gh-99537: Use Py_SETREF() function in C code (#99657)

Fix potential race condition in code patterns:

* Replace "Py_DECREF(var); var = new;" with "Py_SETREF(var, new);"
* Replace "Py_XDECREF(var); var = new;" with "Py_XSETREF(var, new);"
* Replace "Py_CLEAR(var); var = new;" with "Py_XSETREF(var, new);"

Other changes:

* Replace "old = var; var = new; Py_DECREF(var)"
  with "Py_SETREF(var, new);"
* Replace "old = var; var = new; Py_XDECREF(var)"
  with "Py_XSETREF(var, new);"
* And remove the "old" variable.

11 files changed, 23 insertions, 51 deletions

diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index 91c89bb..a63f396 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -2109,9 +2109,7 @@ bytes_translate_impl(PyBytesObject *self, PyObject *table,
                 changed = 1;
         }
         if (!changed && PyBytes_CheckExact(input_obj)) {
-            Py_INCREF(input_obj);
-            Py_DECREF(result);
-            result = input_obj;
+            Py_SETREF(result, Py_NewRef(input_obj));
         }
         PyBuffer_Release(&del_table_view);
         PyBuffer_Release(&table_view);
diff --git a/Objects/capsule.c b/Objects/capsule.c
index 606e50e..baaddb3 100644
--- a/Objects/capsule.c
+++ b/Objects/capsule.c
@@ -220,8 +220,7 @@ PyCapsule_Import(const char *name, int no_block)
             }
         } else {
             PyObject *object2 = PyObject_GetAttrString(object, trace);
-            Py_DECREF(object);
-            object = object2;
+            Py_SETREF(object, object2);
         }
         if (!object) {
             goto EXIT;
diff --git a/Objects/fileobject.c b/Objects/fileobject.c
index ab67cd2..bf56be5 100644
--- a/Objects/fileobject.c
+++ b/Objects/fileobject.c
@@ -88,8 +88,7 @@ PyFile_GetLine(PyObject *f, int n)
             else {
                 PyObject *v;
                 v = PyBytes_FromStringAndSize(s, len-1);
-                Py_DECREF(result);
-                result = v;
+                Py_SETREF(result, v);
             }
         }
     }
@@ -104,8 +103,7 @@ PyFile_GetLine(PyObject *f, int n)
         else if (PyUnicode_READ_CHAR(result, len-1) == '\n') {
             PyObject *v;
             v = PyUnicode_Substring(result, 0, len-1);
-            Py_DECREF(result);
-            result = v;
+            Py_SETREF(result, v);
         }
     }
     return result;
diff --git a/Objects/floatobject.c b/Objects/floatobject.c
index 46016e9..912b742 100644
--- a/Objects/floatobject.c
+++ b/Objects/floatobject.c
@@ -531,20 +531,17 @@ float_richcompare(PyObject *v, PyObject *w, int op)
                 temp = _PyLong_Lshift(ww, 1);
                 if (temp == NULL)
                     goto Error;
-                Py_DECREF(ww);
-                ww = temp;
+                Py_SETREF(ww, temp);
 
                 temp = _PyLong_Lshift(vv, 1);
                 if (temp == NULL)
                     goto Error;
-                Py_DECREF(vv);
-                vv = temp;
+                Py_SETREF(vv, temp);
 
                 temp = PyNumber_Or(vv, _PyLong_GetOne());
                 if (temp == NULL)
                     goto Error;
-                Py_DECREF(vv);
-                vv = temp;
+                Py_SETREF(vv, temp);
             }
 
             r = PyObject_RichCompareBool(vv, ww, op);
diff --git a/Objects/genobject.c b/Objects/genobject.c
index 6661e3f..c006f1a 100644
--- a/Objects/genobject.c
+++ b/Objects/genobject.c
@@ -491,8 +491,7 @@ throw_here:
         }
         else {
             /* Normalize to raise <class>, <instance> */
-            Py_XDECREF(val);
-            val = typ;
+            Py_XSETREF(val, typ);
             typ = Py_NewRef(PyExceptionInstance_Class(typ));
 
             if (tb == NULL)
diff --git a/Objects/setobject.c b/Objects/setobject.c
index e064676..ae9e9b9 100644
--- a/Objects/setobject.c
+++ b/Objects/setobject.c
@@ -1270,8 +1270,7 @@ set_intersection_multi(PySetObject *so, PyObject *args)
             Py_DECREF(result);
             return NULL;
         }
-        Py_DECREF(result);
-        result = newresult;
+        Py_SETREF(result, newresult);
     }
     return result;
 }
diff --git a/Objects/sliceobject.c b/Objects/sliceobject.c
index 1da1df3..5694bd9 100644
--- a/Objects/sliceobject.c
+++ b/Objects/sliceobject.c
@@ -448,8 +448,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
         if (_PyLong_Sign(start) < 0) {
             /* start += length */
             PyObject *tmp = PyNumber_Add(start, length);
-            Py_DECREF(start);
-            start = tmp;
+            Py_SETREF(start, tmp);
             if (start == NULL)
                 goto error;
 
