1 /* Type object implementation */
2 
3 #include "Python.h"
4 #include "pycore_call.h"
5 #include "pycore_initconfig.h"
6 #include "pycore_object.h"
7 #include "pycore_pyerrors.h"
8 #include "pycore_pystate.h"       // _PyThreadState_GET()
9 #include "frameobject.h"
10 #include "structmember.h"         // PyMemberDef
11 
12 #include <ctype.h>
13 
14 /*[clinic input]
15 class type "PyTypeObject *" "&PyType_Type"
16 class object "PyObject *" "&PyBaseObject_Type"
17 [clinic start generated code]*/
18 /*[clinic end generated code: output=da39a3ee5e6b4b0d input=4b94608d231c434b]*/
19 
20 #include "clinic/typeobject.c.h"
21 
22 #define MCACHE
23 
24 #ifdef MCACHE
25 /* Support type attribute cache */
26 
27 /* The cache can keep references to the names alive for longer than
28    they normally would.  This is why the maximum size is limited to
29    MCACHE_MAX_ATTR_SIZE, since it might be a problem if very large
30    strings are used as attribute names. */
31 #define MCACHE_MAX_ATTR_SIZE    100
32 #define MCACHE_SIZE_EXP         12
33 #define MCACHE_HASH(version, name_hash)                                 \
34         (((unsigned int)(version) ^ (unsigned int)(name_hash))          \
35          & ((1 << MCACHE_SIZE_EXP) - 1))
36 
37 #define MCACHE_HASH_METHOD(type, name)                                  \
38         MCACHE_HASH((type)->tp_version_tag,                     \
39                     ((PyASCIIObject *)(name))->hash)
40 #define MCACHE_CACHEABLE_NAME(name)                             \
41         PyUnicode_CheckExact(name) &&                           \
42         PyUnicode_IS_READY(name) &&                             \
43         PyUnicode_GET_LENGTH(name) <= MCACHE_MAX_ATTR_SIZE
44 
45 struct method_cache_entry {
46     unsigned int version;
47     PyObject *name;             /* reference to exactly a str or None */
48     PyObject *value;            /* borrowed */
49 };
50 
51 static struct method_cache_entry method_cache[1 << MCACHE_SIZE_EXP];
52 static unsigned int next_version_tag = 0;
53 #endif
54 
55 #define MCACHE_STATS 0
56 
57 #if MCACHE_STATS
58 static size_t method_cache_hits = 0;
59 static size_t method_cache_misses = 0;
60 static size_t method_cache_collisions = 0;
61 #endif
62 
63 #define INTERN_NAME_STRINGS
64 
65 /* alphabetical order */
66 _Py_IDENTIFIER(__abstractmethods__);
67 _Py_IDENTIFIER(__class__);
68 _Py_IDENTIFIER(__class_getitem__);
69 _Py_IDENTIFIER(__delitem__);
70 _Py_IDENTIFIER(__dict__);
71 _Py_IDENTIFIER(__doc__);
72 _Py_IDENTIFIER(__getattribute__);
73 _Py_IDENTIFIER(__getitem__);
74 _Py_IDENTIFIER(__hash__);
75 _Py_IDENTIFIER(__init_subclass__);
76 _Py_IDENTIFIER(__len__);
77 _Py_IDENTIFIER(__module__);
78 _Py_IDENTIFIER(__name__);
79 _Py_IDENTIFIER(__new__);
80 _Py_IDENTIFIER(__set_name__);
81 _Py_IDENTIFIER(__setitem__);
82 _Py_IDENTIFIER(builtins);
83 _Py_IDENTIFIER(mro);
84 
85 static PyObject *
86 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
87 
88 static void
89 clear_slotdefs(void);
90 
91 static PyObject *
92 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound);
93 
94 static int
95 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value);
96 
97 /*
98  * finds the beginning of the docstring's introspection signature.
99  * if present, returns a pointer pointing to the first '('.
100  * otherwise returns NULL.
101  *
102  * doesn't guarantee that the signature is valid, only that it
103  * has a valid prefix.  (the signature must also pass skip_signature.)
104  */
105 static const char *
find_signature(const char * name,const char * doc)106 find_signature(const char *name, const char *doc)
107 {
108     const char *dot;
109     size_t length;
110 
111     if (!doc)
112         return NULL;
113 
114     assert(name != NULL);
115 
116     /* for dotted names like classes, only use the last component */
117     dot = strrchr(name, '.');
118     if (dot)
119         name = dot + 1;
120 
121     length = strlen(name);
122     if (strncmp(doc, name, length))
123         return NULL;
124     doc += length;
125     if (*doc != '(')
126         return NULL;
127     return doc;
128 }
129 
130 #define SIGNATURE_END_MARKER         ")\n--\n\n"
131 #define SIGNATURE_END_MARKER_LENGTH  6
132 /*
133  * skips past the end of the docstring's introspection signature.
134  * (assumes doc starts with a valid signature prefix.)
135  */
136 static const char *
skip_signature(const char * doc)137 skip_signature(const char *doc)
138 {
139     while (*doc) {
140         if ((*doc == *SIGNATURE_END_MARKER) &&
141             !strncmp(doc, SIGNATURE_END_MARKER, SIGNATURE_END_MARKER_LENGTH))
142             return doc + SIGNATURE_END_MARKER_LENGTH;
143         if ((*doc == '\n') && (doc[1] == '\n'))
144             return NULL;
145         doc++;
146     }
147     return NULL;
148 }
149 
150 int
_PyType_CheckConsistency(PyTypeObject * type)151 _PyType_CheckConsistency(PyTypeObject *type)
152 {
153 #define CHECK(expr) \
154     do { if (!(expr)) { _PyObject_ASSERT_FAILED_MSG((PyObject *)type, Py_STRINGIFY(expr)); } } while (0)
155 
156     CHECK(!_PyObject_IsFreed((PyObject *)type));
157 
158     if (!(type->tp_flags & Py_TPFLAGS_READY)) {
159         /* don't check static types before PyType_Ready() */
160         return 1;
161     }
162 
163     CHECK(Py_REFCNT(type) >= 1);
164     CHECK(PyType_Check(type));
165 
166     CHECK(!(type->tp_flags & Py_TPFLAGS_READYING));
167     CHECK(type->tp_dict != NULL);
168 
169     return 1;
170 #undef CHECK
171 }
172 
173 static const char *
_PyType_DocWithoutSignature(const char * name,const char * internal_doc)174 _PyType_DocWithoutSignature(const char *name, const char *internal_doc)
175 {
176     const char *doc = find_signature(name, internal_doc);
177 
178     if (doc) {
179         doc = skip_signature(doc);
180         if (doc)
181             return doc;
182         }
183     return internal_doc;
184 }
185 
186 PyObject *
_PyType_GetDocFromInternalDoc(const char * name,const char * internal_doc)187 _PyType_GetDocFromInternalDoc(const char *name, const char *internal_doc)
188 {
189     const char *doc = _PyType_DocWithoutSignature(name, internal_doc);
190 
191     if (!doc || *doc == '\0') {
192         Py_RETURN_NONE;
193     }
194 
195     return PyUnicode_FromString(doc);
196 }
197 
198 PyObject *
_PyType_GetTextSignatureFromInternalDoc(const char * name,const char * internal_doc)199 _PyType_GetTextSignatureFromInternalDoc(const char *name, const char *internal_doc)
200 {
201     const char *start = find_signature(name, internal_doc);
202     const char *end;
203 
204     if (start)
205         end = skip_signature(start);
206     else
207         end = NULL;
208     if (!end) {
209         Py_RETURN_NONE;
210     }
211 
212     /* back "end" up until it points just past the final ')' */
213     end -= SIGNATURE_END_MARKER_LENGTH - 1;
214     assert((end - start) >= 2); /* should be "()" at least */
215     assert(end[-1] == ')');
216     assert(end[0] == '\n');
217     return PyUnicode_FromStringAndSize(start, end - start);
218 }
219 
220 unsigned int
PyType_ClearCache(void)221 PyType_ClearCache(void)
222 {
223 #ifdef MCACHE
224     Py_ssize_t i;
225     unsigned int cur_version_tag = next_version_tag - 1;
226 
227 #if MCACHE_STATS
228     size_t total = method_cache_hits + method_cache_collisions + method_cache_misses;
229     fprintf(stderr, "-- Method cache hits        = %zd (%d%%)\n",
230             method_cache_hits, (int) (100.0 * method_cache_hits / total));
231     fprintf(stderr, "-- Method cache true misses = %zd (%d%%)\n",
232             method_cache_misses, (int) (100.0 * method_cache_misses / total));
233     fprintf(stderr, "-- Method cache collisions  = %zd (%d%%)\n",
234             method_cache_collisions, (int) (100.0 * method_cache_collisions / total));
235     fprintf(stderr, "-- Method cache size        = %zd KiB\n",
236             sizeof(method_cache) / 1024);
237 #endif
238 
239     for (i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
240         method_cache[i].version = 0;
241         Py_CLEAR(method_cache[i].name);
242         method_cache[i].value = NULL;
243     }
244     next_version_tag = 0;
245     /* mark all version tags as invalid */
246     PyType_Modified(&PyBaseObject_Type);
247     return cur_version_tag;
248 #else
249     return 0;
250 #endif
251 }
252 
253 void
_PyType_Fini(void)254 _PyType_Fini(void)
255 {
256     PyType_ClearCache();
257     clear_slotdefs();
258 }
259 
260 void
PyType_Modified(PyTypeObject * type)261 PyType_Modified(PyTypeObject *type)
262 {
263     /* Invalidate any cached data for the specified type and all
264        subclasses.  This function is called after the base
265        classes, mro, or attributes of the type are altered.
266 
267        Invariants:
268 
269        - Py_TPFLAGS_VALID_VERSION_TAG is never set if
270          Py_TPFLAGS_HAVE_VERSION_TAG is not set (in case of a
271          bizarre MRO, see type_mro_modified()).
272 
273        - before Py_TPFLAGS_VALID_VERSION_TAG can be set on a type,
274          it must first be set on all super types.
275 
276        This function clears the Py_TPFLAGS_VALID_VERSION_TAG of a
277        type (so it must first clear it on all subclasses).  The
278        tp_version_tag value is meaningless unless this flag is set.
279        We don't assign new version tags eagerly, but only as
280        needed.
281      */
282     PyObject *raw, *ref;
283     Py_ssize_t i;
284 
285     if (!_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
286         return;
287 
288     raw = type->tp_subclasses;
289     if (raw != NULL) {
290         assert(PyDict_CheckExact(raw));
291         i = 0;
292         while (PyDict_Next(raw, &i, NULL, &ref)) {
293             assert(PyWeakref_CheckRef(ref));
294             ref = PyWeakref_GET_OBJECT(ref);
295             if (ref != Py_None) {
296                 PyType_Modified((PyTypeObject *)ref);
297             }
298         }
299     }
300     type->tp_flags &= ~Py_TPFLAGS_VALID_VERSION_TAG;
301 }
302 
303 static void
type_mro_modified(PyTypeObject * type,PyObject * bases)304 type_mro_modified(PyTypeObject *type, PyObject *bases) {
305     /*
306        Check that all base classes or elements of the MRO of type are
307        able to be cached.  This function is called after the base
308        classes or mro of the type are altered.
309 
310        Unset HAVE_VERSION_TAG and VALID_VERSION_TAG if the type
311        has a custom MRO that includes a type which is not officially
312        super type, or if the type implements its own mro() method.
313 
314        Called from mro_internal, which will subsequently be called on
315        each subclass when their mro is recursively updated.
316      */
317     Py_ssize_t i, n;
318     int custom = !Py_IS_TYPE(type, &PyType_Type);
319     int unbound;
320     PyObject *mro_meth = NULL;
321     PyObject *type_mro_meth = NULL;
322 
323     if (!_PyType_HasFeature(type, Py_TPFLAGS_HAVE_VERSION_TAG))
324         return;
325 
326     if (custom) {
327         mro_meth = lookup_maybe_method(
328             (PyObject *)type, &PyId_mro, &unbound);
329         if (mro_meth == NULL)
330             goto clear;
331         type_mro_meth = lookup_maybe_method(
332             (PyObject *)&PyType_Type, &PyId_mro, &unbound);
333         if (type_mro_meth == NULL)
334             goto clear;
335         if (mro_meth != type_mro_meth)
336             goto clear;
337         Py_XDECREF(mro_meth);
338         Py_XDECREF(type_mro_meth);
339     }
340     n = PyTuple_GET_SIZE(bases);
341     for (i = 0; i < n; i++) {
342         PyObject *b = PyTuple_GET_ITEM(bases, i);
343         PyTypeObject *cls;
344 
345         assert(PyType_Check(b));
346         cls = (PyTypeObject *)b;
347 
348         if (!_PyType_HasFeature(cls, Py_TPFLAGS_HAVE_VERSION_TAG) ||
349             !PyType_IsSubtype(type, cls)) {
350             goto clear;
351         }
352     }
353     return;
354  clear:
355     Py_XDECREF(mro_meth);
356     Py_XDECREF(type_mro_meth);
357     type->tp_flags &= ~(Py_TPFLAGS_HAVE_VERSION_TAG|
358                         Py_TPFLAGS_VALID_VERSION_TAG);
359 }
360 
361 #ifdef MCACHE
362 static int
assign_version_tag(PyTypeObject * type)363 assign_version_tag(PyTypeObject *type)
364 {
365     /* Ensure that the tp_version_tag is valid and set
366        Py_TPFLAGS_VALID_VERSION_TAG.  To respect the invariant, this
367        must first be done on all super classes.  Return 0 if this
368        cannot be done, 1 if Py_TPFLAGS_VALID_VERSION_TAG.
369     */
370     Py_ssize_t i, n;
371     PyObject *bases;
372 
373     if (_PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG))
374         return 1;
375     if (!_PyType_HasFeature(type, Py_TPFLAGS_HAVE_VERSION_TAG))
376         return 0;
377     if (!_PyType_HasFeature(type, Py_TPFLAGS_READY))
378         return 0;
379 
380     type->tp_version_tag = next_version_tag++;
381     /* for stress-testing: next_version_tag &= 0xFF; */
382 
383     if (type->tp_version_tag == 0) {
384         /* wrap-around or just starting Python - clear the whole
385            cache by filling names with references to Py_None.
386            Values are also set to NULL for added protection, as they
387            are borrowed reference */
388         for (i = 0; i < (1 << MCACHE_SIZE_EXP); i++) {
389             method_cache[i].value = NULL;
390             Py_INCREF(Py_None);
391             Py_XSETREF(method_cache[i].name, Py_None);
392         }
393         /* mark all version tags as invalid */
394         PyType_Modified(&PyBaseObject_Type);
395         return 1;
396     }
397     bases = type->tp_bases;
398     n = PyTuple_GET_SIZE(bases);
399     for (i = 0; i < n; i++) {
400         PyObject *b = PyTuple_GET_ITEM(bases, i);
401         assert(PyType_Check(b));
402         if (!assign_version_tag((PyTypeObject *)b))
403             return 0;
404     }
405     type->tp_flags |= Py_TPFLAGS_VALID_VERSION_TAG;
406     return 1;
407 }
408 #endif
409 
410 
411 static PyMemberDef type_members[] = {
412     {"__basicsize__", T_PYSSIZET, offsetof(PyTypeObject,tp_basicsize),READONLY},
413     {"__itemsize__", T_PYSSIZET, offsetof(PyTypeObject, tp_itemsize), READONLY},
414     {"__flags__", T_ULONG, offsetof(PyTypeObject, tp_flags), READONLY},
415     {"__weakrefoffset__", T_PYSSIZET,
416      offsetof(PyTypeObject, tp_weaklistoffset), READONLY},
417     {"__base__", T_OBJECT, offsetof(PyTypeObject, tp_base), READONLY},
418     {"__dictoffset__", T_PYSSIZET,
419      offsetof(PyTypeObject, tp_dictoffset), READONLY},
420     {"__mro__", T_OBJECT, offsetof(PyTypeObject, tp_mro), READONLY},
421     {0}
422 };
423 
424 static int
check_set_special_type_attr(PyTypeObject * type,PyObject * value,const char * name)425 check_set_special_type_attr(PyTypeObject *type, PyObject *value, const char *name)
426 {
427     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
428         PyErr_Format(PyExc_TypeError,
429                      "can't set %s.%s", type->tp_name, name);
430         return 0;
431     }
432     if (!value) {
433         PyErr_Format(PyExc_TypeError,
434                      "can't delete %s.%s", type->tp_name, name);
435         return 0;
436     }
437 
438     if (PySys_Audit("object.__setattr__", "OsO",
439                     type, name, value) < 0) {
440         return 0;
441     }
442 
443     return 1;
444 }
445 
446 const char *
_PyType_Name(PyTypeObject * type)447 _PyType_Name(PyTypeObject *type)
448 {
449     assert(type->tp_name != NULL);
450     const char *s = strrchr(type->tp_name, '.');
451     if (s == NULL) {
452         s = type->tp_name;
453     }
454     else {
455         s++;
456     }
457     return s;
458 }
459 
460 static PyObject *
type_name(PyTypeObject * type,void * context)461 type_name(PyTypeObject *type, void *context)
462 {
463     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
464         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
465 
466         Py_INCREF(et->ht_name);
467         return et->ht_name;
468     }
469     else {
470         return PyUnicode_FromString(_PyType_Name(type));
471     }
472 }
473 
474 static PyObject *
type_qualname(PyTypeObject * type,void * context)475 type_qualname(PyTypeObject *type, void *context)
476 {
477     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
478         PyHeapTypeObject* et = (PyHeapTypeObject*)type;
479         Py_INCREF(et->ht_qualname);
480         return et->ht_qualname;
481     }
482     else {
483         return PyUnicode_FromString(_PyType_Name(type));
484     }
485 }
486 
487 static int
type_set_name(PyTypeObject * type,PyObject * value,void * context)488 type_set_name(PyTypeObject *type, PyObject *value, void *context)
489 {
490     const char *tp_name;
491     Py_ssize_t name_size;
492 
493     if (!check_set_special_type_attr(type, value, "__name__"))
494         return -1;
495     if (!PyUnicode_Check(value)) {
496         PyErr_Format(PyExc_TypeError,
497                      "can only assign string to %s.__name__, not '%s'",
498                      type->tp_name, Py_TYPE(value)->tp_name);
499         return -1;
500     }
501 
502     tp_name = PyUnicode_AsUTF8AndSize(value, &name_size);
503     if (tp_name == NULL)
504         return -1;
505     if (strlen(tp_name) != (size_t)name_size) {
506         PyErr_SetString(PyExc_ValueError,
507                         "type name must not contain null characters");
508         return -1;
509     }
510 
511     type->tp_name = tp_name;
512     Py_INCREF(value);
513     Py_SETREF(((PyHeapTypeObject*)type)->ht_name, value);
514 
515     return 0;
516 }
517 
518 static int
type_set_qualname(PyTypeObject * type,PyObject * value,void * context)519 type_set_qualname(PyTypeObject *type, PyObject *value, void *context)
520 {
521     PyHeapTypeObject* et;
522 
523     if (!check_set_special_type_attr(type, value, "__qualname__"))
524         return -1;
525     if (!PyUnicode_Check(value)) {
526         PyErr_Format(PyExc_TypeError,
527                      "can only assign string to %s.__qualname__, not '%s'",
528                      type->tp_name, Py_TYPE(value)->tp_name);
529         return -1;
530     }
531 
532     et = (PyHeapTypeObject*)type;
533     Py_INCREF(value);
534     Py_SETREF(et->ht_qualname, value);
535     return 0;
536 }
537 
538 static PyObject *
type_module(PyTypeObject * type,void * context)539 type_module(PyTypeObject *type, void *context)
540 {
541     PyObject *mod;
542 
543     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE) {
544         mod = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___module__);
545         if (mod == NULL) {
546             if (!PyErr_Occurred()) {
547                 PyErr_Format(PyExc_AttributeError, "__module__");
548             }
549             return NULL;
550         }
551         Py_INCREF(mod);
552     }
553     else {
554         const char *s = strrchr(type->tp_name, '.');
555         if (s != NULL) {
556             mod = PyUnicode_FromStringAndSize(
557                 type->tp_name, (Py_ssize_t)(s - type->tp_name));
558             if (mod != NULL)
559                 PyUnicode_InternInPlace(&mod);
560         }
561         else {
562             mod = _PyUnicode_FromId(&PyId_builtins);
563             Py_XINCREF(mod);
564         }
565     }
566     return mod;
567 }
568 
569 static int
type_set_module(PyTypeObject * type,PyObject * value,void * context)570 type_set_module(PyTypeObject *type, PyObject *value, void *context)
571 {
572     if (!check_set_special_type_attr(type, value, "__module__"))
573         return -1;
574 
575     PyType_Modified(type);
576 
577     return _PyDict_SetItemId(type->tp_dict, &PyId___module__, value);
578 }
579 
580 static PyObject *
type_abstractmethods(PyTypeObject * type,void * context)581 type_abstractmethods(PyTypeObject *type, void *context)
582 {
583     PyObject *mod = NULL;
584     /* type itself has an __abstractmethods__ descriptor (this). Don't return
585        that. */
586     if (type != &PyType_Type)
587         mod = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___abstractmethods__);
588     if (!mod) {
589         if (!PyErr_Occurred()) {
590             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
591             if (message)
592                 PyErr_SetObject(PyExc_AttributeError, message);
593         }
594         return NULL;
595     }
596     Py_INCREF(mod);
597     return mod;
598 }
599 
600 static int
type_set_abstractmethods(PyTypeObject * type,PyObject * value,void * context)601 type_set_abstractmethods(PyTypeObject *type, PyObject *value, void *context)
602 {
603     /* __abstractmethods__ should only be set once on a type, in
604        abc.ABCMeta.__new__, so this function doesn't do anything
605        special to update subclasses.
606     */
607     int abstract, res;
608     if (value != NULL) {
609         abstract = PyObject_IsTrue(value);
610         if (abstract < 0)
611             return -1;
612         res = _PyDict_SetItemId(type->tp_dict, &PyId___abstractmethods__, value);
613     }
614     else {
615         abstract = 0;
616         res = _PyDict_DelItemId(type->tp_dict, &PyId___abstractmethods__);
617         if (res && PyErr_ExceptionMatches(PyExc_KeyError)) {
618             PyObject *message = _PyUnicode_FromId(&PyId___abstractmethods__);
619             if (message)
620                 PyErr_SetObject(PyExc_AttributeError, message);
621             return -1;
622         }
623     }
624     if (res == 0) {
625         PyType_Modified(type);
626         if (abstract)
627             type->tp_flags |= Py_TPFLAGS_IS_ABSTRACT;
628         else
629             type->tp_flags &= ~Py_TPFLAGS_IS_ABSTRACT;
630     }
631     return res;
632 }
633 
634 static PyObject *
type_get_bases(PyTypeObject * type,void * context)635 type_get_bases(PyTypeObject *type, void *context)
636 {
637     Py_INCREF(type->tp_bases);
638     return type->tp_bases;
639 }
640 
641 static PyTypeObject *best_base(PyObject *);
642 static int mro_internal(PyTypeObject *, PyObject **);
643 static int type_is_subtype_base_chain(PyTypeObject *, PyTypeObject *);
644 static int compatible_for_assignment(PyTypeObject *, PyTypeObject *, const char *);
645 static int add_subclass(PyTypeObject*, PyTypeObject*);
646 static int add_all_subclasses(PyTypeObject *type, PyObject *bases);
647 static void remove_subclass(PyTypeObject *, PyTypeObject *);
648 static void remove_all_subclasses(PyTypeObject *type, PyObject *bases);
649 static void update_all_slots(PyTypeObject *);
650 
651 typedef int (*update_callback)(PyTypeObject *, void *);
652 static int update_subclasses(PyTypeObject *type, PyObject *name,
653                              update_callback callback, void *data);
654 static int recurse_down_subclasses(PyTypeObject *type, PyObject *name,
655                                    update_callback callback, void *data);
656 
657 static int
mro_hierarchy(PyTypeObject * type,PyObject * temp)658 mro_hierarchy(PyTypeObject *type, PyObject *temp)
659 {
660     int res;
661     PyObject *new_mro, *old_mro;
662     PyObject *tuple;
663     PyObject *subclasses;
664     Py_ssize_t i, n;
665 
666     res = mro_internal(type, &old_mro);
667     if (res <= 0)
668         /* error / reentrance */
669         return res;
670     new_mro = type->tp_mro;
671 
672     if (old_mro != NULL)
673         tuple = PyTuple_Pack(3, type, new_mro, old_mro);
674     else
675         tuple = PyTuple_Pack(2, type, new_mro);
676 
677     if (tuple != NULL)
678         res = PyList_Append(temp, tuple);
679     else
680         res = -1;
681     Py_XDECREF(tuple);
682 
683     if (res < 0) {
684         type->tp_mro = old_mro;
685         Py_DECREF(new_mro);
686         return -1;
687     }
688     Py_XDECREF(old_mro);
689 
690     /* Obtain a copy of subclasses list to iterate over.
691 
692        Otherwise type->tp_subclasses might be altered
693        in the middle of the loop, for example, through a custom mro(),
694        by invoking type_set_bases on some subclass of the type
695        which in turn calls remove_subclass/add_subclass on this type.
696 
697        Finally, this makes things simple avoiding the need to deal
698        with dictionary iterators and weak references.
699     */
700     subclasses = type___subclasses___impl(type);
701     if (subclasses == NULL)
702         return -1;
703     n = PyList_GET_SIZE(subclasses);
704     for (i = 0; i < n; i++) {
705         PyTypeObject *subclass;
706         subclass = (PyTypeObject *)PyList_GET_ITEM(subclasses, i);
707         res = mro_hierarchy(subclass, temp);
708         if (res < 0)
709             break;
710     }
711     Py_DECREF(subclasses);
712 
713     return res;
714 }
715 
716 static int
type_set_bases(PyTypeObject * type,PyObject * new_bases,void * context)717 type_set_bases(PyTypeObject *type, PyObject *new_bases, void *context)
718 {
719     int res = 0;
720     PyObject *temp;
721     PyObject *old_bases;
722     PyTypeObject *new_base, *old_base;
723     Py_ssize_t i;
724 
725     if (!check_set_special_type_attr(type, new_bases, "__bases__"))
726         return -1;
727     if (!PyTuple_Check(new_bases)) {
728         PyErr_Format(PyExc_TypeError,
729              "can only assign tuple to %s.__bases__, not %s",
730                  type->tp_name, Py_TYPE(new_bases)->tp_name);
731         return -1;
732     }
733     if (PyTuple_GET_SIZE(new_bases) == 0) {
734         PyErr_Format(PyExc_TypeError,
735              "can only assign non-empty tuple to %s.__bases__, not ()",
736                  type->tp_name);
737         return -1;
738     }
739     for (i = 0; i < PyTuple_GET_SIZE(new_bases); i++) {
740         PyObject *ob;
741         PyTypeObject *base;
742 
743         ob = PyTuple_GET_ITEM(new_bases, i);
744         if (!PyType_Check(ob)) {
745             PyErr_Format(PyExc_TypeError,
746                          "%s.__bases__ must be tuple of classes, not '%s'",
747                          type->tp_name, Py_TYPE(ob)->tp_name);
748             return -1;
749         }
750 
751         base = (PyTypeObject*)ob;
752         if (PyType_IsSubtype(base, type) ||
753             /* In case of reentering here again through a custom mro()
754                the above check is not enough since it relies on
755                base->tp_mro which would gonna be updated inside
756                mro_internal only upon returning from the mro().
757 
758                However, base->tp_base has already been assigned (see
759                below), which in turn may cause an inheritance cycle
760                through tp_base chain.  And this is definitely
761                not what you want to ever happen.  */
762             (base->tp_mro != NULL && type_is_subtype_base_chain(base, type))) {
763 
764             PyErr_SetString(PyExc_TypeError,
765                             "a __bases__ item causes an inheritance cycle");
766             return -1;
767         }
768     }
769 
770     new_base = best_base(new_bases);
771     if (new_base == NULL)
772         return -1;
773 
774     if (!compatible_for_assignment(type->tp_base, new_base, "__bases__"))
775         return -1;
776 
777     Py_INCREF(new_bases);
778     Py_INCREF(new_base);
779 
780     old_bases = type->tp_bases;
781     old_base = type->tp_base;
782 
783     type->tp_bases = new_bases;
784     type->tp_base = new_base;
785 
786     temp = PyList_New(0);
787     if (temp == NULL)
788         goto bail;
789     if (mro_hierarchy(type, temp) < 0)
790         goto undo;
791     Py_DECREF(temp);
792 
793     /* Take no action in case if type->tp_bases has been replaced
794        through reentrance.  */
795     if (type->tp_bases == new_bases) {
796         /* any base that was in __bases__ but now isn't, we
797            need to remove |type| from its tp_subclasses.
798            conversely, any class now in __bases__ that wasn't
799            needs to have |type| added to its subclasses. */
800 
801         /* for now, sod that: just remove from all old_bases,
802            add to all new_bases */
803         remove_all_subclasses(type, old_bases);
804         res = add_all_subclasses(type, new_bases);
805         update_all_slots(type);
806     }
807 
808     Py_DECREF(old_bases);
809     Py_DECREF(old_base);
810 
811     assert(_PyType_CheckConsistency(type));
812     return res;
813 
814   undo:
815     for (i = PyList_GET_SIZE(temp) - 1; i >= 0; i--) {
816         PyTypeObject *cls;
817         PyObject *new_mro, *old_mro = NULL;
818 
819         PyArg_UnpackTuple(PyList_GET_ITEM(temp, i),
820                           "", 2, 3, &cls, &new_mro, &old_mro);
821         /* Do not rollback if cls has a newer version of MRO.  */
822         if (cls->tp_mro == new_mro) {
823             Py_XINCREF(old_mro);
824             cls->tp_mro = old_mro;
825             Py_DECREF(new_mro);
826         }
827     }
828     Py_DECREF(temp);
829 
830   bail:
831     if (type->tp_bases == new_bases) {
832         assert(type->tp_base == new_base);
833 
834         type->tp_bases = old_bases;
835         type->tp_base = old_base;
836 
837         Py_DECREF(new_bases);
838         Py_DECREF(new_base);
839     }
840     else {
841         Py_DECREF(old_bases);
842         Py_DECREF(old_base);
843     }
844 
845     assert(_PyType_CheckConsistency(type));
846     return -1;
847 }
848 
849 static PyObject *
type_dict(PyTypeObject * type,void * context)850 type_dict(PyTypeObject *type, void *context)
851 {
852     if (type->tp_dict == NULL) {
853         Py_RETURN_NONE;
854     }
855     return PyDictProxy_New(type->tp_dict);
856 }
857 
858 static PyObject *
type_get_doc(PyTypeObject * type,void * context)859 type_get_doc(PyTypeObject *type, void *context)
860 {
861     PyObject *result;
862     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE) && type->tp_doc != NULL) {
863         return _PyType_GetDocFromInternalDoc(type->tp_name, type->tp_doc);
864     }
865     result = _PyDict_GetItemIdWithError(type->tp_dict, &PyId___doc__);
866     if (result == NULL) {
867         if (!PyErr_Occurred()) {
868             result = Py_None;
869             Py_INCREF(result);
870         }
871     }
872     else if (Py_TYPE(result)->tp_descr_get) {
873         result = Py_TYPE(result)->tp_descr_get(result, NULL,
874                                                (PyObject *)type);
875     }
876     else {
877         Py_INCREF(result);
878     }
879     return result;
880 }
881 
882 static PyObject *
type_get_text_signature(PyTypeObject * type,void * context)883 type_get_text_signature(PyTypeObject *type, void *context)
884 {
885     return _PyType_GetTextSignatureFromInternalDoc(type->tp_name, type->tp_doc);
886 }
887 
888 static int
type_set_doc(PyTypeObject * type,PyObject * value,void * context)889 type_set_doc(PyTypeObject *type, PyObject *value, void *context)
890 {
891     if (!check_set_special_type_attr(type, value, "__doc__"))
892         return -1;
893     PyType_Modified(type);
894     return _PyDict_SetItemId(type->tp_dict, &PyId___doc__, value);
895 }
896 
897 /*[clinic input]
898 type.__instancecheck__ -> bool
899 
900     instance: object
901     /
902 
903 Check if an object is an instance.
904 [clinic start generated code]*/
905 
906 static int
type___instancecheck___impl(PyTypeObject * self,PyObject * instance)907 type___instancecheck___impl(PyTypeObject *self, PyObject *instance)
908 /*[clinic end generated code: output=08b6bf5f591c3618 input=cdbfeaee82c01a0f]*/
909 {
910     return _PyObject_RealIsInstance(instance, (PyObject *)self);
911 }
912 
913 /*[clinic input]
914 type.__subclasscheck__ -> bool
915 
916     subclass: object
917     /
918 
919 Check if a class is a subclass.
920 [clinic start generated code]*/
921 
922 static int
type___subclasscheck___impl(PyTypeObject * self,PyObject * subclass)923 type___subclasscheck___impl(PyTypeObject *self, PyObject *subclass)
924 /*[clinic end generated code: output=97a4e51694500941 input=071b2ca9e03355f4]*/
925 {
926     return _PyObject_RealIsSubclass(subclass, (PyObject *)self);
927 }
928 
929 
930 static PyGetSetDef type_getsets[] = {
931     {"__name__", (getter)type_name, (setter)type_set_name, NULL},
932     {"__qualname__", (getter)type_qualname, (setter)type_set_qualname, NULL},
933     {"__bases__", (getter)type_get_bases, (setter)type_set_bases, NULL},
934     {"__module__", (getter)type_module, (setter)type_set_module, NULL},
935     {"__abstractmethods__", (getter)type_abstractmethods,
936      (setter)type_set_abstractmethods, NULL},
937     {"__dict__",  (getter)type_dict,  NULL, NULL},
938     {"__doc__", (getter)type_get_doc, (setter)type_set_doc, NULL},
939     {"__text_signature__", (getter)type_get_text_signature, NULL, NULL},
940     {0}
941 };
942 
943 static PyObject *
type_repr(PyTypeObject * type)944 type_repr(PyTypeObject *type)
945 {
946     PyObject *mod, *name, *rtn;
947 
948     mod = type_module(type, NULL);
949     if (mod == NULL)
950         PyErr_Clear();
951     else if (!PyUnicode_Check(mod)) {
952         Py_DECREF(mod);
953         mod = NULL;
954     }
955     name = type_qualname(type, NULL);
956     if (name == NULL) {
957         Py_XDECREF(mod);
958         return NULL;
959     }
960 
961     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
962         rtn = PyUnicode_FromFormat("<class '%U.%U'>", mod, name);
963     else
964         rtn = PyUnicode_FromFormat("<class '%s'>", type->tp_name);
965 
966     Py_XDECREF(mod);
967     Py_DECREF(name);
968     return rtn;
969 }
970 
971 static PyObject *
type_call(PyTypeObject * type,PyObject * args,PyObject * kwds)972 type_call(PyTypeObject *type, PyObject *args, PyObject *kwds)
973 {
974     PyObject *obj;
975     PyThreadState *tstate = _PyThreadState_GET();
976 
977 #ifdef Py_DEBUG
978     /* type_call() must not be called with an exception set,
979        because it can clear it (directly or indirectly) and so the
980        caller loses its exception */
981     assert(!_PyErr_Occurred(tstate));
982 #endif
983 
984     /* Special case: type(x) should return Py_TYPE(x) */
985     /* We only want type itself to accept the one-argument form (#27157) */
986     if (type == &PyType_Type) {
987         assert(args != NULL && PyTuple_Check(args));
988         assert(kwds == NULL || PyDict_Check(kwds));
989         Py_ssize_t nargs = PyTuple_GET_SIZE(args);
990 
991         if (nargs == 1 && (kwds == NULL || !PyDict_GET_SIZE(kwds))) {
992             obj = (PyObject *) Py_TYPE(PyTuple_GET_ITEM(args, 0));
993             Py_INCREF(obj);
994             return obj;
995         }
996 
997         /* SF bug 475327 -- if that didn't trigger, we need 3
998            arguments. But PyArg_ParseTuple in type_new may give
999            a msg saying type() needs exactly 3. */
1000         if (nargs != 3) {
1001             PyErr_SetString(PyExc_TypeError,
1002                             "type() takes 1 or 3 arguments");
1003             return NULL;
1004         }
1005     }
1006 
1007     if (type->tp_new == NULL) {
1008         _PyErr_Format(tstate, PyExc_TypeError,
1009                       "cannot create '%.100s' instances",
1010                       type->tp_name);
1011         return NULL;
1012     }
1013 
1014     obj = type->tp_new(type, args, kwds);
1015     obj = _Py_CheckFunctionResult(tstate, (PyObject*)type, obj, NULL);
1016     if (obj == NULL)
1017         return NULL;
1018 
1019     /* If the returned object is not an instance of type,
1020        it won't be initialized. */
1021     if (!PyType_IsSubtype(Py_TYPE(obj), type))
1022         return obj;
1023 
1024     type = Py_TYPE(obj);
1025     if (type->tp_init != NULL) {
1026         int res = type->tp_init(obj, args, kwds);
1027         if (res < 0) {
1028             assert(_PyErr_Occurred(tstate));
1029             Py_DECREF(obj);
1030             obj = NULL;
1031         }
1032         else {
1033             assert(!_PyErr_Occurred(tstate));
1034         }
1035     }
1036     return obj;
1037 }
1038 
1039 PyObject *
PyType_GenericAlloc(PyTypeObject * type,Py_ssize_t nitems)1040 PyType_GenericAlloc(PyTypeObject *type, Py_ssize_t nitems)
1041 {
1042     PyObject *obj;
1043     const size_t size = _PyObject_VAR_SIZE(type, nitems+1);
1044     /* note that we need to add one, for the sentinel */
1045 
1046     if (_PyType_IS_GC(type)) {
1047         obj = _PyObject_GC_Malloc(size);
1048     }
1049     else {
1050         obj = (PyObject *)PyObject_MALLOC(size);
1051     }
1052 
1053     if (obj == NULL) {
1054         return PyErr_NoMemory();
1055     }
1056 
1057     memset(obj, '\0', size);
1058 
1059     if (type->tp_itemsize == 0) {
1060         (void)PyObject_INIT(obj, type);
1061     }
1062     else {
1063         (void) PyObject_INIT_VAR((PyVarObject *)obj, type, nitems);
1064     }
1065 
1066     if (_PyType_IS_GC(type)) {
1067         _PyObject_GC_TRACK(obj);
1068     }
1069     return obj;
1070 }
1071 
1072 PyObject *
PyType_GenericNew(PyTypeObject * type,PyObject * args,PyObject * kwds)1073 PyType_GenericNew(PyTypeObject *type, PyObject *args, PyObject *kwds)
1074 {
1075     return type->tp_alloc(type, 0);
1076 }
1077 
1078 /* Helpers for subtyping */
1079 
1080 static int
traverse_slots(PyTypeObject * type,PyObject * self,visitproc visit,void * arg)1081 traverse_slots(PyTypeObject *type, PyObject *self, visitproc visit, void *arg)
1082 {
1083     Py_ssize_t i, n;
1084     PyMemberDef *mp;
1085 
1086     n = Py_SIZE(type);
1087     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1088     for (i = 0; i < n; i++, mp++) {
1089         if (mp->type == T_OBJECT_EX) {
1090             char *addr = (char *)self + mp->offset;
1091             PyObject *obj = *(PyObject **)addr;
1092             if (obj != NULL) {
1093                 int err = visit(obj, arg);
1094                 if (err)
1095                     return err;
1096             }
1097         }
1098     }
1099     return 0;
1100 }
1101 
1102 static int
subtype_traverse(PyObject * self,visitproc visit,void * arg)1103 subtype_traverse(PyObject *self, visitproc visit, void *arg)
1104 {
1105     PyTypeObject *type, *base;
1106     traverseproc basetraverse;
1107 
1108     /* Find the nearest base with a different tp_traverse,
1109        and traverse slots while we're at it */
1110     type = Py_TYPE(self);
1111     base = type;
1112     while ((basetraverse = base->tp_traverse) == subtype_traverse) {
1113         if (Py_SIZE(base)) {
1114             int err = traverse_slots(base, self, visit, arg);
1115             if (err)
1116                 return err;
1117         }
1118         base = base->tp_base;
1119         assert(base);
1120     }
1121 
1122     if (type->tp_dictoffset != base->tp_dictoffset) {
1123         PyObject **dictptr = _PyObject_GetDictPtr(self);
1124         if (dictptr && *dictptr)
1125             Py_VISIT(*dictptr);
1126     }
1127 
1128     if (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1129         && (!basetraverse || !(base->tp_flags & Py_TPFLAGS_HEAPTYPE))) {
1130         /* For a heaptype, the instances count as references
1131            to the type.          Traverse the type so the collector
1132            can find cycles involving this link.
