Fix: del obj[key] on a reflected indexer crashed the process

CPython calls mp_ass_subscript with a null value for del, which mp_ass_subscript_impl forwarded into PyTuple_SetItem and threw across the native boundary. Handle deletion first: IDictionary<K,V>.Remove / IList<T>.RemoveAt through the binder (KeyError on a missing dictionary key), TypeError for every other type and for arrays.

Author: jhonabreul

src/embed_tests/TestIndexerDelete.cs

@@ -0,0 +1,101 @@
+using System.Collections.Concurrent;
+using System.Collections.Generic;
+
+using NUnit.Framework;
+
+using Python.Runtime;
+
+namespace Python.EmbeddingTest
+{
+    /// <summary>
+    /// `del ob[key]` reaches mp_ass_subscript with a null value. It must raise a catchable Python
+    /// exception (or delete, for IDictionary/IList types) instead of aborting the process.
+    /// </summary>
+    [TestFixture]
+    public class TestIndexerDelete
+    {
+        [OneTimeSetUp]
+        public void SetUp()
+        {
+            PythonEngine.Initialize();
+        }
+
+        [OneTimeTearDown]
+        public void Dispose()
+        {
+            PythonEngine.Shutdown();
+        }
+
+        public class SettableIndexer
+        {
+            private readonly Dictionary<int, string> _items = new();
+
+            public string this[int key]
+            {
+                get => _items[key];
+                set => _items[key] = value;
+            }
+
+            public string Marker => "alive";
+        }
+
+        [Test]
+        public void DelOnSettableIndexerRaisesTypeError()
+        {
+            using (Py.GIL())
+            {
+                using var scope = Py.CreateScope();
+                scope.Set("ob", new SettableIndexer().ToPython());
+                scope.Exec(@"
+ob[1] = 'one'
+raised = None
+try:
+    del ob[1]
+except TypeError as e:
+    raised = e
+");
+                using var raised = scope.Get("raised");
+                Assert.IsFalse(raised.IsNone(), "del must raise TypeError");
+                Assert.AreEqual("alive", scope.Eval("ob.Marker").As<string>());
+                Assert.AreEqual("one", scope.Eval("ob[1]").As<string>());
+            }
+        }
+
+        [Test]
+        public void DelOnConcurrentDictionaryRemovesKey()
+        {
+            using (Py.GIL())
+            {
+                using var scope = Py.CreateScope();
+                var dict = new ConcurrentDictionary<string, string>();
+                dict["MyKey"] = "MyValue";
+                scope.Set("d", dict.ToPython());
+
+                scope.Exec("del d['MyKey']");
+
+                Assert.IsFalse(dict.ContainsKey("MyKey"));
+                Assert.AreEqual(0, scope.Eval("d.Count").As<int>());
+            }
+        }
+
+        [Test]
+        public void DelOnDictionaryMissingKeyRaisesKeyError()
+        {
+            using (Py.GIL())
+            {
+                using var scope = Py.CreateScope();
+                scope.Set("d", new Dictionary<string, int> { ["a"] = 1 }.ToPython());
+                scope.Exec(@"
+raised = None
+try:
+    del d['missing']
+except KeyError as e:
+    raised = e
+");
+                using var raised = scope.Get("raised");
+                Assert.IsFalse(raised.IsNone(), "del of a missing key must raise KeyError");
+                Assert.AreEqual(1, scope.Eval("d.Count").As<int>());
+            }
+        }
+    }
+}

src/runtime/ClassManager.cs

@@ -681,6 +681,8 @@ void AddMember(string name, string snakeCasedName, bool isStaticReadonlyCallable
                 }
             }
 
