bpo-32999: Fix ABC.__subclasscheck__ crash (GH-6002)

(cherry picked from commit fc7df0e664198cb05cafd972f190a18ca422989c)

Co-authored-by: INADA Naoki <methane@users.noreply.github.com>

1 files changed, 25 insertions, 12 deletions

diff --git a/Modules/_abc.c b/Modules/_abc.c
index 504e23d9a7..862883987f 100644
--- a/Modules/_abc.c
+++ b/Modules/_abc.c
@@ -16,6 +16,7 @@ _Py_IDENTIFIER(__abstractmethods__);
 _Py_IDENTIFIER(__class__);
 _Py_IDENTIFIER(__dict__);
 _Py_IDENTIFIER(__bases__);
+_Py_IDENTIFIER(__mro__);
 _Py_IDENTIFIER(_abc_impl);
 _Py_IDENTIFIER(__subclasscheck__);
 _Py_IDENTIFIER(__subclasshook__);
@@ -568,7 +569,7 @@ _abc__abc_subclasscheck_impl(PyObject *module, PyObject *self,
                              PyObject *subclass)
 /*[clinic end generated code: output=b56c9e4a530e3894 input=1d947243409d10b8]*/
 {
-    PyObject *ok, *mro, *subclasses = NULL, *result = NULL;
+    PyObject *ok, *mro = NULL, *subclasses = NULL, *result = NULL;
     Py_ssize_t pos;
     int incache;
     _abc_data *impl = _get_impl(self);
@@ -637,20 +638,31 @@ _abc__abc_subclasscheck_impl(PyObject *module, PyObject *self,
     }
     Py_DECREF(ok);
 
-    /* 4. Check if it's a direct subclass. */
-    mro = ((PyTypeObject *)subclass)->tp_mro;
-    assert(PyTuple_Check(mro));
-    for (pos = 0; pos < PyTuple_GET_SIZE(mro); pos++) {
-        PyObject *mro_item = PyTuple_GET_ITEM(mro, pos);
-        if (mro_item == NULL) {
+    /* 4. Check if it's a direct subclass.
+     *
+     * if cls in getattr(subclass, '__mro__', ()):
+     *     cls._abc_cache.add(subclass)
+     *     return True
+     */
+    if (_PyObject_LookupAttrId(subclass, &PyId___mro__, &mro) < 0) {
+        goto end;
+    }
+    if (mro != NULL) {
+        if (!PyTuple_Check(mro)) {
+            // Python version supports non-tuple iterable.  Keep it as
+            // implementation detail.
+            PyErr_SetString(PyExc_TypeError, "__mro__ is not a tuple");
             goto end;
         }
-        if ((PyObject *)self == mro_item) {
-            if (_add_to_weak_set(&impl->_abc_cache, subclass) < 0) {
+        for (pos = 0; pos < PyTuple_GET_SIZE(mro); pos++) {
+            PyObject *mro_item = PyTuple_GET_ITEM(mro, pos);
+            if ((PyObject *)self == mro_item) {
+                if (_add_to_weak_set(&impl->_abc_cache, subclass) < 0) {
+                    goto end;
+                }
+                result = Py_True;
                 goto end;
             }
-            result = Py_True;
-            goto end;
         }
     }
 
@@ -690,7 +702,8 @@ _abc__abc_subclasscheck_impl(PyObject *module, PyObject *self,
     result = Py_False;
 
 end:
-    Py_XDECREF(impl);
+    Py_DECREF(impl);
+    Py_XDECREF(mro);
     Py_XDECREF(subclasses);
     Py_XINCREF(result);
     return result;