1133            Skip this visit if basetraverse belongs to a heap type: in that
1134            case, basetraverse will visit the type when we call it later.
1135            */
1136         Py_VISIT(type);
1137     }
1138 
1139     if (basetraverse)
1140         return basetraverse(self, visit, arg);
1141     return 0;
1142 }
1143 
1144 static void
clear_slots(PyTypeObject * type,PyObject * self)1145 clear_slots(PyTypeObject *type, PyObject *self)
1146 {
1147     Py_ssize_t i, n;
1148     PyMemberDef *mp;
1149 
1150     n = Py_SIZE(type);
1151     mp = PyHeapType_GET_MEMBERS((PyHeapTypeObject *)type);
1152     for (i = 0; i < n; i++, mp++) {
1153         if (mp->type == T_OBJECT_EX && !(mp->flags & READONLY)) {
1154             char *addr = (char *)self + mp->offset;
1155             PyObject *obj = *(PyObject **)addr;
1156             if (obj != NULL) {
1157                 *(PyObject **)addr = NULL;
1158                 Py_DECREF(obj);
1159             }
1160         }
1161     }
1162 }
1163 
1164 static int
subtype_clear(PyObject * self)1165 subtype_clear(PyObject *self)
1166 {
1167     PyTypeObject *type, *base;
1168     inquiry baseclear;
1169 
1170     /* Find the nearest base with a different tp_clear
1171        and clear slots while we're at it */
1172     type = Py_TYPE(self);
1173     base = type;
1174     while ((baseclear = base->tp_clear) == subtype_clear) {
1175         if (Py_SIZE(base))
1176             clear_slots(base, self);
1177         base = base->tp_base;
1178         assert(base);
1179     }
1180 
1181     /* Clear the instance dict (if any), to break cycles involving only
1182        __dict__ slots (as in the case 'self.__dict__ is self'). */
1183     if (type->tp_dictoffset != base->tp_dictoffset) {
1184         PyObject **dictptr = _PyObject_GetDictPtr(self);
1185         if (dictptr && *dictptr)
1186             Py_CLEAR(*dictptr);
1187     }
1188 
1189     if (baseclear)
1190         return baseclear(self);
1191     return 0;
1192 }
1193 
1194 static void
subtype_dealloc(PyObject * self)1195 subtype_dealloc(PyObject *self)
1196 {
1197     PyTypeObject *type, *base;
1198     destructor basedealloc;
1199     int has_finalizer;
1200 
1201     /* Extract the type; we expect it to be a heap type */
1202     type = Py_TYPE(self);
1203     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
1204 
1205     /* Test whether the type has GC exactly once */
1206 
1207     if (!_PyType_IS_GC(type)) {
1208         /* A non GC dynamic type allows certain simplifications:
1209            there's no need to call clear_slots(), or DECREF the dict,
1210            or clear weakrefs. */
1211 
1212         /* Maybe call finalizer; exit early if resurrected */
1213         if (type->tp_finalize) {
1214             if (PyObject_CallFinalizerFromDealloc(self) < 0)
1215                 return;
1216         }
1217         if (type->tp_del) {
1218             type->tp_del(self);
1219             if (Py_REFCNT(self) > 0) {
1220                 return;
1221             }
1222         }
1223 
1224         /* Find the nearest base with a different tp_dealloc */
1225         base = type;
1226         while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1227             base = base->tp_base;
1228             assert(base);
1229         }
1230 
1231         /* Extract the type again; tp_del may have changed it */
1232         type = Py_TYPE(self);
1233 
1234         // Don't read type memory after calling basedealloc() since basedealloc()
1235         // can deallocate the type and free its memory.
1236         int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1237                                  && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE));
1238 
1239         /* Call the base tp_dealloc() */
1240         assert(basedealloc);
1241         basedealloc(self);
1242 
1243         /* Can't reference self beyond this point. It's possible tp_del switched
1244            our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
1245            reference counting. Only decref if the base type is not already a heap
1246            allocated type. Otherwise, basedealloc should have decref'd it already */
1247         if (type_needs_decref) {
1248             Py_DECREF(type);
1249         }
1250 
1251         /* Done */
1252         return;
1253     }
1254 
1255     /* We get here only if the type has GC */
1256 
1257     /* UnTrack and re-Track around the trashcan macro, alas */
1258     /* See explanation at end of function for full disclosure */
1259     PyObject_GC_UnTrack(self);
1260     Py_TRASHCAN_BEGIN(self, subtype_dealloc);
1261 
1262     /* Find the nearest base with a different tp_dealloc */
1263     base = type;
1264     while ((/*basedealloc =*/ base->tp_dealloc) == subtype_dealloc) {
1265         base = base->tp_base;
1266         assert(base);
1267     }
1268 
1269     has_finalizer = type->tp_finalize || type->tp_del;
1270 
1271     if (type->tp_finalize) {
1272         _PyObject_GC_TRACK(self);
1273         if (PyObject_CallFinalizerFromDealloc(self) < 0) {
1274             /* Resurrected */
1275             goto endlabel;
1276         }
1277         _PyObject_GC_UNTRACK(self);
1278     }
1279     /*
1280       If we added a weaklist, we clear it. Do this *before* calling tp_del,
1281       clearing slots, or clearing the instance dict.
1282 
1283       GC tracking must be off at this point. weakref callbacks (if any, and
1284       whether directly here or indirectly in something we call) may trigger GC,
1285       and if self is tracked at that point, it will look like trash to GC and GC
1286       will try to delete self again.
1287     */
1288     if (type->tp_weaklistoffset && !base->tp_weaklistoffset)
1289         PyObject_ClearWeakRefs(self);
1290 
1291     if (type->tp_del) {
1292         _PyObject_GC_TRACK(self);
1293         type->tp_del(self);
1294         if (Py_REFCNT(self) > 0) {
1295             /* Resurrected */
1296             goto endlabel;
1297         }
1298         _PyObject_GC_UNTRACK(self);
1299     }
1300     if (has_finalizer) {
1301         /* New weakrefs could be created during the finalizer call.
1302            If this occurs, clear them out without calling their
1303            finalizers since they might rely on part of the object
1304            being finalized that has already been destroyed. */
1305         if (type->tp_weaklistoffset && !base->tp_weaklistoffset) {
1306             /* Modeled after GET_WEAKREFS_LISTPTR() */
1307             PyWeakReference **list = (PyWeakReference **) \
1308                 _PyObject_GET_WEAKREFS_LISTPTR(self);
1309             while (*list)
1310                 _PyWeakref_ClearRef(*list);
1311         }
1312     }
1313 
1314     /*  Clear slots up to the nearest base with a different tp_dealloc */
1315     base = type;
1316     while ((basedealloc = base->tp_dealloc) == subtype_dealloc) {
1317         if (Py_SIZE(base))
1318             clear_slots(base, self);
1319         base = base->tp_base;
1320         assert(base);
1321     }
1322 
1323     /* If we added a dict, DECREF it */
1324     if (type->tp_dictoffset && !base->tp_dictoffset) {
1325         PyObject **dictptr = _PyObject_GetDictPtr(self);
1326         if (dictptr != NULL) {
1327             PyObject *dict = *dictptr;
1328             if (dict != NULL) {
1329                 Py_DECREF(dict);
1330                 *dictptr = NULL;
1331             }
1332         }
1333     }
1334 
1335     /* Extract the type again; tp_del may have changed it */
1336     type = Py_TYPE(self);
1337 
1338     /* Call the base tp_dealloc(); first retrack self if
1339      * basedealloc knows about gc.
1340      */
1341     if (_PyType_IS_GC(base)) {
1342         _PyObject_GC_TRACK(self);
1343     }
1344 
1345     // Don't read type memory after calling basedealloc() since basedealloc()
1346     // can deallocate the type and free its memory.
1347     int type_needs_decref = (type->tp_flags & Py_TPFLAGS_HEAPTYPE
1348                              && !(base->tp_flags & Py_TPFLAGS_HEAPTYPE));
1349 
1350     assert(basedealloc);
1351     basedealloc(self);
1352 
1353     /* Can't reference self beyond this point. It's possible tp_del switched
1354        our type from a HEAPTYPE to a non-HEAPTYPE, so be careful about
1355        reference counting. Only decref if the base type is not already a heap
1356        allocated type. Otherwise, basedealloc should have decref'd it already */
1357     if (type_needs_decref) {
1358         Py_DECREF(type);
1359     }
1360 
1361   endlabel:
1362     Py_TRASHCAN_END
1363 
1364     /* Explanation of the weirdness around the trashcan macros:
1365 
1366        Q. What do the trashcan macros do?
1367 
1368        A. Read the comment titled "Trashcan mechanism" in object.h.
1369           For one, this explains why there must be a call to GC-untrack
1370           before the trashcan begin macro.      Without understanding the
1371           trashcan code, the answers to the following questions don't make
1372           sense.
1373 
1374        Q. Why do we GC-untrack before the trashcan and then immediately
1375           GC-track again afterward?
1376 
1377        A. In the case that the base class is GC-aware, the base class
1378           probably GC-untracks the object.      If it does that using the
1379           UNTRACK macro, this will crash when the object is already
1380           untracked.  Because we don't know what the base class does, the
1381           only safe thing is to make sure the object is tracked when we
1382           call the base class dealloc.  But...  The trashcan begin macro
1383           requires that the object is *untracked* before it is called.  So
1384           the dance becomes:
1385 
1386          GC untrack
1387          trashcan begin
1388          GC track
1389 
1390        Q. Why did the last question say "immediately GC-track again"?
1391           It's nowhere near immediately.
1392 
1393        A. Because the code *used* to re-track immediately.      Bad Idea.
1394           self has a refcount of 0, and if gc ever gets its hands on it
1395           (which can happen if any weakref callback gets invoked), it
1396           looks like trash to gc too, and gc also tries to delete self
1397           then.  But we're already deleting self.  Double deallocation is
1398           a subtle disaster.
1399     */
1400 }
1401 
1402 static PyTypeObject *solid_base(PyTypeObject *type);
1403 
1404 /* type test with subclassing support */
1405 
1406 static int
type_is_subtype_base_chain(PyTypeObject * a,PyTypeObject * b)1407 type_is_subtype_base_chain(PyTypeObject *a, PyTypeObject *b)
1408 {
1409     do {
1410         if (a == b)
1411             return 1;
1412         a = a->tp_base;
1413     } while (a != NULL);
1414 
1415     return (b == &PyBaseObject_Type);
1416 }
1417 
1418 int
PyType_IsSubtype(PyTypeObject * a,PyTypeObject * b)1419 PyType_IsSubtype(PyTypeObject *a, PyTypeObject *b)
1420 {
1421     PyObject *mro;
1422 
1423     mro = a->tp_mro;
1424     if (mro != NULL) {
1425         /* Deal with multiple inheritance without recursion
1426            by walking the MRO tuple */
1427         Py_ssize_t i, n;
1428         assert(PyTuple_Check(mro));
1429         n = PyTuple_GET_SIZE(mro);
1430         for (i = 0; i < n; i++) {
1431             if (PyTuple_GET_ITEM(mro, i) == (PyObject *)b)
1432                 return 1;
1433         }
1434         return 0;
1435     }
1436     else
1437         /* a is not completely initialized yet; follow tp_base */
1438         return type_is_subtype_base_chain(a, b);
1439 }
1440 
1441 /* Routines to do a method lookup in the type without looking in the
1442    instance dictionary (so we can't use PyObject_GetAttr) but still
1443    binding it to the instance.
1444 
1445    Variants:
1446 
1447    - _PyObject_LookupSpecial() returns NULL without raising an exception
1448      when the _PyType_Lookup() call fails;
1449 
1450    - lookup_maybe_method() and lookup_method() are internal routines similar
1451      to _PyObject_LookupSpecial(), but can return unbound PyFunction
1452      to avoid temporary method object. Pass self as first argument when
1453      unbound == 1.
1454 */
1455 
1456 PyObject *
_PyObject_LookupSpecial(PyObject * self,_Py_Identifier * attrid)1457 _PyObject_LookupSpecial(PyObject *self, _Py_Identifier *attrid)
1458 {
1459     PyObject *res;
1460 
1461     res = _PyType_LookupId(Py_TYPE(self), attrid);
1462     if (res != NULL) {
1463         descrgetfunc f;
1464         if ((f = Py_TYPE(res)->tp_descr_get) == NULL)
1465             Py_INCREF(res);
1466         else
1467             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1468     }
1469     return res;
1470 }
1471 
1472 static PyObject *
lookup_maybe_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1473 lookup_maybe_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1474 {
1475     PyObject *res = _PyType_LookupId(Py_TYPE(self), attrid);
1476     if (res == NULL) {
1477         return NULL;
1478     }
1479 
1480     if (_PyType_HasFeature(Py_TYPE(res), Py_TPFLAGS_METHOD_DESCRIPTOR)) {
1481         /* Avoid temporary PyMethodObject */
1482         *unbound = 1;
1483         Py_INCREF(res);
1484     }
1485     else {
1486         *unbound = 0;
1487         descrgetfunc f = Py_TYPE(res)->tp_descr_get;
1488         if (f == NULL) {
1489             Py_INCREF(res);
1490         }
1491         else {
1492             res = f(res, self, (PyObject *)(Py_TYPE(self)));
1493         }
1494     }
1495     return res;
1496 }
1497 
1498 static PyObject *
lookup_method(PyObject * self,_Py_Identifier * attrid,int * unbound)1499 lookup_method(PyObject *self, _Py_Identifier *attrid, int *unbound)
1500 {
1501     PyObject *res = lookup_maybe_method(self, attrid, unbound);
1502     if (res == NULL && !PyErr_Occurred()) {
1503         PyErr_SetObject(PyExc_AttributeError, _PyUnicode_FromId(attrid));
1504     }
1505     return res;
1506 }
1507 
1508 
1509 static inline PyObject*
vectorcall_unbound(PyThreadState * tstate,int unbound,PyObject * func,PyObject * const * args,Py_ssize_t nargs)1510 vectorcall_unbound(PyThreadState *tstate, int unbound, PyObject *func,
1511                    PyObject *const *args, Py_ssize_t nargs)
1512 {
1513     size_t nargsf = nargs;
1514     if (!unbound) {
1515         /* Skip self argument, freeing up args[0] to use for
1516          * PY_VECTORCALL_ARGUMENTS_OFFSET */
1517         args++;
1518         nargsf = nargsf - 1 + PY_VECTORCALL_ARGUMENTS_OFFSET;
1519     }
1520     return _PyObject_VectorcallTstate(tstate, func, args, nargsf, NULL);
1521 }
1522 
1523 static PyObject*
call_unbound_noarg(int unbound,PyObject * func,PyObject * self)1524 call_unbound_noarg(int unbound, PyObject *func, PyObject *self)
1525 {
1526     if (unbound) {
1527         return PyObject_CallOneArg(func, self);
1528     }
1529     else {
1530         return _PyObject_CallNoArg(func);
1531     }
1532 }
1533 
1534 /* A variation of PyObject_CallMethod* that uses lookup_method()
1535    instead of PyObject_GetAttrString().
1536 
1537    args is an argument vector of length nargs. The first element in this
1538    vector is the special object "self" which is used for the method lookup */
1539 static PyObject *
vectorcall_method(_Py_Identifier * name,PyObject * const * args,Py_ssize_t nargs)1540 vectorcall_method(_Py_Identifier *name,
1541                   PyObject *const *args, Py_ssize_t nargs)
1542 {
1543     assert(nargs >= 1);
1544 
1545     PyThreadState *tstate = _PyThreadState_GET();
1546     int unbound;
1547     PyObject *self = args[0];
1548     PyObject *func = lookup_method(self, name, &unbound);
1549     if (func == NULL) {
1550         return NULL;
1551     }
1552     PyObject *retval = vectorcall_unbound(tstate, unbound, func, args, nargs);
1553     Py_DECREF(func);
1554     return retval;
1555 }
1556 
1557 /* Clone of vectorcall_method() that returns NotImplemented
1558  * when the lookup fails. */
1559 static PyObject *
vectorcall_maybe(PyThreadState * tstate,_Py_Identifier * name,PyObject * const * args,Py_ssize_t nargs)1560 vectorcall_maybe(PyThreadState *tstate, _Py_Identifier *name,
1561                  PyObject *const *args, Py_ssize_t nargs)
1562 {
1563     assert(nargs >= 1);
1564 
1565     int unbound;
1566     PyObject *self = args[0];
1567     PyObject *func = lookup_maybe_method(self, name, &unbound);
1568     if (func == NULL) {
1569         if (!PyErr_Occurred())
1570             Py_RETURN_NOTIMPLEMENTED;
1571         return NULL;
1572     }
1573     PyObject *retval = vectorcall_unbound(tstate, unbound, func, args, nargs);
1574     Py_DECREF(func);
1575     return retval;
1576 }
1577 
1578 /*
1579     Method resolution order algorithm C3 described in
1580     "A Monotonic Superclass Linearization for Dylan",
1581     by Kim Barrett, Bob Cassel, Paul Haahr,
1582     David A. Moon, Keith Playford, and P. Tucker Withington.
1583     (OOPSLA 1996)
1584 
1585     Some notes about the rules implied by C3:
1586 
1587     No duplicate bases.
1588     It isn't legal to repeat a class in a list of base classes.
1589 
1590     The next three properties are the 3 constraints in "C3".
1591 
1592     Local precedence order.
1593     If A precedes B in C's MRO, then A will precede B in the MRO of all
1594     subclasses of C.
1595 
1596     Monotonicity.
1597     The MRO of a class must be an extension without reordering of the
1598     MRO of each of its superclasses.
1599 
1600     Extended Precedence Graph (EPG).
1601     Linearization is consistent if there is a path in the EPG from
1602     each class to all its successors in the linearization.  See
1603     the paper for definition of EPG.
1604  */
1605 
1606 static int
tail_contains(PyObject * tuple,int whence,PyObject * o)1607 tail_contains(PyObject *tuple, int whence, PyObject *o)
1608 {
1609     Py_ssize_t j, size;
1610     size = PyTuple_GET_SIZE(tuple);
1611 
1612     for (j = whence+1; j < size; j++) {
1613         if (PyTuple_GET_ITEM(tuple, j) == o)
1614             return 1;
1615     }
1616     return 0;
1617 }
1618 
1619 static PyObject *
class_name(PyObject * cls)1620 class_name(PyObject *cls)
1621 {
1622     PyObject *name;
1623     if (_PyObject_LookupAttrId(cls, &PyId___name__, &name) == 0) {
1624         name = PyObject_Repr(cls);
1625     }
1626     return name;
1627 }
1628 
1629 static int
check_duplicates(PyObject * tuple)1630 check_duplicates(PyObject *tuple)
1631 {
1632     Py_ssize_t i, j, n;
1633     /* Let's use a quadratic time algorithm,
1634        assuming that the bases tuples is short.
1635     */
1636     n = PyTuple_GET_SIZE(tuple);
1637     for (i = 0; i < n; i++) {
1638         PyObject *o = PyTuple_GET_ITEM(tuple, i);
1639         for (j = i + 1; j < n; j++) {
1640             if (PyTuple_GET_ITEM(tuple, j) == o) {
1641                 o = class_name(o);
1642                 if (o != NULL) {
1643                     if (PyUnicode_Check(o)) {
1644                         PyErr_Format(PyExc_TypeError,
1645                                      "duplicate base class %U", o);
1646                     }
1647                     else {
1648                         PyErr_SetString(PyExc_TypeError,
1649                                         "duplicate base class");
1650                     }
1651                     Py_DECREF(o);
1652                 }
1653                 return -1;
1654             }
1655         }
1656     }
1657     return 0;
1658 }
1659 
1660 /* Raise a TypeError for an MRO order disagreement.
1661 
1662    It's hard to produce a good error message.  In the absence of better
1663    insight into error reporting, report the classes that were candidates
1664    to be put next into the MRO.  There is some conflict between the
1665    order in which they should be put in the MRO, but it's hard to
1666    diagnose what constraint can't be satisfied.
1667 */
1668 
1669 static void
set_mro_error(PyObject ** to_merge,Py_ssize_t to_merge_size,int * remain)1670 set_mro_error(PyObject **to_merge, Py_ssize_t to_merge_size, int *remain)
1671 {
1672     Py_ssize_t i, n, off;
1673     char buf[1000];
1674     PyObject *k, *v;
1675     PyObject *set = PyDict_New();
1676     if (!set) return;
1677 
1678     for (i = 0; i < to_merge_size; i++) {
1679         PyObject *L = to_merge[i];
1680         if (remain[i] < PyTuple_GET_SIZE(L)) {
1681             PyObject *c = PyTuple_GET_ITEM(L, remain[i]);
1682             if (PyDict_SetItem(set, c, Py_None) < 0) {
1683                 Py_DECREF(set);
1684                 return;
1685             }
1686         }
1687     }
1688     n = PyDict_GET_SIZE(set);
1689 
1690     off = PyOS_snprintf(buf, sizeof(buf), "Cannot create a \
1691 consistent method resolution\norder (MRO) for bases");
1692     i = 0;
1693     while (PyDict_Next(set, &i, &k, &v) && (size_t)off < sizeof(buf)) {
1694         PyObject *name = class_name(k);
1695         const char *name_str = NULL;
1696         if (name != NULL) {
1697             if (PyUnicode_Check(name)) {
1698                 name_str = PyUnicode_AsUTF8(name);
1699             }
1700             else {
1701                 name_str = "?";
1702             }
1703         }
1704         if (name_str == NULL) {
1705             Py_XDECREF(name);
1706             Py_DECREF(set);
1707             return;
1708         }
1709         off += PyOS_snprintf(buf + off, sizeof(buf) - off, " %s", name_str);
1710         Py_XDECREF(name);
1711         if (--n && (size_t)(off+1) < sizeof(buf)) {
1712             buf[off++] = ',';
1713             buf[off] = '\0';
1714         }
1715     }
1716     PyErr_SetString(PyExc_TypeError, buf);
1717     Py_DECREF(set);
1718 }
1719 
1720 static int
pmerge(PyObject * acc,PyObject ** to_merge,Py_ssize_t to_merge_size)1721 pmerge(PyObject *acc, PyObject **to_merge, Py_ssize_t to_merge_size)
1722 {
1723     int res = 0;
1724     Py_ssize_t i, j, empty_cnt;
1725     int *remain;
1726 
1727     /* remain stores an index into each sublist of to_merge.
1728        remain[i] is the index of the next base in to_merge[i]
1729        that is not included in acc.
1730     */
1731     remain = PyMem_New(int, to_merge_size);
1732     if (remain == NULL) {
1733         PyErr_NoMemory();
1734         return -1;
1735     }
1736     for (i = 0; i < to_merge_size; i++)
1737         remain[i] = 0;
1738 
1739   again:
1740     empty_cnt = 0;
1741     for (i = 0; i < to_merge_size; i++) {
1742         PyObject *candidate;
1743 
1744         PyObject *cur_tuple = to_merge[i];
1745 
1746         if (remain[i] >= PyTuple_GET_SIZE(cur_tuple)) {
1747             empty_cnt++;
1748             continue;
1749         }
1750 
1751         /* Choose next candidate for MRO.
1752 
1753            The input sequences alone can determine the choice.
1754            If not, choose the class which appears in the MRO
1755            of the earliest direct superclass of the new class.
1756         */
1757 
1758         candidate = PyTuple_GET_ITEM(cur_tuple, remain[i]);
1759         for (j = 0; j < to_merge_size; j++) {
1760             PyObject *j_lst = to_merge[j];
1761             if (tail_contains(j_lst, remain[j], candidate))
1762                 goto skip; /* continue outer loop */
1763         }
1764         res = PyList_Append(acc, candidate);
1765         if (res < 0)
1766             goto out;
1767 
1768         for (j = 0; j < to_merge_size; j++) {
1769             PyObject *j_lst = to_merge[j];
1770             if (remain[j] < PyTuple_GET_SIZE(j_lst) &&
1771                 PyTuple_GET_ITEM(j_lst, remain[j]) == candidate) {
1772                 remain[j]++;
1773             }
1774         }
1775         goto again;
1776       skip: ;
1777     }
1778 
1779     if (empty_cnt != to_merge_size) {
1780         set_mro_error(to_merge, to_merge_size, remain);
1781         res = -1;
1782     }
1783 
1784   out:
1785     PyMem_Del(remain);
1786 
1787     return res;
1788 }
1789 
1790 static PyObject *
mro_implementation(PyTypeObject * type)1791 mro_implementation(PyTypeObject *type)
1792 {
1793     PyObject *result;
1794     PyObject *bases;
1795     PyObject **to_merge;
1796     Py_ssize_t i, n;
1797 
1798     if (type->tp_dict == NULL) {
1799         if (PyType_Ready(type) < 0)
1800             return NULL;
1801     }
1802 
1803     bases = type->tp_bases;
1804     assert(PyTuple_Check(bases));
1805     n = PyTuple_GET_SIZE(bases);
1806     for (i = 0; i < n; i++) {
1807         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1808         if (base->tp_mro == NULL) {
1809             PyErr_Format(PyExc_TypeError,
1810                          "Cannot extend an incomplete type '%.100s'",
1811                          base->tp_name);
1812             return NULL;
1813         }
1814         assert(PyTuple_Check(base->tp_mro));
1815     }
1816 
1817     if (n == 1) {
1818         /* Fast path: if there is a single base, constructing the MRO
1819          * is trivial.
1820          */
1821         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, 0);
1822         Py_ssize_t k = PyTuple_GET_SIZE(base->tp_mro);
1823         result = PyTuple_New(k + 1);
1824         if (result == NULL) {
1825             return NULL;
1826         }
1827         Py_INCREF(type);
1828         PyTuple_SET_ITEM(result, 0, (PyObject *) type);
1829         for (i = 0; i < k; i++) {
1830             PyObject *cls = PyTuple_GET_ITEM(base->tp_mro, i);
1831             Py_INCREF(cls);
1832             PyTuple_SET_ITEM(result, i + 1, cls);
1833         }
1834         return result;
1835     }
1836 
1837     /* This is just a basic sanity check. */
1838     if (check_duplicates(bases) < 0) {
1839         return NULL;
1840     }
1841 
1842     /* Find a superclass linearization that honors the constraints
1843        of the explicit tuples of bases and the constraints implied by
1844        each base class.
1845 
1846        to_merge is an array of tuples, where each tuple is a superclass
1847        linearization implied by a base class.  The last element of
1848        to_merge is the declared tuple of bases.
1849     */
1850 
1851     to_merge = PyMem_New(PyObject *, n + 1);
1852     if (to_merge == NULL) {
1853         PyErr_NoMemory();
1854         return NULL;
1855     }
1856 
1857     for (i = 0; i < n; i++) {
1858         PyTypeObject *base = (PyTypeObject *)PyTuple_GET_ITEM(bases, i);
1859         to_merge[i] = base->tp_mro;
1860     }
1861     to_merge[n] = bases;
1862 
1863     result = PyList_New(1);
1864     if (result == NULL) {
1865         PyMem_Del(to_merge);
1866         return NULL;
1867     }
1868 
1869     Py_INCREF(type);
1870     PyList_SET_ITEM(result, 0, (PyObject *)type);
1871     if (pmerge(result, to_merge, n + 1) < 0) {
1872         Py_CLEAR(result);
1873     }
1874 
1875     PyMem_Del(to_merge);
1876     return result;
1877 }
1878 
1879 /*[clinic input]
1880 type.mro
1881 
1882 Return a type's method resolution order.
1883 [clinic start generated code]*/
1884 
1885 static PyObject *
type_mro_impl(PyTypeObject * self)1886 type_mro_impl(PyTypeObject *self)
1887 /*[clinic end generated code: output=bffc4a39b5b57027 input=28414f4e156db28d]*/
1888 {
1889     PyObject *seq;
1890     seq = mro_implementation(self);
1891     if (seq != NULL && !PyList_Check(seq)) {
1892         Py_SETREF(seq, PySequence_List(seq));
1893     }
1894     return seq;
1895 }
1896 
1897 static int
mro_check(PyTypeObject * type,PyObject * mro)1898 mro_check(PyTypeObject *type, PyObject *mro)
1899 {
1900     PyTypeObject *solid;
1901     Py_ssize_t i, n;
1902 
1903     solid = solid_base(type);
1904 
1905     n = PyTuple_GET_SIZE(mro);
1906     for (i = 0; i < n; i++) {
1907         PyTypeObject *base;
1908         PyObject *tmp;
1909 
1910         tmp = PyTuple_GET_ITEM(mro, i);
1911         if (!PyType_Check(tmp)) {
1912             PyErr_Format(
1913                 PyExc_TypeError,
1914                 "mro() returned a non-class ('%.500s')",
1915                 Py_TYPE(tmp)->tp_name);
1916             return -1;
1917         }
1918 
1919         base = (PyTypeObject*)tmp;
1920         if (!PyType_IsSubtype(solid, solid_base(base))) {
1921             PyErr_Format(
1922                 PyExc_TypeError,
1923                 "mro() returned base with unsuitable layout ('%.500s')",
1924                 base->tp_name);
1925             return -1;
1926         }
1927     }
1928 
1929     return 0;
1930 }
1931 
1932 /* Lookups an mcls.mro method, invokes it and checks the result (if needed,
1933    in case of a custom mro() implementation).
1934 
1935    Keep in mind that during execution of this function type->tp_mro
1936    can be replaced due to possible reentrance (for example,
1937    through type_set_bases):
1938 
1939       - when looking up the mcls.mro attribute (it could be
1940         a user-provided descriptor);
1941 
1942       - from inside a custom mro() itself;
1943 
1944       - through a finalizer of the return value of mro().
1945 */
1946 static PyObject *
mro_invoke(PyTypeObject * type)1947 mro_invoke(PyTypeObject *type)
1948 {
1949     PyObject *mro_result;
1950     PyObject *new_mro;
1951     const int custom = !Py_IS_TYPE(type, &PyType_Type);
1952 
1953     if (custom) {
1954         int unbound;
1955         PyObject *mro_meth = lookup_method((PyObject *)type, &PyId_mro,
1956                                            &unbound);
1957         if (mro_meth == NULL)
1958             return NULL;
1959         mro_result = call_unbound_noarg(unbound, mro_meth, (PyObject *)type);
1960         Py_DECREF(mro_meth);
1961     }
1962     else {
1963         mro_result = mro_implementation(type);
1964     }
1965     if (mro_result == NULL)
1966         return NULL;
1967 
1968     new_mro = PySequence_Tuple(mro_result);
1969     Py_DECREF(mro_result);
1970     if (new_mro == NULL)
1971         return NULL;
1972 
1973     if (custom && mro_check(type, new_mro) < 0) {
1974         Py_DECREF(new_mro);
1975         return NULL;
1976     }
1977 
1978     return new_mro;
1979 }
1980 
1981 /* Calculates and assigns a new MRO to type->tp_mro.
1982    Return values and invariants:
1983 
1984      - Returns 1 if a new MRO value has been set to type->tp_mro due to
1985        this call of mro_internal (no tricky reentrancy and no errors).
1986 
1987        In case if p_old_mro argument is not NULL, a previous value
1988        of type->tp_mro is put there, and the ownership of this
1989        reference is transferred to a caller.
1990        Otherwise, the previous value (if any) is decref'ed.
1991 
1992      - Returns 0 in case when type->tp_mro gets changed because of
1993        reentering here through a custom mro() (see a comment to mro_invoke).
1994 
1995        In this case, a refcount of an old type->tp_mro is adjusted
1996        somewhere deeper in the call stack (by the innermost mro_internal
1997        or its caller) and may become zero upon returning from here.
1998        This also implies that the whole hierarchy of subclasses of the type
1999        has seen the new value and updated their MRO accordingly.
2000 
2001      - Returns -1 in case of an error.
2002 */
2003 static int
mro_internal(PyTypeObject * type,PyObject ** p_old_mro)2004 mro_internal(PyTypeObject *type, PyObject **p_old_mro)
2005 {
2006     PyObject *new_mro, *old_mro;
2007     int reent;
2008 
2009     /* Keep a reference to be able to do a reentrancy check below.
2010        Don't let old_mro be GC'ed and its address be reused for
2011        another object, like (suddenly!) a new tp_mro.  */
2012     old_mro = type->tp_mro;
2013     Py_XINCREF(old_mro);
2014     new_mro = mro_invoke(type);  /* might cause reentrance */
2015     reent = (type->tp_mro != old_mro);
2016     Py_XDECREF(old_mro);
2017     if (new_mro == NULL)
2018         return -1;
2019 
2020     if (reent) {
2021         Py_DECREF(new_mro);
2022         return 0;
2023     }
2024 
2025     type->tp_mro = new_mro;
2026 
2027     type_mro_modified(type, type->tp_mro);
2028     /* corner case: the super class might have been hidden
2029        from the custom MRO */
2030     type_mro_modified(type, type->tp_bases);
2031 
2032     PyType_Modified(type);
2033 
2034     if (p_old_mro != NULL)
2035         *p_old_mro = old_mro;  /* transfer the ownership */
2036     else
2037         Py_XDECREF(old_mro);
2038 
2039     return 1;
2040 }
2041 
2042 
2043 /* Calculate the best base amongst multiple base classes.
2044    This is the first one that's on the path to the "solid base". */
2045 
2046 static PyTypeObject *
best_base(PyObject * bases)2047 best_base(PyObject *bases)
2048 {
2049     Py_ssize_t i, n;
2050     PyTypeObject *base, *winner, *candidate, *base_i;
2051     PyObject *base_proto;
2052 
2053     assert(PyTuple_Check(bases));
2054     n = PyTuple_GET_SIZE(bases);
2055     assert(n > 0);
2056     base = NULL;
2057     winner = NULL;
2058     for (i = 0; i < n; i++) {
2059         base_proto = PyTuple_GET_ITEM(bases, i);
2060         if (!PyType_Check(base_proto)) {
2061             PyErr_SetString(
2062                 PyExc_TypeError,
2063                 "bases must be types");
2064             return NULL;
2065         }
2066         base_i = (PyTypeObject *)base_proto;
2067         if (base_i->tp_dict == NULL) {
2068             if (PyType_Ready(base_i) < 0)
2069                 return NULL;
2070         }
2071         if (!_PyType_HasFeature(base_i, Py_TPFLAGS_BASETYPE)) {
2072             PyErr_Format(PyExc_TypeError,
2073                          "type '%.100s' is not an acceptable base type",
2074                          base_i->tp_name);
2075             return NULL;
2076         }
2077         candidate = solid_base(base_i);
2078         if (winner == NULL) {
2079             winner = candidate;
2080             base = base_i;
2081         }
2082         else if (PyType_IsSubtype(winner, candidate))
2083             ;
2084         else if (PyType_IsSubtype(candidate, winner)) {
2085             winner = candidate;
2086             base = base_i;
2087         }
2088         else {
2089             PyErr_SetString(
2090                 PyExc_TypeError,
2091                 "multiple bases have "
2092                 "instance lay-out conflict");
2093             return NULL;
2094         }
2095     }
2096     assert (base != NULL);
2097 
2098     return base;
2099 }
2100 
2101 static int
extra_ivars(PyTypeObject * type,PyTypeObject * base)2102 extra_ivars(PyTypeObject *type, PyTypeObject *base)
2103 {
2104     size_t t_size = type->tp_basicsize;
2105     size_t b_size = base->tp_basicsize;
2106 
2107     assert(t_size >= b_size); /* Else type smaller than base! */
2108     if (type->tp_itemsize || base->tp_itemsize) {
2109         /* If itemsize is involved, stricter rules */
2110         return t_size != b_size ||
2111             type->tp_itemsize != base->tp_itemsize;
2112     }
2113     if (type->tp_weaklistoffset && base->tp_weaklistoffset == 0 &&
2114         type->tp_weaklistoffset + sizeof(PyObject *) == t_size &&
2115         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2116         t_size -= sizeof(PyObject *);
2117     if (type->tp_dictoffset && base->tp_dictoffset == 0 &&
2118         type->tp_dictoffset + sizeof(PyObject *) == t_size &&
2119         type->tp_flags & Py_TPFLAGS_HEAPTYPE)
2120         t_size -= sizeof(PyObject *);
2121 
2122     return t_size != b_size;
2123 }
2124 
2125 static PyTypeObject *
solid_base(PyTypeObject * type)2126 solid_base(PyTypeObject *type)
2127 {
2128     PyTypeObject *base;
2129 
2130     if (type->tp_base)
2131         base = solid_base(type->tp_base);
2132     else
2133         base = &PyBaseObject_Type;
2134     if (extra_ivars(type, base))
2135         return type;
2136     else
2137         return base;
2138 }
2139 
2140 static void object_dealloc(PyObject *);
2141 static int object_init(PyObject *, PyObject *, PyObject *);
2142 static int update_slot(PyTypeObject *, PyObject *);
2143 static void fixup_slot_dispatchers(PyTypeObject *);
2144 static int set_names(PyTypeObject *);
2145 static int init_subclass(PyTypeObject *, PyObject *);
2146 
2147 /*
2148  * Helpers for  __dict__ descriptor.  We don't want to expose the dicts
2149  * inherited from various builtin types.  The builtin base usually provides
2150  * its own __dict__ descriptor, so we use that when we can.
