash) == -1)
3044     {
3045         hash = PyObject_Hash(name);
3046         if (hash == -1) {
3047             *error = -1;
3048             return NULL;
3049         }
3050     }
3051 
3052     /* Look in tp_dict of types in MRO */
3053     mro = type->tp_mro;
3054 
3055     if (mro == NULL) {
3056         if ((type->tp_flags & Py_TPFLAGS_READYING) == 0) {
3057             if (PyType_Ready(type) < 0) {
3058                 *error = -1;
3059                 return NULL;
3060             }
3061             mro = type->tp_mro;
3062         }
3063         if (mro == NULL) {
3064             *error = 1;
3065             return NULL;
3066         }
3067     }
3068 
3069     res = NULL;
3070     /* Keep a strong reference to mro because type->tp_mro can be replaced
3071        during dict lookup, e.g. when comparing to non-string keys. */
3072     Py_INCREF(mro);
3073     assert(PyTuple_Check(mro));
3074     n = PyTuple_GET_SIZE(mro);
3075     for (i = 0; i < n; i++) {
3076         base = PyTuple_GET_ITEM(mro, i);
3077         assert(PyType_Check(base));
3078         dict = ((PyTypeObject *)base)->tp_dict;
3079         assert(dict && PyDict_Check(dict));
3080         res = _PyDict_GetItem_KnownHash(dict, name, hash);
3081         if (res != NULL)
3082             break;
3083         if (PyErr_Occurred()) {
3084             *error = -1;
3085             goto done;
3086         }
3087     }
3088     *error = 0;
3089 done:
3090     Py_DECREF(mro);
3091     return res;
3092 }
3093 
3094 /* Internal API to look for a name through the MRO.
3095    This returns a borrowed reference, and doesn't set an exception! */
3096 PyObject *
_PyType_Lookup(PyTypeObject * type,PyObject * name)3097 _PyType_Lookup(PyTypeObject *type, PyObject *name)
3098 {
3099     PyObject *res;
3100     int error;
3101     unsigned int h;
3102 
3103     if (MCACHE_CACHEABLE_NAME(name) &&
3104         PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG)) {
3105         /* fast path */
3106         h = MCACHE_HASH_METHOD(type, name);
3107         if (method_cache[h].version == type->tp_version_tag &&
3108             method_cache[h].name == name) {
3109 #if MCACHE_STATS
3110             method_cache_hits++;
3111 #endif
3112             return method_cache[h].value;
3113         }
3114     }
3115 
3116     /* We may end up clearing live exceptions below, so make sure it's ours. */
3117     assert(!PyErr_Occurred());
3118 
3119     res = find_name_in_mro(type, name, &error);
3120     /* Only put NULL results into cache if there was no error. */
3121     if (error) {
3122         /* It's not ideal to clear the error condition,
3123            but this function is documented as not setting
3124            an exception, and I don't want to change that.
3125            E.g., when PyType_Ready() can't proceed, it won't
3126            set the "ready" flag, so future attempts to ready
3127            the same type will call it again -- hopefully
3128            in a context that propagates the exception out.
3129         */
3130         if (error == -1) {
3131             PyErr_Clear();
3132         }
3133         return NULL;
3134     }
3135 
3136     if (MCACHE_CACHEABLE_NAME(name) && assign_version_tag(type)) {
3137         h = MCACHE_HASH_METHOD(type, name);
3138         method_cache[h].version = type->tp_version_tag;
3139         method_cache[h].value = res;  /* borrowed */
3140         Py_INCREF(name);
3141         assert(((PyASCIIObject *)(name))->hash != -1);
3142 #if MCACHE_STATS
3143         if (method_cache[h].name != Py_None && method_cache[h].name != name)
3144             method_cache_collisions++;
3145         else
3146             method_cache_misses++;
3147 #endif
3148         Py_SETREF(method_cache[h].name, name);
3149     }
3150     return res;
3151 }
3152 
3153 PyObject *
_PyType_LookupId(PyTypeObject * type,struct _Py_Identifier * name)3154 _PyType_LookupId(PyTypeObject *type, struct _Py_Identifier *name)
3155 {
3156     PyObject *oname;
3157     oname = _PyUnicode_FromId(name);   /* borrowed */
3158     if (oname == NULL)
3159         return NULL;
3160     return _PyType_Lookup(type, oname);
3161 }
3162 
3163 /* This is similar to PyObject_GenericGetAttr(),
3164    but uses _PyType_Lookup() instead of just looking in type->tp_dict. */
3165 static PyObject *
type_getattro(PyTypeObject * type,PyObject * name)3166 type_getattro(PyTypeObject *type, PyObject *name)
3167 {
3168     PyTypeObject *metatype = Py_TYPE(type);
3169     PyObject *meta_attribute, *attribute;
3170     descrgetfunc meta_get;
3171     PyObject* res;
3172 
3173     if (!PyUnicode_Check(name)) {
3174         PyErr_Format(PyExc_TypeError,
3175                      "attribute name must be string, not '%.200s'",
3176                      name->ob_type->tp_name);
3177         return NULL;
3178     }
3179 
3180     /* Initialize this type (we'll assume the metatype is initialized) */
3181     if (type->tp_dict == NULL) {
3182         if (PyType_Ready(type) < 0)
3183             return NULL;
3184     }
3185 
3186     /* No readable descriptor found yet */
3187     meta_get = NULL;
3188 
3189     /* Look for the attribute in the metatype */
3190     meta_attribute = _PyType_Lookup(metatype, name);
3191 
3192     if (meta_attribute != NULL) {
3193         Py_INCREF(meta_attribute);
3194         meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
3195 
3196         if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
3197             /* Data descriptors implement tp_descr_set to intercept
3198              * writes. Assume the attribute is not overridden in
3199              * type's tp_dict (and bases): call the descriptor now.
3200              */
3201             res = meta_get(meta_attribute, (PyObject *)type,
3202                            (PyObject *)metatype);
3203             Py_DECREF(meta_attribute);
3204             return res;
3205         }
3206     }
3207 
3208     /* No data descriptor found on metatype. Look in tp_dict of this
3209      * type and its bases */
3210     attribute = _PyType_Lookup(type, name);
3211     if (attribute != NULL) {
3212         /* Implement descriptor functionality, if any */
3213         Py_INCREF(attribute);
3214         descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
3215 
3216         Py_XDECREF(meta_attribute);
3217 
3218         if (local_get != NULL) {
3219             /* NULL 2nd argument indicates the descriptor was
3220              * found on the target object itself (or a base)  */
3221             res = local_get(attribute, (PyObject *)NULL,
3222                             (PyObject *)type);
3223             Py_DECREF(attribute);
3224             return res;
3225         }
3226 
3227         return attribute;
3228     }
3229 
3230     /* No attribute found in local __dict__ (or bases): use the
3231      * descriptor from the metatype, if any */
3232     if (meta_get != NULL) {
3233         PyObject *res;
3234         res = meta_get(meta_attribute, (PyObject *)type,
3235                        (PyObject *)metatype);
3236         Py_DECREF(meta_attribute);
3237         return res;
3238     }
3239 
3240     /* If an ordinary attribute was found on the metatype, return it now */
3241     if (meta_attribute != NULL) {
3242         return meta_attribute;
3243     }
3244 
3245     /* Give up */
3246     PyErr_Format(PyExc_AttributeError,
3247                  "type object '%.50s' has no attribute '%U'",
3248                  type->tp_name, name);
3249     return NULL;
3250 }
3251 
3252 static int
type_setattro(PyTypeObject * type,PyObject * name,PyObject * value)3253 type_setattro(PyTypeObject *type, PyObject *name, PyObject *value)
3254 {
3255     int res;
3256     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
3257         PyErr_Format(
3258             PyExc_TypeError,
3259             "can't set attributes of built-in/extension type '%s'",
3260             type->tp_name);
3261         return -1;
3262     }
3263     if (PyUnicode_Check(name)) {
3264         if (PyUnicode_CheckExact(name)) {
3265             if (PyUnicode_READY(name) == -1)
3266                 return -1;
3267             Py_INCREF(name);
3268         }
3269         else {
3270             name = _PyUnicode_Copy(name);
3271             if (name == NULL)
3272                 return -1;
3273         }
3274         PyUnicode_InternInPlace(&name);
3275         if (!PyUnicode_CHECK_INTERNED(name)) {
3276             PyErr_SetString(PyExc_MemoryError,
3277                             "Out of memory interning an attribute name");
3278             Py_DECREF(name);
3279             return -1;
3280         }
3281     }
3282     else {
3283         /* Will fail in _PyObject_GenericSetAttrWithDict. */
3284         Py_INCREF(name);
3285     }
3286     res = _PyObject_GenericSetAttrWithDict((PyObject *)type, name, value, NULL);
3287     if (res == 0) {
3288         res = update_slot(type, name);
3289         assert(_PyType_CheckConsistency(type));
3290     }
3291     Py_DECREF(name);
3292     return res;
3293 }
3294 
3295 extern void
3296 _PyDictKeys_DecRef(PyDictKeysObject *keys);
3297 
3298 static void
type_dealloc(PyTypeObject * type)3299 type_dealloc(PyTypeObject *type)
3300 {
3301     PyHeapTypeObject *et;
3302     PyObject *tp, *val, *tb;
3303 
3304     /* Assert this is a heap-allocated type object */
3305     assert(type->tp_flags & Py_TPFLAGS_HEAPTYPE);
3306     _PyObject_GC_UNTRACK(type);
3307     PyErr_Fetch(&tp, &val, &tb);
3308     remove_all_subclasses(type, type->tp_bases);
3309     PyErr_Restore(tp, val, tb);
3310     PyObject_ClearWeakRefs((PyObject *)type);
3311     et = (PyHeapTypeObject *)type;
3312     Py_XDECREF(type->tp_base);
3313     Py_XDECREF(type->tp_dict);
3314     Py_XDECREF(type->tp_bases);
3315     Py_XDECREF(type->tp_mro);
3316     Py_XDECREF(type->tp_cache);
3317     Py_XDECREF(type->tp_subclasses);
3318     /* A type's tp_doc is heap allocated, unlike the tp_doc slots
3319      * of most other objects.  It's okay to cast it to char *.
3320      */
3321     PyObject_Free((char *)type->tp_doc);
3322     Py_XDECREF(et->ht_name);
3323     Py_XDECREF(et->ht_qualname);
3324     Py_XDECREF(et->ht_slots);
3325     if (et->ht_cached_keys)
3326         _PyDictKeys_DecRef(et->ht_cached_keys);
3327     Py_TYPE(type)->tp_free((PyObject *)type);
3328 }
3329 
3330 /*[clinic input]
3331 type.__subclasses__
3332 
3333 Return a list of immediate subclasses.
3334 [clinic start generated code]*/
3335 
3336 static PyObject *
type___subclasses___impl(PyTypeObject * self)3337 type___subclasses___impl(PyTypeObject *self)
3338 /*[clinic end generated code: output=eb5eb54485942819 input=5af66132436f9a7b]*/
3339 {
3340     PyObject *list, *raw, *ref;
3341     Py_ssize_t i;
3342 
3343     list = PyList_New(0);
3344     if (list == NULL)
3345         return NULL;
3346     raw = self->tp_subclasses;
3347     if (raw == NULL)
3348         return list;
3349     assert(PyDict_CheckExact(raw));
3350     i = 0;
3351     while (PyDict_Next(raw, &i, NULL, &ref)) {
3352         assert(PyWeakref_CheckRef(ref));
3353         ref = PyWeakref_GET_OBJECT(ref);
3354         if (ref != Py_None) {
3355             if (PyList_Append(list, ref) < 0) {
3356                 Py_DECREF(list);
3357                 return NULL;
3358             }
3359         }
3360     }
3361     return list;
3362 }
3363 
3364 static PyObject *
type_prepare(PyObject * self,PyObject * const * args,Py_ssize_t nargs,PyObject * kwnames)3365 type_prepare(PyObject *self, PyObject *const *args, Py_ssize_t nargs,
3366              PyObject *kwnames)
3367 {
3368     return PyDict_New();
3369 }
3370 
3371 /*
3372    Merge the __dict__ of aclass into dict, and recursively also all
3373    the __dict__s of aclass's base classes.  The order of merging isn't
3374    defined, as it's expected that only the final set of dict keys is
3375    interesting.
3376    Return 0 on success, -1 on error.
3377 */
3378 
3379 static int
merge_class_dict(PyObject * dict,PyObject * aclass)3380 merge_class_dict(PyObject *dict, PyObject *aclass)
3381 {
3382     PyObject *classdict;
3383     PyObject *bases;
3384     _Py_IDENTIFIER(__bases__);
3385 
3386     assert(PyDict_Check(dict));
3387     assert(aclass);
3388 
3389     /* Merge in the type's dict (if any). */
3390     classdict = _PyObject_GetAttrId(aclass, &PyId___dict__);
3391     if (classdict == NULL)
3392         PyErr_Clear();
3393     else {
3394         int status = PyDict_Update(dict, classdict);
3395         Py_DECREF(classdict);
3396         if (status < 0)
3397             return -1;
3398     }
3399 
3400     /* Recursively merge in the base types' (if any) dicts. */
3401     bases = _PyObject_GetAttrId(aclass, &PyId___bases__);
3402     if (bases == NULL)
3403         PyErr_Clear();
3404     else {
3405         /* We have no guarantee that bases is a real tuple */
3406         Py_ssize_t i, n;
3407         n = PySequence_Size(bases); /* This better be right */
3408         if (n < 0)
3409             PyErr_Clear();
3410         else {
3411             for (i = 0; i < n; i++) {
3412                 int status;
3413                 PyObject *base = PySequence_GetItem(bases, i);
3414                 if (base == NULL) {
3415                     Py_DECREF(bases);
3416                     return -1;
3417                 }
3418                 status = merge_class_dict(dict, base);
3419                 Py_DECREF(base);
3420                 if (status < 0) {
3421                     Py_DECREF(bases);
3422                     return -1;
3423                 }
3424             }
3425         }
3426         Py_DECREF(bases);
3427     }
3428     return 0;
3429 }
3430 
3431 /* __dir__ for type objects: returns __dict__ and __bases__.
3432    We deliberately don't suck up its __class__, as methods belonging to the
3433    metaclass would probably be more confusing than helpful.
3434 */
3435 /*[clinic input]
3436 type.__dir__
3437 
3438 Specialized __dir__ implementation for types.
3439 [clinic start generated code]*/
3440 
3441 static PyObject *
type___dir___impl(PyTypeObject * self)3442 type___dir___impl(PyTypeObject *self)
3443 /*[clinic end generated code: output=69d02fe92c0f15fa input=7733befbec645968]*/
3444 {
3445     PyObject *result = NULL;
3446     PyObject *dict = PyDict_New();
3447 
3448     if (dict != NULL && merge_class_dict(dict, (PyObject *)self) == 0)
3449         result = PyDict_Keys(dict);
3450 
3451     Py_XDECREF(dict);
3452     return result;
3453 }
3454 
3455 /*[clinic input]
3456 type.__sizeof__
3457 
3458 Return memory consumption of the type object.
3459 [clinic start generated code]*/
3460 
3461 static PyObject *
type___sizeof___impl(PyTypeObject * self)3462 type___sizeof___impl(PyTypeObject *self)
3463 /*[clinic end generated code: output=766f4f16cd3b1854 input=99398f24b9cf45d6]*/
3464 {
3465     Py_ssize_t size;
3466     if (self->tp_flags & Py_TPFLAGS_HEAPTYPE) {
3467         PyHeapTypeObject* et = (PyHeapTypeObject*)self;
3468         size = sizeof(PyHeapTypeObject);
3469         if (et->ht_cached_keys)
3470             size += _PyDict_KeysSize(et->ht_cached_keys);
3471     }
3472     else
3473         size = sizeof(PyTypeObject);
3474     return PyLong_FromSsize_t(size);
3475 }
3476 
3477 static PyMethodDef type_methods[] = {
3478     TYPE_MRO_METHODDEF
3479     TYPE___SUBCLASSES___METHODDEF
3480     {"__prepare__", (PyCFunction)type_prepare,
3481      METH_FASTCALL | METH_KEYWORDS | METH_CLASS,
3482      PyDoc_STR("__prepare__() -> dict\n"
3483                "used to create the namespace for the class statement")},
3484     TYPE___INSTANCECHECK___METHODDEF
3485     TYPE___SUBCLASSCHECK___METHODDEF
3486     TYPE___DIR___METHODDEF
3487     TYPE___SIZEOF___METHODDEF
3488     {0}
3489 };
3490 
3491 PyDoc_STRVAR(type_doc,
3492 /* this text signature cannot be accurate yet.  will fix.  --larry */
3493 "type(object_or_name, bases, dict)\n"
3494 "type(object) -> the object's type\n"
3495 "type(name, bases, dict) -> a new type");
3496 
3497 static int
type_traverse(PyTypeObject * type,visitproc visit,void * arg)3498 type_traverse(PyTypeObject *type, visitproc visit, void *arg)
3499 {
3500     /* Because of type_is_gc(), the collector only calls this
3501        for heaptypes. */
3502     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
3503         char msg[200];
3504         sprintf(msg, "type_traverse() called for non-heap type '%.100s'",
3505                 type->tp_name);
3506         Py_FatalError(msg);
3507     }
3508 
3509     Py_VISIT(type->tp_dict);
3510     Py_VISIT(type->tp_cache);
3511     Py_VISIT(type->tp_mro);
3512     Py_VISIT(type->tp_bases);
3513     Py_VISIT(type->tp_base);
3514 
3515     /* There's no need to visit type->tp_subclasses or
3516        ((PyHeapTypeObject *)type)->ht_slots, because they can't be involved
3517        in cycles; tp_subclasses is a list of weak references,
3518        and slots is a tuple of strings. */
3519 
3520     return 0;
3521 }
3522 
3523 static int
type_clear(PyTypeObject * type)3524 type_clear(PyTypeObject *type)
3525 {
3526     PyDictKeysObject *cached_keys;
3527     /* Because of type_is_gc(), the collector only calls this
3528        for heaptypes. */
3529     assert(type->tp_flags & Py_TPFLAGS_HEAPTYPE);
3530 
3531     /* We need to invalidate the method cache carefully before clearing
3532        the dict, so that other objects caught in a reference cycle
3533        don't start calling destroyed methods.
3534 
3535        Otherwise, the only field we need to clear is tp_mro, which is
3536        part of a hard cycle (its first element is the class itself) that
3537        won't be broken otherwise (it's a tuple and tuples don't have a
3538        tp_clear handler).  None of the other fields need to be
3539        cleared, and here's why:
3540 
3541        tp_cache:
3542            Not used; if it were, it would be a dict.
3543 
3544        tp_bases, tp_base:
3545            If these are involved in a cycle, there must be at least
3546            one other, mutable object in the cycle, e.g. a base
3547            class's dict; the cycle will be broken that way.
3548 
3549        tp_subclasses:
3550            A dict of weak references can't be part of a cycle; and
3551            dicts have their own tp_clear.
3552 
3553        slots (in PyHeapTypeObject):
3554            A tuple of strings can't be part of a cycle.
3555     */
3556 
3557     PyType_Modified(type);
3558     cached_keys = ((PyHeapTypeObject *)type)->ht_cached_keys;
3559     if (cached_keys != NULL) {
3560         ((PyHeapTypeObject *)type)->ht_cached_keys = NULL;
3561         _PyDictKeys_DecRef(cached_keys);
3562     }
3563     if (type->tp_dict)
3564         PyDict_Clear(type->tp_dict);
3565     Py_CLEAR(type->tp_mro);
3566 
3567     return 0;
3568 }
3569 
3570 static int
type_is_gc(PyTypeObject * type)3571 type_is_gc(PyTypeObject *type)
3572 {
3573     return type->tp_flags & Py_TPFLAGS_HEAPTYPE;
3574 }
3575 
3576 PyTypeObject PyType_Type = {
3577     PyVarObject_HEAD_INIT(&PyType_Type, 0)
3578     "type",                                     /* tp_name */
3579     sizeof(PyHeapTypeObject),                   /* tp_basicsize */
3580     sizeof(PyMemberDef),                        /* tp_itemsize */
3581     (destructor)type_dealloc,                   /* tp_dealloc */
3582     0,                                          /* tp_print */
3583     0,                                          /* tp_getattr */
3584     0,                                          /* tp_setattr */
3585     0,                                          /* tp_reserved */
3586     (reprfunc)type_repr,                        /* tp_repr */
3587     0,                                          /* tp_as_number */
3588     0,                                          /* tp_as_sequence */
3589     0,                                          /* tp_as_mapping */
3590     0,                                          /* tp_hash */
3591     (ternaryfunc)type_call,                     /* tp_call */
3592     0,                                          /* tp_str */
3593     (getattrofunc)type_getattro,                /* tp_getattro */
3594     (setattrofunc)type_setattro,                /* tp_setattro */
3595     0,                                          /* tp_as_buffer */
3596     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
3597         Py_TPFLAGS_BASETYPE | Py_TPFLAGS_TYPE_SUBCLASS,         /* tp_flags */
3598     type_doc,                                   /* tp_doc */
3599     (traverseproc)type_traverse,                /* tp_traverse */
3600     (inquiry)type_clear,                        /* tp_clear */
3601     0,                                          /* tp_richcompare */
3602     offsetof(PyTypeObject, tp_weaklist),        /* tp_weaklistoffset */
3603     0,                                          /* tp_iter */
3604     0,                                          /* tp_iternext */
3605     type_methods,                               /* tp_methods */
3606     type_members,                               /* tp_members */
3607     type_getsets,                               /* tp_getset */
3608     0,                                          /* tp_base */
3609     0,                                          /* tp_dict */
3610     0,                                          /* tp_descr_get */
3611     0,                                          /* tp_descr_set */
3612     offsetof(PyTypeObject, tp_dict),            /* tp_dictoffset */
3613     type_init,                                  /* tp_init */
3614     0,                                          /* tp_alloc */
3615     type_new,                                   /* tp_new */
3616     PyObject_GC_Del,                            /* tp_free */
3617     (inquiry)type_is_gc,                        /* tp_is_gc */
3618 };
3619 
3620 
3621 /* The base type of all types (eventually)... except itself. */
3622 
3623 /* You may wonder why object.__new__() only complains about arguments
3624    when object.__init__() is not overridden, and vice versa.
3625 
3626    Consider the use cases:
3627 
3628    1. When neither is overridden, we want to hear complaints about
3629       excess (i.e., any) arguments, since their presence could
3630       indicate there's a bug.
3631 
3632    2. When defining an Immutable type, we are likely to override only
3633       __new__(), since __init__() is called too late to initialize an
3634       Immutable object.  Since __new__() defines the signature for the
3635       type, it would be a pain to have to override __init__() just to
3636       stop it from complaining about excess arguments.
3637 
3638    3. When defining a Mutable type, we are likely to override only
3639       __init__().  So here the converse reasoning applies: we don't
3640       want to have to override __new__() just to stop it from
3641       complaining.
3642 
3643    4. When __init__() is overridden, and the subclass __init__() calls
3644       object.__init__(), the latter should complain about excess
3645       arguments; ditto for __new__().
3646 
3647    Use cases 2 and 3 make it unattractive to unconditionally check for
3648    excess arguments.  The best solution that addresses all four use
3649    cases is as follows: __init__() complains about excess arguments
3650    unless __new__() is overridden and __init__() is not overridden
3651    (IOW, if __init__() is overridden or __new__() is not overridden);
3652    symmetrically, __new__() complains about excess arguments unless
3653    __init__() is overridden and __new__() is not overridden
3654    (IOW, if __new__() is overridden or __init__() is not overridden).
3655 
3656    However, for backwards compatibility, this breaks too much code.
3657    Therefore, in 2.6, we'll *warn* about excess arguments when both
3658    methods are overridden; for all other cases we'll use the above
3659    rules.
