GeezerVison

gh-149816: Fix UAF in Modules/_pickle.c (GH-150024)

Backport note: 3.14's batch_list_exact() has the single-item fast path before the batch loop; main moved it inside the loop, which changes the emitted pickle byte stream (APPEND vs MARK ... APPENDS for a trailing single item). To avoid changing 3.14's pickle output, 3.14's structure was kept and only the fix applied: the borrowed PyList_GET_ITEM() + Py_INCREF() became PyList_GetItemRef(), and the list changed size during iteration RuntimeError check was added after each batch. The upstream regression test (test_pickle_dumps_with_concurrent_list_mutations) tolerates RuntimeError/IndexError and passes unchanged.

(cherry picked from commit d095ceb)

Co-authored-by: Alexey Katsman [email protected]
Co-authored-by: Gregory P. Smith [email protected]