From 66e4edd7346b1cd65ddff6da890a0d725e325116 Mon Sep 17 00:00:00 2001
From: Carl Meyer <carl@oddbird.net>
Date: Fri, 11 Aug 2023 12:42:26 -0600
Subject: [PATCH] gh-91051: fix segfault when using all 8 type watchers
 (#107853)

---
 Doc/c-api/typeobj.rst                                |  4 ++--
 Doc/includes/typestruct.h                            |  2 +-
 Include/cpython/object.h                             |  2 +-
 Lib/test/test_capi/test_watchers.py                  | 12 ++++++++++++
 .../2023-08-10-17-36-27.gh-issue-91051.LfaeNW.rst    |  2 ++
 5 files changed, 18 insertions(+), 4 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Core and Builtins/2023-08-10-17-36-27.gh-issue-91051.LfaeNW.rst

diff --git a/Doc/c-api/typeobj.rst b/Doc/c-api/typeobj.rst
index 221a05b1922..faa183e27fc 100644
--- a/Doc/c-api/typeobj.rst
+++ b/Doc/c-api/typeobj.rst
@@ -147,7 +147,7 @@ Quick Reference
    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
    | :c:member:`~PyTypeObject.tp_vectorcall`        | :c:type:`vectorcallfunc`          |                   |   |   |   |   |
    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
-   | [:c:member:`~PyTypeObject.tp_watched`]         | char                              |                   |   |   |   |   |
+   | [:c:member:`~PyTypeObject.tp_watched`]         | unsigned char                     |                   |   |   |   |   |
    +------------------------------------------------+-----------------------------------+-------------------+---+---+---+---+
 
 .. [#slots]
@@ -2141,7 +2141,7 @@ and :c:data:`PyType_Type` effectively act as defaults.)
    .. versionadded:: 3.9 (the field exists since 3.8 but it's only used since 3.9)
 
 
-.. c:member:: char PyTypeObject.tp_watched
+.. c:member:: unsigned char PyTypeObject.tp_watched
 
    Internal. Do not use.
 
diff --git a/Doc/includes/typestruct.h b/Doc/includes/typestruct.h
index f0ad1e47cb0..ec939c28831 100644
--- a/Doc/includes/typestruct.h
+++ b/Doc/includes/typestruct.h
@@ -82,5 +82,5 @@ typedef struct _typeobject {
     vectorcallfunc tp_vectorcall;
 
     /* bitset of which type-watchers care about this type */
-    char tp_watched;
+    unsigned char tp_watched;
 } PyTypeObject;
diff --git a/Include/cpython/object.h b/Include/cpython/object.h
index fd45fa57e62..5f8b1f7c195 100644
--- a/Include/cpython/object.h
+++ b/Include/cpython/object.h
@@ -227,7 +227,7 @@ struct _typeobject {
     vectorcallfunc tp_vectorcall;
 
     /* bitset of which type-watchers care about this type */
-    char tp_watched;
+    unsigned char tp_watched;
 };
 
 /* This struct is used by the specializer
diff --git a/Lib/test/test_capi/test_watchers.py b/Lib/test/test_capi/test_watchers.py
index 93f6ef752d0..10b76e163bf 100644
--- a/Lib/test/test_capi/test_watchers.py
+++ b/Lib/test/test_capi/test_watchers.py
@@ -294,6 +294,18 @@ class TestTypeWatchers(unittest.TestCase):
                 C2.hmm = "baz"
                 self.assert_events([C1, [C2]])
 
+    def test_all_watchers(self):
+        class C: pass
+        with ExitStack() as stack:
+            last_wid = -1
+            # don't make assumptions about how many watchers are already
+            # registered, just go until we reach the max ID
+            while last_wid < self.TYPE_MAX_WATCHERS - 1:
+                last_wid = stack.enter_context(self.watcher())
+            self.watch(last_wid, C)
+            C.foo = "bar"
+            self.assert_events([C])
+
     def test_watch_non_type(self):
         with self.watcher() as wid:
             with self.assertRaisesRegex(ValueError, r"Cannot watch non-type"):
diff --git a/Misc/NEWS.d/next/Core and Builtins/2023-08-10-17-36-27.gh-issue-91051.LfaeNW.rst b/Misc/NEWS.d/next/Core and Builtins/2023-08-10-17-36-27.gh-issue-91051.LfaeNW.rst
new file mode 100644
index 00000000000..b4b90ad4ea0
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2023-08-10-17-36-27.gh-issue-91051.LfaeNW.rst	
@@ -0,0 +1,2 @@
+Fix abort / segfault when using all eight type watcher slots, on platforms
+where ``char`` is signed by default.