René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Crash with an evil custom `mro()` on a metaclass","articleBody":"**Crash report**\r\n\r\nThere is a path in `type_mro_modified` that results in double-free of `*mro_meth`:\r\n* https://github.com/python/cpython/blob/ad5e8520f3e117f45481513014548a39879d30d2/Objects/typeobject.c#L362\r\n* https://github.com/python/cpython/blob/ad5e8520f3e117f45481513014548a39879d30d2/Objects/typeobject.c#L371\r\n\r\nA reproducer:\r\n```\r\nclass B:\r\n    pass\r\n\r\nclass M(type):\r\n    def mro(cls):\r\n        del M.mro\r\n        return (B,)\r\n\r\nclass C(metaclass=M):\r\n    pass\r\n```\r\n\r\nCrash with the debug CPython:\r\n```\r\n$ ./python mro-crasher.py\r\n/home/test/cpython/Include/object.h:601: _Py_NegativeRefcount: Assertion failed: object has negative ref count\r\n\u003cobject at 0x7f88c12d1a90 is freed\u003e\r\nFatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed\r\nPython runtime state: initialized\r\n\r\nCurrent thread 0x00007f88c13cb080 (most recent call first):\r\n  File \"/home/test/mro-crasher.py\", line 9 in \u003cmodule\u003e\r\nAborted (core dumped)\r\n```\r\n\r\nThis bug was introduced in #73052.","author":{"url":"https://github.com/izbyshev","@type":"Person","name":"izbyshev"},"datePublished":"2022-05-01T10:55:31.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/92112/cpython/issues/92112"}