`super.__new__(super)` can create an object that causes a NULL dereference in supercheck()

Crash report

What happened?

super.__new__(super) can create a super object whose internal type field is NULL. Using that object as a descriptor then causes a segmentation fault in supercheck().

Minimal reproducer:

s = super.__new__(super)
print(s)
s.__get__(1)

Output:

<super: <class 'NULL'>, NULL>
Segmentation fault (core dumped)

The one-line form also reproduces the crash:

super.__new__(super).__get__(1)

This is deterministic on the tested build.

A normal initialized super object does not crash:

class A:
    pass

class B(A):
    pass

s = super(B, B())
print(s.__get__(B()))

Output:

<super: <class 'B'>, ...>

GDB confirms the NULL dereference:

Program received signal SIGSEGV, Segmentation fault.
supercheck (type=0x0, obj=...)
    at Objects/typeobject.c:12605

The crashing code is:

PyErr_Format(PyExc_TypeError,
            "super(type, obj): obj (%s %.200s) is not "
            "an instance or subtype of type (%.200s).",
            type_or_instance, obj_str, type->tp_name);

Here type == NULL, so evaluating type->tp_name dereferences NULL.

The relevant call path is:

super.__new__(super)
    -> PyType_GenericNew()
    -> uninitialized super object (su->type == NULL)
    -> super_descr_get()
    -> supercheck(su->type, obj)
    -> type->tp_name
    -> SIGSEGV

PySuper_Type currently uses PyType_GenericNew as its tp_new, while initialization of the internal fields is performed separately by super_init. Therefore direct use of super.__new__(super) bypasses that initialization.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (heads/audit-objects-phase1-dirty:c3aefdb9eff, Aug 7 2026, 19:38:01) [GCC 13.3.0]

Linked PRs

• gh-155379

Comece em Objects/typeobject.c, em supercheck(), e depois acompanhe o PyType_GenericNew de PySuper_Type e o caminho separado super_init descrito no relatório. Use o reprodutor com super.new(super).get(1) como cobertura de regressão; está concluído quando ele não mais trava e, em vez disso, relata um erro apropriado.