2151  */
2152 static PyTypeObject *
get_builtin_base_with_dict(PyTypeObject * type)2153 get_builtin_base_with_dict(PyTypeObject *type)
2154 {
2155     while (type->tp_base != NULL) {
2156         if (type->tp_dictoffset != 0 &&
2157             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
2158             return type;
2159         type = type->tp_base;
2160     }
2161     return NULL;
2162 }
2163 
2164 static PyObject *
get_dict_descriptor(PyTypeObject * type)2165 get_dict_descriptor(PyTypeObject *type)
2166 {
2167     PyObject *descr;
2168 
2169     descr = _PyType_LookupId(type, &PyId___dict__);
2170     if (descr == NULL || !PyDescr_IsData(descr))
2171         return NULL;
2172 
2173     return descr;
2174 }
2175 
2176 static void
raise_dict_descr_error(PyObject * obj)2177 raise_dict_descr_error(PyObject *obj)
2178 {
2179     PyErr_Format(PyExc_TypeError,
2180                  "this __dict__ descriptor does not support "
2181                  "'%.200s' objects", Py_TYPE(obj)->tp_name);
2182 }
2183 
2184 static PyObject *
subtype_dict(PyObject * obj,void * context)2185 subtype_dict(PyObject *obj, void *context)
2186 {
2187     PyTypeObject *base;
2188 
2189     base = get_builtin_base_with_dict(Py_TYPE(obj));
2190     if (base != NULL) {
2191         descrgetfunc func;
2192         PyObject *descr = get_dict_descriptor(base);
2193         if (descr == NULL) {
2194             raise_dict_descr_error(obj);
2195             return NULL;
2196         }
2197         func = Py_TYPE(descr)->tp_descr_get;
2198         if (func == NULL) {
2199             raise_dict_descr_error(obj);
2200             return NULL;
2201         }
2202         return func(descr, obj, (PyObject *)(Py_TYPE(obj)));
2203     }
2204     return PyObject_GenericGetDict(obj, context);
2205 }
2206 
2207 static int
subtype_setdict(PyObject * obj,PyObject * value,void * context)2208 subtype_setdict(PyObject *obj, PyObject *value, void *context)
2209 {
2210     PyObject **dictptr;
2211     PyTypeObject *base;
2212 
2213     base = get_builtin_base_with_dict(Py_TYPE(obj));
2214     if (base != NULL) {
2215         descrsetfunc func;
2216         PyObject *descr = get_dict_descriptor(base);
2217         if (descr == NULL) {
2218             raise_dict_descr_error(obj);
2219             return -1;
2220         }
2221         func = Py_TYPE(descr)->tp_descr_set;
2222         if (func == NULL) {
2223             raise_dict_descr_error(obj);
2224             return -1;
2225         }
2226         return func(descr, obj, value);
2227     }
2228     /* Almost like PyObject_GenericSetDict, but allow __dict__ to be deleted. */
2229     dictptr = _PyObject_GetDictPtr(obj);
2230     if (dictptr == NULL) {
2231         PyErr_SetString(PyExc_AttributeError,
2232                         "This object has no __dict__");
2233         return -1;
2234     }
2235     if (value != NULL && !PyDict_Check(value)) {
2236         PyErr_Format(PyExc_TypeError,
2237                      "__dict__ must be set to a dictionary, "
2238                      "not a '%.200s'", Py_TYPE(value)->tp_name);
2239         return -1;
2240     }
2241     Py_XINCREF(value);
2242     Py_XSETREF(*dictptr, value);
2243     return 0;
2244 }
2245 
2246 static PyObject *
subtype_getweakref(PyObject * obj,void * context)2247 subtype_getweakref(PyObject *obj, void *context)
2248 {
2249     PyObject **weaklistptr;
2250     PyObject *result;
2251     PyTypeObject *type = Py_TYPE(obj);
2252 
2253     if (type->tp_weaklistoffset == 0) {
2254         PyErr_SetString(PyExc_AttributeError,
2255                         "This object has no __weakref__");
2256         return NULL;
2257     }
2258     _PyObject_ASSERT((PyObject *)type,
2259                      type->tp_weaklistoffset > 0);
2260     _PyObject_ASSERT((PyObject *)type,
2261                      ((type->tp_weaklistoffset + sizeof(PyObject *))
2262                       <= (size_t)(type->tp_basicsize)));
2263     weaklistptr = (PyObject **)((char *)obj + type->tp_weaklistoffset);
2264     if (*weaklistptr == NULL)
2265         result = Py_None;
2266     else
2267         result = *weaklistptr;
2268     Py_INCREF(result);
2269     return result;
2270 }
2271 
2272 /* Three variants on the subtype_getsets list. */
2273 
2274 static PyGetSetDef subtype_getsets_full[] = {
2275     {"__dict__", subtype_dict, subtype_setdict,
2276      PyDoc_STR("dictionary for instance variables (if defined)")},
2277     {"__weakref__", subtype_getweakref, NULL,
2278      PyDoc_STR("list of weak references to the object (if defined)")},
2279     {0}
2280 };
2281 
2282 static PyGetSetDef subtype_getsets_dict_only[] = {
2283     {"__dict__", subtype_dict, subtype_setdict,
2284      PyDoc_STR("dictionary for instance variables (if defined)")},
2285     {0}
2286 };
2287 
2288 static PyGetSetDef subtype_getsets_weakref_only[] = {
2289     {"__weakref__", subtype_getweakref, NULL,
2290      PyDoc_STR("list of weak references to the object (if defined)")},
2291     {0}
2292 };
2293 
2294 static int
valid_identifier(PyObject * s)2295 valid_identifier(PyObject *s)
2296 {
2297     if (!PyUnicode_Check(s)) {
2298         PyErr_Format(PyExc_TypeError,
2299                      "__slots__ items must be strings, not '%.200s'",
2300                      Py_TYPE(s)->tp_name);
2301         return 0;
2302     }
2303     if (!PyUnicode_IsIdentifier(s)) {
2304         PyErr_SetString(PyExc_TypeError,
2305                         "__slots__ must be identifiers");
2306         return 0;
2307     }
2308     return 1;
2309 }
2310 
2311 /* Forward */
2312 static int
2313 object_init(PyObject *self, PyObject *args, PyObject *kwds);
2314 
2315 static int
type_init(PyObject * cls,PyObject * args,PyObject * kwds)2316 type_init(PyObject *cls, PyObject *args, PyObject *kwds)
2317 {
2318     int res;
2319 
2320     assert(args != NULL && PyTuple_Check(args));
2321     assert(kwds == NULL || PyDict_Check(kwds));
2322 
2323     if (kwds != NULL && PyTuple_Check(args) && PyTuple_GET_SIZE(args) == 1 &&
2324         PyDict_Check(kwds) && PyDict_GET_SIZE(kwds) != 0) {
2325         PyErr_SetString(PyExc_TypeError,
2326                         "type.__init__() takes no keyword arguments");
2327         return -1;
2328     }
2329 
2330     if (args != NULL && PyTuple_Check(args) &&
2331         (PyTuple_GET_SIZE(args) != 1 && PyTuple_GET_SIZE(args) != 3)) {
2332         PyErr_SetString(PyExc_TypeError,
2333                         "type.__init__() takes 1 or 3 arguments");
2334         return -1;
2335     }
2336 
2337     /* Call object.__init__(self) now. */
2338     /* XXX Could call super(type, cls).__init__() but what's the point? */
2339     args = PyTuple_GetSlice(args, 0, 0);
2340     if (args == NULL) {
2341         return -1;
2342     }
2343     res = object_init(cls, args, NULL);
2344     Py_DECREF(args);
2345     return res;
2346 }
2347 
2348 unsigned long
PyType_GetFlags(PyTypeObject * type)2349 PyType_GetFlags(PyTypeObject *type)
2350 {
2351     return type->tp_flags;
2352 }
2353 
2354 /* Determine the most derived metatype. */
2355 PyTypeObject *
_PyType_CalculateMetaclass(PyTypeObject * metatype,PyObject * bases)2356 _PyType_CalculateMetaclass(PyTypeObject *metatype, PyObject *bases)
2357 {
2358     Py_ssize_t i, nbases;
2359     PyTypeObject *winner;
2360     PyObject *tmp;
2361     PyTypeObject *tmptype;
2362 
2363     /* Determine the proper metatype to deal with this,
2364        and check for metatype conflicts while we're at it.
2365        Note that if some other metatype wins to contract,
2366        it's possible that its instances are not types. */
2367 
2368     nbases = PyTuple_GET_SIZE(bases);
2369     winner = metatype;
2370     for (i = 0; i < nbases; i++) {
2371         tmp = PyTuple_GET_ITEM(bases, i);
2372         tmptype = Py_TYPE(tmp);
2373         if (PyType_IsSubtype(winner, tmptype))
2374             continue;
2375         if (PyType_IsSubtype(tmptype, winner)) {
2376             winner = tmptype;
2377             continue;
2378         }
2379         /* else: */
2380         PyErr_SetString(PyExc_TypeError,
2381                         "metaclass conflict: "
2382                         "the metaclass of a derived class "
2383                         "must be a (non-strict) subclass "
2384                         "of the metaclasses of all its bases");
2385         return NULL;
2386     }
2387     return winner;
2388 }
2389 
2390 static PyObject *
type_new(PyTypeObject * metatype,PyObject * args,PyObject * kwds)2391 type_new(PyTypeObject *metatype, PyObject *args, PyObject *kwds)
2392 {
2393     PyObject *name, *bases = NULL, *orig_dict, *dict = NULL;
2394     PyObject *qualname, *slots = NULL, *tmp, *newslots, *cell;
2395     PyTypeObject *type = NULL, *base, *tmptype, *winner;
2396     PyHeapTypeObject *et;
2397     PyMemberDef *mp;
2398     Py_ssize_t i, nbases, nslots, slotoffset, name_size;
2399     int j, may_add_dict, may_add_weak, add_dict, add_weak;
2400     _Py_IDENTIFIER(__qualname__);
2401     _Py_IDENTIFIER(__slots__);
2402     _Py_IDENTIFIER(__classcell__);
2403 
2404     assert(args != NULL && PyTuple_Check(args));
2405     assert(kwds == NULL || PyDict_Check(kwds));
2406 
2407     /* Check arguments: (name, bases, dict) */
2408     if (!PyArg_ParseTuple(args, "UO!O!:type.__new__", &name, &PyTuple_Type,
2409                           &bases, &PyDict_Type, &orig_dict))
2410         return NULL;
2411 
2412     /* Adjust for empty tuple bases */
2413     nbases = PyTuple_GET_SIZE(bases);
2414     if (nbases == 0) {
2415         base = &PyBaseObject_Type;
2416         bases = PyTuple_Pack(1, base);
2417         if (bases == NULL)
2418             return NULL;
2419         nbases = 1;
2420     }
2421     else {
2422         _Py_IDENTIFIER(__mro_entries__);
2423         for (i = 0; i < nbases; i++) {
2424             tmp = PyTuple_GET_ITEM(bases, i);
2425             if (PyType_Check(tmp)) {
2426                 continue;
2427             }
2428             if (_PyObject_LookupAttrId(tmp, &PyId___mro_entries__, &tmp) < 0) {
2429                 return NULL;
2430             }
2431             if (tmp != NULL) {
2432                 PyErr_SetString(PyExc_TypeError,
2433                                 "type() doesn't support MRO entry resolution; "
2434                                 "use types.new_class()");
2435                 Py_DECREF(tmp);
2436                 return NULL;
2437             }
2438         }
2439         /* Search the bases for the proper metatype to deal with this: */
2440         winner = _PyType_CalculateMetaclass(metatype, bases);
2441         if (winner == NULL) {
2442             return NULL;
2443         }
2444 
2445         if (winner != metatype) {
2446             if (winner->tp_new != type_new) /* Pass it to the winner */
2447                 return winner->tp_new(winner, args, kwds);
2448             metatype = winner;
2449         }
2450 
2451         /* Calculate best base, and check that all bases are type objects */
2452         base = best_base(bases);
2453         if (base == NULL) {
2454             return NULL;
2455         }
2456 
2457         Py_INCREF(bases);
2458     }
2459 
2460     /* Use "goto error" from this point on as we now own the reference to "bases". */
2461 
2462     dict = PyDict_Copy(orig_dict);
2463     if (dict == NULL)
2464         goto error;
2465 
2466     /* Check for a __slots__ sequence variable in dict, and count it */
2467     slots = _PyDict_GetItemIdWithError(dict, &PyId___slots__);
2468     nslots = 0;
2469     add_dict = 0;
2470     add_weak = 0;
2471     may_add_dict = base->tp_dictoffset == 0;
2472     may_add_weak = base->tp_weaklistoffset == 0 && base->tp_itemsize == 0;
2473     if (slots == NULL) {
2474         if (PyErr_Occurred()) {
2475             goto error;
2476         }
2477         if (may_add_dict) {
2478             add_dict++;
2479         }
2480         if (may_add_weak) {
2481             add_weak++;
2482         }
2483     }
2484     else {
2485         /* Have slots */
2486 
2487         /* Make it into a tuple */
2488         if (PyUnicode_Check(slots))
2489             slots = PyTuple_Pack(1, slots);
2490         else
2491             slots = PySequence_Tuple(slots);
2492         if (slots == NULL)
2493             goto error;
2494         assert(PyTuple_Check(slots));
2495 
2496         /* Are slots allowed? */
2497         nslots = PyTuple_GET_SIZE(slots);
2498         if (nslots > 0 && base->tp_itemsize != 0) {
2499             PyErr_Format(PyExc_TypeError,
2500                          "nonempty __slots__ "
2501                          "not supported for subtype of '%s'",
2502                          base->tp_name);
2503             goto error;
2504         }
2505 
2506         /* Check for valid slot names and two special cases */
2507         for (i = 0; i < nslots; i++) {
2508             PyObject *tmp = PyTuple_GET_ITEM(slots, i);
2509             if (!valid_identifier(tmp))
2510                 goto error;
2511             assert(PyUnicode_Check(tmp));
2512             if (_PyUnicode_EqualToASCIIId(tmp, &PyId___dict__)) {
2513                 if (!may_add_dict || add_dict) {
2514                     PyErr_SetString(PyExc_TypeError,
2515                         "__dict__ slot disallowed: "
2516                         "we already got one");
2517                     goto error;
2518                 }
2519                 add_dict++;
2520             }
2521             if (_PyUnicode_EqualToASCIIString(tmp, "__weakref__")) {
2522                 if (!may_add_weak || add_weak) {
2523                     PyErr_SetString(PyExc_TypeError,
2524                         "__weakref__ slot disallowed: "
2525                         "either we already got one, "
2526                         "or __itemsize__ != 0");
2527                     goto error;
2528                 }
2529                 add_weak++;
2530             }
2531         }
2532 
2533         /* Copy slots into a list, mangle names and sort them.
2534            Sorted names are needed for __class__ assignment.
2535            Convert them back to tuple at the end.
2536         */
2537         newslots = PyList_New(nslots - add_dict - add_weak);
2538         if (newslots == NULL)
2539             goto error;
2540         for (i = j = 0; i < nslots; i++) {
2541             tmp = PyTuple_GET_ITEM(slots, i);
2542             if ((add_dict &&
2543                  _PyUnicode_EqualToASCIIId(tmp, &PyId___dict__)) ||
2544                 (add_weak &&
2545                  _PyUnicode_EqualToASCIIString(tmp, "__weakref__")))
2546                 continue;
2547             tmp =_Py_Mangle(name, tmp);
2548             if (!tmp) {
2549                 Py_DECREF(newslots);
2550                 goto error;
2551             }
2552             PyList_SET_ITEM(newslots, j, tmp);
2553             if (PyDict_GetItemWithError(dict, tmp)) {
2554                 /* CPython inserts __qualname__ and __classcell__ (when needed)
2555                    into the namespace when creating a class.  They will be deleted
2556                    below so won't act as class variables. */
2557                 if (!_PyUnicode_EqualToASCIIId(tmp, &PyId___qualname__) &&
2558                     !_PyUnicode_EqualToASCIIId(tmp, &PyId___classcell__)) {
2559                     PyErr_Format(PyExc_ValueError,
2560                                  "%R in __slots__ conflicts with class variable",
2561                                  tmp);
2562                     Py_DECREF(newslots);
2563                     goto error;
2564                 }
2565             }
2566             else if (PyErr_Occurred()) {
2567                 Py_DECREF(newslots);
2568                 goto error;
2569             }
2570             j++;
2571         }
2572         assert(j == nslots - add_dict - add_weak);
2573         nslots = j;
2574         Py_CLEAR(slots);
2575         if (PyList_Sort(newslots) == -1) {
2576             Py_DECREF(newslots);
2577             goto error;
2578         }
2579         slots = PyList_AsTuple(newslots);
2580         Py_DECREF(newslots);
2581         if (slots == NULL)
2582             goto error;
2583 
2584         /* Secondary bases may provide weakrefs or dict */
2585         if (nbases > 1 &&
2586             ((may_add_dict && !add_dict) ||
2587              (may_add_weak && !add_weak))) {
2588             for (i = 0; i < nbases; i++) {
2589                 tmp = PyTuple_GET_ITEM(bases, i);
2590                 if (tmp == (PyObject *)base)
2591                     continue; /* Skip primary base */
2592                 assert(PyType_Check(tmp));
2593                 tmptype = (PyTypeObject *)tmp;
2594                 if (may_add_dict && !add_dict &&
2595                     tmptype->tp_dictoffset != 0)
2596                     add_dict++;
2597                 if (may_add_weak && !add_weak &&
2598                     tmptype->tp_weaklistoffset != 0)
2599                     add_weak++;
2600                 if (may_add_dict && !add_dict)
2601                     continue;
2602                 if (may_add_weak && !add_weak)
2603                     continue;
2604                 /* Nothing more to check */
2605                 break;
2606             }
2607         }
2608     }
2609 
2610     /* Allocate the type object */
2611     type = (PyTypeObject *)metatype->tp_alloc(metatype, nslots);
2612     if (type == NULL)
2613         goto error;
2614 
2615     /* Keep name and slots alive in the extended type object */
2616     et = (PyHeapTypeObject *)type;
2617     Py_INCREF(name);
2618     et->ht_name = name;
2619     et->ht_slots = slots;
2620     slots = NULL;
2621 
2622     /* Initialize tp_flags */
2623     // All heap types need GC, since we can create a reference cycle by storing
2624     // an instance on one of its parents:
2625     type->tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HEAPTYPE |
2626         Py_TPFLAGS_BASETYPE | Py_TPFLAGS_HAVE_GC;
2627 
2628     /* Initialize essential fields */
2629     type->tp_as_async = &et->as_async;
2630     type->tp_as_number = &et->as_number;
2631     type->tp_as_sequence = &et->as_sequence;
2632     type->tp_as_mapping = &et->as_mapping;
2633     type->tp_as_buffer = &et->as_buffer;
2634     type->tp_name = PyUnicode_AsUTF8AndSize(name, &name_size);
2635     if (!type->tp_name)
2636         goto error;
2637     if (strlen(type->tp_name) != (size_t)name_size) {
2638         PyErr_SetString(PyExc_ValueError,
2639                         "type name must not contain null characters");
2640         goto error;
2641     }
2642 
2643     /* Set tp_base and tp_bases */
2644     type->tp_bases = bases;
2645     bases = NULL;
2646     Py_INCREF(base);
2647     type->tp_base = base;
2648 
2649     /* Initialize tp_dict from passed-in dict */
2650     Py_INCREF(dict);
2651     type->tp_dict = dict;
2652 
2653     /* Set __module__ in the dict */
2654     if (_PyDict_GetItemIdWithError(dict, &PyId___module__) == NULL) {
2655         if (PyErr_Occurred()) {
2656             goto error;
2657         }
2658         tmp = PyEval_GetGlobals();
2659         if (tmp != NULL) {
2660             tmp = _PyDict_GetItemIdWithError(tmp, &PyId___name__);
2661             if (tmp != NULL) {
2662                 if (_PyDict_SetItemId(dict, &PyId___module__,
2663                                       tmp) < 0)
2664                     goto error;
2665             }
2666             else if (PyErr_Occurred()) {
2667                 goto error;
2668             }
2669         }
2670     }
2671 
2672     /* Set ht_qualname to dict['__qualname__'] if available, else to
2673        __name__.  The __qualname__ accessor will look for ht_qualname.
2674     */
2675     qualname = _PyDict_GetItemIdWithError(dict, &PyId___qualname__);
2676     if (qualname != NULL) {
2677         if (!PyUnicode_Check(qualname)) {
2678             PyErr_Format(PyExc_TypeError,
2679                          "type __qualname__ must be a str, not %s",
2680                          Py_TYPE(qualname)->tp_name);
2681             goto error;
2682         }
2683     }
2684     else if (PyErr_Occurred()) {
2685         goto error;
2686     }
2687     et->ht_qualname = qualname ? qualname : et->ht_name;
2688     Py_INCREF(et->ht_qualname);
2689     if (qualname != NULL && _PyDict_DelItemId(dict, &PyId___qualname__) < 0)
2690         goto error;
2691 
2692     /* Set ht_module */
2693     et->ht_module = NULL;
2694 
2695     /* Set tp_doc to a copy of dict['__doc__'], if the latter is there
2696        and is a string.  The __doc__ accessor will first look for tp_doc;
2697        if that fails, it will still look into __dict__.
2698     */
2699     {
2700         PyObject *doc = _PyDict_GetItemIdWithError(dict, &PyId___doc__);
2701         if (doc != NULL && PyUnicode_Check(doc)) {
2702             Py_ssize_t len;
2703             const char *doc_str;
2704             char *tp_doc;
2705 
2706             doc_str = PyUnicode_AsUTF8(doc);
2707             if (doc_str == NULL)
2708                 goto error;
2709             /* Silently truncate the docstring if it contains null bytes. */
2710             len = strlen(doc_str);
2711             tp_doc = (char *)PyObject_MALLOC(len + 1);
2712             if (tp_doc == NULL) {
2713                 PyErr_NoMemory();
2714                 goto error;
2715             }
2716             memcpy(tp_doc, doc_str, len + 1);
2717             type->tp_doc = tp_doc;
2718         }
2719         else if (doc == NULL && PyErr_Occurred()) {
2720             goto error;
2721         }
2722     }
2723 
2724     /* Special-case __new__: if it's a plain function,
2725        make it a static function */
2726     tmp = _PyDict_GetItemIdWithError(dict, &PyId___new__);
2727     if (tmp != NULL && PyFunction_Check(tmp)) {
2728         tmp = PyStaticMethod_New(tmp);
2729         if (tmp == NULL)
2730             goto error;
2731         if (_PyDict_SetItemId(dict, &PyId___new__, tmp) < 0) {
2732             Py_DECREF(tmp);
2733             goto error;
2734         }
2735         Py_DECREF(tmp);
2736     }
2737     else if (tmp == NULL && PyErr_Occurred()) {
2738         goto error;
2739     }
2740 
2741     /* Special-case __init_subclass__ and __class_getitem__:
2742        if they are plain functions, make them classmethods */
2743     tmp = _PyDict_GetItemIdWithError(dict, &PyId___init_subclass__);
2744     if (tmp != NULL && PyFunction_Check(tmp)) {
2745         tmp = PyClassMethod_New(tmp);
2746         if (tmp == NULL)
2747             goto error;
2748         if (_PyDict_SetItemId(dict, &PyId___init_subclass__, tmp) < 0) {
2749             Py_DECREF(tmp);
2750             goto error;
2751         }
2752         Py_DECREF(tmp);
2753     }
2754     else if (tmp == NULL && PyErr_Occurred()) {
2755         goto error;
2756     }
2757 
2758     tmp = _PyDict_GetItemIdWithError(dict, &PyId___class_getitem__);
2759     if (tmp != NULL && PyFunction_Check(tmp)) {
2760         tmp = PyClassMethod_New(tmp);
2761         if (tmp == NULL)
2762             goto error;
2763         if (_PyDict_SetItemId(dict, &PyId___class_getitem__, tmp) < 0) {
2764             Py_DECREF(tmp);
2765             goto error;
2766         }
2767         Py_DECREF(tmp);
2768     }
2769     else if (tmp == NULL && PyErr_Occurred()) {
2770         goto error;
2771     }
2772 
2773     /* Add descriptors for custom slots from __slots__, or for __dict__ */
2774     mp = PyHeapType_GET_MEMBERS(et);
2775     slotoffset = base->tp_basicsize;
2776     if (et->ht_slots != NULL) {
2777         for (i = 0; i < nslots; i++, mp++) {
2778             mp->name = PyUnicode_AsUTF8(
2779                 PyTuple_GET_ITEM(et->ht_slots, i));
2780             if (mp->name == NULL)
2781                 goto error;
2782             mp->type = T_OBJECT_EX;
2783             mp->offset = slotoffset;
2784 
2785             /* __dict__ and __weakref__ are already filtered out */
2786             assert(strcmp(mp->name, "__dict__") != 0);
2787             assert(strcmp(mp->name, "__weakref__") != 0);
2788 
2789             slotoffset += sizeof(PyObject *);
2790         }
2791     }
2792     if (add_dict) {
2793         if (base->tp_itemsize)
2794             type->tp_dictoffset = -(long)sizeof(PyObject *);
2795         else
2796             type->tp_dictoffset = slotoffset;
2797         slotoffset += sizeof(PyObject *);
2798     }
2799     if (add_weak) {
2800         assert(!base->tp_itemsize);
2801         type->tp_weaklistoffset = slotoffset;
2802         slotoffset += sizeof(PyObject *);
2803     }
2804     type->tp_basicsize = slotoffset;
2805     type->tp_itemsize = base->tp_itemsize;
2806     type->tp_members = PyHeapType_GET_MEMBERS(et);
2807 
2808     if (type->tp_weaklistoffset && type->tp_dictoffset)
2809         type->tp_getset = subtype_getsets_full;
2810     else if (type->tp_weaklistoffset && !type->tp_dictoffset)
2811         type->tp_getset = subtype_getsets_weakref_only;
2812     else if (!type->tp_weaklistoffset && type->tp_dictoffset)
2813         type->tp_getset = subtype_getsets_dict_only;
2814     else
2815         type->tp_getset = NULL;
2816 
2817     /* Special case some slots */
2818     if (type->tp_dictoffset != 0 || nslots > 0) {
2819         if (base->tp_getattr == NULL && base->tp_getattro == NULL)
2820             type->tp_getattro = PyObject_GenericGetAttr;
2821         if (base->tp_setattr == NULL && base->tp_setattro == NULL)
2822             type->tp_setattro = PyObject_GenericSetAttr;
2823     }
2824     type->tp_dealloc = subtype_dealloc;
2825 
2826     /* Always override allocation strategy to use regular heap */
2827     type->tp_alloc = PyType_GenericAlloc;
2828     type->tp_free = PyObject_GC_Del;
2829     type->tp_traverse = subtype_traverse;
2830     type->tp_clear = subtype_clear;
2831 
2832     /* store type in class' cell if one is supplied */
2833     cell = _PyDict_GetItemIdWithError(dict, &PyId___classcell__);
2834     if (cell != NULL) {
2835         /* At least one method requires a reference to its defining class */
2836         if (!PyCell_Check(cell)) {
2837             PyErr_Format(PyExc_TypeError,
2838                          "__classcell__ must be a nonlocal cell, not %.200R",
2839                          Py_TYPE(cell));
2840             goto error;
2841         }
2842         PyCell_Set(cell, (PyObject *) type);
2843         if (_PyDict_DelItemId(dict, &PyId___classcell__) < 0) {
2844             goto error;
2845         }
2846     }
2847     else if (PyErr_Occurred()) {
2848         goto error;
2849     }
2850 
2851     /* Initialize the rest */
2852     if (PyType_Ready(type) < 0)
2853         goto error;
2854 
2855     /* Put the proper slots in place */
2856     fixup_slot_dispatchers(type);
2857 
2858     if (type->tp_dictoffset) {
2859         et->ht_cached_keys = _PyDict_NewKeysForClass();
2860     }
2861 
2862     if (set_names(type) < 0)
2863         goto error;
2864 
2865     if (init_subclass(type, kwds) < 0)
2866         goto error;
2867 
2868     Py_DECREF(dict);
2869     return (PyObject *)type;
2870 
2871 error:
2872     Py_XDECREF(dict);
2873     Py_XDECREF(bases);
2874     Py_XDECREF(slots);
2875     Py_XDECREF(type);
2876     return NULL;
2877 }
2878 
2879 static const short slotoffsets[] = {
2880     -1, /* invalid slot */
2881 #include "typeslots.inc"
2882 };
2883 
2884 PyObject *
PyType_FromSpecWithBases(PyType_Spec * spec,PyObject * bases)2885 PyType_FromSpecWithBases(PyType_Spec *spec, PyObject *bases)
2886 {
2887     return PyType_FromModuleAndSpec(NULL, spec, bases);
2888 }
2889 
2890 PyObject *
PyType_FromModuleAndSpec(PyObject * module,PyType_Spec * spec,PyObject * bases)2891 PyType_FromModuleAndSpec(PyObject *module, PyType_Spec *spec, PyObject *bases)
2892 {
2893     PyHeapTypeObject *res;
2894     PyObject *modname;
2895     PyTypeObject *type, *base;
2896 
2897     const PyType_Slot *slot;
2898     Py_ssize_t nmembers, weaklistoffset, dictoffset, vectorcalloffset;
2899     char *res_start;
2900 
2901     nmembers = weaklistoffset = dictoffset = vectorcalloffset = 0;
2902     for (slot = spec->slots; slot->slot; slot++) {
2903         if (slot->slot == Py_tp_members) {
2904             nmembers = 0;
2905             for (const PyMemberDef *memb = slot->pfunc; memb->name != NULL; memb++) {
2906                 nmembers++;
2907                 if (strcmp(memb->name, "__weaklistoffset__") == 0) {
2908                     // The PyMemberDef must be a Py_ssize_t and readonly
2909                     assert(memb->type == T_PYSSIZET);
2910                     assert(memb->flags == READONLY);
2911                     weaklistoffset = memb->offset;
2912                 }
2913                 if (strcmp(memb->name, "__dictoffset__") == 0) {
2914                     // The PyMemberDef must be a Py_ssize_t and readonly
2915                     assert(memb->type == T_PYSSIZET);
2916                     assert(memb->flags == READONLY);
2917                     dictoffset = memb->offset;
2918                 }
2919                 if (strcmp(memb->name, "__vectorcalloffset__") == 0) {
2920                     // The PyMemberDef must be a Py_ssize_t and readonly
2921                     assert(memb->type == T_PYSSIZET);
2922                     assert(memb->flags == READONLY);
2923                     vectorcalloffset = memb->offset;
2924                 }
2925             }
2926         }
2927     }
2928 
2929     res = (PyHeapTypeObject*)PyType_GenericAlloc(&PyType_Type, nmembers);
2930     if (res == NULL)
2931         return NULL;
2932     res_start = (char*)res;
2933 
2934     if (spec->name == NULL) {
2935         PyErr_SetString(PyExc_SystemError,
2936                         "Type spec does not define the name field.");
2937         goto fail;
2938     }
2939 
2940     /* Set the type name and qualname */
2941     const char *s = strrchr(spec->name, '.');
2942     if (s == NULL)
2943         s = spec->name;
2944     else
2945         s++;
2946 
2947     type = &res->ht_type;
2948     /* The flags must be initialized early, before the GC traverses us */
2949     type->tp_flags = spec->flags | Py_TPFLAGS_HEAPTYPE;
2950     res->ht_name = PyUnicode_FromString(s);
2951     if (!res->ht_name)
2952         goto fail;
2953     res->ht_qualname = res->ht_name;
2954     Py_INCREF(res->ht_qualname);
2955     type->tp_name = spec->name;
2956 
2957     Py_XINCREF(module);
2958     res->ht_module = module;
2959 
2960     /* Adjust for empty tuple bases */
2961     if (!bases) {
2962         base = &PyBaseObject_Type;
2963         /* See whether Py_tp_base(s) was specified */
2964         for (slot = spec->slots; slot->slot; slot++) {
2965             if (slot->slot == Py_tp_base)
2966                 base = slot->pfunc;
2967             else if (slot->slot == Py_tp_bases) {
2968                 bases = slot->pfunc;
2969             }
2970         }
2971         if (!bases) {
2972             bases = PyTuple_Pack(1, base);
2973             if (!bases)
2974                 goto fail;
2975         }
2976         else if (!PyTuple_Check(bases)) {
2977             PyErr_SetString(PyExc_SystemError, "Py_tp_bases is not a tuple");
2978             goto fail;
2979         }
2980         else {
2981             Py_INCREF(bases);
2982         }
2983     }
2984     else if (!PyTuple_Check(bases)) {
2985         PyErr_SetString(PyExc_SystemError, "bases is not a tuple");
2986         goto fail;
2987     }
2988     else {
2989         Py_INCREF(bases);
2990     }
2991 
2992     /* Calculate best base, and check that all bases are type objects */
2993     base = best_base(bases);
2994     if (base == NULL) {
2995         Py_DECREF(bases);
2996         goto fail;
2997     }
2998     if (!_PyType_HasFeature(base, Py_TPFLAGS_BASETYPE)) {
2999         PyErr_Format(PyExc_TypeError,
3000                      "type '%.100s' is not an acceptable base type",
3001                      base->tp_name);
3002         Py_DECREF(bases);
3003         goto fail;
3004     }
3005 
3006     /* Initialize essential fields */
3007     type->tp_as_async = &res->as_async;
3008     type->tp_as_number = &res->as_number;
3009     type->tp_as_sequence = &res->as_sequence;
3010     type->tp_as_mapping = &res->as_mapping;
3011     type->tp_as_buffer = &res->as_buffer;
3012     /* Set tp_base and tp_bases */
3013     type->tp_bases = bases;
3014     Py_INCREF(base);
3015     type->tp_base = base;
3016 
3017     type->tp_basicsize = spec->basicsize;
3018     type->tp_itemsize = spec->itemsize;
3019 
3020     for (slot = spec->slots; slot->slot; slot++) {
3021         if (slot->slot < 0
3022             || (size_t)slot->slot >= Py_ARRAY_LENGTH(slotoffsets)) {
3023             PyErr_SetString(PyExc_RuntimeError, "invalid slot offset");
3024             goto fail;
3025         }
3026         else if (slot->slot == Py_tp_base || slot->slot == Py_tp_bases) {
3027             /* Processed above */
3028             continue;
3029         }
3030         else if (slot->slot == Py_tp_doc) {
3031             /* For the docstring slot, which usually points to a static string
3032                literal, we need to make a copy */
3033             const char *old_doc = _PyType_DocWithoutSignature(type->tp_name, slot->pfunc);
3034             size_t len = strlen(old_doc)+1;
3035             char *tp_doc = PyObject_MALLOC(len);
3036             if (tp_doc == NULL) {
3037                 type->tp_doc = NULL;
3038                 PyErr_NoMemory();
3039                 goto fail;
3040             }
3041             memcpy(tp_doc, old_doc, len);
3042             type->tp_doc = tp_doc;
3043         }
3044         else if (slot->slot == Py_tp_members) {
3045             /* Move the slots to the heap type itself */
3046             size_t len = Py_TYPE(type)->tp_itemsize * nmembers;
3047             memcpy(PyHeapType_GET_MEMBERS(res), slot->pfunc, len);
3048             type->tp_members = PyHeapType_GET_MEMBERS(res);
3049         }
3050         else {
3051             /* Copy other slots directly */
3052             *(void**)(res_start + slotoffsets[slot->slot]) = slot->pfunc;
3053         }
3054     }
3055     if (type->tp_dealloc == NULL) {
3056         /* It's a heap type, so needs the heap types' dealloc.
3057            subtype_dealloc will call the base type's tp_dealloc, if
3058            necessary. */
3059         type->tp_dealloc = subtype_dealloc;
3060     }
3061 
3062     if (vectorcalloffset) {
3063         type->tp_vectorcall_offset = vectorcalloffset;
3064     }
3065 
3066     if (PyType_Ready(type) < 0)
3067         goto fail;
3068 
3069     if (type->tp_dictoffset) {
3070         res->ht_cached_keys = _PyDict_NewKeysForClass();
3071     }
3072 
3073     if (weaklistoffset) {
3074         type->tp_weaklistoffset = weaklistoffset;
3075         if (PyDict_DelItemString((PyObject *)type->tp_dict, "__weaklistoffset__") < 0)
3076             goto fail;
3077     }
3078     if (dictoffset) {
3079         type->tp_dictoffset = dictoffset;
3080         if (PyDict_DelItemString((PyObject *)type->tp_dict, "__dictoffset__") < 0)
3081             goto fail;
3082     }
3083 
3084     /* Set type.__module__ */
3085     if (_PyDict_GetItemIdWithError(type->tp_dict, &PyId___module__) == NULL) {
3086         if (PyErr_Occurred()) {
3087             goto fail;
3088         }
3089         s = strrchr(spec->name, '.');
3090         if (s != NULL) {
3091             int err;
3092             modname = PyUnicode_FromStringAndSize(
3093                     spec->name, (Py_ssize_t)(s - spec->name));
3094             if (modname == NULL) {
3095                 goto fail;
3096             }
3097             err = _PyDict_SetItemId(type->tp_dict, &PyId___module__, modname);
3098             Py_DECREF(modname);
3099             if (err != 0)
3100                 goto fail;
3101         } else {
3102             if (PyErr_WarnFormat(PyExc_DeprecationWarning, 1,
3103                     "builtin type %.200s has no __module__ attribute",
3104                     spec->name))
3105                 goto fail;
3106         }
3107     }
3108 
3109     return (PyObject*)res;
3110 
3111  fail:
3112     Py_DECREF(res);
3113     return NULL;
3114 }
3115 
3116 PyObject *
PyType_FromSpec(PyType_Spec * spec)3117 PyType_FromSpec(PyType_Spec *spec)
3118 {
3119     return PyType_FromSpecWithBases(spec, NULL);
3120 }
3121 
3122 /* private in 3.10 and 3.9.8+; public in 3.11 */
3123 PyObject *
_PyType_GetQualName(PyTypeObject * type)3124 _PyType_GetQualName(PyTypeObject *type)
3125 {
3126     return type_qualname(type, NULL);
3127 }
3128 
3129 
3130 void *
PyType_GetSlot(PyTypeObject * type,int slot)3131 PyType_GetSlot(PyTypeObject *type, int slot)
3132 {
3133     if (!_PyType_HasFeature(type, Py_TPFLAGS_HEAPTYPE) || slot < 0) {
3134         PyErr_BadInternalCall();
3135         return NULL;
3136     }
3137     if ((size_t)slot >= Py_ARRAY_LENGTH(slotoffsets)) {
3138         /* Extension module requesting slot from a future version */
3139         return NULL;
3140     }
3141     return  *(void**)(((char*)type) + slotoffsets[slot]);
3142 }
3143 
3144 PyObject *
PyType_GetModule(PyTypeObject * type)3145 PyType_GetModule(PyTypeObject *type)
3146 {
3147     assert(PyType_Check(type));
3148     if (!_PyType_HasFeature(type, Py_TPFLAGS_HEAPTYPE)) {
3149         PyErr_Format(
3150             PyExc_TypeError,
3151             "PyType_GetModule: Type '%s' is not a heap type",
3152             type->tp_name);
3153         return NULL;
3154     }
3155 
3156     PyHeapTypeObject* et = (PyHeapTypeObject*)type;
3157     if (!et->ht_module) {
3158         PyErr_Format(
3159             PyExc_TypeError,
3160             "PyType_GetModule: Type '%s' has no associated module",
3161             type->tp_name);
3162         return NULL;
3163     }
3164     return et->ht_module;
3165 
3166 }
3167 
3168 void *
PyType_GetModuleState(PyTypeObject * type)3169 PyType_GetModuleState(PyTypeObject *type)
3170 {
3171     PyObject *m = PyType_GetModule(type);
3172     if (m == NULL) {
3173         return NULL;
3174     }
3175     return PyModule_GetState(m);
3176 }
3177 
3178 /* Internal API to look for a name through the MRO, bypassing the method cache.
3179    This returns a borrowed reference, and might set an exception.
3180    'error' is set to: -1: error with exception; 1: error without exception; 0: ok */
3181 static PyObject *
find_name_in_mro(PyTypeObject * type,PyObject * name,int * error)3182 find_name_in_mro(PyTypeObject *type, PyObject *name, int *error)
3183 {
3184     Py_ssize_t i, n;
3185     PyObject *mro, *res, *base, *dict;
3186     Py_hash_t hash;
3187 
3188     if (!PyUnicode_CheckExact(name) ||
3189         (hash = ((PyASCIIObject *) name)->hash) == -1)
3190     {
3191         hash = PyObject_Hash(name);
3192         if (hash == -1) {
3193             *error = -1;
3194             return NULL;
3195         }
3196     }
3197 
3198     /* Look in tp_dict of types in MRO */
3199     mro = type->tp_mro;
3200 
3201     if (mro == NULL) {
3202         if ((type->tp_flags & Py_TPFLAGS_READYING) == 0) {
3203             if (PyType_Ready(type) < 0) {
3204                 *error = -1;
3205                 return NULL;
3206             }
3207             mro = type->tp_mro;
3208         }
3209         if (mro == NULL) {
3210             *error = 1;
3211             return NULL;
3212         }
3213     }
3214 
3215     res = NULL;
3216     /* Keep a strong reference to mro because type->tp_mro can be replaced
3217        during dict lookup, e.g. when comparing to non-string keys. */
3218     Py_INCREF(mro);
3219     assert(PyTuple_Check(mro));
3220     n = PyTuple_GET_SIZE(mro);
3221     for (i = 0; i < n; i++) {
3222         base = PyTuple_GET_ITEM(mro, i);
3223         assert(PyType_Check(base));
3224         dict = ((PyTypeObject *)base)->tp_dict;
3225         assert(dict && PyDict_Check(dict));
3226         res = _PyDict_GetItem_KnownHash(dict, name, hash);
3227         if (res != NULL)
3228             break;
3229         if (PyErr_Occurred()) {
3230             *error = -1;
3231             goto done;
3232         }
3233     }
3234     *error = 0;
3235 done:
3236     Py_DECREF(mro);
3237     return res;
3238 }
3239 
3240 /* Internal API to look for a name through the MRO.
3241    This returns a borrowed reference, and doesn't set an exception! */
3242 PyObject *
_PyType_Lookup(PyTypeObject * type,PyObject * name)3243 _PyType_Lookup(PyTypeObject *type, PyObject *name)
3244 {
3245     PyObject *res;
3246     int error;
3247 
3248 #ifdef MCACHE
3249     if (MCACHE_CACHEABLE_NAME(name) &&
3250         _PyType_HasFeature(type, Py_TPFLAGS_VALID_VERSION_TAG)) {
3251         /* fast path */
3252         unsigned int h = MCACHE_HASH_METHOD(type, name);
3253         if (method_cache[h].version == type->tp_version_tag &&
3254             method_cache[h].name == name) {
3255 #if MCACHE_STATS
3256             method_cache_hits++;
3257 #endif
3258             return method_cache[h].value;
3259         }
3260     }
3261 #endif
3262 
3263     /* We may end up clearing live exceptions below, so make sure it's ours. */
3264     assert(!PyErr_Occurred());
3265 
3266     res = find_name_in_mro(type, name, &error);
3267     /* Only put NULL results into cache if there was no error. */
3268     if (error) {
3269         /* It's not ideal to clear the error condition,
3270            but this function is documented as not setting
3271            an exception, and I don't want to change that.
3272            E.g., when PyType_Ready() can't proceed, it won't
3273            set the "ready" flag, so future attempts to ready
3274            the same type will call it again -- hopefully
3275            in a context that propagates the exception out.
