From f3b86253866fcec81b24b88850797eb47aaf34e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 16 Dec 2024 12:35:40 +0100
Subject: [PATCH 1/8] Fix UBSan failures in `xml.etree.ElementTree.Element`

---
 Modules/_elementtree.c | 97 ++++++++++++++++++++++++------------------
 1 file changed, 55 insertions(+), 42 deletions(-)

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index e134e096e044b7..533b0ee4cd7565 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -257,6 +257,7 @@ typedef struct {
 } ElementObject;
 
 
+#define _Element_CAST(PTR) ((ElementObject *)(PTR))
 #define Element_CheckExact(st, op) Py_IS_TYPE(op, (st)->Element_Type)
 #define Element_Check(st, op) PyObject_TypeCheck(op, (st)->Element_Type)
 
@@ -648,9 +649,10 @@ subelement(PyObject *self, PyObject *args, PyObject *kwds)
 }
 
 static int
-element_gc_traverse(ElementObject *self, visitproc visit, void *arg)
+element_gc_traverse(PyObject *op, visitproc visit, void *arg)
 {
-    Py_VISIT(Py_TYPE(self));
+    Py_VISIT(Py_TYPE(op));
+    ElementObject *self = _Element_CAST(op);
     Py_VISIT(self->tag);
     Py_VISIT(JOIN_OBJ(self->text));
     Py_VISIT(JOIN_OBJ(self->tail));
@@ -666,8 +668,9 @@ element_gc_traverse(ElementObject *self, visitproc visit, void *arg)
 }
 
 static int
-element_gc_clear(ElementObject *self)
+element_gc_clear(PyObject *op)
 {
+    ElementObject *self = _Element_CAST(op);
     Py_CLEAR(self->tag);
     _clear_joined_ptr(&self->text);
     _clear_joined_ptr(&self->tail);
@@ -680,22 +683,23 @@ element_gc_clear(ElementObject *self)
 }
 
 static void
-element_dealloc(ElementObject* self)
+element_dealloc(PyObject *op)
 {
-    PyTypeObject *tp = Py_TYPE(self);
+    PyTypeObject *tp = Py_TYPE(op);
 
     /* bpo-31095: UnTrack is needed before calling any callbacks */
-    PyObject_GC_UnTrack(self);
-    Py_TRASHCAN_BEGIN(self, element_dealloc)
+    PyObject_GC_UnTrack(op);
+    Py_TRASHCAN_BEGIN(op, element_dealloc)
+    ElementObject *self = _Element_CAST(op);
 
     if (self->weakreflist != NULL)
-        PyObject_ClearWeakRefs((PyObject *) self);
+        PyObject_ClearWeakRefs(op);
 
     /* element_gc_clear clears all references and deallocates extra
     */
-    element_gc_clear(self);
+    (void)element_gc_clear(op);
 
-    tp->tp_free((PyObject *)self);
+    tp->tp_free(op);
     Py_DECREF(tp);
     Py_TRASHCAN_END
 }
@@ -1478,9 +1482,9 @@ _elementtree_Element_itertext_impl(ElementObject *self, PyTypeObject *cls)
 
 
 static PyObject*
-element_getitem(PyObject* self_, Py_ssize_t index)
+element_getitem(PyObject *op, Py_ssize_t index)
 {
-    ElementObject* self = (ElementObject*) self_;
+    ElementObject *self = _Element_CAST(op);
 
     if (!self->extra || index < 0 || index >= self->extra->length) {
         PyErr_SetString(
@@ -1494,9 +1498,9 @@ element_getitem(PyObject* self_, Py_ssize_t index)
 }
 
 static int
-element_bool(PyObject* self_)
+element_bool(PyObject *op)
 {
-    ElementObject* self = (ElementObject*) self_;
+    ElementObject *self = _Element_CAST(op);
     if (PyErr_WarnEx(PyExc_DeprecationWarning,
                      "Testing an element's truth value will always return True "
                      "in future versions.  Use specific 'len(elem)' or "
@@ -1583,8 +1587,9 @@ _elementtree_Element_keys_impl(ElementObject *self)
 }
 
 static Py_ssize_t
-element_length(ElementObject* self)
+element_length(PyObject *op)
 {
+    ElementObject *self = _Element_CAST(op);
     if (!self->extra)
         return 0;
 
