gh-99537: Use Py_SETREF() function in C code (#99657)

Fix potential race condition in code patterns:

* Replace "Py_DECREF(var); var = new;" with "Py_SETREF(var, new);"
* Replace "Py_XDECREF(var); var = new;" with "Py_XSETREF(var, new);"
* Replace "Py_CLEAR(var); var = new;" with "Py_XSETREF(var, new);"

Other changes:

* Replace "old = var; var = new; Py_DECREF(var)"
  with "Py_SETREF(var, new);"
* Replace "old = var; var = new; Py_XDECREF(var)"
  with "Py_XSETREF(var, new);"
* And remove the "old" variable.

diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 91c89bbd9005a78237bb815e4d2062aecb9fedf0..a63f396e022f7170ed88892db5f61b35823a14c9 100644 (file)
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -2109,9 +2109,7 @@ bytes_translate_impl(PyBytesObject *self, PyObject *table,
                 changed = 1;
         }
         if (!changed && PyBytes_CheckExact(input_obj)) {
-            Py_INCREF(input_obj);
-            Py_DECREF(result);
-            result = input_obj;
+            Py_SETREF(result, Py_NewRef(input_obj));
         }
         PyBuffer_Release(&del_table_view);
         PyBuffer_Release(&table_view);

diff --git a/Objects/capsule.c b/Objects/capsule.c
index 606e50e69611335ec167866aeaa9aaef182c208f..baaddb3f1f0849c82f1a5e3ca7a78857dbd98eef 100644 (file)
--- a/Objects/capsule.c
+++ b/Objects/capsule.c
@@ -220,8 +220,7 @@ PyCapsule_Import(const char *name, int no_block)
             }
         } else {
             PyObject *object2 = PyObject_GetAttrString(object, trace);
-            Py_DECREF(object);
-            object = object2;
+            Py_SETREF(object, object2);
         }
         if (!object) {
             goto EXIT;

diff --git a/Objects/fileobject.c b/Objects/fileobject.c
index ab67cd23cef3b3e98ceab7a308cb50e968e8dd8f..bf56be5f7ea7b040cb8f1f8abc2dc437bfd84755 100644 (file)
--- a/Objects/fileobject.c
+++ b/Objects/fileobject.c
@@ -88,8 +88,7 @@ PyFile_GetLine(PyObject *f, int n)
             else {
                 PyObject *v;
                 v = PyBytes_FromStringAndSize(s, len-1);
-                Py_DECREF(result);
-                result = v;
+                Py_SETREF(result, v);
             }
         }
     }
@@ -104,8 +103,7 @@ PyFile_GetLine(PyObject *f, int n)
         else if (PyUnicode_READ_CHAR(result, len-1) == '\n') {
             PyObject *v;
             v = PyUnicode_Substring(result, 0, len-1);
-            Py_DECREF(result);
-            result = v;
+            Py_SETREF(result, v);
         }
     }
     return result;

diff --git a/Objects/floatobject.c b/Objects/floatobject.c
index 46016e946ad344f8ce6d23993e8138c00915ee9a..912b742f797d249b1bcde6348903bbc8e7e3e7d5 100644 (file)
--- a/Objects/floatobject.c
+++ b/Objects/floatobject.c
@@ -531,20 +531,17 @@ float_richcompare(PyObject *v, PyObject *w, int op)
                 temp = _PyLong_Lshift(ww, 1);
                 if (temp == NULL)
                     goto Error;
-                Py_DECREF(ww);
-                ww = temp;
+                Py_SETREF(ww, temp);
 
                 temp = _PyLong_Lshift(vv, 1);
                 if (temp == NULL)
                     goto Error;
-                Py_DECREF(vv);
-                vv = temp;
+                Py_SETREF(vv, temp);
 
                 temp = PyNumber_Or(vv, _PyLong_GetOne());
                 if (temp == NULL)
                     goto Error;
-                Py_DECREF(vv);
-                vv = temp;
+                Py_SETREF(vv, temp);
             }
 
             r = PyObject_RichCompareBool(vv, ww, op);

diff --git a/Objects/genobject.c b/Objects/genobject.c
index 6661e3fb9461a4ea2d95415acc9df4f5da77d2b5..c006f1af2177f94e9469eb3772a2f44d3f71d4b8 100644 (file)
--- a/Objects/genobject.c
+++ b/Objects/genobject.c
@@ -491,8 +491,7 @@ throw_here:
         }
         else {
             /* Normalize to raise <class>, <instance> */
-            Py_XDECREF(val);
-            val = typ;
+            Py_XSETREF(val, typ);
             typ = Py_NewRef(PyExceptionInstance_Class(typ));
 
