Skip to content

Prevent __class__ reassignment across incompatible layouts #6521

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 6 commits into from
Dec 26, 2025
Merged

Prevent __class__ reassignment across incompatible layouts #6521

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3271b74
Initial plan
Copilot Dec 25, 2025
a3fb6fe
fix: guard __class__ reassignment layout
Copilot Dec 25, 2025
fbdb400
Auto-format: cargo fmt --all
github-actions[bot] Dec 25, 2025
71e9eb7
test: move __class__ layout check to builtin_type snippet
Copilot Dec 25, 2025
89e0801
fix: allow module __class__ reassignment with matching layout
Copilot Dec 25, 2025
e0090ff
Fix condition
youknowone Dec 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 32 additions & 3 deletions crates/vm/src/builtins/object.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -497,16 +497,45 @@ impl PyBaseObject {
) -> PyResult<()> {
match value.downcast::<PyType>() {
Ok(cls) => {
let both_module = instance.class().fast_issubclass(vm.ctx.types.module_type)
let current_cls = instance.class();
let both_module = current_cls.fast_issubclass(vm.ctx.types.module_type)
&& cls.fast_issubclass(vm.ctx.types.module_type);
let both_mutable = !instance
.class()
let both_mutable = !current_cls
.slots
.flags
.has_feature(PyTypeFlags::IMMUTABLETYPE)
&& !cls.slots.flags.has_feature(PyTypeFlags::IMMUTABLETYPE);
// FIXME(#1979) cls instances might have a payload
if both_mutable || both_module {
let has_dict =
|typ: &Py<PyType>| typ.slots.flags.has_feature(PyTypeFlags::HAS_DICT);
// Compare slots tuples
let slots_equal = match (
current_cls
.heaptype_ext
.as_ref()
.and_then(|e| e.slots.as_ref()),
cls.heaptype_ext.as_ref().and_then(|e| e.slots.as_ref()),
) {
(Some(a), Some(b)) => {
a.len() == b.len()
&& a.iter()
.zip(b.iter())
.all(|(x, y)| x.as_str() == y.as_str())
}
(None, None) => true,
_ => false,
};
if current_cls.slots.basicsize != cls.slots.basicsize
|| !slots_equal
|| has_dict(current_cls) != has_dict(&cls)
{
return Err(vm.new_type_error(format!(
"__class__ assignment: '{}' object layout differs from '{}'",
cls.name(),
current_cls.name()
)));
}
instance.set_class(cls, vm);
Ok(())
} else {
Expand Down
50 changes: 50 additions & 0 deletions extra_tests/snippets/builtin_type.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -240,6 +240,56 @@ class C(B, BB):
assert C.mro() == [C, B, A, BB, AA, object]


class TypeA:
def __init__(self):
self.a = 1


class TypeB:
__slots__ = "b"

def __init__(self):
self.b = 2


obj = TypeA()
with assert_raises(TypeError) as cm:
obj.__class__ = TypeB
assert "__class__ assignment: 'TypeB' object layout differs from 'TypeA'" in str(
cm.exception
)


# Test: same slot count but different slot names should fail
class SlotX:
__slots__ = ("x",)


class SlotY:
__slots__ = ("y",)


slot_obj = SlotX()
with assert_raises(TypeError) as cm:
slot_obj.__class__ = SlotY
assert "__class__ assignment: 'SlotY' object layout differs from 'SlotX'" in str(
cm.exception
)


# Test: same slots should succeed
class SlotA:
__slots__ = ("a",)


class SlotA2:
__slots__ = ("a",)


slot_a = SlotA()
slot_a.__class__ = SlotA2 # Should work


assert type(Exception.args).__name__ == "getset_descriptor"
assert type(None).__bool__(None) is False

Expand Down
Loading