Abort when using a tuple subclass instance as the `bases` parameter for `type`

[devdanzin]

Crash report

What happened?

The interpreter will abort when a new type is created using an instance of a subclass of tuple as the bases parameter due to a PyTuple_CheckExact(bases) assertion:

class weird_tuple(tuple): pass

c = type("c", weird_tuple((str,)), {})
python: Objects/typeobject.c:500: set_tp_bases: Assertion `PyTuple_CheckExact(bases)' failed.
Aborted (core dumped)

Found using fusil by @vstinner.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.14.0a6+ (heads/main:04bc681e7cf, Apr 4 2025, 12:38:19) [GCC 11.4.0]

Linked PRs

• gh-132176: Fix crash on type() when tuple subclass passed as bases #132212
• [3.13] gh-132176: Fix crash on type() when tuple subclass passed as bases (GH-132212) #132548

[xuantengh]

The doc states the 2nd arg when type() receives 3 arguments should be a tuple. Maybe we should raise an exception if bases cannot pass the PyTuple_CheckExact check?

[devdanzin]

Maybe we should raise an exception if bases cannot pass the PyTuple_CheckExact check?

Maybe, but it works in release builds, resulting in a class where __bases__ is the instance of the tuple subclass we passed to type. So there's a chance somebody out there is using this in some way.

[xuantengh]

Otherwise we should relax the assert with PyTuple_Check.

[sobolevn]

I think that it should be an exact tuple for _Py_SetImmortal call and it can be a tuple subclass for regular classes. This problem exists since 3.12

Thanks for the report! 🤝