gh-100942: Fix crash on property subtypes with weird __new__

Author: sobolevn

Lib/test/test_property.py

@@ -403,6 +403,16 @@ def spam(self):
                 return 2
         self.assertEqual(Foo.spam.__doc__, "a new docstring")
 
+    def test_gh100942(self):
+        # See https://github.com/python/cpython/issues/100942
+        class pro(property):
+            def __new__(typ, *args, **kwargs):
+                return "abcdef"
+
+        p = property.__new__(pro)
+        with self.assertRaises(TypeError):
+            p.getter(lambda self: 1)  # this line was causing a crash
+
 
 class _PropertyUnreachableAttribute:
     msg_format = None

Misc/NEWS.d/next/Core and Builtins/2023-01-11-21-41-58.gh-issue-100942._jnwot.rst

@@ -0,0 +1 @@
+Fix crash on ``property`` subclasses with weird ``__new__`` methods.

Objects/descrobject.c

@@ -1711,6 +1711,11 @@ property_copy(PyObject *old, PyObject *get, PyObject *set, PyObject *del)
     Py_DECREF(type);
     if (new == NULL)
         return NULL;
+    if (!PyObject_TypeCheck(new, &PyProperty_Type)) {
+        PyErr_Format(PyExc_TypeError, "property instance expected, got %.50s",
+                     Py_TYPE(new)->tp_name);
+        return NULL;
+    }
 
     Py_XSETREF(((propertyobject *) new)->prop_name, Py_XNewRef(pold->prop_name));
     return new;