3276         */
3277         if (error == -1) {
3278             PyErr_Clear();
3279         }
3280         return NULL;
3281     }
3282 
3283 #ifdef MCACHE
3284     if (MCACHE_CACHEABLE_NAME(name) && assign_version_tag(type)) {
3285         unsigned int h = MCACHE_HASH_METHOD(type, name);
3286         method_cache[h].version = type->tp_version_tag;
3287         method_cache[h].value = res;  /* borrowed */
3288         Py_INCREF(name);
3289         assert(((PyASCIIObject *)(name))->hash != -1);
3290 #if MCACHE_STATS
3291         if (method_cache[h].name != Py_None && method_cache[h].name != name)
3292             method_cache_collisions++;
3293         else
3294             method_cache_misses++;
3295 #endif
3296         Py_SETREF(method_cache[h].name, name);
3297     }
3298 #endif
3299     return res;
3300 }
3301 
3302 PyObject *
_PyType_LookupId(PyTypeObject * type,struct _Py_Identifier * name)3303 _PyType_LookupId(PyTypeObject *type, struct _Py_Identifier *name)
3304 {
3305     PyObject *oname;
3306     oname = _PyUnicode_FromId(name);   /* borrowed */
3307     if (oname == NULL)
3308         return NULL;
3309     return _PyType_Lookup(type, oname);
3310 }
3311 
3312 /* Check if the "readied" PyUnicode name
3313    is a double-underscore special name. */
3314 static int
is_dunder_name(PyObject * name)3315 is_dunder_name(PyObject *name)
3316 {
3317     Py_ssize_t length = PyUnicode_GET_LENGTH(name);
3318     int kind = PyUnicode_KIND(name);
3319     /* Special names contain at least "__x__" and are always ASCII. */
3320     if (length > 4 && kind == PyUnicode_1BYTE_KIND) {
3321         const Py_UCS1 *characters = PyUnicode_1BYTE_DATA(name);
3322         return (
3323             ((characters[length-2] == '_') && (characters[length-1] == '_')) &&
3324             ((characters[0] == '_') && (characters[1] == '_'))
3325         );
3326     }
3327     return 0;
3328 }
3329 
3330 /* This is similar to PyObject_GenericGetAttr(),
3331    but uses _PyType_Lookup() instead of just looking in type->tp_dict. */
3332 static PyObject *
type_getattro(PyTypeObject * type,PyObject * name)3333 type_getattro(PyTypeObject *type, PyObject *name)
3334 {
3335     PyTypeObject *metatype = Py_TYPE(type);
3336     PyObject *meta_attribute, *attribute;
3337     descrgetfunc meta_get;
3338     PyObject* res;
3339 
3340     if (!PyUnicode_Check(name)) {
3341         PyErr_Format(PyExc_TypeError,
3342                      "attribute name must be string, not '%.200s'",
3343                      Py_TYPE(name)->tp_name);
3344         return NULL;
3345     }
3346 
3347     /* Initialize this type (we'll assume the metatype is initialized) */
3348     if (type->tp_dict == NULL) {
3349         if (PyType_Ready(type) < 0)
3350             return NULL;
3351     }
3352 
3353     /* No readable descriptor found yet */
3354     meta_get = NULL;
3355 
3356     /* Look for the attribute in the metatype */
3357     meta_attribute = _PyType_Lookup(metatype, name);
3358 
3359     if (meta_attribute != NULL) {
3360         Py_INCREF(meta_attribute);
3361         meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
3362 
3363         if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
3364             /* Data descriptors implement tp_descr_set to intercept
3365              * writes. Assume the attribute is not overridden in
3366              * type's tp_dict (and bases): call the descriptor now.
3367              */
3368             res = meta_get(meta_attribute, (PyObject *)type,
3369                            (PyObject *)metatype);
3370             Py_DECREF(meta_attribute);
3371             return res;
3372         }
3373     }
3374 
3375     /* No data descriptor found on metatype. Look in tp_dict of this
3376      * type and its bases */
3377     attribute = _PyType_Lookup(type, name);
3378     if (attribute != NULL) {
3379         /* Implement descriptor functionality, if any */
3380         Py_INCREF(attribute);
3381         descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
3382 
3383         Py_XDECREF(meta_attribute);
3384 
3385         if (local_get != NULL) {
3386             /* NULL 2nd argument indicates the descriptor was
3387              * found on the target object itself (or a base)  */
3388             res = local_get(attribute, (PyObject *)NULL,
3389                             (PyObject *)type);
3390             Py_DECREF(attribute);
3391             return res;
3392         }
3393 
3394         return attribute;
3395     }
3396 
3397     /* No attribute found in local __dict__ (or bases): use the
3398      * descriptor from the metatype, if any */
3399     if (meta_get != NULL) {
3400         PyObject *res;
3401         res = meta_get(meta_attribute, (PyObject *)type,
3402                        (PyObject *)metatype);
3403         Py_DECREF(meta_attribute);
3404         return res;
3405     }
3406 
3407     /* If an ordinary attribute was found on the metatype, return it now */
3408     if (meta_attribute != NULL) {
3409         return meta_attribute;
3410     }
3411 
3412     /* Give up */
3413     PyErr_Format(PyExc_AttributeError,
3414                  "type object '%.50s' has no attribute '%U'",
3415                  type->tp_name, name);
3416     return NULL;
3417 }
3418 
3419 static int
type_setattro(PyTypeObject * type,PyObject * name,PyObject * value)3420 type_setattro(PyTypeObject *type, PyObject *name, PyObject *value)
3421 {
3422     int res;
3423     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
3424         PyErr_Format(
3425             PyExc_TypeError,
3426             "can't set attributes of built-in/extension type '%s'",
3427             type->tp_name);
3428         return -1;
3429     }
3430     if (PyUnicode_Check(name)) {
3431         if (PyUnicode_CheckExact(name)) {
3432             if (PyUnicode_READY(name) == -1)
3433                 return -1;
3434             Py_INCREF(name);
3435         }
3436         else {
3437             name = _PyUnicode_Copy(name);
3438             if (name == NULL)
3439                 return -1;
3440         }
3441 #ifdef INTERN_NAME_STRINGS
3442         if (!PyUnicode_CHECK_INTERNED(name)) {
3443             PyUnicode_InternInPlace(&name);
3444             if (!PyUnicode_CHECK_INTERNED(name)) {
3445                 PyErr_SetString(PyExc_MemoryError,
3446                                 "Out of memory interning an attribute name");
3447                 Py_DECREF(name);
3448                 return -1;
3449             }
3450         }
3451 #endif
3452     }
3453     else {
3454         /* Will fail in _PyObject_GenericSetAttrWithDict. */
3455         Py_INCREF(name);
3456     }
3457     res = _PyObject_GenericSetAttrWithDict((PyObject *)type, name, value, NULL);
3458     if (res == 0) {
3459         /* Clear the VALID_VERSION flag of 'type' and all its
3460            subclasses.  This could possibly be unified with the
3461            update_subclasses() recursion in update_slot(), but carefully:
3462            they each have their own conditions on which to stop
3463            recursing into subclasses. */
3464         PyType_Modified(type);
3465 
3466         if (is_dunder_name(name)) {
3467             res = update_slot(type, name);
3468         }
3469         assert(_PyType_CheckConsistency(type));
3470     }
3471     Py_DECREF(name);
3472     return res;
3473 }
3474 
3475 extern void
3476 _PyDictKeys_DecRef(PyDictKeysObject *keys);
3477 
3478 static void
type_dealloc(PyTypeObject * type)3479 type_dealloc(PyTypeObject *type)
3480 {
3481     PyHeapTypeObject *et;
3482     PyObject *tp, *val, *tb;
3483 
3484     /* Assert this is a heap-allocated type object */
3485     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
3486     _PyObject_GC_UNTRACK(type);
3487     PyErr_Fetch(&tp, &val, &tb);
3488     remove_all_subclasses(type, type->tp_bases);
3489     PyErr_Restore(tp, val, tb);
3490     PyObject_ClearWeakRefs((PyObject *)type);
3491     et = (PyHeapTypeObject *)type;
3492     Py_XDECREF(type->tp_base);
3493     Py_XDECREF(type->tp_dict);
3494     Py_XDECREF(type->tp_bases);
3495     Py_XDECREF(type->tp_mro);
3496     Py_XDECREF(type->tp_cache);
3497     Py_XDECREF(type->tp_subclasses);
3498     /* A type's tp_doc is heap allocated, unlike the tp_doc slots
3499      * of most other objects.  It's okay to cast it to char *.
3500      */
3501     PyObject_Free((char *)type->tp_doc);
3502     Py_XDECREF(et->ht_name);
3503     Py_XDECREF(et->ht_qualname);
3504     Py_XDECREF(et->ht_slots);
3505     if (et->ht_cached_keys) {
3506         _PyDictKeys_DecRef(et->ht_cached_keys);
3507     }
3508     Py_XDECREF(et->ht_module);
3509     Py_TYPE(type)->tp_free((PyObject *)type);
3510 }
3511 
3512 /*[clinic input]
3513 type.__subclasses__
3514 
3515 Return a list of immediate subclasses.
3516 [clinic start generated code]*/
3517 
3518 static PyObject *
type___subclasses___impl(PyTypeObject * self)3519 type___subclasses___impl(PyTypeObject *self)
3520 /*[clinic end generated code: output=eb5eb54485942819 input=5af66132436f9a7b]*/
3521 {
3522     PyObject *list, *raw, *ref;
3523     Py_ssize_t i;
3524 
3525     list = PyList_New(0);
3526     if (list == NULL)
3527         return NULL;
3528     raw = self->tp_subclasses;
3529     if (raw == NULL)
3530         return list;
3531     assert(PyDict_CheckExact(raw));
3532     i = 0;
3533     while (PyDict_Next(raw, &i, NULL, &ref)) {
3534         assert(PyWeakref_CheckRef(ref));
3535         ref = PyWeakref_GET_OBJECT(ref);
3536         if (ref != Py_None) {
3537             if (PyList_Append(list, ref) < 0) {
3538                 Py_DECREF(list);
3539                 return NULL;
3540             }
3541         }
3542     }
3543     return list;
3544 }
3545 
3546 static PyObject *
type_prepare(PyObject * self,PyObject * const * args,Py_ssize_t nargs,PyObject * kwnames)3547 type_prepare(PyObject *self, PyObject *const *args, Py_ssize_t nargs,
3548              PyObject *kwnames)
3549 {
3550     return PyDict_New();
3551 }
3552 
3553 /*
3554    Merge the __dict__ of aclass into dict, and recursively also all
3555    the __dict__s of aclass's base classes.  The order of merging isn't
3556    defined, as it's expected that only the final set of dict keys is
3557    interesting.
3558    Return 0 on success, -1 on error.
3559 */
3560 
3561 static int
merge_class_dict(PyObject * dict,PyObject * aclass)3562 merge_class_dict(PyObject *dict, PyObject *aclass)
3563 {
3564     PyObject *classdict;
3565     PyObject *bases;
3566     _Py_IDENTIFIER(__bases__);
3567 
3568     assert(PyDict_Check(dict));
3569     assert(aclass);
3570 
3571     /* Merge in the type's dict (if any). */
3572     if (_PyObject_LookupAttrId(aclass, &PyId___dict__, &classdict) < 0) {
3573         return -1;
3574     }
3575     if (classdict != NULL) {
3576         int status = PyDict_Update(dict, classdict);
3577         Py_DECREF(classdict);
3578         if (status < 0)
3579             return -1;
3580     }
3581 
3582     /* Recursively merge in the base types' (if any) dicts. */
3583     if (_PyObject_LookupAttrId(aclass, &PyId___bases__, &bases) < 0) {
3584         return -1;
3585     }
3586     if (bases != NULL) {
3587         /* We have no guarantee that bases is a real tuple */
3588         Py_ssize_t i, n;
3589         n = PySequence_Size(bases); /* This better be right */
3590         if (n < 0) {
3591             Py_DECREF(bases);
3592             return -1;
3593         }
3594         else {
3595             for (i = 0; i < n; i++) {
3596                 int status;
3597                 PyObject *base = PySequence_GetItem(bases, i);
3598                 if (base == NULL) {
3599                     Py_DECREF(bases);
3600                     return -1;
3601                 }
3602                 status = merge_class_dict(dict, base);
3603                 Py_DECREF(base);
3604                 if (status < 0) {
3605                     Py_DECREF(bases);
3606                     return -1;
3607                 }
3608             }
3609         }
3610         Py_DECREF(bases);
3611     }
3612     return 0;
3613 }
3614 
3615 /* __dir__ for type objects: returns __dict__ and __bases__.
3616    We deliberately don't suck up its __class__, as methods belonging to the
3617    metaclass would probably be more confusing than helpful.
3618 */
3619 /*[clinic input]
3620 type.__dir__
3621 
3622 Specialized __dir__ implementation for types.
3623 [clinic start generated code]*/
3624 
3625 static PyObject *
type___dir___impl(PyTypeObject * self)3626 type___dir___impl(PyTypeObject *self)
3627 /*[clinic end generated code: output=69d02fe92c0f15fa input=7733befbec645968]*/
3628 {
3629     PyObject *result = NULL;
3630     PyObject *dict = PyDict_New();
3631 
3632     if (dict != NULL && merge_class_dict(dict, (PyObject *)self) == 0)
3633         result = PyDict_Keys(dict);
3634 
3635     Py_XDECREF(dict);
3636     return result;
3637 }
3638 
3639 /*[clinic input]
3640 type.__sizeof__
3641 
3642 Return memory consumption of the type object.
3643 [clinic start generated code]*/
3644 
3645 static PyObject *
type___sizeof___impl(PyTypeObject * self)3646 type___sizeof___impl(PyTypeObject *self)
3647 /*[clinic end generated code: output=766f4f16cd3b1854 input=99398f24b9cf45d6]*/
3648 {
3649     Py_ssize_t size;
3650     if (self->tp_flags & Py_TPFLAGS_HEAPTYPE) {
3651         PyHeapTypeObject* et = (PyHeapTypeObject*)self;
3652         size = sizeof(PyHeapTypeObject);
3653         if (et->ht_cached_keys)
3654             size += _PyDict_KeysSize(et->ht_cached_keys);
3655     }
3656     else
3657         size = sizeof(PyTypeObject);
3658     return PyLong_FromSsize_t(size);
3659 }
3660 
3661 static PyMethodDef type_methods[] = {
3662     TYPE_MRO_METHODDEF
3663     TYPE___SUBCLASSES___METHODDEF
3664     {"__prepare__", (PyCFunction)(void(*)(void))type_prepare,
3665      METH_FASTCALL | METH_KEYWORDS | METH_CLASS,
3666      PyDoc_STR("__prepare__() -> dict\n"
3667                "used to create the namespace for the class statement")},
3668     TYPE___INSTANCECHECK___METHODDEF
3669     TYPE___SUBCLASSCHECK___METHODDEF
3670     TYPE___DIR___METHODDEF
3671     TYPE___SIZEOF___METHODDEF
3672     {0}
3673 };
3674 
3675 PyDoc_STRVAR(type_doc,
3676 "type(object) -> the object's type\n"
3677 "type(name, bases, dict, **kwds) -> a new type");
3678 
3679 static int
type_traverse(PyTypeObject * type,visitproc visit,void * arg)3680 type_traverse(PyTypeObject *type, visitproc visit, void *arg)
3681 {
3682     /* Because of type_is_gc(), the collector only calls this
3683        for heaptypes. */
3684     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
3685         char msg[200];
3686         sprintf(msg, "type_traverse() called on non-heap type '%.100s'",
3687                 type->tp_name);
3688         _PyObject_ASSERT_FAILED_MSG((PyObject *)type, msg);
3689     }
3690 
3691     Py_VISIT(type->tp_dict);
3692     Py_VISIT(type->tp_cache);
3693     Py_VISIT(type->tp_mro);
3694     Py_VISIT(type->tp_bases);
3695     Py_VISIT(type->tp_base);
3696     Py_VISIT(((PyHeapTypeObject *)type)->ht_module);
3697 
3698     /* There's no need to visit type->tp_subclasses or
3699        ((PyHeapTypeObject *)type)->ht_slots, because they can't be involved
3700        in cycles; tp_subclasses is a list of weak references,
3701        and slots is a tuple of strings. */
3702 
3703     return 0;
3704 }
3705 
3706 static int
type_clear(PyTypeObject * type)3707 type_clear(PyTypeObject *type)
3708 {
3709     PyDictKeysObject *cached_keys;
3710     /* Because of type_is_gc(), the collector only calls this
3711        for heaptypes. */
3712     _PyObject_ASSERT((PyObject *)type, type->tp_flags & Py_TPFLAGS_HEAPTYPE);
3713 
3714     /* We need to invalidate the method cache carefully before clearing
3715        the dict, so that other objects caught in a reference cycle
3716        don't start calling destroyed methods.
3717 
3718        Otherwise, the we need to clear tp_mro, which is
3719        part of a hard cycle (its first element is the class itself) that
3720        won't be broken otherwise (it's a tuple and tuples don't have a
3721        tp_clear handler).
3722        We also need to clear ht_module, if present: the module usually holds a
3723        reference to its class. None of the other fields need to be
3724 
3725        cleared, and here's why:
3726 
3727        tp_cache:
3728            Not used; if it were, it would be a dict.
3729 
3730        tp_bases, tp_base:
3731            If these are involved in a cycle, there must be at least
3732            one other, mutable object in the cycle, e.g. a base
3733            class's dict; the cycle will be broken that way.
3734 
3735        tp_subclasses:
3736            A dict of weak references can't be part of a cycle; and
3737            dicts have their own tp_clear.
3738 
3739        slots (in PyHeapTypeObject):
3740            A tuple of strings can't be part of a cycle.
3741     */
3742 
3743     PyType_Modified(type);
3744     cached_keys = ((PyHeapTypeObject *)type)->ht_cached_keys;
3745     if (cached_keys != NULL) {
3746         ((PyHeapTypeObject *)type)->ht_cached_keys = NULL;
3747         _PyDictKeys_DecRef(cached_keys);
3748     }
3749     if (type->tp_dict) {
3750         PyDict_Clear(type->tp_dict);
3751     }
3752     Py_CLEAR(((PyHeapTypeObject *)type)->ht_module);
3753 
3754     Py_CLEAR(type->tp_mro);
3755 
3756     return 0;
3757 }
3758 
3759 static int
type_is_gc(PyTypeObject * type)3760 type_is_gc(PyTypeObject *type)
3761 {
3762     return type->tp_flags & Py_TPFLAGS_HEAPTYPE;
3763 }
3764 
3765 PyTypeObject PyType_Type = {
3766     PyVarObject_HEAD_INIT(&PyType_Type, 0)
3767     "type",                                     /* tp_name */
3768     sizeof(PyHeapTypeObject),                   /* tp_basicsize */
3769     sizeof(PyMemberDef),                        /* tp_itemsize */
3770     (destructor)type_dealloc,                   /* tp_dealloc */
3771     offsetof(PyTypeObject, tp_vectorcall),      /* tp_vectorcall_offset */
3772     0,                                          /* tp_getattr */
3773     0,                                          /* tp_setattr */
3774     0,                                          /* tp_as_async */
3775     (reprfunc)type_repr,                        /* tp_repr */
3776     0,                                          /* tp_as_number */
3777     0,                                          /* tp_as_sequence */
3778     0,                                          /* tp_as_mapping */
3779     0,                                          /* tp_hash */
3780     (ternaryfunc)type_call,                     /* tp_call */
3781     0,                                          /* tp_str */
3782     (getattrofunc)type_getattro,                /* tp_getattro */
3783     (setattrofunc)type_setattro,                /* tp_setattro */
3784     0,                                          /* tp_as_buffer */
3785     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
3786     Py_TPFLAGS_BASETYPE | Py_TPFLAGS_TYPE_SUBCLASS |
3787     Py_TPFLAGS_HAVE_VECTORCALL,                 /* tp_flags */
3788     type_doc,                                   /* tp_doc */
3789     (traverseproc)type_traverse,                /* tp_traverse */
3790     (inquiry)type_clear,                        /* tp_clear */
3791     0,                                          /* tp_richcompare */
3792     offsetof(PyTypeObject, tp_weaklist),        /* tp_weaklistoffset */
3793     0,                                          /* tp_iter */
3794     0,                                          /* tp_iternext */
3795     type_methods,                               /* tp_methods */
3796     type_members,                               /* tp_members */
3797     type_getsets,                               /* tp_getset */
3798     0,                                          /* tp_base */
3799     0,                                          /* tp_dict */
3800     0,                                          /* tp_descr_get */
3801     0,                                          /* tp_descr_set */
3802     offsetof(PyTypeObject, tp_dict),            /* tp_dictoffset */
3803     type_init,                                  /* tp_init */
3804     0,                                          /* tp_alloc */
3805     type_new,                                   /* tp_new */
3806     PyObject_GC_Del,                            /* tp_free */
3807     (inquiry)type_is_gc,                        /* tp_is_gc */
3808 };
3809 
3810 
3811 /* The base type of all types (eventually)... except itself. */
3812 
3813 /* You may wonder why object.__new__() only complains about arguments
3814    when object.__init__() is not overridden, and vice versa.
3815 
3816    Consider the use cases:
3817 
3818    1. When neither is overridden, we want to hear complaints about
3819       excess (i.e., any) arguments, since their presence could
3820       indicate there's a bug.
3821 
3822    2. When defining an Immutable type, we are likely to override only
3823       __new__(), since __init__() is called too late to initialize an
3824       Immutable object.  Since __new__() defines the signature for the
3825       type, it would be a pain to have to override __init__() just to
3826       stop it from complaining about excess arguments.
3827 
3828    3. When defining a Mutable type, we are likely to override only
3829       __init__().  So here the converse reasoning applies: we don't
3830       want to have to override __new__() just to stop it from
3831       complaining.
3832 
3833    4. When __init__() is overridden, and the subclass __init__() calls
3834       object.__init__(), the latter should complain about excess
3835       arguments; ditto for __new__().
3836 
3837    Use cases 2 and 3 make it unattractive to unconditionally check for
3838    excess arguments.  The best solution that addresses all four use
3839    cases is as follows: __init__() complains about excess arguments
3840    unless __new__() is overridden and __init__() is not overridden
3841    (IOW, if __init__() is overridden or __new__() is not overridden);
3842    symmetrically, __new__() complains about excess arguments unless
3843    __init__() is overridden and __new__() is not overridden
3844    (IOW, if __new__() is overridden or __init__() is not overridden).
3845 
3846    However, for backwards compatibility, this breaks too much code.
3847    Therefore, in 2.6, we'll *warn* about excess arguments when both
3848    methods are overridden; for all other cases we'll use the above
3849    rules.
3850 
3851 */
3852 
3853 /* Forward */
3854 static PyObject *
3855 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds);
3856 
3857 static int
excess_args(PyObject * args,PyObject * kwds)3858 excess_args(PyObject *args, PyObject *kwds)
3859 {
3860     return PyTuple_GET_SIZE(args) ||
3861         (kwds && PyDict_Check(kwds) && PyDict_GET_SIZE(kwds));
3862 }
3863 
3864 static int
object_init(PyObject * self,PyObject * args,PyObject * kwds)3865 object_init(PyObject *self, PyObject *args, PyObject *kwds)
3866 {
3867     PyTypeObject *type = Py_TYPE(self);
3868     if (excess_args(args, kwds)) {
3869         if (type->tp_init != object_init) {
3870             PyErr_SetString(PyExc_TypeError,
3871                             "object.__init__() takes exactly one argument (the instance to initialize)");
3872             return -1;
3873         }
3874         if (type->tp_new == object_new) {
3875             PyErr_Format(PyExc_TypeError,
3876                          "%.200s.__init__() takes exactly one argument (the instance to initialize)",
3877                          type->tp_name);
3878             return -1;
3879         }
3880     }
3881     return 0;
3882 }
3883 
3884 static PyObject *
object_new(PyTypeObject * type,PyObject * args,PyObject * kwds)3885 object_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
3886 {
3887     if (excess_args(args, kwds)) {
3888         if (type->tp_new != object_new) {
3889             PyErr_SetString(PyExc_TypeError,
3890                             "object.__new__() takes exactly one argument (the type to instantiate)");
3891             return NULL;
3892         }
3893         if (type->tp_init == object_init) {
3894             PyErr_Format(PyExc_TypeError, "%.200s() takes no arguments",
3895                          type->tp_name);
3896             return NULL;
3897         }
3898     }
3899 
3900     if (type->tp_flags & Py_TPFLAGS_IS_ABSTRACT) {
3901         PyObject *abstract_methods;
3902         PyObject *sorted_methods;
3903         PyObject *joined;
3904         PyObject *comma;
3905         _Py_static_string(comma_id, ", ");
3906         Py_ssize_t method_count;
3907 
3908         /* Compute ", ".join(sorted(type.__abstractmethods__))
3909            into joined. */
3910         abstract_methods = type_abstractmethods(type, NULL);
3911         if (abstract_methods == NULL)
3912             return NULL;
3913         sorted_methods = PySequence_List(abstract_methods);
3914         Py_DECREF(abstract_methods);
3915         if (sorted_methods == NULL)
3916             return NULL;
3917         if (PyList_Sort(sorted_methods)) {
3918             Py_DECREF(sorted_methods);
3919             return NULL;
3920         }
3921         comma = _PyUnicode_FromId(&comma_id);
3922         if (comma == NULL) {
3923             Py_DECREF(sorted_methods);
3924             return NULL;
3925         }
3926         joined = PyUnicode_Join(comma, sorted_methods);
3927         method_count = PyObject_Length(sorted_methods);
3928         Py_DECREF(sorted_methods);
3929         if (joined == NULL)
3930             return NULL;
3931         if (method_count == -1)
3932             return NULL;
3933 
3934         PyErr_Format(PyExc_TypeError,
3935                      "Can't instantiate abstract class %s "
3936                      "with abstract method%s %U",
3937                      type->tp_name,
3938                      method_count > 1 ? "s" : "",
3939                      joined);
3940         Py_DECREF(joined);
3941         return NULL;
3942     }
3943     return type->tp_alloc(type, 0);
3944 }
3945 
3946 static void
object_dealloc(PyObject * self)3947 object_dealloc(PyObject *self)
3948 {
3949     Py_TYPE(self)->tp_free(self);
3950 }
3951 
3952 static PyObject *
object_repr(PyObject * self)3953 object_repr(PyObject *self)
3954 {
3955     PyTypeObject *type;
3956     PyObject *mod, *name, *rtn;
3957 
3958     type = Py_TYPE(self);
3959     mod = type_module(type, NULL);
3960     if (mod == NULL)
3961         PyErr_Clear();
3962     else if (!PyUnicode_Check(mod)) {
3963         Py_DECREF(mod);
3964         mod = NULL;
3965     }
3966     name = type_qualname(type, NULL);
3967     if (name == NULL) {
3968         Py_XDECREF(mod);
3969         return NULL;
3970     }
3971     if (mod != NULL && !_PyUnicode_EqualToASCIIId(mod, &PyId_builtins))
3972         rtn = PyUnicode_FromFormat("<%U.%U object at %p>", mod, name, self);
3973     else
3974         rtn = PyUnicode_FromFormat("<%s object at %p>",
3975                                   type->tp_name, self);
3976     Py_XDECREF(mod);
3977     Py_DECREF(name);
3978     return rtn;
3979 }
3980 
3981 static PyObject *
object_str(PyObject * self)3982 object_str(PyObject *self)
3983 {
3984     unaryfunc f;
3985 
3986     f = Py_TYPE(self)->tp_repr;
3987     if (f == NULL)
3988         f = object_repr;
3989     return f(self);
3990 }
3991 
3992 static PyObject *
object_richcompare(PyObject * self,PyObject * other,int op)3993 object_richcompare(PyObject *self, PyObject *other, int op)
3994 {
3995     PyObject *res;
3996 
3997     switch (op) {
3998 
3999     case Py_EQ:
4000         /* Return NotImplemented instead of False, so if two
4001            objects are compared, both get a chance at the
4002            comparison.  See issue #1393. */
4003         res = (self == other) ? Py_True : Py_NotImplemented;
4004         Py_INCREF(res);
4005         break;
4006 
4007     case Py_NE:
4008         /* By default, __ne__() delegates to __eq__() and inverts the result,
4009            unless the latter returns NotImplemented. */
4010         if (Py_TYPE(self)->tp_richcompare == NULL) {
4011             res = Py_NotImplemented;
4012             Py_INCREF(res);
4013             break;
4014         }
4015         res = (*Py_TYPE(self)->tp_richcompare)(self, other, Py_EQ);
4016         if (res != NULL && res != Py_NotImplemented) {
4017             int ok = PyObject_IsTrue(res);
4018             Py_DECREF(res);
4019             if (ok < 0)
4020                 res = NULL;
4021             else {
4022                 if (ok)
4023                     res = Py_False;
4024                 else
4025                     res = Py_True;
4026                 Py_INCREF(res);
4027             }
4028         }
4029         break;
4030 
4031     default:
4032         res = Py_NotImplemented;
4033         Py_INCREF(res);
4034         break;
4035     }
4036 
4037     return res;
4038 }
4039 
4040 static PyObject *
object_get_class(PyObject * self,void * closure)4041 object_get_class(PyObject *self, void *closure)
4042 {
4043     Py_INCREF(Py_TYPE(self));
4044     return (PyObject *)(Py_TYPE(self));
4045 }
4046 
4047 static int
compatible_with_tp_base(PyTypeObject * child)4048 compatible_with_tp_base(PyTypeObject *child)
4049 {
4050     PyTypeObject *parent = child->tp_base;
4051     return (parent != NULL &&
4052             child->tp_basicsize == parent->tp_basicsize &&
4053             child->tp_itemsize == parent->tp_itemsize &&
4054             child->tp_dictoffset == parent->tp_dictoffset &&
4055             child->tp_weaklistoffset == parent->tp_weaklistoffset &&
4056             ((child->tp_flags & Py_TPFLAGS_HAVE_GC) ==
4057              (parent->tp_flags & Py_TPFLAGS_HAVE_GC)) &&
4058             (child->tp_dealloc == subtype_dealloc ||
4059              child->tp_dealloc == parent->tp_dealloc));
4060 }
4061 
4062 static int
same_slots_added(PyTypeObject * a,PyTypeObject * b)4063 same_slots_added(PyTypeObject *a, PyTypeObject *b)
4064 {
4065     PyTypeObject *base = a->tp_base;
4066     Py_ssize_t size;
4067     PyObject *slots_a, *slots_b;
4068 
4069     assert(base == b->tp_base);
4070     size = base->tp_basicsize;
4071     if (a->tp_dictoffset == size && b->tp_dictoffset == size)
4072         size += sizeof(PyObject *);
4073     if (a->tp_weaklistoffset == size && b->tp_weaklistoffset == size)
4074         size += sizeof(PyObject *);
4075 
4076     /* Check slots compliance */
4077     if (!(a->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
4078         !(b->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
4079         return 0;
4080     }
4081     slots_a = ((PyHeapTypeObject *)a)->ht_slots;
4082     slots_b = ((PyHeapTypeObject *)b)->ht_slots;
4083     if (slots_a && slots_b) {
4084         if (PyObject_RichCompareBool(slots_a, slots_b, Py_EQ) != 1)
4085             return 0;
4086         size += sizeof(PyObject *) * PyTuple_GET_SIZE(slots_a);
4087     }
4088     return size == a->tp_basicsize && size == b->tp_basicsize;
4089 }
4090 
4091 static int
compatible_for_assignment(PyTypeObject * oldto,PyTypeObject * newto,const char * attr)4092 compatible_for_assignment(PyTypeObject* oldto, PyTypeObject* newto, const char* attr)
4093 {
4094     PyTypeObject *newbase, *oldbase;
4095 
4096     if (newto->tp_free != oldto->tp_free) {
4097         PyErr_Format(PyExc_TypeError,
4098                      "%s assignment: "
4099                      "'%s' deallocator differs from '%s'",
4100                      attr,
4101                      newto->tp_name,
4102                      oldto->tp_name);
4103         return 0;
4104     }
4105     /*
4106      It's tricky to tell if two arbitrary types are sufficiently compatible as
4107      to be interchangeable; e.g., even if they have the same tp_basicsize, they
4108      might have totally different struct fields. It's much easier to tell if a
4109      type and its supertype are compatible; e.g., if they have the same
4110      tp_basicsize, then that means they have identical fields. So to check
4111      whether two arbitrary types are compatible, we first find the highest
4112      supertype that each is compatible with, and then if those supertypes are
4113      compatible then the original types must also be compatible.
4114     */
4115     newbase = newto;
4116     oldbase = oldto;
4117     while (compatible_with_tp_base(newbase))
4118         newbase = newbase->tp_base;
4119     while (compatible_with_tp_base(oldbase))
4120         oldbase = oldbase->tp_base;
4121     if (newbase != oldbase &&
4122         (newbase->tp_base != oldbase->tp_base ||
4123          !same_slots_added(newbase, oldbase))) {
4124         PyErr_Format(PyExc_TypeError,
4125                      "%s assignment: "
4126                      "'%s' object layout differs from '%s'",
4127                      attr,
4128                      newto->tp_name,
4129                      oldto->tp_name);
4130         return 0;
4131     }
4132 
4133     return 1;
4134 }
4135 
4136 static int
object_set_class(PyObject * self,PyObject * value,void * closure)4137 object_set_class(PyObject *self, PyObject *value, void *closure)
4138 {
4139     PyTypeObject *oldto = Py_TYPE(self);
4140     PyTypeObject *newto;
4141 
4142     if (value == NULL) {
4143         PyErr_SetString(PyExc_TypeError,
4144                         "can't delete __class__ attribute");
4145         return -1;
4146     }
4147     if (!PyType_Check(value)) {
4148         PyErr_Format(PyExc_TypeError,
4149           "__class__ must be set to a class, not '%s' object",
4150           Py_TYPE(value)->tp_name);
4151         return -1;
4152     }
4153     if (PySys_Audit("object.__setattr__", "OsO",
4154                     self, "__class__", value) < 0) {
4155         return -1;
4156     }
4157 
4158     newto = (PyTypeObject *)value;
4159     /* In versions of CPython prior to 3.5, the code in
4160        compatible_for_assignment was not set up to correctly check for memory
4161        layout / slot / etc. compatibility for non-HEAPTYPE classes, so we just
4162        disallowed __class__ assignment in any case that wasn't HEAPTYPE ->
4163        HEAPTYPE.
4164 
4165        During the 3.5 development cycle, we fixed the code in
4166        compatible_for_assignment to correctly check compatibility between
4167        arbitrary types, and started allowing __class__ assignment in all cases
4168        where the old and new types did in fact have compatible slots and
4169        memory layout (regardless of whether they were implemented as HEAPTYPEs
4170        or not).
4171 
4172        Just before 3.5 was released, though, we discovered that this led to
4173        problems with immutable types like int, where the interpreter assumes
4174        they are immutable and interns some values. Formerly this wasn't a
4175        problem, because they really were immutable -- in particular, all the
4176        types where the interpreter applied this interning trick happened to
4177        also be statically allocated, so the old HEAPTYPE rules were
4178        "accidentally" stopping them from allowing __class__ assignment. But
4179        with the changes to __class__ assignment, we started allowing code like
4180 
4181          class MyInt(int):
4182              ...
4183          # Modifies the type of *all* instances of 1 in the whole program,
4184          # including future instances (!), because the 1 object is interned.
4185          (1).__class__ = MyInt
4186 
4187        (see https://bugs.python.org/issue24912).
4188 
4189        In theory the proper fix would be to identify which classes rely on
4190        this invariant and somehow disallow __class__ assignment only for them,
4191        perhaps via some mechanism like a new Py_TPFLAGS_IMMUTABLE flag (a
4192        "blacklisting" approach). But in practice, since this problem wasn't
4193        noticed late in the 3.5 RC cycle, we're taking the conservative
4194        approach and reinstating the same HEAPTYPE->HEAPTYPE check that we used
4195        to have, plus a "whitelist". For now, the whitelist consists only of
4196        ModuleType subtypes, since those are the cases that motivated the patch
4197        in the first place -- see https://bugs.python.org/issue22986 -- and
4198        since module objects are mutable we can be sure that they are
4199        definitely not being interned. So now we allow HEAPTYPE->HEAPTYPE *or*
4200        ModuleType subtype -> ModuleType subtype.
4201 
4202        So far as we know, all the code beyond the following 'if' statement
4203        will correctly handle non-HEAPTYPE classes, and the HEAPTYPE check is
4204        needed only to protect that subset of non-HEAPTYPE classes for which
4205        the interpreter has baked in the assumption that all instances are
4206        truly immutable.
4207     */
4208     if (!(PyType_IsSubtype(newto, &PyModule_Type) &&
4209           PyType_IsSubtype(oldto, &PyModule_Type)) &&
4210         (!(newto->tp_flags & Py_TPFLAGS_HEAPTYPE) ||
4211          !(oldto->tp_flags & Py_TPFLAGS_HEAPTYPE))) {
4212         PyErr_Format(PyExc_TypeError,
4213                      "__class__ assignment only supported for heap types "
4214                      "or ModuleType subclasses");
4215         return -1;
4216     }
4217 
4218     if (compatible_for_assignment(oldto, newto, "__class__")) {
4219         if (newto->tp_flags & Py_TPFLAGS_HEAPTYPE) {
4220             Py_INCREF(newto);
4221         }
4222         Py_SET_TYPE(self, newto);
4223         if (oldto->tp_flags & Py_TPFLAGS_HEAPTYPE)
4224             Py_DECREF(oldto);
4225         return 0;
4226     }
4227     else {
4228         return -1;
4229     }
4230 }
4231 
4232 static PyGetSetDef object_getsets[] = {
4233     {"__class__", object_get_class, object_set_class,
4234      PyDoc_STR("the object's class")},
4235     {0}
4236 };
4237 
4238 
4239 /* Stuff to implement __reduce_ex__ for pickle protocols >= 2.
4240    We fall back to helpers in copyreg for:
4241    - pickle protocols < 2
4242    - calculating the list of slot names (done only once per class)
4243    - the __newobj__ function (which is used as a token but never called)
4244 */
4245 
4246 static PyObject *
import_copyreg(void)4247 import_copyreg(void)
4248 {
4249     PyObject *copyreg_str;
4250     PyObject *copyreg_module;
4251     _Py_IDENTIFIER(copyreg);
4252 
4253     copyreg_str = _PyUnicode_FromId(&PyId_copyreg);
4254     if (copyreg_str == NULL) {
4255         return NULL;
4256     }
4257     /* Try to fetch cached copy of copyreg from sys.modules first in an
4258        attempt to avoid the import overhead. Previously this was implemented
4259        by storing a reference to the cached module in a static variable, but
4260        this broke when multiple embedded interpreters were in use (see issue
4261        #17408 and #19088). */
4262     copyreg_module = PyImport_GetModule(copyreg_str);
4263     if (copyreg_module != NULL) {
4264         return copyreg_module;
4265     }
4266     if (PyErr_Occurred()) {
4267         return NULL;
4268     }
4269     return PyImport_Import(copyreg_str);
4270 }
4271 
4272 static PyObject *
_PyType_GetSlotNames(PyTypeObject * cls)4273 _PyType_GetSlotNames(PyTypeObject *cls)
4274 {
4275     PyObject *copyreg;
4276     PyObject *slotnames;
4277     _Py_IDENTIFIER(__slotnames__);
4278     _Py_IDENTIFIER(_slotnames);
4279 
4280     assert(PyType_Check(cls));
4281 
4282     /* Get the slot names from the cache in the class if possible. */
4283     slotnames = _PyDict_GetItemIdWithError(cls->tp_dict, &PyId___slotnames__);
4284     if (slotnames != NULL) {
4285         if (slotnames != Py_None && !PyList_Check(slotnames)) {
4286             PyErr_Format(PyExc_TypeError,
4287                          "%.200s.__slotnames__ should be a list or None, "
4288                          "not %.200s",
4289                          cls->tp_name, Py_TYPE(slotnames)->tp_name);
4290             return NULL;
4291         }
4292         Py_INCREF(slotnames);
4293         return slotnames;
4294     }
4295     else {
4296         if (PyErr_Occurred()) {
4297             return NULL;
4298         }
4299         /* The class does not have the slot names cached yet. */
4300     }
4301 
4302     copyreg = import_copyreg();
4303     if (copyreg == NULL)
4304         return NULL;
4305 
4306     /* Use _slotnames function from the copyreg module to find the slots
4307        by this class and its bases. This function will cache the result
4308        in __slotnames__. */
4309     slotnames = _PyObject_CallMethodIdOneArg(copyreg, &PyId__slotnames,
4310                                              (PyObject *)cls);
4311     Py_DECREF(copyreg);
4312     if (slotnames == NULL)
4313         return NULL;
4314 
4315     if (slotnames != Py_None && !PyList_Check(slotnames)) {
4316         PyErr_SetString(PyExc_TypeError,
4317                         "copyreg._slotnames didn't return a list or None");
4318         Py_DECREF(slotnames);
4319         return NULL;
4320     }
4321 
4322     return slotnames;
4323 }
4324 
4325 static PyObject *
_PyObject_GetState(PyObject * obj,int required)4326 _PyObject_GetState(PyObject *obj, int required)
4327 {
4328     PyObject *state;
4329     PyObject *getstate;
4330     _Py_IDENTIFIER(__getstate__);
4331 
4332     if (_PyObject_LookupAttrId(obj, &PyId___getstate__, &getstate) < 0) {
4333         return NULL;
4334     }
4335     if (getstate == NULL) {
4336         PyObject *slotnames;
4337 
4338         if (required && Py_TYPE(obj)->tp_itemsize) {
4339             PyErr_Format(PyExc_TypeError,
4340                          "cannot pickle '%.200s' object",
4341                          Py_TYPE(obj)->tp_name);
4342             return NULL;
4343         }
4344 
4345         {
4346             PyObject **dict;
4347             dict = _PyObject_GetDictPtr(obj);
4348             /* It is possible that the object's dict is not initialized
4349                yet. In this case, we will return None for the state.
