bpo-39453: Make list.__contains__ hold strong references to avoid crashes (GH-18181)

Lib/test/test_list.py

@@ -221,6 +221,11 @@ class ListTest(list_tests.CommonTest):
         with self.assertRaises(ValueError):
             lst.remove(lst)
 
+        # bpo-39453: list.__contains__ was not holding strong references
+        # to list elements while calling PyObject_RichCompareBool().
+        lst = [X(), X()]
+        3 in lst
+
 
 if __name__ == "__main__":
     unittest.main()

Misc/NEWS.d/next/Core and Builtins/2020-01-25-23-51-17.bpo-39453.xCOkYk.rst

@@ -0,0 +1,2 @@
+Fixed a possible crash in :meth:`list.__contains__` when a list is changed
+during comparing items. Patch by Dong-hee Na.

Objects/listobject.c

@@ -445,11 +445,16 @@ list_length(PyListObject *a)
 static int
 list_contains(PyListObject *a, PyObject *el)
 {
+    PyObject *item;
     Py_ssize_t i;
     int cmp;
 
-    for (i = 0, cmp = 0 ; cmp == 0 && i < Py_SIZE(a); ++i)
+    for (i = 0, cmp = 0 ; cmp == 0 && i < Py_SIZE(a); ++i) {
+        item = PyList_GET_ITEM(a, i);
+        Py_INCREF(item);
         cmp = PyObject_RichCompareBool(PyList_GET_ITEM(a, i), el, Py_EQ);
+        Py_DECREF(item);
+    }
     return cmp;
 }