[3.9] gh-92112: Fix crash triggered by an evil custom `mro()` (GH-92113) (GH-92372)

(cherry picked from commit 85354ed78c0edb6d81a2bd53cabc85e547b8b26e)

Co-authored-by: Alexey Izbyshev <izbyshev@ispras.ru>

1 files changed, 17 insertions, 0 deletions

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index e5e9f49..a8fe3ef 100644
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -5686,6 +5686,23 @@ class MroTest(unittest.TestCase):
         class A(metaclass=M):
             pass
 
+    def test_disappearing_custom_mro(self):
+        """
+        gh-92112: A custom mro() returning a result conflicting with
+        __bases__ and deleting itself caused a double free.
+        """
+        class B:
+            pass
+
+        class M(DebugHelperMeta):
+            def mro(cls):
+                del M.mro
+                return (B,)
+
+        with self.assertRaises(TypeError):
+            class A(metaclass=M):
+                pass
+
 
 if __name__ == "__main__":
     unittest.main()