@@ -1675,10 +1680,10 @@ _elementtree_Element_remove_impl(ElementObject *self, PyObject *subelement)
 }
 
 static PyObject*
-element_repr(ElementObject* self)
+element_repr(PyObject *op)
 {
     int status;
-
+    ElementObject *self = _Element_CAST(op);
     if (self->tag == NULL)
         return PyUnicode_FromFormat("<Element at %p>", self);
 
@@ -1728,9 +1733,9 @@ _elementtree_Element_set_impl(ElementObject *self, PyObject *key,
 }
 
 static int
-element_setitem(PyObject* self_, Py_ssize_t index, PyObject* item)
+element_setitem(PyObject *op, Py_ssize_t index, PyObject* item)
 {
-    ElementObject* self = (ElementObject*) self_;
+    ElementObject *self = _Element_CAST(op);
     Py_ssize_t i;
     PyObject* old;
 
@@ -1762,10 +1767,10 @@ element_setitem(PyObject* self_, Py_ssize_t index, PyObject* item)
     return 0;
 }
 
-static PyObject*
-element_subscr(PyObject* self_, PyObject* item)
+static PyObject *
+element_subscr(PyObject *op, PyObject *item)
 {
-    ElementObject* self = (ElementObject*) self_;
+    ElementObject *self = _Element_CAST(op);
 
     if (PyIndex_Check(item)) {
         Py_ssize_t i = PyNumber_AsSsize_t(item, PyExc_IndexError);
@@ -1775,7 +1780,7 @@ element_subscr(PyObject* self_, PyObject* item)
         }
         if (i < 0 && self->extra)
             i += self->extra->length;
-        return element_getitem(self_, i);
+        return element_getitem(op, i);
     }
     else if (PySlice_Check(item)) {
         Py_ssize_t start, stop, step, slicelen, i;
@@ -1815,9 +1820,9 @@ element_subscr(PyObject* self_, PyObject* item)
 }
 
 static int
-element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
+element_ass_subscr(PyObject *op, PyObject *item, PyObject *value)
 {
-    ElementObject* self = (ElementObject*) self_;
+    ElementObject *self = _Element_CAST(op);
 
     if (PyIndex_Check(item)) {
         Py_ssize_t i = PyNumber_AsSsize_t(item, PyExc_IndexError);
@@ -1827,7 +1832,7 @@ element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
         }
         if (i < 0 && self->extra)
             i += self->extra->length;
-        return element_setitem(self_, i, value);
+        return element_setitem(op, i, value);
     }
     else if (PySlice_Check(item)) {
         Py_ssize_t start, stop, step, slicelen, newlen, i;
@@ -1998,30 +2003,34 @@ element_ass_subscr(PyObject* self_, PyObject* item, PyObject* value)
 }
 
 static PyObject*
-element_tag_getter(ElementObject *self, void *closure)
+element_tag_getter(PyObject *op, void *closure)
 {
+    ElementObject *self = _Element_CAST(op);
     PyObject *res = self->tag;
     return Py_NewRef(res);
 }
 
 static PyObject*
-element_text_getter(ElementObject *self, void *closure)
+element_text_getter(PyObject *op, void *closure)
 {
+    ElementObject *self = _Element_CAST(op);
     PyObject *res = element_get_text(self);
     return Py_XNewRef(res);
 }
 
 static PyObject*
-element_tail_getter(ElementObject *self, void *closure)
+element_tail_getter(PyObject *op, void *closure)
 {
+    ElementObject *self = _Element_CAST(op);
     PyObject *res = element_get_tail(self);
     return Py_XNewRef(res);
 }
 
 static PyObject*
-element_attrib_getter(ElementObject *self, void *closure)
+element_attrib_getter(PyObject *op, void *closure)
 {
     PyObject *res;
+    ElementObject *self = _Element_CAST(op);
     if (!self->extra) {
         if (create_extra(self, NULL) < 0)
             return NULL;
@@ -2040,31 +2049,34 @@ element_attrib_getter(ElementObject *self, void *closure)
     }
 
 static int
-element_tag_setter(ElementObject *self, PyObject *value, void *closure)
+element_tag_setter(PyObject *op, PyObject *value, void *closure)
 {
     _VALIDATE_ATTR_VALUE(value);
+    ElementObject *self = _Element_CAST(op);
     Py_SETREF(self->tag, Py_NewRef(value));
     return 0;
 }
 