             if (tb == NULL)

diff --git a/Objects/setobject.c b/Objects/setobject.c
index e0646768384a88079179ad667e22f2a5316a028d..ae9e9b99446116ac90b0a832df74ae7f96e85133 100644 (file)
--- a/Objects/setobject.c
+++ b/Objects/setobject.c
@@ -1270,8 +1270,7 @@ set_intersection_multi(PySetObject *so, PyObject *args)
             Py_DECREF(result);
             return NULL;
         }
-        Py_DECREF(result);
-        result = newresult;
+        Py_SETREF(result, newresult);
     }
     return result;
 }

diff --git a/Objects/sliceobject.c b/Objects/sliceobject.c
index 1da1df3090721fb1b080c8f8ced9aa4a5a10f93a..5694bd9c661fa531c903e14687fddf5215318b08 100644 (file)
--- a/Objects/sliceobject.c
+++ b/Objects/sliceobject.c
@@ -448,8 +448,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
         if (_PyLong_Sign(start) < 0) {
             /* start += length */
             PyObject *tmp = PyNumber_Add(start, length);
-            Py_DECREF(start);
-            start = tmp;
+            Py_SETREF(start, tmp);
             if (start == NULL)
                 goto error;
 
@@ -457,9 +456,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
             if (cmp_result < 0)
                 goto error;
             if (cmp_result) {
-                Py_INCREF(lower);
-                Py_DECREF(start);
-                start = lower;
+                Py_SETREF(start, Py_NewRef(lower));
             }
         }
         else {
@@ -467,9 +464,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
             if (cmp_result < 0)
                 goto error;
             if (cmp_result) {
-                Py_INCREF(upper);
-                Py_DECREF(start);
-                start = upper;
+                Py_SETREF(start, Py_NewRef(upper));
             }
         }
     }
@@ -486,8 +481,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
         if (_PyLong_Sign(stop) < 0) {
             /* stop += length */
             PyObject *tmp = PyNumber_Add(stop, length);
-            Py_DECREF(stop);
-            stop = tmp;
+            Py_SETREF(stop, tmp);
             if (stop == NULL)
                 goto error;
 
@@ -495,9 +489,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
             if (cmp_result < 0)
                 goto error;
             if (cmp_result) {
-                Py_INCREF(lower);
-                Py_DECREF(stop);
-                stop = lower;
+                Py_SETREF(stop, Py_NewRef(lower));
             }
         }
         else {
@@ -505,9 +497,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
             if (cmp_result < 0)
                 goto error;
             if (cmp_result) {
-                Py_INCREF(upper);
-                Py_DECREF(stop);
-                stop = upper;
+                Py_SETREF(stop, Py_NewRef(upper));
             }
         }
     }

diff --git a/Objects/stringlib/unicode_format.h b/Objects/stringlib/unicode_format.h
index e970588a7e34bc00708fc7a630f4bbb140257c90..ccd7c77c0a03fdbbcc3106b8961e6230d05f7051 100644 (file)
--- a/Objects/stringlib/unicode_format.h
+++ b/Objects/stringlib/unicode_format.h
@@ -473,8 +473,7 @@ get_field_object(SubString *input, PyObject *args, PyObject *kwargs,
             goto error;
 
         /* assign to obj */
-        Py_DECREF(obj);
-        obj = tmp;
+        Py_SETREF(obj, tmp);
     }
     /* end of iterator, this is the non-error case */
     if (ok == 1)
@@ -825,8 +824,7 @@ output_markup(SubString *field_name, SubString *format_spec,
             goto done;
 
         /* do the assignment, transferring ownership: fieldobj = tmp */
-        Py_DECREF(fieldobj);
-        fieldobj = tmp;
+        Py_SETREF(fieldobj, tmp);
         tmp = NULL;
     }
 

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 9d868d51f027508240d1864c54db1a37db02b710..312406993c5b23109d29ca9fce598bcf625834db 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -5968,8 +5968,7 @@ object___dir___impl(PyObject *self)
     else {
         /* Copy __dict__ to avoid mutating it. */
         PyObject *temp = PyDict_Copy(dict);
-        Py_DECREF(dict);
-        dict = temp;
+        Py_SETREF(dict, temp);
     }
 
     if (dict == NULL)
@@ -9377,8 +9376,7 @@ super_getattro(PyObject *self, PyObject *name)
                        (See SF ID #743627)  */
                     (su->obj == (PyObject *)starttype) ? NULL : su->obj,
                     (PyObject *)starttype);
-                Py_DECREF(res);
-                res = res2;
+                Py_SETREF(res, res2);
             }
 
