[3.15] gh-151818: Fix double-free in _CALL_LIST_APPEND on allocation failure (GH-151826) (#160200)

On allocation failure, close the remaining live inputs and pop all three
inputs before unwinding, so the consumed argument is not closed twice.

Backport the regression test and regenerate the interpreter files using
the 3.15 cases generator.

(cherry picked from commit 4ecf6ca)

Co-authored-by: Timur Mamedov <timurmamedov742@gmail.com>

Author: JelleZijlstra

Include/internal/pycore_opcode_metadata.h

@@ -2,6 +2,7 @@
 import copy
 import pickle
 import dis
+import sys
 import threading
 import types
 import unittest
@@ -2171,6 +2172,39 @@ class MyList(list): pass
         self.assert_no_opcode(my_list_append, "CALL_LIST_APPEND")
         self.assert_no_opcode(my_list_append, "CALL")
 
+    @cpython_only
+    @requires_specialization
+    def test_call_list_append_memory_error(self):
+        # gh-151818: if CALL_LIST_APPEND fails to resize the list,
+        # the argument must be released exactly once.
+        _testcapi = import_module("_testcapi")
+
+        class Holder:
+            pass
+
+        def list_append(l, holder):
+            # holder.item is pushed as a new reference, which
+            # CALL_LIST_APPEND steals.
+            l.append(holder.item)
+
+        holder = Holder()
+        holder.item = item = object()
+        for _ in range(_testinternalcapi.SPECIALIZATION_THRESHOLD):
+            list_append([], holder)
+        self.assert_specialized(list_append, "CALL_LIST_APPEND")
+
+        refcount = sys.getrefcount(item)
+        # An empty list has no spare capacity, so append() must resize it.
+        lst = []
+        with self.assertRaises(MemoryError):
+            _testcapi.set_nomemory(0)
+            try:
+                list_append(lst, holder)
+            finally:
+                _testcapi.remove_mem_hooks()
+        self.assertEqual(lst, [])
+        self.assertEqual(sys.getrefcount(item), refcount)
+
     @cpython_only
     @requires_specialization
     def test_load_attr_module_with_getattr(self):

Include/internal/pycore_uop_metadata.h

@@ -0,0 +1,3 @@
+Fix a double-free crash in ``list.append()`` (the specialized
+``CALL_LIST_APPEND`` instruction) when growing the list fails with
+:exc:`MemoryError`.

Lib/test/test_opcache.py

@@ -5075,7 +5075,10 @@ dummy_func(
             int err = _PyList_AppendTakeRef((PyListObject *)self_o, PyStackRef_AsPyObjectSteal(arg));
             UNLOCK_OBJECT(self_o);
             if (err) {
-                ERROR_NO_POP();
+                // arg is consumed even on failure: close the other inputs
+                // and pop them all, so that arg is not closed a second time.
+                DECREF_INPUTS();
+                ERROR_IF(true);
             }
             c = callable;
             s = self;