fix bpo-37619

youknowone · youknowone · commit 9dfc0291af61 · 2026-01-01T21:15:30.000+09:00
diff --git a/crates/vm/src/builtins/descriptor.rs b/crates/vm/src/builtins/descriptor.rs
@@ -774,6 +774,15 @@ impl Callable for PyMethodWrapper {
     type Args = FuncArgs;
 
     fn call(zelf: &Py<Self>, args: FuncArgs, vm: &VirtualMachine) -> PyResult {
+        // bpo-37619: Check type compatibility before calling wrapped slot
+        if !zelf.obj.fast_isinstance(zelf.wrapper.typ) {
+            return Err(vm.new_type_error(format!(
+                "descriptor '{}' requires a '{}' object but received a '{}'",
+                zelf.wrapper.name.as_str(),
+                zelf.wrapper.typ.name(),
+                zelf.obj.class().name()
+            )));
+        }
         zelf.wrapper.wrapped.call(zelf.obj.clone(), args, vm)
     }
 }
diff --git a/crates/vm/src/types/slot.rs b/crates/vm/src/types/slot.rs
@@ -1362,28 +1362,44 @@ impl PyType {
     ) -> Option<T> {
         use crate::builtins::descriptor::PyWrapper;
 
+        // Helper to check if a class is a subclass of another by checking MRO
+        let is_subclass_of = |subclass_mro: &[PyRef<PyType>], superclass: &Py<PyType>| -> bool {
+            subclass_mro.iter().any(|c| c.is(superclass))
+        };
+
         // Helper to extract slot from an attribute if it's a wrapper descriptor
-        let try_extract = |attr: &PyObjectRef| -> Option<T> {
+        // and the wrapper's type is compatible with the given class.
+        // bpo-37619: wrapper descriptor from wrong class should not be used directly.
+        let try_extract = |attr: &PyObjectRef, for_class_mro: &[PyRef<PyType>]| -> Option<T> {
             if attr.class().is(ctx.types.wrapper_descriptor_type) {
-                attr.downcast_ref::<PyWrapper>()
-                    .and_then(|wrapper| extract(&wrapper.wrapped))
+                attr.downcast_ref::<PyWrapper>().and_then(|wrapper| {
+                    // Only extract slot if for_class is a subclass of wrapper.typ
+                    if is_subclass_of(for_class_mro, wrapper.typ) {
+                        extract(&wrapper.wrapped)
+                    } else {
+                        None
+                    }
+                })
             } else {
                 None
             }
         };
 
+        let mro = self.mro.read();
+
         // Look up in self's dict first
         if let Some(attr) = self.attributes.read().get(name).cloned() {
-            if let Some(func) = try_extract(&attr) {
+            if let Some(func) = try_extract(&attr, &mro) {
                 return Some(func);
             }
             return None;
         }
 
         // Look up in MRO (mro[0] is self, so skip it)
-        for cls in self.mro.read()[1..].iter() {
+        for (i, cls) in mro[1..].iter().enumerate() {
             if let Some(attr) = cls.attributes.read().get(name).cloned() {
-                if let Some(func) = try_extract(&attr) {
+                // Use the slice starting from this class in MRO
+                if let Some(func) = try_extract(&attr, &mro[i + 1..]) {
                     return Some(func);
                 }
                 return None;
