gh-115733: Fix crash involving exhausted list iterator (#115740)

colesbury · web-flow · commit 520403ed4cdf · 2024-02-21T05:18:44.000+09:00
* gh-115733: Fix crash involving exhausted iterator * Add blurb
diff --git a/Lib/test/list_tests.py b/Lib/test/list_tests.py
@@ -562,3 +562,8 @@ def test_exhausted_iterator(self):
         self.assertEqual(list(exhit), [])
         self.assertEqual(list(empit), [9])
         self.assertEqual(a, self.type2test([1, 2, 3, 9]))
+
+        # gh-115733: Crash when iterating over exhausted iterator
+        exhit = iter(self.type2test([1, 2, 3]))
+        for _ in exhit:
+            next(exhit, 1)
diff --git a/Misc/NEWS.d/next/Core and Builtins/2024-02-20-18-49-02.gh-issue-115733.51Zb85.rst b/Misc/NEWS.d/next/Core and Builtins/2024-02-20-18-49-02.gh-issue-115733.51Zb85.rst
@@ -0,0 +1 @@
+Fix crash when calling ``next()`` on exhausted list iterators.
diff --git a/Objects/listobject.c b/Objects/listobject.c
@@ -3537,13 +3537,13 @@ listreviter_next(PyObject *self)
 {
     listreviterobject *it = (listreviterobject *)self;
     assert(it != NULL);
-    PyListObject *seq = it->it_seq;
-    assert(PyList_Check(seq));
-
     Py_ssize_t index = LOAD_SSIZE(it->it_index);
     if (index < 0) {
         return NULL;
     }
+
+    PyListObject *seq = it->it_seq;
+    assert(PyList_Check(seq));
     PyObject *item = list_get_item_ref(seq, index);
     if (item != NULL) {
         STORE_SSIZE(it->it_index, index - 1);
diff --git a/Python/bytecodes.c b/Python/bytecodes.c
@@ -2612,7 +2612,7 @@ dummy_func(
             assert(Py_TYPE(iter) == &PyListIter_Type);
             STAT_INC(FOR_ITER, hit);
             PyListObject *seq = it->it_seq;
-            if ((size_t)it->it_index >= (size_t)PyList_GET_SIZE(seq)) {
+            if (seq == NULL || (size_t)it->it_index >= (size_t)PyList_GET_SIZE(seq)) {
                 it->it_index = -1;
                 #ifndef Py_GIL_DISABLED
                 if (seq != NULL) {
@@ -2633,6 +2633,7 @@ dummy_func(
             _PyListIterObject *it = (_PyListIterObject *)iter;
             assert(Py_TYPE(iter) == &PyListIter_Type);
             PyListObject *seq = it->it_seq;
+            DEOPT_IF(seq == NULL);
             DEOPT_IF((size_t)it->it_index >= (size_t)PyList_GET_SIZE(seq));
         }
 
diff --git a/Python/executor_cases.c.h b/Python/executor_cases.c.h
diff --git a/Python/generated_cases.c.h b/Python/generated_cases.c.h
