bpo-44483: Fix crash in union object with bad ``__module__`` (GH-26848)

Lib/test/test_types.py

@@ -747,6 +747,15 @@ def __eq__(self, other):
                 with self.assertRaises(TypeError):
                     issubclass(list, type_)
 
+    def test_or_type_operator_with_bad_module(self):
+        class TypeVar:
+            @property
+            def __module__(self):
+                1 / 0
+        # Crashes in Issue44483
+        with self.assertRaises(ZeroDivisionError):
+            str | TypeVar()
+
     def test_ellipsis_type(self):
         self.assertIsInstance(Ellipsis, types.EllipsisType)
 

Misc/NEWS.d/next/Core and Builtins/2021-06-22-19-08-19.bpo-44483.eq2f7T.rst

@@ -0,0 +1,2 @@
+Fix a crash in ``types.Union`` objects when creating a union of an object
+with bad ``__module__`` field.

Objects/unionobject.c

@@ -284,6 +284,16 @@ is_new_type(PyObject *obj)
     return is_typing_module(obj);
 }
 
+// Emulates short-circuiting behavior of the ``||`` operator
+// while also checking negative values.
+#define CHECK_RES(res) { \
+    int result = res; \
+    if (result) { \
+       return result; \
+    } \
+}
+
+// Returns 1 on true, 0 on false, and -1 on error.
 static int
 is_unionable(PyObject *obj)
 {
@@ -291,10 +301,11 @@ is_unionable(PyObject *obj)
         return 1;
     }
     PyTypeObject *type = Py_TYPE(obj);
+    CHECK_RES(is_typevar(obj));
+    CHECK_RES(is_new_type(obj));
+    CHECK_RES(is_special_form(obj));
     return (
-        is_typevar(obj) ||
+        // The following checks never fail.
-        is_new_type(obj) ||
-        is_special_form(obj) ||
         PyType_Check(obj) ||
         PyObject_TypeCheck(obj, &Py_GenericAliasType) ||
         type == &_Py_UnionType);