Bug report

Bug description:

This was one of the trickiest bugs I had to catch in recent times, but you can catch this by inserting

assert(PyUnicode_CheckExact(left_o));

after https://github.com/python/cpython/blob/main/Python/bytecodes.c#L804. This will crash, as it's actually a use-after-free in some cases.

This was introduced in
#130708

The problem is that we are not checking for uniqueness of the reference before appending to it. This is incorrect as it may in-place append something that is not safe to do so.

The only reason why this never surfaced is that we never used LHS and immediately trashed it. Since it was always borrowed, the close is a no-op, and that just never causes a UAF. For correctness sake and to spare other contributors from stumbling over this bug (like the one I was helping did), which should fix it.

The fix is to check for !_PyObject_IsUniquelyReferenced(*target_local) and deopt if true.

While I think this affects 3.14 too, it should never manifest in practice. So let's just fix this on main.

CPython versions tested on:

CPython main branch, 3.15, 3.14

Operating systems tested on:

No response

Linked PRs

• gh-143401: Check for unique reference for _BINARY_OP_INPLACE_ADD_UNICODE #143402