From 4c54387f11d8c38d3bf59f547ab72b78354ad5de Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Wed, 28 Jan 2015 10:52:49 +0200
Subject: [PATCH] Issue #22079: PyType_Ready() now checks that statically
 allocated type has no dynamically allocated bases.

---
 Misc/NEWS            |  6 ++++++
 Objects/typeobject.c | 14 ++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/Misc/NEWS b/Misc/NEWS
index c08951ef8b..2256bf835d 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -117,6 +117,12 @@ Build
 
 - Issue #23212: Update 10.5 OS X installer build to use OpenSSL 1.0.1k.
 
+C API
+-----
+
+- Issue #22079: PyType_Ready() now checks that statically allocated type has
+  no dynamically allocated bases.
+
 
 What's New in Python 2.7.9?
 ===========================
diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 619ac9be17..23dda2ac93 100644
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -4073,6 +4073,20 @@ PyType_Ready(PyTypeObject *type)
             inherit_slots(type, (PyTypeObject *)b);
     }
 
+    /* All bases of statically allocated type should be statically allocated */
+    if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE))
+        for (i = 0; i < n; i++) {
+            PyObject *b = PyTuple_GET_ITEM(bases, i);
+            if (PyType_Check(b) &&
+                (((PyTypeObject *)b)->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
+                PyErr_Format(PyExc_TypeError,
+                             "type '%.100s' is not dynamically allocated but "
+                             "its base type '%.100s' is dynamically allocated",
+                             type->tp_name, ((PyTypeObject *)b)->tp_name);
+                goto error;
+            }
+        }
+
     /* Sanity check for tp_free. */
     if (PyType_IS_GC(type) && (type->tp_flags & Py_TPFLAGS_BASETYPE) &&
         (type->tp_free == NULL || type->tp_free == PyObject_Del)) {
-- 
2.50.1