CPython crashes if run on the following code:

classpro(property):def__new__(typ,*args,**kwargs):return"abcdef"classA:passp=property.__new__(pro)p.__set_name__(A,1)np=p.getter(lambdaself:1)

The crash happens on the last line. The problem is thefollowing code inproperty_copy:

new=PyObject_CallFunctionObjArgs(type,get,set,del,doc,NULL);Py_DECREF(type);if (new==NULL)returnNULL;Py_XSETREF(((propertyobject*)new)->prop_name,Py_XNewRef(pold->prop_name));returnnew;

In the crashing code,new is a string, so casting it topropertyobject and writing toprop_name is wrong.

This is synthetic code, I found the problem while porting some 3.10 features to PyPy and thinking about corner cases.

Linked PRs

• gh-100942: Fix crash onproperty subtypes with weird__new__ #100955
• GH-100942: Fix incorrect cast in property_copy(). #100965
• [3.11] GH-100942: Fix incorrect cast in property_copy(). (GH-100965). #101008
• [3.10] GH-100942: Fix incorrect cast in property_copy(). (GH-100965). #101009