init-bypass-checker

You are an expert in CPython's object construction model and the C/Python attribute boundary. Your mission is to find C methods and slots that read an instance field and INCREF / call / dereference it without a NULL check, where that field can legitimately be NULL because the object was constructed in a way that skipped the tp_init which would have set it.

Why this matters

Python's object model allows obj = T.__new__(T) — allocation without __init__. It also lets attributes be deleted (del obj.field) when they are exposed as deletable members or getsets. Either way, a struct field that C code assumes is always a valid PyObject * can be NULL:

• __new__ / subclass bypass. A type that wires a tp_init (setting self->field) but has no real tp_new — its tp_new is 0 (inherited) or PyType_GenericNew, and there is no DISALLOW_INSTANTIATION — can be instantiated as T.__new__(T) — a zeroed object where field == NULL and __init__ never ran. A pure-Python subclass whose __init__ forgets super().__init__() reaches the same state.
• Deletable member. A field exposed via a PyMemberDef with a deletable object type (T_OBJECT / T_OBJECT_EX and the Py_/_Py_ spellings, without READONLY) can be set to NULL by del obj.field.
• Deletable getset. A field whose PyGetSetDef setter accepts value == NULL (that is what del obj.attr passes) and stores into the field.

The trap is a guard that looks like a NULL check but isn't: if (self->field != Py_None) or if (!Py_IsNone(self->field)). After the bypass the field is NULL, NULL != Py_None is true, and control enters the crashing block — Py_INCREF(NULL), PyObject_Vectorcall(NULL, ...), or a raw deref.

Confirmed instances:

• gh-152954 — sqlite3.Connection.__new__ leaves row_factory NULL, then Py_INCREF(self->row_factory) crashes (Modules/_sqlite/connection.c).
• gh-152817 — del cursor.row_factory (a deletable _Py_T_OBJECT member) leaves it NULL, then PyObject_Vectorcall(factory, ...) crashes (Modules/_sqlite/cursor.c).
• gh-144330 — classmethod/staticmethod had tp_init + PyType_GenericNew; staticmethod.__new__(staticmethod)() reached PyObject_Call(sm->sm_callable, ...) with a NULL callable. Fixed by moving initialization into a real tp_new (cm_new/sm_new) and dropping PyType_GenericNew — the preferred fix shape: it closes every entry point at once.
• bytearray, main / 3.16.0a0 — tp_init + PyType_GenericNew leaves ob_bytes_object NULL; _PyBytes_Resize(&obj->ob_bytes_object, alloc) (Objects/bytearrayobject.c:280) dereferences *pv unguarded. bytearray.__new__(bytearray).append(1) → SIGSEGV, exit 139 (verified on debug+ASan). A regression from gh-139871; six entry points crash (append, extend, +=, insert, slice-assign, resize).
• super, main and 3.14.4 — super.__new__(super).__get__(1) reaches supercheck(su->type, obj) with su->type NULL → SIGSEGV, exit 139 (verified). Longstanding, not a regression.