3660 
3661 */
3662 
3663 /* Forward */
3664 static PyObject *
3665 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
3666 
3667 static int
excess_args(PyObject * args,PyObject * kwds)3668 excess_args(PyObject *args, PyObject *kwds)
3669 {
3670     return PyTuple_GET_SIZE(args) ||
3671         (kwds && PyDict_Check(kwds) && PyDict_GET_SIZE(kwds));
3672 }
3673 
3674 static int
object_init(PyObject * self,PyObject * args,PyObject * kwds)3675 object_init(PyObject *self, PyObject *args, PyObject *kwds)
3676 {
3677     PyTypeObject *type = Py_TYPE(self);
3678     if (excess_args(args, kwds)) {
3679         if (type->tp_init != object_init) {
3680             PyErr_SetString(PyExc_TypeError,
3681                             "object.__init__() takes exactly one argument (the instance to initialize)");
3682             return -1;
3683         }
3684         if (type->tp_new == object_new) {
3685             PyErr_Format(PyExc_TypeError,
3686                          "%.200s.__init__() takes exactly one argument (the instance to initialize)",
3687                          type->tp_name);
3688             return -1;
3689         }
3690     }
3691     return 0;
3692 }
3693 
3694 static PyObject *
object_new(PyTypeObject * type,PyObject * args,PyObject * kwds)3695 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
3696 {
3697     if (excess_args(args, kwds)) {
3698         if (type->tp_new != object_new) {
3699             PyErr_SetString(PyExc_TypeError,
3700                             "object.__new__() takes exactly one argument (the type to instantiate)");
3701             return NULL;
3702         }
3703         if (type->tp_init == object_init) {
3704             PyErr_Format(PyExc_TypeError, "%.200s() takes no arguments",
3705                          type->tp_name);
3706             return NULL;
3707         }
3708     }
3709 
3710     if (type->tp_flags & Py_TPFLAGS_IS_ABSTRACT) {
3711         PyObject *abstract_methods = NULL;
3712         PyObject *builtins;
3713         PyObject *sorted;
3714         PyObject *sorted_methods = NULL;
3715         PyObject *joined = NULL;
3716         PyObject *comma;
3717         _Py_static_string(comma_id, ", ");
3718         _Py_IDENTIFIER(sorted);
3719 
3720         /* Compute ", ".join(sorted(type.__abstractmethods__))
3721            into joined. */
3722         abstract_methods = type_abstractmethods(type, NULL);
3723         if (abstract_methods == NULL)
3724             goto error;
3725         builtins = PyEval_GetBuiltins();
3726         if (builtins == NULL)
3727             goto error;
3728         sorted = _PyDict_GetItemId(builtins, &PyId_sorted);
3729         if (sorted == NULL)
3730             goto error;
3731         sorted_methods = PyObject_CallFunctionObjArgs(sorted,
3732                                                       abstract_methods,
3733                                                       NULL);
3734         if (sorted_methods == NULL)
3735             goto error;
3736         comma = _PyUnicode_FromId(&comma_id);
3737         if (comma == NULL)
3738             goto error;
3739         joined = PyUnicode_Join(comma, sorted_methods);
3740         if (joined == NULL)
3741             goto error;
3742 
3743         PyErr_Format(PyExc_TypeError,
3744                      "Can't instantiate abstract class %s "
3745                      "with abstract methods %U",
3746                      type->tp_name,
3747                      joined);
3748     error:
3749         Py_XDECREF(joined);
3750         Py_XDECREF(sorted_methods);
3751         Py_XDECREF(abstract_methods);
3752         return NULL;
3753     }
3754     return type->tp_alloc(type, 0);
3755 }
3756 
3757 static void
object_dealloc(PyObject * self)3758 object_dealloc(PyObject *self)
3759 {
3760     Py_TYPE(self)->tp_free(self);
3761 }
3762 
3763 static PyObject *
object_repr(PyObject * self)3764 object_repr(PyObject *self)
3765 {
3766     PyTypeObject *type;
3767     PyObject *mod, *name, *rtn;
3768 
3769     type = Py_TYPE(self);
3770     mod = type_module(type, NULL);
3771     if (mod == NULL)
3772         PyErr_Clear();
3773     else if (!PyUnicode_Check(mod)) {
3774         Py_DECREF(mod);
3775         mod = NULL;
3776     }
3777     name = type_qualname(type, NULL);
3778     if (name == NULL) {
3779         Py_XDECREF(mod);
3780         return NULL;
3781     }
3782     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
3783         rtn = PyUnicode_FromFormat("<%U.%U object at %p>", mod, name, self);
3784     else
3785         rtn = PyUnicode_FromFormat("<%s object at %p>",
3786                                   type->tp_name, self);
3787     Py_XDECREF(mod);
3788     Py_DECREF(name);
3789     return rtn;
3790 }
3791 
3792 static PyObject *
object_str(PyObject * self)3793 object_str(PyObject *self)
3794 {
3795     unaryfunc f;
3796 
3797     f = Py_TYPE(self)->tp_repr;
3798     if (f == NULL)
3799         f = object_repr;
3800     return f(self);
3801 }
3802 
3803 static PyObject *
object_richcompare(PyObject * self,PyObject * other,int op)3804 object_richcompare(PyObject *self, PyObject *other, int op)
3805 {
3806     PyObject *res;
3807 
3808     switch (op) {
3809 
3810     case Py_EQ:
3811         /* Return NotImplemented instead of False, so if two
3812            objects are compared, both get a chance at the
3813            comparison.  See issue #1393. */
3814         res = (self == other) ? Py_True : Py_NotImplemented;
3815         Py_INCREF(res);
3816         break;
3817 
3818     case Py_NE:
3819         /* By default, __ne__() delegates to __eq__() and inverts the result,
3820            unless the latter returns NotImplemented. */
3821         if (self->ob_type->tp_richcompare == NULL) {
3822             res = Py_NotImplemented;
3823             Py_INCREF(res);
3824             break;
3825         }
3826         res = (*self->ob_type->tp_richcompare)(self, other, Py_EQ);
3827         if (res != NULL && res != Py_NotImplemented) {
3828             int ok = PyObject_IsTrue(res);
3829             Py_DECREF(res);
3830             if (ok < 0)
3831                 res = NULL;
3832             else {
3833                 if (ok)
3834                     res = Py_False;
3835                 else
3836                     res = Py_True;
3837                 Py_INCREF(res);
3838             }
3839         }
3840         break;
3841 
3842     default:
3843         res = Py_NotImplemented;
3844         Py_INCREF(res);
3845         break;
3846     }
3847 
3848     return res;
3849 }
3850 
3851 static PyObject *
object_get_class(PyObject * self,void * closure)3852 object_get_class(PyObject *self, void *closure)
3853 {
3854     Py_INCREF(Py_TYPE(self));
3855     return (PyObject *)(Py_TYPE(self));
3856 }
3857 
3858 static int
compatible_with_tp_base(PyTypeObject * child)3859 compatible_with_tp_base(PyTypeObject *child)
3860 {
3861     PyTypeObject *parent = child->tp_base;
3862     return (parent != NULL &&
3863             child->tp_basicsize == parent->tp_basicsize &&
3864             child->tp_itemsize == parent->tp_itemsize &&
3865             child->tp_dictoffset == parent->tp_dictoffset &&
3866             child->tp_weaklistoffset == parent->tp_weaklistoffset &&
3867             ((child->tp_flags & Py_TPFLAGS_HAVE_GC) ==
3868              (parent->tp_flags & Py_TPFLAGS_HAVE_GC)) &&
3869             (child->tp_dealloc == subtype_dealloc ||
3870              child->tp_dealloc == parent->tp_dealloc));
3871 }
3872 
3873 static int
same_slots_added(PyTypeObject * a,PyTypeObject * b)3874 same_slots_added(PyTypeObject *a, PyTypeObject *b)
3875 {
3876     PyTypeObject *base = a->tp_base;
3877     Py_ssize_t size;
3878     PyObject *slots_a, *slots_b;
3879 
3880     assert(base == b->tp_base);
3881     size = base->tp_basicsize;
3882     if (a->tp_dictoffset == size && b->tp_dictoffset == size)
3883         size += sizeof(PyObject *);
3884     if (a->tp_weaklistoffset == size && b->tp_weaklistoffset == size)
3885         size += sizeof(PyObject *);
3886 
3887     /* Check slots compliance */
3888     if (!(a->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
3889         !(b->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
3890         return 0;
3891     }
3892     slots_a = ((PyHeapTypeObject *)a)->ht_slots;
3893     slots_b = ((PyHeapTypeObject *)b)->ht_slots;
3894     if (slots_a && slots_b) {
3895         if (PyObject_RichCompareBool(slots_a, slots_b, Py_EQ) != 1)
3896             return 0;
3897         size += sizeof(PyObject *) * PyTuple_GET_SIZE(slots_a);
3898     }
3899     return size == a->tp_basicsize && size == b->tp_basicsize;
3900 }
3901 
3902 static int
compatible_for_assignment(PyTypeObject * oldto,PyTypeObject * newto,const char * attr)3903 compatible_for_assignment(PyTypeObject* oldto, PyTypeObject* newto, const char* attr)
3904 {
3905     PyTypeObject *newbase, *oldbase;
3906 
3907     if (newto->tp_free != oldto->tp_free) {
3908         PyErr_Format(PyExc_TypeError,
3909                      "%s assignment: "
3910                      "'%s' deallocator differs from '%s'",
3911                      attr,
3912                      newto->tp_name,
3913                      oldto->tp_name);
3914         return 0;
3915     }
3916     /*
3917      It's tricky to tell if two arbitrary types are sufficiently compatible as
3918      to be interchangeable; e.g., even if they have the same tp_basicsize, they
3919      might have totally different struct fields. It's much easier to tell if a
3920      type and its supertype are compatible; e.g., if they have the same
3921      tp_basicsize, then that means they have identical fields. So to check
3922      whether two arbitrary types are compatible, we first find the highest
3923      supertype that each is compatible with, and then if those supertypes are
3924      compatible then the original types must also be compatible.
3925     */
3926     newbase = newto;
3927     oldbase = oldto;
3928     while (compatible_with_tp_base(newbase))
3929         newbase = newbase->tp_base;
3930     while (compatible_with_tp_base(oldbase))
3931         oldbase = oldbase->tp_base;
3932     if (newbase != oldbase &&
3933         (newbase->tp_base != oldbase->tp_base ||
3934          !same_slots_added(newbase, oldbase))) {
3935         PyErr_Format(PyExc_TypeError,
3936                      "%s assignment: "
3937                      "'%s' object layout differs from '%s'",
3938                      attr,
3939                      newto->tp_name,
3940                      oldto->tp_name);
3941         return 0;
3942     }
3943 
3944     return 1;
3945 }
3946 
3947 static int
object_set_class(PyObject * self,PyObject * value,void * closure)3948 object_set_class(PyObject *self, PyObject *value, void *closure)
3949 {
3950     PyTypeObject *oldto = Py_TYPE(self);
3951     PyTypeObject *newto;
3952 
3953     if (value == NULL) {
3954         PyErr_SetString(PyExc_TypeError,
3955                         "can't delete __class__ attribute");
3956         return -1;
3957     }
3958     if (!PyType_Check(value)) {
3959         PyErr_Format(PyExc_TypeError,
3960           "__class__ must be set to a class, not '%s' object",
3961           Py_TYPE(value)->tp_name);
3962         return -1;
3963     }
3964     newto = (PyTypeObject *)value;
3965     /* In versions of CPython prior to 3.5, the code in
3966        compatible_for_assignment was not set up to correctly check for memory
3967        layout / slot / etc. compatibility for non-HEAPTYPE classes, so we just
3968        disallowed __class__ assignment in any case that wasn't HEAPTYPE ->
3969        HEAPTYPE.
3970 
3971        During the 3.5 development cycle, we fixed the code in
3972        compatible_for_assignment to correctly check compatibility between
3973        arbitrary types, and started allowing __class__ assignment in all cases
3974        where the old and new types did in fact have compatible slots and
3975        memory layout (regardless of whether they were implemented as HEAPTYPEs
3976        or not).
3977 
3978        Just before 3.5 was released, though, we discovered that this led to
3979        problems with immutable types like int, where the interpreter assumes
3980        they are immutable and interns some values. Formerly this wasn't a
3981        problem, because they really were immutable -- in particular, all the
3982        types where the interpreter applied this interning trick happened to
3983        also be statically allocated, so the old HEAPTYPE rules were
3984        "accidentally" stopping them from allowing __class__ assignment. But
3985        with the changes to __class__ assignment, we started allowing code like
3986 
3987          class MyInt(int):
3988              ...
3989          # Modifies the type of *all* instances of 1 in the whole program,
3990          # including future instances (!), because the 1 object is interned.
3991          (1).__class__ = MyInt
3992 
3993        (see https://bugs.python.org/issue24912).
3994 
3995        In theory the proper fix would be to identify which classes rely on
3996        this invariant and somehow disallow __class__ assignment only for them,
3997        perhaps via some mechanism like a new Py_TPFLAGS_IMMUTABLE flag (a
3998        "blacklisting" approach). But in practice, since this problem wasn't
3999        noticed late in the 3.5 RC cycle, we're taking the conservative
4000        approach and reinstating the same HEAPTYPE->HEAPTYPE check that we used
4001        to have, plus a "whitelist". For now, the whitelist consists only of
4002        ModuleType subtypes, since those are the cases that motivated the patch
4003        in the first place -- see https://bugs.python.org/issue22986 -- and
4004        since module objects are mutable we can be sure that they are
4005        definitely not being interned. So now we allow HEAPTYPE->HEAPTYPE *or*
4006        ModuleType subtype -> ModuleType subtype.
4007 
4008        So far as we know, all the code beyond the following 'if' statement
4009        will correctly handle non-HEAPTYPE classes, and the HEAPTYPE check is
4010        needed only to protect that subset of non-HEAPTYPE classes for which
4011        the interpreter has baked in the assumption that all instances are
4012        truly immutable.
4013     */
4014     if (!(PyType_IsSubtype(newto, &PyModule_Type) &&
4015           PyType_IsSubtype(oldto, &PyModule_Type)) &&
4016         (!(newto->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
4017          !(oldto->tp_flags & Py_TPFLAGS_HEAPTYPE))) {
4018         PyErr_Format(PyExc_TypeError,
4019                      "__class__ assignment only supported for heap types "
4020                      "or ModuleType subclasses");
4021         return -1;
4022     }
4023 
4024     if (compatible_for_assignment(oldto, newto, "__class__")) {
4025         if (newto->tp_flags & Py_TPFLAGS_HEAPTYPE)
4026             Py_INCREF(newto);
4027         Py_TYPE(self) = newto;
4028         if (oldto->tp_flags & Py_TPFLAGS_HEAPTYPE)
4029             Py_DECREF(oldto);
4030         return 0;
4031     }
4032     else {
4033         return -1;
4034     }
4035 }
4036 
4037 static PyGetSetDef object_getsets[] = {
4038     {"__class__", object_get_class, object_set_class,
4039      PyDoc_STR("the object's class")},
4040     {0}
4041 };
4042 
4043 
4044 /* Stuff to implement __reduce_ex__ for pickle protocols >= 2.
4045    We fall back to helpers in copyreg for:
4046    - pickle protocols < 2
4047    - calculating the list of slot names (done only once per class)
4048    - the __newobj__ function (which is used as a token but never called)
4049 */
4050 
4051 static PyObject *
import_copyreg(void)4052 import_copyreg(void)
4053 {
4054     PyObject *copyreg_str;
4055     PyObject *copyreg_module;
4056     _Py_IDENTIFIER(copyreg);
4057 
4058     copyreg_str = _PyUnicode_FromId(&PyId_copyreg);
4059     if (copyreg_str == NULL) {
4060         return NULL;
4061     }
4062     /* Try to fetch cached copy of copyreg from sys.modules first in an
4063        attempt to avoid the import overhead. Previously this was implemented
4064        by storing a reference to the cached module in a static variable, but
4065        this broke when multiple embedded interpreters were in use (see issue
4066        #17408 and #19088). */
4067     copyreg_module = PyImport_GetModule(copyreg_str);
4068     if (copyreg_module != NULL) {
4069         return copyreg_module;
4070     }
4071     if (PyErr_Occurred()) {
4072         return NULL;
4073     }
4074     return PyImport_Import(copyreg_str);
4075 }
4076 
4077 static PyObject *
_PyType_GetSlotNames(PyTypeObject * cls)4078 _PyType_GetSlotNames(PyTypeObject *cls)
4079 {
4080     PyObject *copyreg;
4081     PyObject *slotnames;
4082     _Py_IDENTIFIER(__slotnames__);
4083     _Py_IDENTIFIER(_slotnames);
4084 
4085     assert(PyType_Check(cls));
4086 
4087     /* Get the slot names from the cache in the class if possible. */
4088     slotnames = _PyDict_GetItemIdWithError(cls->tp_dict, &PyId___slotnames__);
4089     if (slotnames != NULL) {
4090         if (slotnames != Py_None && !PyList_Check(slotnames)) {
4091             PyErr_Format(PyExc_TypeError,
4092                          "%.200s.__slotnames__ should be a list or None, "
4093                          "not %.200s",
4094                          cls->tp_name, Py_TYPE(slotnames)->tp_name);
4095             return NULL;
4096         }
4097         Py_INCREF(slotnames);
4098         return slotnames;
4099     }
4100     else {
4101         if (PyErr_Occurred()) {
4102             return NULL;
4103         }
4104         /* The class does not have the slot names cached yet. */
4105     }
4106 
4107     copyreg = import_copyreg();
4108     if (copyreg == NULL)
4109         return NULL;
4110 
4111     /* Use _slotnames function from the copyreg module to find the slots
4112        by this class and its bases. This function will cache the result
4113        in __slotnames__. */
4114     slotnames = _PyObject_CallMethodIdObjArgs(copyreg, &PyId__slotnames,
4115                                               cls, NULL);
4116     Py_DECREF(copyreg);
4117     if (slotnames == NULL)
4118         return NULL;
4119 
4120     if (slotnames != Py_None && !PyList_Check(slotnames)) {
4121         PyErr_SetString(PyExc_TypeError,
4122                         "copyreg._slotnames didn't return a list or None");
4123         Py_DECREF(slotnames);
4124         return NULL;
4125     }
4126 
4127     return slotnames;
4128 }
4129 
4130 static PyObject *
_PyObject_GetState(PyObject * obj,int required)4131 _PyObject_GetState(PyObject *obj, int required)
4132 {
4133     PyObject *state;
4134     PyObject *getstate;
4135     _Py_IDENTIFIER(__getstate__);
4136 
4137     if (_PyObject_LookupAttrId(obj, &PyId___getstate__, &getstate) < 0) {
4138         return NULL;
4139     }
4140     if (getstate == NULL) {
4141         PyObject *slotnames;
4142 
4143         if (required && obj->ob_type->tp_itemsize) {
4144             PyErr_Format(PyExc_TypeError,
4145                          "can't pickle %.200s objects",
4146                          Py_TYPE(obj)->tp_name);
4147             return NULL;
4148         }
4149 
4150         {
4151             PyObject **dict;
4152             dict = _PyObject_GetDictPtr(obj);
4153             /* It is possible that the object's dict is not initialized
4154                yet. In this case, we will return None for the state.
4155                We also return None if the dict is empty to make the behavior
4156                consistent regardless whether the dict was initialized or not.
