Issue #27286: Fixed compiling BUILD_MAP_UNPACK_WITH_CALL opcode. Calling

function with generalized unpacking (PEP 448) and conflicting keyword names
could cause undefined behavior.

Lib/importlib/_bootstrap_external.py

@@ -223,6 +223,7 @@ _code_type = type(_write_atomic.__code__)
 #     Python 3.5b1  3330 (PEP 448: Additional Unpacking Generalizations)
 #     Python 3.5b2  3340 (fix dictionary display evaluation order #11205)
 #     Python 3.5b2  3350 (add GET_YIELD_FROM_ITER opcode #24400)
+#     Python 3.5.2  3351 (fix BUILD_MAP_UNPACK_WITH_CALL opcode #27286)
 #
 # MAGIC must change whenever the bytecode emitted by the compiler may no
 # longer be understood by older implementations of the eval loop (usually
@@ -231,7 +232,7 @@ _code_type = type(_write_atomic.__code__)
 # Whenever MAGIC_NUMBER is changed, the ranges in the magic_values array
 # in PC/launcher.c must also be updated.
 
-MAGIC_NUMBER = (3350).to_bytes(2, 'little') + b'\r\n'
+MAGIC_NUMBER = (3351).to_bytes(2, 'little') + b'\r\n'
 _RAW_MAGIC_NUMBER = int.from_bytes(MAGIC_NUMBER, 'little')  # For import.c
 
 _PYCACHE = '__pycache__'

Lib/test/test_extcall.py

@@ -57,6 +57,10 @@ Here we add keyword arguments
     Traceback (most recent call last):
         ...
     TypeError: f() got multiple values for keyword argument 'a'
+    >>> f(1, 2, a=3, **{'a': 4}, **{'a': 5})
+    Traceback (most recent call last):
+        ...
+    TypeError: f() got multiple values for keyword argument 'a'
     >>> f(1, 2, 3, *[4, 5], **{'a':6, 'b':7})
     (1, 2, 3, 4, 5) {'a': 6, 'b': 7}
     >>> f(1, 2, 3, x=4, y=5, *(6, 7), **{'a':8, 'b': 9})

Lib/test/test_unpack_ex.py

@@ -248,6 +248,11 @@ Overridden parameters
       ...
     TypeError: f() got multiple values for keyword argument 'x'
 
+    >>> f(x=5, **{'x': 3}, **{'x': 2})
+    Traceback (most recent call last):
+      ...
+    TypeError: f() got multiple values for keyword argument 'x'
+
     >>> f(**{1: 3}, **{1: 5})
     Traceback (most recent call last):
       ...

Misc/NEWS

@@ -10,6 +10,10 @@ Release date: tba
 Core and Builtins
 -----------------
 
+- Issue #27286: Fixed compiling BUILD_MAP_UNPACK_WITH_CALL opcode.  Calling
+  function with generalized unpacking (PEP 448) and conflicting keyword names
+  could cause undefined behavior.
+
 - Issue #27066: Fixed SystemError if a custom opener (for open()) returns a
   negative number without setting an exception.
 

PC/launcher.c

@@ -1081,7 +1081,7 @@ static PYC_MAGIC magic_values[] = {
     { 3160, 3180, L"3.2" },
     { 3190, 3230, L"3.3" },
     { 3250, 3310, L"3.4" },
-    { 3320, 3350, L"3.5" },
+    { 3320, 3351, L"3.5" },
     { 3360, 3361, L"3.6" },
     { 0 }
 };

Python/compile.c

@@ -3262,7 +3262,7 @@ compiler_call_helper(struct compiler *c,
         code |= 2;
         if (nsubkwargs > 1) {
             /* Pack it all up */
-            int function_pos = n + (code & 1) + nkw + 1;
+            int function_pos = n + (code & 1) + 2 * nkw + 1;
             ADDOP_I(c, BUILD_MAP_UNPACK_WITH_CALL, nsubkwargs | (function_pos << 8));
         }
     }