Type confusion in float_richcompare via re-entrant __neg__ #143006

static PyObject*
float_richcompare(PyObject *v, PyObject *w, int op)
{
    /* ... */
    double fracpart;
    double intpart;
    PyObject *result = NULL;
    PyObject *vv = NULL;
    PyObject *ww = w;

    if (wsign < 0) {
        // Trigger the __neg__ on the int object whose return value set to ww
        ww = PyNumber_Negative(w);
        if (ww == NULL)
            goto Error;
    }
    else
        Py_INCREF(ww);

    fracpart = modf(i, &intpart);
    vv = PyLong_FromDouble(intpart);
    if (vv == NULL)
        goto Error;

    if (fracpart != 0.0) {
        /* Shift left, and or a 1 bit into vv
            * to represent the lost fraction.
            */
        PyObject *temp;

        // Type Confusion: ww has been casted to PyLong with only assertion check (doesn't work on release version)
        temp = _PyLong_Lshift(ww, 1);
        Py_SETREF(ww, temp);
        /* ... */

        r = PyObject_RichCompareBool(vv, ww, op);

PyObject *
_PyLong_Lshift(PyObject *a, int64_t shiftby)
{
    return long_lshift_int64(_PyLong_CAST(a), shiftby);
}