4157                This make unit testing easier. */
4158             if (dict != NULL && *dict != NULL && PyDict_GET_SIZE(*dict)) {
4159                 state = *dict;
4160             }
4161             else {
4162                 state = Py_None;
4163             }
4164             Py_INCREF(state);
4165         }
4166 
4167         slotnames = _PyType_GetSlotNames(Py_TYPE(obj));
4168         if (slotnames == NULL) {
4169             Py_DECREF(state);
4170             return NULL;
4171         }
4172 
4173         assert(slotnames == Py_None || PyList_Check(slotnames));
4174         if (required) {
4175             Py_ssize_t basicsize = PyBaseObject_Type.tp_basicsize;
4176             if (obj->ob_type->tp_dictoffset)
4177                 basicsize += sizeof(PyObject *);
4178             if (obj->ob_type->tp_weaklistoffset)
4179                 basicsize += sizeof(PyObject *);
4180             if (slotnames != Py_None)
4181                 basicsize += sizeof(PyObject *) * PyList_GET_SIZE(slotnames);
4182             if (obj->ob_type->tp_basicsize > basicsize) {
4183                 Py_DECREF(slotnames);
4184                 Py_DECREF(state);
4185                 PyErr_Format(PyExc_TypeError,
4186                              "can't pickle %.200s objects",
4187                              Py_TYPE(obj)->tp_name);
4188                 return NULL;
4189             }
4190         }
4191 
4192         if (slotnames != Py_None && PyList_GET_SIZE(slotnames) > 0) {
4193             PyObject *slots;
4194             Py_ssize_t slotnames_size, i;
4195 
4196             slots = PyDict_New();
4197             if (slots == NULL) {
4198                 Py_DECREF(slotnames);
4199                 Py_DECREF(state);
4200                 return NULL;
4201             }
4202 
4203             slotnames_size = PyList_GET_SIZE(slotnames);
4204             for (i = 0; i < slotnames_size; i++) {
4205                 PyObject *name, *value;
4206 
4207                 name = PyList_GET_ITEM(slotnames, i);
4208                 Py_INCREF(name);
4209                 if (_PyObject_LookupAttr(obj, name, &value) < 0) {
4210                     goto error;
4211                 }
4212                 if (value == NULL) {
4213                     Py_DECREF(name);
4214                     /* It is not an error if the attribute is not present. */
4215                 }
4216                 else {
4217                     int err = PyDict_SetItem(slots, name, value);
4218                     Py_DECREF(name);
4219                     Py_DECREF(value);
4220                     if (err) {
4221                         goto error;
4222                     }
4223                 }
4224 
4225                 /* The list is stored on the class so it may mutate while we
4226                    iterate over it */
4227                 if (slotnames_size != PyList_GET_SIZE(slotnames)) {
4228                     PyErr_Format(PyExc_RuntimeError,
4229                                  "__slotsname__ changed size during iteration");
4230                     goto error;
4231                 }
4232 
4233                 /* We handle errors within the loop here. */
4234                 if (0) {
4235                   error:
4236                     Py_DECREF(slotnames);
4237                     Py_DECREF(slots);
4238                     Py_DECREF(state);
4239                     return NULL;
4240                 }
4241             }
4242 
4243             /* If we found some slot attributes, pack them in a tuple along
4244                the original attribute dictionary. */
4245             if (PyDict_GET_SIZE(slots) > 0) {
4246                 PyObject *state2;
4247 
4248                 state2 = PyTuple_Pack(2, state, slots);
4249                 Py_DECREF(state);
4250                 if (state2 == NULL) {
4251                     Py_DECREF(slotnames);
4252                     Py_DECREF(slots);
4253                     return NULL;
4254                 }
4255                 state = state2;
4256             }
4257             Py_DECREF(slots);
4258         }
4259         Py_DECREF(slotnames);
4260     }
4261     else { /* getstate != NULL */
4262         state = _PyObject_CallNoArg(getstate);
4263         Py_DECREF(getstate);
4264         if (state == NULL)
4265             return NULL;
4266     }
4267 
4268     return state;
4269 }
4270 
4271 static int
_PyObject_GetNewArguments(PyObject * obj,PyObject ** args,PyObject ** kwargs)4272 _PyObject_GetNewArguments(PyObject *obj, PyObject **args, PyObject **kwargs)
4273 {
4274     PyObject *getnewargs, *getnewargs_ex;
4275     _Py_IDENTIFIER(__getnewargs_ex__);
4276     _Py_IDENTIFIER(__getnewargs__);
4277 
4278     if (args == NULL || kwargs == NULL) {
4279         PyErr_BadInternalCall();
4280         return -1;
4281     }
4282 
4283     /* We first attempt to fetch the arguments for __new__ by calling
4284        __getnewargs_ex__ on the object. */
4285     getnewargs_ex = _PyObject_LookupSpecial(obj, &PyId___getnewargs_ex__);
4286     if (getnewargs_ex != NULL) {
4287         PyObject *newargs = _PyObject_CallNoArg(getnewargs_ex);
4288         Py_DECREF(getnewargs_ex);
4289         if (newargs == NULL) {
4290             return -1;
4291         }
4292         if (!PyTuple_Check(newargs)) {
4293             PyErr_Format(PyExc_TypeError,
4294                          "__getnewargs_ex__ should return a tuple, "
4295                          "not '%.200s'", Py_TYPE(newargs)->tp_name);
4296             Py_DECREF(newargs);
4297             return -1;
4298         }
4299         if (PyTuple_GET_SIZE(newargs) != 2) {
4300             PyErr_Format(PyExc_ValueError,
4301                          "__getnewargs_ex__ should return a tuple of "
4302                          "length 2, not %zd", PyTuple_GET_SIZE(newargs));
4303             Py_DECREF(newargs);
4304             return -1;
4305         }
4306         *args = PyTuple_GET_ITEM(newargs, 0);
4307         Py_INCREF(*args);
4308         *kwargs = PyTuple_GET_ITEM(newargs, 1);
4309         Py_INCREF(*kwargs);
4310         Py_DECREF(newargs);
4311 
4312         /* XXX We should perhaps allow None to be passed here. */
4313         if (!PyTuple_Check(*args)) {
4314             PyErr_Format(PyExc_TypeError,
4315                          "first item of the tuple returned by "
4316                          "__getnewargs_ex__ must be a tuple, not '%.200s'",
4317                          Py_TYPE(*args)->tp_name);
4318             Py_CLEAR(*args);
4319             Py_CLEAR(*kwargs);
4320             return -1;
4321         }
4322         if (!PyDict_Check(*kwargs)) {
4323             PyErr_Format(PyExc_TypeError,
4324                          "second item of the tuple returned by "
4325                          "__getnewargs_ex__ must be a dict, not '%.200s'",
4326                          Py_TYPE(*kwargs)->tp_name);
4327             Py_CLEAR(*args);
4328             Py_CLEAR(*kwargs);
4329             return -1;
4330         }
4331         return 0;
4332     } else if (PyErr_Occurred()) {
4333         return -1;
4334     }
4335 
4336     /* The object does not have __getnewargs_ex__ so we fallback on using
4337        __getnewargs__ instead. */
4338     getnewargs = _PyObject_LookupSpecial(obj, &PyId___getnewargs__);
4339     if (getnewargs != NULL) {
4340         *args = _PyObject_CallNoArg(getnewargs);
4341         Py_DECREF(getnewargs);
4342         if (*args == NULL) {
4343             return -1;
4344         }
4345         if (!PyTuple_Check(*args)) {
4346             PyErr_Format(PyExc_TypeError,
4347                          "__getnewargs__ should return a tuple, "
4348                          "not '%.200s'", Py_TYPE(*args)->tp_name);
4349             Py_CLEAR(*args);
4350             return -1;
4351         }
4352         *kwargs = NULL;
4353         return 0;
4354     } else if (PyErr_Occurred()) {
4355         return -1;
4356     }
4357 
4358     /* The object does not have __getnewargs_ex__ and __getnewargs__. This may
4359        mean __new__ does not takes any arguments on this object, or that the
4360        object does not implement the reduce protocol for pickling or
4361        copying. */
4362     *args = NULL;
4363     *kwargs = NULL;
4364     return 0;
4365 }
4366 
4367 static int
_PyObject_GetItemsIter(PyObject * obj,PyObject ** listitems,PyObject ** dictitems)4368 _PyObject_GetItemsIter(PyObject *obj, PyObject **listitems,
4369                        PyObject **dictitems)
4370 {
4371     if (listitems == NULL || dictitems == NULL) {
4372         PyErr_BadInternalCall();
4373         return -1;
4374     }
4375 
4376     if (!PyList_Check(obj)) {
4377         *listitems = Py_None;
4378         Py_INCREF(*listitems);
4379     }
4380     else {
4381         *listitems = PyObject_GetIter(obj);
4382         if (*listitems == NULL)
4383             return -1;
4384     }
4385 
4386     if (!PyDict_Check(obj)) {
4387         *dictitems = Py_None;
4388         Py_INCREF(*dictitems);
4389     }
4390     else {
4391         PyObject *items;
4392         _Py_IDENTIFIER(items);
4393 
4394         items = _PyObject_CallMethodIdObjArgs(obj, &PyId_items, NULL);
4395         if (items == NULL) {
4396             Py_CLEAR(*listitems);
4397             return -1;
4398         }
4399         *dictitems = PyObject_GetIter(items);
4400         Py_DECREF(items);
4401         if (*dictitems == NULL) {
4402             Py_CLEAR(*listitems);
4403             return -1;
4404         }
4405     }
4406 
4407     assert(*listitems != NULL && *dictitems != NULL);
4408 
4409     return 0;
4410 }
4411 
4412 static PyObject *
reduce_newobj(PyObject * obj)4413 reduce_newobj(PyObject *obj)
4414 {
4415     PyObject *args = NULL, *kwargs = NULL;
4416     PyObject *copyreg;
4417     PyObject *newobj, *newargs, *state, *listitems, *dictitems;
4418     PyObject *result;
4419     int hasargs;
4420 
4421     if (Py_TYPE(obj)->tp_new == NULL) {
4422         PyErr_Format(PyExc_TypeError,
4423                      "can't pickle %.200s objects",
4424                      Py_TYPE(obj)->tp_name);
4425         return NULL;
4426     }
4427     if (_PyObject_GetNewArguments(obj, &args, &kwargs) < 0)
4428         return NULL;
4429 
4430     copyreg = import_copyreg();
4431     if (copyreg == NULL) {
4432         Py_XDECREF(args);
4433         Py_XDECREF(kwargs);
4434         return NULL;
4435     }
4436     hasargs = (args != NULL);
4437     if (kwargs == NULL || PyDict_GET_SIZE(kwargs) == 0) {
4438         _Py_IDENTIFIER(__newobj__);
4439         PyObject *cls;
4440         Py_ssize_t i, n;
4441 
4442         Py_XDECREF(kwargs);
4443         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj__);
4444         Py_DECREF(copyreg);
4445         if (newobj == NULL) {
4446             Py_XDECREF(args);
4447             return NULL;
4448         }
4449         n = args ? PyTuple_GET_SIZE(args) : 0;
4450         newargs = PyTuple_New(n+1);
4451         if (newargs == NULL) {
4452             Py_XDECREF(args);
4453             Py_DECREF(newobj);
4454             return NULL;
4455         }
4456         cls = (PyObject *) Py_TYPE(obj);
4457         Py_INCREF(cls);
4458         PyTuple_SET_ITEM(newargs, 0, cls);
4459         for (i = 0; i < n; i++) {
4460             PyObject *v = PyTuple_GET_ITEM(args, i);
4461             Py_INCREF(v);
4462             PyTuple_SET_ITEM(newargs, i+1, v);
4463         }
4464         Py_XDECREF(args);
4465     }
4466     else if (args != NULL) {
4467         _Py_IDENTIFIER(__newobj_ex__);
4468 
4469         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj_ex__);
4470         Py_DECREF(copyreg);
4471         if (newobj == NULL) {
4472             Py_DECREF(args);
4473             Py_DECREF(kwargs);
4474             return NULL;
4475         }
4476         newargs = PyTuple_Pack(3, Py_TYPE(obj), args, kwargs);
4477         Py_DECREF(args);
4478         Py_DECREF(kwargs);
4479         if (newargs == NULL) {
4480             Py_DECREF(newobj);
4481             return NULL;
4482         }
4483     }
4484     else {
4485         /* args == NULL */
4486         Py_DECREF(kwargs);
4487         PyErr_BadInternalCall();
4488         return NULL;
4489     }
4490 
4491     state = _PyObject_GetState(obj,
4492                 !hasargs && !PyList_Check(obj) && !PyDict_Check(obj));
4493     if (state == NULL) {
4494         Py_DECREF(newobj);
4495         Py_DECREF(newargs);
4496         return NULL;
4497     }
4498     if (_PyObject_GetItemsIter(obj, &listitems, &dictitems) < 0) {
4499         Py_DECREF(newobj);
4500         Py_DECREF(newargs);
4501         Py_DECREF(state);
4502         return NULL;
4503     }
4504 
4505     result = PyTuple_Pack(5, newobj, newargs, state, listitems, dictitems);
4506     Py_DECREF(newobj);
4507     Py_DECREF(newargs);
4508     Py_DECREF(state);
4509     Py_DECREF(listitems);
4510     Py_DECREF(dictitems);
4511     return result;
4512 }
4513 
4514 /*
4515  * There were two problems when object.__reduce__ and object.__reduce_ex__
4516  * were implemented in the same function:
4517  *  - trying to pickle an object with a custom __reduce__ method that
4518  *    fell back to object.__reduce__ in certain circumstances led to
4519  *    infinite recursion at Python level and eventual RecursionError.
4520  *  - Pickling objects that lied about their type by overwriting the
4521  *    __class__ descriptor could lead to infinite recursion at C level
4522  *    and eventual segfault.
4523  *
4524  * Because of backwards compatibility, the two methods still have to
4525  * behave in the same way, even if this is not required by the pickle
4526  * protocol. This common functionality was moved to the _common_reduce
4527  * function.
4528  */
4529 static PyObject *
_common_reduce(PyObject * self,int proto)4530 _common_reduce(PyObject *self, int proto)
4531 {
4532     PyObject *copyreg, *res;
4533 
4534     if (proto >= 2)
4535         return reduce_newobj(self);
4536 
4537     copyreg = import_copyreg();
4538     if (!copyreg)
4539         return NULL;
4540 
4541     res = PyObject_CallMethod(copyreg, "_reduce_ex", "Oi", self, proto);
4542     Py_DECREF(copyreg);
4543 
4544     return res;
4545 }
4546 
4547 /*[clinic input]
4548 object.__reduce__
4549 
4550 Helper for pickle.
4551 [clinic start generated code]*/
4552 
4553 static PyObject *
object___reduce___impl(PyObject * self)4554 object___reduce___impl(PyObject *self)
4555 /*[clinic end generated code: output=d4ca691f891c6e2f input=11562e663947e18b]*/
4556 {
4557     return _common_reduce(self, 0);
4558 }
4559 
4560 /*[clinic input]
4561 object.__reduce_ex__
4562 
4563   protocol: int
4564   /
4565 
4566 Helper for pickle.
4567 [clinic start generated code]*/
4568 
4569 static PyObject *
object___reduce_ex___impl(PyObject * self,int protocol)4570 object___reduce_ex___impl(PyObject *self, int protocol)
4571 /*[clinic end generated code: output=2e157766f6b50094 input=f326b43fb8a4c5ff]*/
4572 {
4573     static PyObject *objreduce;
4574     PyObject *reduce, *res;
4575     _Py_IDENTIFIER(__reduce__);
4576 
4577     if (objreduce == NULL) {
4578         objreduce = _PyDict_GetItemId(PyBaseObject_Type.tp_dict,
4579                                       &PyId___reduce__);
4580         if (objreduce == NULL)
4581             return NULL;
4582     }
4583 
4584     reduce = _PyObject_GetAttrId(self, &PyId___reduce__);
4585     if (reduce == NULL)
4586         PyErr_Clear();
4587     else {
4588         PyObject *cls, *clsreduce;
4589         int override;
4590 
4591         cls = (PyObject *) Py_TYPE(self);
4592         clsreduce = _PyObject_GetAttrId(cls, &PyId___reduce__);
4593         if (clsreduce == NULL) {
4594             Py_DECREF(reduce);
4595             return NULL;
4596         }
4597         override = (clsreduce != objreduce);
4598         Py_DECREF(clsreduce);
4599         if (override) {
4600             res = _PyObject_CallNoArg(reduce);
4601             Py_DECREF(reduce);
4602             return res;
4603         }
4604         else
4605             Py_DECREF(reduce);
4606     }
4607 
4608     return _common_reduce(self, protocol);
4609 }
4610 
4611 static PyObject *
object_subclasshook(PyObject * cls,PyObject * args)4612 object_subclasshook(PyObject *cls, PyObject *args)
4613 {
4614     Py_RETURN_NOTIMPLEMENTED;
4615 }
4616 
4617 PyDoc_STRVAR(object_subclasshook_doc,
4618 "Abstract classes can override this to customize issubclass().\n"
4619 "\n"
4620 "This is invoked early on by abc.ABCMeta.__subclasscheck__().\n"
4621 "It should return True, False or NotImplemented.  If it returns\n"
4622 "NotImplemented, the normal algorithm is used.  Otherwise, it\n"
4623 "overrides the normal algorithm (and the outcome is cached).\n");
4624 
4625 static PyObject *
object_init_subclass(PyObject * cls,PyObject * arg)4626 object_init_subclass(PyObject *cls, PyObject *arg)
4627 {
4628     Py_RETURN_NONE;
4629 }
4630 
4631 PyDoc_STRVAR(object_init_subclass_doc,
4632 "This method is called when a class is subclassed.\n"
4633 "\n"
4634 "The default implementation does nothing. It may be\n"
4635 "overridden to extend subclasses.\n");
4636 
4637 /*[clinic input]
4638 object.__format__
4639 
4640   format_spec: unicode
4641   /
4642 
4643 Default object formatter.
4644 [clinic start generated code]*/
4645 
4646 static PyObject *
object___format___impl(PyObject * self,PyObject * format_spec)4647 object___format___impl(PyObject *self, PyObject *format_spec)
4648 /*[clinic end generated code: output=34897efb543a974b input=7c3b3bc53a6fb7fa]*/
4649 {
4650     /* Issue 7994: If we're converting to a string, we
4651        should reject format specifications */
4652     if (PyUnicode_GET_LENGTH(format_spec) > 0) {
4653         PyErr_Format(PyExc_TypeError,
4654                      "unsupported format string passed to %.200s.__format__",
4655                      self->ob_type->tp_name);
4656         return NULL;
4657     }
4658     return PyObject_Str(self);
4659 }
4660 
4661 /*[clinic input]
4662 object.__sizeof__
4663 
4664 Size of object in memory, in bytes.
4665 [clinic start generated code]*/
4666 
4667 static PyObject *
object___sizeof___impl(PyObject * self)4668 object___sizeof___impl(PyObject *self)
4669 /*[clinic end generated code: output=73edab332f97d550 input=1200ff3dfe485306]*/
4670 {
4671     Py_ssize_t res, isize;
4672 
4673     res = 0;
4674     isize = self->ob_type->tp_itemsize;
4675     if (isize > 0)
4676         res = Py_SIZE(self) * isize;
4677     res += self->ob_type->tp_basicsize;
4678 
4679     return PyLong_FromSsize_t(res);
4680 }
4681 
4682 /* __dir__ for generic objects: returns __dict__, __class__,
4683    and recursively up the __class__.__bases__ chain.
4684 */
4685 /*[clinic input]
4686 object.__dir__
4687 
4688 Default dir() implementation.
4689 [clinic start generated code]*/
4690 
4691 static PyObject *
object___dir___impl(PyObject * self)4692 object___dir___impl(PyObject *self)
4693 /*[clinic end generated code: output=66dd48ea62f26c90 input=0a89305bec669b10]*/
4694 {
4695     PyObject *result = NULL;
4696     PyObject *dict = NULL;
4697     PyObject *itsclass = NULL;
4698 
4699     /* Get __dict__ (which may or may not be a real dict...) */
4700     dict = _PyObject_GetAttrId(self, &PyId___dict__);
4701     if (dict == NULL) {
4702         PyErr_Clear();
4703         dict = PyDict_New();
4704     }
4705     else if (!PyDict_Check(dict)) {
4706         Py_DECREF(dict);
4707         dict = PyDict_New();
4708     }
4709     else {
4710         /* Copy __dict__ to avoid mutating it. */
4711         PyObject *temp = PyDict_Copy(dict);
4712         Py_DECREF(dict);
4713         dict = temp;
4714     }
4715 
4716     if (dict == NULL)
4717         goto error;
4718 
4719     /* Merge in attrs reachable from its class. */
4720     itsclass = _PyObject_GetAttrId(self, &PyId___class__);
4721     if (itsclass == NULL)
4722         /* XXX(tomer): Perhaps fall back to obj->ob_type if no
4723                        __class__ exists? */
4724         PyErr_Clear();
4725     else if (merge_class_dict(dict, itsclass) != 0)
4726         goto error;
4727 
4728     result = PyDict_Keys(dict);
4729     /* fall through */
4730 error:
4731     Py_XDECREF(itsclass);
4732     Py_XDECREF(dict);
4733     return result;
4734 }
4735 
4736 static PyMethodDef object_methods[] = {
4737     OBJECT___REDUCE_EX___METHODDEF
4738     OBJECT___REDUCE___METHODDEF
4739     {"__subclasshook__", object_subclasshook, METH_CLASS | METH_VARARGS,
4740      object_subclasshook_doc},
4741     {"__init_subclass__", object_init_subclass, METH_CLASS | METH_NOARGS,
4742      object_init_subclass_doc},
4743     OBJECT___FORMAT___METHODDEF
4744     OBJECT___SIZEOF___METHODDEF
4745     OBJECT___DIR___METHODDEF
4746     {0}
4747 };
4748 
4749 
4750 PyTypeObject PyBaseObject_Type = {
4751     PyVarObject_HEAD_INIT(&PyType_Type, 0)
4752     "object",                                   /* tp_name */
4753     sizeof(PyObject),                           /* tp_basicsize */
4754     0,                                          /* tp_itemsize */
4755     object_dealloc,                             /* tp_dealloc */
4756     0,                                          /* tp_print */
4757     0,                                          /* tp_getattr */
4758     0,                                          /* tp_setattr */
4759     0,                                          /* tp_reserved */
4760     object_repr,                                /* tp_repr */
4761     0,                                          /* tp_as_number */
4762     0,                                          /* tp_as_sequence */
4763     0,                                          /* tp_as_mapping */
4764     (hashfunc)_Py_HashPointer,                  /* tp_hash */
4765     0,                                          /* tp_call */
4766     object_str,                                 /* tp_str */
4767     PyObject_GenericGetAttr,                    /* tp_getattro */
4768     PyObject_GenericSetAttr,                    /* tp_setattro */
4769     0,                                          /* tp_as_buffer */
4770     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,   /* tp_flags */
4771     PyDoc_STR("object()\n--\n\nThe most base type"),  /* tp_doc */
4772     0,                                          /* tp_traverse */
4773     0,                                          /* tp_clear */
4774     object_richcompare,                         /* tp_richcompare */
4775     0,                                          /* tp_weaklistoffset */
4776     0,                                          /* tp_iter */
4777     0,                                          /* tp_iternext */
4778     object_methods,                             /* tp_methods */
4779     0,                                          /* tp_members */
4780     object_getsets,                             /* tp_getset */
4781     0,                                          /* tp_base */
4782     0,                                          /* tp_dict */
4783     0,                                          /* tp_descr_get */
4784     0,                                          /* tp_descr_set */
4785     0,                                          /* tp_dictoffset */
4786     object_init,                                /* tp_init */
4787     PyType_GenericAlloc,                        /* tp_alloc */
4788     object_new,                                 /* tp_new */
4789     PyObject_Del,                               /* tp_free */
4790 };
4791 
4792 
4793 /* Add the methods from tp_methods to the __dict__ in a type object */
4794 
4795 static int
add_methods(PyTypeObject * type,PyMethodDef * meth)4796 add_methods(PyTypeObject *type, PyMethodDef *meth)
4797 {
4798     PyObject *dict = type->tp_dict;
4799 
4800     for (; meth->ml_name != NULL; meth++) {
4801         PyObject *descr;
4802         int err;
4803         int isdescr = 1;
4804         if (PyDict_GetItemString(dict, meth->ml_name) &&
4805             !(meth->ml_flags & METH_COEXIST))
4806                 continue;
4807         if (meth->ml_flags & METH_CLASS) {
4808             if (meth->ml_flags & METH_STATIC) {
4809                 PyErr_SetString(PyExc_ValueError,
4810                      "method cannot be both class and static");
4811                 return -1;
4812             }
4813             descr = PyDescr_NewClassMethod(type, meth);
4814         }
4815         else if (meth->ml_flags & METH_STATIC) {
4816           PyObject *cfunc = PyCFunction_NewEx(meth, (PyObject*)type, NULL);
4817             if (cfunc == NULL)
4818                 return -1;
4819             descr = PyStaticMethod_New(cfunc);
4820             isdescr = 0;  // PyStaticMethod is not PyDescrObject
4821             Py_DECREF(cfunc);
4822         }
4823         else {
4824             descr = PyDescr_NewMethod(type, meth);
4825         }
4826         if (descr == NULL)
4827             return -1;
4828         if (isdescr) {
4829             err = PyDict_SetItem(dict, PyDescr_NAME(descr), descr);
4830         }
4831         else {
4832             err = PyDict_SetItemString(dict, meth->ml_name, descr);
4833         }
4834         Py_DECREF(descr);
4835         if (err < 0)
4836             return -1;
4837     }
4838     return 0;
4839 }
4840 
4841 static int
add_members(PyTypeObject * type,PyMemberDef * memb)4842 add_members(PyTypeObject *type, PyMemberDef *memb)
4843 {
4844     PyObject *dict = type->tp_dict;
4845 
4846     for (; memb->name != NULL; memb++) {
4847         PyObject *descr;
4848         if (PyDict_GetItemString(dict, memb->name))
4849             continue;
4850         descr = PyDescr_NewMember(type, memb);
4851         if (descr == NULL)
4852             return -1;
4853         if (PyDict_SetItem(dict, PyDescr_NAME(descr), descr) < 0) {
4854             Py_DECREF(descr);
4855             return -1;
4856         }
4857         Py_DECREF(descr);
4858     }
4859     return 0;
4860 }
4861 
4862 static int
add_getset(PyTypeObject * type,PyGetSetDef * gsp)4863 add_getset(PyTypeObject *type, PyGetSetDef *gsp)
4864 {
4865     PyObject *dict = type->tp_dict;
4866 
4867     for (; gsp->name != NULL; gsp++) {
4868         PyObject *descr;
4869         if (PyDict_GetItemString(dict, gsp->name))
4870             continue;
4871         descr = PyDescr_NewGetSet(type, gsp);
4872 
4873         if (descr == NULL)
4874             return -1;
4875         if (PyDict_SetItem(dict, PyDescr_NAME(descr), descr) < 0) {
4876             Py_DECREF(descr);
4877             return -1;
4878         }
4879         Py_DECREF(descr);
4880     }
4881     return 0;
4882 }
4883 
4884 static void
inherit_special(PyTypeObject * type,PyTypeObject * base)4885 inherit_special(PyTypeObject *type, PyTypeObject *base)
4886 {
4887 
4888     /* Copying basicsize is connected to the GC flags */
4889     if (!(type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
4890         (base->tp_flags & Py_TPFLAGS_HAVE_GC) &&
4891         (!type->tp_traverse && !type->tp_clear)) {
4892         type->tp_flags |= Py_TPFLAGS_HAVE_GC;
4893         if (type->tp_traverse == NULL)
4894             type->tp_traverse = base->tp_traverse;
4895         if (type->tp_clear == NULL)
4896             type->tp_clear = base->tp_clear;
4897     }
4898     {
4899         /* The condition below could use some explanation.
4900            It appears that tp_new is not inherited for static types
4901            whose base class is 'object'; this seems to be a precaution
4902            so that old extension types don't suddenly become
4903            callable (object.__new__ wouldn't insure the invariants
4904            that the extension type's own factory function ensures).
