gh-143635: Fix crash in _Py_typing_type_repr

Lib/test/test_genericalias.py

@@ -244,6 +244,43 @@ class MyGeneric:
         self.assertEndsWith(repr(MyGeneric[[]]), 'MyGeneric[[]]')
         self.assertEndsWith(repr(MyGeneric[[int, str]]), 'MyGeneric[[int, str]]')
 
+    def test_evil_repr1(self):
+        # gh-143635
+        class Zap:
+            def __init__(self, container):
+                self.container = container
+            def __getattr__(self, name):
+                if name == "__origin__":
+                    self.container.clear()
+                    return None
+                if name == "__args__":
+                    return ()
+                raise AttributeError
+
+        params = []
+        params.append(Zap(params))
+        alias = type(list[int])(list, (params,))
+        repr_str = repr(alias)
+        self.assertTrue(repr_str.startswith("list[["), repr_str)
+
+    def test_evil_repr2(self):
+        class Zap:
+            def __init__(self, container):
+                self.container = container
+            def __getattr__(self, name):
+                if name == "__qualname__":
+                    self.container.clear()
+                    return "abcd"
+                if name == "__module__":
+                    return None
+                raise AttributeError
+
+        params = []
+        params.append(Zap(params))
+        alias = type(list[int])(list, (params,))
+        repr_str = repr(alias)
+        self.assertTrue(repr_str.startswith("list[["), repr_str)
+
     def test_exposed_type(self):
         import types
         a = types.GenericAlias(list, int)

Misc/NEWS.d/next/Core_and_Builtins/2026-01-11-20-11-36.gh-issue-143670.klnGoD.rst

@@ -0,0 +1 @@
+Fixes a crash in ``_Py_typing_type_repr`` function.

Objects/typevarobject.c

@@ -270,13 +270,14 @@ _Py_typing_type_repr(PyUnicodeWriter *writer, PyObject *p)
     if (p == Py_Ellipsis) {
         // The Ellipsis object
         r = PyUnicode_FromString("...");
-        goto exit;
+        goto cleanup;
     }
 
     if (p == (PyObject *)&_PyNone_Type) {
         return PyUnicodeWriter_WriteASCII(writer, "None", 4);
     }
 
+    Py_INCREF(p);  // gh-143635
     if ((rc = PyObject_HasAttrWithError(p, &_Py_ID(__origin__))) > 0 &&
         (rc = PyObject_HasAttrWithError(p, &_Py_ID(__args__))) > 0)
     {
@@ -316,6 +317,8 @@ _Py_typing_type_repr(PyUnicodeWriter *writer, PyObject *p)
 use_repr:
     r = PyObject_Repr(p);
 exit:
+    Py_DECREF(p);  // gh-143635
+cleanup:
     Py_XDECREF(qualname);
     Py_XDECREF(module);
     if (r == NULL) {