PyType_HasFeature may dereference a NULL pointer

[alonrs]

Bug report

Bug description:

In Modules/_testcapi/list.c list_clear function. NULLABLE(obj) may set obj to NULL. Then, it calls PyList_Clear
which in turn calls PyList_Check and then PyType_FastSubclass that calls PyType_HasFeature with type = NULL, which is derefernced here.

A similar phenomenon happens in other Modules/_testcapi/list.c functions as well.

CPython versions tested on:

3.13

Operating systems tested on:

Linux

[picnixz]

I think it's meant to allow testing for crashes. There should be some comments saying that we have CRASH(...). It's just that we have no way to pass NULL to the CAPI from Python except by saying that None is equivalent to NULL for the specific test.

cc @encukou for confirmation

[encukou]

Yes, you can use _testcapi.list_clear(None) to see what happens if you call PyList_Clear(NULL) in C. You get a crash. Both are the intended behaviour :)