+            ci.indexer?.ResolveDeleter(type);
+
             return ci;
         }
 

src/runtime/Types/ArrayObject.cs

@@ -245,6 +245,13 @@ public static NewReference mp_subscript(BorrowedReference ob, BorrowedReference
         /// </summary>
         public static int mp_ass_subscript(BorrowedReference ob, BorrowedReference idx, BorrowedReference v)
         {
+            // `del arr[i]` arrives here with a null value; arrays are fixed-size, so refuse it up front.
+            if (v.IsNull)
+            {
+                Exceptions.RaiseTypeError("array does not support item deletion");
+                return -1;
+            }
+
             var obj = (CLRObject)GetManagedObject(ob)!;
             var items = (Array)obj.inst;
             Type itemType = obj.inst.GetType().GetElementType();

src/runtime/Types/ClassBase.cs

@@ -507,6 +507,13 @@ static int mp_ass_subscript_impl(BorrowedReference ob, BorrowedReference idx, Bo
             BorrowedReference tp = Runtime.PyObject_TYPE(ob);
             var cls = (ClassBase)GetManagedObject(tp)!;
 
+            // CPython routes `del ob[key]` through this same slot with a null value. None of the
+            // assignment code below can take a null, so deletion must be handled before anything else.
+            if (v.IsNull)
+            {
+                return DeleteItemImpl(cls, ob, idx);
+            }
+
             if (cls.indexer == null || !cls.indexer.CanSet)
             {
                 Exceptions.SetError(Exceptions.TypeError, "object doesn't support item assignment");
@@ -560,6 +567,44 @@ static int mp_ass_subscript_impl(BorrowedReference ob, BorrowedReference idx, Bo
             return 0;
         }
 
+        /// <summary>
+        /// Implements __delitem__ (del ob[key]) for reflected classes: IDictionary&lt;K,V&gt;.Remove or
+        /// IList&lt;T&gt;.RemoveAt through the binder, TypeError for everything else.
+        /// </summary>
+        static int DeleteItemImpl(ClassBase cls, BorrowedReference ob, BorrowedReference idx)
+        {
+            if (cls.indexer == null || !cls.indexer.CanDelete)
+            {
+                Exceptions.SetError(Exceptions.TypeError, "object doesn't support item deletion");
+                return -1;
+            }
+
+            if (Runtime.PyTuple_Check(idx))
+            {
+                Exceptions.SetError(Exceptions.TypeError, "object doesn't support multi-index item deletion");
+                return -1;
+            }
+
+            using var args = Runtime.PyTuple_New(1);
+            Runtime.PyTuple_SetItem(args.Borrow(), 0, idx);
+
+            // The binder converts the key and turns a managed exception into a Python error.
+            using var result = cls.indexer.DeleteItem(ob, args.Borrow());
+            if (result.IsNull() || Exceptions.ErrorOccurred())
+            {
+                return -1;
+            }
+
+            // IDictionary<K,V>.Remove reports a missing key by returning false; match dict semantics.
+            if (result.Borrow() == Runtime.PyFalse)
+            {
+                Exceptions.SetError(Exceptions.KeyError, idx);
+                return -1;
+            }
+
+            return 0;
+        }
+
         static NewReference tp_call_impl(BorrowedReference ob, BorrowedReference args, BorrowedReference kw)
         {
             BorrowedReference tp = Runtime.PyObject_TYPE(ob);

src/runtime/Types/Indexer.cs

@@ -1,4 +1,6 @@
 using System;
+using System.Collections.Generic;
+using System.Linq;
 using System.Reflection;
 
 namespace Python.Runtime
@@ -11,11 +13,13 @@ internal class Indexer
     {
         public MethodBinder GetterBinder;
         public MethodBinder SetterBinder;
+        public MethodBinder DeleterBinder;
 
         public Indexer()
         {
             GetterBinder = new MethodBinder();
             SetterBinder = new MethodBinder();
+            DeleterBinder = new MethodBinder();
         }
 
 
@@ -29,6 +33,11 @@ public bool CanSet
             get { return SetterBinder.Count > 0; }
         }
 
+        public bool CanDelete
+        {
+            get { return DeleterBinder?.Count > 0; }
+        }
+
 
         public void AddProperty(PropertyInfo pi)
         {
@@ -55,6 +64,54 @@ internal void SetItem(BorrowedReference inst, BorrowedReference args)
             SetterBinder.Invoke(inst, args, null);
         }
 