4350                We also return None if the dict is empty to make the behavior
4351                consistent regardless whether the dict was initialized or not.
4352                This make unit testing easier. */
4353             if (dict != NULL && *dict != NULL && PyDict_GET_SIZE(*dict)) {
4354                 state = *dict;
4355             }
4356             else {
4357                 state = Py_None;
4358             }
4359             Py_INCREF(state);
4360         }
4361 
4362         slotnames = _PyType_GetSlotNames(Py_TYPE(obj));
4363         if (slotnames == NULL) {
4364             Py_DECREF(state);
4365             return NULL;
4366         }
4367 
4368         assert(slotnames == Py_None || PyList_Check(slotnames));
4369         if (required) {
4370             Py_ssize_t basicsize = PyBaseObject_Type.tp_basicsize;
4371             if (Py_TYPE(obj)->tp_dictoffset)
4372                 basicsize += sizeof(PyObject *);
4373             if (Py_TYPE(obj)->tp_weaklistoffset)
4374                 basicsize += sizeof(PyObject *);
4375             if (slotnames != Py_None)
4376                 basicsize += sizeof(PyObject *) * PyList_GET_SIZE(slotnames);
4377             if (Py_TYPE(obj)->tp_basicsize > basicsize) {
4378                 Py_DECREF(slotnames);
4379                 Py_DECREF(state);
4380                 PyErr_Format(PyExc_TypeError,
4381                              "cannot pickle '%.200s' object",
4382                              Py_TYPE(obj)->tp_name);
4383                 return NULL;
4384             }
4385         }
4386 
4387         if (slotnames != Py_None && PyList_GET_SIZE(slotnames) > 0) {
4388             PyObject *slots;
4389             Py_ssize_t slotnames_size, i;
4390 
4391             slots = PyDict_New();
4392             if (slots == NULL) {
4393                 Py_DECREF(slotnames);
4394                 Py_DECREF(state);
4395                 return NULL;
4396             }
4397 
4398             slotnames_size = PyList_GET_SIZE(slotnames);
4399             for (i = 0; i < slotnames_size; i++) {
4400                 PyObject *name, *value;
4401 
4402                 name = PyList_GET_ITEM(slotnames, i);
4403                 Py_INCREF(name);
4404                 if (_PyObject_LookupAttr(obj, name, &value) < 0) {
4405                     goto error;
4406                 }
4407                 if (value == NULL) {
4408                     Py_DECREF(name);
4409                     /* It is not an error if the attribute is not present. */
4410                 }
4411                 else {
4412                     int err = PyDict_SetItem(slots, name, value);
4413                     Py_DECREF(name);
4414                     Py_DECREF(value);
4415                     if (err) {
4416                         goto error;
4417                     }
4418                 }
4419 
4420                 /* The list is stored on the class so it may mutate while we
4421                    iterate over it */
4422                 if (slotnames_size != PyList_GET_SIZE(slotnames)) {
4423                     PyErr_Format(PyExc_RuntimeError,
4424                                  "__slotsname__ changed size during iteration");
4425                     goto error;
4426                 }
4427 
4428                 /* We handle errors within the loop here. */
4429                 if (0) {
4430                   error:
4431                     Py_DECREF(slotnames);
4432                     Py_DECREF(slots);
4433                     Py_DECREF(state);
4434                     return NULL;
4435                 }
4436             }
4437 
4438             /* If we found some slot attributes, pack them in a tuple along
4439                the original attribute dictionary. */
4440             if (PyDict_GET_SIZE(slots) > 0) {
4441                 PyObject *state2;
4442 
4443                 state2 = PyTuple_Pack(2, state, slots);
4444                 Py_DECREF(state);
4445                 if (state2 == NULL) {
4446                     Py_DECREF(slotnames);
4447                     Py_DECREF(slots);
4448                     return NULL;
4449                 }
4450                 state = state2;
4451             }
4452             Py_DECREF(slots);
4453         }
4454         Py_DECREF(slotnames);
4455     }
4456     else { /* getstate != NULL */
4457         state = _PyObject_CallNoArg(getstate);
4458         Py_DECREF(getstate);
4459         if (state == NULL)
4460             return NULL;
4461     }
4462 
4463     return state;
4464 }
4465 
4466 static int
_PyObject_GetNewArguments(PyObject * obj,PyObject ** args,PyObject ** kwargs)4467 _PyObject_GetNewArguments(PyObject *obj, PyObject **args, PyObject **kwargs)
4468 {
4469     PyObject *getnewargs, *getnewargs_ex;
4470     _Py_IDENTIFIER(__getnewargs_ex__);
4471     _Py_IDENTIFIER(__getnewargs__);
4472 
4473     if (args == NULL || kwargs == NULL) {
4474         PyErr_BadInternalCall();
4475         return -1;
4476     }
4477 
4478     /* We first attempt to fetch the arguments for __new__ by calling
4479        __getnewargs_ex__ on the object. */
4480     getnewargs_ex = _PyObject_LookupSpecial(obj, &PyId___getnewargs_ex__);
4481     if (getnewargs_ex != NULL) {
4482         PyObject *newargs = _PyObject_CallNoArg(getnewargs_ex);
4483         Py_DECREF(getnewargs_ex);
4484         if (newargs == NULL) {
4485             return -1;
4486         }
4487         if (!PyTuple_Check(newargs)) {
4488             PyErr_Format(PyExc_TypeError,
4489                          "__getnewargs_ex__ should return a tuple, "
4490                          "not '%.200s'", Py_TYPE(newargs)->tp_name);
4491             Py_DECREF(newargs);
4492             return -1;
4493         }
4494         if (PyTuple_GET_SIZE(newargs) != 2) {
4495             PyErr_Format(PyExc_ValueError,
4496                          "__getnewargs_ex__ should return a tuple of "
4497                          "length 2, not %zd", PyTuple_GET_SIZE(newargs));
4498             Py_DECREF(newargs);
4499             return -1;
4500         }
4501         *args = PyTuple_GET_ITEM(newargs, 0);
4502         Py_INCREF(*args);
4503         *kwargs = PyTuple_GET_ITEM(newargs, 1);
4504         Py_INCREF(*kwargs);
4505         Py_DECREF(newargs);
4506 
4507         /* XXX We should perhaps allow None to be passed here. */
4508         if (!PyTuple_Check(*args)) {
4509             PyErr_Format(PyExc_TypeError,
4510                          "first item of the tuple returned by "
4511                          "__getnewargs_ex__ must be a tuple, not '%.200s'",
4512                          Py_TYPE(*args)->tp_name);
4513             Py_CLEAR(*args);
4514             Py_CLEAR(*kwargs);
4515             return -1;
4516         }
4517         if (!PyDict_Check(*kwargs)) {
4518             PyErr_Format(PyExc_TypeError,
4519                          "second item of the tuple returned by "
4520                          "__getnewargs_ex__ must be a dict, not '%.200s'",
4521                          Py_TYPE(*kwargs)->tp_name);
4522             Py_CLEAR(*args);
4523             Py_CLEAR(*kwargs);
4524             return -1;
4525         }
4526         return 0;
4527     } else if (PyErr_Occurred()) {
4528         return -1;
4529     }
4530 
4531     /* The object does not have __getnewargs_ex__ so we fallback on using
4532        __getnewargs__ instead. */
4533     getnewargs = _PyObject_LookupSpecial(obj, &PyId___getnewargs__);
4534     if (getnewargs != NULL) {
4535         *args = _PyObject_CallNoArg(getnewargs);
4536         Py_DECREF(getnewargs);
4537         if (*args == NULL) {
4538             return -1;
4539         }
4540         if (!PyTuple_Check(*args)) {
4541             PyErr_Format(PyExc_TypeError,
4542                          "__getnewargs__ should return a tuple, "
4543                          "not '%.200s'", Py_TYPE(*args)->tp_name);
4544             Py_CLEAR(*args);
4545             return -1;
4546         }
4547         *kwargs = NULL;
4548         return 0;
4549     } else if (PyErr_Occurred()) {
4550         return -1;
4551     }
4552 
4553     /* The object does not have __getnewargs_ex__ and __getnewargs__. This may
4554        mean __new__ does not takes any arguments on this object, or that the
4555        object does not implement the reduce protocol for pickling or
4556        copying. */
4557     *args = NULL;
4558     *kwargs = NULL;
4559     return 0;
4560 }
4561 
4562 static int
_PyObject_GetItemsIter(PyObject * obj,PyObject ** listitems,PyObject ** dictitems)4563 _PyObject_GetItemsIter(PyObject *obj, PyObject **listitems,
4564                        PyObject **dictitems)
4565 {
4566     if (listitems == NULL || dictitems == NULL) {
4567         PyErr_BadInternalCall();
4568         return -1;
4569     }
4570 
4571     if (!PyList_Check(obj)) {
4572         *listitems = Py_None;
4573         Py_INCREF(*listitems);
4574     }
4575     else {
4576         *listitems = PyObject_GetIter(obj);
4577         if (*listitems == NULL)
4578             return -1;
4579     }
4580 
4581     if (!PyDict_Check(obj)) {
4582         *dictitems = Py_None;
4583         Py_INCREF(*dictitems);
4584     }
4585     else {
4586         PyObject *items;
4587         _Py_IDENTIFIER(items);
4588 
4589         items = _PyObject_CallMethodIdNoArgs(obj, &PyId_items);
4590         if (items == NULL) {
4591             Py_CLEAR(*listitems);
4592             return -1;
4593         }
4594         *dictitems = PyObject_GetIter(items);
4595         Py_DECREF(items);
4596         if (*dictitems == NULL) {
4597             Py_CLEAR(*listitems);
4598             return -1;
4599         }
4600     }
4601 
4602     assert(*listitems != NULL && *dictitems != NULL);
4603 
4604     return 0;
4605 }
4606 
4607 static PyObject *
reduce_newobj(PyObject * obj)4608 reduce_newobj(PyObject *obj)
4609 {
4610     PyObject *args = NULL, *kwargs = NULL;
4611     PyObject *copyreg;
4612     PyObject *newobj, *newargs, *state, *listitems, *dictitems;
4613     PyObject *result;
4614     int hasargs;
4615 
4616     if (Py_TYPE(obj)->tp_new == NULL) {
4617         PyErr_Format(PyExc_TypeError,
4618                      "cannot pickle '%.200s' object",
4619                      Py_TYPE(obj)->tp_name);
4620         return NULL;
4621     }
4622     if (_PyObject_GetNewArguments(obj, &args, &kwargs) < 0)
4623         return NULL;
4624 
4625     copyreg = import_copyreg();
4626     if (copyreg == NULL) {
4627         Py_XDECREF(args);
4628         Py_XDECREF(kwargs);
4629         return NULL;
4630     }
4631     hasargs = (args != NULL);
4632     if (kwargs == NULL || PyDict_GET_SIZE(kwargs) == 0) {
4633         _Py_IDENTIFIER(__newobj__);
4634         PyObject *cls;
4635         Py_ssize_t i, n;
4636 
4637         Py_XDECREF(kwargs);
4638         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj__);
4639         Py_DECREF(copyreg);
4640         if (newobj == NULL) {
4641             Py_XDECREF(args);
4642             return NULL;
4643         }
4644         n = args ? PyTuple_GET_SIZE(args) : 0;
4645         newargs = PyTuple_New(n+1);
4646         if (newargs == NULL) {
4647             Py_XDECREF(args);
4648             Py_DECREF(newobj);
4649             return NULL;
4650         }
4651         cls = (PyObject *) Py_TYPE(obj);
4652         Py_INCREF(cls);
4653         PyTuple_SET_ITEM(newargs, 0, cls);
4654         for (i = 0; i < n; i++) {
4655             PyObject *v = PyTuple_GET_ITEM(args, i);
4656             Py_INCREF(v);
4657             PyTuple_SET_ITEM(newargs, i+1, v);
4658         }
4659         Py_XDECREF(args);
4660     }
4661     else if (args != NULL) {
4662         _Py_IDENTIFIER(__newobj_ex__);
4663 
4664         newobj = _PyObject_GetAttrId(copyreg, &PyId___newobj_ex__);
4665         Py_DECREF(copyreg);
4666         if (newobj == NULL) {
4667             Py_DECREF(args);
4668             Py_DECREF(kwargs);
4669             return NULL;
4670         }
4671         newargs = PyTuple_Pack(3, Py_TYPE(obj), args, kwargs);
4672         Py_DECREF(args);
4673         Py_DECREF(kwargs);
4674         if (newargs == NULL) {
4675             Py_DECREF(newobj);
4676             return NULL;
4677         }
4678     }
4679     else {
4680         /* args == NULL */
4681         Py_DECREF(kwargs);
4682         PyErr_BadInternalCall();
4683         return NULL;
4684     }
4685 
4686     state = _PyObject_GetState(obj,
4687                 !hasargs && !PyList_Check(obj) && !PyDict_Check(obj));
4688     if (state == NULL) {
4689         Py_DECREF(newobj);
4690         Py_DECREF(newargs);
4691         return NULL;
4692     }
4693     if (_PyObject_GetItemsIter(obj, &listitems, &dictitems) < 0) {
4694         Py_DECREF(newobj);
4695         Py_DECREF(newargs);
4696         Py_DECREF(state);
4697         return NULL;
4698     }
4699 
4700     result = PyTuple_Pack(5, newobj, newargs, state, listitems, dictitems);
4701     Py_DECREF(newobj);
4702     Py_DECREF(newargs);
4703     Py_DECREF(state);
4704     Py_DECREF(listitems);
4705     Py_DECREF(dictitems);
4706     return result;
4707 }
4708 
4709 /*
4710  * There were two problems when object.__reduce__ and object.__reduce_ex__
4711  * were implemented in the same function:
4712  *  - trying to pickle an object with a custom __reduce__ method that
4713  *    fell back to object.__reduce__ in certain circumstances led to
4714  *    infinite recursion at Python level and eventual RecursionError.
4715  *  - Pickling objects that lied about their type by overwriting the
4716  *    __class__ descriptor could lead to infinite recursion at C level
4717  *    and eventual segfault.
4718  *
4719  * Because of backwards compatibility, the two methods still have to
4720  * behave in the same way, even if this is not required by the pickle
4721  * protocol. This common functionality was moved to the _common_reduce
4722  * function.
4723  */
4724 static PyObject *
_common_reduce(PyObject * self,int proto)4725 _common_reduce(PyObject *self, int proto)
4726 {
4727     PyObject *copyreg, *res;
4728 
4729     if (proto >= 2)
4730         return reduce_newobj(self);
4731 
4732     copyreg = import_copyreg();
4733     if (!copyreg)
4734         return NULL;
4735 
4736     res = PyObject_CallMethod(copyreg, "_reduce_ex", "Oi", self, proto);
4737     Py_DECREF(copyreg);
4738 
4739     return res;
4740 }
4741 
4742 /*[clinic input]
4743 object.__reduce__
4744 
4745 Helper for pickle.
4746 [clinic start generated code]*/
4747 
4748 static PyObject *
object___reduce___impl(PyObject * self)4749 object___reduce___impl(PyObject *self)
4750 /*[clinic end generated code: output=d4ca691f891c6e2f input=11562e663947e18b]*/
4751 {
4752     return _common_reduce(self, 0);
4753 }
4754 
4755 /*[clinic input]
4756 object.__reduce_ex__
4757 
4758   protocol: int
4759   /
4760 
4761 Helper for pickle.
4762 [clinic start generated code]*/
4763 
4764 static PyObject *
object___reduce_ex___impl(PyObject * self,int protocol)4765 object___reduce_ex___impl(PyObject *self, int protocol)
4766 /*[clinic end generated code: output=2e157766f6b50094 input=f326b43fb8a4c5ff]*/
4767 {
4768     static PyObject *objreduce;
4769     PyObject *reduce, *res;
4770     _Py_IDENTIFIER(__reduce__);
4771 
4772     if (objreduce == NULL) {
4773         objreduce = _PyDict_GetItemId(PyBaseObject_Type.tp_dict,
4774                                       &PyId___reduce__);
4775     }
4776 
4777     if (_PyObject_LookupAttrId(self, &PyId___reduce__, &reduce) < 0) {
4778         return NULL;
4779     }
4780     if (reduce != NULL) {
4781         PyObject *cls, *clsreduce;
4782         int override;
4783 
4784         cls = (PyObject *) Py_TYPE(self);
4785         clsreduce = _PyObject_GetAttrId(cls, &PyId___reduce__);
4786         if (clsreduce == NULL) {
4787             Py_DECREF(reduce);
4788             return NULL;
4789         }
4790         override = (clsreduce != objreduce);
4791         Py_DECREF(clsreduce);
4792         if (override) {
4793             res = _PyObject_CallNoArg(reduce);
4794             Py_DECREF(reduce);
4795             return res;
4796         }
4797         else
4798             Py_DECREF(reduce);
4799     }
4800 
4801     return _common_reduce(self, protocol);
4802 }
4803 
4804 static PyObject *
object_subclasshook(PyObject * cls,PyObject * args)4805 object_subclasshook(PyObject *cls, PyObject *args)
4806 {
4807     Py_RETURN_NOTIMPLEMENTED;
4808 }
4809 
4810 PyDoc_STRVAR(object_subclasshook_doc,
4811 "Abstract classes can override this to customize issubclass().\n"
4812 "\n"
4813 "This is invoked early on by abc.ABCMeta.__subclasscheck__().\n"
4814 "It should return True, False or NotImplemented.  If it returns\n"
4815 "NotImplemented, the normal algorithm is used.  Otherwise, it\n"
4816 "overrides the normal algorithm (and the outcome is cached).\n");
4817 
4818 static PyObject *
object_init_subclass(PyObject * cls,PyObject * arg)4819 object_init_subclass(PyObject *cls, PyObject *arg)
4820 {
4821     Py_RETURN_NONE;
4822 }
4823 
4824 PyDoc_STRVAR(object_init_subclass_doc,
4825 "This method is called when a class is subclassed.\n"
4826 "\n"
4827 "The default implementation does nothing. It may be\n"
4828 "overridden to extend subclasses.\n");
4829 
4830 /*[clinic input]
4831 object.__format__
4832 
4833   format_spec: unicode
4834   /
4835 
4836 Default object formatter.
4837 [clinic start generated code]*/
4838 
4839 static PyObject *
object___format___impl(PyObject * self,PyObject * format_spec)4840 object___format___impl(PyObject *self, PyObject *format_spec)
4841 /*[clinic end generated code: output=34897efb543a974b input=7c3b3bc53a6fb7fa]*/
4842 {
4843     /* Issue 7994: If we're converting to a string, we
4844        should reject format specifications */
4845     if (PyUnicode_GET_LENGTH(format_spec) > 0) {
4846         PyErr_Format(PyExc_TypeError,
4847                      "unsupported format string passed to %.200s.__format__",
4848                      Py_TYPE(self)->tp_name);
4849         return NULL;
4850     }
4851     return PyObject_Str(self);
4852 }
4853 
4854 /*[clinic input]
4855 object.__sizeof__
4856 
4857 Size of object in memory, in bytes.
4858 [clinic start generated code]*/
4859 
4860 static PyObject *
object___sizeof___impl(PyObject * self)4861 object___sizeof___impl(PyObject *self)
4862 /*[clinic end generated code: output=73edab332f97d550 input=1200ff3dfe485306]*/
4863 {
4864     Py_ssize_t res, isize;
4865 
4866     res = 0;
4867     isize = Py_TYPE(self)->tp_itemsize;
4868     if (isize > 0)
4869         res = Py_SIZE(self) * isize;
4870     res += Py_TYPE(self)->tp_basicsize;
4871 
4872     return PyLong_FromSsize_t(res);
4873 }
4874 
4875 /* __dir__ for generic objects: returns __dict__, __class__,
4876    and recursively up the __class__.__bases__ chain.
4877 */
4878 /*[clinic input]
4879 object.__dir__
4880 
4881 Default dir() implementation.
4882 [clinic start generated code]*/
4883 
4884 static PyObject *
object___dir___impl(PyObject * self)4885 object___dir___impl(PyObject *self)
4886 /*[clinic end generated code: output=66dd48ea62f26c90 input=0a89305bec669b10]*/
4887 {
4888     PyObject *result = NULL;
4889     PyObject *dict = NULL;
4890     PyObject *itsclass = NULL;
4891 
4892     /* Get __dict__ (which may or may not be a real dict...) */
4893     if (_PyObject_LookupAttrId(self, &PyId___dict__, &dict) < 0) {
4894         return NULL;
4895     }
4896     if (dict == NULL) {
4897         dict = PyDict_New();
4898     }
4899     else if (!PyDict_Check(dict)) {
4900         Py_DECREF(dict);
4901         dict = PyDict_New();
4902     }
4903     else {
4904         /* Copy __dict__ to avoid mutating it. */
4905         PyObject *temp = PyDict_Copy(dict);
4906         Py_DECREF(dict);
4907         dict = temp;
4908     }
4909 
4910     if (dict == NULL)
4911         goto error;
4912 
4913     /* Merge in attrs reachable from its class. */
4914     if (_PyObject_LookupAttrId(self, &PyId___class__, &itsclass) < 0) {
4915         goto error;
4916     }
4917     /* XXX(tomer): Perhaps fall back to Py_TYPE(obj) if no
4918                    __class__ exists? */
4919     if (itsclass != NULL && merge_class_dict(dict, itsclass) < 0)
4920         goto error;
4921 
4922     result = PyDict_Keys(dict);
4923     /* fall through */
4924 error:
4925     Py_XDECREF(itsclass);
4926     Py_XDECREF(dict);
4927     return result;
4928 }
4929 
4930 static PyMethodDef object_methods[] = {
4931     OBJECT___REDUCE_EX___METHODDEF
4932     OBJECT___REDUCE___METHODDEF
4933     {"__subclasshook__", object_subclasshook, METH_CLASS | METH_VARARGS,
4934      object_subclasshook_doc},
4935     {"__init_subclass__", object_init_subclass, METH_CLASS | METH_NOARGS,
4936      object_init_subclass_doc},
4937     OBJECT___FORMAT___METHODDEF
4938     OBJECT___SIZEOF___METHODDEF
4939     OBJECT___DIR___METHODDEF
4940     {0}
4941 };
4942 
4943 PyDoc_STRVAR(object_doc,
4944 "object()\n--\n\n"
4945 "The base class of the class hierarchy.\n\n"
4946 "When called, it accepts no arguments and returns a new featureless\n"
4947 "instance that has no instance attributes and cannot be given any.\n");
4948 
4949 PyTypeObject PyBaseObject_Type = {
4950     PyVarObject_HEAD_INIT(&PyType_Type, 0)
4951     "object",                                   /* tp_name */
4952     sizeof(PyObject),                           /* tp_basicsize */
4953     0,                                          /* tp_itemsize */
4954     object_dealloc,                             /* tp_dealloc */
4955     0,                                          /* tp_vectorcall_offset */
4956     0,                                          /* tp_getattr */
4957     0,                                          /* tp_setattr */
4958     0,                                          /* tp_as_async */
4959     object_repr,                                /* tp_repr */
4960     0,                                          /* tp_as_number */
4961     0,                                          /* tp_as_sequence */
4962     0,                                          /* tp_as_mapping */
4963     (hashfunc)_Py_HashPointer,                  /* tp_hash */
4964     0,                                          /* tp_call */
4965     object_str,                                 /* tp_str */
4966     PyObject_GenericGetAttr,                    /* tp_getattro */
4967     PyObject_GenericSetAttr,                    /* tp_setattro */
4968     0,                                          /* tp_as_buffer */
4969     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,   /* tp_flags */
4970     object_doc,                                 /* tp_doc */
4971     0,                                          /* tp_traverse */
4972     0,                                          /* tp_clear */
4973     object_richcompare,                         /* tp_richcompare */
4974     0,                                          /* tp_weaklistoffset */
4975     0,                                          /* tp_iter */
4976     0,                                          /* tp_iternext */
4977     object_methods,                             /* tp_methods */
4978     0,                                          /* tp_members */
4979     object_getsets,                             /* tp_getset */
4980     0,                                          /* tp_base */
4981     0,                                          /* tp_dict */
4982     0,                                          /* tp_descr_get */
4983     0,                                          /* tp_descr_set */
4984     0,                                          /* tp_dictoffset */
4985     object_init,                                /* tp_init */
4986     PyType_GenericAlloc,                        /* tp_alloc */
4987     object_new,                                 /* tp_new */
4988     PyObject_Del,                               /* tp_free */
4989 };
4990 
4991 
4992 /* Add the methods from tp_methods to the __dict__ in a type object */
4993 
4994 static int
add_methods(PyTypeObject * type,PyMethodDef * meth)4995 add_methods(PyTypeObject *type, PyMethodDef *meth)
4996 {
4997     PyObject *dict = type->tp_dict;
4998     PyObject *name;
4999 
5000     for (; meth->ml_name != NULL; meth++) {
5001         PyObject *descr;
5002         int err;
5003         int isdescr = 1;
5004         if (meth->ml_flags & METH_CLASS) {
5005             if (meth->ml_flags & METH_STATIC) {
5006                 PyErr_SetString(PyExc_ValueError,
5007                      "method cannot be both class and static");
5008                 return -1;
5009             }
5010             descr = PyDescr_NewClassMethod(type, meth);
5011         }
5012         else if (meth->ml_flags & METH_STATIC) {
5013             PyObject *cfunc = PyCFunction_NewEx(meth, (PyObject*)type, NULL);
5014             if (cfunc == NULL)
5015                 return -1;
5016             descr = PyStaticMethod_New(cfunc);
5017             isdescr = 0;  // PyStaticMethod is not PyDescrObject
5018             Py_DECREF(cfunc);
5019         }
5020         else {
5021             descr = PyDescr_NewMethod(type, meth);
5022         }
5023         if (descr == NULL)
5024             return -1;
5025 
5026         if (isdescr) {
5027             name = PyDescr_NAME(descr);
5028         }
5029         else {
5030             name = PyUnicode_FromString(meth->ml_name);
5031             if (name == NULL) {
5032                 Py_DECREF(descr);
5033                 return -1;
5034             }
5035         }
5036 
5037         if (!(meth->ml_flags & METH_COEXIST)) {
5038             if (PyDict_GetItemWithError(dict, name)) {
5039                 if (!isdescr) {
5040                     Py_DECREF(name);
5041                 }
5042                 Py_DECREF(descr);
5043                 continue;
5044             }
5045             else if (PyErr_Occurred()) {
5046                 if (!isdescr) {
5047                     Py_DECREF(name);
5048                 }
5049                 return -1;
5050             }
5051         }
5052         err = PyDict_SetItem(dict, name, descr);
5053         if (!isdescr) {
5054             Py_DECREF(name);
5055         }
5056         Py_DECREF(descr);
5057         if (err < 0)
5058             return -1;
5059     }
5060     return 0;
5061 }
5062 
5063 static int
add_members(PyTypeObject * type,PyMemberDef * memb)5064 add_members(PyTypeObject *type, PyMemberDef *memb)
5065 {
5066     PyObject *dict = type->tp_dict;
5067 
5068     for (; memb->name != NULL; memb++) {
5069         PyObject *descr = PyDescr_NewMember(type, memb);
5070         if (descr == NULL)
5071             return -1;
5072 
5073         if (PyDict_GetItemWithError(dict, PyDescr_NAME(descr))) {
5074             Py_DECREF(descr);
5075             continue;
5076         }
5077         else if (PyErr_Occurred()) {
5078             Py_DECREF(descr);
5079             return -1;
5080         }
5081         if (PyDict_SetItem(dict, PyDescr_NAME(descr), descr) < 0) {
5082             Py_DECREF(descr);
5083             return -1;
5084         }
5085         Py_DECREF(descr);
5086     }
5087     return 0;
5088 }
5089 
5090 static int
add_getset(PyTypeObject * type,PyGetSetDef * gsp)5091 add_getset(PyTypeObject *type, PyGetSetDef *gsp)
5092 {
5093     PyObject *dict = type->tp_dict;
5094 
5095     for (; gsp->name != NULL; gsp++) {
5096         PyObject *descr = PyDescr_NewGetSet(type, gsp);
5097         if (descr == NULL)
5098             return -1;
5099 
5100         if (PyDict_GetItemWithError(dict, PyDescr_NAME(descr))) {
5101             Py_DECREF(descr);
5102             continue;
5103         }
5104         else if (PyErr_Occurred()) {
5105             Py_DECREF(descr);
5106             return -1;
5107         }
5108         if (PyDict_SetItem(dict, PyDescr_NAME(descr), descr) < 0) {
5109             Py_DECREF(descr);
5110             return -1;
5111         }
5112         Py_DECREF(descr);
5113     }
5114     return 0;
5115 }
5116 
5117 static void
inherit_special(PyTypeObject * type,PyTypeObject * base)5118 inherit_special(PyTypeObject *type, PyTypeObject *base)
5119 {
5120 
5121     /* Copying tp_traverse and tp_clear is connected to the GC flags */
5122     if (!(type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5123         (base->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5124         (!type->tp_traverse && !type->tp_clear)) {
5125         type->tp_flags |= Py_TPFLAGS_HAVE_GC;
5126         if (type->tp_traverse == NULL)
5127             type->tp_traverse = base->tp_traverse;
5128         if (type->tp_clear == NULL)
5129             type->tp_clear = base->tp_clear;
5130     }
5131     {
5132         /* The condition below could use some explanation.
5133            It appears that tp_new is not inherited for static types
5134            whose base class is 'object'; this seems to be a precaution
5135            so that old extension types don't suddenly become
5136            callable (object.__new__ wouldn't insure the invariants
5137            that the extension type's own factory function ensures).
5138            Heap types, of course, are under our control, so they do
5139            inherit tp_new; static extension types that specify some
5140            other built-in type as the default also
5141            inherit object.__new__. */
5142         if (base != &PyBaseObject_Type ||
5143             (type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
5144             if (type->tp_new == NULL)
5145                 type->tp_new = base->tp_new;
5146         }
5147     }
5148     if (type->tp_basicsize == 0)
5149         type->tp_basicsize = base->tp_basicsize;
5150 
5151     /* Copy other non-function slots */
5152 
5153 #undef COPYVAL
5154 #define COPYVAL(SLOT) \
5155     if (type->SLOT == 0) type->SLOT = base->SLOT
5156 
5157     COPYVAL(tp_itemsize);
5158     COPYVAL(tp_weaklistoffset);
5159     COPYVAL(tp_dictoffset);
5160 
5161     /* Setup fast subclass flags */
5162     if (PyType_IsSubtype(base, (PyTypeObject*)PyExc_BaseException))
5163         type->tp_flags |= Py_TPFLAGS_BASE_EXC_SUBCLASS;
5164     else if (PyType_IsSubtype(base, &PyType_Type))
5165         type->tp_flags |= Py_TPFLAGS_TYPE_SUBCLASS;
5166     else if (PyType_IsSubtype(base, &PyLong_Type))
5167         type->tp_flags |= Py_TPFLAGS_LONG_SUBCLASS;
5168     else if (PyType_IsSubtype(base, &PyBytes_Type))
5169         type->tp_flags |= Py_TPFLAGS_BYTES_SUBCLASS;
5170     else if (PyType_IsSubtype(base, &PyUnicode_Type))
5171         type->tp_flags |= Py_TPFLAGS_UNICODE_SUBCLASS;
5172     else if (PyType_IsSubtype(base, &PyTuple_Type))
5173         type->tp_flags |= Py_TPFLAGS_TUPLE_SUBCLASS;
5174     else if (PyType_IsSubtype(base, &PyList_Type))
5175         type->tp_flags |= Py_TPFLAGS_LIST_SUBCLASS;
5176     else if (PyType_IsSubtype(base, &PyDict_Type))
5177         type->tp_flags |= Py_TPFLAGS_DICT_SUBCLASS;
5178 }
5179 
5180 static int
overrides_hash(PyTypeObject * type)5181 overrides_hash(PyTypeObject *type)
5182 {
5183     PyObject *dict = type->tp_dict;
5184     _Py_IDENTIFIER(__eq__);
5185 
5186     assert(dict != NULL);
5187     if (_PyDict_GetItemId(dict, &PyId___eq__) != NULL)
5188         return 1;
5189     if (_PyDict_GetItemId(dict, &PyId___hash__) != NULL)
5190         return 1;
5191     return 0;
5192 }
5193 
5194 static void
inherit_slots(PyTypeObject * type,PyTypeObject * base)5195 inherit_slots(PyTypeObject *type, PyTypeObject *base)
5196 {
5197     PyTypeObject *basebase;
5198 
5199 #undef SLOTDEFINED
5200 #undef COPYSLOT
5201 #undef COPYNUM
5202 #undef COPYSEQ
5203 #undef COPYMAP
5204 #undef COPYBUF
5205 
5206 #define SLOTDEFINED(SLOT) \
5207     (base->SLOT != 0 && \
5208      (basebase == NULL || base->SLOT != basebase->SLOT))
5209 
5210 #define COPYSLOT(SLOT) \
5211     if (!type->SLOT && SLOTDEFINED(SLOT)) type->SLOT = base->SLOT
5212 
5213 #define COPYASYNC(SLOT) COPYSLOT(tp_as_async->SLOT)
5214 #define COPYNUM(SLOT) COPYSLOT(tp_as_number->SLOT)
5215 #define COPYSEQ(SLOT) COPYSLOT(tp_as_sequence->SLOT)
5216 #define COPYMAP(SLOT) COPYSLOT(tp_as_mapping->SLOT)
5217 #define COPYBUF(SLOT) COPYSLOT(tp_as_buffer->SLOT)
5218 
5219     /* This won't inherit indirect slots (from tp_as_number etc.)
5220        if type doesn't provide the space. */
5221 
5222     if (type->tp_as_number != NULL && base->tp_as_number != NULL) {
5223         basebase = base->tp_base;
5224         if (basebase->tp_as_number == NULL)
5225             basebase = NULL;
5226         COPYNUM(nb_add);
5227         COPYNUM(nb_subtract);
5228         COPYNUM(nb_multiply);
5229         COPYNUM(nb_remainder);
5230         COPYNUM(nb_divmod);
5231         COPYNUM(nb_power);
5232         COPYNUM(nb_negative);
5233         COPYNUM(nb_positive);
5234         COPYNUM(nb_absolute);
5235         COPYNUM(nb_bool);
5236         COPYNUM(nb_invert);
5237         COPYNUM(nb_lshift);
5238         COPYNUM(nb_rshift);
5239         COPYNUM(nb_and);
5240         COPYNUM(nb_xor);
5241         COPYNUM(nb_or);
5242         COPYNUM(nb_int);
5243         COPYNUM(nb_float);
5244         COPYNUM(nb_inplace_add);
5245         COPYNUM(nb_inplace_subtract);
5246         COPYNUM(nb_inplace_multiply);
5247         COPYNUM(nb_inplace_remainder);
5248         COPYNUM(nb_inplace_power);
5249         COPYNUM(nb_inplace_lshift);
5250         COPYNUM(nb_inplace_rshift);
5251         COPYNUM(nb_inplace_and);
5252         COPYNUM(nb_inplace_xor);
5253         COPYNUM(nb_inplace_or);
5254         COPYNUM(nb_true_divide);
5255         COPYNUM(nb_floor_divide);
5256         COPYNUM(nb_inplace_true_divide);
5257         COPYNUM(nb_inplace_floor_divide);
5258         COPYNUM(nb_index);
5259         COPYNUM(nb_matrix_multiply);
5260         COPYNUM(nb_inplace_matrix_multiply);
5261     }
5262 
5263     if (type->tp_as_async != NULL && base->tp_as_async != NULL) {
5264         basebase = base->tp_base;
5265         if (basebase->tp_as_async == NULL)
5266             basebase = NULL;
5267         COPYASYNC(am_await);
5268         COPYASYNC(am_aiter);
5269         COPYASYNC(am_anext);
5270     }
5271 
5272     if (type->tp_as_sequence != NULL && base->tp_as_sequence != NULL) {
5273         basebase = base->tp_base;
5274         if (basebase->tp_as_sequence == NULL)
5275             basebase = NULL;
5276         COPYSEQ(sq_length);
5277         COPYSEQ(sq_concat);
5278         COPYSEQ(sq_repeat);
5279         COPYSEQ(sq_item);
5280         COPYSEQ(sq_ass_item);
5281         COPYSEQ(sq_contains);
5282         COPYSEQ(sq_inplace_concat);
5283         COPYSEQ(sq_inplace_repeat);
5284     }
5285 
5286     if (type->tp_as_mapping != NULL && base->tp_as_mapping != NULL) {
5287         basebase = base->tp_base;
5288         if (basebase->tp_as_mapping == NULL)
5289             basebase = NULL;
5290         COPYMAP(mp_length);
5291         COPYMAP(mp_subscript);
5292         COPYMAP(mp_ass_subscript);
5293     }
5294 
5295     if (type->tp_as_buffer != NULL && base->tp_as_buffer != NULL) {
5296         basebase = base->tp_base;
5297         if (basebase->tp_as_buffer == NULL)
5298             basebase = NULL;
5299         COPYBUF(bf_getbuffer);
5300         COPYBUF(bf_releasebuffer);
5301     }
5302 
5303     basebase = base->tp_base;
5304 
5305     COPYSLOT(tp_dealloc);
5306     if (type->tp_getattr == NULL && type->tp_getattro == NULL) {
5307         type->tp_getattr = base->tp_getattr;
5308         type->tp_getattro = base->tp_getattro;
5309     }
5310     if (type->tp_setattr == NULL && type->tp_setattro == NULL) {
5311         type->tp_setattr = base->tp_setattr;
5312         type->tp_setattro = base->tp_setattro;
5313     }
5314     COPYSLOT(tp_repr);
5315     /* tp_hash see tp_richcompare */
5316     {
5317         /* Always inherit tp_vectorcall_offset to support PyVectorcall_Call().
5318          * If Py_TPFLAGS_HAVE_VECTORCALL is not inherited, then vectorcall
5319          * won't be used automatically. */
5320         COPYSLOT(tp_vectorcall_offset);
5321 
5322         /* Inherit Py_TPFLAGS_HAVE_VECTORCALL for non-heap types
5323         * if tp_call is not overridden */
5324         if (!type->tp_call &&
5325             (base->tp_flags & Py_TPFLAGS_HAVE_VECTORCALL) &&
5326             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
5327         {
5328             type->tp_flags |= Py_TPFLAGS_HAVE_VECTORCALL;
5329         }
5330         COPYSLOT(tp_call);
5331     }
5332     COPYSLOT(tp_str);
5333     {
5334         /* Copy comparison-related slots only when
5335            not overriding them anywhere */
5336         if (type->tp_richcompare == NULL &&
5337             type->tp_hash == NULL &&
5338             !overrides_hash(type))
5339         {
5340             type->tp_richcompare = base->tp_richcompare;
5341             type->tp_hash = base->tp_hash;
5342         }
5343     }
5344     {
5345         COPYSLOT(tp_iter);
5346         COPYSLOT(tp_iternext);
5347     }
5348     {
5349         COPYSLOT(tp_descr_get);
5350         /* Inherit Py_TPFLAGS_METHOD_DESCRIPTOR if tp_descr_get was inherited,
5351          * but only for extension types */
5352         if (base->tp_descr_get &&
5353             type->tp_descr_get == base->tp_descr_get &&
5354             !(type->tp_flags & Py_TPFLAGS_HEAPTYPE) &&
5355             (base->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR))
5356         {
5357             type->tp_flags |= Py_TPFLAGS_METHOD_DESCRIPTOR;
5358         }
5359         COPYSLOT(tp_descr_set);
5360         COPYSLOT(tp_dictoffset);
5361         COPYSLOT(tp_init);
5362         COPYSLOT(tp_alloc);
5363         COPYSLOT(tp_is_gc);
5364         COPYSLOT(tp_finalize);
5365         if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) ==
5366             (base->tp_flags & Py_TPFLAGS_HAVE_GC)) {
5367             /* They agree about gc. */
5368             COPYSLOT(tp_free);
5369         }
5370         else if ((type->tp_flags & Py_TPFLAGS_HAVE_GC) &&
5371                  type->tp_free == NULL &&
5372                  base->tp_free == PyObject_Free) {
5373             /* A bit of magic to plug in the correct default
5374              * tp_free function when a derived class adds gc,
5375              * didn't define tp_free, and the base uses the
5376              * default non-gc tp_free.