4905            Heap types, of course, are under our control, so they do
4906            inherit tp_new; static extension types that specify some
4907            other built-in type as the default also
4908            inherit object.__new__. */
4909         if (base != &PyBaseObject_Type ||
4910             (type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
4911             if (type->tp_new == NULL)
4912                 type->tp_new = base->tp_new;
4913         }
4914     }
4915     if (type->tp_basicsize == 0)
4916         type->tp_basicsize = base->tp_basicsize;
4917 
4918     /* Copy other non-function slots */
4919 
4920 #undef COPYVAL
4921 #define COPYVAL(SLOT) \
4922     if (type->SLOT == 0) type->SLOT = base->SLOT
4923 
4924     COPYVAL(tp_itemsize);
4925     COPYVAL(tp_weaklistoffset);
4926     COPYVAL(tp_dictoffset);
4927 
4928     /* Setup fast subclass flags */
4929     if (PyType_IsSubtype(base, (PyTypeObject*)PyExc_BaseException))
4930         type->tp_flags |= Py_TPFLAGS_BASE_EXC_SUBCLASS;
4931     else if (PyType_IsSubtype(base, &PyType_Type))
4932         type->tp_flags |= Py_TPFLAGS_TYPE_SUBCLASS;
4933     else if (PyType_IsSubtype(base, &PyLong_Type))
4934         type->tp_flags |= Py_TPFLAGS_LONG_SUBCLASS;
4935     else if (PyType_IsSubtype(base, &PyBytes_Type))
4936         type->tp_flags |= Py_TPFLAGS_BYTES_SUBCLASS;
4937     else if (PyType_IsSubtype(base, &PyUnicode_Type))
4938         type->tp_flags |= Py_TPFLAGS_UNICODE_SUBCLASS;
4939     else if (PyType_IsSubtype(base, &PyTuple_Type))
4940         type->tp_flags |= Py_TPFLAGS_TUPLE_SUBCLASS;
4941     else if (PyType_IsSubtype(base, &PyList_Type))
4942         type->tp_flags |= Py_TPFLAGS_LIST_SUBCLASS;
4943     else if (PyType_IsSubtype(base, &PyDict_Type))
4944         type->tp_flags |= Py_TPFLAGS_DICT_SUBCLASS;
4945 }
4946 
4947 static int
overrides_hash(PyTypeObject * type)4948 overrides_hash(PyTypeObject *type)
4949 {
4950     PyObject *dict = type->tp_dict;
4951     _Py_IDENTIFIER(__eq__);
4952 
4953     assert(dict != NULL);
4954     if (_PyDict_GetItemId(dict, &PyId___eq__) != NULL)
4955         return 1;
4956     if (_PyDict_GetItemId(dict, &PyId___hash__) != NULL)
4957         return 1;
4958     return 0;
4959 }
4960 
4961 static void
inherit_slots(PyTypeObject * type,PyTypeObject * base)4962 inherit_slots(PyTypeObject *type, PyTypeObject *base)
4963 {
4964     PyTypeObject *basebase;
4965 
4966 #undef SLOTDEFINED
4967 #undef COPYSLOT
4968 #undef COPYNUM
4969 #undef COPYSEQ
4970 #undef COPYMAP
4971 #undef COPYBUF
4972 
4973 #define SLOTDEFINED(SLOT) \
4974     (base->SLOT != 0 && \
4975      (basebase == NULL || base->SLOT != basebase->SLOT))
4976 
4977 #define COPYSLOT(SLOT) \
4978     if (!type->SLOT && SLOTDEFINED(SLOT)) type->SLOT = base->SLOT
4979 
4980 #define COPYASYNC(SLOT) COPYSLOT(tp_as_async->SLOT)
4981 #define COPYNUM(SLOT) COPYSLOT(tp_as_number->SLOT)
4982 #define COPYSEQ(SLOT) COPYSLOT(tp_as_sequence->SLOT)
4983 #define COPYMAP(SLOT) COPYSLOT(tp_as_mapping->SLOT)
4984 #define COPYBUF(SLOT) COPYSLOT(tp_as_buffer->SLOT)
4985 
4986     /* This won't inherit indirect slots (from tp_as_number etc.)
4987        if type doesn't provide the space. */
4988 
4989     if (type->tp_as_number != NULL && base->tp_as_number != NULL) {
4990         basebase = base->tp_base;
4991         if (basebase->tp_as_number == NULL)
4992             basebase = NULL;
4993         COPYNUM(nb_add);
4994         COPYNUM(nb_subtract);
4995         COPYNUM(nb_multiply);
4996         COPYNUM(nb_remainder);
4997         COPYNUM(nb_divmod);
4998         COPYNUM(nb_power);
4999         COPYNUM(nb_negative);
5000         COPYNUM(nb_positive);
5001         COPYNUM(nb_absolute);
5002         COPYNUM(nb_bool);
5003         COPYNUM(nb_invert);
5004         COPYNUM(nb_lshift);
5005         COPYNUM(nb_rshift);
5006         COPYNUM(nb_and);
5007         COPYNUM(nb_xor);
5008         COPYNUM(nb_or);
5009         COPYNUM(nb_int);
5010         COPYNUM(nb_float);
5011         COPYNUM(nb_inplace_add);
5012         COPYNUM(nb_inplace_subtract);
5013         COPYNUM(nb_inplace_multiply);
5014         COPYNUM(nb_inplace_remainder);
5015         COPYNUM(nb_inplace_power);
5016         COPYNUM(nb_inplace_lshift);
5017         COPYNUM(nb_inplace_rshift);
5018         COPYNUM(nb_inplace_and);
5019         COPYNUM(nb_inplace_xor);
5020         COPYNUM(nb_inplace_or);
5021         COPYNUM(nb_true_divide);
5022         COPYNUM(nb_floor_divide);
5023         COPYNUM(nb_inplace_true_divide);
5024         COPYNUM(nb_inplace_floor_divide);
5025         COPYNUM(nb_index);
5026         COPYNUM(nb_matrix_multiply);
5027         COPYNUM(nb_inplace_matrix_multiply);
5028     }
5029 
5030     if (type->tp_as_async != NULL && base->tp_as_async != NULL) {
5031         basebase = base->tp_base;
5032         if (basebase->tp_as_async == NULL)
5033             basebase = NULL;
5034         COPYASYNC(am_await);
5035         COPYASYNC(am_aiter);
5036         COPYASYNC(am_anext);
5037     }
5038 
5039     if (type->tp_as_sequence != NULL && base->tp_as_sequence != NULL) {
5040         basebase = base->tp_base;
5041         if (basebase->tp_as_sequence == NULL)
5042             basebase = NULL;
5043         COPYSEQ(sq_length);
5044         COPYSEQ(sq_concat);
5045         COPYSEQ(sq_repeat);
5046         COPYSEQ(sq_item);
5047         COPYSEQ(sq_ass_item);
5048         COPYSEQ(sq_contains);
5049         COPYSEQ(sq_inplace_concat);
5050         COPYSEQ(sq_inplace_repeat);
5051     }
5052 
5053     if (type->tp_as_mapping != NULL && base->tp_as_mapping != NULL) {
5054         basebase = base->tp_base;
5055         if (basebase->tp_as_mapping == NULL)
5056             basebase = NULL;
5057         COPYMAP(mp_length);
5058         COPYMAP(mp_subscript);
5059         COPYMAP(mp_ass_subscript);
5060     }
5061 
5062     if (type->tp_as_buffer != NULL && base->tp_as_buffer != NULL) {
5063         basebase = base->tp_base;
5064         if (basebase->tp_as_buffer == NULL)
5065             basebase = NULL;
5066         COPYBUF(bf_getbuffer);
5067         COPYBUF(bf_releasebuffer);
5068     }
5069 
5070     basebase = base->tp_base;
5071 
5072     COPYSLOT(tp_dealloc);
5073     if (type->tp_getattr == NULL && type->tp_getattro == NULL) {
5074         type->tp_getattr = base->tp_getattr;
5075         type->tp_getattro = base->tp_getattro;
5076     }
5077     if (type->tp_setattr == NULL && type->tp_setattro == NULL) {
5078         type->tp_setattr = base->tp_setattr;
5079         type->tp_setattro = base->tp_setattro;
5080     }
5081     /* tp_reserved is ignored */
5082     COPYSLOT(tp_repr);
5083     /* tp_hash see tp_richcompare */
5084     COPYSLOT(tp_call);
5085     COPYSLOT(tp_str);
5086     {
5087         /* Copy comparison-related slots only when
5088            not overriding them anywhere */
5089         if (type->tp_richcompare == NULL &&
5090             type->tp_hash == NULL &&
5091             !overrides_hash(type))
5092         {
5093             type->tp_richcompare = base->tp_richcompare;
5094             type->tp_hash = base->tp_hash;
5095         }
5096     }
5097     {
5098         COPYSLOT(tp_iter);
5099         COPYSLOT(tp_iternext);
5100     }
5101     {
5102         COPYSLOT(tp_descr_get);
5103         COPYSLOT(tp_descr_set);
5104         COPYSLOT(tp_dictoffset);
5105         COPYSLOT(tp_init);
5106         COPYSLOT(tp_alloc);
5107         COPYSLOT(tp_is_gc);
5108         if ((type->tp_flags & Py_TPFLAGS_HAVE_FINALIZE) &&
5109             (base->tp_flags & Py_TPFLAGS_HAVE_FINALIZE)) {
5110             COPYSLOT(tp_finalize);
5111         }
5112         if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) ==
5113             (base->tp_flags & Py_TPFLAGS_HAVE_GC)) {
5114             /* They agree about gc. */
5115             COPYSLOT(tp_free);
5116         }
5117         else if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5118                  type->tp_free == NULL &&
5119                  base->tp_free == PyObject_Free) {
5120             /* A bit of magic to plug in the correct default
5121              * tp_free function when a derived class adds gc,
5122              * didn't define tp_free, and the base uses the
5123              * default non-gc tp_free.
5124              */
5125             type->tp_free = PyObject_GC_Del;
5126         }
5127         /* else they didn't agree about gc, and there isn't something
5128          * obvious to be done -- the type is on its own.
5129          */
5130     }
5131 }
5132 
5133 static int add_operators(PyTypeObject *);
5134 
5135 int
PyType_Ready(PyTypeObject * type)5136 PyType_Ready(PyTypeObject *type)
5137 {
5138     PyObject *dict, *bases;
5139     PyTypeObject *base;
5140     Py_ssize_t i, n;
5141 
5142     if (type->tp_flags & Py_TPFLAGS_READY) {
5143         assert(_PyType_CheckConsistency(type));
5144         return 0;
5145     }
5146     assert((type->tp_flags & Py_TPFLAGS_READYING) == 0);
5147 
5148     type->tp_flags |= Py_TPFLAGS_READYING;
5149 
5150 #ifdef Py_TRACE_REFS
5151     /* PyType_Ready is the closest thing we have to a choke point
5152      * for type objects, so is the best place I can think of to try
5153      * to get type objects into the doubly-linked list of all objects.
5154      * Still, not all type objects go through PyType_Ready.
5155      */
5156     _Py_AddToAllObjects((PyObject *)type, 0);
5157 #endif
5158 
5159     if (type->tp_name == NULL) {
5160         PyErr_Format(PyExc_SystemError,
5161                      "Type does not define the tp_name field.");
5162         goto error;
5163     }
5164 
5165     /* Initialize tp_base (defaults to BaseObject unless that's us) */
5166     base = type->tp_base;
5167     if (base == NULL && type != &PyBaseObject_Type) {
5168         base = type->tp_base = &PyBaseObject_Type;
5169         Py_INCREF(base);
5170     }
5171 
5172     /* Now the only way base can still be NULL is if type is
5173      * &PyBaseObject_Type.
5174      */
5175 
5176     /* Initialize the base class */
5177     if (base != NULL && base->tp_dict == NULL) {
5178         if (PyType_Ready(base) < 0)
5179             goto error;
5180     }
5181 
5182     /* Initialize ob_type if NULL.      This means extensions that want to be
5183        compilable separately on Windows can call PyType_Ready() instead of
5184        initializing the ob_type field of their type objects. */
5185     /* The test for base != NULL is really unnecessary, since base is only
5186        NULL when type is &PyBaseObject_Type, and we know its ob_type is
5187        not NULL (it's initialized to &PyType_Type).      But coverity doesn't
5188        know that. */
5189     if (Py_TYPE(type) == NULL && base != NULL)
5190         Py_TYPE(type) = Py_TYPE(base);
5191 
5192     /* Initialize tp_bases */
5193     bases = type->tp_bases;
5194     if (bases == NULL) {
5195         if (base == NULL)
5196             bases = PyTuple_New(0);
5197         else
5198             bases = PyTuple_Pack(1, base);
5199         if (bases == NULL)
5200             goto error;
5201         type->tp_bases = bases;
5202     }
5203 
5204     /* Initialize tp_dict */
5205     dict = type->tp_dict;
5206     if (dict == NULL) {
5207         dict = PyDict_New();
5208         if (dict == NULL)
5209             goto error;
5210         type->tp_dict = dict;
5211     }
5212 
5213     /* Add type-specific descriptors to tp_dict */
5214     if (add_operators(type) < 0)
5215         goto error;
5216     if (type->tp_methods != NULL) {
5217         if (add_methods(type, type->tp_methods) < 0)
5218             goto error;
5219     }
5220     if (type->tp_members != NULL) {
5221         if (add_members(type, type->tp_members) < 0)
5222             goto error;
5223     }
5224     if (type->tp_getset != NULL) {
5225         if (add_getset(type, type->tp_getset) < 0)
5226             goto error;
5227     }
5228 
5229     /* Calculate method resolution order */
5230     if (mro_internal(type, NULL) < 0)
5231         goto error;
5232 
5233     /* Inherit special flags from dominant base */
5234     if (type->tp_base != NULL)
5235         inherit_special(type, type->tp_base);
5236 
5237     /* Initialize tp_dict properly */
5238     bases = type->tp_mro;
5239     assert(bases != NULL);
5240     assert(PyTuple_Check(bases));
5241     n = PyTuple_GET_SIZE(bases);
5242     for (i = 1; i < n; i++) {
5243         PyObject *b = PyTuple_GET_ITEM(bases, i);
5244         if (PyType_Check(b))
5245             inherit_slots(type, (PyTypeObject *)b);
5246     }
5247 
5248     /* All bases of statically allocated type should be statically allocated */
5249     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
5250         for (i = 0; i < n; i++) {
5251             PyObject *b = PyTuple_GET_ITEM(bases, i);
5252             if (PyType_Check(b) &&
5253                 (((PyTypeObject *)b)->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
5254                 PyErr_Format(PyExc_TypeError,
5255                              "type '%.100s' is not dynamically allocated but "
5256                              "its base type '%.100s' is dynamically allocated",
5257                              type->tp_name, ((PyTypeObject *)b)->tp_name);
5258                 goto error;
5259             }
5260         }
5261 
5262     /* Sanity check for tp_free. */
5263     if (PyType_IS_GC(type) && (type->tp_flags & Py_TPFLAGS_BASETYPE) &&
5264         (type->tp_free == NULL || type->tp_free == PyObject_Del)) {
5265         /* This base class needs to call tp_free, but doesn't have
5266          * one, or its tp_free is for non-gc'ed objects.
5267          */
5268         PyErr_Format(PyExc_TypeError, "type '%.100s' participates in "
5269                      "gc and is a base type but has inappropriate "
5270                      "tp_free slot",
5271                      type->tp_name);
5272         goto error;
5273     }
5274 
5275     /* if the type dictionary doesn't contain a __doc__, set it from
5276        the tp_doc slot.
5277      */
5278     if (_PyDict_GetItemId(type->tp_dict, &PyId___doc__) == NULL) {
5279         if (type->tp_doc != NULL) {
5280             const char *old_doc = _PyType_DocWithoutSignature(type->tp_name,
5281                 type->tp_doc);
5282             PyObject *doc = PyUnicode_FromString(old_doc);
5283             if (doc == NULL)
5284                 goto error;
5285             if (_PyDict_SetItemId(type->tp_dict, &PyId___doc__, doc) < 0) {
5286                 Py_DECREF(doc);
5287                 goto error;
5288             }
5289             Py_DECREF(doc);
5290         } else {
5291             if (_PyDict_SetItemId(type->tp_dict,
5292                                   &PyId___doc__, Py_None) < 0)
5293                 goto error;
5294         }
5295     }
5296 
5297     /* Hack for tp_hash and __hash__.
5298        If after all that, tp_hash is still NULL, and __hash__ is not in
5299        tp_dict, set tp_hash to PyObject_HashNotImplemented and
5300        tp_dict['__hash__'] equal to None.
5301        This signals that __hash__ is not inherited.
5302      */
5303     if (type->tp_hash == NULL) {
5304         if (_PyDict_GetItemId(type->tp_dict, &PyId___hash__) == NULL) {
5305             if (_PyDict_SetItemId(type->tp_dict, &PyId___hash__, Py_None) < 0)
5306                 goto error;
5307             type->tp_hash = PyObject_HashNotImplemented;
5308         }
5309     }
5310 
5311     /* Some more special stuff */
5312     base = type->tp_base;
5313     if (base != NULL) {
5314         if (type->tp_as_async == NULL)
5315             type->tp_as_async = base->tp_as_async;
5316         if (type->tp_as_number == NULL)
5317             type->tp_as_number = base->tp_as_number;
5318         if (type->tp_as_sequence == NULL)
5319             type->tp_as_sequence = base->tp_as_sequence;
5320         if (type->tp_as_mapping == NULL)
5321             type->tp_as_mapping = base->tp_as_mapping;
5322         if (type->tp_as_buffer == NULL)
5323             type->tp_as_buffer = base->tp_as_buffer;
5324     }
5325 
5326     /* Link into each base class's list of subclasses */
5327     bases = type->tp_bases;
5328     n = PyTuple_GET_SIZE(bases);
5329     for (i = 0; i < n; i++) {
5330         PyObject *b = PyTuple_GET_ITEM(bases, i);
5331         if (PyType_Check(b) &&
5332             add_subclass((PyTypeObject *)b, type) < 0)
5333             goto error;
5334     }
5335 
5336     /* All done -- set the ready flag */
5337     type->tp_flags =
5338         (type->tp_flags & ~Py_TPFLAGS_READYING) | Py_TPFLAGS_READY;
5339     assert(_PyType_CheckConsistency(type));
5340     return 0;
5341 
5342   error:
5343     type->tp_flags &= ~Py_TPFLAGS_READYING;
5344     return -1;
5345 }
5346 
5347 static int
add_subclass(PyTypeObject * base,PyTypeObject * type)5348 add_subclass(PyTypeObject *base, PyTypeObject *type)
5349 {
5350     int result = -1;
5351     PyObject *dict, *key, *newobj;
5352 
5353     dict = base->tp_subclasses;
5354     if (dict == NULL) {
5355         base->tp_subclasses = dict = PyDict_New();
5356         if (dict == NULL)
5357             return -1;
5358     }
5359     assert(PyDict_CheckExact(dict));
5360     key = PyLong_FromVoidPtr((void *) type);
5361     if (key == NULL)
5362         return -1;
5363     newobj = PyWeakref_NewRef((PyObject *)type, NULL);
5364     if (newobj != NULL) {
5365         result = PyDict_SetItem(dict, key, newobj);
5366         Py_DECREF(newobj);
5367     }
5368     Py_DECREF(key);
5369     return result;
5370 }
5371 
5372 static int
add_all_subclasses(PyTypeObject * type,PyObject * bases)5373 add_all_subclasses(PyTypeObject *type, PyObject *bases)
5374 {
5375     int res = 0;
5376 
5377     if (bases) {
5378         Py_ssize_t i;
5379         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
5380             PyObject *base = PyTuple_GET_ITEM(bases, i);
5381             if (PyType_Check(base) &&
5382                 add_subclass((PyTypeObject*)base, type) < 0)
5383                 res = -1;
5384         }
5385     }
5386 
5387     return res;
5388 }
5389 
5390 static void
remove_subclass(PyTypeObject * base,PyTypeObject * type)5391 remove_subclass(PyTypeObject *base, PyTypeObject *type)
5392 {
5393     PyObject *dict, *key;
5394 
5395     dict = base->tp_subclasses;
5396     if (dict == NULL) {
5397         return;
5398     }
5399     assert(PyDict_CheckExact(dict));
5400     key = PyLong_FromVoidPtr((void *) type);
5401     if (key == NULL || PyDict_DelItem(dict, key)) {
5402         /* This can happen if the type initialization errored out before
5403            the base subclasses were updated (e.g. a non-str __qualname__
5404            was passed in the type dict). */
5405         PyErr_Clear();
5406     }
5407     Py_XDECREF(key);
5408 }
5409 
5410 static void
remove_all_subclasses(PyTypeObject * type,PyObject * bases)5411 remove_all_subclasses(PyTypeObject *type, PyObject *bases)
5412 {
5413     if (bases) {
5414         Py_ssize_t i;
5415         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
5416             PyObject *base = PyTuple_GET_ITEM(bases, i);
5417             if (PyType_Check(base))
5418                 remove_subclass((PyTypeObject*) base, type);
5419         }
5420     }
5421 }
5422 
5423 static int
check_num_args(PyObject * ob,int n)5424 check_num_args(PyObject *ob, int n)
5425 {
5426     if (!PyTuple_CheckExact(ob)) {
5427         PyErr_SetString(PyExc_SystemError,
5428             "PyArg_UnpackTuple() argument list is not a tuple");
5429         return 0;
5430     }
5431     if (n == PyTuple_GET_SIZE(ob))
5432         return 1;
5433     PyErr_Format(
5434         PyExc_TypeError,
5435         "expected %d arguments, got %zd", n, PyTuple_GET_SIZE(ob));
5436     return 0;
5437 }
5438 
5439 /* Generic wrappers for overloadable 'operators' such as __getitem__ */
5440 
5441 /* There's a wrapper *function* for each distinct function typedef used
5442    for type object slots (e.g. binaryfunc, ternaryfunc, etc.).  There's a
5443    wrapper *table* for each distinct operation (e.g. __len__, __add__).
