Fix infinite generator hanging on extended slice assignment (gh-146268)

When assigning an arbitrary iterable to an extended slice (step != 1),
use bounded iteration to collect at most slicelength + 1 items instead
of eagerly consuming the entire iterable via PySequence_Fast. This
prevents infinite iterators from hanging indefinitely.

The slice length is recomputed after consuming the iterable to handle
pathological iterators that mutate the list during iteration.

Co-authored-by: csm10495 <5749838+csm10495@users.noreply.github.com>
Agent-Logs-Url: https://github.com/csm10495/cpython/sessions/996cabbe-7dc6-4faa-b95b-31907ef41b20

Author: Copilot

Lib/test/list_tests.py

@@ -202,6 +202,49 @@ def test_slice_assign_iterator(self):
         x[:] = reversed(range(3))
         self.assertEqual(x, self.type2test([2, 1, 0]))
 
+    def test_extended_slice_assign_infinite_iterator(self):
+        # gh-146268: assigning an infinite iterator to an extended slice
+        # (step != 1) should raise ValueError, not hang indefinitely.
+        def infinite_gen():
+            while True:
+                yield "foo"
+
+        a = self.type2test(range(4))
+        with self.assertRaises(ValueError):
+            a[::2] = infinite_gen()
+        # list should be unchanged after the failed assignment
+        self.assertEqual(a, self.type2test(range(4)))
+
+        a = self.type2test(range(10))
+        with self.assertRaises(ValueError):
+            a[::3] = infinite_gen()
+        self.assertEqual(a, self.type2test(range(10)))
+
+        # Negative step with infinite iterator
+        a = self.type2test(range(6))
+        with self.assertRaises(ValueError):
+            a[::-2] = infinite_gen()
+        self.assertEqual(a, self.type2test(range(6)))
+
+    def test_extended_slice_assign_iterator(self):
+        # Assigning a finite iterator with the correct length to an
+        # extended slice should work.
+        a = self.type2test(range(10))
+        a[::2] = iter(range(5))
+        self.assertEqual(a, self.type2test([0, 1, 1, 3, 2, 5, 3, 7, 4, 9]))
+
+        # Too few items from an iterator
+        a = self.type2test(range(10))
+        with self.assertRaises(ValueError):
+            a[::2] = iter(range(3))
+        self.assertEqual(a, self.type2test(range(10)))
+
+        # Too many items from an iterator
+        a = self.type2test(range(10))
+        with self.assertRaises(ValueError):
+            a[::2] = iter(range(10))
+        self.assertEqual(a, self.type2test(range(10)))
+
     def test_delslice(self):
         a = self.type2test([0, 1])
         del a[1:2]

Objects/listobject.c

@@ -3827,6 +3827,62 @@ list_ass_subscript_lock_held(PyObject *_self, PyObject *item, PyObject *value)
                 seq = list_slice_lock_held((PyListObject *)value, 0,
                                             Py_SIZE(value));
             }
+            else if (step != 1 &&
+                     !PyList_CheckExact(value) &&
+                     !PyTuple_CheckExact(value))
+            {
+                /* For extended slices (step != 1) with arbitrary iterables,
+                   use bounded iteration to avoid hanging on infinite
+                   iterators (gh-146268).  We compute a preliminary slice
+                   length to cap the number of items we collect.  The real
+                   slice length is recomputed afterwards because the
+                   iterable's __next__ may mutate the list. */
+                Py_ssize_t tmp_start = start, tmp_stop = stop;
+                Py_ssize_t slicelength_bound = adjust_slice_indexes(
+                    self, &tmp_start, &tmp_stop, step);
+
+                PyObject *it = PyObject_GetIter(value);
+                if (it == NULL) {
+                    if (PyErr_ExceptionMatches(PyExc_TypeError)) {
+                        PyErr_SetString(PyExc_TypeError,
+                                        "must assign iterable "
+                                        "to extended slice");
+                    }
+                    return -1;
+                }
+                Py_ssize_t alloc = slicelength_bound + 1;
+                if (alloc <= 0) {
+                    /* Overflow or zero-length slice; still collect at
+                       least 1 item so the size check can detect a
+                       non-empty iterable. */
+                    alloc = 1;
+                }
+                seq = PyList_New(alloc);
+                if (seq == NULL) {
+                    Py_DECREF(it);
+                    return -1;
+                }
+                Py_ssize_t j;
+                for (j = 0; j < alloc; j++) {
+                    PyObject *v = PyIter_Next(it);
+                    if (v == NULL) {
+                        if (PyErr_Occurred()) {
+                            /* Discard unfilled slots before decref */
+                            Py_SET_SIZE(seq, j);
+                            Py_DECREF(seq);
+                            Py_DECREF(it);
+                            return -1;
+                        }
+                        break;
+                    }
+                    PyList_SET_ITEM(seq, j, v);
+                }
+                Py_DECREF(it);
+                /* Shrink to the number of items actually collected */
+                if (j < alloc) {
+                    Py_SET_SIZE(seq, j);
+                }
+            }
             else {
                 seq = PySequence_Fast(value,
                                       "must assign iterable "