 static int
-element_text_setter(ElementObject *self, PyObject *value, void *closure)
+element_text_setter(PyObject *op, PyObject *value, void *closure)
 {
     _VALIDATE_ATTR_VALUE(value);
+    ElementObject *self = _Element_CAST(op);
     _set_joined_ptr(&self->text, Py_NewRef(value));
     return 0;
 }
 
 static int
-element_tail_setter(ElementObject *self, PyObject *value, void *closure)
+element_tail_setter(PyObject *op, PyObject *value, void *closure)
 {
     _VALIDATE_ATTR_VALUE(value);
+    ElementObject *self = _Element_CAST(op);
     _set_joined_ptr(&self->tail, Py_NewRef(value));
     return 0;
 }
 
 static int
-element_attrib_setter(ElementObject *self, PyObject *value, void *closure)
+element_attrib_setter(PyObject *op, PyObject *value, void *closure)
 {
     _VALIDATE_ATTR_VALUE(value);
     if (!PyDict_Check(value)) {
@@ -2073,6 +2085,7 @@ element_attrib_setter(ElementObject *self, PyObject *value, void *closure)
                      Py_TYPE(value)->tp_name);
         return -1;
     }
+    ElementObject *self = _Element_CAST(op);
     if (!self->extra) {
         if (create_extra(self, NULL) < 0)
             return -1;
@@ -4229,20 +4242,20 @@ static struct PyMemberDef element_members[] = {
 
 static PyGetSetDef element_getsetlist[] = {
     {"tag",
-        (getter)element_tag_getter,
-        (setter)element_tag_setter,
+        element_tag_getter,
+        element_tag_setter,
         "A string identifying what kind of data this element represents"},
     {"text",
-        (getter)element_text_getter,
-        (setter)element_text_setter,
+        element_text_getter,
+        element_text_setter,
         "A string of text directly after the start tag, or None"},
     {"tail",
-        (getter)element_tail_getter,
-        (setter)element_tail_setter,
+        element_tail_getter,
+        element_tail_setter,
         "A string of text directly after the end tag, or None"},
     {"attrib",
-        (getter)element_attrib_getter,
-        (setter)element_attrib_setter,
+        element_attrib_getter,
+        element_attrib_setter,
         "A dictionary containing the element's attributes"},
     {NULL},
 };

From 26a172c5ef72997bcb42d1799c1b476df2229fc1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 16 Dec 2024 12:38:05 +0100
Subject: [PATCH 2/8] Fix UBSan failures in `_elementtree._element_iterator`

---
 Modules/_elementtree.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 533b0ee4cd7565..6b3e966a549f2a 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -2119,11 +2119,14 @@ typedef struct {
     int gettext;
 } ElementIterObject;
 
+#define _ElementIter_CAST(PTR) ((ElementIterObject *)(PTR))
+
 
 static void
-elementiter_dealloc(ElementIterObject *it)
+elementiter_dealloc(PyObject *op)
 {
-    PyTypeObject *tp = Py_TYPE(it);
+    PyTypeObject *tp = Py_TYPE(op);
+    ElementIterObject *it = _ElementIter_CAST(op);
     Py_ssize_t i = it->parent_stack_used;
     it->parent_stack_used = 0;
     /* bpo-31095: UnTrack is needed before calling any callbacks */
@@ -2135,20 +2138,21 @@ elementiter_dealloc(ElementIterObject *it)
     Py_XDECREF(it->sought_tag);
     Py_XDECREF(it->root_element);
 
-    tp->tp_free(it);
+    tp->tp_free(op);
     Py_DECREF(tp);
 }
 
 static int
-elementiter_traverse(ElementIterObject *it, visitproc visit, void *arg)
+elementiter_traverse(PyObject *op, visitproc visit, void *arg)
 {
+    ElementIterObject *it = _ElementIter_CAST(op);
     Py_ssize_t i = it->parent_stack_used;
     while (i--)
         Py_VISIT(it->parent_stack[i].parent);
 
     Py_VISIT(it->root_element);
     Py_VISIT(it->sought_tag);
-    Py_VISIT(Py_TYPE(it));
+    Py_VISIT(Py_TYPE(op));
     return 0;
 }
 
@@ -2175,8 +2179,9 @@ parent_stack_push_new(ElementIterObject *it, ElementObject *parent)
 }
 
 static PyObject *
-elementiter_next(ElementIterObject *it)
+elementiter_next(PyObject *op)
 {
+    ElementIterObject *it = _ElementIter_CAST(op);
     /* Sub-element iterator.
      *
      * A short note on gettext: this function serves both the iter() and

