gh-143544: Fix possible use-after-free in the JSON decoder when JSONDecodeError disappears during raising it

Lib/test/test_json/test_fail.py

@@ -1,4 +1,6 @@
 from test.test_json import PyTest, CTest
+from test import support
+import json
 
 # 2007-10-05
 JSONDOCS = [
@@ -236,5 +238,27 @@ def test_linecol(self):
                              'Expecting value: line %s column %d (char %d)' %
                              (line, col, idx))
 
+
+    def test_reentrant_jsondecodeerror_does_not_crash(self):
+        # gh-143544
+
+        class Trigger:
+            def __call__(self, *args, **kwargs):
+                # Remove JSONDecodeError during construction to trigger re-entrancy
+                del json.JSONDecodeError
+                del json.decoder.JSONDecodeError
+                return ValueError("boom")
+
+        hook = Trigger()
+        with (
+            support.swap_attr(json, "JSONDecodeError", hook),
+            support.swap_attr(json.decoder, "JSONDecodeError", hook)
+        ):
+            # The exact exception type is not important here;
+            # this test only ensures we don't crash.
+            with self.assertRaises(json.JSONDecodeError):
+                json.loads('"\\uZZZZ"')
+
+
 class TestPyFail(TestFail, PyTest): pass
 class TestCFail(TestFail, CTest): pass

Modules/_json.c

@@ -423,11 +423,12 @@ raise_errmsg(const char *msg, PyObject *s, Py_ssize_t end)
 
     PyObject *exc;
     exc = PyObject_CallFunction(JSONDecodeError, "zOn", msg, s, end);
-    Py_DECREF(JSONDecodeError);
     if (exc) {
         PyErr_SetObject(JSONDecodeError, exc);
         Py_DECREF(exc);
     }
+
+    Py_DECREF(JSONDecodeError);
 }
 
 static void