1 files changed, 62 insertions, 0 deletions
diff --git a/pkgs/development/interpreters/python/cpython/2.7/type_getattro.patch b/pkgs/development/interpreters/python/cpython/2.7/type_getattro.patch
new file mode 100644
index 000000000000..c69c86b642b4
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/2.7/type_getattro.patch
@@ -0,0 +1,62 @@
+--- a/Objects/typeobject.c
++++ b/Objects/typeobject.c
+@@ -3137,6 +3137,7 @@
+     PyTypeObject *metatype = Py_TYPE(type);
+     PyObject *meta_attribute, *attribute;
+     descrgetfunc meta_get;
++    PyObject* res;
+ 
+     if (!PyUnicode_Check(name)) {
+         PyErr_Format(PyExc_TypeError,
+@@ -3158,6 +3159,7 @@
+     meta_attribute = _PyType_Lookup(metatype, name);
+ 
+     if (meta_attribute != NULL) {
++        Py_INCREF(meta_attribute);
+         meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
+ 
+         if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
+@@ -3165,10 +3167,11 @@
+              * writes. Assume the attribute is not overridden in
+              * type's tp_dict (and bases): call the descriptor now.
+              */
+-            return meta_get(meta_attribute, (PyObject *)type,
+-                            (PyObject *)metatype);
++            res = meta_get(meta_attribute, (PyObject *)type,
++                           (PyObject *)metatype);
++            Py_DECREF(meta_attribute);
++            return res;
+         }
+-        Py_INCREF(meta_attribute);
+     }
+ 
+     /* No data descriptor found on metatype. Look in tp_dict of this
+@@ -3176,6 +3179,7 @@
+     attribute = _PyType_Lookup(type, name);
+     if (attribute != NULL) {
+         /* Implement descriptor functionality, if any */
++        Py_INCREF(attribute);
+         descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
+ 
+         Py_XDECREF(meta_attribute);
+@@ -3183,11 +3187,12 @@
+         if (local_get != NULL) {
+             /* NULL 2nd argument indicates the descriptor was
+              * found on the target object itself (or a base)  */
+-            return local_get(attribute, (PyObject *)NULL,
+-                             (PyObject *)type);
++            res = local_get(attribute, (PyObject *)NULL,
++                            (PyObject *)type);
++            Py_DECREF(attribute);
++            return res;
+         }
+ 
+-        Py_INCREF(attribute);
+         return attribute;
+     }
+ 
+--- /dev/null
++++ b/Misc/NEWS.d/next/Core and Builtins/2018-03-14-21-42-17.bpo-25750.lxgkQz.rst	
+@@ -0,0 +1,2 @@
++Fix rare Python crash due to bad refcounting in ``type_getattro()`` if a
++descriptor deletes itself from the class.