Fix the third crash

python · sobolevn · Jan 15, 2026 · Jan 10, 2026 · Jan 11, 2026 · Jan 14, 2026
commit 4e08352103ecb6c8a81b8d32d046153c40f3c3a9
diff --git a/Lib/test/test_genericalias.py b/Lib/test/test_genericalias.py
@@ -259,7 +259,7 @@ def __getattr__(self, name):
 
         params = []
         params.append(Zap(params))
-        alias = type(list[int])(list, (params,))
+        alias = GenericAlias(list, (params,))
         repr_str = repr(alias)
         self.assertTrue(repr_str.startswith("list[["), repr_str)
 
@@ -277,10 +277,23 @@ def __getattr__(self, name):
 
         params = []
         params.append(Zap(params))
-        alias = type(list[int])(list, (params,))
+        alias = GenericAlias(list, (params,))
         repr_str = repr(alias)
         self.assertTrue(repr_str.startswith("list[["), repr_str)
 
+    def test_evil_repr3(self):
+        # gh-143823
+        lst = []
+        class X:
+            def __repr__(self):
+                lst.clear()
+                return "x"
+
+        lst += [X(), 1]
+        ga = GenericAlias(int, lst)
+        with self.assertRaises(IndexError):
+            repr(ga)
+
     def test_exposed_type(self):
         import types
         a = types.GenericAlias(list, int)

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst
@@ -1 +1 @@
-Fixes a crash in ``_Py_typing_type_repr`` function.
+Fixes a crash in ``ga_repr_items_list`` function.
diff --git a/Objects/genericaliasobject.c b/Objects/genericaliasobject.c
@@ -68,10 +68,15 @@ ga_repr_items_list(PyUnicodeWriter *writer, PyObject *p)
                 return -1;
             }
         }
-        PyObject *item = PyList_GET_ITEM(p, i);
+        PyObject *item = PyList_GetItemRef(p, i);
+        if (item == NULL) {
+            return -1;  // list can be mutated in a callback
+        }
         if (_Py_typing_type_repr(writer, item) < 0) {
+            Py_DECREF(item);
             return -1;
         }
+        Py_DECREF(item);
     }
 
     if (PyUnicodeWriter_WriteChar(writer, ']') < 0) {

diff --git a/Objects/typevarobject.c b/Objects/typevarobject.c
@@ -270,14 +270,13 @@ _Py_typing_type_repr(PyUnicodeWriter *writer, PyObject *p)
     if (p == Py_Ellipsis) {
         // The Ellipsis object
         r = PyUnicode_FromString("...");
-        goto cleanup;
+        goto exit;
     }
 
     if (p == (PyObject *)&_PyNone_Type) {
         return PyUnicodeWriter_WriteASCII(writer, "None", 4);
     }
 
-    Py_INCREF(p);  // gh-143635
     if ((rc = PyObject_HasAttrWithError(p, &_Py_ID(__origin__))) > 0 &&
         (rc = PyObject_HasAttrWithError(p, &_Py_ID(__args__))) > 0)
     {
@@ -317,8 +316,6 @@ _Py_typing_type_repr(PyUnicodeWriter *writer, PyObject *p)
 use_repr:
     r = PyObject_Repr(p);
 exit:
-    Py_DECREF(p);  // gh-143635
-cleanup:
     Py_XDECREF(qualname);
     Py_XDECREF(module);
     if (r == NULL) {
Original file line number	Diff line number	Diff line change
		@@ -1 +1 @@
		Fixes a crash in ``_Py_typing_type_repr`` function.
		Fixes a crash in ``ga_repr_items_list`` function.