gh-151912: Fix segfault in type() with NULL tp_new metaclasses

[Santhosh-I]

Summary

Fix a crash in type(...) when the provided metaclass has tp_new == NULL.

Currently, type(name, bases, namespace) can reach a code path that calls:

type = winner->tp_new(winner, ctx->args, ctx->kwds);

without verifying that winner->tp_new is non-NULL. For metaclasses that are valid base classes at the C level but cannot be instantiated from Python (tp_new == NULL), this results in a segmentation fault.

This change adds validation to reject such metaclasses and raise a Python exception instead.

Bug

For example, on NumPy main:

type("name", metaclass_instance, {})

where metaclass_instance == np.dtype, can eventually dereference a NULL tp_new pointer.

The expected behavior is consistent with:

type(metaclass_instance)()

which raises:

TypeError: cannot create 'numpy._DTypeMeta' instances

Fix

• Check whether the selected metaclass (winner) has a valid tp_new.
• Raise TypeError when tp_new == NULL instead of attempting to call it.
• Prevent a NULL function pointer dereference and resulting segfault.

Issue

Closes gh-151912. #151912

[bedevere-app]

Most changes to Python require a NEWS entry. Add one using the blurb_it web app or the blurb command-line tool.

If this change has little impact on Python users, wait for a maintainer to apply the skip news label instead.

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[Copilot]

Pull request overview

Fixes a crash in CPython’s type(name, bases, namespace) code path when metaclass resolution selects a metaclass whose tp_new slot is NULL (i.e., not instantiable), by raising a TypeError instead of calling through a NULL function pointer.

Changes:

• Add a winner->tp_new == NULL guard before delegating to a non-type_new metaclass constructor.
• Raise TypeError: cannot create '<metaclass>' instances rather than segfaulting.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.