5444    Most tables have only one entry; the tables for binary operators have two
5445    entries, one regular and one with reversed arguments. */
5446 
5447 static PyObject *
wrap_lenfunc(PyObject * self,PyObject * args,void * wrapped)5448 wrap_lenfunc(PyObject *self, PyObject *args, void *wrapped)
5449 {
5450     lenfunc func = (lenfunc)wrapped;
5451     Py_ssize_t res;
5452 
5453     if (!check_num_args(args, 0))
5454         return NULL;
5455     res = (*func)(self);
5456     if (res == -1 && PyErr_Occurred())
5457         return NULL;
5458     return PyLong_FromSsize_t(res);
5459 }
5460 
5461 static PyObject *
wrap_inquirypred(PyObject * self,PyObject * args,void * wrapped)5462 wrap_inquirypred(PyObject *self, PyObject *args, void *wrapped)
5463 {
5464     inquiry func = (inquiry)wrapped;
5465     int res;
5466 
5467     if (!check_num_args(args, 0))
5468         return NULL;
5469     res = (*func)(self);
5470     if (res == -1 && PyErr_Occurred())
5471         return NULL;
5472     return PyBool_FromLong((long)res);
5473 }
5474 
5475 static PyObject *
wrap_binaryfunc(PyObject * self,PyObject * args,void * wrapped)5476 wrap_binaryfunc(PyObject *self, PyObject *args, void *wrapped)
5477 {
5478     binaryfunc func = (binaryfunc)wrapped;
5479     PyObject *other;
5480 
5481     if (!check_num_args(args, 1))
5482         return NULL;
5483     other = PyTuple_GET_ITEM(args, 0);
5484     return (*func)(self, other);
5485 }
5486 
5487 static PyObject *
wrap_binaryfunc_l(PyObject * self,PyObject * args,void * wrapped)5488 wrap_binaryfunc_l(PyObject *self, PyObject *args, void *wrapped)
5489 {
5490     binaryfunc func = (binaryfunc)wrapped;
5491     PyObject *other;
5492 
5493     if (!check_num_args(args, 1))
5494         return NULL;
5495     other = PyTuple_GET_ITEM(args, 0);
5496     return (*func)(self, other);
5497 }
5498 
5499 static PyObject *
wrap_binaryfunc_r(PyObject * self,PyObject * args,void * wrapped)5500 wrap_binaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
5501 {
5502     binaryfunc func = (binaryfunc)wrapped;
5503     PyObject *other;
5504 
5505     if (!check_num_args(args, 1))
5506         return NULL;
5507     other = PyTuple_GET_ITEM(args, 0);
5508     return (*func)(other, self);
5509 }
5510 
5511 static PyObject *
wrap_ternaryfunc(PyObject * self,PyObject * args,void * wrapped)5512 wrap_ternaryfunc(PyObject *self, PyObject *args, void *wrapped)
5513 {
5514     ternaryfunc func = (ternaryfunc)wrapped;
5515     PyObject *other;
5516     PyObject *third = Py_None;
5517 
5518     /* Note: This wrapper only works for __pow__() */
5519 
5520     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
5521         return NULL;
5522     return (*func)(self, other, third);
5523 }
5524 
5525 static PyObject *
wrap_ternaryfunc_r(PyObject * self,PyObject * args,void * wrapped)5526 wrap_ternaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
5527 {
5528     ternaryfunc func = (ternaryfunc)wrapped;
5529     PyObject *other;
5530     PyObject *third = Py_None;
5531 
5532     /* Note: This wrapper only works for __pow__() */
5533 
5534     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
5535         return NULL;
5536     return (*func)(other, self, third);
5537 }
5538 
5539 static PyObject *
wrap_unaryfunc(PyObject * self,PyObject * args,void * wrapped)5540 wrap_unaryfunc(PyObject *self, PyObject *args, void *wrapped)
5541 {
5542     unaryfunc func = (unaryfunc)wrapped;
5543 
5544     if (!check_num_args(args, 0))
5545         return NULL;
5546     return (*func)(self);
5547 }
5548 
5549 static PyObject *
wrap_indexargfunc(PyObject * self,PyObject * args,void * wrapped)5550 wrap_indexargfunc(PyObject *self, PyObject *args, void *wrapped)
5551 {
5552     ssizeargfunc func = (ssizeargfunc)wrapped;
5553     PyObject* o;
5554     Py_ssize_t i;
5555 
5556     if (!PyArg_UnpackTuple(args, "", 1, 1, &o))
5557         return NULL;
5558     i = PyNumber_AsSsize_t(o, PyExc_OverflowError);
5559     if (i == -1 && PyErr_Occurred())
5560         return NULL;
5561     return (*func)(self, i);
5562 }
5563 
5564 static Py_ssize_t
getindex(PyObject * self,PyObject * arg)5565 getindex(PyObject *self, PyObject *arg)
5566 {
5567     Py_ssize_t i;
5568 
5569     i = PyNumber_AsSsize_t(arg, PyExc_OverflowError);
5570     if (i == -1 && PyErr_Occurred())
5571         return -1;
5572     if (i < 0) {
5573         PySequenceMethods *sq = Py_TYPE(self)->tp_as_sequence;
5574         if (sq && sq->sq_length) {
5575             Py_ssize_t n = (*sq->sq_length)(self);
5576             if (n < 0) {
5577                 assert(PyErr_Occurred());
5578                 return -1;
5579             }
5580             i += n;
5581         }
5582     }
5583     return i;
5584 }
5585 
5586 static PyObject *
wrap_sq_item(PyObject * self,PyObject * args,void * wrapped)5587 wrap_sq_item(PyObject *self, PyObject *args, void *wrapped)
5588 {
5589     ssizeargfunc func = (ssizeargfunc)wrapped;
5590     PyObject *arg;
5591     Py_ssize_t i;
5592 
5593     if (PyTuple_GET_SIZE(args) == 1) {
5594         arg = PyTuple_GET_ITEM(args, 0);
5595         i = getindex(self, arg);
5596         if (i == -1 && PyErr_Occurred())
5597             return NULL;
5598         return (*func)(self, i);
5599     }
5600     check_num_args(args, 1);
5601     assert(PyErr_Occurred());
5602     return NULL;
5603 }
5604 
5605 static PyObject *
wrap_sq_setitem(PyObject * self,PyObject * args,void * wrapped)5606 wrap_sq_setitem(PyObject *self, PyObject *args, void *wrapped)
5607 {
5608     ssizeobjargproc func = (ssizeobjargproc)wrapped;
5609     Py_ssize_t i;
5610     int res;
5611     PyObject *arg, *value;
5612 
5613     if (!PyArg_UnpackTuple(args, "", 2, 2, &arg, &value))
5614         return NULL;
5615     i = getindex(self, arg);
5616     if (i == -1 && PyErr_Occurred())
5617         return NULL;
5618     res = (*func)(self, i, value);
5619     if (res == -1 && PyErr_Occurred())
5620         return NULL;
5621     Py_RETURN_NONE;
5622 }
5623 
5624 static PyObject *
wrap_sq_delitem(PyObject * self,PyObject * args,void * wrapped)5625 wrap_sq_delitem(PyObject *self, PyObject *args, void *wrapped)
5626 {
5627     ssizeobjargproc func = (ssizeobjargproc)wrapped;
5628     Py_ssize_t i;
5629     int res;
5630     PyObject *arg;
5631 
5632     if (!check_num_args(args, 1))
5633         return NULL;
5634     arg = PyTuple_GET_ITEM(args, 0);
5635     i = getindex(self, arg);
5636     if (i == -1 && PyErr_Occurred())
5637         return NULL;
5638     res = (*func)(self, i, NULL);
5639     if (res == -1 && PyErr_Occurred())
5640         return NULL;
5641     Py_RETURN_NONE;
5642 }
5643 
5644 /* XXX objobjproc is a misnomer; should be objargpred */
5645 static PyObject *
wrap_objobjproc(PyObject * self,PyObject * args,void * wrapped)5646 wrap_objobjproc(PyObject *self, PyObject *args, void *wrapped)
5647 {
5648     objobjproc func = (objobjproc)wrapped;
5649     int res;
5650     PyObject *value;
5651 
5652     if (!check_num_args(args, 1))
5653         return NULL;
5654     value = PyTuple_GET_ITEM(args, 0);
5655     res = (*func)(self, value);
5656     if (res == -1 && PyErr_Occurred())
5657         return NULL;
5658     else
5659         return PyBool_FromLong(res);
5660 }
5661 
5662 static PyObject *
wrap_objobjargproc(PyObject * self,PyObject * args,void * wrapped)5663 wrap_objobjargproc(PyObject *self, PyObject *args, void *wrapped)
5664 {
5665     objobjargproc func = (objobjargproc)wrapped;
5666     int res;
5667     PyObject *key, *value;
5668 
5669     if (!PyArg_UnpackTuple(args, "", 2, 2, &key, &value))
5670         return NULL;
5671     res = (*func)(self, key, value);
5672     if (res == -1 && PyErr_Occurred())
5673         return NULL;
5674     Py_RETURN_NONE;
5675 }
5676 
5677 static PyObject *
wrap_delitem(PyObject * self,PyObject * args,void * wrapped)5678 wrap_delitem(PyObject *self, PyObject *args, void *wrapped)
5679 {
5680     objobjargproc func = (objobjargproc)wrapped;
5681     int res;
5682     PyObject *key;
5683 
5684     if (!check_num_args(args, 1))
5685         return NULL;
5686     key = PyTuple_GET_ITEM(args, 0);
5687     res = (*func)(self, key, NULL);
5688     if (res == -1 && PyErr_Occurred())
5689         return NULL;
5690     Py_RETURN_NONE;
5691 }
5692 
5693 /* Helper to check for object.__setattr__ or __delattr__ applied to a type.
5694    This is called the Carlo Verre hack after its discoverer. */
5695 static int
hackcheck(PyObject * self,setattrofunc func,const char * what)5696 hackcheck(PyObject *self, setattrofunc func, const char *what)
5697 {
5698     PyTypeObject *type = Py_TYPE(self);
5699     while (type && type->tp_flags & Py_TPFLAGS_HEAPTYPE)
5700         type = type->tp_base;
5701     /* If type is NULL now, this is a really weird type.
5702        In the spirit of backwards compatibility (?), just shut up. */
5703     if (type && type->tp_setattro != func) {
5704         PyErr_Format(PyExc_TypeError,
5705                      "can't apply this %s to %s object",
5706                      what,
5707                      type->tp_name);
5708         return 0;
5709     }
5710     return 1;
5711 }
5712 
5713 static PyObject *
wrap_setattr(PyObject * self,PyObject * args,void * wrapped)5714 wrap_setattr(PyObject *self, PyObject *args, void *wrapped)
5715 {
5716     setattrofunc func = (setattrofunc)wrapped;
5717     int res;
5718     PyObject *name, *value;
5719 
5720     if (!PyArg_UnpackTuple(args, "", 2, 2, &name, &value))
5721         return NULL;
5722     if (!hackcheck(self, func, "__setattr__"))
5723         return NULL;
5724     res = (*func)(self, name, value);
5725     if (res < 0)
5726         return NULL;
5727     Py_RETURN_NONE;
5728 }
5729 
5730 static PyObject *
wrap_delattr(PyObject * self,PyObject * args,void * wrapped)5731 wrap_delattr(PyObject *self, PyObject *args, void *wrapped)
5732 {
5733     setattrofunc func = (setattrofunc)wrapped;
5734     int res;
5735     PyObject *name;
5736 
5737     if (!check_num_args(args, 1))
5738         return NULL;
5739     name = PyTuple_GET_ITEM(args, 0);
5740     if (!hackcheck(self, func, "__delattr__"))
5741         return NULL;
5742     res = (*func)(self, name, NULL);
5743     if (res < 0)
5744         return NULL;
5745     Py_RETURN_NONE;
5746 }
5747 
5748 static PyObject *
wrap_hashfunc(PyObject * self,PyObject * args,void * wrapped)5749 wrap_hashfunc(PyObject *self, PyObject *args, void *wrapped)
5750 {
5751     hashfunc func = (hashfunc)wrapped;
5752     Py_hash_t res;
5753 
5754     if (!check_num_args(args, 0))
5755         return NULL;
5756     res = (*func)(self);
5757     if (res == -1 && PyErr_Occurred())
5758         return NULL;
5759     return PyLong_FromSsize_t(res);
5760 }
5761 
5762 static PyObject *
wrap_call(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)5763 wrap_call(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
5764 {
5765     ternaryfunc func = (ternaryfunc)wrapped;
5766 
5767     return (*func)(self, args, kwds);
5768 }
5769 
5770 static PyObject *
wrap_del(PyObject * self,PyObject * args,void * wrapped)5771 wrap_del(PyObject *self, PyObject *args, void *wrapped)
5772 {
5773     destructor func = (destructor)wrapped;
5774 
5775     if (!check_num_args(args, 0))
5776         return NULL;
5777 
5778     (*func)(self);
5779     Py_RETURN_NONE;
5780 }
5781 
5782 static PyObject *
wrap_richcmpfunc(PyObject * self,PyObject * args,void * wrapped,int op)5783 wrap_richcmpfunc(PyObject *self, PyObject *args, void *wrapped, int op)
5784 {
5785     richcmpfunc func = (richcmpfunc)wrapped;
5786     PyObject *other;
5787 
5788     if (!check_num_args(args, 1))
5789         return NULL;
5790     other = PyTuple_GET_ITEM(args, 0);
5791     return (*func)(self, other, op);
5792 }
5793 
5794 #undef RICHCMP_WRAPPER
5795 #define RICHCMP_WRAPPER(NAME, OP) \
5796 static PyObject * \
5797 richcmp_##NAME(PyObject *self, PyObject *args, void *wrapped) \
5798 { \
5799     return wrap_richcmpfunc(self, args, wrapped, OP); \
5800 }
5801 
RICHCMP_WRAPPER(lt,Py_LT)5802 RICHCMP_WRAPPER(lt, Py_LT)
5803 RICHCMP_WRAPPER(le, Py_LE)
5804 RICHCMP_WRAPPER(eq, Py_EQ)
5805 RICHCMP_WRAPPER(ne, Py_NE)
5806 RICHCMP_WRAPPER(gt, Py_GT)
5807 RICHCMP_WRAPPER(ge, Py_GE)
5808 
5809 static PyObject *
5810 wrap_next(PyObject *self, PyObject *args, void *wrapped)
5811 {
5812     unaryfunc func = (unaryfunc)wrapped;
5813     PyObject *res;
5814 
5815     if (!check_num_args(args, 0))
5816         return NULL;
5817     res = (*func)(self);
5818     if (res == NULL && !PyErr_Occurred())
5819         PyErr_SetNone(PyExc_StopIteration);
5820     return res;
5821 }
5822 
5823 static PyObject *
wrap_descr_get(PyObject * self,PyObject * args,void * wrapped)5824 wrap_descr_get(PyObject *self, PyObject *args, void *wrapped)
5825 {
5826     descrgetfunc func = (descrgetfunc)wrapped;
5827     PyObject *obj;
5828     PyObject *type = NULL;
5829 
5830     if (!PyArg_UnpackTuple(args, "", 1, 2, &obj, &type))
5831         return NULL;
5832     if (obj == Py_None)
5833         obj = NULL;
5834     if (type == Py_None)
5835         type = NULL;
5836     if (type == NULL &&obj == NULL) {
5837         PyErr_SetString(PyExc_TypeError,
5838                         "__get__(None, None) is invalid");
5839         return NULL;
5840     }
5841     return (*func)(self, obj, type);
5842 }
5843 
5844 static PyObject *
wrap_descr_set(PyObject * self,PyObject * args,void * wrapped)5845 wrap_descr_set(PyObject *self, PyObject *args, void *wrapped)
5846 {
5847     descrsetfunc func = (descrsetfunc)wrapped;
5848     PyObject *obj, *value;
5849     int ret;
5850 
5851     if (!PyArg_UnpackTuple(args, "", 2, 2, &obj, &value))
5852         return NULL;
5853     ret = (*func)(self, obj, value);
5854     if (ret < 0)
5855         return NULL;
5856     Py_RETURN_NONE;
5857 }
5858 
5859 static PyObject *
wrap_descr_delete(PyObject * self,PyObject * args,void * wrapped)5860 wrap_descr_delete(PyObject *self, PyObject *args, void *wrapped)
5861 {
5862     descrsetfunc func = (descrsetfunc)wrapped;
5863     PyObject *obj;
5864     int ret;
5865 
5866     if (!check_num_args(args, 1))
5867         return NULL;
5868     obj = PyTuple_GET_ITEM(args, 0);
5869     ret = (*func)(self, obj, NULL);
5870     if (ret < 0)
5871         return NULL;
5872     Py_RETURN_NONE;
5873 }
5874 
5875 static PyObject *
wrap_init(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)5876 wrap_init(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
5877 {
5878     initproc func = (initproc)wrapped;
5879 
5880     if (func(self, args, kwds) < 0)
5881         return NULL;
5882     Py_RETURN_NONE;
5883 }
5884 
5885 static PyObject *
tp_new_wrapper(PyObject * self,PyObject * args,PyObject * kwds)5886 tp_new_wrapper(PyObject *self, PyObject *args, PyObject *kwds)
5887 {
5888     PyTypeObject *type, *subtype, *staticbase;
5889     PyObject *arg0, *res;
5890 
5891     if (self == NULL || !PyType_Check(self))
5892         Py_FatalError("__new__() called with non-type 'self'");
5893     type = (PyTypeObject *)self;
5894     if (!PyTuple_Check(args) || PyTuple_GET_SIZE(args) < 1) {
5895         PyErr_Format(PyExc_TypeError,
5896                      "%s.__new__(): not enough arguments",
5897                      type->tp_name);
5898         return NULL;
5899     }
5900     arg0 = PyTuple_GET_ITEM(args, 0);
5901     if (!PyType_Check(arg0)) {
5902         PyErr_Format(PyExc_TypeError,
5903                      "%s.__new__(X): X is not a type object (%s)",
5904                      type->tp_name,
5905                      Py_TYPE(arg0)->tp_name);
5906         return NULL;
5907     }
5908     subtype = (PyTypeObject *)arg0;
5909     if (!PyType_IsSubtype(subtype, type)) {
5910         PyErr_Format(PyExc_TypeError,
5911                      "%s.__new__(%s): %s is not a subtype of %s",
5912                      type->tp_name,
5913                      subtype->tp_name,
5914                      subtype->tp_name,
5915                      type->tp_name);
5916         return NULL;
5917     }
5918 
5919     /* Check that the use doesn't do something silly and unsafe like
5920        object.__new__(dict).  To do this, we check that the
5921        most derived base that's not a heap type is this type. */
5922     staticbase = subtype;
5923     while (staticbase && (staticbase->tp_new == slot_tp_new))
5924         staticbase = staticbase->tp_base;
5925     /* If staticbase is NULL now, it is a really weird type.
5926        In the spirit of backwards compatibility (?), just shut up. */
5927     if (staticbase && staticbase->tp_new != type->tp_new) {
5928         PyErr_Format(PyExc_TypeError,
5929                      "%s.__new__(%s) is not safe, use %s.__new__()",
5930                      type->tp_name,
5931                      subtype->tp_name,
5932                      staticbase->tp_name);
5933         return NULL;
5934     }
5935 
5936     args = PyTuple_GetSlice(args, 1, PyTuple_GET_SIZE(args));
5937     if (args == NULL)
5938         return NULL;
5939     res = type->tp_new(subtype, args, kwds);
5940     Py_DECREF(args);
5941     return res;
5942 }
5943 
5944 static struct PyMethodDef tp_new_methoddef[] = {
5945     {"__new__", (PyCFunction)tp_new_wrapper, METH_VARARGS|METH_KEYWORDS,
5946      PyDoc_STR("__new__($type, *args, **kwargs)\n--\n\n"
5947                "Create and return a new object.  "
5948                "See help(type) for accurate signature.")},
5949     {0}
5950 };
5951 
5952 static int
add_tp_new_wrapper(PyTypeObject * type)5953 add_tp_new_wrapper(PyTypeObject *type)
5954 {
5955     PyObject *func;
5956 
5957     if (_PyDict_GetItemId(type->tp_dict, &PyId___new__) != NULL)
5958         return 0;
5959     func = PyCFunction_NewEx(tp_new_methoddef, (PyObject *)type, NULL);
5960     if (func == NULL)
5961         return -1;
5962     if (_PyDict_SetItemId(type->tp_dict, &PyId___new__, func)) {
5963         Py_DECREF(func);
5964         return -1;
5965     }
5966     Py_DECREF(func);
5967     return 0;
5968 }
5969 
5970 /* Slot wrappers that call the corresponding __foo__ slot.  See comments
5971    below at override_slots() for more explanation. */
5972 
5973 #define SLOT0(FUNCNAME, OPSTR) \
5974 static PyObject * \
5975 FUNCNAME(PyObject *self) \
5976 { \
5977     _Py_static_string(id, OPSTR); \
5978     return call_method(self, &id, NULL, 0); \
5979 }
5980 
5981 #define SLOT1(FUNCNAME, OPSTR, ARG1TYPE) \
5982 static PyObject * \
5983 FUNCNAME(PyObject *self, ARG1TYPE arg1) \
5984 { \
5985     PyObject* stack[1] = {arg1}; \
5986     _Py_static_string(id, OPSTR); \
5987     return call_method(self, &id, stack, 1); \
5988 }
5989 
5990 /* Boolean helper for SLOT1BINFULL().
