gh-151818: Fix double-free in _CALL_LIST_APPEND on allocation failure (#151826)

_CALL_LIST_APPEND stole the arg stackref via PyStackRef_AsPyObjectSteal
and passed it to _PyList_AppendTakeRef. When the list's backing array
failed to grow, _PyList_AppendTakeRef decreffed the item, but the stale
stackref remained on the value stack. The exception unwinder then closed
it a second time, causing a double-free / use-after-free.

Fix by giving _PyList_AppendTakeRef a separate reference via Py_NewRef
and closing the stackref explicitly on success. On the error path the
stackref still holds a valid reference, so the exception unwinder can
safely close it.

Author: timurmamedov1

Include/internal/pycore_opcode_metadata.h

@@ -2,6 +2,7 @@
 import copy
 import pickle
 import dis
+import sys
 import threading
 import types
 import unittest
@@ -2171,6 +2172,39 @@ class MyList(list): pass
         self.assert_no_opcode(my_list_append, "CALL_LIST_APPEND")
         self.assert_no_opcode(my_list_append, "CALL")
 
+    @cpython_only
+    @requires_specialization
+    def test_call_list_append_memory_error(self):
+        # gh-151818: if CALL_LIST_APPEND fails to resize the list,
+        # the argument must be released exactly once.
+        _testcapi = import_module("_testcapi")
+
+        class Holder:
+            pass
+
+        def list_append(l, holder):
+            # holder.item is pushed as a new reference, which
+            # CALL_LIST_APPEND steals.
+            l.append(holder.item)
+
+        holder = Holder()
+        holder.item = item = object()
+        for _ in range(_testinternalcapi.SPECIALIZATION_THRESHOLD):
+            list_append([], holder)
+        self.assert_specialized(list_append, "CALL_LIST_APPEND")
+
+        refcount = sys.getrefcount(item)
+        # An empty list has no spare capacity, so append() must resize it.
+        lst = []
+        with self.assertRaises(MemoryError):
+            _testcapi.set_nomemory(0)
+            try:
+                list_append(lst, holder)
+            finally:
+                _testcapi.remove_mem_hooks()
+        self.assertEqual(lst, [])
+        self.assertEqual(sys.getrefcount(item), refcount)
+
     @cpython_only
     @requires_specialization
     def test_call_c_function_extra_flags(self):

Include/internal/pycore_uop_metadata.h

@@ -0,0 +1,3 @@
+Fix a double-free crash in ``list.append()`` (the specialized
+``CALL_LIST_APPEND`` instruction) when growing the list fails with
+:exc:`MemoryError`.

Lib/test/test_opcache.py

@@ -5038,7 +5038,10 @@ dummy_func(
             int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
             UNLOCK_OBJECT(self_o);
             if (err) {
-                ERROR_NO_POP();
+                // arg is consumed even on failure: close the other inputs
+                // and pop them all, so that arg is not closed a second time.
+                DECREF_INPUTS();
+                ERROR_IF(true);
             }
             c = callable;
             s = self;