gh-99537: Use Py_SETREF() function in C code (#99657)

Fix potential race condition in code patterns:

* Replace "Py_DECREF(var); var = new;" with "Py_SETREF(var, new);"
* Replace "Py_XDECREF(var); var = new;" with "Py_XSETREF(var, new);"
* Replace "Py_CLEAR(var); var = new;" with "Py_XSETREF(var, new);"

Other changes:

* Replace "old = var; var = new; Py_DECREF(var)"
  with "Py_SETREF(var, new);"
* Replace "old = var; var = new; Py_XDECREF(var)"
  with "Py_XSETREF(var, new);"
* And remove the "old" variable.

8 files changed, 11 insertions, 25 deletions

diff --git a/Python/_warnings.c b/Python/_warnings.c
index d703e1e..046c37e 100644
--- a/Python/_warnings.c
+++ b/Python/_warnings.c
@@ -801,8 +801,7 @@ next_external_frame(PyFrameObject *frame)
 {
     do {
         PyFrameObject *back = PyFrame_GetBack(frame);
-        Py_DECREF(frame);
-        frame = back;
+        Py_SETREF(frame, back);
     } while (frame != NULL && is_internal_frame(frame));
 
     return frame;
@@ -828,8 +827,7 @@ setup_context(Py_ssize_t stack_level, PyObject **filename, int *lineno,
     if (stack_level <= 0 || is_internal_frame(f)) {
         while (--stack_level > 0 && f != NULL) {
             PyFrameObject *back = PyFrame_GetBack(f);
-            Py_DECREF(f);
-            f = back;
+            Py_SETREF(f, back);
         }
     }
     else {
diff --git a/Python/bltinmodule.c b/Python/bltinmodule.c
index 119e21a..c2cf79a 100644
--- a/Python/bltinmodule.c
+++ b/Python/bltinmodule.c
@@ -168,8 +168,7 @@ builtin___build_class__(PyObject *self, PyObject *const *args, Py_ssize_t nargs,
             goto error;
         }
         if (winner != meta) {
-            Py_DECREF(meta);
-            meta = Py_NewRef(winner);
+            Py_SETREF(meta, Py_NewRef(winner));
         }
     }
     /* else: meta is not a class, so we cannot do the metaclass
diff --git a/Python/compile.c b/Python/compile.c
index 9226bc2..3663211 100644
--- a/Python/compile.c
+++ b/Python/compile.c
@@ -8280,9 +8280,7 @@ merge_const_one(PyObject *const_cache, PyObject **obj)
         t = PyTuple_GET_ITEM(t, 1);
     }
 
-    Py_INCREF(t);
-    Py_DECREF(*obj);
-    *obj = t;
+    Py_SETREF(*obj, Py_NewRef(t));
     return 1;
 }
 
diff --git a/Python/errors.c b/Python/errors.c
index d74ac34..6a42f59 100644
--- a/Python/errors.c
+++ b/Python/errors.c
@@ -353,16 +353,13 @@ _PyErr_NormalizeException(PyThreadState *tstate, PyObject **exc,
             if (fixed_value == NULL) {
                 goto error;
             }
-            Py_DECREF(value);
-            value = fixed_value;
+            Py_SETREF(value, fixed_value);
         }
         /* If the class of the instance doesn't exactly match the
            class of the type, believe the instance.
         */
         else if (inclass != type) {
-            Py_INCREF(inclass);
-            Py_DECREF(type);
-            type = inclass;
+            Py_SETREF(type, Py_NewRef(inclass));
         }
     }
     *exc = type;
diff --git a/Python/hamt.c b/Python/hamt.c
index c4e47eb..8cb9464 100644
--- a/Python/hamt.c
+++ b/Python/hamt.c
@@ -1354,8 +1354,7 @@ hamt_node_collision_assoc(PyHamtNode_Collision *self,
                 }
 
                 /* Replace the old value with the new value for the our key. */
-                Py_DECREF(new_node->c_array[val_idx]);
-                new_node->c_array[val_idx] = Py_NewRef(val);
+                Py_SETREF(new_node->c_array[val_idx], Py_NewRef(val));
 
                 return (PyHamtNode *)new_node;
 
diff --git a/Python/pythonrun.c b/Python/pythonrun.c
index 7087222..35292b6 100644
--- a/Python/pythonrun.c
+++ b/Python/pythonrun.c
@@ -718,8 +718,7 @@ _Py_HandleSystemExit(int *exitcode_p)
         /* The error code should be in the `code' attribute. */
         PyObject *code = PyObject_GetAttr(value, &_Py_ID(code));
         if (code) {
-            Py_DECREF(value);
-            value = code;
+            Py_SETREF(value, code);
             if (value == Py_None)
                 goto done;
         }
diff --git a/Python/sysmodule.c b/Python/sysmodule.c
index 6f0a126..88f806e 100644
--- a/Python/sysmodule.c
+++ b/Python/sysmodule.c
@@ -198,8 +198,7 @@ sys_audit_tstate(PyThreadState *ts, const char *event,
         eventArgs = _Py_VaBuildValue_SizeT(argFormat, vargs);
         if (eventArgs && !PyTuple_Check(eventArgs)) {
             PyObject *argTuple = PyTuple_Pack(1, eventArgs);
-            Py_DECREF(eventArgs);
-            eventArgs = argTuple;
+            Py_SETREF(eventArgs, argTuple);
         }
     }
     else {
diff --git a/Python/traceback.c b/Python/traceback.c
index 356e643..da26c9b 100644
--- a/Python/traceback.c
+++ b/Python/traceback.c
@@ -136,9 +136,7 @@ tb_next_set(PyTracebackObject *self, PyObject *new_next, void *Py_UNUSED(_))
         cursor = cursor->tb_next;
     }
 
-    PyObject *old_next = (PyObject*)self->tb_next;
-    self->tb_next = (PyTracebackObject *)Py_XNewRef(new_next);
-    Py_XDECREF(old_next);
+    Py_XSETREF(self->tb_next, (PyTracebackObject *)Py_XNewRef(new_next));
 
     return 0;
 }
@@ -533,8 +531,7 @@ display_source_line_with_margin(PyObject *f, PyObject *filename, int lineno, int
         PyObject *truncated;
         truncated = PyUnicode_Substring(lineobj, i, PyUnicode_GET_LENGTH(lineobj));
         if (truncated) {
-            Py_DECREF(lineobj);
-            lineobj = truncated;
+            Py_SETREF(lineobj, truncated);
         } else {
             PyErr_Clear();
         }