5991    right.__class__ is a nontrivial subclass of left.__class__. */
5992 static int
method_is_overloaded(PyObject * left,PyObject * right,struct _Py_Identifier * name)5993 method_is_overloaded(PyObject *left, PyObject *right, struct _Py_Identifier *name)
5994 {
5995     PyObject *a, *b;
5996     int ok;
5997 
5998     b = _PyObject_GetAttrId((PyObject *)(Py_TYPE(right)), name);
5999     if (b == NULL) {
6000         PyErr_Clear();
6001         /* If right doesn't have it, it's not overloaded */
6002         return 0;
6003     }
6004 
6005     a = _PyObject_GetAttrId((PyObject *)(Py_TYPE(left)), name);
6006     if (a == NULL) {
6007         PyErr_Clear();
6008         Py_DECREF(b);
6009         /* If right has it but left doesn't, it's overloaded */
6010         return 1;
6011     }
6012 
6013     ok = PyObject_RichCompareBool(a, b, Py_NE);
6014     Py_DECREF(a);
6015     Py_DECREF(b);
6016     if (ok < 0) {
6017         PyErr_Clear();
6018         return 0;
6019     }
6020 
6021     return ok;
6022 }
6023 
6024 
6025 #define SLOT1BINFULL(FUNCNAME, TESTFUNC, SLOTNAME, OPSTR, ROPSTR) \
6026 static PyObject * \
6027 FUNCNAME(PyObject *self, PyObject *other) \
6028 { \
6029     PyObject* stack[1]; \
6030     _Py_static_string(op_id, OPSTR); \
6031     _Py_static_string(rop_id, ROPSTR); \
6032     int do_other = Py_TYPE(self) != Py_TYPE(other) && \
6033         Py_TYPE(other)->tp_as_number != NULL && \
6034         Py_TYPE(other)->tp_as_number->SLOTNAME == TESTFUNC; \
6035     if (Py_TYPE(self)->tp_as_number != NULL && \
6036         Py_TYPE(self)->tp_as_number->SLOTNAME == TESTFUNC) { \
6037         PyObject *r; \
6038         if (do_other && \
6039             PyType_IsSubtype(Py_TYPE(other), Py_TYPE(self)) && \
6040             method_is_overloaded(self, other, &rop_id)) { \
6041             stack[0] = self; \
6042             r = call_maybe(other, &rop_id, stack, 1); \
6043             if (r != Py_NotImplemented) \
6044                 return r; \
6045             Py_DECREF(r); \
6046             do_other = 0; \
6047         } \
6048         stack[0] = other; \
6049         r = call_maybe(self, &op_id, stack, 1); \
6050         if (r != Py_NotImplemented || \
6051             Py_TYPE(other) == Py_TYPE(self)) \
6052             return r; \
6053         Py_DECREF(r); \
6054     } \
6055     if (do_other) { \
6056         stack[0] = self; \
6057         return call_maybe(other, &rop_id, stack, 1); \
6058     } \
6059     Py_RETURN_NOTIMPLEMENTED; \
6060 }
6061 
6062 #define SLOT1BIN(FUNCNAME, SLOTNAME, OPSTR, ROPSTR) \
6063     SLOT1BINFULL(FUNCNAME, FUNCNAME, SLOTNAME, OPSTR, ROPSTR)
6064 
6065 static Py_ssize_t
slot_sq_length(PyObject * self)6066 slot_sq_length(PyObject *self)
6067 {
6068     PyObject *res = call_method(self, &PyId___len__, NULL, 0);
6069     Py_ssize_t len;
6070 
6071     if (res == NULL)
6072         return -1;
6073 
6074     Py_SETREF(res, PyNumber_Index(res));
6075     if (res == NULL)
6076         return -1;
6077 
6078     assert(PyLong_Check(res));
6079     if (Py_SIZE(res) < 0) {
6080         Py_DECREF(res);
6081         PyErr_SetString(PyExc_ValueError,
6082                         "__len__() should return >= 0");
6083         return -1;
6084     }
6085 
6086     len = PyNumber_AsSsize_t(res, PyExc_OverflowError);
6087     assert(len >= 0 || PyErr_ExceptionMatches(PyExc_OverflowError));
6088     Py_DECREF(res);
6089     return len;
6090 }
6091 
6092 static PyObject *
slot_sq_item(PyObject * self,Py_ssize_t i)6093 slot_sq_item(PyObject *self, Py_ssize_t i)
6094 {
6095     PyObject *retval;
6096     PyObject *args[1];
6097     PyObject *ival = PyLong_FromSsize_t(i);
6098     if (ival == NULL) {
6099         return NULL;
6100     }
6101     args[0] = ival;
6102     retval = call_method(self, &PyId___getitem__, args, 1);
6103     Py_DECREF(ival);
6104     return retval;
6105 }
6106 
6107 static int
slot_sq_ass_item(PyObject * self,Py_ssize_t index,PyObject * value)6108 slot_sq_ass_item(PyObject *self, Py_ssize_t index, PyObject *value)
6109 {
6110     PyObject *stack[2];
6111     PyObject *res;
6112     PyObject *index_obj;
6113 
6114     index_obj = PyLong_FromSsize_t(index);
6115     if (index_obj == NULL) {
6116         return -1;
6117     }
6118 
6119     stack[0] = index_obj;
6120     if (value == NULL) {
6121         res = call_method(self, &PyId___delitem__, stack, 1);
6122     }
6123     else {
6124         stack[1] = value;
6125         res = call_method(self, &PyId___setitem__, stack, 2);
6126     }
6127     Py_DECREF(index_obj);
6128 
6129     if (res == NULL) {
6130         return -1;
6131     }
6132     Py_DECREF(res);
6133     return 0;
6134 }
6135 
6136 static int
slot_sq_contains(PyObject * self,PyObject * value)6137 slot_sq_contains(PyObject *self, PyObject *value)
6138 {
6139     PyObject *func, *res;
6140     int result = -1, unbound;
6141     _Py_IDENTIFIER(__contains__);
6142 
6143     func = lookup_maybe_method(self, &PyId___contains__, &unbound);
6144     if (func == Py_None) {
6145         Py_DECREF(func);
6146         PyErr_Format(PyExc_TypeError,
6147                      "'%.200s' object is not a container",
6148                      Py_TYPE(self)->tp_name);
6149         return -1;
6150     }
6151     if (func != NULL) {
6152         PyObject *args[1] = {value};
6153         res = call_unbound(unbound, func, self, args, 1);
6154         Py_DECREF(func);
6155         if (res != NULL) {
6156             result = PyObject_IsTrue(res);
6157             Py_DECREF(res);
6158         }
6159     }
6160     else if (! PyErr_Occurred()) {
6161         /* Possible results: -1 and 1 */
6162         result = (int)_PySequence_IterSearch(self, value,
6163                                          PY_ITERSEARCH_CONTAINS);
6164     }
6165     return result;
6166 }
6167 
6168 #define slot_mp_length slot_sq_length
6169 
6170 SLOT1(slot_mp_subscript, "__getitem__", PyObject *)
6171 
6172 static int
slot_mp_ass_subscript(PyObject * self,PyObject * key,PyObject * value)6173 slot_mp_ass_subscript(PyObject *self, PyObject *key, PyObject *value)
6174 {
6175     PyObject *stack[2];
6176     PyObject *res;
6177 
6178     stack[0] = key;
6179     if (value == NULL) {
6180         res = call_method(self, &PyId___delitem__, stack, 1);
6181     }
6182     else {
6183         stack[1] = value;
6184         res = call_method(self, &PyId___setitem__, stack, 2);
6185     }
6186 
6187     if (res == NULL)
6188         return -1;
6189     Py_DECREF(res);
6190     return 0;
6191 }
6192 
6193 SLOT1BIN(slot_nb_add, nb_add, "__add__", "__radd__")
6194 SLOT1BIN(slot_nb_subtract, nb_subtract, "__sub__", "__rsub__")
6195 SLOT1BIN(slot_nb_multiply, nb_multiply, "__mul__", "__rmul__")
6196 SLOT1BIN(slot_nb_matrix_multiply, nb_matrix_multiply, "__matmul__", "__rmatmul__")
6197 SLOT1BIN(slot_nb_remainder, nb_remainder, "__mod__", "__rmod__")
6198 SLOT1BIN(slot_nb_divmod, nb_divmod, "__divmod__", "__rdivmod__")
6199 
6200 static PyObject *slot_nb_power(PyObject *, PyObject *, PyObject *);
6201 
6202 SLOT1BINFULL(slot_nb_power_binary, slot_nb_power,
6203              nb_power, "__pow__", "__rpow__")
6204 
6205 static PyObject *
slot_nb_power(PyObject * self,PyObject * other,PyObject * modulus)6206 slot_nb_power(PyObject *self, PyObject *other, PyObject *modulus)
6207 {
6208     _Py_IDENTIFIER(__pow__);
6209 
6210     if (modulus == Py_None)
6211         return slot_nb_power_binary(self, other);
6212     /* Three-arg power doesn't use __rpow__.  But ternary_op
6213        can call this when the second argument's type uses
6214        slot_nb_power, so check before calling self.__pow__. */
6215     if (Py_TYPE(self)->tp_as_number != NULL &&
6216         Py_TYPE(self)->tp_as_number->nb_power == slot_nb_power) {
6217         PyObject* stack[2] = {other, modulus};
6218         return call_method(self, &PyId___pow__, stack, 2);
6219     }
6220     Py_RETURN_NOTIMPLEMENTED;
6221 }
6222 
6223 SLOT0(slot_nb_negative, "__neg__")
6224 SLOT0(slot_nb_positive, "__pos__")
6225 SLOT0(slot_nb_absolute, "__abs__")
6226 
6227 static int
slot_nb_bool(PyObject * self)6228 slot_nb_bool(PyObject *self)
6229 {
6230     PyObject *func, *value;
6231     int result, unbound;
6232     int using_len = 0;
6233     _Py_IDENTIFIER(__bool__);
6234 
6235     func = lookup_maybe_method(self, &PyId___bool__, &unbound);
6236     if (func == NULL) {
6237         if (PyErr_Occurred()) {
6238             return -1;
6239         }
6240 
6241         func = lookup_maybe_method(self, &PyId___len__, &unbound);
6242         if (func == NULL) {
6243             if (PyErr_Occurred()) {
6244                 return -1;
6245             }
6246             return 1;
6247         }
6248         using_len = 1;
6249     }
6250 
6251     value = call_unbound_noarg(unbound, func, self);
6252     if (value == NULL) {
6253         goto error;
6254     }
6255 
6256     if (using_len) {
6257         /* bool type enforced by slot_nb_len */
6258         result = PyObject_IsTrue(value);
6259     }
6260     else if (PyBool_Check(value)) {
6261         result = PyObject_IsTrue(value);
6262     }
6263     else {
6264         PyErr_Format(PyExc_TypeError,
6265                      "__bool__ should return "
6266                      "bool, returned %s",
6267                      Py_TYPE(value)->tp_name);
6268         result = -1;
6269     }
6270 
6271     Py_DECREF(value);
6272     Py_DECREF(func);
6273     return result;
6274 
6275 error:
6276     Py_DECREF(func);
6277     return -1;
6278 }
6279 
6280 
6281 static PyObject *
slot_nb_index(PyObject * self)6282 slot_nb_index(PyObject *self)
6283 {
6284     _Py_IDENTIFIER(__index__);
6285     return call_method(self, &PyId___index__, NULL, 0);
6286 }
6287 
6288 
6289 SLOT0(slot_nb_invert, "__invert__")
6290 SLOT1BIN(slot_nb_lshift, nb_lshift, "__lshift__", "__rlshift__")
6291 SLOT1BIN(slot_nb_rshift, nb_rshift, "__rshift__", "__rrshift__")
6292 SLOT1BIN(slot_nb_and, nb_and, "__and__", "__rand__")
6293 SLOT1BIN(slot_nb_xor, nb_xor, "__xor__", "__rxor__")
6294 SLOT1BIN(slot_nb_or, nb_or, "__or__", "__ror__")
6295 
6296 SLOT0(slot_nb_int, "__int__")
6297 SLOT0(slot_nb_float, "__float__")
6298 SLOT1(slot_nb_inplace_add, "__iadd__", PyObject *)
6299 SLOT1(slot_nb_inplace_subtract, "__isub__", PyObject *)
6300 SLOT1(slot_nb_inplace_multiply, "__imul__", PyObject *)
6301 SLOT1(slot_nb_inplace_matrix_multiply, "__imatmul__", PyObject *)
6302 SLOT1(slot_nb_inplace_remainder, "__imod__", PyObject *)
6303 /* Can't use SLOT1 here, because nb_inplace_power is ternary */
6304 static PyObject *
slot_nb_inplace_power(PyObject * self,PyObject * arg1,PyObject * arg2)6305 slot_nb_inplace_power(PyObject *self, PyObject * arg1, PyObject *arg2)
6306 {
6307     PyObject *stack[1] = {arg1};
6308     _Py_IDENTIFIER(__ipow__);
6309     return call_method(self, &PyId___ipow__, stack, 1);
6310 }
6311 SLOT1(slot_nb_inplace_lshift, "__ilshift__", PyObject *)
6312 SLOT1(slot_nb_inplace_rshift, "__irshift__", PyObject *)
6313 SLOT1(slot_nb_inplace_and, "__iand__", PyObject *)
6314 SLOT1(slot_nb_inplace_xor, "__ixor__", PyObject *)
6315 SLOT1(slot_nb_inplace_or, "__ior__", PyObject *)
6316 SLOT1BIN(slot_nb_floor_divide, nb_floor_divide,
6317          "__floordiv__", "__rfloordiv__")
6318 SLOT1BIN(slot_nb_true_divide, nb_true_divide, "__truediv__", "__rtruediv__")
6319 SLOT1(slot_nb_inplace_floor_divide, "__ifloordiv__", PyObject *)
6320 SLOT1(slot_nb_inplace_true_divide, "__itruediv__", PyObject *)
6321 
6322 static PyObject *
slot_tp_repr(PyObject * self)6323 slot_tp_repr(PyObject *self)
6324 {
6325     PyObject *func, *res;
6326     _Py_IDENTIFIER(__repr__);
6327     int unbound;
6328 
6329     func = lookup_maybe_method(self, &PyId___repr__, &unbound);
6330     if (func != NULL) {
6331         res = call_unbound_noarg(unbound, func, self);
6332         Py_DECREF(func);
6333         return res;
6334     }
6335     PyErr_Clear();
6336     return PyUnicode_FromFormat("<%s object at %p>",
6337                                Py_TYPE(self)->tp_name, self);
6338 }
6339 
6340 SLOT0(slot_tp_str, "__str__")
6341 
6342 static Py_hash_t
slot_tp_hash(PyObject * self)6343 slot_tp_hash(PyObject *self)
6344 {
6345     PyObject *func, *res;
6346     Py_ssize_t h;
6347     int unbound;
6348 
6349     func = lookup_maybe_method(self, &PyId___hash__, &unbound);
6350 
6351     if (func == Py_None) {
6352         Py_DECREF(func);
6353         func = NULL;
6354     }
6355 
6356     if (func == NULL) {
6357         return PyObject_HashNotImplemented(self);
6358     }
6359 
6360     res = call_unbound_noarg(unbound, func, self);
6361     Py_DECREF(func);
6362     if (res == NULL)
6363         return -1;
6364 
6365     if (!PyLong_Check(res)) {
6366         PyErr_SetString(PyExc_TypeError,
6367                         "__hash__ method should return an integer");
6368         return -1;
6369     }
6370     /* Transform the PyLong `res` to a Py_hash_t `h`.  For an existing
6371        hashable Python object x, hash(x) will always lie within the range of
6372        Py_hash_t.  Therefore our transformation must preserve values that
6373        already lie within this range, to ensure that if x.__hash__() returns
6374        hash(y) then hash(x) == hash(y). */
6375     h = PyLong_AsSsize_t(res);
6376     if (h == -1 && PyErr_Occurred()) {
6377         /* res was not within the range of a Py_hash_t, so we're free to
6378            use any sufficiently bit-mixing transformation;
6379            long.__hash__ will do nicely. */
6380         PyErr_Clear();
6381         h = PyLong_Type.tp_hash(res);
6382     }
6383     /* -1 is reserved for errors. */
6384     if (h == -1)
6385         h = -2;
6386     Py_DECREF(res);
6387     return h;
6388 }
6389 
6390 static PyObject *
slot_tp_call(PyObject * self,PyObject * args,PyObject * kwds)6391 slot_tp_call(PyObject *self, PyObject *args, PyObject *kwds)
6392 {
6393     _Py_IDENTIFIER(__call__);
6394     int unbound;
6395     PyObject *meth = lookup_method(self, &PyId___call__, &unbound);
6396     PyObject *res;
6397 
6398     if (meth == NULL)
6399         return NULL;
6400 
6401     if (unbound) {
6402         res = _PyObject_Call_Prepend(meth, self, args, kwds);
6403     }
6404     else {
6405         res = PyObject_Call(meth, args, kwds);
6406     }
6407 
6408     Py_DECREF(meth);
6409     return res;
6410 }
6411 
6412 /* There are two slot dispatch functions for tp_getattro.
6413 
6414    - slot_tp_getattro() is used when __getattribute__ is overridden
6415      but no __getattr__ hook is present;
6416 
6417    - slot_tp_getattr_hook() is used when a __getattr__ hook is present.
6418 
6419    The code in update_one_slot() always installs slot_tp_getattr_hook(); this
6420    detects the absence of __getattr__ and then installs the simpler slot if
6421    necessary. */
6422 
6423 static PyObject *
slot_tp_getattro(PyObject * self,PyObject * name)6424 slot_tp_getattro(PyObject *self, PyObject *name)
6425 {
6426     PyObject *stack[1] = {name};
6427     return call_method(self, &PyId___getattribute__, stack, 1);
6428 }
6429 
6430 static PyObject *
call_attribute(PyObject * self,PyObject * attr,PyObject * name)6431 call_attribute(PyObject *self, PyObject *attr, PyObject *name)
6432 {
6433     PyObject *res, *descr = NULL;
6434     descrgetfunc f = Py_TYPE(attr)->tp_descr_get;
6435 
6436     if (f != NULL) {
6437         descr = f(attr, self, (PyObject *)(Py_TYPE(self)));
6438         if (descr == NULL)
6439             return NULL;
6440         else
6441             attr = descr;
6442     }
6443     res = PyObject_CallFunctionObjArgs(attr, name, NULL);
6444     Py_XDECREF(descr);
6445     return res;
6446 }
6447 
6448 static PyObject *
slot_tp_getattr_hook(PyObject * self,PyObject * name)6449 slot_tp_getattr_hook(PyObject *self, PyObject *name)
6450 {
6451     PyTypeObject *tp = Py_TYPE(self);
6452     PyObject *getattr, *getattribute, *res;
6453     _Py_IDENTIFIER(__getattr__);
6454 
6455     /* speed hack: we could use lookup_maybe, but that would resolve the
6456        method fully for each attribute lookup for classes with
6457        __getattr__, even when the attribute is present. So we use
6458        _PyType_Lookup and create the method only when needed, with
6459        call_attribute. */
6460     getattr = _PyType_LookupId(tp, &PyId___getattr__);
6461     if (getattr == NULL) {
6462         /* No __getattr__ hook: use a simpler dispatcher */
6463         tp->tp_getattro = slot_tp_getattro;
6464         return slot_tp_getattro(self, name);
6465     }
6466     Py_INCREF(getattr);
6467     /* speed hack: we could use lookup_maybe, but that would resolve the
6468        method fully for each attribute lookup for classes with
6469        __getattr__, even when self has the default __getattribute__
6470        method. So we use _PyType_Lookup and create the method only when
6471        needed, with call_attribute. */
6472     getattribute = _PyType_LookupId(tp, &PyId___getattribute__);
6473     if (getattribute == NULL ||
6474         (Py_TYPE(getattribute) == &PyWrapperDescr_Type &&
6475          ((PyWrapperDescrObject *)getattribute)->d_wrapped ==
6476          (void *)PyObject_GenericGetAttr))
6477         res = PyObject_GenericGetAttr(self, name);
6478     else {
6479         Py_INCREF(getattribute);
6480         res = call_attribute(self, getattribute, name);
6481         Py_DECREF(getattribute);
6482     }
6483     if (res == NULL && PyErr_ExceptionMatches(PyExc_AttributeError)) {
6484         PyErr_Clear();
6485         res = call_attribute(self, getattr, name);
6486     }
6487     Py_DECREF(getattr);
6488     return res;
6489 }
6490 
6491 static int
slot_tp_setattro(PyObject * self,PyObject * name,PyObject * value)6492 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value)
6493 {
6494     PyObject *stack[2];
6495     PyObject *res;
6496     _Py_IDENTIFIER(__delattr__);
6497     _Py_IDENTIFIER(__setattr__);
6498 
6499     stack[0] = name;
6500     if (value == NULL) {
6501         res = call_method(self, &PyId___delattr__, stack, 1);
6502     }
6503     else {
6504         stack[1] = value;
6505         res = call_method(self, &PyId___setattr__, stack, 2);
6506     }
6507     if (res == NULL)
6508         return -1;
6509     Py_DECREF(res);
6510     return 0;
6511 }
6512 
6513 static _Py_Identifier name_op[] = {
6514     {0, "__lt__", 0},
6515     {0, "__le__", 0},
6516     {0, "__eq__", 0},
6517     {0, "__ne__", 0},
6518     {0, "__gt__", 0},
6519     {0, "__ge__", 0}
6520 };
6521 
6522 static PyObject *
slot_tp_richcompare(PyObject * self,PyObject * other,int op)6523 slot_tp_richcompare(PyObject *self, PyObject *other, int op)
6524 {
6525     int unbound;
6526     PyObject *func, *res;
6527 
6528     func = lookup_maybe_method(self, &name_op[op], &unbound);
6529     if (func == NULL) {
6530         PyErr_Clear();
6531         Py_RETURN_NOTIMPLEMENTED;
6532     }
6533 
6534     PyObject *args[1] = {other};
6535     res = call_unbound(unbound, func, self, args, 1);
6536     Py_DECREF(func);
6537     return res;
6538 }
6539 
6540 static PyObject *
slot_tp_iter(PyObject * self)6541 slot_tp_iter(PyObject *self)
6542 {
6543     int unbound;
6544     PyObject *func, *res;
6545     _Py_IDENTIFIER(__iter__);
6546 
6547     func = lookup_maybe_method(self, &PyId___iter__, &unbound);
6548     if (func == Py_None) {
6549         Py_DECREF(func);
6550         PyErr_Format(PyExc_TypeError,
6551                      "'%.200s' object is not iterable",
6552                      Py_TYPE(self)->tp_name);
6553         return NULL;
6554     }
6555 
6556     if (func != NULL) {
6557         res = call_unbound_noarg(unbound, func, self);
6558         Py_DECREF(func);
6559         return res;
6560     }
6561 
6562     PyErr_Clear();
6563     func = lookup_maybe_method(self, &PyId___getitem__, &unbound);
6564     if (func == NULL) {
6565         PyErr_Format(PyExc_TypeError,
6566                      "'%.200s' object is not iterable",
6567                      Py_TYPE(self)->tp_name);
6568         return NULL;
6569     }
6570     Py_DECREF(func);
6571     return PySeqIter_New(self);
6572 }
6573 
6574 static PyObject *
slot_tp_iternext(PyObject * self)6575 slot_tp_iternext(PyObject *self)
6576 {
6577     _Py_IDENTIFIER(__next__);
6578     return call_method(self, &PyId___next__, NULL, 0);
6579 }
6580 
6581 static PyObject *
slot_tp_descr_get(PyObject * self,PyObject * obj,PyObject * type)6582 slot_tp_descr_get(PyObject *self, PyObject *obj, PyObject *type)
6583 {
6584     PyTypeObject *tp = Py_TYPE(self);
6585     PyObject *get;
6586     _Py_IDENTIFIER(__get__);
6587 
6588     get = _PyType_LookupId(tp, &PyId___get__);
6589     if (get == NULL) {
6590         /* Avoid further slowdowns */
6591         if (tp->tp_descr_get == slot_tp_descr_get)
6592             tp->tp_descr_get = NULL;
6593         Py_INCREF(self);
6594         return self;
6595     }
6596     if (obj == NULL)
6597         obj = Py_None;
6598     if (type == NULL)
6599         type = Py_None;
6600     return PyObject_CallFunctionObjArgs(get, self, obj, type, NULL);
6601 }
6602 
6603 static int
slot_tp_descr_set(PyObject * self,PyObject * target,PyObject * value)6604 slot_tp_descr_set(PyObject *self, PyObject *target, PyObject *value)
6605 {
6606     PyObject* stack[2];
6607     PyObject *res;
6608     _Py_IDENTIFIER(__delete__);
6609     _Py_IDENTIFIER(__set__);
6610 
6611     stack[0] = target;
6612     if (value == NULL) {
6613         res = call_method(self, &PyId___delete__, stack, 1);
6614     }
6615     else {
6616         stack[1] = value;
6617         res = call_method(self, &PyId___set__, stack, 2);
6618     }
6619     if (res == NULL)
6620         return -1;
6621     Py_DECREF(res);
6622     return 0;
6623 }
6624 
6625 static int
slot_tp_init(PyObject * self,PyObject * args,PyObject * kwds)6626 slot_tp_init(PyObject *self, PyObject *args, PyObject *kwds)
6627 {
6628     _Py_IDENTIFIER(__init__);
6629     int unbound;
6630     PyObject *meth = lookup_method(self, &PyId___init__, &unbound);
6631     PyObject *res;
6632 
6633     if (meth == NULL)
6634         return -1;
6635     if (unbound) {
6636         res = _PyObject_Call_Prepend(meth, self, args, kwds);
6637     }
6638     else {
6639         res = PyObject_Call(meth, args, kwds);
6640     }
6641     Py_DECREF(meth);
6642     if (res == NULL)
6643         return -1;
6644     if (res != Py_None) {
6645         PyErr_Format(PyExc_TypeError,
6646                      "__init__() should return None, not '%.200s'",
6647                      Py_TYPE(res)->tp_name);
6648         Py_DECREF(res);
6649         return -1;
6650     }
6651     Py_DECREF(res);
6652     return 0;
6653 }
6654 
6655 static PyObject *
slot_tp_new(PyTypeObject * type,PyObject * args,PyObject * kwds)6656 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
6657 {
6658     PyObject *func, *result;
6659 
6660     func = _PyObject_GetAttrId((PyObject *)type, &PyId___new__);
6661     if (func == NULL) {
6662         return NULL;
6663     }
6664 
6665     result = _PyObject_Call_Prepend(func, (PyObject *)type, args, kwds);
6666     Py_DECREF(func);
6667     return result;
6668 }
6669 
6670 static void
slot_tp_finalize(PyObject * self)6671 slot_tp_finalize(PyObject *self)
6672 {
6673     _Py_IDENTIFIER(__del__);
6674     int unbound;
6675     PyObject *del, *res;
6676     PyObject *error_type, *error_value, *error_traceback;
6677 
6678     /* Save the current exception, if any. */
6679     PyErr_Fetch(&error_type, &error_value, &error_traceback);
6680 
6681     /* Execute __del__ method, if any. */
6682     del = lookup_maybe_method(self, &PyId___del__, &unbound);
6683     if (del != NULL) {
6684         res = call_unbound_noarg(unbound, del, self);
6685         if (res == NULL)
6686             PyErr_WriteUnraisable(del);
6687         else
6688             Py_DECREF(res);
6689         Py_DECREF(del);
6690     }
6691 
6692     /* Restore the saved exception. */
6693     PyErr_Restore(error_type, error_value, error_traceback);
6694 }
6695 
6696 static PyObject *
slot_am_await(PyObject * self)6697 slot_am_await(PyObject *self)
6698 {
6699     int unbound;
6700     PyObject *func, *res;
6701     _Py_IDENTIFIER(__await__);
6702 
6703     func = lookup_maybe_method(self, &PyId___await__, &unbound);
6704     if (func != NULL) {
6705         res = call_unbound_noarg(unbound, func, self);
6706         Py_DECREF(func);
6707         return res;
6708     }
6709     PyErr_Format(PyExc_AttributeError,
6710                  "object %.50s does not have __await__ method",
6711                  Py_TYPE(self)->tp_name);
6712     return NULL;
6713 }
6714 
6715 static PyObject *
slot_am_aiter(PyObject * self)6716 slot_am_aiter(PyObject *self)
6717 {
6718     int unbound;
6719     PyObject *func, *res;
6720     _Py_IDENTIFIER(__aiter__);
6721 
6722     func = lookup_maybe_method(self, &PyId___aiter__, &unbound);
6723     if (func != NULL) {
6724         res = call_unbound_noarg(unbound, func, self);
6725         Py_DECREF(func);
6726         return res;
6727     }
6728     PyErr_Format(PyExc_AttributeError,
6729                  "object %.50s does not have __aiter__ method",
6730                  Py_TYPE(self)->tp_name);
6731     return NULL;
6732 }
6733 
6734 static PyObject *
slot_am_anext(PyObject * self)6735 slot_am_anext(PyObject *self)
6736 {
6737     int unbound;
6738     PyObject *func, *res;
6739     _Py_IDENTIFIER(__anext__);
6740 
6741     func = lookup_maybe_method(self, &PyId___anext__, &unbound);
6742     if (func != NULL) {
6743         res = call_unbound_noarg(unbound, func, self);
6744         Py_DECREF(func);
6745         return res;
6746     }
6747     PyErr_Format(PyExc_AttributeError,
6748                  "object %.50s does not have __anext__ method",
6749                  Py_TYPE(self)->tp_name);
6750     return NULL;
6751 }
6752 
6753 /*
6754 Table mapping __foo__ names to tp_foo offsets and slot_tp_foo wrapper functions.
6755 
6756 The table is ordered by offsets relative to the 'PyHeapTypeObject' structure,
6757 which incorporates the additional structures used for numbers, sequences and
6758 mappings.  Note that multiple names may map to the same slot (e.g. __eq__,
6759 __ne__ etc. all map to tp_richcompare) and one name may map to multiple slots
6760 (e.g. __str__ affects tp_str as well as tp_repr). The table is terminated with
6761 an all-zero entry.  (This table is further initialized in init_slotdefs().)