             Py_DECREF(mro);

diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index b1acfc71379cd55b52700f005c1e34d91ca55d68..55f029dd504ca07aafb75bd57e0a7ed0ddecda19 100644 (file)
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -13572,8 +13572,7 @@ _PyUnicode_FormatLong(PyObject *val, int alt, int prec, int type)
         for (i = 0; i < numdigits; i++)
             *b1++ = *buf++;
         *b1 = '\0';
-        Py_DECREF(result);
-        result = r1;
+        Py_SETREF(result, r1);
         buf = PyBytes_AS_STRING(result);
         len = numnondigits + prec;
     }
@@ -13590,8 +13589,7 @@ _PyUnicode_FormatLong(PyObject *val, int alt, int prec, int type)
         || buf != PyUnicode_DATA(result)) {
         PyObject *unicode;
         unicode = _PyUnicode_FromASCII(buf, len);
-        Py_DECREF(result);
-        result = unicode;
+        Py_SETREF(result, unicode);
     }
     else if (len != PyUnicode_GET_LENGTH(result)) {
         if (PyUnicode_Resize(&result, len) < 0)

diff --git a/Objects/weakrefobject.c b/Objects/weakrefobject.c
index ff284c882b0f1c478450d79f8fa73db162894c01..bd7720e275330786b9f13adf446577122978e580 100644 (file)
--- a/Objects/weakrefobject.c
+++ b/Objects/weakrefobject.c
@@ -824,8 +824,7 @@ PyWeakref_NewRef(PyObject *ob, PyObject *callback)
                        during GC.  Return that one instead of this one
                        to avoid violating the invariants of the list
                        of weakrefs for ob. */
-                    Py_DECREF(result);
-                    result = (PyWeakReference*)Py_NewRef(ref);
+                    Py_SETREF(result, (PyWeakReference*)Py_NewRef(ref));
                 }
             }
             else {
@@ -888,8 +887,7 @@ PyWeakref_NewProxy(PyObject *ob, PyObject *callback)
                        during GC.  Return that one instead of this one
                        to avoid violating the invariants of the list
                        of weakrefs for ob. */
-                    Py_DECREF(result);
-                    result = (PyWeakReference*)Py_NewRef(proxy);
+                    Py_SETREF(result, (PyWeakReference*)Py_NewRef(proxy));
                     goto skip_insert;
                 }
                 prev = ref;

diff --git a/Python/_warnings.c b/Python/_warnings.c
index d703e1e6d843a5c5e2f2618e2e94cf06476fc2ac..046c37eb49bac0384a51c4c2cf56f3aaaac45c8a 100644 (file)
--- a/Python/_warnings.c
+++ b/Python/_warnings.c
@@ -801,8 +801,7 @@ next_external_frame(PyFrameObject *frame)
 {
     do {
         PyFrameObject *back = PyFrame_GetBack(frame);
-        Py_DECREF(frame);
-        frame = back;
+        Py_SETREF(frame, back);
     } while (frame != NULL && is_internal_frame(frame));
 
     return frame;
@@ -828,8 +827,7 @@ setup_context(Py_ssize_t stack_level, PyObject **filename, int *lineno,
     if (stack_level <= 0 || is_internal_frame(f)) {
         while (--stack_level > 0 && f != NULL) {
             PyFrameObject *back = PyFrame_GetBack(f);
-            Py_DECREF(f);
-            f = back;
+            Py_SETREF(f, back);
         }
     }
     else {

diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 119e21ae0da2900b8d244213d16d9ae17c4dca79..c2cf79a727f0a895ee06aecbc3a7794a4bfe050b 100644 (file)
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -168,8 +168,7 @@ builtin___build_class__(PyObject *self, PyObject *const *args, Py_ssize_t nargs,
             goto error;
         }
         if (winner != meta) {
-            Py_DECREF(meta);
-            meta = Py_NewRef(winner);
+            Py_SETREF(meta, Py_NewRef(winner));
         }
     }
     /* else: meta is not a class, so we cannot do the metaclass

diff --git a/Python/compile.c b/Python/compile.c
index 9226bc233ead747ebcb55fa08acf32cf646186b0..366321143a54aa4c5834cfc481f2fa2905c7a1b9 100644 (file)
--- a/Python/compile.c
+++ b/Python/compile.c
@@ -8280,9 +8280,7 @@ merge_const_one(PyObject *const_cache, PyObject **obj)
         t = PyTuple_GET_ITEM(t, 1);
     }
 
