gh-156946: Unlink a curses panel before dropping its user pointer

PyCursesPanel_Dealloc() dropped the panel's user pointer first, through
PyCursesPanel_Clear(), and only then called del_panel() and remove_lop().
Dropping that reference can run a __del__, and until del_panel() has run
the dying panel is still on the panel stack and still in lop, so
top_panel(), bottom_panel(), above() and below() hand the finalizer a new
reference to an object whose refcount is already zero.  Releasing that
reference re-enters the deallocator and the interpreter segfaults.

Take the panel out of lop and off the panel stack first, and release the
user pointer and the window afterwards.  set_panel_userptr() and
panel_userptr() need the PANEL, so they still run before del_panel().
remove_lop() now also runs before del_panel(), which closes a second
window where the registry held an entry whose PANEL had been freed.

The deallocator cannot simply call PyCursesPanel_Clear() in the new order
because that function is also tp_clear, where del_panel() must not run.

Author: fedonman

Lib/test/test_curses.py

@@ -2428,6 +2428,22 @@ def __del__(self):
         panel.set_userptr(A())
         panel.set_userptr(None)
 
+    @requires_curses_func('panel')
+    def test_userptr_dealloc_segfault(self):
+        w = curses.newwin(10, 10)
+        panel = curses.panel.new_panel(w)
+        seen = []
+        class A:
+            def __del__(self):
+                # The panel is being deallocated, so it must already be off
+                # the stack: handing it back here would resurrect an object
+                # whose refcount is zero -- segfaults.
+                seen.append(curses.panel.top_panel() is None)
+        panel.set_userptr(A())
+        del panel
+        gc_collect()
+        self.assertEqual(seen, [True])
+
     @cpython_only
     @requires_curses_func('panel')
     def test_disallow_instantiation(self):

Misc/NEWS.d/next/Library/2026-09-04-16-05-45.gh-issue-156946.0ZYCdh.rst

@@ -0,0 +1,3 @@
+Fix a crash in :mod:`curses.panel` when the finalizer of a panel's user
+pointer runs while the panel is being deallocated.  The panel is now taken
+off the panel stack before its user pointer is dropped.

Modules/_curses_panel.c

@@ -454,20 +454,21 @@ PyCursesPanel_Dealloc(PyObject *self)
     PyObject_GC_UnTrack(self);
 
     PyCursesPanelObject *po = _PyCursesPanelObject_CAST(self);
-    if (PyCursesPanel_Clear(self) < 0) {
+    PyObject *extra = (PyObject *)panel_userptr(po->pan);
+    if (extra != NULL && set_panel_userptr(po->pan, NULL) == ERR) {
+        curses_panel_panel_set_error(po, "set_panel_userptr", "__del__");
+        PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()");
+    }
+    if (po->wo != NULL && remove_lop(po) < 0) {
+        PyErr_SetString(PyExc_RuntimeError, "__del__: no panel object to delete");
         PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()");
     }
     if (del_panel(po->pan) == ERR && !PyErr_Occurred()) {
         curses_panel_panel_set_error(po, "del_panel", "__del__");
         PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()");
     }
-    if (po->wo != NULL) {
-        Py_DECREF(po->wo);
-        if (remove_lop(po) < 0) {
-            PyErr_SetString(PyExc_RuntimeError, "__del__: no panel object to delete");
-            PyErr_FormatUnraisable("Exception ignored in PyCursesPanel_Dealloc()");
-        }
-    }
+    Py_XDECREF(extra);
+    Py_XDECREF(po->wo);
     tp->tp_free(po);
     Py_DECREF(tp);
 }