From e613606fa40d1d765c185646b956b620a4fa2042 Mon Sep 17 00:00:00 2001
From: Sam Gross <colesbury@gmail.com>
Date: Thu, 8 Aug 2024 17:07:42 +0000
Subject: [PATCH] gh-117139: Fix a few `_PyStackRef` related bugs

BUILD_SET should use a borrow instead of a steal. The cleanup in
_DO_CALL CONVERSION_FAILED was incorrect.

Co-authored-by: Ken Jin <kenjin@python.org>
---
 Python/bytecodes.c         | 10 ++++++----
 Python/executor_cases.c.h  |  5 ++---
 Python/generated_cases.c.h | 15 ++++++---------
 3 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/Python/bytecodes.c b/Python/bytecodes.c
index b68f9327d898c2..70c7d82b090468 100644
--- a/Python/bytecodes.c
+++ b/Python/bytecodes.c
@@ -1714,11 +1714,10 @@ dummy_func(
             }
             int err = 0;
             for (int i = 0; i < oparg; i++) {
-                PyObject *item = PyStackRef_AsPyObjectSteal(values[i]);
                 if (err == 0) {
-                    err = PySet_Add(set_o, item);
+                    err = PySet_Add(set_o, PyStackRef_AsPyObjectBorrow(values[i]));
                 }
-                Py_DECREF(item);
+                PyStackRef_CLOSE(values[i]);
             }
             if (err != 0) {
                 Py_DECREF(set_o);
@@ -3235,7 +3234,10 @@ dummy_func(
             /* Callable is not a normal Python function */
             STACKREFS_TO_PYOBJECTS(args, total_args, args_o);
             if (CONVERSION_FAILED(args_o)) {
-                DECREF_INPUTS();
+                PyStackRef_CLOSE(callable);
+                for (int i = 0; i < total_args; i++) {
+                    PyStackRef_CLOSE(args[i]);
+                }
                 ERROR_IF(true, error);
             }
             PyObject *res_o = PyObject_Vectorcall(
diff --git a/Python/executor_cases.c.h b/Python/executor_cases.c.h
index f2741286d60197..d64ef0cbeee3be 100644
--- a/Python/executor_cases.c.h
+++ b/Python/executor_cases.c.h
@@ -1957,11 +1957,10 @@
             }
             int err = 0;
             for (int i = 0; i < oparg; i++) {
-                PyObject *item = PyStackRef_AsPyObjectSteal(values[i]);
                 if (err == 0) {
-                    err = PySet_Add(set_o, item);
+                    err = PySet_Add(set_o, PyStackRef_AsPyObjectBorrow(values[i]));
                 }
-                Py_DECREF(item);
+                PyStackRef_CLOSE(values[i]);
             }
             if (err != 0) {
                 Py_DECREF(set_o);
diff --git a/Python/generated_cases.c.h b/Python/generated_cases.c.h
index d0aa0f9fe83182..a290e1ed81aa32 100644
--- a/Python/generated_cases.c.h
+++ b/Python/generated_cases.c.h
@@ -714,11 +714,10 @@
             }
             int err = 0;
             for (int i = 0; i < oparg; i++) {
-                PyObject *item = PyStackRef_AsPyObjectSteal(values[i]);
                 if (err == 0) {
-                    err = PySet_Add(set_o, item);
+                    err = PySet_Add(set_o, PyStackRef_AsPyObjectBorrow(values[i]));
                 }
-                Py_DECREF(item);
+                PyStackRef_CLOSE(values[i]);
             }
             if (err != 0) {
                 Py_DECREF(set_o);
@@ -917,9 +916,8 @@
                 STACKREFS_TO_PYOBJECTS(args, total_args, args_o);
                 if (CONVERSION_FAILED(args_o)) {
                     PyStackRef_CLOSE(callable);
-                    PyStackRef_CLOSE(self_or_null);
-                    for (int _i = oparg; --_i >= 0;) {
-                        PyStackRef_CLOSE(args[_i]);
+                    for (int i = 0; i < total_args; i++) {
+                        PyStackRef_CLOSE(args[i]);
                     }
                     if (true) {
                         stack_pointer += -2 - oparg;
@@ -3705,9 +3703,8 @@
                 STACKREFS_TO_PYOBJECTS(args, total_args, args_o);
                 if (CONVERSION_FAILED(args_o)) {
                     PyStackRef_CLOSE(callable);
-                    PyStackRef_CLOSE(self_or_null);
-                    for (int _i = oparg; --_i >= 0;) {
-                        PyStackRef_CLOSE(args[_i]);
+                    for (int i = 0; i < total_args; i++) {
+                        PyStackRef_CLOSE(args[i]);
                     }
                     if (true) {
                         stack_pointer += -2 - oparg;