From aaf16ec66f17519f6857036cb238634c6f8f861d Mon Sep 17 00:00:00 2001
From: Victor Stinner <vstinner@python.org>
Date: Wed, 24 Jun 2026 17:32:49 +0200
Subject: [PATCH] gh-152090: Fix CALL_LIST_APPEND opcode error path

Clear arg since PyStackRef_AsPyObjectSteal(arg) converted arg to a
dangling stack reference.
---
 Modules/_testinternalcapi/test_cases.c.h | 1 +
 Python/bytecodes.c                       | 1 +
 Python/executor_cases.c.h                | 4 ++++
 Python/generated_cases.c.h               | 1 +
 4 files changed, 7 insertions(+)

diff --git a/Modules/_testinternalcapi/test_cases.c.h b/Modules/_testinternalcapi/test_cases.c.h
index 76493327ca0a00b..433d6d3e86128f4 100644
--- a/Modules/_testinternalcapi/test_cases.c.h
+++ b/Modules/_testinternalcapi/test_cases.c.h
@@ -3981,6 +3981,7 @@
                 int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
                 UNLOCK_OBJECT(self_o);
                 if (err) {
+                    stack_pointer[-1] = PyStackRef_NULL;
                     JUMP_TO_LABEL(error);
                 }
                 c = callable;
diff --git a/Python/bytecodes.c b/Python/bytecodes.c
index 8afa0be702357de..f52109096779988 100644
--- a/Python/bytecodes.c
+++ b/Python/bytecodes.c
@@ -5108,6 +5108,7 @@ dummy_func(
             int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
             UNLOCK_OBJECT(self_o);
             if (err) {
+                stack_pointer[-1] = PyStackRef_NULL;
                 ERROR_NO_POP();
             }
             c = callable;
diff --git a/Python/executor_cases.c.h b/Python/executor_cases.c.h
index 63b77c9e1527787..fa37f89d5140f9d 100644
--- a/Python/executor_cases.c.h
+++ b/Python/executor_cases.c.h
@@ -19097,6 +19097,7 @@
             int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
             UNLOCK_OBJECT(self_o);
             if (err) {
+                stack_pointer[-1] = PyStackRef_NULL;
                 SET_CURRENT_CACHED_VALUES(0);
                 JUMP_TO_ERROR();
             }
@@ -19139,6 +19140,7 @@
             int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
             UNLOCK_OBJECT(self_o);
             if (err) {
+                stack_pointer[-1] = PyStackRef_NULL;
                 stack_pointer += 1;
                 ASSERT_WITHIN_STACK_BOUNDS(__FILE__, __LINE__);
                 SET_CURRENT_CACHED_VALUES(0);
@@ -19185,6 +19187,7 @@
             int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
             UNLOCK_OBJECT(self_o);
             if (err) {
+                stack_pointer[-1] = PyStackRef_NULL;
                 stack_pointer[0] = self;
                 stack_pointer += 2;
                 ASSERT_WITHIN_STACK_BOUNDS(__FILE__, __LINE__);
@@ -19234,6 +19237,7 @@
             int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
             UNLOCK_OBJECT(self_o);
             if (err) {
+                stack_pointer[-1] = PyStackRef_NULL;
                 stack_pointer[0] = callable;
                 stack_pointer[1] = self;
                 stack_pointer += 3;
diff --git a/Python/generated_cases.c.h b/Python/generated_cases.c.h
index 2cdf48c559a292c..92eb2acc1f5cbe6 100644
--- a/Python/generated_cases.c.h
+++ b/Python/generated_cases.c.h
@@ -3981,6 +3981,7 @@
                 int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
                 UNLOCK_OBJECT(self_o);
                 if (err) {
+                    stack_pointer[-1] = PyStackRef_NULL;
                     JUMP_TO_LABEL(error);
                 }
                 c = callable;