+        /// <summary>
+        /// Resolves the method behind <c>del ob[key]</c>: IDictionary&lt;K,V&gt;.Remove(K), else
+        /// IList&lt;T&gt;.RemoveAt(int). Types with neither don't support item deletion.
+        /// </summary>
+        internal void ResolveDeleter(Type type)
+        {
+            // Bind the interface method itself, not a member looked up by name: explicit implementations
+            // (e.g. ConcurrentDictionary.Remove, which only exposes TryRemove publicly) are reached this way.
+            var interfaces = type.GetInterfaces().AsEnumerable();
+            if (type.IsInterface)
+            {
+                interfaces = interfaces.Prepend(type);
+            }
+
+            foreach (var iface in interfaces)
+            {
+                if (iface.IsConstructedGenericType && iface.GetGenericTypeDefinition() == typeof(IDictionary<,>))
+                {
+                    var remove = iface.GetMethod(nameof(IDictionary<int, int>.Remove), new[] { iface.GetGenericArguments()[0] });
+                    if (remove != null)
+                    {
+                        DeleterBinder.AddMethod(remove, true);
+                    }
+                }
+            }
+            if (CanDelete)
+            {
+                return;
+            }
+
+            foreach (var iface in interfaces)
+            {
+                if (iface.IsConstructedGenericType && iface.GetGenericTypeDefinition() == typeof(IList<>))
+                {
+                    var removeAt = iface.GetMethod(nameof(IList<int>.RemoveAt), new[] { typeof(int) });
+                    if (removeAt != null)
+                    {
+                        DeleterBinder.AddMethod(removeAt, true);
+                    }
+                }
+            }
+        }
+
+        internal NewReference DeleteItem(BorrowedReference inst, BorrowedReference args)
+        {
+            return DeleterBinder.Invoke(inst, args, null);
+        }
+
         internal bool NeedsDefaultArgs(BorrowedReference args)
         {
             var pynargs = Runtime.PyTuple_Size(args);

src/testing/indexertest.cs

@@ -1,4 +1,6 @@
+using System;
 using System.Collections;
+using System.Collections.Generic;
 
 namespace Python.Test
 {
@@ -412,6 +414,38 @@ public MultiDefaultKeyIndexerTest() : base()
         }
     }
 
+    /// <summary>
+    /// IDictionary whose Remove throws: `del ob[key]` must surface it as a catchable Python error.
+    /// </summary>
+    public class ThrowingRemoveDictionary : IDictionary<string, string>
+    {
+        private readonly Dictionary<string, string> _items = new Dictionary<string, string>();
+
+        public string Marker => "alive";
+
+        public string this[string key]
+        {
+            get { return _items[key]; }
+            set { _items[key] = value; }
+        }
+
+        public ICollection<string> Keys => _items.Keys;
+        public ICollection<string> Values => _items.Values;
+        public int Count => _items.Count;
+        public bool IsReadOnly => false;
+        public void Add(string key, string value) => _items.Add(key, value);
+        public void Add(KeyValuePair<string, string> item) => _items.Add(item.Key, item.Value);
+        public void Clear() => _items.Clear();
+        public bool Contains(KeyValuePair<string, string> item) => _items.ContainsKey(item.Key);
+        public bool ContainsKey(string key) => _items.ContainsKey(key);
+        public void CopyTo(KeyValuePair<string, string>[] array, int arrayIndex) { }
+        public IEnumerator<KeyValuePair<string, string>> GetEnumerator() => _items.GetEnumerator();
+        IEnumerator IEnumerable.GetEnumerator() => _items.GetEnumerator();
+        public bool Remove(string key) => throw new InvalidOperationException("remove failed");
+        public bool Remove(KeyValuePair<string, string> item) => throw new InvalidOperationException("remove failed");
+        public bool TryGetValue(string key, out string value) => _items.TryGetValue(key, out value);
+    }
+
     public class PublicInheritedIndexerTest : PublicIndexerTest { }
 
     public class ProtectedInheritedIndexerTest : ProtectedIndexerTest { }