@@ -457,9 +456,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
             if (cmp_result < 0)
                 goto error;
             if (cmp_result) {
-                Py_INCREF(lower);
-                Py_DECREF(start);
-                start = lower;
+                Py_SETREF(start, Py_NewRef(lower));
             }
         }
         else {
@@ -467,9 +464,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
             if (cmp_result < 0)
                 goto error;
             if (cmp_result) {
-                Py_INCREF(upper);
-                Py_DECREF(start);
-                start = upper;
+                Py_SETREF(start, Py_NewRef(upper));
             }
         }
     }
@@ -486,8 +481,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
         if (_PyLong_Sign(stop) < 0) {
             /* stop += length */
             PyObject *tmp = PyNumber_Add(stop, length);
-            Py_DECREF(stop);
-            stop = tmp;
+            Py_SETREF(stop, tmp);
             if (stop == NULL)
                 goto error;
 
@@ -495,9 +489,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
             if (cmp_result < 0)
                 goto error;
             if (cmp_result) {
-                Py_INCREF(lower);
-                Py_DECREF(stop);
-                stop = lower;
+                Py_SETREF(stop, Py_NewRef(lower));
             }
         }
         else {
@@ -505,9 +497,7 @@ _PySlice_GetLongIndices(PySliceObject *self, PyObject *length,
             if (cmp_result < 0)
                 goto error;
             if (cmp_result) {
-                Py_INCREF(upper);
-                Py_DECREF(stop);
-                stop = upper;
+                Py_SETREF(stop, Py_NewRef(upper));
             }
         }
     }
diff --git a/Objects/stringlib/unicode_format.h b/Objects/stringlib/unicode_format.h
index e970588..ccd7c77 100644
--- a/Objects/stringlib/unicode_format.h
+++ b/Objects/stringlib/unicode_format.h
@@ -473,8 +473,7 @@ get_field_object(SubString *input, PyObject *args, PyObject *kwargs,
             goto error;
 
         /* assign to obj */
-        Py_DECREF(obj);
-        obj = tmp;
+        Py_SETREF(obj, tmp);
     }
     /* end of iterator, this is the non-error case */
     if (ok == 1)
@@ -825,8 +824,7 @@ output_markup(SubString *field_name, SubString *format_spec,
             goto done;
 
         /* do the assignment, transferring ownership: fieldobj = tmp */
-        Py_DECREF(fieldobj);
-        fieldobj = tmp;
+        Py_SETREF(fieldobj, tmp);
         tmp = NULL;
     }
 
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 9d868d5..3124069 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -5968,8 +5968,7 @@ object___dir___impl(PyObject *self)
     else {
         /* Copy __dict__ to avoid mutating it. */
         PyObject *temp = PyDict_Copy(dict);
-        Py_DECREF(dict);
-        dict = temp;
+        Py_SETREF(dict, temp);
     }
 
     if (dict == NULL)
@@ -9377,8 +9376,7 @@ super_getattro(PyObject *self, PyObject *name)
                        (See SF ID #743627)  */
                     (su->obj == (PyObject *)starttype) ? NULL : su->obj,
                     (PyObject *)starttype);
-                Py_DECREF(res);
-                res = res2;
+                Py_SETREF(res, res2);
             }
 
             Py_DECREF(mro);
diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c
index b1acfc7..55f029d 100644
--- a/Objects/unicodeobject.c
+++ b/Objects/unicodeobject.c
@@ -13572,8 +13572,7 @@ _PyUnicode_FormatLong(PyObject *val, int alt, int prec, int type)
         for (i = 0; i < numdigits; i++)
             *b1++ = *buf++;
         *b1 = '\0';
-        Py_DECREF(result);
-        result = r1;
+        Py_SETREF(result, r1);
         buf = PyBytes_AS_STRING(result);
         len = numnondigits + prec;
     }
@@ -13590,8 +13589,7 @@ _PyUnicode_FormatLong(PyObject *val, int alt, int prec, int type)
         || buf != PyUnicode_DATA(result)) {
         PyObject *unicode;
         unicode = _PyUnicode_FromASCII(buf, len);
-        Py_DECREF(result);
-        result = unicode;
+        Py_SETREF(result, unicode);
     }
     else if (len != PyUnicode_GET_LENGTH(result)) {
         if (PyUnicode_Resize(&result, len) < 0)
diff --git a/Objects/weakrefobject.c b/Objects/weakrefobject.c
index ff284c8..bd7720e 100644
--- a/Objects/weakrefobject.c
+++ b/Objects/weakrefobject.c
@@ -824,8 +824,7 @@ PyWeakref_NewRef(PyObject *ob, PyObject *callback)
                        during GC.  Return that one instead of this one
                        to avoid violating the invariants of the list
                        of weakrefs for ob. */
-                    Py_DECREF(result);
-                    result = (PyWeakReference*)Py_NewRef(ref);
+                    Py_SETREF(result, (PyWeakReference*)Py_NewRef(ref));
                 }
             }
             else {
@@ -888,8 +887,7 @@ PyWeakref_NewProxy(PyObject *ob, PyObject *callback)
                        during GC.  Return that one instead of this one
                        to avoid violating the invariants of the list
                        of weakrefs for ob. */
-                    Py_DECREF(result);
-                    result = (PyWeakReference*)Py_NewRef(proxy);
+                    Py_SETREF(result, (PyWeakReference*)Py_NewRef(proxy));
                     goto skip_insert;
                 }
                 prev = ref;