Fix issue 26287: While handling FORMAT_VALUE opcode, the top of stack was being…

Fix issue 26287: While handling FORMAT_VALUE opcode, the top of stack was being corrupted if an error occurred in PyObject_Format().

Lib/test/test_fstring.py

@@ -692,6 +692,17 @@ f'{a * x()}'"""
                              r"f'{a(4]}'",
                             ])
 
+    def test_errors(self):
+        # see issue 26287
+        self.assertAllRaise(TypeError, 'non-empty',
+                            [r"f'{(lambda: 0):x}'",
+                             r"f'{(0,):x}'",
+                             ])
+        self.assertAllRaise(ValueError, 'Unknown format code',
+                            [r"f'{1000:j}'",
+                             r"f'{1000:j}'",
+                            ])
+
     def test_loop(self):
         for i in range(1000):
             self.assertEqual(f'i:{i}', 'i:' + str(i))

Python/ceval.c

@@ -3383,7 +3383,7 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
             int have_fmt_spec = (oparg & FVS_MASK) == FVS_HAVE_SPEC;
 
             fmt_spec = have_fmt_spec ? POP() : NULL;
-            value = TOP();
+            value = POP();
 
             /* See if any conversion is specified. */
             switch (which_conversion) {
@@ -3426,7 +3426,7 @@ PyEval_EvalFrameEx(PyFrameObject *f, int throwflag)
                     goto error;
             }
 
-            SET_TOP(result);
+            PUSH(result);
             DISPATCH();
         }