[3.12] gh-131998: Fix NULL dereference when using an unbound method descriptor in a specialized code path (GH-132000)

[andersk]

(cherry picked from commit ac3c439)

• Issue: The interpreter crashes when specializing bound method calls on unbound objects #131998

That issue was never labeled 3.12, I assume because the reported test cases happen not to segfault there. However, this variant case does segfault on 3.12 (tested on Linux x86-64 in all of docker run python:3.12.14, docker run python:3.12.14-alpine, uv run -p 3.12.14 python, and a build from source), and is fixed by this patch:

def g():
    list.pop()

def f():
    g()

for i in range(2):
    try:
        f()
    except TypeError:
        pass

I reduced this from a test suite failure in the wild. The maintainer had previously observed this failure and marked the test as skipped in CI: https://github.com/abelcheung/types-lxml/blob/2026.02.16/tests/runtime/test_relaxng.py#L122.

Any uninitialized pointer dereference has potential security implications, so I think there’s a clear case for backporting this to 3.12.

• Issue: The interpreter crashes when specializing bound method calls on unbound objects #131998

[andersk]

(Note that isn’t the case that crashes on existing 3.12—I prioritized a straight backport from 3.13/3.14.)

[ZeroIntensity]

Please contact the PSRT at security@python.org if you think this is a security issue with a real attack surface. They can decide whether this warrants a 3.12 backport.

Keep in mind that we don't typically consider segfaults to be security problems, unless they're exploitable in a practical manner (which is rare, because it usually involves being able to run arbitrary Python code as a prerequisite).

cc @sethmlarson @StanFromIreland

[bedevere-app]

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

[StanFromIreland]

This isn't a security vulnerability per our security policy, since it requires arbitrary Python execution.

As such, backporting is left to the RM's discretion.