-    Py_INCREF(t);
-    Py_DECREF(*obj);
-    *obj = t;
+    Py_SETREF(*obj, Py_NewRef(t));
     return 1;
 }
 

diff --git a/Python/errors.c b/Python/errors.c
index d74ac347484fed52e4f430247734871a8297e05b..6a42f5912f942abcc17238d1afb70b0091d1c468 100644 (file)
--- a/Python/errors.c
+++ b/Python/errors.c
@@ -353,16 +353,13 @@ _PyErr_NormalizeException(PyThreadState *tstate, PyObject **exc,
             if (fixed_value == NULL) {
                 goto error;
             }
-            Py_DECREF(value);
-            value = fixed_value;
+            Py_SETREF(value, fixed_value);
         }
         /* If the class of the instance doesn't exactly match the
            class of the type, believe the instance.
         */
         else if (inclass != type) {
-            Py_INCREF(inclass);
-            Py_DECREF(type);
-            type = inclass;
+            Py_SETREF(type, Py_NewRef(inclass));
         }
     }
     *exc = type;

diff --git a/Python/hamt.c b/Python/hamt.c
index c4e47eb9e5703a754322f3b3b2679ec946af619b..8cb94641bef251b1b0c5d943b2898db80579f683 100644 (file)
--- a/Python/hamt.c
+++ b/Python/hamt.c
@@ -1354,8 +1354,7 @@ hamt_node_collision_assoc(PyHamtNode_Collision *self,
                 }
 
                 /* Replace the old value with the new value for the our key. */
-                Py_DECREF(new_node->c_array[val_idx]);
-                new_node->c_array[val_idx] = Py_NewRef(val);
+                Py_SETREF(new_node->c_array[val_idx], Py_NewRef(val));
 
                 return (PyHamtNode *)new_node;
 

diff --git a/Python/pythonrun.c b/Python/pythonrun.c
index 70872222eb645876927e35e665cd64242e6db3cb..35292b6478a833a24f00b03c87fc26c7a0aa077d 100644 (file)
--- a/Python/pythonrun.c
+++ b/Python/pythonrun.c
@@ -718,8 +718,7 @@ _Py_HandleSystemExit(int *exitcode_p)
         /* The error code should be in the `code' attribute. */
         PyObject *code = PyObject_GetAttr(value, &_Py_ID(code));
         if (code) {
-            Py_DECREF(value);
-            value = code;
+            Py_SETREF(value, code);
             if (value == Py_None)
                 goto done;
         }

diff --git a/Python/sysmodule.c b/Python/sysmodule.c
index 6f0a126a62277b46ff49a423c981b6a3890d4b59..88f806e616f27e86ab1ce6bc5f24d7fb2339b7b3 100644 (file)
--- a/Python/sysmodule.c
+++ b/Python/sysmodule.c
@@ -198,8 +198,7 @@ sys_audit_tstate(PyThreadState *ts, const char *event,
         eventArgs = _Py_VaBuildValue_SizeT(argFormat, vargs);
         if (eventArgs && !PyTuple_Check(eventArgs)) {
             PyObject *argTuple = PyTuple_Pack(1, eventArgs);
-            Py_DECREF(eventArgs);
-            eventArgs = argTuple;
+            Py_SETREF(eventArgs, argTuple);
         }
     }
     else {

diff --git a/Python/traceback.c b/Python/traceback.c
index 356e64364832aae48e2bf02b3bc0756c4516525d..da26c9b260a3bd90a2a4501b5f411bfbbaf14685 100644 (file)
--- a/Python/traceback.c
+++ b/Python/traceback.c
@@ -136,9 +136,7 @@ tb_next_set(PyTracebackObject *self, PyObject *new_next, void *Py_UNUSED(_))
         cursor = cursor->tb_next;
     }
 
-    PyObject *old_next = (PyObject*)self->tb_next;
-    self->tb_next = (PyTracebackObject *)Py_XNewRef(new_next);
-    Py_XDECREF(old_next);
+    Py_XSETREF(self->tb_next, (PyTracebackObject *)Py_XNewRef(new_next));
 
     return 0;
 }
@@ -533,8 +531,7 @@ display_source_line_with_margin(PyObject *f, PyObject *filename, int lineno, int
         PyObject *truncated;
         truncated = PyUnicode_Substring(lineobj, i, PyUnicode_GET_LENGTH(lineobj));
         if (truncated) {
-            Py_DECREF(lineobj);
-            lineobj = truncated;
+            Py_SETREF(lineobj, truncated);
         } else {
             PyErr_Clear();
         }