From 52fdab1fe46f7f8b97491e445b72f6c9947fdce3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 16 Dec 2024 12:40:53 +0100
Subject: [PATCH 3/8] Fix UBSan failures in `xml.etree.ElementTree.TreeBuilder`

---
 Modules/_elementtree.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 6b3e966a549f2a..11884de34b78ae 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -2372,6 +2372,8 @@ typedef struct {
     elementtreestate *state;
 } TreeBuilderObject;
 
+
+#define _TreeBuilder_CAST(PTR) ((TreeBuilderObject *)(PTR))
 #define TreeBuilder_CheckExact(st, op) Py_IS_TYPE((op), (st)->TreeBuilder_Type)
 
 /* -------------------------------------------------------------------- */
@@ -2462,9 +2464,10 @@ _elementtree_TreeBuilder___init___impl(TreeBuilderObject *self,
 }
 
 static int
-treebuilder_gc_traverse(TreeBuilderObject *self, visitproc visit, void *arg)
+treebuilder_gc_traverse(PyObject *op, visitproc visit, void *arg)
 {
-    Py_VISIT(Py_TYPE(self));
+    Py_VISIT(Py_TYPE(op));
+    TreeBuilderObject *self = _TreeBuilder_CAST(op);
     Py_VISIT(self->pi_event_obj);
     Py_VISIT(self->comment_event_obj);
     Py_VISIT(self->end_ns_event_obj);
@@ -2485,8 +2488,9 @@ treebuilder_gc_traverse(TreeBuilderObject *self, visitproc visit, void *arg)
 }
 
 static int
-treebuilder_gc_clear(TreeBuilderObject *self)
+treebuilder_gc_clear(PyObject *op)
 {
+    TreeBuilderObject *self = _TreeBuilder_CAST(op);
     Py_CLEAR(self->pi_event_obj);
     Py_CLEAR(self->comment_event_obj);
     Py_CLEAR(self->end_ns_event_obj);
@@ -2507,12 +2511,13 @@ treebuilder_gc_clear(TreeBuilderObject *self)
 }
 
 static void
-treebuilder_dealloc(TreeBuilderObject *self)
+treebuilder_dealloc(PyObject *op)
 {
-    PyTypeObject *tp = Py_TYPE(self);
+    PyTypeObject *tp = Py_TYPE(op);
+    TreeBuilderObject *self = _TreeBuilder_CAST(op);
     PyObject_GC_UnTrack(self);
-    treebuilder_gc_clear(self);
-    tp->tp_free(self);
+    (void)treebuilder_gc_clear(op);
+    tp->tp_free(op);
     Py_DECREF(tp);
 }
 

From 9ba4c173005d6c72c06fae51316b103978c9f4cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 16 Dec 2024 12:41:09 +0100
Subject: [PATCH 4/8] Fix UBSan failures in `xml.etree.ElementTree.XMLParser`

---
 Modules/_elementtree.c | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 11884de34b78ae..87e653cf539c1a 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -3084,6 +3084,9 @@ typedef struct {
     PyObject *elementtree_module;
 } XMLParserObject;
 
+
+#define _XMLParser_CAST(PTR) ((XMLParserObject *)(PTR))
+
 /* helpers */
 
 LOCAL(PyObject*)
@@ -3774,9 +3777,10 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *target,
 }
 
 static int
-xmlparser_gc_traverse(XMLParserObject *self, visitproc visit, void *arg)
+xmlparser_gc_traverse(PyObject *op, visitproc visit, void *arg)
 {
-    Py_VISIT(Py_TYPE(self));
+    Py_VISIT(Py_TYPE(op));
+    XMLParserObject *self = _XMLParser_CAST(op);
     Py_VISIT(self->handle_close);
     Py_VISIT(self->handle_pi);
     Py_VISIT(self->handle_comment);
@@ -3795,8 +3799,9 @@ xmlparser_gc_traverse(XMLParserObject *self, visitproc visit, void *arg)
 }
 
 static int
-xmlparser_gc_clear(XMLParserObject *self)
+xmlparser_gc_clear(PyObject *op)
 {
+    XMLParserObject *self = _XMLParser_CAST(op);
     elementtreestate *st = self->state;
     if (self->parser != NULL) {
         XML_Parser parser = self->parser;
@@ -3823,11 +3828,11 @@ xmlparser_gc_clear(XMLParserObject *self)
 }
 
