weakrefobject.c: binary, ternary, or comparison operations ref leak with dead proxy

Bug report

Bug description:

Original gist: https://gist.github.com/devdanzin/f7d0c7694b2be2345f4cf85f4eedc3ee

Summary

When first UNWRAP(x) succeeds but second UNWRAP(y) fails (dead proxy), x's new reference is leaked. Affects ~20 binary operators (+, -, *, /, |, &, ^, etc.).

Reproducer

import weakref, sys, gc

class C:
    def __add__(self, other): return NotImplemented
    def __radd__(self, other): return NotImplemented

obj = type('D', (), {})()
dead = weakref.proxy(obj)
del obj; gc.collect()

live_obj = C()
live = weakref.proxy(live_obj)

before = sys.gettotalrefcount()
for i in range(10000):
    try:
        live + dead
    except ReferenceError:
        pass
after = sys.gettotalrefcount()
print(f"Leaked {after - before} refs (~{(after-before)//10000}/call)")

Actually, ternary, or comparison operations have the same problem.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

• gh-153059

Start in weakrefobject.c and run the provided refcount reproducer on a CPython main build. Check the binary, ternary, and comparison operation paths described in the report; done means the dead-proxy cases no longer leak references, including the repeated reproducer loop.