Fix crash in method_get for METH_METHOD descriptors with invalid type argument

Author: sunmy2019

Lib/test/test_descr.py

@@ -1803,6 +1803,28 @@ class SubSpam(spam.spamlist): pass
             spam_cm.__get__(None, list)
         self.assertEqual(str(cm.exception), expected_errmsg)
 
+    def test_method_get_meth_method_invalid_type(self):
+        # gh-146615: method_get() for METH_METHOD descriptors used to pass
+        # Py_TYPE(type)->tp_name as the %V fallback instead of the separate
+        # %s argument, causing a missing argument for %s and a crash.
+        # Verify the error message is correct when __get__() is called with a
+        # non-type as the second argument.
+        #
+        # METH_METHOD|METH_FASTCALL|METH_KEYWORDS is the only flag combination
+        # that enters the affected branch in method_get().
+
+        import xxlimited
+
+        xxo = xxlimited.Xxo()
+        descr = xxlimited.Xxo.demo
+
+        with self.assertRaises(TypeError) as cm:
+            descr.__get__(xxo, "not_a_type")
+        self.assertEqual(
+            str(cm.exception),
+            "descriptor 'demo' needs a type, not 'str', as arg 2",
+        )
+
     def test_staticmethods(self):
         # Testing static methods...
         class C(object):

Misc/NEWS.d/next/Core_and_Builtins/2026-03-31-01-06-35.gh-issue-146615.fix-method-get.rst

@@ -0,0 +1,3 @@
+Fix a crash in :meth:`~object.__get__` for :c:expr:`METH_METHOD` descriptors
+when an invalid (non-type) object is passed as the second argument.
+Patch by Steven Sun.