6762 */
6763 
6764 typedef struct wrapperbase slotdef;
6765 
6766 #undef TPSLOT
6767 #undef FLSLOT
6768 #undef AMSLOT
6769 #undef ETSLOT
6770 #undef SQSLOT
6771 #undef MPSLOT
6772 #undef NBSLOT
6773 #undef UNSLOT
6774 #undef IBSLOT
6775 #undef BINSLOT
6776 #undef RBINSLOT
6777 
6778 #define TPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6779     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
6780      PyDoc_STR(DOC)}
6781 #define FLSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC, FLAGS) \
6782     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
6783      PyDoc_STR(DOC), FLAGS}
6784 #define ETSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6785     {NAME, offsetof(PyHeapTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
6786      PyDoc_STR(DOC)}
6787 #define AMSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6788     ETSLOT(NAME, as_async.SLOT, FUNCTION, WRAPPER, DOC)
6789 #define SQSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6790     ETSLOT(NAME, as_sequence.SLOT, FUNCTION, WRAPPER, DOC)
6791 #define MPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6792     ETSLOT(NAME, as_mapping.SLOT, FUNCTION, WRAPPER, DOC)
6793 #define NBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6794     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, DOC)
6795 #define UNSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6796     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
6797            NAME "($self, /)\n--\n\n" DOC)
6798 #define IBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
6799     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
6800            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
6801 #define BINSLOT(NAME, SLOT, FUNCTION, DOC) \
6802     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
6803            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
6804 #define RBINSLOT(NAME, SLOT, FUNCTION, DOC) \
6805     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
6806            NAME "($self, value, /)\n--\n\nReturn value" DOC "self.")
6807 #define BINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
6808     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
6809            NAME "($self, value, /)\n--\n\n" DOC)
6810 #define RBINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
6811     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
6812            NAME "($self, value, /)\n--\n\n" DOC)
6813 
6814 static slotdef slotdefs[] = {
6815     TPSLOT("__getattribute__", tp_getattr, NULL, NULL, ""),
6816     TPSLOT("__getattr__", tp_getattr, NULL, NULL, ""),
6817     TPSLOT("__setattr__", tp_setattr, NULL, NULL, ""),
6818     TPSLOT("__delattr__", tp_setattr, NULL, NULL, ""),
6819     TPSLOT("__repr__", tp_repr, slot_tp_repr, wrap_unaryfunc,
6820            "__repr__($self, /)\n--\n\nReturn repr(self)."),
6821     TPSLOT("__hash__", tp_hash, slot_tp_hash, wrap_hashfunc,
6822            "__hash__($self, /)\n--\n\nReturn hash(self)."),
6823     FLSLOT("__call__", tp_call, slot_tp_call, (wrapperfunc)(void(*)(void))wrap_call,
6824            "__call__($self, /, *args, **kwargs)\n--\n\nCall self as a function.",
6825            PyWrapperFlag_KEYWORDS),
6826     TPSLOT("__str__", tp_str, slot_tp_str, wrap_unaryfunc,
6827            "__str__($self, /)\n--\n\nReturn str(self)."),
6828     TPSLOT("__getattribute__", tp_getattro, slot_tp_getattr_hook,
6829            wrap_binaryfunc,
6830            "__getattribute__($self, name, /)\n--\n\nReturn getattr(self, name)."),
6831     TPSLOT("__getattr__", tp_getattro, slot_tp_getattr_hook, NULL, ""),
6832     TPSLOT("__setattr__", tp_setattro, slot_tp_setattro, wrap_setattr,
6833            "__setattr__($self, name, value, /)\n--\n\nImplement setattr(self, name, value)."),
6834     TPSLOT("__delattr__", tp_setattro, slot_tp_setattro, wrap_delattr,
6835            "__delattr__($self, name, /)\n--\n\nImplement delattr(self, name)."),
6836     TPSLOT("__lt__", tp_richcompare, slot_tp_richcompare, richcmp_lt,
6837            "__lt__($self, value, /)\n--\n\nReturn self<value."),
6838     TPSLOT("__le__", tp_richcompare, slot_tp_richcompare, richcmp_le,
6839            "__le__($self, value, /)\n--\n\nReturn self<=value."),
6840     TPSLOT("__eq__", tp_richcompare, slot_tp_richcompare, richcmp_eq,
6841            "__eq__($self, value, /)\n--\n\nReturn self==value."),
6842     TPSLOT("__ne__", tp_richcompare, slot_tp_richcompare, richcmp_ne,
6843            "__ne__($self, value, /)\n--\n\nReturn self!=value."),
6844     TPSLOT("__gt__", tp_richcompare, slot_tp_richcompare, richcmp_gt,
6845            "__gt__($self, value, /)\n--\n\nReturn self>value."),
6846     TPSLOT("__ge__", tp_richcompare, slot_tp_richcompare, richcmp_ge,
6847            "__ge__($self, value, /)\n--\n\nReturn self>=value."),
6848     TPSLOT("__iter__", tp_iter, slot_tp_iter, wrap_unaryfunc,
6849            "__iter__($self, /)\n--\n\nImplement iter(self)."),
6850     TPSLOT("__next__", tp_iternext, slot_tp_iternext, wrap_next,
6851            "__next__($self, /)\n--\n\nImplement next(self)."),
6852     TPSLOT("__get__", tp_descr_get, slot_tp_descr_get, wrap_descr_get,
6853            "__get__($self, instance, owner, /)\n--\n\nReturn an attribute of instance, which is of type owner."),
6854     TPSLOT("__set__", tp_descr_set, slot_tp_descr_set, wrap_descr_set,
6855            "__set__($self, instance, value, /)\n--\n\nSet an attribute of instance to value."),
6856     TPSLOT("__delete__", tp_descr_set, slot_tp_descr_set,
6857            wrap_descr_delete,
6858            "__delete__($self, instance, /)\n--\n\nDelete an attribute of instance."),
6859     FLSLOT("__init__", tp_init, slot_tp_init, (wrapperfunc)(void(*)(void))wrap_init,
6860            "__init__($self, /, *args, **kwargs)\n--\n\n"
6861            "Initialize self.  See help(type(self)) for accurate signature.",
6862            PyWrapperFlag_KEYWORDS),
6863     TPSLOT("__new__", tp_new, slot_tp_new, NULL,
6864            "__new__(type, /, *args, **kwargs)\n--\n\n"
6865            "Create and return new object.  See help(type) for accurate signature."),
6866     TPSLOT("__del__", tp_finalize, slot_tp_finalize, (wrapperfunc)wrap_del, ""),
6867 
6868     AMSLOT("__await__", am_await, slot_am_await, wrap_unaryfunc,
6869            "__await__($self, /)\n--\n\nReturn an iterator to be used in await expression."),
6870     AMSLOT("__aiter__", am_aiter, slot_am_aiter, wrap_unaryfunc,
6871            "__aiter__($self, /)\n--\n\nReturn an awaitable, that resolves in asynchronous iterator."),
6872     AMSLOT("__anext__", am_anext, slot_am_anext, wrap_unaryfunc,
6873            "__anext__($self, /)\n--\n\nReturn a value or raise StopAsyncIteration."),
6874 
6875     BINSLOT("__add__", nb_add, slot_nb_add,
6876            "+"),
6877     RBINSLOT("__radd__", nb_add, slot_nb_add,
6878            "+"),
6879     BINSLOT("__sub__", nb_subtract, slot_nb_subtract,
6880            "-"),
6881     RBINSLOT("__rsub__", nb_subtract, slot_nb_subtract,
6882            "-"),
6883     BINSLOT("__mul__", nb_multiply, slot_nb_multiply,
6884            "*"),
6885     RBINSLOT("__rmul__", nb_multiply, slot_nb_multiply,
6886            "*"),
6887     BINSLOT("__mod__", nb_remainder, slot_nb_remainder,
6888            "%"),
6889     RBINSLOT("__rmod__", nb_remainder, slot_nb_remainder,
6890            "%"),
6891     BINSLOTNOTINFIX("__divmod__", nb_divmod, slot_nb_divmod,
6892            "Return divmod(self, value)."),
6893     RBINSLOTNOTINFIX("__rdivmod__", nb_divmod, slot_nb_divmod,
6894            "Return divmod(value, self)."),
6895     NBSLOT("__pow__", nb_power, slot_nb_power, wrap_ternaryfunc,
6896            "__pow__($self, value, mod=None, /)\n--\n\nReturn pow(self, value, mod)."),
6897     NBSLOT("__rpow__", nb_power, slot_nb_power, wrap_ternaryfunc_r,
6898            "__rpow__($self, value, mod=None, /)\n--\n\nReturn pow(value, self, mod)."),
6899     UNSLOT("__neg__", nb_negative, slot_nb_negative, wrap_unaryfunc, "-self"),
6900     UNSLOT("__pos__", nb_positive, slot_nb_positive, wrap_unaryfunc, "+self"),
6901     UNSLOT("__abs__", nb_absolute, slot_nb_absolute, wrap_unaryfunc,
6902            "abs(self)"),
6903     UNSLOT("__bool__", nb_bool, slot_nb_bool, wrap_inquirypred,
6904            "self != 0"),
6905     UNSLOT("__invert__", nb_invert, slot_nb_invert, wrap_unaryfunc, "~self"),
6906     BINSLOT("__lshift__", nb_lshift, slot_nb_lshift, "<<"),
6907     RBINSLOT("__rlshift__", nb_lshift, slot_nb_lshift, "<<"),
6908     BINSLOT("__rshift__", nb_rshift, slot_nb_rshift, ">>"),
6909     RBINSLOT("__rrshift__", nb_rshift, slot_nb_rshift, ">>"),
6910     BINSLOT("__and__", nb_and, slot_nb_and, "&"),
6911     RBINSLOT("__rand__", nb_and, slot_nb_and, "&"),
6912     BINSLOT("__xor__", nb_xor, slot_nb_xor, "^"),
6913     RBINSLOT("__rxor__", nb_xor, slot_nb_xor, "^"),
6914     BINSLOT("__or__", nb_or, slot_nb_or, "|"),
6915     RBINSLOT("__ror__", nb_or, slot_nb_or, "|"),
6916     UNSLOT("__int__", nb_int, slot_nb_int, wrap_unaryfunc,
6917            "int(self)"),
6918     UNSLOT("__float__", nb_float, slot_nb_float, wrap_unaryfunc,
6919            "float(self)"),
6920     IBSLOT("__iadd__", nb_inplace_add, slot_nb_inplace_add,
6921            wrap_binaryfunc, "+="),
6922     IBSLOT("__isub__", nb_inplace_subtract, slot_nb_inplace_subtract,
6923            wrap_binaryfunc, "-="),
6924     IBSLOT("__imul__", nb_inplace_multiply, slot_nb_inplace_multiply,
6925            wrap_binaryfunc, "*="),
6926     IBSLOT("__imod__", nb_inplace_remainder, slot_nb_inplace_remainder,
6927            wrap_binaryfunc, "%="),
6928     IBSLOT("__ipow__", nb_inplace_power, slot_nb_inplace_power,
6929            wrap_binaryfunc, "**="),
6930     IBSLOT("__ilshift__", nb_inplace_lshift, slot_nb_inplace_lshift,
6931            wrap_binaryfunc, "<<="),
6932     IBSLOT("__irshift__", nb_inplace_rshift, slot_nb_inplace_rshift,
6933            wrap_binaryfunc, ">>="),
6934     IBSLOT("__iand__", nb_inplace_and, slot_nb_inplace_and,
6935            wrap_binaryfunc, "&="),
6936     IBSLOT("__ixor__", nb_inplace_xor, slot_nb_inplace_xor,
6937            wrap_binaryfunc, "^="),
6938     IBSLOT("__ior__", nb_inplace_or, slot_nb_inplace_or,
6939            wrap_binaryfunc, "|="),
6940     BINSLOT("__floordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
6941     RBINSLOT("__rfloordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
6942     BINSLOT("__truediv__", nb_true_divide, slot_nb_true_divide, "/"),
6943     RBINSLOT("__rtruediv__", nb_true_divide, slot_nb_true_divide, "/"),
6944     IBSLOT("__ifloordiv__", nb_inplace_floor_divide,
6945            slot_nb_inplace_floor_divide, wrap_binaryfunc, "//="),
6946     IBSLOT("__itruediv__", nb_inplace_true_divide,
6947            slot_nb_inplace_true_divide, wrap_binaryfunc, "/="),
6948     NBSLOT("__index__", nb_index, slot_nb_index, wrap_unaryfunc,
6949            "__index__($self, /)\n--\n\n"
6950            "Return self converted to an integer, if self is suitable "
6951            "for use as an index into a list."),
6952     BINSLOT("__matmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
6953             "@"),
6954     RBINSLOT("__rmatmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
6955              "@"),
6956     IBSLOT("__imatmul__", nb_inplace_matrix_multiply, slot_nb_inplace_matrix_multiply,
6957            wrap_binaryfunc, "@="),
6958     MPSLOT("__len__", mp_length, slot_mp_length, wrap_lenfunc,
6959            "__len__($self, /)\n--\n\nReturn len(self)."),
6960     MPSLOT("__getitem__", mp_subscript, slot_mp_subscript,
6961            wrap_binaryfunc,
6962            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
6963     MPSLOT("__setitem__", mp_ass_subscript, slot_mp_ass_subscript,
6964            wrap_objobjargproc,
6965            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
6966     MPSLOT("__delitem__", mp_ass_subscript, slot_mp_ass_subscript,
6967            wrap_delitem,
6968            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
6969 
6970     SQSLOT("__len__", sq_length, slot_sq_length, wrap_lenfunc,
6971            "__len__($self, /)\n--\n\nReturn len(self)."),
6972     /* Heap types defining __add__/__mul__ have sq_concat/sq_repeat == NULL.
6973        The logic in abstract.c always falls back to nb_add/nb_multiply in
6974        this case.  Defining both the nb_* and the sq_* slots to call the
6975        user-defined methods has unexpected side-effects, as shown by
6976        test_descr.notimplemented() */
6977     SQSLOT("__add__", sq_concat, NULL, wrap_binaryfunc,
6978            "__add__($self, value, /)\n--\n\nReturn self+value."),
6979     SQSLOT("__mul__", sq_repeat, NULL, wrap_indexargfunc,
6980            "__mul__($self, value, /)\n--\n\nReturn self*value."),
6981     SQSLOT("__rmul__", sq_repeat, NULL, wrap_indexargfunc,
6982            "__rmul__($self, value, /)\n--\n\nReturn value*self."),
6983     SQSLOT("__getitem__", sq_item, slot_sq_item, wrap_sq_item,
6984            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
6985     SQSLOT("__setitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_setitem,
6986            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
6987     SQSLOT("__delitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_delitem,
6988            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
6989     SQSLOT("__contains__", sq_contains, slot_sq_contains, wrap_objobjproc,
6990            "__contains__($self, key, /)\n--\n\nReturn key in self."),
6991     SQSLOT("__iadd__", sq_inplace_concat, NULL,
6992            wrap_binaryfunc,
6993            "__iadd__($self, value, /)\n--\n\nImplement self+=value."),
6994     SQSLOT("__imul__", sq_inplace_repeat, NULL,
6995            wrap_indexargfunc,
6996            "__imul__($self, value, /)\n--\n\nImplement self*=value."),
6997 
6998     {NULL}
6999 };
7000 
7001 /* Given a type pointer and an offset gotten from a slotdef entry, return a
7002    pointer to the actual slot.  This is not quite the same as simply adding
7003    the offset to the type pointer, since it takes care to indirect through the
7004    proper indirection pointer (as_buffer, etc.); it returns NULL if the
7005    indirection pointer is NULL. */
7006 static void **
slotptr(PyTypeObject * type,int ioffset)7007 slotptr(PyTypeObject *type, int ioffset)
7008 {
7009     char *ptr;
7010     long offset = ioffset;
7011 
7012     /* Note: this depends on the order of the members of PyHeapTypeObject! */
7013     assert(offset >= 0);
7014     assert((size_t)offset < offsetof(PyHeapTypeObject, as_buffer));
7015     if ((size_t)offset >= offsetof(PyHeapTypeObject, as_sequence)) {
7016         ptr = (char *)type->tp_as_sequence;
7017         offset -= offsetof(PyHeapTypeObject, as_sequence);
7018     }
7019     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_mapping)) {
7020         ptr = (char *)type->tp_as_mapping;
7021         offset -= offsetof(PyHeapTypeObject, as_mapping);
7022     }
7023     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_number)) {
7024         ptr = (char *)type->tp_as_number;
7025         offset -= offsetof(PyHeapTypeObject, as_number);
7026     }
7027     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_async)) {
7028         ptr = (char *)type->tp_as_async;
7029         offset -= offsetof(PyHeapTypeObject, as_async);
7030     }
7031     else {
7032         ptr = (char *)type;
7033     }
7034     if (ptr != NULL)
7035         ptr += offset;
7036     return (void **)ptr;
7037 }
7038 
7039 /* Length of array of slotdef pointers used to store slots with the
7040    same __name__.  There should be at most MAX_EQUIV-1 slotdef entries with
7041    the same __name__, for any __name__. Since that's a static property, it is
7042    appropriate to declare fixed-size arrays for this. */
7043 #define MAX_EQUIV 10
7044 
7045 /* Return a slot pointer for a given name, but ONLY if the attribute has
7046    exactly one slot function.  The name must be an interned string. */
7047 static void **
resolve_slotdups(PyTypeObject * type,PyObject * name)7048 resolve_slotdups(PyTypeObject *type, PyObject *name)
7049 {
7050     /* XXX Maybe this could be optimized more -- but is it worth it? */
7051 
7052     /* pname and ptrs act as a little cache */
7053     static PyObject *pname;
7054     static slotdef *ptrs[MAX_EQUIV];
7055     slotdef *p, **pp;
7056     void **res, **ptr;
7057 
7058     if (pname != name) {
7059         /* Collect all slotdefs that match name into ptrs. */
7060         pname = name;
7061         pp = ptrs;
7062         for (p = slotdefs; p->name_strobj; p++) {
7063             if (p->name_strobj == name)
7064                 *pp++ = p;
7065         }
7066         *pp = NULL;
7067     }
7068 
7069     /* Look in all matching slots of the type; if exactly one of these has
7070        a filled-in slot, return its value.      Otherwise return NULL. */
7071     res = NULL;
7072     for (pp = ptrs; *pp; pp++) {
7073         ptr = slotptr(type, (*pp)->offset);
7074         if (ptr == NULL || *ptr == NULL)
7075             continue;
7076         if (res != NULL)
7077             return NULL;
7078         res = ptr;
7079     }
7080     return res;
7081 }
7082 
7083 /* Common code for update_slots_callback() and fixup_slot_dispatchers().  This
7084    does some incredibly complex thinking and then sticks something into the
7085    slot.  (It sees if the adjacent slotdefs for the same slot have conflicting
7086    interests, and then stores a generic wrapper or a specific function into
7087    the slot.)  Return a pointer to the next slotdef with a different offset,
7088    because that's convenient  for fixup_slot_dispatchers(). */
7089 static slotdef *
update_one_slot(PyTypeObject * type,slotdef * p)7090 update_one_slot(PyTypeObject *type, slotdef *p)
7091 {
7092     PyObject *descr;
7093     PyWrapperDescrObject *d;
7094     void *generic = NULL, *specific = NULL;
7095     int use_generic = 0;
7096     int offset = p->offset;
7097     int error;
7098     void **ptr = slotptr(type, offset);
7099 
7100     if (ptr == NULL) {
7101         do {
7102             ++p;
7103         } while (p->offset == offset);
7104         return p;
7105     }
7106     /* We may end up clearing live exceptions below, so make sure it's ours. */
7107     assert(!PyErr_Occurred());
7108     do {
7109         /* Use faster uncached lookup as we won't get any cache hits during type setup. */
7110         descr = find_name_in_mro(type, p->name_strobj, &error);
7111         if (descr == NULL) {
7112             if (error == -1) {
7113                 /* It is unlikely by not impossible that there has been an exception
7114                    during lookup. Since this function originally expected no errors,
7115                    we ignore them here in order to keep up the interface. */
7116                 PyErr_Clear();
7117             }
7118             if (ptr == (void**)&type->tp_iternext) {
7119                 specific = (void *)_PyObject_NextNotImplemented;
7120             }
7121             continue;
7122         }
7123         if (Py_TYPE(descr) == &PyWrapperDescr_Type &&
7124             ((PyWrapperDescrObject *)descr)->d_base->name_strobj == p->name_strobj) {
7125             void **tptr = resolve_slotdups(type, p->name_strobj);
7126             if (tptr == NULL || tptr == ptr)
7127                 generic = p->function;
7128             d = (PyWrapperDescrObject *)descr;
7129             if (d->d_base->wrapper == p->wrapper &&
7130                 PyType_IsSubtype(type, PyDescr_TYPE(d)))
7131             {
7132                 if (specific == NULL ||
7133                     specific == d->d_wrapped)
7134                     specific = d->d_wrapped;
7135                 else
7136                     use_generic = 1;
7137             }
7138         }
7139         else if (Py_TYPE(descr) == &PyCFunction_Type &&
7140                  PyCFunction_GET_FUNCTION(descr) ==
7141                  (PyCFunction)tp_new_wrapper &&
7142                  ptr == (void**)&type->tp_new)
7143         {
7144             /* The __new__ wrapper is not a wrapper descriptor,
7145                so must be special-cased differently.
7146                If we don't do this, creating an instance will
7147                always use slot_tp_new which will look up
7148                __new__ in the MRO which will call tp_new_wrapper
7149                which will look through the base classes looking
7150                for a static base and call its tp_new (usually
7151                PyType_GenericNew), after performing various
7152                sanity checks and constructing a new argument
7153                list.  Cut all that nonsense short -- this speeds
7154                up instance creation tremendously. */
7155             specific = (void *)type->tp_new;
7156             /* XXX I'm not 100% sure that there isn't a hole
7157                in this reasoning that requires additional
7158                sanity checks.  I'll buy the first person to
7159                point out a bug in this reasoning a beer. */
7160         }
7161         else if (descr == Py_None &&
7162                  ptr == (void**)&type->tp_hash) {
7163             /* We specifically allow __hash__ to be set to None
7164                to prevent inheritance of the default
7165                implementation from object.__hash__ */
7166             specific = (void *)PyObject_HashNotImplemented;
7167         }
7168         else {
7169             use_generic = 1;
7170             generic = p->function;
7171         }
7172     } while ((++p)->offset == offset);
7173     if (specific && !use_generic)
7174         *ptr = specific;
7175     else
7176         *ptr = generic;
7177     return p;
7178 }
7179 
7180 /* In the type, update the slots whose slotdefs are gathered in the pp array.
