[3.14] gh-149122: Fix segfault in compiler when certain builtin functions are passed...

gh-149122: Fix segfault in compiler when certain builtin functions are passed a coroutine as arg (GH-149138)
(cherry picked from commit 16f292ef4e8c56bfd115ecdb91420c7b4006249f)

Co-authored-by: Irit Katriel <1055913+iritkatriel@users.noreply.github.com>

diff --git a/Lib/test/test_builtin.py b/Lib/test/test_builtin.py
index 5e9b087db91aad8f351d481e8bc8d9087902e1a6..54043eac2909169235467596328fb93855379cdc 100644 (file)
--- a/Lib/test/test_builtin.py
+++ b/Lib/test/test_builtin.py
@@ -293,6 +293,27 @@ class BuiltinTest(ComplexesAreIdenticalMixin, unittest.TestCase):
         self.assertEqual(overridden_outputs, ['all', 'any', 'tuple'])
 
 
+    def test_builtin_call_async_genexpr_no_crash(self):
+        async def f_all():
+            return all(await 2 for _ in [])
+
+        async def f_any():
+            return any(await 2 for _ in [])
+
+        async def f_tuple():
+            return tuple(await 2 for _ in [])
+
+        async def f_list():
+            return list(await 2 for _ in [])
+
+        async def f_set():
+            return set(await 2 for _ in [])
+
+        for f in (f_all, f_any, f_tuple, f_list, f_set):
+            with self.subTest(func=f.__name__):
+                with self.assertRaises(TypeError):
+                    run_yielding_async_fn(f)
+
     def test_ascii(self):
         self.assertEqual(ascii(''), '\'\'')
         self.assertEqual(ascii(0), '0')

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-04-29-14-06-00.gh-issue-149122.P8k2Lm.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-29-14-06-00.gh-issue-149122.P8k2Lm.rst
new file mode 100644 (file)
index 0000000..f34b6ea
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-04-29-14-06-00.gh-issue-149122.P8k2Lm.rst
@@ -0,0 +1,4 @@
+Fix a crash in optimized calls to :func:`all`, :func:`any`, :func:`tuple`,
+:func:`list`, and :func:`set` with an async generator expression argument
+(for example, ``tuple(await x for x in y)``). These calls now correctly raise
+``TypeError`` instead of crashing.

diff --git a/Python/codegen.c b/Python/codegen.c
index 085ebc391a165f99945e6409695dd4d446686e5f..3ce7220bcb6adf099d5acb548aa5556bb1cb2fc9 100644 (file)
--- a/Python/codegen.c
+++ b/Python/codegen.c
@@ -3861,6 +3861,12 @@ maybe_optimize_function_call(compiler *c, expr_ty e, jump_target_label end)
         return 0;
     }
 
+    expr_ty generator_exp = asdl_seq_GET(args, 0);
+    PySTEntryObject *generator_entry = _PySymtable_Lookup(SYMTABLE(c), (void *)generator_exp);
+    if (generator_entry->ste_coroutine) {
+        return 0;
+    }
+
     location loc = LOC(func);
 
     int optimized = 0;
@@ -3892,7 +3898,6 @@ maybe_optimize_function_call(compiler *c, expr_ty e, jump_target_label end)
         if (const_oparg == CONSTANT_BUILTIN_TUPLE) {
             ADDOP_I(c, loc, BUILD_LIST, 0);
         }
-        expr_ty generator_exp = asdl_seq_GET(args, 0);
         VISIT(c, expr, generator_exp);
 
         NEW_JUMP_TARGET_LABEL(c, loop);