Fix refcount error in restore_sys_last_exception (#1816)

docs/project/changelog.md

@@ -34,10 +34,15 @@ substitutions:
   `PYODIDE_PACKAGES='*'` In addition, `make minimal` was removed, since it is
   now equivalent to `make` without extra arguments. {pr}`1801`
 
-- {{Fix}} The `setInterruptBuffer` command is now publically exposed again, as
+### Uncategorized
+
+- {{Fix}} The `setInterruptBuffer` command is now publicly exposed again, as
   it was before.
   {pr}`1797`
 
+- {{Fix}} Fixed a use after free bug in the error handling code.
+  {pr}`1816`
+
 ## Version 0.18.0
 
 _August 3rd, 2021_

src/core/error_handling.c

@@ -118,6 +118,11 @@ restore_sys_last_exception(void* value)
   if (value != last_value) {
     return 0;
   }
+  // PyErr_Restore steals a reference to each of its arguments so need to incref
+  // them first.
+  Py_INCREF(last_type);
+  Py_INCREF(last_value);
+  Py_INCREF(last_traceback);
   PyErr_Restore(last_type, last_value, last_traceback);
   success = true;
 finally:

src/tests/test_pyodide.py

@@ -573,6 +573,32 @@ def test_reentrant_error(selenium):
     assert caught
 
 
+def test_restore_error(selenium):
+    # See PR #1816.
+    selenium.run_js(
+        """
+        self.f = function(){
+            pyodide.runPython(`
+                err = Exception('hi')
+                raise err
+            `);
+        }
+        pyodide.runPython(`
+            from js import f
+            import sys
+            try:
+                f()
+            except Exception as e:
+                assert err == e
+                assert e == sys.last_value
+            finally:
+                del err
+            assert sys.getrefcount(sys.last_value) == 2
+        `);
+        """
+    )
+
+
 @pytest.mark.skip_refcount_check
 @pytest.mark.skip_pyproxy_check
 def test_custom_stdin_stdout(selenium_standalone_noload):