5377              */
5378             type->tp_free = PyObject_GC_Del;
5379         }
5380         /* else they didn't agree about gc, and there isn't something
5381          * obvious to be done -- the type is on its own.
5382          */
5383     }
5384 }
5385 
5386 static int add_operators(PyTypeObject *);
5387 
5388 int
PyType_Ready(PyTypeObject * type)5389 PyType_Ready(PyTypeObject *type)
5390 {
5391     PyObject *dict, *bases;
5392     PyTypeObject *base;
5393     Py_ssize_t i, n;
5394 
5395     if (type->tp_flags & Py_TPFLAGS_READY) {
5396         assert(_PyType_CheckConsistency(type));
5397         return 0;
5398     }
5399     _PyObject_ASSERT((PyObject *)type,
5400                      (type->tp_flags & Py_TPFLAGS_READYING) == 0);
5401 
5402     /* Consistency checks for PEP 590:
5403      * - Py_TPFLAGS_METHOD_DESCRIPTOR requires tp_descr_get
5404      * - Py_TPFLAGS_HAVE_VECTORCALL requires tp_call and
5405      *   tp_vectorcall_offset > 0
5406      * To avoid mistakes, we require this before inheriting.
5407      */
5408     if (type->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR) {
5409         _PyObject_ASSERT((PyObject *)type, type->tp_descr_get != NULL);
5410     }
5411     if (type->tp_flags & Py_TPFLAGS_HAVE_VECTORCALL) {
5412         _PyObject_ASSERT((PyObject *)type, type->tp_vectorcall_offset > 0);
5413         _PyObject_ASSERT((PyObject *)type, type->tp_call != NULL);
5414     }
5415 
5416     type->tp_flags |= Py_TPFLAGS_READYING;
5417 
5418 #ifdef Py_TRACE_REFS
5419     /* PyType_Ready is the closest thing we have to a choke point
5420      * for type objects, so is the best place I can think of to try
5421      * to get type objects into the doubly-linked list of all objects.
5422      * Still, not all type objects go through PyType_Ready.
5423      */
5424     _Py_AddToAllObjects((PyObject *)type, 0);
5425 #endif
5426 
5427     if (type->tp_name == NULL) {
5428         PyErr_Format(PyExc_SystemError,
5429                      "Type does not define the tp_name field.");
5430         goto error;
5431     }
5432 
5433     /* Initialize tp_base (defaults to BaseObject unless that's us) */
5434     base = type->tp_base;
5435     if (base == NULL && type != &PyBaseObject_Type) {
5436         base = type->tp_base = &PyBaseObject_Type;
5437         Py_INCREF(base);
5438     }
5439 
5440     /* Now the only way base can still be NULL is if type is
5441      * &PyBaseObject_Type.
5442      */
5443 
5444     /* Initialize the base class */
5445     if (base != NULL && base->tp_dict == NULL) {
5446         if (PyType_Ready(base) < 0)
5447             goto error;
5448     }
5449 
5450     /* Initialize ob_type if NULL.      This means extensions that want to be
5451        compilable separately on Windows can call PyType_Ready() instead of
5452        initializing the ob_type field of their type objects. */
5453     /* The test for base != NULL is really unnecessary, since base is only
5454        NULL when type is &PyBaseObject_Type, and we know its ob_type is
5455        not NULL (it's initialized to &PyType_Type).      But coverity doesn't
5456        know that. */
5457     if (Py_IS_TYPE(type, NULL) && base != NULL) {
5458         Py_SET_TYPE(type, Py_TYPE(base));
5459     }
5460 
5461     /* Initialize tp_bases */
5462     bases = type->tp_bases;
5463     if (bases == NULL) {
5464         if (base == NULL)
5465             bases = PyTuple_New(0);
5466         else
5467             bases = PyTuple_Pack(1, base);
5468         if (bases == NULL)
5469             goto error;
5470         type->tp_bases = bases;
5471     }
5472 
5473     /* Initialize tp_dict */
5474     dict = type->tp_dict;
5475     if (dict == NULL) {
5476         dict = PyDict_New();
5477         if (dict == NULL)
5478             goto error;
5479         type->tp_dict = dict;
5480     }
5481 
5482     /* Add type-specific descriptors to tp_dict */
5483     if (add_operators(type) < 0)
5484         goto error;
5485     if (type->tp_methods != NULL) {
5486         if (add_methods(type, type->tp_methods) < 0)
5487             goto error;
5488     }
5489     if (type->tp_members != NULL) {
5490         if (add_members(type, type->tp_members) < 0)
5491             goto error;
5492     }
5493     if (type->tp_getset != NULL) {
5494         if (add_getset(type, type->tp_getset) < 0)
5495             goto error;
5496     }
5497 
5498     /* Calculate method resolution order */
5499     if (mro_internal(type, NULL) < 0)
5500         goto error;
5501 
5502     /* Inherit special flags from dominant base */
5503     if (type->tp_base != NULL)
5504         inherit_special(type, type->tp_base);
5505 
5506     /* Initialize tp_dict properly */
5507     bases = type->tp_mro;
5508     assert(bases != NULL);
5509     assert(PyTuple_Check(bases));
5510     n = PyTuple_GET_SIZE(bases);
5511     for (i = 1; i < n; i++) {
5512         PyObject *b = PyTuple_GET_ITEM(bases, i);
5513         if (PyType_Check(b))
5514             inherit_slots(type, (PyTypeObject *)b);
5515     }
5516 
5517     /* All bases of statically allocated type should be statically allocated */
5518     if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
5519         for (i = 0; i < n; i++) {
5520             PyObject *b = PyTuple_GET_ITEM(bases, i);
5521             if (PyType_Check(b) &&
5522                 (((PyTypeObject *)b)->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
5523                 PyErr_Format(PyExc_TypeError,
5524                              "type '%.100s' is not dynamically allocated but "
5525                              "its base type '%.100s' is dynamically allocated",
5526                              type->tp_name, ((PyTypeObject *)b)->tp_name);
5527                 goto error;
5528             }
5529         }
5530 
5531     /* Sanity check for tp_free. */
5532     if (_PyType_IS_GC(type) && (type->tp_flags & Py_TPFLAGS_BASETYPE) &&
5533         (type->tp_free == NULL || type->tp_free == PyObject_Del)) {
5534         /* This base class needs to call tp_free, but doesn't have
5535          * one, or its tp_free is for non-gc'ed objects.
5536          */
5537         PyErr_Format(PyExc_TypeError, "type '%.100s' participates in "
5538                      "gc and is a base type but has inappropriate "
5539                      "tp_free slot",
5540                      type->tp_name);
5541         goto error;
5542     }
5543 
5544     /* if the type dictionary doesn't contain a __doc__, set it from
5545        the tp_doc slot.
5546      */
5547     if (_PyDict_GetItemIdWithError(type->tp_dict, &PyId___doc__) == NULL) {
5548         if (PyErr_Occurred()) {
5549             goto error;
5550         }
5551         if (type->tp_doc != NULL) {
5552             const char *old_doc = _PyType_DocWithoutSignature(type->tp_name,
5553                 type->tp_doc);
5554             PyObject *doc = PyUnicode_FromString(old_doc);
5555             if (doc == NULL)
5556                 goto error;
5557             if (_PyDict_SetItemId(type->tp_dict, &PyId___doc__, doc) < 0) {
5558                 Py_DECREF(doc);
5559                 goto error;
5560             }
5561             Py_DECREF(doc);
5562         } else {
5563             if (_PyDict_SetItemId(type->tp_dict,
5564                                   &PyId___doc__, Py_None) < 0)
5565                 goto error;
5566         }
5567     }
5568 
5569     /* Hack for tp_hash and __hash__.
5570        If after all that, tp_hash is still NULL, and __hash__ is not in
5571        tp_dict, set tp_hash to PyObject_HashNotImplemented and
5572        tp_dict['__hash__'] equal to None.
5573        This signals that __hash__ is not inherited.
5574      */
5575     if (type->tp_hash == NULL) {
5576         if (_PyDict_GetItemIdWithError(type->tp_dict, &PyId___hash__) == NULL) {
5577             if (PyErr_Occurred() ||
5578                _PyDict_SetItemId(type->tp_dict, &PyId___hash__, Py_None) < 0)
5579             {
5580                 goto error;
5581             }
5582             type->tp_hash = PyObject_HashNotImplemented;
5583         }
5584     }
5585 
5586     /* Some more special stuff */
5587     base = type->tp_base;
5588     if (base != NULL) {
5589         if (type->tp_as_async == NULL)
5590             type->tp_as_async = base->tp_as_async;
5591         if (type->tp_as_number == NULL)
5592             type->tp_as_number = base->tp_as_number;
5593         if (type->tp_as_sequence == NULL)
5594             type->tp_as_sequence = base->tp_as_sequence;
5595         if (type->tp_as_mapping == NULL)
5596             type->tp_as_mapping = base->tp_as_mapping;
5597         if (type->tp_as_buffer == NULL)
5598             type->tp_as_buffer = base->tp_as_buffer;
5599     }
5600 
5601     /* Link into each base class's list of subclasses */
5602     bases = type->tp_bases;
5603     n = PyTuple_GET_SIZE(bases);
5604     for (i = 0; i < n; i++) {
5605         PyObject *b = PyTuple_GET_ITEM(bases, i);
5606         if (PyType_Check(b) &&
5607             add_subclass((PyTypeObject *)b, type) < 0)
5608             goto error;
5609     }
5610 
5611     /* All done -- set the ready flag */
5612     type->tp_flags =
5613         (type->tp_flags & ~Py_TPFLAGS_READYING) | Py_TPFLAGS_READY;
5614     assert(_PyType_CheckConsistency(type));
5615     return 0;
5616 
5617   error:
5618     type->tp_flags &= ~Py_TPFLAGS_READYING;
5619     return -1;
5620 }
5621 
5622 static int
add_subclass(PyTypeObject * base,PyTypeObject * type)5623 add_subclass(PyTypeObject *base, PyTypeObject *type)
5624 {
5625     int result = -1;
5626     PyObject *dict, *key, *newobj;
5627 
5628     dict = base->tp_subclasses;
5629     if (dict == NULL) {
5630         base->tp_subclasses = dict = PyDict_New();
5631         if (dict == NULL)
5632             return -1;
5633     }
5634     assert(PyDict_CheckExact(dict));
5635     key = PyLong_FromVoidPtr((void *) type);
5636     if (key == NULL)
5637         return -1;
5638     newobj = PyWeakref_NewRef((PyObject *)type, NULL);
5639     if (newobj != NULL) {
5640         result = PyDict_SetItem(dict, key, newobj);
5641         Py_DECREF(newobj);
5642     }
5643     Py_DECREF(key);
5644     return result;
5645 }
5646 
5647 static int
add_all_subclasses(PyTypeObject * type,PyObject * bases)5648 add_all_subclasses(PyTypeObject *type, PyObject *bases)
5649 {
5650     int res = 0;
5651 
5652     if (bases) {
5653         Py_ssize_t i;
5654         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
5655             PyObject *base = PyTuple_GET_ITEM(bases, i);
5656             if (PyType_Check(base) &&
5657                 add_subclass((PyTypeObject*)base, type) < 0)
5658                 res = -1;
5659         }
5660     }
5661 
5662     return res;
5663 }
5664 
5665 static void
remove_subclass(PyTypeObject * base,PyTypeObject * type)5666 remove_subclass(PyTypeObject *base, PyTypeObject *type)
5667 {
5668     PyObject *dict, *key;
5669 
5670     dict = base->tp_subclasses;
5671     if (dict == NULL) {
5672         return;
5673     }
5674     assert(PyDict_CheckExact(dict));
5675     key = PyLong_FromVoidPtr((void *) type);
5676     if (key == NULL || PyDict_DelItem(dict, key)) {
5677         /* This can happen if the type initialization errored out before
5678            the base subclasses were updated (e.g. a non-str __qualname__
5679            was passed in the type dict). */
5680         PyErr_Clear();
5681     }
5682     Py_XDECREF(key);
5683 }
5684 
5685 static void
remove_all_subclasses(PyTypeObject * type,PyObject * bases)5686 remove_all_subclasses(PyTypeObject *type, PyObject *bases)
5687 {
5688     if (bases) {
5689         Py_ssize_t i;
5690         for (i = 0; i < PyTuple_GET_SIZE(bases); i++) {
5691             PyObject *base = PyTuple_GET_ITEM(bases, i);
5692             if (PyType_Check(base))
5693                 remove_subclass((PyTypeObject*) base, type);
5694         }
5695     }
5696 }
5697 
5698 static int
check_num_args(PyObject * ob,int n)5699 check_num_args(PyObject *ob, int n)
5700 {
5701     if (!PyTuple_CheckExact(ob)) {
5702         PyErr_SetString(PyExc_SystemError,
5703             "PyArg_UnpackTuple() argument list is not a tuple");
5704         return 0;
5705     }
5706     if (n == PyTuple_GET_SIZE(ob))
5707         return 1;
5708     PyErr_Format(
5709         PyExc_TypeError,
5710         "expected %d argument%s, got %zd", n, n == 1 ? "" : "s", PyTuple_GET_SIZE(ob));
5711     return 0;
5712 }
5713 
5714 /* Generic wrappers for overloadable 'operators' such as __getitem__ */
5715 
5716 /* There's a wrapper *function* for each distinct function typedef used
5717    for type object slots (e.g. binaryfunc, ternaryfunc, etc.).  There's a
5718    wrapper *table* for each distinct operation (e.g. __len__, __add__).
5719    Most tables have only one entry; the tables for binary operators have two
5720    entries, one regular and one with reversed arguments. */
5721 
5722 static PyObject *
wrap_lenfunc(PyObject * self,PyObject * args,void * wrapped)5723 wrap_lenfunc(PyObject *self, PyObject *args, void *wrapped)
5724 {
5725     lenfunc func = (lenfunc)wrapped;
5726     Py_ssize_t res;
5727 
5728     if (!check_num_args(args, 0))
5729         return NULL;
5730     res = (*func)(self);
5731     if (res == -1 && PyErr_Occurred())
5732         return NULL;
5733     return PyLong_FromSsize_t(res);
5734 }
5735 
5736 static PyObject *
wrap_inquirypred(PyObject * self,PyObject * args,void * wrapped)5737 wrap_inquirypred(PyObject *self, PyObject *args, void *wrapped)
5738 {
5739     inquiry func = (inquiry)wrapped;
5740     int res;
5741 
5742     if (!check_num_args(args, 0))
5743         return NULL;
5744     res = (*func)(self);
5745     if (res == -1 && PyErr_Occurred())
5746         return NULL;
5747     return PyBool_FromLong((long)res);
5748 }
5749 
5750 static PyObject *
wrap_binaryfunc(PyObject * self,PyObject * args,void * wrapped)5751 wrap_binaryfunc(PyObject *self, PyObject *args, void *wrapped)
5752 {
5753     binaryfunc func = (binaryfunc)wrapped;
5754     PyObject *other;
5755 
5756     if (!check_num_args(args, 1))
5757         return NULL;
5758     other = PyTuple_GET_ITEM(args, 0);
5759     return (*func)(self, other);
5760 }
5761 
5762 static PyObject *
wrap_binaryfunc_l(PyObject * self,PyObject * args,void * wrapped)5763 wrap_binaryfunc_l(PyObject *self, PyObject *args, void *wrapped)
5764 {
5765     binaryfunc func = (binaryfunc)wrapped;
5766     PyObject *other;
5767 
5768     if (!check_num_args(args, 1))
5769         return NULL;
5770     other = PyTuple_GET_ITEM(args, 0);
5771     return (*func)(self, other);
5772 }
5773 
5774 static PyObject *
wrap_binaryfunc_r(PyObject * self,PyObject * args,void * wrapped)5775 wrap_binaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
5776 {
5777     binaryfunc func = (binaryfunc)wrapped;
5778     PyObject *other;
5779 
5780     if (!check_num_args(args, 1))
5781         return NULL;
5782     other = PyTuple_GET_ITEM(args, 0);
5783     return (*func)(other, self);
5784 }
5785 
5786 static PyObject *
wrap_ternaryfunc(PyObject * self,PyObject * args,void * wrapped)5787 wrap_ternaryfunc(PyObject *self, PyObject *args, void *wrapped)
5788 {
5789     ternaryfunc func = (ternaryfunc)wrapped;
5790     PyObject *other;
5791     PyObject *third = Py_None;
5792 
5793     /* Note: This wrapper only works for __pow__() */
5794 
5795     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
5796         return NULL;
5797     return (*func)(self, other, third);
5798 }
5799 
5800 static PyObject *
wrap_ternaryfunc_r(PyObject * self,PyObject * args,void * wrapped)5801 wrap_ternaryfunc_r(PyObject *self, PyObject *args, void *wrapped)
5802 {
5803     ternaryfunc func = (ternaryfunc)wrapped;
5804     PyObject *other;
5805     PyObject *third = Py_None;
5806 
5807     /* Note: This wrapper only works for __pow__() */
5808 
5809     if (!PyArg_UnpackTuple(args, "", 1, 2, &other, &third))
5810         return NULL;
5811     return (*func)(other, self, third);
5812 }
5813 
5814 static PyObject *
wrap_unaryfunc(PyObject * self,PyObject * args,void * wrapped)5815 wrap_unaryfunc(PyObject *self, PyObject *args, void *wrapped)
5816 {
5817     unaryfunc func = (unaryfunc)wrapped;
5818 
5819     if (!check_num_args(args, 0))
5820         return NULL;
5821     return (*func)(self);
5822 }
5823 
5824 static PyObject *
wrap_indexargfunc(PyObject * self,PyObject * args,void * wrapped)5825 wrap_indexargfunc(PyObject *self, PyObject *args, void *wrapped)
5826 {
5827     ssizeargfunc func = (ssizeargfunc)wrapped;
5828     PyObject* o;
5829     Py_ssize_t i;
5830 
5831     if (!PyArg_UnpackTuple(args, "", 1, 1, &o))
5832         return NULL;
5833     i = PyNumber_AsSsize_t(o, PyExc_OverflowError);
5834     if (i == -1 && PyErr_Occurred())
5835         return NULL;
5836     return (*func)(self, i);
5837 }
5838 
5839 static Py_ssize_t
getindex(PyObject * self,PyObject * arg)5840 getindex(PyObject *self, PyObject *arg)
5841 {
5842     Py_ssize_t i;
5843 
5844     i = PyNumber_AsSsize_t(arg, PyExc_OverflowError);
5845     if (i == -1 && PyErr_Occurred())
5846         return -1;
5847     if (i < 0) {
5848         PySequenceMethods *sq = Py_TYPE(self)->tp_as_sequence;
5849         if (sq && sq->sq_length) {
5850             Py_ssize_t n = (*sq->sq_length)(self);
5851             if (n < 0) {
5852                 assert(PyErr_Occurred());
5853                 return -1;
5854             }
5855             i += n;
5856         }
5857     }
5858     return i;
5859 }
5860 
5861 static PyObject *
wrap_sq_item(PyObject * self,PyObject * args,void * wrapped)5862 wrap_sq_item(PyObject *self, PyObject *args, void *wrapped)
5863 {
5864     ssizeargfunc func = (ssizeargfunc)wrapped;
5865     PyObject *arg;
5866     Py_ssize_t i;
5867 
5868     if (PyTuple_GET_SIZE(args) == 1) {
5869         arg = PyTuple_GET_ITEM(args, 0);
5870         i = getindex(self, arg);
5871         if (i == -1 && PyErr_Occurred())
5872             return NULL;
5873         return (*func)(self, i);
5874     }
5875     check_num_args(args, 1);
5876     assert(PyErr_Occurred());
5877     return NULL;
5878 }
5879 
5880 static PyObject *
wrap_sq_setitem(PyObject * self,PyObject * args,void * wrapped)5881 wrap_sq_setitem(PyObject *self, PyObject *args, void *wrapped)
5882 {
5883     ssizeobjargproc func = (ssizeobjargproc)wrapped;
5884     Py_ssize_t i;
5885     int res;
5886     PyObject *arg, *value;
5887 
5888     if (!PyArg_UnpackTuple(args, "", 2, 2, &arg, &value))
5889         return NULL;
5890     i = getindex(self, arg);
5891     if (i == -1 && PyErr_Occurred())
5892         return NULL;
5893     res = (*func)(self, i, value);
5894     if (res == -1 && PyErr_Occurred())
5895         return NULL;
5896     Py_RETURN_NONE;
5897 }
5898 
5899 static PyObject *
wrap_sq_delitem(PyObject * self,PyObject * args,void * wrapped)5900 wrap_sq_delitem(PyObject *self, PyObject *args, void *wrapped)
5901 {
5902     ssizeobjargproc func = (ssizeobjargproc)wrapped;
5903     Py_ssize_t i;
5904     int res;
5905     PyObject *arg;
5906 
5907     if (!check_num_args(args, 1))
5908         return NULL;
5909     arg = PyTuple_GET_ITEM(args, 0);
5910     i = getindex(self, arg);
5911     if (i == -1 && PyErr_Occurred())
5912         return NULL;
5913     res = (*func)(self, i, NULL);
5914     if (res == -1 && PyErr_Occurred())
5915         return NULL;
5916     Py_RETURN_NONE;
5917 }
5918 
5919 /* XXX objobjproc is a misnomer; should be objargpred */
5920 static PyObject *
wrap_objobjproc(PyObject * self,PyObject * args,void * wrapped)5921 wrap_objobjproc(PyObject *self, PyObject *args, void *wrapped)
5922 {
5923     objobjproc func = (objobjproc)wrapped;
5924     int res;
5925     PyObject *value;
5926 
5927     if (!check_num_args(args, 1))
5928         return NULL;
5929     value = PyTuple_GET_ITEM(args, 0);
5930     res = (*func)(self, value);
5931     if (res == -1 && PyErr_Occurred())
5932         return NULL;
5933     else
5934         return PyBool_FromLong(res);
5935 }
5936 
5937 static PyObject *
wrap_objobjargproc(PyObject * self,PyObject * args,void * wrapped)5938 wrap_objobjargproc(PyObject *self, PyObject *args, void *wrapped)
5939 {
5940     objobjargproc func = (objobjargproc)wrapped;
5941     int res;
5942     PyObject *key, *value;
5943 
5944     if (!PyArg_UnpackTuple(args, "", 2, 2, &key, &value))
5945         return NULL;
5946     res = (*func)(self, key, value);
5947     if (res == -1 && PyErr_Occurred())
5948         return NULL;
5949     Py_RETURN_NONE;
5950 }
5951 
5952 static PyObject *
wrap_delitem(PyObject * self,PyObject * args,void * wrapped)5953 wrap_delitem(PyObject *self, PyObject *args, void *wrapped)
5954 {
5955     objobjargproc func = (objobjargproc)wrapped;
5956     int res;
5957     PyObject *key;
5958 
5959     if (!check_num_args(args, 1))
5960         return NULL;
5961     key = PyTuple_GET_ITEM(args, 0);
5962     res = (*func)(self, key, NULL);
5963     if (res == -1 && PyErr_Occurred())
5964         return NULL;
5965     Py_RETURN_NONE;
5966 }
5967 
5968 /* Helper to check for object.__setattr__ or __delattr__ applied to a type.
5969    This is called the Carlo Verre hack after its discoverer.  See
5970    https://mail.python.org/pipermail/python-dev/2003-April/034535.html
5971    */
5972 static int
hackcheck(PyObject * self,setattrofunc func,const char * what)5973 hackcheck(PyObject *self, setattrofunc func, const char *what)
5974 {
5975     PyTypeObject *type = Py_TYPE(self);
5976     PyObject *mro = type->tp_mro;
5977     if (!mro) {
5978         /* Probably ok not to check the call in this case. */
5979         return 1;
5980     }
5981     assert(PyTuple_Check(mro));
5982 
5983     /* Find the (base) type that defined the type's slot function. */
5984     PyTypeObject *defining_type = type;
5985     Py_ssize_t i;
5986     for (i = PyTuple_GET_SIZE(mro) - 1; i >= 0; i--) {
5987         PyTypeObject *base = (PyTypeObject*) PyTuple_GET_ITEM(mro, i);
5988         if (base->tp_setattro == slot_tp_setattro) {
5989             /* Ignore Python classes:
5990                they never define their own C-level setattro. */
5991         }
5992         else if (base->tp_setattro == type->tp_setattro) {
5993             defining_type = base;
5994             break;
5995         }
5996     }
5997 
5998     /* Reject calls that jump over intermediate C-level overrides. */
5999     for (PyTypeObject *base = defining_type; base; base = base->tp_base) {
6000         if (base->tp_setattro == func) {
6001             /* 'func' is the right slot function to call. */
6002             break;
6003         }
6004         else if (base->tp_setattro != slot_tp_setattro) {
6005             /* 'base' is not a Python class and overrides 'func'.
6006                Its tp_setattro should be called instead. */
6007             PyErr_Format(PyExc_TypeError,
6008                          "can't apply this %s to %s object",
6009                          what,
6010                          type->tp_name);
6011             return 0;
6012         }
6013     }
6014     return 1;
6015 }
6016 
6017 static PyObject *
wrap_setattr(PyObject * self,PyObject * args,void * wrapped)6018 wrap_setattr(PyObject *self, PyObject *args, void *wrapped)
6019 {
6020     setattrofunc func = (setattrofunc)wrapped;
6021     int res;
6022     PyObject *name, *value;
6023 
6024     if (!PyArg_UnpackTuple(args, "", 2, 2, &name, &value))
6025         return NULL;
6026     if (!hackcheck(self, func, "__setattr__"))
6027         return NULL;
6028     res = (*func)(self, name, value);
6029     if (res < 0)
6030         return NULL;
6031     Py_RETURN_NONE;
6032 }
6033 
6034 static PyObject *
wrap_delattr(PyObject * self,PyObject * args,void * wrapped)6035 wrap_delattr(PyObject *self, PyObject *args, void *wrapped)
6036 {
6037     setattrofunc func = (setattrofunc)wrapped;
6038     int res;
6039     PyObject *name;
6040 
6041     if (!check_num_args(args, 1))
6042         return NULL;
6043     name = PyTuple_GET_ITEM(args, 0);
6044     if (!hackcheck(self, func, "__delattr__"))
6045         return NULL;
6046     res = (*func)(self, name, NULL);
6047     if (res < 0)
6048         return NULL;
6049     Py_RETURN_NONE;
6050 }
6051 
6052 static PyObject *
wrap_hashfunc(PyObject * self,PyObject * args,void * wrapped)6053 wrap_hashfunc(PyObject *self, PyObject *args, void *wrapped)
6054 {
6055     hashfunc func = (hashfunc)wrapped;
6056     Py_hash_t res;
6057 
6058     if (!check_num_args(args, 0))
6059         return NULL;
6060     res = (*func)(self);
6061     if (res == -1 && PyErr_Occurred())
6062         return NULL;
6063     return PyLong_FromSsize_t(res);
6064 }
6065 
6066 static PyObject *
wrap_call(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)6067 wrap_call(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
6068 {
6069     ternaryfunc func = (ternaryfunc)wrapped;
6070 
6071     return (*func)(self, args, kwds);
6072 }
6073 
6074 static PyObject *
wrap_del(PyObject * self,PyObject * args,void * wrapped)6075 wrap_del(PyObject *self, PyObject *args, void *wrapped)
6076 {
6077     destructor func = (destructor)wrapped;
6078 
6079     if (!check_num_args(args, 0))
6080         return NULL;
6081 
6082     (*func)(self);
6083     Py_RETURN_NONE;
6084 }
6085 
6086 static PyObject *
wrap_richcmpfunc(PyObject * self,PyObject * args,void * wrapped,int op)6087 wrap_richcmpfunc(PyObject *self, PyObject *args, void *wrapped, int op)
6088 {
6089     richcmpfunc func = (richcmpfunc)wrapped;
6090     PyObject *other;
6091 
6092     if (!check_num_args(args, 1))
6093         return NULL;
6094     other = PyTuple_GET_ITEM(args, 0);
6095     return (*func)(self, other, op);
6096 }
6097 
6098 #undef RICHCMP_WRAPPER
6099 #define RICHCMP_WRAPPER(NAME, OP) \
6100 static PyObject * \
6101 richcmp_##NAME(PyObject *self, PyObject *args, void *wrapped) \
6102 { \
6103     return wrap_richcmpfunc(self, args, wrapped, OP); \
6104 }
6105 
RICHCMP_WRAPPER(lt,Py_LT)6106 RICHCMP_WRAPPER(lt, Py_LT)
6107 RICHCMP_WRAPPER(le, Py_LE)
6108 RICHCMP_WRAPPER(eq, Py_EQ)
6109 RICHCMP_WRAPPER(ne, Py_NE)
6110 RICHCMP_WRAPPER(gt, Py_GT)
6111 RICHCMP_WRAPPER(ge, Py_GE)
6112 
6113 static PyObject *
6114 wrap_next(PyObject *self, PyObject *args, void *wrapped)
6115 {
6116     unaryfunc func = (unaryfunc)wrapped;
6117     PyObject *res;
6118 
6119     if (!check_num_args(args, 0))
6120         return NULL;
6121     res = (*func)(self);
6122     if (res == NULL && !PyErr_Occurred())
6123         PyErr_SetNone(PyExc_StopIteration);
6124     return res;
6125 }
6126 
6127 static PyObject *
wrap_descr_get(PyObject * self,PyObject * args,void * wrapped)6128 wrap_descr_get(PyObject *self, PyObject *args, void *wrapped)
6129 {
6130     descrgetfunc func = (descrgetfunc)wrapped;
6131     PyObject *obj;
6132     PyObject *type = NULL;
6133 
6134     if (!PyArg_UnpackTuple(args, "", 1, 2, &obj, &type))
6135         return NULL;
6136     if (obj == Py_None)
6137         obj = NULL;
6138     if (type == Py_None)
6139         type = NULL;
6140     if (type == NULL &&obj == NULL) {
6141         PyErr_SetString(PyExc_TypeError,
6142                         "__get__(None, None) is invalid");
6143         return NULL;
6144     }
6145     return (*func)(self, obj, type);
6146 }
6147 
6148 static PyObject *
wrap_descr_set(PyObject * self,PyObject * args,void * wrapped)6149 wrap_descr_set(PyObject *self, PyObject *args, void *wrapped)
6150 {
6151     descrsetfunc func = (descrsetfunc)wrapped;
6152     PyObject *obj, *value;
6153     int ret;
6154 
6155     if (!PyArg_UnpackTuple(args, "", 2, 2, &obj, &value))
6156         return NULL;
6157     ret = (*func)(self, obj, value);
6158     if (ret < 0)
6159         return NULL;
6160     Py_RETURN_NONE;
6161 }
6162 
6163 static PyObject *
wrap_descr_delete(PyObject * self,PyObject * args,void * wrapped)6164 wrap_descr_delete(PyObject *self, PyObject *args, void *wrapped)
6165 {
6166     descrsetfunc func = (descrsetfunc)wrapped;
6167     PyObject *obj;
6168     int ret;
6169 
6170     if (!check_num_args(args, 1))
6171         return NULL;
6172     obj = PyTuple_GET_ITEM(args, 0);
6173     ret = (*func)(self, obj, NULL);
6174     if (ret < 0)
6175         return NULL;
6176     Py_RETURN_NONE;
6177 }
6178 
6179 static PyObject *
wrap_init(PyObject * self,PyObject * args,void * wrapped,PyObject * kwds)6180 wrap_init(PyObject *self, PyObject *args, void *wrapped, PyObject *kwds)
6181 {
6182     initproc func = (initproc)wrapped;
6183 
6184     if (func(self, args, kwds) < 0)
6185         return NULL;
6186     Py_RETURN_NONE;
6187 }
6188 
6189 static PyObject *
tp_new_wrapper(PyObject * self,PyObject * args,PyObject * kwds)6190 tp_new_wrapper(PyObject *self, PyObject *args, PyObject *kwds)
6191 {
6192     PyTypeObject *type, *subtype, *staticbase;
6193     PyObject *arg0, *res;
6194 
6195     if (self == NULL || !PyType_Check(self)) {
6196         PyErr_Format(PyExc_SystemError,
6197                      "__new__() called with non-type 'self'");
6198         return NULL;
6199     }
6200 
6201     type = (PyTypeObject *)self;
6202     if (!PyTuple_Check(args) || PyTuple_GET_SIZE(args) < 1) {
6203         PyErr_Format(PyExc_TypeError,
6204                      "%s.__new__(): not enough arguments",
6205                      type->tp_name);
6206         return NULL;
6207     }
6208     arg0 = PyTuple_GET_ITEM(args, 0);
6209     if (!PyType_Check(arg0)) {
6210         PyErr_Format(PyExc_TypeError,
6211                      "%s.__new__(X): X is not a type object (%s)",
6212                      type->tp_name,
6213                      Py_TYPE(arg0)->tp_name);
6214         return NULL;
6215     }
6216     subtype = (PyTypeObject *)arg0;
6217     if (!PyType_IsSubtype(subtype, type)) {
6218         PyErr_Format(PyExc_TypeError,
6219                      "%s.__new__(%s): %s is not a subtype of %s",
6220                      type->tp_name,
6221                      subtype->tp_name,
6222                      subtype->tp_name,
6223                      type->tp_name);
6224         return NULL;
6225     }
6226 
6227     /* Check that the use doesn't do something silly and unsafe like
6228        object.__new__(dict).  To do this, we check that the
6229        most derived base that's not a heap type is this type. */
6230     staticbase = subtype;
6231     while (staticbase && (staticbase->tp_new == slot_tp_new))
6232         staticbase = staticbase->tp_base;
6233     /* If staticbase is NULL now, it is a really weird type.
6234        In the spirit of backwards compatibility (?), just shut up. */
6235     if (staticbase && staticbase->tp_new != type->tp_new) {
6236         PyErr_Format(PyExc_TypeError,
6237                      "%s.__new__(%s) is not safe, use %s.__new__()",
6238                      type->tp_name,
6239                      subtype->tp_name,
6240                      staticbase->tp_name);
6241         return NULL;
6242     }
6243 
6244     args = PyTuple_GetSlice(args, 1, PyTuple_GET_SIZE(args));
6245     if (args == NULL)
6246         return NULL;
6247     res = type->tp_new(subtype, args, kwds);
6248     Py_DECREF(args);
6249     return res;
6250 }
6251 
6252 static struct PyMethodDef tp_new_methoddef[] = {
6253     {"__new__", (PyCFunction)(void(*)(void))tp_new_wrapper, METH_VARARGS|METH_KEYWORDS,
6254      PyDoc_STR("__new__($type, *args, **kwargs)\n--\n\n"
6255                "Create and return a new object.  "
6256                "See help(type) for accurate signature.")},
6257     {0}
6258 };
6259 
6260 static int
add_tp_new_wrapper(PyTypeObject * type)6261 add_tp_new_wrapper(PyTypeObject *type)
6262 {
6263     PyObject *func;
6264 
6265     if (_PyDict_GetItemIdWithError(type->tp_dict, &PyId___new__) != NULL)
6266         return 0;
6267     if (PyErr_Occurred())
6268         return -1;
6269     func = PyCFunction_NewEx(tp_new_methoddef, (PyObject *)type, NULL);
6270     if (func == NULL)
6271         return -1;
6272     if (_PyDict_SetItemId(type->tp_dict, &PyId___new__, func)) {
6273         Py_DECREF(func);
6274         return -1;
6275     }
6276     Py_DECREF(func);
6277     return 0;
6278 }
6279 
6280 /* Slot wrappers that call the corresponding __foo__ slot.  See comments
6281    below at override_slots() for more explanation. */
6282 
6283 #define SLOT0(FUNCNAME, OPSTR) \
6284 static PyObject * \
6285 FUNCNAME(PyObject *self) \
6286 { \
6287     PyObject* stack[1] = {self}; \
6288     _Py_static_string(id, OPSTR); \
6289     return vectorcall_method(&id, stack, 1); \
6290 }
6291 
6292 #define SLOT1(FUNCNAME, OPSTR, ARG1TYPE) \
6293 static PyObject * \
6294 FUNCNAME(PyObject *self, ARG1TYPE arg1) \
6295 { \
6296     PyObject* stack[2] = {self, arg1}; \
6297     _Py_static_string(id, OPSTR); \
6298     return vectorcall_method(&id, stack, 2); \
6299 }
6300 
6301 /* Boolean helper for SLOT1BINFULL().
