Reference count leak when there is an error in the BUILD_MAP opcode

[timofej673]

Bug report

Bug description:

        inst(BUILD_MAP, (values[oparg*2] -- map)) {
            map = _PyDict_FromItems(
                    values, 2,
                    values+1, 2,
                    oparg);
            if (map == NULL)     <--------------
                goto error; <------------------

            DECREF_INPUTS();
            ERROR_IF(map == NULL, error);
        }

If an error occurs, the number of links will not decrease

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

Linked PRs

• gh-109216: Fix possible memory leak in BUILD_MAP #109257
• [3.11] gh-109216: Fix possible memory leak in BUILD_MAP #109323
• [3.12] gh-109216: Fix possible memory leak in BUILD_MAP #109324

[sobolevn]

Generated code is also wrong:

        TARGET(BUILD_MAP) {
            PyObject **values;
            PyObject *map;
            values = stack_pointer - oparg*2;
            map = _PyDict_FromItems(
                    values, 2,
                    values+1, 2,
                    oparg);
            if (map == NULL)
                goto error;

            for (int _i = oparg*2; --_i >= 0;) {
                Py_DECREF(values[_i]);
            }
            if (map == NULL) { STACK_SHRINK(oparg*2); goto error; }
            STACK_SHRINK(oparg*2);
            STACK_GROW(1);
            stack_pointer[-1] = map;
            DISPATCH();
        }

Here's how BUILD_CONST_KEY_MAP is defined:

        inst(BUILD_CONST_KEY_MAP, (values[oparg], keys -- map)) {
            if (!PyTuple_CheckExact(keys) ||
                PyTuple_GET_SIZE(keys) != (Py_ssize_t)oparg) {
                _PyErr_SetString(tstate, PyExc_SystemError,
                                 "bad BUILD_CONST_KEY_MAP keys argument");
                goto error;  // Pop the keys and values.
            }
            map = _PyDict_FromItems(
                    &PyTuple_GET_ITEM(keys, 0), 1,
                    values, 1, oparg);
            DECREF_INPUTS();
            ERROR_IF(map == NULL, error);
        }

It seems to generate correct code:

        TARGET(BUILD_CONST_KEY_MAP) {
            PyObject *keys;
            PyObject **values;
            PyObject *map;
            keys = stack_pointer[-1];
            values = stack_pointer - 1 - oparg;
            if (!PyTuple_CheckExact(keys) ||
                PyTuple_GET_SIZE(keys) != (Py_ssize_t)oparg) {
                _PyErr_SetString(tstate, PyExc_SystemError,
                                 "bad BUILD_CONST_KEY_MAP keys argument");
                goto error;  // Pop the keys and values.
            }
            map = _PyDict_FromItems(
                    &PyTuple_GET_ITEM(keys, 0), 1,
                    values, 1, oparg);
            for (int _i = oparg; --_i >= 0;) {
                Py_DECREF(values[_i]);
            }
            Py_DECREF(keys);
            if (map == NULL) { STACK_SHRINK(oparg); goto pop_1_error; }
            STACK_SHRINK(oparg);
            stack_pointer[-1] = map;
            DISPATCH();
        }

[timofej673]

This bug is present from python 3.11