 static void
-xmlparser_dealloc(XMLParserObject* self)
+xmlparser_dealloc(PyObject *self)
 {
     PyTypeObject *tp = Py_TYPE(self);
     PyObject_GC_UnTrack(self);
-    xmlparser_gc_clear(self);
+    (void)xmlparser_gc_clear(self);
     tp->tp_free(self);
     Py_DECREF(tp);
 }
@@ -4195,7 +4200,7 @@ static PyMemberDef xmlparser_members[] = {
 };
 
 static PyObject*
-xmlparser_version_getter(XMLParserObject *self, void *closure)
+xmlparser_version_getter(PyObject *op, void *closure)
 {
     return PyUnicode_FromFormat(
         "Expat %d.%d.%d", XML_MAJOR_VERSION,
@@ -4203,7 +4208,7 @@ xmlparser_version_getter(XMLParserObject *self, void *closure)
 }
 
 static PyGetSetDef xmlparser_getsetlist[] = {
-    {"version", (getter)xmlparser_version_getter, NULL, NULL},
+    {"version", xmlparser_version_getter, NULL, NULL},
     {NULL},
 };
 

From 19df9bae776ee6d3e8eed842947af7fbd41141d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 16 Dec 2024 12:41:57 +0100
Subject: [PATCH 5/8] suppress unused return value

---
 Modules/_elementtree.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 87e653cf539c1a..fcb2ae513e7b97 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -184,7 +184,7 @@ elementtree_traverse(PyObject *m, visitproc visit, void *arg)
 static void
 elementtree_free(void *m)
 {
-    elementtree_clear((PyObject *)m);
+    (void)elementtree_clear((PyObject *)m);
 }
 
 /* helpers */

From bfe7fdd21d15772c0d77f59b65bb056f519805d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 16 Dec 2024 13:18:38 +0100
Subject: [PATCH 6/8] use 'op' instead of 'PTR' in cast macros

---
 Modules/_elementtree.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index fcb2ae513e7b97..0f0e45fb4b61f8 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -257,7 +257,7 @@ typedef struct {
 } ElementObject;
 
 
-#define _Element_CAST(PTR) ((ElementObject *)(PTR))
+#define _Element_CAST(op) ((ElementObject *)(op))
 #define Element_CheckExact(st, op) Py_IS_TYPE(op, (st)->Element_Type)
 #define Element_Check(st, op) PyObject_TypeCheck(op, (st)->Element_Type)
 
@@ -2119,7 +2119,7 @@ typedef struct {
     int gettext;
 } ElementIterObject;
 
-#define _ElementIter_CAST(PTR) ((ElementIterObject *)(PTR))
+#define _ElementIter_CAST(op) ((ElementIterObject *)(op))
 
 
 static void
@@ -2373,7 +2373,7 @@ typedef struct {
 } TreeBuilderObject;
 
 
-#define _TreeBuilder_CAST(PTR) ((TreeBuilderObject *)(PTR))
+#define _TreeBuilder_CAST(op) ((TreeBuilderObject *)(op))
 #define TreeBuilder_CheckExact(st, op) Py_IS_TYPE((op), (st)->TreeBuilder_Type)
 
 /* -------------------------------------------------------------------- */
@@ -3085,7 +3085,7 @@ typedef struct {
 } XMLParserObject;
 
 
-#define _XMLParser_CAST(PTR) ((XMLParserObject *)(PTR))
+#define _XMLParser_CAST(op) ((XMLParserObject *)(op))
 
 /* helpers */
 

From d1b2d5218aad0a3e2d7be8a69a7ba40f670c32b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 16 Dec 2024 13:27:56 +0100
Subject: [PATCH 7/8] reduce diff

---
 Modules/_elementtree.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index 0f0e45fb4b61f8..e170734bfa8291 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -651,8 +651,8 @@ subelement(PyObject *self, PyObject *args, PyObject *kwds)
 static int
 element_gc_traverse(PyObject *op, visitproc visit, void *arg)
 {
-    Py_VISIT(Py_TYPE(op));
     ElementObject *self = _Element_CAST(op);
+    Py_VISIT(Py_TYPE(self));
     Py_VISIT(self->tag);
     Py_VISIT(JOIN_OBJ(self->text));
     Py_VISIT(JOIN_OBJ(self->tail));
@@ -685,12 +685,12 @@ element_gc_clear(PyObject *op)
 static void
 element_dealloc(PyObject *op)
 {
-    PyTypeObject *tp = Py_TYPE(op);
+    ElementObject *self = _Element_CAST(op);
+    PyTypeObject *tp = Py_TYPE(self);
 