6302    right.__class__ is a nontrivial subclass of left.__class__. */
6303 static int
method_is_overloaded(PyObject * left,PyObject * right,struct _Py_Identifier * name)6304 method_is_overloaded(PyObject *left, PyObject *right, struct _Py_Identifier *name)
6305 {
6306     PyObject *a, *b;
6307     int ok;
6308 
6309     if (_PyObject_LookupAttrId((PyObject *)(Py_TYPE(right)), name, &b) < 0) {
6310         return -1;
6311     }
6312     if (b == NULL) {
6313         /* If right doesn't have it, it's not overloaded */
6314         return 0;
6315     }
6316 
6317     if (_PyObject_LookupAttrId((PyObject *)(Py_TYPE(left)), name, &a) < 0) {
6318         Py_DECREF(b);
6319         return -1;
6320     }
6321     if (a == NULL) {
6322         Py_DECREF(b);
6323         /* If right has it but left doesn't, it's overloaded */
6324         return 1;
6325     }
6326 
6327     ok = PyObject_RichCompareBool(a, b, Py_NE);
6328     Py_DECREF(a);
6329     Py_DECREF(b);
6330     return ok;
6331 }
6332 
6333 
6334 #define SLOT1BINFULL(FUNCNAME, TESTFUNC, SLOTNAME, OPSTR, ROPSTR) \
6335 static PyObject * \
6336 FUNCNAME(PyObject *self, PyObject *other) \
6337 { \
6338     PyObject* stack[2]; \
6339     PyThreadState *tstate = _PyThreadState_GET(); \
6340     _Py_static_string(op_id, OPSTR); \
6341     _Py_static_string(rop_id, ROPSTR); \
6342     int do_other = !Py_IS_TYPE(self, Py_TYPE(other)) && \
6343         Py_TYPE(other)->tp_as_number != NULL && \
6344         Py_TYPE(other)->tp_as_number->SLOTNAME == TESTFUNC; \
6345     if (Py_TYPE(self)->tp_as_number != NULL && \
6346         Py_TYPE(self)->tp_as_number->SLOTNAME == TESTFUNC) { \
6347         PyObject *r; \
6348         if (do_other && PyType_IsSubtype(Py_TYPE(other), Py_TYPE(self))) { \
6349             int ok = method_is_overloaded(self, other, &rop_id); \
6350             if (ok < 0) { \
6351                 return NULL; \
6352             } \
6353             if (ok) { \
6354                 stack[0] = other; \
6355                 stack[1] = self; \
6356                 r = vectorcall_maybe(tstate, &rop_id, stack, 2); \
6357                 if (r != Py_NotImplemented) \
6358                     return r; \
6359                 Py_DECREF(r); \
6360                 do_other = 0; \
6361             } \
6362         } \
6363         stack[0] = self; \
6364         stack[1] = other; \
6365         r = vectorcall_maybe(tstate, &op_id, stack, 2); \
6366         if (r != Py_NotImplemented || \
6367             Py_IS_TYPE(other, Py_TYPE(self))) \
6368             return r; \
6369         Py_DECREF(r); \
6370     } \
6371     if (do_other) { \
6372         stack[0] = other; \
6373         stack[1] = self; \
6374         return vectorcall_maybe(tstate, &rop_id, stack, 2); \
6375     } \
6376     Py_RETURN_NOTIMPLEMENTED; \
6377 }
6378 
6379 #define SLOT1BIN(FUNCNAME, SLOTNAME, OPSTR, ROPSTR) \
6380     SLOT1BINFULL(FUNCNAME, FUNCNAME, SLOTNAME, OPSTR, ROPSTR)
6381 
6382 static Py_ssize_t
slot_sq_length(PyObject * self)6383 slot_sq_length(PyObject *self)
6384 {
6385     PyObject* stack[1] = {self};
6386     PyObject *res = vectorcall_method(&PyId___len__, stack, 1);
6387     Py_ssize_t len;
6388 
6389     if (res == NULL)
6390         return -1;
6391 
6392     Py_SETREF(res, PyNumber_Index(res));
6393     if (res == NULL)
6394         return -1;
6395 
6396     assert(PyLong_Check(res));
6397     if (Py_SIZE(res) < 0) {
6398         Py_DECREF(res);
6399         PyErr_SetString(PyExc_ValueError,
6400                         "__len__() should return >= 0");
6401         return -1;
6402     }
6403 
6404     len = PyNumber_AsSsize_t(res, PyExc_OverflowError);
6405     assert(len >= 0 || PyErr_ExceptionMatches(PyExc_OverflowError));
6406     Py_DECREF(res);
6407     return len;
6408 }
6409 
6410 static PyObject *
slot_sq_item(PyObject * self,Py_ssize_t i)6411 slot_sq_item(PyObject *self, Py_ssize_t i)
6412 {
6413     PyObject *ival = PyLong_FromSsize_t(i);
6414     if (ival == NULL) {
6415         return NULL;
6416     }
6417     PyObject *stack[2] = {self, ival};
6418     PyObject *retval = vectorcall_method(&PyId___getitem__, stack, 2);
6419     Py_DECREF(ival);
6420     return retval;
6421 }
6422 
6423 static int
slot_sq_ass_item(PyObject * self,Py_ssize_t index,PyObject * value)6424 slot_sq_ass_item(PyObject *self, Py_ssize_t index, PyObject *value)
6425 {
6426     PyObject *stack[3];
6427     PyObject *res;
6428     PyObject *index_obj;
6429 
6430     index_obj = PyLong_FromSsize_t(index);
6431     if (index_obj == NULL) {
6432         return -1;
6433     }
6434 
6435     stack[0] = self;
6436     stack[1] = index_obj;
6437     if (value == NULL) {
6438         res = vectorcall_method(&PyId___delitem__, stack, 2);
6439     }
6440     else {
6441         stack[2] = value;
6442         res = vectorcall_method(&PyId___setitem__, stack, 3);
6443     }
6444     Py_DECREF(index_obj);
6445 
6446     if (res == NULL) {
6447         return -1;
6448     }
6449     Py_DECREF(res);
6450     return 0;
6451 }
6452 
6453 static int
slot_sq_contains(PyObject * self,PyObject * value)6454 slot_sq_contains(PyObject *self, PyObject *value)
6455 {
6456     PyThreadState *tstate = _PyThreadState_GET();
6457     PyObject *func, *res;
6458     int result = -1, unbound;
6459     _Py_IDENTIFIER(__contains__);
6460 
6461     func = lookup_maybe_method(self, &PyId___contains__, &unbound);
6462     if (func == Py_None) {
6463         Py_DECREF(func);
6464         PyErr_Format(PyExc_TypeError,
6465                      "'%.200s' object is not a container",
6466                      Py_TYPE(self)->tp_name);
6467         return -1;
6468     }
6469     if (func != NULL) {
6470         PyObject *args[2] = {self, value};
6471         res = vectorcall_unbound(tstate, unbound, func, args, 2);
6472         Py_DECREF(func);
6473         if (res != NULL) {
6474             result = PyObject_IsTrue(res);
6475             Py_DECREF(res);
6476         }
6477     }
6478     else if (! PyErr_Occurred()) {
6479         /* Possible results: -1 and 1 */
6480         result = (int)_PySequence_IterSearch(self, value,
6481                                          PY_ITERSEARCH_CONTAINS);
6482     }
6483     return result;
6484 }
6485 
6486 #define slot_mp_length slot_sq_length
6487 
6488 SLOT1(slot_mp_subscript, "__getitem__", PyObject *)
6489 
6490 static int
slot_mp_ass_subscript(PyObject * self,PyObject * key,PyObject * value)6491 slot_mp_ass_subscript(PyObject *self, PyObject *key, PyObject *value)
6492 {
6493     PyObject *stack[3];
6494     PyObject *res;
6495 
6496     stack[0] = self;
6497     stack[1] = key;
6498     if (value == NULL) {
6499         res = vectorcall_method(&PyId___delitem__, stack, 2);
6500     }
6501     else {
6502         stack[2] = value;
6503         res = vectorcall_method(&PyId___setitem__, stack, 3);
6504     }
6505 
6506     if (res == NULL)
6507         return -1;
6508     Py_DECREF(res);
6509     return 0;
6510 }
6511 
6512 SLOT1BIN(slot_nb_add, nb_add, "__add__", "__radd__")
6513 SLOT1BIN(slot_nb_subtract, nb_subtract, "__sub__", "__rsub__")
6514 SLOT1BIN(slot_nb_multiply, nb_multiply, "__mul__", "__rmul__")
6515 SLOT1BIN(slot_nb_matrix_multiply, nb_matrix_multiply, "__matmul__", "__rmatmul__")
6516 SLOT1BIN(slot_nb_remainder, nb_remainder, "__mod__", "__rmod__")
6517 SLOT1BIN(slot_nb_divmod, nb_divmod, "__divmod__", "__rdivmod__")
6518 
6519 static PyObject *slot_nb_power(PyObject *, PyObject *, PyObject *);
6520 
6521 SLOT1BINFULL(slot_nb_power_binary, slot_nb_power,
6522              nb_power, "__pow__", "__rpow__")
6523 
6524 static PyObject *
slot_nb_power(PyObject * self,PyObject * other,PyObject * modulus)6525 slot_nb_power(PyObject *self, PyObject *other, PyObject *modulus)
6526 {
6527     _Py_IDENTIFIER(__pow__);
6528 
6529     if (modulus == Py_None)
6530         return slot_nb_power_binary(self, other);
6531     /* Three-arg power doesn't use __rpow__.  But ternary_op
6532        can call this when the second argument's type uses
6533        slot_nb_power, so check before calling self.__pow__. */
6534     if (Py_TYPE(self)->tp_as_number != NULL &&
6535         Py_TYPE(self)->tp_as_number->nb_power == slot_nb_power) {
6536         PyObject* stack[3] = {self, other, modulus};
6537         return vectorcall_method(&PyId___pow__, stack, 3);
6538     }
6539     Py_RETURN_NOTIMPLEMENTED;
6540 }
6541 
6542 SLOT0(slot_nb_negative, "__neg__")
6543 SLOT0(slot_nb_positive, "__pos__")
6544 SLOT0(slot_nb_absolute, "__abs__")
6545 
6546 static int
slot_nb_bool(PyObject * self)6547 slot_nb_bool(PyObject *self)
6548 {
6549     PyObject *func, *value;
6550     int result, unbound;
6551     int using_len = 0;
6552     _Py_IDENTIFIER(__bool__);
6553 
6554     func = lookup_maybe_method(self, &PyId___bool__, &unbound);
6555     if (func == NULL) {
6556         if (PyErr_Occurred()) {
6557             return -1;
6558         }
6559 
6560         func = lookup_maybe_method(self, &PyId___len__, &unbound);
6561         if (func == NULL) {
6562             if (PyErr_Occurred()) {
6563                 return -1;
6564             }
6565             return 1;
6566         }
6567         using_len = 1;
6568     }
6569 
6570     value = call_unbound_noarg(unbound, func, self);
6571     if (value == NULL) {
6572         goto error;
6573     }
6574 
6575     if (using_len) {
6576         /* bool type enforced by slot_nb_len */
6577         result = PyObject_IsTrue(value);
6578     }
6579     else if (PyBool_Check(value)) {
6580         result = PyObject_IsTrue(value);
6581     }
6582     else {
6583         PyErr_Format(PyExc_TypeError,
6584                      "__bool__ should return "
6585                      "bool, returned %s",
6586                      Py_TYPE(value)->tp_name);
6587         result = -1;
6588     }
6589 
6590     Py_DECREF(value);
6591     Py_DECREF(func);
6592     return result;
6593 
6594 error:
6595     Py_DECREF(func);
6596     return -1;
6597 }
6598 
6599 
6600 static PyObject *
slot_nb_index(PyObject * self)6601 slot_nb_index(PyObject *self)
6602 {
6603     _Py_IDENTIFIER(__index__);
6604     PyObject *stack[1] = {self};
6605     return vectorcall_method(&PyId___index__, stack, 1);
6606 }
6607 
6608 
6609 SLOT0(slot_nb_invert, "__invert__")
6610 SLOT1BIN(slot_nb_lshift, nb_lshift, "__lshift__", "__rlshift__")
6611 SLOT1BIN(slot_nb_rshift, nb_rshift, "__rshift__", "__rrshift__")
6612 SLOT1BIN(slot_nb_and, nb_and, "__and__", "__rand__")
6613 SLOT1BIN(slot_nb_xor, nb_xor, "__xor__", "__rxor__")
6614 SLOT1BIN(slot_nb_or, nb_or, "__or__", "__ror__")
6615 
6616 SLOT0(slot_nb_int, "__int__")
6617 SLOT0(slot_nb_float, "__float__")
6618 SLOT1(slot_nb_inplace_add, "__iadd__", PyObject *)
6619 SLOT1(slot_nb_inplace_subtract, "__isub__", PyObject *)
6620 SLOT1(slot_nb_inplace_multiply, "__imul__", PyObject *)
6621 SLOT1(slot_nb_inplace_matrix_multiply, "__imatmul__", PyObject *)
6622 SLOT1(slot_nb_inplace_remainder, "__imod__", PyObject *)
6623 /* Can't use SLOT1 here, because nb_inplace_power is ternary */
6624 static PyObject *
slot_nb_inplace_power(PyObject * self,PyObject * arg1,PyObject * arg2)6625 slot_nb_inplace_power(PyObject *self, PyObject * arg1, PyObject *arg2)
6626 {
6627     PyObject *stack[2] = {self, arg1};
6628     _Py_IDENTIFIER(__ipow__);
6629     return vectorcall_method(&PyId___ipow__, stack, 2);
6630 }
6631 SLOT1(slot_nb_inplace_lshift, "__ilshift__", PyObject *)
6632 SLOT1(slot_nb_inplace_rshift, "__irshift__", PyObject *)
6633 SLOT1(slot_nb_inplace_and, "__iand__", PyObject *)
6634 SLOT1(slot_nb_inplace_xor, "__ixor__", PyObject *)
6635 SLOT1(slot_nb_inplace_or, "__ior__", PyObject *)
6636 SLOT1BIN(slot_nb_floor_divide, nb_floor_divide,
6637          "__floordiv__", "__rfloordiv__")
6638 SLOT1BIN(slot_nb_true_divide, nb_true_divide, "__truediv__", "__rtruediv__")
6639 SLOT1(slot_nb_inplace_floor_divide, "__ifloordiv__", PyObject *)
6640 SLOT1(slot_nb_inplace_true_divide, "__itruediv__", PyObject *)
6641 
6642 static PyObject *
slot_tp_repr(PyObject * self)6643 slot_tp_repr(PyObject *self)
6644 {
6645     PyObject *func, *res;
6646     _Py_IDENTIFIER(__repr__);
6647     int unbound;
6648 
6649     func = lookup_maybe_method(self, &PyId___repr__, &unbound);
6650     if (func != NULL) {
6651         res = call_unbound_noarg(unbound, func, self);
6652         Py_DECREF(func);
6653         return res;
6654     }
6655     PyErr_Clear();
6656     return PyUnicode_FromFormat("<%s object at %p>",
6657                                Py_TYPE(self)->tp_name, self);
6658 }
6659 
6660 SLOT0(slot_tp_str, "__str__")
6661 
6662 static Py_hash_t
slot_tp_hash(PyObject * self)6663 slot_tp_hash(PyObject *self)
6664 {
6665     PyObject *func, *res;
6666     Py_ssize_t h;
6667     int unbound;
6668 
6669     func = lookup_maybe_method(self, &PyId___hash__, &unbound);
6670 
6671     if (func == Py_None) {
6672         Py_DECREF(func);
6673         func = NULL;
6674     }
6675 
6676     if (func == NULL) {
6677         return PyObject_HashNotImplemented(self);
6678     }
6679 
6680     res = call_unbound_noarg(unbound, func, self);
6681     Py_DECREF(func);
6682     if (res == NULL)
6683         return -1;
6684 
6685     if (!PyLong_Check(res)) {
6686         PyErr_SetString(PyExc_TypeError,
6687                         "__hash__ method should return an integer");
6688         return -1;
6689     }
6690     /* Transform the PyLong `res` to a Py_hash_t `h`.  For an existing
6691        hashable Python object x, hash(x) will always lie within the range of
6692        Py_hash_t.  Therefore our transformation must preserve values that
6693        already lie within this range, to ensure that if x.__hash__() returns
6694        hash(y) then hash(x) == hash(y). */
6695     h = PyLong_AsSsize_t(res);
6696     if (h == -1 && PyErr_Occurred()) {
6697         /* res was not within the range of a Py_hash_t, so we're free to
6698            use any sufficiently bit-mixing transformation;
6699            long.__hash__ will do nicely. */
6700         PyErr_Clear();
6701         h = PyLong_Type.tp_hash(res);
6702     }
6703     /* -1 is reserved for errors. */
6704     if (h == -1)
6705         h = -2;
6706     Py_DECREF(res);
6707     return h;
6708 }
6709 
6710 static PyObject *
slot_tp_call(PyObject * self,PyObject * args,PyObject * kwds)6711 slot_tp_call(PyObject *self, PyObject *args, PyObject *kwds)
6712 {
6713     PyThreadState *tstate = _PyThreadState_GET();
6714     _Py_IDENTIFIER(__call__);
6715     int unbound;
6716 
6717     PyObject *meth = lookup_method(self, &PyId___call__, &unbound);
6718     if (meth == NULL) {
6719         return NULL;
6720     }
6721 
6722     PyObject *res;
6723     if (unbound) {
6724         res = _PyObject_Call_Prepend(tstate, meth, self, args, kwds);
6725     }
6726     else {
6727         res = _PyObject_Call(tstate, meth, args, kwds);
6728     }
6729 
6730     Py_DECREF(meth);
6731     return res;
6732 }
6733 
6734 /* There are two slot dispatch functions for tp_getattro.
6735 
6736    - slot_tp_getattro() is used when __getattribute__ is overridden
6737      but no __getattr__ hook is present;
6738 
6739    - slot_tp_getattr_hook() is used when a __getattr__ hook is present.
6740 
6741    The code in update_one_slot() always installs slot_tp_getattr_hook(); this
6742    detects the absence of __getattr__ and then installs the simpler slot if
6743    necessary. */
6744 
6745 static PyObject *
slot_tp_getattro(PyObject * self,PyObject * name)6746 slot_tp_getattro(PyObject *self, PyObject *name)
6747 {
6748     PyObject *stack[2] = {self, name};
6749     return vectorcall_method(&PyId___getattribute__, stack, 2);
6750 }
6751 
6752 static PyObject *
call_attribute(PyObject * self,PyObject * attr,PyObject * name)6753 call_attribute(PyObject *self, PyObject *attr, PyObject *name)
6754 {
6755     PyObject *res, *descr = NULL;
6756     descrgetfunc f = Py_TYPE(attr)->tp_descr_get;
6757 
6758     if (f != NULL) {
6759         descr = f(attr, self, (PyObject *)(Py_TYPE(self)));
6760         if (descr == NULL)
6761             return NULL;
6762         else
6763             attr = descr;
6764     }
6765     res = PyObject_CallOneArg(attr, name);
6766     Py_XDECREF(descr);
6767     return res;
6768 }
6769 
6770 static PyObject *
slot_tp_getattr_hook(PyObject * self,PyObject * name)6771 slot_tp_getattr_hook(PyObject *self, PyObject *name)
6772 {
6773     PyTypeObject *tp = Py_TYPE(self);
6774     PyObject *getattr, *getattribute, *res;
6775     _Py_IDENTIFIER(__getattr__);
6776 
6777     /* speed hack: we could use lookup_maybe, but that would resolve the
6778        method fully for each attribute lookup for classes with
6779        __getattr__, even when the attribute is present. So we use
6780        _PyType_Lookup and create the method only when needed, with
6781        call_attribute. */
6782     getattr = _PyType_LookupId(tp, &PyId___getattr__);
6783     if (getattr == NULL) {
6784         /* No __getattr__ hook: use a simpler dispatcher */
6785         tp->tp_getattro = slot_tp_getattro;
6786         return slot_tp_getattro(self, name);
6787     }
6788     Py_INCREF(getattr);
6789     /* speed hack: we could use lookup_maybe, but that would resolve the
6790        method fully for each attribute lookup for classes with
6791        __getattr__, even when self has the default __getattribute__
6792        method. So we use _PyType_Lookup and create the method only when
6793        needed, with call_attribute. */
6794     getattribute = _PyType_LookupId(tp, &PyId___getattribute__);
6795     if (getattribute == NULL ||
6796         (Py_IS_TYPE(getattribute, &PyWrapperDescr_Type) &&
6797          ((PyWrapperDescrObject *)getattribute)->d_wrapped ==
6798          (void *)PyObject_GenericGetAttr))
6799         res = PyObject_GenericGetAttr(self, name);
6800     else {
6801         Py_INCREF(getattribute);
6802         res = call_attribute(self, getattribute, name);
6803         Py_DECREF(getattribute);
6804     }
6805     if (res == NULL && PyErr_ExceptionMatches(PyExc_AttributeError)) {
6806         PyErr_Clear();
6807         res = call_attribute(self, getattr, name);
6808     }
6809     Py_DECREF(getattr);
6810     return res;
6811 }
6812 
6813 static int
slot_tp_setattro(PyObject * self,PyObject * name,PyObject * value)6814 slot_tp_setattro(PyObject *self, PyObject *name, PyObject *value)
6815 {
6816     PyObject *stack[3];
6817     PyObject *res;
6818     _Py_IDENTIFIER(__delattr__);
6819     _Py_IDENTIFIER(__setattr__);
6820 
6821     stack[0] = self;
6822     stack[1] = name;
6823     if (value == NULL) {
6824         res = vectorcall_method(&PyId___delattr__, stack, 2);
6825     }
6826     else {
6827         stack[2] = value;
6828         res = vectorcall_method(&PyId___setattr__, stack, 3);
6829     }
6830     if (res == NULL)
6831         return -1;
6832     Py_DECREF(res);
6833     return 0;
6834 }
6835 
6836 static _Py_Identifier name_op[] = {
6837     _Py_static_string_init("__lt__"),
6838     _Py_static_string_init("__le__"),
6839     _Py_static_string_init("__eq__"),
6840     _Py_static_string_init("__ne__"),
6841     _Py_static_string_init("__gt__"),
6842     _Py_static_string_init("__ge__"),
6843 };
6844 
6845 static PyObject *
slot_tp_richcompare(PyObject * self,PyObject * other,int op)6846 slot_tp_richcompare(PyObject *self, PyObject *other, int op)
6847 {
6848     PyThreadState *tstate = _PyThreadState_GET();
6849 
6850     int unbound;
6851     PyObject *func = lookup_maybe_method(self, &name_op[op], &unbound);
6852     if (func == NULL) {
6853         PyErr_Clear();
6854         Py_RETURN_NOTIMPLEMENTED;
6855     }
6856 
6857     PyObject *stack[2] = {self, other};
6858     PyObject *res = vectorcall_unbound(tstate, unbound, func, stack, 2);
6859     Py_DECREF(func);
6860     return res;
6861 }
6862 
6863 static PyObject *
slot_tp_iter(PyObject * self)6864 slot_tp_iter(PyObject *self)
6865 {
6866     int unbound;
6867     PyObject *func, *res;
6868     _Py_IDENTIFIER(__iter__);
6869 
6870     func = lookup_maybe_method(self, &PyId___iter__, &unbound);
6871     if (func == Py_None) {
6872         Py_DECREF(func);
6873         PyErr_Format(PyExc_TypeError,
6874                      "'%.200s' object is not iterable",
6875                      Py_TYPE(self)->tp_name);
6876         return NULL;
6877     }
6878 
6879     if (func != NULL) {
6880         res = call_unbound_noarg(unbound, func, self);
6881         Py_DECREF(func);
6882         return res;
6883     }
6884 
6885     PyErr_Clear();
6886     func = lookup_maybe_method(self, &PyId___getitem__, &unbound);
6887     if (func == NULL) {
6888         PyErr_Format(PyExc_TypeError,
6889                      "'%.200s' object is not iterable",
6890                      Py_TYPE(self)->tp_name);
6891         return NULL;
6892     }
6893     Py_DECREF(func);
6894     return PySeqIter_New(self);
6895 }
6896 
6897 static PyObject *
slot_tp_iternext(PyObject * self)6898 slot_tp_iternext(PyObject *self)
6899 {
6900     _Py_IDENTIFIER(__next__);
6901     PyObject *stack[1] = {self};
6902     return vectorcall_method(&PyId___next__, stack, 1);
6903 }
6904 
6905 static PyObject *
slot_tp_descr_get(PyObject * self,PyObject * obj,PyObject * type)6906 slot_tp_descr_get(PyObject *self, PyObject *obj, PyObject *type)
6907 {
6908     PyTypeObject *tp = Py_TYPE(self);
6909     PyObject *get;
6910     _Py_IDENTIFIER(__get__);
6911 
6912     get = _PyType_LookupId(tp, &PyId___get__);
6913     if (get == NULL) {
6914         /* Avoid further slowdowns */
6915         if (tp->tp_descr_get == slot_tp_descr_get)
6916             tp->tp_descr_get = NULL;
6917         Py_INCREF(self);
6918         return self;
6919     }
6920     if (obj == NULL)
6921         obj = Py_None;
6922     if (type == NULL)
6923         type = Py_None;
6924     return PyObject_CallFunctionObjArgs(get, self, obj, type, NULL);
6925 }
6926 
6927 static int
slot_tp_descr_set(PyObject * self,PyObject * target,PyObject * value)6928 slot_tp_descr_set(PyObject *self, PyObject *target, PyObject *value)
6929 {
6930     PyObject* stack[3];
6931     PyObject *res;
6932     _Py_IDENTIFIER(__delete__);
6933     _Py_IDENTIFIER(__set__);
6934 
6935     stack[0] = self;
6936     stack[1] = target;
6937     if (value == NULL) {
6938         res = vectorcall_method(&PyId___delete__, stack, 2);
6939     }
6940     else {
6941         stack[2] = value;
6942         res = vectorcall_method(&PyId___set__, stack, 3);
6943     }
6944     if (res == NULL)
6945         return -1;
6946     Py_DECREF(res);
6947     return 0;
6948 }
6949 
6950 static int
slot_tp_init(PyObject * self,PyObject * args,PyObject * kwds)6951 slot_tp_init(PyObject *self, PyObject *args, PyObject *kwds)
6952 {
6953     PyThreadState *tstate = _PyThreadState_GET();
6954 
6955     _Py_IDENTIFIER(__init__);
6956     int unbound;
6957     PyObject *meth = lookup_method(self, &PyId___init__, &unbound);
6958     if (meth == NULL) {
6959         return -1;
6960     }
6961 
6962     PyObject *res;
6963     if (unbound) {
6964         res = _PyObject_Call_Prepend(tstate, meth, self, args, kwds);
6965     }
6966     else {
6967         res = _PyObject_Call(tstate, meth, args, kwds);
6968     }
6969     Py_DECREF(meth);
6970     if (res == NULL)
6971         return -1;
6972     if (res != Py_None) {
6973         PyErr_Format(PyExc_TypeError,
6974                      "__init__() should return None, not '%.200s'",
6975                      Py_TYPE(res)->tp_name);
6976         Py_DECREF(res);
6977         return -1;
6978     }
6979     Py_DECREF(res);
6980     return 0;
6981 }
6982 
6983 static PyObject *
slot_tp_new(PyTypeObject * type,PyObject * args,PyObject * kwds)6984 slot_tp_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
6985 {
6986     PyThreadState *tstate = _PyThreadState_GET();
6987     PyObject *func, *result;
6988 
6989     func = _PyObject_GetAttrId((PyObject *)type, &PyId___new__);
6990     if (func == NULL) {
6991         return NULL;
6992     }
6993 
6994     result = _PyObject_Call_Prepend(tstate, func, (PyObject *)type, args, kwds);
6995     Py_DECREF(func);
6996     return result;
6997 }
6998 
6999 static void
slot_tp_finalize(PyObject * self)7000 slot_tp_finalize(PyObject *self)
7001 {
7002     _Py_IDENTIFIER(__del__);
7003     int unbound;
7004     PyObject *del, *res;
7005     PyObject *error_type, *error_value, *error_traceback;
7006 
7007     /* Save the current exception, if any. */
7008     PyErr_Fetch(&error_type, &error_value, &error_traceback);
7009 
7010     /* Execute __del__ method, if any. */
7011     del = lookup_maybe_method(self, &PyId___del__, &unbound);
7012     if (del != NULL) {
7013         res = call_unbound_noarg(unbound, del, self);
7014         if (res == NULL)
7015             PyErr_WriteUnraisable(del);
7016         else
7017             Py_DECREF(res);
7018         Py_DECREF(del);
7019     }
7020 
7021     /* Restore the saved exception. */
7022     PyErr_Restore(error_type, error_value, error_traceback);
7023 }
7024 
7025 static PyObject *
slot_am_await(PyObject * self)7026 slot_am_await(PyObject *self)
7027 {
7028     int unbound;
7029     PyObject *func, *res;
7030     _Py_IDENTIFIER(__await__);
7031 
7032     func = lookup_maybe_method(self, &PyId___await__, &unbound);
7033     if (func != NULL) {
7034         res = call_unbound_noarg(unbound, func, self);
7035         Py_DECREF(func);
7036         return res;
7037     }
7038     PyErr_Format(PyExc_AttributeError,
7039                  "object %.50s does not have __await__ method",
7040                  Py_TYPE(self)->tp_name);
7041     return NULL;
7042 }
7043 
7044 static PyObject *
slot_am_aiter(PyObject * self)7045 slot_am_aiter(PyObject *self)
7046 {
7047     int unbound;
7048     PyObject *func, *res;
7049     _Py_IDENTIFIER(__aiter__);
7050 
7051     func = lookup_maybe_method(self, &PyId___aiter__, &unbound);
7052     if (func != NULL) {
7053         res = call_unbound_noarg(unbound, func, self);
7054         Py_DECREF(func);
7055         return res;
7056     }
7057     PyErr_Format(PyExc_AttributeError,
7058                  "object %.50s does not have __aiter__ method",
7059                  Py_TYPE(self)->tp_name);
7060     return NULL;
7061 }
7062 
7063 static PyObject *
slot_am_anext(PyObject * self)7064 slot_am_anext(PyObject *self)
7065 {
7066     int unbound;
7067     PyObject *func, *res;
7068     _Py_IDENTIFIER(__anext__);
7069 
7070     func = lookup_maybe_method(self, &PyId___anext__, &unbound);
7071     if (func != NULL) {
7072         res = call_unbound_noarg(unbound, func, self);
7073         Py_DECREF(func);
7074         return res;
7075     }
7076     PyErr_Format(PyExc_AttributeError,
7077                  "object %.50s does not have __anext__ method",
7078                  Py_TYPE(self)->tp_name);
7079     return NULL;
7080 }
7081 
7082 /*
7083 Table mapping __foo__ names to tp_foo offsets and slot_tp_foo wrapper functions.
7084 
7085 The table is ordered by offsets relative to the 'PyHeapTypeObject' structure,
7086 which incorporates the additional structures used for numbers, sequences and
7087 mappings.  Note that multiple names may map to the same slot (e.g. __eq__,
7088 __ne__ etc. all map to tp_richcompare) and one name may map to multiple slots
7089 (e.g. __str__ affects tp_str as well as tp_repr). The table is terminated with
7090 an all-zero entry.  (This table is further initialized in
7091 _PyTypes_InitSlotDefs().)
7092 */
7093 
7094 typedef struct wrapperbase slotdef;
7095 
7096 #undef TPSLOT
7097 #undef FLSLOT
7098 #undef AMSLOT
7099 #undef ETSLOT
7100 #undef SQSLOT
7101 #undef MPSLOT
7102 #undef NBSLOT
7103 #undef UNSLOT
7104 #undef IBSLOT
7105 #undef BINSLOT
7106 #undef RBINSLOT
7107 
7108 #define TPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7109     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7110      PyDoc_STR(DOC)}
7111 #define FLSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC, FLAGS) \
7112     {NAME, offsetof(PyTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7113      PyDoc_STR(DOC), FLAGS}
7114 #define ETSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7115     {NAME, offsetof(PyHeapTypeObject, SLOT), (void *)(FUNCTION), WRAPPER, \
7116      PyDoc_STR(DOC)}
7117 #define AMSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7118     ETSLOT(NAME, as_async.SLOT, FUNCTION, WRAPPER, DOC)
7119 #define SQSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7120     ETSLOT(NAME, as_sequence.SLOT, FUNCTION, WRAPPER, DOC)
7121 #define MPSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7122     ETSLOT(NAME, as_mapping.SLOT, FUNCTION, WRAPPER, DOC)
7123 #define NBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7124     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, DOC)
7125 #define UNSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7126     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
7127            NAME "($self, /)\n--\n\n" DOC)
7128 #define IBSLOT(NAME, SLOT, FUNCTION, WRAPPER, DOC) \
7129     ETSLOT(NAME, as_number.SLOT, FUNCTION, WRAPPER, \
7130            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
7131 #define BINSLOT(NAME, SLOT, FUNCTION, DOC) \
7132     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
7133            NAME "($self, value, /)\n--\n\nReturn self" DOC "value.")
7134 #define RBINSLOT(NAME, SLOT, FUNCTION, DOC) \
7135     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
7136            NAME "($self, value, /)\n--\n\nReturn value" DOC "self.")
7137 #define BINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
7138     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_l, \
7139            NAME "($self, value, /)\n--\n\n" DOC)
7140 #define RBINSLOTNOTINFIX(NAME, SLOT, FUNCTION, DOC) \
7141     ETSLOT(NAME, as_number.SLOT, FUNCTION, wrap_binaryfunc_r, \
7142            NAME "($self, value, /)\n--\n\n" DOC)
7143 
7144 static slotdef slotdefs[] = {
7145     TPSLOT("__getattribute__", tp_getattr, NULL, NULL, ""),
7146     TPSLOT("__getattr__", tp_getattr, NULL, NULL, ""),
7147     TPSLOT("__setattr__", tp_setattr, NULL, NULL, ""),
7148     TPSLOT("__delattr__", tp_setattr, NULL, NULL, ""),
7149     TPSLOT("__repr__", tp_repr, slot_tp_repr, wrap_unaryfunc,
7150            "__repr__($self, /)\n--\n\nReturn repr(self)."),
7151     TPSLOT("__hash__", tp_hash, slot_tp_hash, wrap_hashfunc,
7152            "__hash__($self, /)\n--\n\nReturn hash(self)."),
7153     FLSLOT("__call__", tp_call, slot_tp_call, (wrapperfunc)(void(*)(void))wrap_call,
7154            "__call__($self, /, *args, **kwargs)\n--\n\nCall self as a function.",
7155            PyWrapperFlag_KEYWORDS),
7156     TPSLOT("__str__", tp_str, slot_tp_str, wrap_unaryfunc,
7157            "__str__($self, /)\n--\n\nReturn str(self)."),
7158     TPSLOT("__getattribute__", tp_getattro, slot_tp_getattr_hook,
7159            wrap_binaryfunc,
7160            "__getattribute__($self, name, /)\n--\n\nReturn getattr(self, name)."),
7161     TPSLOT("__getattr__", tp_getattro, slot_tp_getattr_hook, NULL, ""),
7162     TPSLOT("__setattr__", tp_setattro, slot_tp_setattro, wrap_setattr,
7163            "__setattr__($self, name, value, /)\n--\n\nImplement setattr(self, name, value)."),
7164     TPSLOT("__delattr__", tp_setattro, slot_tp_setattro, wrap_delattr,
7165            "__delattr__($self, name, /)\n--\n\nImplement delattr(self, name)."),
7166     TPSLOT("__lt__", tp_richcompare, slot_tp_richcompare, richcmp_lt,
7167            "__lt__($self, value, /)\n--\n\nReturn self<value."),
7168     TPSLOT("__le__", tp_richcompare, slot_tp_richcompare, richcmp_le,
7169            "__le__($self, value, /)\n--\n\nReturn self<=value."),
7170     TPSLOT("__eq__", tp_richcompare, slot_tp_richcompare, richcmp_eq,
7171            "__eq__($self, value, /)\n--\n\nReturn self==value."),
7172     TPSLOT("__ne__", tp_richcompare, slot_tp_richcompare, richcmp_ne,
7173            "__ne__($self, value, /)\n--\n\nReturn self!=value."),
7174     TPSLOT("__gt__", tp_richcompare, slot_tp_richcompare, richcmp_gt,
7175            "__gt__($self, value, /)\n--\n\nReturn self>value."),
7176     TPSLOT("__ge__", tp_richcompare, slot_tp_richcompare, richcmp_ge,
7177            "__ge__($self, value, /)\n--\n\nReturn self>=value."),
7178     TPSLOT("__iter__", tp_iter, slot_tp_iter, wrap_unaryfunc,
7179            "__iter__($self, /)\n--\n\nImplement iter(self)."),
7180     TPSLOT("__next__", tp_iternext, slot_tp_iternext, wrap_next,
7181            "__next__($self, /)\n--\n\nImplement next(self)."),
7182     TPSLOT("__get__", tp_descr_get, slot_tp_descr_get, wrap_descr_get,
7183            "__get__($self, instance, owner, /)\n--\n\nReturn an attribute of instance, which is of type owner."),
7184     TPSLOT("__set__", tp_descr_set, slot_tp_descr_set, wrap_descr_set,
7185            "__set__($self, instance, value, /)\n--\n\nSet an attribute of instance to value."),
7186     TPSLOT("__delete__", tp_descr_set, slot_tp_descr_set,
7187            wrap_descr_delete,
7188            "__delete__($self, instance, /)\n--\n\nDelete an attribute of instance."),
7189     FLSLOT("__init__", tp_init, slot_tp_init, (wrapperfunc)(void(*)(void))wrap_init,
7190            "__init__($self, /, *args, **kwargs)\n--\n\n"
7191            "Initialize self.  See help(type(self)) for accurate signature.",
7192            PyWrapperFlag_KEYWORDS),
7193     TPSLOT("__new__", tp_new, slot_tp_new, NULL,
7194            "__new__(type, /, *args, **kwargs)\n--\n\n"
7195            "Create and return new object.  See help(type) for accurate signature."),
7196     TPSLOT("__del__", tp_finalize, slot_tp_finalize, (wrapperfunc)wrap_del, ""),
7197 
7198     AMSLOT("__await__", am_await, slot_am_await, wrap_unaryfunc,
7199            "__await__($self, /)\n--\n\nReturn an iterator to be used in await expression."),
7200     AMSLOT("__aiter__", am_aiter, slot_am_aiter, wrap_unaryfunc,
7201            "__aiter__($self, /)\n--\n\nReturn an awaitable, that resolves in asynchronous iterator."),
7202     AMSLOT("__anext__", am_anext, slot_am_anext, wrap_unaryfunc,
7203            "__anext__($self, /)\n--\n\nReturn a value or raise StopAsyncIteration."),
7204 
7205     BINSLOT("__add__", nb_add, slot_nb_add,
7206            "+"),
7207     RBINSLOT("__radd__", nb_add, slot_nb_add,
7208            "+"),
7209     BINSLOT("__sub__", nb_subtract, slot_nb_subtract,
7210            "-"),
7211     RBINSLOT("__rsub__", nb_subtract, slot_nb_subtract,
7212            "-"),
7213     BINSLOT("__mul__", nb_multiply, slot_nb_multiply,
7214            "*"),
7215     RBINSLOT("__rmul__", nb_multiply, slot_nb_multiply,
7216            "*"),
7217     BINSLOT("__mod__", nb_remainder, slot_nb_remainder,
7218            "%"),
7219     RBINSLOT("__rmod__", nb_remainder, slot_nb_remainder,
7220            "%"),
7221     BINSLOTNOTINFIX("__divmod__", nb_divmod, slot_nb_divmod,
7222            "Return divmod(self, value)."),
7223     RBINSLOTNOTINFIX("__rdivmod__", nb_divmod, slot_nb_divmod,
7224            "Return divmod(value, self)."),
7225     NBSLOT("__pow__", nb_power, slot_nb_power, wrap_ternaryfunc,
7226            "__pow__($self, value, mod=None, /)\n--\n\nReturn pow(self, value, mod)."),
7227     NBSLOT("__rpow__", nb_power, slot_nb_power, wrap_ternaryfunc_r,
7228            "__rpow__($self, value, mod=None, /)\n--\n\nReturn pow(value, self, mod)."),
7229     UNSLOT("__neg__", nb_negative, slot_nb_negative, wrap_unaryfunc, "-self"),
7230     UNSLOT("__pos__", nb_positive, slot_nb_positive, wrap_unaryfunc, "+self"),
7231     UNSLOT("__abs__", nb_absolute, slot_nb_absolute, wrap_unaryfunc,
7232            "abs(self)"),
7233     UNSLOT("__bool__", nb_bool, slot_nb_bool, wrap_inquirypred,
7234            "self != 0"),
7235     UNSLOT("__invert__", nb_invert, slot_nb_invert, wrap_unaryfunc, "~self"),
7236     BINSLOT("__lshift__", nb_lshift, slot_nb_lshift, "<<"),
7237     RBINSLOT("__rlshift__", nb_lshift, slot_nb_lshift, "<<"),
7238     BINSLOT("__rshift__", nb_rshift, slot_nb_rshift, ">>"),
7239     RBINSLOT("__rrshift__", nb_rshift, slot_nb_rshift, ">>"),
7240     BINSLOT("__and__", nb_and, slot_nb_and, "&"),
7241     RBINSLOT("__rand__", nb_and, slot_nb_and, "&"),
7242     BINSLOT("__xor__", nb_xor, slot_nb_xor, "^"),
7243     RBINSLOT("__rxor__", nb_xor, slot_nb_xor, "^"),
7244     BINSLOT("__or__", nb_or, slot_nb_or, "|"),
7245     RBINSLOT("__ror__", nb_or, slot_nb_or, "|"),
7246     UNSLOT("__int__", nb_int, slot_nb_int, wrap_unaryfunc,
7247            "int(self)"),
7248     UNSLOT("__float__", nb_float, slot_nb_float, wrap_unaryfunc,
7249            "float(self)"),
7250     IBSLOT("__iadd__", nb_inplace_add, slot_nb_inplace_add,
7251            wrap_binaryfunc, "+="),
7252     IBSLOT("__isub__", nb_inplace_subtract, slot_nb_inplace_subtract,
7253            wrap_binaryfunc, "-="),
7254     IBSLOT("__imul__", nb_inplace_multiply, slot_nb_inplace_multiply,
7255            wrap_binaryfunc, "*="),
7256     IBSLOT("__imod__", nb_inplace_remainder, slot_nb_inplace_remainder,
7257            wrap_binaryfunc, "%="),
7258     IBSLOT("__ipow__", nb_inplace_power, slot_nb_inplace_power,
7259            wrap_ternaryfunc, "**="),
7260     IBSLOT("__ilshift__", nb_inplace_lshift, slot_nb_inplace_lshift,
7261            wrap_binaryfunc, "<<="),
7262     IBSLOT("__irshift__", nb_inplace_rshift, slot_nb_inplace_rshift,
7263            wrap_binaryfunc, ">>="),
7264     IBSLOT("__iand__", nb_inplace_and, slot_nb_inplace_and,
7265            wrap_binaryfunc, "&="),
7266     IBSLOT("__ixor__", nb_inplace_xor, slot_nb_inplace_xor,
7267            wrap_binaryfunc, "^="),
7268     IBSLOT("__ior__", nb_inplace_or, slot_nb_inplace_or,
7269            wrap_binaryfunc, "|="),
7270     BINSLOT("__floordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
7271     RBINSLOT("__rfloordiv__", nb_floor_divide, slot_nb_floor_divide, "//"),
7272     BINSLOT("__truediv__", nb_true_divide, slot_nb_true_divide, "/"),
7273     RBINSLOT("__rtruediv__", nb_true_divide, slot_nb_true_divide, "/"),
7274     IBSLOT("__ifloordiv__", nb_inplace_floor_divide,
7275            slot_nb_inplace_floor_divide, wrap_binaryfunc, "//="),
7276     IBSLOT("__itruediv__", nb_inplace_true_divide,
7277            slot_nb_inplace_true_divide, wrap_binaryfunc, "/="),
7278     NBSLOT("__index__", nb_index, slot_nb_index, wrap_unaryfunc,
7279            "__index__($self, /)\n--\n\n"
7280            "Return self converted to an integer, if self is suitable "
7281            "for use as an index into a list."),
7282     BINSLOT("__matmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
7283             "@"),
7284     RBINSLOT("__rmatmul__", nb_matrix_multiply, slot_nb_matrix_multiply,
7285              "@"),
7286     IBSLOT("__imatmul__", nb_inplace_matrix_multiply, slot_nb_inplace_matrix_multiply,
7287            wrap_binaryfunc, "@="),
7288     MPSLOT("__len__", mp_length, slot_mp_length, wrap_lenfunc,
7289            "__len__($self, /)\n--\n\nReturn len(self)."),
7290     MPSLOT("__getitem__", mp_subscript, slot_mp_subscript,
7291            wrap_binaryfunc,
7292            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
7293     MPSLOT("__setitem__", mp_ass_subscript, slot_mp_ass_subscript,
7294            wrap_objobjargproc,
7295            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
7296     MPSLOT("__delitem__", mp_ass_subscript, slot_mp_ass_subscript,
7297            wrap_delitem,
7298            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
7299 
7300     SQSLOT("__len__", sq_length, slot_sq_length, wrap_lenfunc,
7301            "__len__($self, /)\n--\n\nReturn len(self)."),
7302     /* Heap types defining __add__/__mul__ have sq_concat/sq_repeat == NULL.
