Closed
Description
Crash report
There is a path in type_mro_modified that results in double-free of *mro_meth:
A reproducer:
class B:
pass
class M(type):
def mro(cls):
del M.mro
return (B,)
class C(metaclass=M):
pass
Crash with the debug CPython:
$ ./python mro-crasher.py
/home/test/cpython/Include/object.h:601: _Py_NegativeRefcount: Assertion failed: object has negative ref count
<object at 0x7f88c12d1a90 is freed>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized
Current thread 0x00007f88c13cb080 (most recent call first):
File "/home/test/mro-crasher.py", line 9 in <module>
Aborted (core dumped)
This bug was introduced in #73052.