     /* bpo-31095: UnTrack is needed before calling any callbacks */
-    PyObject_GC_UnTrack(op);
-    Py_TRASHCAN_BEGIN(op, element_dealloc)
-    ElementObject *self = _Element_CAST(op);
+    PyObject_GC_UnTrack(self);
+    Py_TRASHCAN_BEGIN(self, element_dealloc)
 
     if (self->weakreflist != NULL)
         PyObject_ClearWeakRefs(op);
@@ -699,7 +699,7 @@ element_dealloc(PyObject *op)
     */
     (void)element_gc_clear(op);
 
-    tp->tp_free(op);
+    tp->tp_free(self);
     Py_DECREF(tp);
     Py_TRASHCAN_END
 }
@@ -2138,7 +2138,7 @@ elementiter_dealloc(PyObject *op)
     Py_XDECREF(it->sought_tag);
     Py_XDECREF(it->root_element);
 
-    tp->tp_free(op);
+    tp->tp_free(it);
     Py_DECREF(tp);
 }
 
@@ -2152,7 +2152,7 @@ elementiter_traverse(PyObject *op, visitproc visit, void *arg)
 
     Py_VISIT(it->root_element);
     Py_VISIT(it->sought_tag);
-    Py_VISIT(Py_TYPE(op));
+    Py_VISIT(Py_TYPE(it));
     return 0;
 }
 
@@ -2466,8 +2466,8 @@ _elementtree_TreeBuilder___init___impl(TreeBuilderObject *self,
 static int
 treebuilder_gc_traverse(PyObject *op, visitproc visit, void *arg)
 {
-    Py_VISIT(Py_TYPE(op));
     TreeBuilderObject *self = _TreeBuilder_CAST(op);
+    Py_VISIT(Py_TYPE(self));
     Py_VISIT(self->pi_event_obj);
     Py_VISIT(self->comment_event_obj);
     Py_VISIT(self->end_ns_event_obj);
@@ -2513,11 +2513,11 @@ treebuilder_gc_clear(PyObject *op)
 static void
 treebuilder_dealloc(PyObject *op)
 {
-    PyTypeObject *tp = Py_TYPE(op);
     TreeBuilderObject *self = _TreeBuilder_CAST(op);
+    PyTypeObject *tp = Py_TYPE(self);
     PyObject_GC_UnTrack(self);
     (void)treebuilder_gc_clear(op);
-    tp->tp_free(op);
+    tp->tp_free(self);
     Py_DECREF(tp);
 }
 
@@ -3779,8 +3779,8 @@ _elementtree_XMLParser___init___impl(XMLParserObject *self, PyObject *target,
 static int
 xmlparser_gc_traverse(PyObject *op, visitproc visit, void *arg)
 {
-    Py_VISIT(Py_TYPE(op));
     XMLParserObject *self = _XMLParser_CAST(op);
+    Py_VISIT(Py_TYPE(self));
     Py_VISIT(self->handle_close);
     Py_VISIT(self->handle_pi);
     Py_VISIT(self->handle_comment);

From 766a4481130b5396c12c058edd3ba352cafc8c46 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?B=C3=A9n=C3=A9dikt=20Tran?=
 <10796600+picnixz@users.noreply.github.com>
Date: Mon, 16 Dec 2024 13:29:25 +0100
Subject: [PATCH 8/8] reduce diff

---
 Modules/_elementtree.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/Modules/_elementtree.c b/Modules/_elementtree.c
index e170734bfa8291..355f322d304c2f 100644
--- a/Modules/_elementtree.c
+++ b/Modules/_elementtree.c
@@ -2511,12 +2511,11 @@ treebuilder_gc_clear(PyObject *op)
 }
 
 static void
-treebuilder_dealloc(PyObject *op)
+treebuilder_dealloc(PyObject *self)
 {
-    TreeBuilderObject *self = _TreeBuilder_CAST(op);
     PyTypeObject *tp = Py_TYPE(self);
     PyObject_GC_UnTrack(self);
-    (void)treebuilder_gc_clear(op);
+    (void)treebuilder_gc_clear(self);
     tp->tp_free(self);
     Py_DECREF(tp);
 }