7303        The logic in abstract.c always falls back to nb_add/nb_multiply in
7304        this case.  Defining both the nb_* and the sq_* slots to call the
7305        user-defined methods has unexpected side-effects, as shown by
7306        test_descr.notimplemented() */
7307     SQSLOT("__add__", sq_concat, NULL, wrap_binaryfunc,
7308            "__add__($self, value, /)\n--\n\nReturn self+value."),
7309     SQSLOT("__mul__", sq_repeat, NULL, wrap_indexargfunc,
7310            "__mul__($self, value, /)\n--\n\nReturn self*value."),
7311     SQSLOT("__rmul__", sq_repeat, NULL, wrap_indexargfunc,
7312            "__rmul__($self, value, /)\n--\n\nReturn value*self."),
7313     SQSLOT("__getitem__", sq_item, slot_sq_item, wrap_sq_item,
7314            "__getitem__($self, key, /)\n--\n\nReturn self[key]."),
7315     SQSLOT("__setitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_setitem,
7316            "__setitem__($self, key, value, /)\n--\n\nSet self[key] to value."),
7317     SQSLOT("__delitem__", sq_ass_item, slot_sq_ass_item, wrap_sq_delitem,
7318            "__delitem__($self, key, /)\n--\n\nDelete self[key]."),
7319     SQSLOT("__contains__", sq_contains, slot_sq_contains, wrap_objobjproc,
7320            "__contains__($self, key, /)\n--\n\nReturn key in self."),
7321     SQSLOT("__iadd__", sq_inplace_concat, NULL,
7322            wrap_binaryfunc,
7323            "__iadd__($self, value, /)\n--\n\nImplement self+=value."),
7324     SQSLOT("__imul__", sq_inplace_repeat, NULL,
7325            wrap_indexargfunc,
7326            "__imul__($self, value, /)\n--\n\nImplement self*=value."),
7327 
7328     {NULL}
7329 };
7330 
7331 /* Given a type pointer and an offset gotten from a slotdef entry, return a
7332    pointer to the actual slot.  This is not quite the same as simply adding
7333    the offset to the type pointer, since it takes care to indirect through the
7334    proper indirection pointer (as_buffer, etc.); it returns NULL if the
7335    indirection pointer is NULL. */
7336 static void **
slotptr(PyTypeObject * type,int ioffset)7337 slotptr(PyTypeObject *type, int ioffset)
7338 {
7339     char *ptr;
7340     long offset = ioffset;
7341 
7342     /* Note: this depends on the order of the members of PyHeapTypeObject! */
7343     assert(offset >= 0);
7344     assert((size_t)offset < offsetof(PyHeapTypeObject, as_buffer));
7345     if ((size_t)offset >= offsetof(PyHeapTypeObject, as_sequence)) {
7346         ptr = (char *)type->tp_as_sequence;
7347         offset -= offsetof(PyHeapTypeObject, as_sequence);
7348     }
7349     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_mapping)) {
7350         ptr = (char *)type->tp_as_mapping;
7351         offset -= offsetof(PyHeapTypeObject, as_mapping);
7352     }
7353     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_number)) {
7354         ptr = (char *)type->tp_as_number;
7355         offset -= offsetof(PyHeapTypeObject, as_number);
7356     }
7357     else if ((size_t)offset >= offsetof(PyHeapTypeObject, as_async)) {
7358         ptr = (char *)type->tp_as_async;
7359         offset -= offsetof(PyHeapTypeObject, as_async);
7360     }
7361     else {
7362         ptr = (char *)type;
7363     }
7364     if (ptr != NULL)
7365         ptr += offset;
7366     return (void **)ptr;
7367 }
7368 
7369 /* Length of array of slotdef pointers used to store slots with the
7370    same __name__.  There should be at most MAX_EQUIV-1 slotdef entries with
7371    the same __name__, for any __name__. Since that's a static property, it is
7372    appropriate to declare fixed-size arrays for this. */
7373 #define MAX_EQUIV 10
7374 
7375 /* Return a slot pointer for a given name, but ONLY if the attribute has
7376    exactly one slot function.  The name must be an interned string. */
7377 static void **
resolve_slotdups(PyTypeObject * type,PyObject * name)7378 resolve_slotdups(PyTypeObject *type, PyObject *name)
7379 {
7380     /* XXX Maybe this could be optimized more -- but is it worth it? */
7381 
7382     /* pname and ptrs act as a little cache */
7383     static PyObject *pname;
7384     static slotdef *ptrs[MAX_EQUIV];
7385     slotdef *p, **pp;
7386     void **res, **ptr;
7387 
7388     if (pname != name) {
7389         /* Collect all slotdefs that match name into ptrs. */
7390         pname = name;
7391         pp = ptrs;
7392         for (p = slotdefs; p->name_strobj; p++) {
7393             if (p->name_strobj == name)
7394                 *pp++ = p;
7395         }
7396         *pp = NULL;
7397     }
7398 
7399     /* Look in all slots of the type matching the name. If exactly one of these
7400        has a filled-in slot, return a pointer to that slot.
7401        Otherwise, return NULL. */
7402     res = NULL;
7403     for (pp = ptrs; *pp; pp++) {
7404         ptr = slotptr(type, (*pp)->offset);
7405         if (ptr == NULL || *ptr == NULL)
7406             continue;
7407         if (res != NULL)
7408             return NULL;
7409         res = ptr;
7410     }
7411     return res;
7412 }
7413 
7414 
7415 /* Common code for update_slots_callback() and fixup_slot_dispatchers().
7416  *
7417  * This is meant to set a "slot" like type->tp_repr or
7418  * type->tp_as_sequence->sq_concat by looking up special methods like
7419  * __repr__ or __add__. The opposite (adding special methods from slots) is
7420  * done by add_operators(), called from PyType_Ready(). Since update_one_slot()
7421  * calls PyType_Ready() if needed, the special methods are already in place.
7422  *
7423  * The special methods corresponding to each slot are defined in the "slotdef"
7424  * array. Note that one slot may correspond to multiple special methods and vice
7425  * versa. For example, tp_richcompare uses 6 methods __lt__, ..., __ge__ and
7426  * tp_as_number->nb_add uses __add__ and __radd__. In the other direction,
7427  * __add__ is used by the number and sequence protocols and __getitem__ by the
7428  * sequence and mapping protocols. This causes a lot of complications.
7429  *
7430  * In detail, update_one_slot() does the following:
7431  *
7432  * First of all, if the slot in question does not exist, return immediately.
7433  * This can happen for example if it's tp_as_number->nb_add but tp_as_number
7434  * is NULL.
7435  *
7436  * For the given slot, we loop over all the special methods with a name
7437  * corresponding to that slot (for example, for tp_descr_set, this would be
7438  * __set__ and __delete__) and we look up these names in the MRO of the type.
7439  * If we don't find any special method, the slot is set to NULL (regardless of
7440  * what was in the slot before).
7441  *
7442  * Suppose that we find exactly one special method. If it's a wrapper_descriptor
7443  * (i.e. a special method calling a slot, for example str.__repr__ which calls
7444  * the tp_repr for the 'str' class) with the correct name ("__repr__" for
7445  * tp_repr), for the right class, calling the right wrapper C function (like
7446  * wrap_unaryfunc for tp_repr), then the slot is set to the slot that the
7447  * wrapper_descriptor originally wrapped. For example, a class inheriting
7448  * from 'str' and not redefining __repr__ will have tp_repr set to the tp_repr
7449  * of 'str'.
7450  * In all other cases where the special method exists, the slot is set to a
7451  * wrapper calling the special method. There is one exception: if the special
7452  * method is a wrapper_descriptor with the correct name but the type has
7453  * precisely one slot set for that name and that slot is not the one that we
7454  * are updating, then NULL is put in the slot (this exception is the only place
7455  * in update_one_slot() where the *existing* slots matter).
7456  *
7457  * When there are multiple special methods for the same slot, the above is
7458  * applied for each special method. As long as the results agree, the common
7459  * resulting slot is applied. If the results disagree, then a wrapper for
7460  * the special methods is installed. This is always safe, but less efficient
7461  * because it uses method lookup instead of direct C calls.
7462  *
7463  * There are some further special cases for specific slots, like supporting
7464  * __hash__ = None for tp_hash and special code for tp_new.
7465  *
7466  * When done, return a pointer to the next slotdef with a different offset,
7467  * because that's convenient for fixup_slot_dispatchers(). This function never
7468  * sets an exception: if an internal error happens (unlikely), it's ignored. */
7469 static slotdef *
update_one_slot(PyTypeObject * type,slotdef * p)7470 update_one_slot(PyTypeObject *type, slotdef *p)
7471 {
7472     PyObject *descr;
7473     PyWrapperDescrObject *d;
7474     void *generic = NULL, *specific = NULL;
7475     int use_generic = 0;
7476     int offset = p->offset;
7477     int error;
7478     void **ptr = slotptr(type, offset);
7479 
7480     if (ptr == NULL) {
7481         do {
7482             ++p;
7483         } while (p->offset == offset);
7484         return p;
7485     }
7486     /* We may end up clearing live exceptions below, so make sure it's ours. */
7487     assert(!PyErr_Occurred());
7488     do {
7489         /* Use faster uncached lookup as we won't get any cache hits during type setup. */
7490         descr = find_name_in_mro(type, p->name_strobj, &error);
7491         if (descr == NULL) {
7492             if (error == -1) {
7493                 /* It is unlikely but not impossible that there has been an exception
7494                    during lookup. Since this function originally expected no errors,
7495                    we ignore them here in order to keep up the interface. */
7496                 PyErr_Clear();
7497             }
7498             if (ptr == (void**)&type->tp_iternext) {
7499                 specific = (void *)_PyObject_NextNotImplemented;
7500             }
7501             continue;
7502         }
7503         if (Py_IS_TYPE(descr, &PyWrapperDescr_Type) &&
7504             ((PyWrapperDescrObject *)descr)->d_base->name_strobj == p->name_strobj) {
7505             void **tptr = resolve_slotdups(type, p->name_strobj);
7506             if (tptr == NULL || tptr == ptr)
7507                 generic = p->function;
7508             d = (PyWrapperDescrObject *)descr;
7509             if ((specific == NULL || specific == d->d_wrapped) &&
7510                 d->d_base->wrapper == p->wrapper &&
7511                 PyType_IsSubtype(type, PyDescr_TYPE(d)))
7512             {
7513                 specific = d->d_wrapped;
7514             }
7515             else {
7516                 /* We cannot use the specific slot function because either
7517                    - it is not unique: there are multiple methods for this
7518                      slot and they conflict
7519                    - the signature is wrong (as checked by the ->wrapper
7520                      comparison above)
7521                    - it's wrapping the wrong class
7522                  */
7523                 use_generic = 1;
7524             }
7525         }
7526         else if (Py_IS_TYPE(descr, &PyCFunction_Type) &&
7527                  PyCFunction_GET_FUNCTION(descr) ==
7528                  (PyCFunction)(void(*)(void))tp_new_wrapper &&
7529                  ptr == (void**)&type->tp_new)
7530         {
7531             /* The __new__ wrapper is not a wrapper descriptor,
7532                so must be special-cased differently.
7533                If we don't do this, creating an instance will
7534                always use slot_tp_new which will look up
7535                __new__ in the MRO which will call tp_new_wrapper
7536                which will look through the base classes looking
7537                for a static base and call its tp_new (usually
7538                PyType_GenericNew), after performing various
7539                sanity checks and constructing a new argument
7540                list.  Cut all that nonsense short -- this speeds
7541                up instance creation tremendously. */
7542             specific = (void *)type->tp_new;
7543             /* XXX I'm not 100% sure that there isn't a hole
7544                in this reasoning that requires additional
7545                sanity checks.  I'll buy the first person to
7546                point out a bug in this reasoning a beer. */
7547         }
7548         else if (descr == Py_None &&
7549                  ptr == (void**)&type->tp_hash) {
7550             /* We specifically allow __hash__ to be set to None
7551                to prevent inheritance of the default
7552                implementation from object.__hash__ */
7553             specific = (void *)PyObject_HashNotImplemented;
7554         }
7555         else {
7556             use_generic = 1;
7557             generic = p->function;
7558         }
7559     } while ((++p)->offset == offset);
7560     if (specific && !use_generic)
7561         *ptr = specific;
7562     else
7563         *ptr = generic;
7564     return p;
7565 }
7566 
7567 /* In the type, update the slots whose slotdefs are gathered in the pp array.
7568    This is a callback for update_subclasses(). */
7569 static int
update_slots_callback(PyTypeObject * type,void * data)7570 update_slots_callback(PyTypeObject *type, void *data)
7571 {
7572     slotdef **pp = (slotdef **)data;
7573 
7574     for (; *pp; pp++)
7575         update_one_slot(type, *pp);
7576     return 0;
7577 }
7578 
7579 static int slotdefs_initialized = 0;
7580 /* Initialize the slotdefs table by adding interned string objects for the
7581    names. */
7582 PyStatus
_PyTypes_InitSlotDefs(void)7583 _PyTypes_InitSlotDefs(void)
7584 {
7585     if (slotdefs_initialized) {
7586         return _PyStatus_OK();
7587     }
7588 
7589     for (slotdef *p = slotdefs; p->name; p++) {
7590         /* Slots must be ordered by their offset in the PyHeapTypeObject. */
7591         assert(!p[1].name || p->offset <= p[1].offset);
7592 #ifdef INTERN_NAME_STRINGS
7593         p->name_strobj = PyUnicode_InternFromString(p->name);
7594         if (!p->name_strobj || !PyUnicode_CHECK_INTERNED(p->name_strobj)) {
7595             return _PyStatus_NO_MEMORY();
7596         }
7597 #else
7598         p->name_strobj = PyUnicode_FromString(p->name);
7599         if (!p->name_strobj) {
7600             return _PyStatus_NO_MEMORY();
7601         }
7602 #endif
7603     }
7604     slotdefs_initialized = 1;
7605     return _PyStatus_OK();
7606 }
7607 
7608 /* Undo _PyTypes_InitSlotDefs(), releasing the interned strings. */
clear_slotdefs(void)7609 static void clear_slotdefs(void)
7610 {
7611     for (slotdef *p = slotdefs; p->name; p++) {
7612         Py_CLEAR(p->name_strobj);
7613     }
7614     slotdefs_initialized = 0;
7615 }
7616 
7617 /* Update the slots after assignment to a class (type) attribute. */
7618 static int
update_slot(PyTypeObject * type,PyObject * name)7619 update_slot(PyTypeObject *type, PyObject *name)
7620 {
7621     slotdef *ptrs[MAX_EQUIV];
7622     slotdef *p;
7623     slotdef **pp;
7624     int offset;
7625 
7626     assert(PyUnicode_CheckExact(name));
7627 #ifdef INTERN_NAME_STRINGS
7628     assert(PyUnicode_CHECK_INTERNED(name));
7629 #endif
7630 
7631     assert(slotdefs_initialized);
7632     pp = ptrs;
7633     for (p = slotdefs; p->name; p++) {
7634         if (p->name_strobj == name)
7635             *pp++ = p;
7636     }
7637     *pp = NULL;
7638     for (pp = ptrs; *pp; pp++) {
7639         p = *pp;
7640         offset = p->offset;
7641         while (p > slotdefs && (p-1)->offset == offset)
7642             --p;
7643         *pp = p;
7644     }
7645     if (ptrs[0] == NULL)
7646         return 0; /* Not an attribute that affects any slots */
7647     return update_subclasses(type, name,
7648                              update_slots_callback, (void *)ptrs);
7649 }
7650 
7651 /* Store the proper functions in the slot dispatches at class (type)
7652    definition time, based upon which operations the class overrides in its
7653    dict. */
7654 static void
fixup_slot_dispatchers(PyTypeObject * type)7655 fixup_slot_dispatchers(PyTypeObject *type)
7656 {
7657     slotdef *p;
7658 
7659     assert(slotdefs_initialized);
7660     for (p = slotdefs; p->name; )
7661         p = update_one_slot(type, p);
7662 }
7663 
7664 static void
update_all_slots(PyTypeObject * type)7665 update_all_slots(PyTypeObject* type)
7666 {
7667     slotdef *p;
7668 
7669     /* Clear the VALID_VERSION flag of 'type' and all its subclasses. */
7670     PyType_Modified(type);
7671 
7672     assert(slotdefs_initialized);
7673     for (p = slotdefs; p->name; p++) {
7674         /* update_slot returns int but can't actually fail */
7675         update_slot(type, p->name_strobj);
7676     }
7677 }
7678 
7679 /* Call __set_name__ on all descriptors in a newly generated type */
7680 static int
set_names(PyTypeObject * type)7681 set_names(PyTypeObject *type)
7682 {
7683     PyObject *names_to_set, *key, *value, *set_name, *tmp;
7684     Py_ssize_t i = 0;
7685 
7686     names_to_set = PyDict_Copy(type->tp_dict);
7687     if (names_to_set == NULL)
7688         return -1;
7689 
7690     while (PyDict_Next(names_to_set, &i, &key, &value)) {
7691         set_name = _PyObject_LookupSpecial(value, &PyId___set_name__);
7692         if (set_name != NULL) {
7693             tmp = PyObject_CallFunctionObjArgs(set_name, type, key, NULL);
7694             Py_DECREF(set_name);
7695             if (tmp == NULL) {
7696                 _PyErr_FormatFromCause(PyExc_RuntimeError,
7697                     "Error calling __set_name__ on '%.100s' instance %R "
7698                     "in '%.100s'",
7699                     Py_TYPE(value)->tp_name, key, type->tp_name);
7700                 Py_DECREF(names_to_set);
7701                 return -1;
7702             }
7703             else
7704                 Py_DECREF(tmp);
7705         }
7706         else if (PyErr_Occurred()) {
7707             Py_DECREF(names_to_set);
7708             return -1;
7709         }
7710     }
7711 
7712     Py_DECREF(names_to_set);
7713     return 0;
7714 }
7715 
7716 /* Call __init_subclass__ on the parent of a newly generated type */
7717 static int
init_subclass(PyTypeObject * type,PyObject * kwds)7718 init_subclass(PyTypeObject *type, PyObject *kwds)
7719 {
7720     PyObject *super, *func, *result;
7721     PyObject *args[2] = {(PyObject *)type, (PyObject *)type};
7722 
7723     super = _PyObject_FastCall((PyObject *)&PySuper_Type, args, 2);
7724     if (super == NULL) {
7725         return -1;
7726     }
7727 
7728     func = _PyObject_GetAttrId(super, &PyId___init_subclass__);
7729     Py_DECREF(super);
7730     if (func == NULL) {
7731         return -1;
7732     }
7733 
7734 
7735     result = PyObject_VectorcallDict(func, NULL, 0, kwds);
7736     Py_DECREF(func);
7737     if (result == NULL) {
7738         return -1;
7739     }
7740 
7741     Py_DECREF(result);
7742     return 0;
7743 }
7744 
7745 /* recurse_down_subclasses() and update_subclasses() are mutually
7746    recursive functions to call a callback for all subclasses,
7747    but refraining from recursing into subclasses that define 'name'. */
7748 
7749 static int
update_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)7750 update_subclasses(PyTypeObject *type, PyObject *name,
7751                   update_callback callback, void *data)
7752 {
7753     if (callback(type, data) < 0)
7754         return -1;
7755     return recurse_down_subclasses(type, name, callback, data);
7756 }
7757 
7758 static int
recurse_down_subclasses(PyTypeObject * type,PyObject * name,update_callback callback,void * data)7759 recurse_down_subclasses(PyTypeObject *type, PyObject *name,
7760                         update_callback callback, void *data)
7761 {
7762     PyTypeObject *subclass;
7763     PyObject *ref, *subclasses, *dict;
7764     Py_ssize_t i;
7765 
7766     subclasses = type->tp_subclasses;
7767     if (subclasses == NULL)
7768         return 0;
7769     assert(PyDict_CheckExact(subclasses));
7770     i = 0;
7771     while (PyDict_Next(subclasses, &i, NULL, &ref)) {
7772         assert(PyWeakref_CheckRef(ref));
7773         subclass = (PyTypeObject *)PyWeakref_GET_OBJECT(ref);
7774         assert(subclass != NULL);
7775         if ((PyObject *)subclass == Py_None)
7776             continue;
7777         assert(PyType_Check(subclass));
7778         /* Avoid recursing down into unaffected classes */
7779         dict = subclass->tp_dict;
7780         if (dict != NULL && PyDict_Check(dict)) {
7781             if (PyDict_GetItemWithError(dict, name) != NULL) {
7782                 continue;
7783             }
7784             if (PyErr_Occurred()) {
7785                 return -1;
7786             }
7787         }
7788         if (update_subclasses(subclass, name, callback, data) < 0)
7789             return -1;
7790     }
7791     return 0;
7792 }
7793 
7794 /* This function is called by PyType_Ready() to populate the type's
7795    dictionary with method descriptors for function slots.  For each
7796    function slot (like tp_repr) that's defined in the type, one or more
7797    corresponding descriptors are added in the type's tp_dict dictionary
7798    under the appropriate name (like __repr__).  Some function slots
7799    cause more than one descriptor to be added (for example, the nb_add
7800    slot adds both __add__ and __radd__ descriptors) and some function
7801    slots compete for the same descriptor (for example both sq_item and
7802    mp_subscript generate a __getitem__ descriptor).
7803 
7804    In the latter case, the first slotdef entry encountered wins.  Since
7805    slotdef entries are sorted by the offset of the slot in the
7806    PyHeapTypeObject, this gives us some control over disambiguating
7807    between competing slots: the members of PyHeapTypeObject are listed
7808    from most general to least general, so the most general slot is
7809    preferred.  In particular, because as_mapping comes before as_sequence,
7810    for a type that defines both mp_subscript and sq_item, mp_subscript
7811    wins.
7812 
7813    This only adds new descriptors and doesn't overwrite entries in
7814    tp_dict that were previously defined.  The descriptors contain a
7815    reference to the C function they must call, so that it's safe if they
7816    are copied into a subtype's __dict__ and the subtype has a different
7817    C function in its slot -- calling the method defined by the
7818    descriptor will call the C function that was used to create it,
7819    rather than the C function present in the slot when it is called.
7820    (This is important because a subtype may have a C function in the
7821    slot that calls the method from the dictionary, and we want to avoid
7822    infinite recursion here.) */
7823 
7824 static int
add_operators(PyTypeObject * type)7825 add_operators(PyTypeObject *type)
7826 {
7827     PyObject *dict = type->tp_dict;
7828     slotdef *p;
7829     PyObject *descr;
7830     void **ptr;
7831 
7832     assert(slotdefs_initialized);
7833     for (p = slotdefs; p->name; p++) {
7834         if (p->wrapper == NULL)
7835             continue;
7836         ptr = slotptr(type, p->offset);
7837         if (!ptr || !*ptr)
7838             continue;
7839         if (PyDict_GetItemWithError(dict, p->name_strobj))
7840             continue;
7841         if (PyErr_Occurred()) {
7842             return -1;
7843         }
7844         if (*ptr == (void *)PyObject_HashNotImplemented) {
7845             /* Classes may prevent the inheritance of the tp_hash
7846                slot by storing PyObject_HashNotImplemented in it. Make it
7847                visible as a None value for the __hash__ attribute. */
7848             if (PyDict_SetItem(dict, p->name_strobj, Py_None) < 0)
7849                 return -1;
7850         }
7851         else {
7852             descr = PyDescr_NewWrapper(type, p, *ptr);
7853             if (descr == NULL)
7854                 return -1;
7855             if (PyDict_SetItem(dict, p->name_strobj, descr) < 0) {
7856                 Py_DECREF(descr);
7857                 return -1;
7858             }
7859             Py_DECREF(descr);
7860         }
7861     }
7862     if (type->tp_new != NULL) {
7863         if (add_tp_new_wrapper(type) < 0)
7864             return -1;
7865     }
7866     return 0;
7867 }
7868 
7869 
7870 /* Cooperative 'super' */
7871 
7872 typedef struct {
7873     PyObject_HEAD
7874     PyTypeObject *type;
7875     PyObject *obj;
7876     PyTypeObject *obj_type;
7877 } superobject;
7878 
7879 static PyMemberDef super_members[] = {
7880     {"__thisclass__", T_OBJECT, offsetof(superobject, type), READONLY,
7881      "the class invoking super()"},
7882     {"__self__",  T_OBJECT, offsetof(superobject, obj), READONLY,
7883      "the instance invoking super(); may be None"},
7884     {"__self_class__", T_OBJECT, offsetof(superobject, obj_type), READONLY,
7885      "the type of the instance invoking super(); may be None"},
7886     {0}
7887 };
7888 
7889 static void
super_dealloc(PyObject * self)7890 super_dealloc(PyObject *self)
7891 {
7892     superobject *su = (superobject *)self;
7893 
7894     _PyObject_GC_UNTRACK(self);
7895     Py_XDECREF(su->obj);
7896     Py_XDECREF(su->type);
7897     Py_XDECREF(su->obj_type);
7898     Py_TYPE(self)->tp_free(self);
7899 }
7900 
7901 static PyObject *
super_repr(PyObject * self)7902 super_repr(PyObject *self)
7903 {
7904     superobject *su = (superobject *)self;
7905 
7906     if (su->obj_type)
7907         return PyUnicode_FromFormat(
7908             "<super: <class '%s'>, <%s object>>",
7909             su->type ? su->type->tp_name : "NULL",
7910             su->obj_type->tp_name);
7911     else
7912         return PyUnicode_FromFormat(
7913             "<super: <class '%s'>, NULL>",
7914             su->type ? su->type->tp_name : "NULL");
7915 }
7916 
7917 static PyObject *
super_getattro(PyObject * self,PyObject * name)7918 super_getattro(PyObject *self, PyObject *name)
7919 {
7920     superobject *su = (superobject *)self;
7921     PyTypeObject *starttype;
7922     PyObject *mro;
7923     Py_ssize_t i, n;
7924 
7925     starttype = su->obj_type;
7926     if (starttype == NULL)
7927         goto skip;
7928 
7929     /* We want __class__ to return the class of the super object
7930        (i.e. super, or a subclass), not the class of su->obj. */
7931     if (PyUnicode_Check(name) &&
7932         PyUnicode_GET_LENGTH(name) == 9 &&
7933         _PyUnicode_EqualToASCIIId(name, &PyId___class__))
7934         goto skip;
7935 
7936     mro = starttype->tp_mro;
7937     if (mro == NULL)
7938         goto skip;
7939 
7940     assert(PyTuple_Check(mro));
7941     n = PyTuple_GET_SIZE(mro);
7942 
7943     /* No need to check the last one: it's gonna be skipped anyway.  */
7944     for (i = 0; i+1 < n; i++) {
7945         if ((PyObject *)(su->type) == PyTuple_GET_ITEM(mro, i))
7946             break;
7947     }
7948     i++;  /* skip su->type (if any)  */
7949     if (i >= n)
7950         goto skip;
7951 
7952     /* keep a strong reference to mro because starttype->tp_mro can be
7953        replaced during PyDict_GetItemWithError(dict, name)  */
7954     Py_INCREF(mro);
7955     do {
7956         PyObject *res, *tmp, *dict;
7957         descrgetfunc f;
7958 
7959         tmp = PyTuple_GET_ITEM(mro, i);
7960         assert(PyType_Check(tmp));
7961 
7962         dict = ((PyTypeObject *)tmp)->tp_dict;
7963         assert(dict != NULL && PyDict_Check(dict));
7964 
7965         res = PyDict_GetItemWithError(dict, name);
7966         if (res != NULL) {
7967             Py_INCREF(res);
7968 
7969             f = Py_TYPE(res)->tp_descr_get;
7970             if (f != NULL) {
7971                 tmp = f(res,
7972                     /* Only pass 'obj' param if this is instance-mode super
7973                        (See SF ID #743627)  */
7974                     (su->obj == (PyObject *)starttype) ? NULL : su->obj,
7975                     (PyObject *)starttype);
7976                 Py_DECREF(res);
7977                 res = tmp;
7978             }
7979 
7980             Py_DECREF(mro);
7981             return res;
7982         }
7983         else if (PyErr_Occurred()) {
7984             Py_DECREF(mro);
7985             return NULL;
7986         }
7987 
7988         i++;
7989     } while (i < n);
7990     Py_DECREF(mro);
7991 
7992   skip:
7993     return PyObject_GenericGetAttr(self, name);
7994 }
7995 
7996 static PyTypeObject *
supercheck(PyTypeObject * type,PyObject * obj)7997 supercheck(PyTypeObject *type, PyObject *obj)
7998 {
7999     /* Check that a super() call makes sense.  Return a type object.
8000 
8001        obj can be a class, or an instance of one:
8002 
8003        - If it is a class, it must be a subclass of 'type'.      This case is
8004          used for class methods; the return value is obj.
8005 
8006        - If it is an instance, it must be an instance of 'type'.  This is
8007          the normal case; the return value is obj.__class__.
8008 
8009        But... when obj is an instance, we want to allow for the case where
8010        Py_TYPE(obj) is not a subclass of type, but obj.__class__ is!
8011        This will allow using super() with a proxy for obj.
8012     */
8013 
8014     /* Check for first bullet above (special case) */
8015     if (PyType_Check(obj) && PyType_IsSubtype((PyTypeObject *)obj, type)) {
8016         Py_INCREF(obj);
8017         return (PyTypeObject *)obj;
8018     }
8019 
8020     /* Normal case */
8021     if (PyType_IsSubtype(Py_TYPE(obj), type)) {
8022         Py_INCREF(Py_TYPE(obj));
8023         return Py_TYPE(obj);
8024     }
8025     else {
8026         /* Try the slow way */
8027         PyObject *class_attr;
8028 
8029         if (_PyObject_LookupAttrId(obj, &PyId___class__, &class_attr) < 0) {
8030             return NULL;
8031         }
8032         if (class_attr != NULL &&
8033             PyType_Check(class_attr) &&
8034             (PyTypeObject *)class_attr != Py_TYPE(obj))
8035         {
8036             int ok = PyType_IsSubtype(
8037                 (PyTypeObject *)class_attr, type);
8038             if (ok)
8039                 return (PyTypeObject *)class_attr;
8040         }
8041         Py_XDECREF(class_attr);
8042     }
8043 
8044     PyErr_SetString(PyExc_TypeError,
8045                     "super(type, obj): "
8046                     "obj must be an instance or subtype of type");
8047     return NULL;
8048 }
8049 
8050 static PyObject *
super_descr_get(PyObject * self,PyObject * obj,PyObject * type)8051 super_descr_get(PyObject *self, PyObject *obj, PyObject *type)
8052 {
8053     superobject *su = (superobject *)self;
8054     superobject *newobj;
8055 
8056     if (obj == NULL || obj == Py_None || su->obj != NULL) {
8057         /* Not binding to an object, or already bound */
8058         Py_INCREF(self);
8059         return self;
8060     }
8061     if (!Py_IS_TYPE(su, &PySuper_Type))
8062         /* If su is an instance of a (strict) subclass of super,
8063            call its type */
8064         return PyObject_CallFunctionObjArgs((PyObject *)Py_TYPE(su),
8065                                             su->type, obj, NULL);
8066     else {
8067         /* Inline the common case */
8068         PyTypeObject *obj_type = supercheck(su->type, obj);
8069         if (obj_type == NULL)
8070             return NULL;
8071         newobj = (superobject *)PySuper_Type.tp_new(&PySuper_Type,
8072                                                  NULL, NULL);
8073         if (newobj == NULL)
8074             return NULL;
8075         Py_INCREF(su->type);
8076         Py_INCREF(obj);
8077         newobj->type = su->type;
8078         newobj->obj = obj;
8079         newobj->obj_type = obj_type;
8080         return (PyObject *)newobj;
8081     }
8082 }
8083 
8084 static int
super_init_without_args(PyFrameObject * f,PyCodeObject * co,PyTypeObject ** type_p,PyObject ** obj_p)8085 super_init_without_args(PyFrameObject *f, PyCodeObject *co,
8086                         PyTypeObject **type_p, PyObject **obj_p)
8087 {
8088     if (co->co_argcount == 0) {
8089         PyErr_SetString(PyExc_RuntimeError,
8090                         "super(): no arguments");
8091         return -1;
8092     }
8093 
8094     PyObject *obj = f->f_localsplus[0];
8095     Py_ssize_t i, n;
8096     if (obj == NULL && co->co_cell2arg) {
8097         /* The first argument might be a cell. */
8098         n = PyTuple_GET_SIZE(co->co_cellvars);
8099         for (i = 0; i < n; i++) {
8100             if (co->co_cell2arg[i] == 0) {
8101                 PyObject *cell = f->f_localsplus[co->co_nlocals + i];
8102                 assert(PyCell_Check(cell));
8103                 obj = PyCell_GET(cell);
8104                 break;
8105             }
8106         }
8107     }
8108     if (obj == NULL) {
8109         PyErr_SetString(PyExc_RuntimeError,
8110                         "super(): arg[0] deleted");
8111         return -1;
8112     }
8113 
8114     if (co->co_freevars == NULL) {
8115         n = 0;
8116     }
8117     else {
8118         assert(PyTuple_Check(co->co_freevars));
8119         n = PyTuple_GET_SIZE(co->co_freevars);
8120     }
8121 
8122     PyTypeObject *type = NULL;
8123     for (i = 0; i < n; i++) {
8124         PyObject *name = PyTuple_GET_ITEM(co->co_freevars, i);
8125         assert(PyUnicode_Check(name));
8126         if (_PyUnicode_EqualToASCIIId(name, &PyId___class__)) {
8127             Py_ssize_t index = co->co_nlocals +
8128                 PyTuple_GET_SIZE(co->co_cellvars) + i;
8129             PyObject *cell = f->f_localsplus[index];
8130             if (cell == NULL || !PyCell_Check(cell)) {
8131                 PyErr_SetString(PyExc_RuntimeError,
8132                   "super(): bad __class__ cell");
8133                 return -1;
8134             }
8135             type = (PyTypeObject *) PyCell_GET(cell);
8136             if (type == NULL) {
8137                 PyErr_SetString(PyExc_RuntimeError,
8138                   "super(): empty __class__ cell");
8139                 return -1;
8140             }
8141             if (!PyType_Check(type)) {
8142                 PyErr_Format(PyExc_RuntimeError,
8143                   "super(): __class__ is not a type (%s)",
8144                   Py_TYPE(type)->tp_name);
8145                 return -1;
8146             }
8147             break;
8148         }
8149     }
8150     if (type == NULL) {
8151         PyErr_SetString(PyExc_RuntimeError,
8152                         "super(): __class__ cell not found");
8153         return -1;
8154     }
8155 
8156     *type_p = type;
8157     *obj_p = obj;
8158     return 0;
8159 }
8160 
8161 static int
super_init(PyObject * self,PyObject * args,PyObject * kwds)8162 super_init(PyObject *self, PyObject *args, PyObject *kwds)
8163 {
8164     superobject *su = (superobject *)self;
8165     PyTypeObject *type = NULL;
8166     PyObject *obj = NULL;
8167     PyTypeObject *obj_type = NULL;
8168 
8169     if (!_PyArg_NoKeywords("super", kwds))
8170         return -1;
8171     if (!PyArg_ParseTuple(args, "|O!O:super", &PyType_Type, &type, &obj))
8172         return -1;
8173 
8174     if (type == NULL) {
8175         /* Call super(), without args -- fill in from __class__
8176            and first local variable on the stack. */
8177         PyThreadState *tstate = _PyThreadState_GET();
8178         PyFrameObject *frame = PyThreadState_GetFrame(tstate);
8179         if (frame == NULL) {
8180             PyErr_SetString(PyExc_RuntimeError,
8181                             "super(): no current frame");
8182             return -1;
8183         }
8184 
8185         PyCodeObject *code = PyFrame_GetCode(frame);
8186         int res = super_init_without_args(frame, code, &type, &obj);
8187         Py_DECREF(frame);
8188         Py_DECREF(code);
8189 
8190         if (res < 0) {
8191             return -1;
8192         }
8193     }
8194 
8195     if (obj == Py_None)
8196         obj = NULL;
8197     if (obj != NULL) {
8198         obj_type = supercheck(type, obj);
8199         if (obj_type == NULL)
8200             return -1;
8201         Py_INCREF(obj);
8202     }
8203     Py_INCREF(type);
8204     Py_XSETREF(su->type, type);
8205     Py_XSETREF(su->obj, obj);
8206     Py_XSETREF(su->obj_type, obj_type);
8207     return 0;
8208 }
8209 
8210 PyDoc_STRVAR(super_doc,
8211 "super() -> same as super(__class__, <first argument>)\n"
8212 "super(type) -> unbound super object\n"
8213 "super(type, obj) -> bound super object; requires isinstance(obj, type)\n"
8214 "super(type, type2) -> bound super object; requires issubclass(type2, type)\n"
8215 "Typical use to call a cooperative superclass method:\n"
8216 "class C(B):\n"
8217 "    def meth(self, arg):\n"
8218 "        super().meth(arg)\n"
8219 "This works for class methods too:\n"
8220 "class C(B):\n"
8221 "    @classmethod\n"
8222 "    def cmeth(cls, arg):\n"
8223 "        super().cmeth(arg)\n");
8224 
8225 static int
super_traverse(PyObject * self,visitproc visit,void * arg)8226 super_traverse(PyObject *self, visitproc visit, void *arg)
8227 {
8228     superobject *su = (superobject *)self;
8229 
8230     Py_VISIT(su->obj);
8231     Py_VISIT(su->type);
8232     Py_VISIT(su->obj_type);
8233 
8234     return 0;
8235 }
8236 
8237 PyTypeObject PySuper_Type = {
8238     PyVarObject_HEAD_INIT(&PyType_Type, 0)
8239     "super",                                    /* tp_name */
8240     sizeof(superobject),                        /* tp_basicsize */
8241     0,                                          /* tp_itemsize */
8242     /* methods */
8243     super_dealloc,                              /* tp_dealloc */
8244     0,                                          /* tp_vectorcall_offset */
8245     0,                                          /* tp_getattr */
8246     0,                                          /* tp_setattr */
8247     0,                                          /* tp_as_async */
8248     super_repr,                                 /* tp_repr */
8249     0,                                          /* tp_as_number */
8250     0,                                          /* tp_as_sequence */
8251     0,                                          /* tp_as_mapping */
8252     0,                                          /* tp_hash */
8253     0,                                          /* tp_call */
8254     0,                                          /* tp_str */
8255     super_getattro,                             /* tp_getattro */
8256     0,                                          /* tp_setattro */
8257     0,                                          /* tp_as_buffer */
8258     Py_TPFLAGS_DEFAULT | Py_TPFLAGS_HAVE_GC |
8259         Py_TPFLAGS_BASETYPE,                    /* tp_flags */
8260     super_doc,                                  /* tp_doc */
8261     super_traverse,                             /* tp_traverse */
8262     0,                                          /* tp_clear */
8263     0,                                          /* tp_richcompare */
8264     0,                                          /* tp_weaklistoffset */
8265     0,                                          /* tp_iter */
8266     0,                                          /* tp_iternext */
8267     0,                                          /* tp_methods */
8268     super_members,                              /* tp_members */
8269     0,                                          /* tp_getset */
8270     0,                                          /* tp_base */
8271     0,                                          /* tp_dict */
8272     super_descr_get,                            /* tp_descr_get */
8273     0,                                          /* tp_descr_set */
8274     0,                                          /* tp_dictoffset */
8275     super_init,                                 /* tp_init */
8276     PyType_GenericAlloc,                        /* tp_alloc */
8277     PyType_GenericNew,                          /* tp_new */
8278     PyObject_GC_Del,                            /* tp_free */
8279 };
8280