Issue 31608: crash in methods of a subclass of _collections.deque with a bad __new__()

The following code causes the interpreter to crash:

import _collections
class BadDeque(_collections.deque):
    def __new__(cls, *args):
        if len(args):
            return 42
        return _collections.deque.__new__(cls)

BadDeque() * 42

(The interpreter would crash also if we replaced 'BadDeque() * 42' with
'BadDeque() + _collections.deque([42])'.)

This is because deque_copy() (in Modules/_collectionsmodule.c) returns whatever
BadDeque() returned, without verifying it is a deque.
deque_repeat() assumes that deque_copy() returned a deque, and passes it to
deque_inplace_repeat(), which assumes it is a deque, and crashes.

(Similarly, deque_concat() assumes that deque_copy() returned a deque, which
is the reason for the other crash.)


ISTM it is a very unlikely corner case, so that adding a test (as well as
a NEWS.d item) for it is unnecessary.
What do you think?

All other sequence objects return an instance of the base class rather than a subclass. list, tuple, str, bytes, bytearray, array. Only deque tries to create an instance of a subclass.

I meant that if make deque.copy(), deque.__add__() and deque.__mul__() returning an exact deque for subclasses, this would make the deque class more consistent with other collections and solve this issue. This could even make them (almost) atomic.

New changeset 24bd50bdcc97d65130c07d6cd26085fd06c3e972 by Benjamin Peterson (Oren Milman) in branch 'master':
closes bpo-31608: Fix a crash in methods of a subclass of _collections.deque with a bad __new__(). (GH-3788)
https://github.com/python/cpython/commit/24bd50bdcc97d65130c07d6cd26085fd06c3e972

New changeset 536e45accf8f05355dd943a6966b9968cdb15f5a by Miss Islington (bot) in branch '3.7':
closes bpo-31608: Fix a crash in methods of a subclass of _collections.deque with a bad __new__(). (GH-3788)
https://github.com/python/cpython/commit/536e45accf8f05355dd943a6966b9968cdb15f5a

New changeset ccbbdd0a1e00ecad6f0005438dd6ff6d84fd9ceb by Benjamin Peterson in branch '3.6':
[3.6] closes bpo-31608: Fix a crash in methods of a subclass of _collections.deque with a bad __new__(). (GH-9178)
https://github.com/python/cpython/commit/ccbbdd0a1e00ecad6f0005438dd6ff6d84fd9ceb

New changeset 253279c616d4f34287c5749df15e20eb2eb988d6 by Benjamin Peterson in branch '2.7':
[2.7] closes bpo-31608: Fix a crash in methods of a subclass of _collections.deque with a bad __new__(). (GH-9179)
https://github.com/python/cpython/commit/253279c616d4f34287c5749df15e20eb2eb988d6

nosy: + benjamin.peterson
messages: + msg325049

resolution: fixed
stage: patch review -> resolved

messages: + msg303133

assignee: rhettinger