7181    This is a callback for update_subclasses(). */
7182 static int
update_slots_callback(PyTypeObject * type,void * data)7183 update_slots_callback(PyTypeObject *type, void *data)
7184 {
7185     slotdef **pp = (slotdef **)data;
7186 
7187     for (; *pp; pp++)
7188         update_one_slot(type, *pp);
7189     return 0;
7190 }
7191 
7192 static int slotdefs_initialized = 0;
7193 /* Initialize the slotdefs table by adding interned string objects for the
7194    names. */
7195 static void
init_slotdefs(void)7196 init_slotdefs(void)
7197 {
7198     slotdef *p;
7199 
7200     if (slotdefs_initialized)
7201         return;
7202     for (p = slotdefs; p->name; p++) {
7203         /* Slots must be ordered by their offset in the PyHeapTypeObject. */
7204         assert(!p[1].name || p->offset <= p[1].offset);
7205         p->name_strobj = PyUnicode_InternFromString(p->name);
7206         if (!p->name_strobj || !PyUnicode_CHECK_INTERNED(p->name_strobj))
7207             Py_FatalError("Out of memory interning slotdef names");
7208     }
7209     slotdefs_initialized = 1;
7210 }
7211 
7212 /* Undo init_slotdefs, releasing the interned strings. */
clear_slotdefs(void)7213 static void clear_slotdefs(void)
7214 {
7215     slotdef *p;
7216     for (p = slotdefs; p->name; p++) {
7217         Py_CLEAR(p->name_strobj);
7218     }
7219     slotdefs_initialized = 0;
7220 }
7221 
7222 /* Update the slots after assignment to a class (type) attribute. */
7223 static int
update_slot(PyTypeObject * type,PyObject * name)7224 update_slot(PyTypeObject *type, PyObject *name)
7225 {
7226     slotdef *ptrs[MAX_EQUIV];
7227     slotdef *p;
7228     slotdef **pp;
7229     int offset;
7230 
7231     assert(PyUnicode_CheckExact(name));
7232     assert(PyUnicode_CHECK_INTERNED(name));
7233 
7234     /* Clear the VALID_VERSION flag of 'type' and all its
7235        subclasses.  This could possibly be unified with the
7236        update_subclasses() recursion below, but carefully:
7237        they each have their own conditions on which to stop
7238        recursing into subclasses. */
7239     PyType_Modified(type);
7240 
7241     init_slotdefs();
7242     pp = ptrs;
7243     for (p = slotdefs; p->name; p++) {
7244         if (p->name_strobj == name)
7245             *pp++ = p;
7246     }
7247     *pp = NULL;
7248     for (pp = ptrs; *pp; pp++) {
7249         p = *pp;
7250         offset = p->offset;
7251         while (p > slotdefs && (p-1)->offset == offset)
7252             --p;
7253         *pp = p;
7254     }
7255     if (ptrs[0] == NULL)
7256         return 0; /* Not an attribute that affects any slots */
7257     return update_subclasses(type, name,
7258                              update_slots_callback, (void *)ptrs);
7259 }
7260 
7261 /* Store the proper functions in the slot dispatches at class (type)
7262    definition time, based upon which operations the class overrides in its
7263    dict. */
7264 static void
fixup_slot_dispatchers(PyTypeObject * type)7265 fixup_slot_dispatchers(PyTypeObject *type)
7266 {
7267     slotdef *p;
7268 
7269     init_slotdefs();
7270     for (p = slotdefs; p->name; )
7271         p = update_one_slot(type, p);
7272 }
7273 
7274 static void
update_all_slots(PyTypeObject * type)7275 update_all_slots(PyTypeObject* type)
7276 {
7277     slotdef *p;
7278 
7279     init_slotdefs();
7280     for (p = slotdefs; p->name; p++) {
7281         /* update_slot returns int but can't actually fail */
7282         update_slot(type, p->name_strobj);
7283     }
7284 }
7285 
7286 /* Call __set_name__ on all descriptors in a newly generated type */
7287 static int
set_names(PyTypeObject * type)7288 set_names(PyTypeObject *type)
7289 {
7290     PyObject *names_to_set, *key, *value, *set_name, *tmp;
7291     Py_ssize_t i = 0;
7292 
7293     names_to_set = PyDict_Copy(type->tp_dict);
7294     if (names_to_set == NULL)
7295         return -1;
7296 
7297     while (PyDict_Next(names_to_set, &i, &key, &value)) {
7298         set_name = _PyObject_LookupSpecial(value, &PyId___set_name__);
7299         if (set_name != NULL) {
7300             tmp = PyObject_CallFunctionObjArgs(set_name, type, key, NULL);
7301             Py_DECREF(set_name);
7302             if (tmp == NULL) {
7303                 _PyErr_FormatFromCause(PyExc_RuntimeError,
7304                     "Error calling __set_name__ on '%.100s' instance %R "
7305                     "in '%.100s'",
7306                     value->ob_type->tp_name, key, type->tp_name);
7307                 Py_DECREF(names_to_set);
7308                 return -1;
7309             }
7310             else
7311                 Py_DECREF(tmp);
7312         }
7313         else if (PyErr_Occurred()) {
7314             Py_DECREF(names_to_set);
7315             return -1;
7316         }
7317     }
7318 
7319     Py_DECREF(names_to_set);
7320     return 0;
7321 }
7322 
7323 /* Call __init_subclass__ on the parent of a newly generated type */
7324 static int
init_subclass(PyTypeObject * type,PyObject * kwds)7325 init_subclass(PyTypeObject *type, PyObject *kwds)
7326 {
7327     PyObject *super, *func, *result;
7328     PyObject *args[2] = {(PyObject *)type, (PyObject *)type};
7329 
7330     super = _PyObject_FastCall((PyObject *)&PySuper_Type, args, 2);
7331     if (super == NULL) {
7332         return -1;
7333     }
7334 
7335     func = _PyObject_GetAttrId(super, &PyId___init_subclass__);
7336     Py_DECREF(super);
7337     if (func == NULL) {
7338         return -1;
7339     }
7340 
7341 
7342     result = _PyObject_FastCallDict(func, NULL, 0, kwds);
7343     Py_DECREF(func);
7344     if (result == NULL) {
7345         return -1;
7346     }
7347 
7348     Py_DECREF(result);
7349     return 0;
7350 }
7351 
7352 /* recurse_down_subclasses() and update_subclasses() are mutually
7353    recursive functions to call a callback for all subclasses,
7354    but refraining from recursing into subclasses that define 'name'. */
7355 
7356 static int
update_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)7357 update_subclasses(PyTypeObject *type, PyObject *name,
7358                   update_callback callback, void *data)
7359 {
7360     if (callback(type, data) < 0)
7361         return -1;
7362     return recurse_down_subclasses(type, name, callback, data);
7363 }
7364 
7365 static int
recurse_down_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)7366 recurse_down_subclasses(PyTypeObject *type, PyObject *name,
7367                         update_callback callback, void *data)
7368 {
7369     PyTypeObject *subclass;
7370     PyObject *ref, *subclasses, *dict;
7371     Py_ssize_t i;
7372 
7373     subclasses = type->tp_subclasses;
7374     if (subclasses == NULL)
7375         return 0;
7376     assert(PyDict_CheckExact(subclasses));
7377     i = 0;
7378     while (PyDict_Next(subclasses, &i, NULL, &ref)) {
7379         assert(PyWeakref_CheckRef(ref));
7380         subclass = (PyTypeObject *)PyWeakref_GET_OBJECT(ref);
7381         assert(subclass != NULL);
7382         if ((PyObject *)subclass == Py_None)
7383             continue;
7384         assert(PyType_Check(subclass));
7385         /* Avoid recursing down into unaffected classes */
7386         dict = subclass->tp_dict;
7387         if (dict != NULL && PyDict_Check(dict) &&
7388             PyDict_GetItem(dict, name) != NULL)
7389             continue;
7390         if (update_subclasses(subclass, name, callback, data) < 0)
7391             return -1;
7392     }
7393     return 0;
7394 }
7395 
7396 /* This function is called by PyType_Ready() to populate the type's
7397    dictionary with method descriptors for function slots.  For each
7398    function slot (like tp_repr) that's defined in the type, one or more
7399    corresponding descriptors are added in the type's tp_dict dictionary
7400    under the appropriate name (like __repr__).  Some function slots
7401    cause more than one descriptor to be added (for example, the nb_add
7402    slot adds both __add__ and __radd__ descriptors) and some function
7403    slots compete for the same descriptor (for example both sq_item and
7404    mp_subscript generate a __getitem__ descriptor).
7405 
7406    In the latter case, the first slotdef entry encountered wins.  Since
7407    slotdef entries are sorted by the offset of the slot in the
7408    PyHeapTypeObject, this gives us some control over disambiguating
7409    between competing slots: the members of PyHeapTypeObject are listed
7410    from most general to least general, so the most general slot is
7411    preferred.  In particular, because as_mapping comes before as_sequence,
7412    for a type that defines both mp_subscript and sq_item, mp_subscript
7413    wins.
7414 
7415    This only adds new descriptors and doesn't overwrite entries in
7416    tp_dict that were previously defined.  The descriptors contain a
7417    reference to the C function they must call, so that it's safe if they
7418    are copied into a subtype's __dict__ and the subtype has a different
7419    C function in its slot -- calling the method defined by the
7420    descriptor will call the C function that was used to create it,
7421    rather than the C function present in the slot when it is called.
7422    (This is important because a subtype may have a C function in the
7423    slot that calls the method from the dictionary, and we want to avoid
7424    infinite recursion here.) */
7425 
7426 static int
add_operators(PyTypeObject * type)7427 add_operators(PyTypeObject *type)
7428 {
7429     PyObject *dict = type->tp_dict;
7430     slotdef *p;
7431     PyObject *descr;
7432     void **ptr;
7433 
7434     init_slotdefs();
7435     for (p = slotdefs; p->name; p++) {
7436         if (p->wrapper == NULL)
7437             continue;
7438         ptr = slotptr(type, p->offset);
7439         if (!ptr || !*ptr)
7440             continue;
7441         if (PyDict_GetItem(dict, p->name_strobj))
7442             continue;
7443         if (*ptr == (void *)PyObject_HashNotImplemented) {
7444             /* Classes may prevent the inheritance of the tp_hash
7445                slot by storing PyObject_HashNotImplemented in it. Make it
7446                visible as a None value for the __hash__ attribute. */
7447             if (PyDict_SetItem(dict, p->name_strobj, Py_None) < 0)
7448                 return -1;
7449         }
7450         else {
7451             descr = PyDescr_NewWrapper(type, p, *ptr);
7452             if (descr == NULL)
7453                 return -1;
7454             if (PyDict_SetItem(dict, p->name_strobj, descr) < 0) {
7455                 Py_DECREF(descr);
7456                 return -1;
7457             }
7458             Py_DECREF(descr);
7459         }
7460     }
7461     if (type->tp_new != NULL) {
7462         if (add_tp_new_wrapper(type) < 0)
7463             return -1;
7464     }
7465     return 0;
7466 }
7467 
7468 
7469 /* Cooperative 'super' */
7470 
7471 typedef struct {
7472     PyObject_HEAD
7473     PyTypeObject *type;
7474     PyObject *obj;
7475     PyTypeObject *obj_type;
7476 } superobject;
7477 
7478 static PyMemberDef super_members[] = {
7479     {"__thisclass__", T_OBJECT, offsetof(superobject, type), READONLY,
7480      "the class invoking super()"},
7481     {"__self__",  T_OBJECT, offsetof(superobject, obj), READONLY,
7482      "the instance invoking super(); may be None"},
7483     {"__self_class__", T_OBJECT, offsetof(superobject, obj_type), READONLY,
7484      "the type of the instance invoking super(); may be None"},
7485     {0}
7486 };
7487 
7488 static void
super_dealloc(PyObject * self)7489 super_dealloc(PyObject *self)
7490 {
7491     superobject *su = (superobject *)self;
7492 
7493     _PyObject_GC_UNTRACK(self);
7494     Py_XDECREF(su->obj);
7495     Py_XDECREF(su->type);
7496     Py_XDECREF(su->obj_type);
7497     Py_TYPE(self)->tp_free(self);
7498 }
7499 
7500 static PyObject *
super_repr(PyObject * self)7501 super_repr(PyObject *self)
7502 {
7503     superobject *su = (superobject *)self;
7504 
7505     if (su->obj_type)
7506         return PyUnicode_FromFormat(
7507             "<super: <class '%s'>, <%s object>>",
7508             su->type ? su->type->tp_name : "NULL",
7509             su->obj_type->tp_name);
7510     else
7511         return PyUnicode_FromFormat(
7512             "<super: <class '%s'>, NULL>",
7513             su->type ? su->type->tp_name : "NULL");
7514 }
7515 
7516 static PyObject *
super_getattro(PyObject * self,PyObject * name)7517 super_getattro(PyObject *self, PyObject *name)
7518 {
7519     superobject *su = (superobject *)self;
7520     PyTypeObject *starttype;
7521     PyObject *mro;
7522     Py_ssize_t i, n;
7523 
7524     starttype = su->obj_type;
7525     if (starttype == NULL)
7526         goto skip;
7527 
7528     /* We want __class__ to return the class of the super object
7529        (i.e. super, or a subclass), not the class of su->obj. */
7530     if (PyUnicode_Check(name) &&
7531         PyUnicode_GET_LENGTH(name) == 9 &&
7532         _PyUnicode_EqualToASCIIId(name, &PyId___class__))
7533         goto skip;
7534 
7535     mro = starttype->tp_mro;
7536     if (mro == NULL)
7537         goto skip;
7538 
7539     assert(PyTuple_Check(mro));
7540     n = PyTuple_GET_SIZE(mro);
7541 
7542     /* No need to check the last one: it's gonna be skipped anyway.  */
7543     for (i = 0; i+1 < n; i++) {
7544         if ((PyObject *)(su->type) == PyTuple_GET_ITEM(mro, i))
7545             break;
7546     }
7547     i++;  /* skip su->type (if any)  */
7548     if (i >= n)
7549         goto skip;
7550 
7551     /* keep a strong reference to mro because starttype->tp_mro can be
7552        replaced during PyDict_GetItem(dict, name)  */
7553     Py_INCREF(mro);
7554     do {
7555         PyObject *res, *tmp, *dict;
7556         descrgetfunc f;
7557 
7558         tmp = PyTuple_GET_ITEM(mro, i);
7559         assert(PyType_Check(tmp));
7560 
7561         dict = ((PyTypeObject *)tmp)->tp_dict;
7562         assert(dict != NULL && PyDict_Check(dict));
7563 
7564         res = PyDict_GetItem(dict, name);
7565         if (res != NULL) {
7566             Py_INCREF(res);
7567 
7568             f = Py_TYPE(res)->tp_descr_get;
7569             if (f != NULL) {
7570                 tmp = f(res,
7571                     /* Only pass 'obj' param if this is instance-mode super
7572                        (See SF ID #743627)  */
7573                     (su->obj == (PyObject *)starttype) ? NULL : su->obj,
7574                     (PyObject *)starttype);
7575                 Py_DECREF(res);
7576                 res = tmp;
7577             }
7578 
7579             Py_DECREF(mro);
7580             return res;
7581         }
7582 
7583         i++;
7584     } while (i < n);
7585     Py_DECREF(mro);
7586 
7587   skip:
7588     return PyObject_GenericGetAttr(self, name);
7589 }
7590 
7591 static PyTypeObject *
supercheck(PyTypeObject * type,PyObject * obj)7592 supercheck(PyTypeObject *type, PyObject *obj)
7593 {
7594     /* Check that a super() call makes sense.  Return a type object.
7595 
7596        obj can be a class, or an instance of one:
7597 
7598        - If it is a class, it must be a subclass of 'type'.      This case is
7599          used for class methods; the return value is obj.
7600 
7601        - If it is an instance, it must be an instance of 'type'.  This is
7602          the normal case; the return value is obj.__class__.
7603 
7604        But... when obj is an instance, we want to allow for the case where
7605        Py_TYPE(obj) is not a subclass of type, but obj.__class__ is!
7606        This will allow using super() with a proxy for obj.
7607     */
7608 
7609     /* Check for first bullet above (special case) */
7610     if (PyType_Check(obj) && PyType_IsSubtype((PyTypeObject *)obj, type)) {
7611         Py_INCREF(obj);
7612         return (PyTypeObject *)obj;
7613     }
7614 
7615     /* Normal case */
7616     if (PyType_IsSubtype(Py_TYPE(obj), type)) {
7617         Py_INCREF(Py_TYPE(obj));
7618         return Py_TYPE(obj);
7619     }
7620     else {
7621         /* Try the slow way */
7622         PyObject *class_attr;
7623 
7624         class_attr = _PyObject_GetAttrId(obj, &PyId___class__);
7625         if (class_attr != NULL &&
7626             PyType_Check(class_attr) &&
7627             (PyTypeObject *)class_attr != Py_TYPE(obj))
7628         {
7629             int ok = PyType_IsSubtype(
7630                 (PyTypeObject *)class_attr, type);
7631             if (ok)
7632                 return (PyTypeObject *)class_attr;
7633         }
7634 
7635         if (class_attr == NULL)
7636             PyErr_Clear();
7637         else
7638             Py_DECREF(class_attr);
7639     }
7640 
7641     PyErr_SetString(PyExc_TypeError,
7642                     "super(type, obj): "
7643                     "obj must be an instance or subtype of type");
7644     return NULL;
7645 }
7646 
7647 static PyObject *
super_descr_get(PyObject * self,PyObject * obj,PyObject * type)7648 super_descr_get(PyObject *self, PyObject *obj, PyObject *type)
7649 {
7650     superobject *su = (superobject *)self;
7651     superobject *newobj;
7652 
7653     if (obj == NULL || obj == Py_None || su->obj != NULL) {
7654         /* Not binding to an object, or already bound */
7655         Py_INCREF(self);
7656         return self;
7657     }
7658     if (Py_TYPE(su) != &PySuper_Type)
7659         /* If su is an instance of a (strict) subclass of super,
7660            call its type */
7661         return PyObject_CallFunctionObjArgs((PyObject *)Py_TYPE(su),
7662                                             su->type, obj, NULL);
7663     else {
7664         /* Inline the common case */
7665         PyTypeObject *obj_type = supercheck(su->type, obj);
7666         if (obj_type == NULL)
7667             return NULL;
7668         newobj = (superobject *)PySuper_Type.tp_new(&PySuper_Type,
7669                                                  NULL, NULL);
7670         if (newobj == NULL)
7671             return NULL;
7672         Py_INCREF(su->type);
7673         Py_INCREF(obj);
7674         newobj->type = su->type;
7675         newobj->obj = obj;
7676         newobj->obj_type = obj_type;
7677         return (PyObject *)newobj;
7678     }
7679 }
7680 
7681 static int
super_init(PyObject * self,PyObject * args,PyObject * kwds)7682 super_init(PyObject *self, PyObject *args, PyObject *kwds)
7683 {
7684     superobject *su = (superobject *)self;
7685     PyTypeObject *type = NULL;
7686     PyObject *obj = NULL;
7687     PyTypeObject *obj_type = NULL;
7688 
7689     if (!_PyArg_NoKeywords("super", kwds))
7690         return -1;
7691     if (!PyArg_ParseTuple(args, "|O!O:super", &PyType_Type, &type, &obj))
7692         return -1;
7693 
7694     if (type == NULL) {
7695         /* Call super(), without args -- fill in from __class__
7696            and first local variable on the stack. */
7697         PyFrameObject *f;
7698         PyCodeObject *co;
7699         Py_ssize_t i, n;
7700         f = PyThreadState_GET()->frame;
7701         if (f == NULL) {
7702             PyErr_SetString(PyExc_RuntimeError,
7703                             "super(): no current frame");
7704             return -1;
7705         }
7706         co = f->f_code;
7707         if (co == NULL) {
7708             PyErr_SetString(PyExc_RuntimeError,
7709                             "super(): no code object");
7710             return -1;
7711         }
7712         if (co->co_argcount == 0) {
7713             PyErr_SetString(PyExc_RuntimeError,
7714                             "super(): no arguments");
7715             return -1;
7716         }
7717         obj = f->f_localsplus[0];
7718         if (obj == NULL && co->co_cell2arg) {
7719             /* The first argument might be a cell. */
7720             n = PyTuple_GET_SIZE(co->co_cellvars);
7721             for (i = 0; i < n; i++) {
7722                 if (co->co_cell2arg[i] == 0) {
7723                     PyObject *cell = f->f_localsplus[co->co_nlocals + i];
7724                     assert(PyCell_Check(cell));
7725                     obj = PyCell_GET(cell);
7726                     break;
7727                 }
7728             }
7729         }
7730         if (obj == NULL) {
7731             PyErr_SetString(PyExc_RuntimeError,
7732                             "super(): arg[0] deleted");
7733             return -1;
7734         }
7735         if (co->co_freevars == NULL)
7736             n = 0;
7737         else {
7738             assert(PyTuple_Check(co->co_freevars));
7739             n = PyTuple_GET_SIZE(co->co_freevars);
7740         }
7741         for (i = 0; i < n; i++) {
7742             PyObject *name = PyTuple_GET_ITEM(co->co_freevars, i);
7743             assert(PyUnicode_Check(name));
7744             if (_PyUnicode_EqualToASCIIId(name, &PyId___class__)) {
7745                 Py_ssize_t index = co->co_nlocals +
7746                     PyTuple_GET_SIZE(co->co_cellvars) + i;
7747                 PyObject *cell = f->f_localsplus[index];
7748                 if (cell == NULL || !PyCell_Check(cell)) {
7749                     PyErr_SetString(PyExc_RuntimeError,
7750                       "super(): bad __class__ cell");
7751                     return -1;
7752                 }
7753                 type = (PyTypeObject *) PyCell_GET(cell);
7754                 if (type == NULL) {
7755                     PyErr_SetString(PyExc_RuntimeError,
7756                       "super(): empty __class__ cell");
7757                     return -1;
7758                 }
7759                 if (!PyType_Check(type)) {
7760                     PyErr_Format(PyExc_RuntimeError,
7761                       "super(): __class__ is not a type (%s)",
7762                       Py_TYPE(type)->tp_name);
7763                     return -1;
7764                 }
7765                 break;
7766             }
7767         }
7768         if (type == NULL) {
7769             PyErr_SetString(PyExc_RuntimeError,
7770                             "super(): __class__ cell not found");
7771             return -1;
7772         }
7773     }
7774 
7775     if (obj == Py_None)
7776         obj = NULL;
7777     if (obj != NULL) {
7778         obj_type = supercheck(type, obj);
7779         if (obj_type == NULL)
7780             return -1;
7781         Py_INCREF(obj);
7782     }
7783     Py_INCREF(type);
7784     Py_XSETREF(su->type, type);
7785     Py_XSETREF(su->obj, obj);
7786     Py_XSETREF(su->obj_type, obj_type);
7787     return 0;
7788 }
7789 
7790 PyDoc_STRVAR(super_doc,
7791 "super() -> same as super(__class__, <first argument>)\n"
7792 "super(type) -> unbound super object\n"
7793 "super(type, obj) -> bound super object; requires isinstance(obj, type)\n"
7794 "super(type, type2) -> bound super object; requires issubclass(type2, type)\n"
7795 "Typical use to call a cooperative superclass method:\n"
7796 "class C(B):\n"
7797 "    def meth(self, arg):\n"
7798 "        super().meth(arg)\n"
7799 "This works for class methods too:\n"
7800 "class C(B):\n"
7801 "    @classmethod\n"
7802 "    def cmeth(cls, arg):\n"
7803 "        super().cmeth(arg)\n");
7804 
7805 static int
super_traverse(PyObject * self,visitproc visit,void * arg)7806 super_traverse(PyObject *self, visitproc visit, void *arg)
7807 {
7808     superobject *su = (superobject *)self;
7809 
7810     Py_VISIT(su->obj);
7811     Py_VISIT(su->type);
7812     Py_VISIT(su->obj_type);
7813 
7814     return 0;
7815 }
7816 
7817 PyTypeObject PySuper_Type = {
7818     PyVarObject_HEAD_INIT(&PyType_Type, 0)
7819     "super",                                    /* tp_name */
7820     sizeof(superobject),                        /* tp_basicsize */
7821     0,                                          /* tp_itemsize */
7822     /* methods */
7823     super_dealloc,                              /* tp_dealloc */
7824     0,                                          /* tp_print */
7825     0,                                          /* tp_getattr */
7826     0,                                          /* tp_setattr */
7827     0,                                          /* tp_reserved */
7828     super_repr,                                 /* tp_repr */
7829     0,                                          /* tp_as_number */
7830     0,                                          /* tp_as_sequence */
7831     0,                                          /* tp_as_mapping */
7832     0,                                          /* tp_hash */
7833     0,                                          /* tp_call */
7834     0,                                          /* tp_str */
7835     super_getattro,                             /* tp_getattro */
7836     0,                                          /* tp_setattro */
7837     0,                                          /* tp_as_buffer */
7838     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
7839         Py_TPFLAGS_BASETYPE,                    /* tp_flags */
7840     super_doc,                                  /* tp_doc */
7841     super_traverse,                             /* tp_traverse */
7842     0,                                          /* tp_clear */
7843     0,                                          /* tp_richcompare */
7844     0,                                          /* tp_weaklistoffset */
7845     0,                                          /* tp_iter */
7846     0,                                          /* tp_iternext */
7847     0,                                          /* tp_methods */
7848     super_members,                              /* tp_members */
7849     0,                                          /* tp_getset */
7850     0,                                          /* tp_base */
7851     0,                                          /* tp_dict */
7852     super_descr_get,                            /* tp_descr_get */
7853     0,                                          /* tp_descr_set */
7854     0,                                          /* tp_dictoffset */
7855     super_init,                                 /* tp_init */
7856     PyType_GenericAlloc,                        /* tp_alloc */
7857     PyType_GenericNew,                          /* tp_new */
7858     PyObject_GC_Del,                            /* tp_free */
7859 };
7860