[New-bugs-announce] [issue46689] `list(FunctionType(a.gi_code, {})(0))` crashes Python

[Nikita Sobolev]

New submission from Nikita Sobolev <mail at sobolevn.me>:

Here's the simplest reproduction:

```
from types import FunctionType
a = (x for x in [1])
list(FunctionType(a.gi_code, {})(0))
```

I understand that the code above does not make much sense, but I still think it should not crash.

Demo:

```
» PYTHONFAULTHANDLER=1 ./python.exe
Python 3.11.0a5+ (heads/issue-46647-dirty:88819357a5, Feb  5 2022, 18:19:59) [Clang 11.0.0 (clang-1100.0.33.16)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from types import FunctionType
>>> a = (x for x in [1])
>>> list(FunctionType(a.gi_code, {})(0))
Fatal Python error: Segmentation fault

Current thread 0x0000000112ece5c0 (most recent call first):
  File "<stdin>", line 1 in <genexpr>
  File "<stdin>", line 1 in <module>
[1]    22662 segmentation fault  PYTHONFAULTHANDLER=1 ./python.exe
```

I can reproduce this on 3.9 and 3.10 as well.

----------
components: Interpreter Core
messages: 412897
nosy: sobolevn
priority: normal
severity: normal
status: open
title: `list(FunctionType(a.gi_code, {})(0))` crashes Python
type: crash
versions: Python 3.10, Python 3.11, Python 3.9

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue46689>
_______________________________________