set tp_new from the class in the hierarchy that actually owns the descriptor (closes #25731)

Debugging by Eryk Sun.

Lib/test/test_descr.py

@@ -4564,6 +4564,14 @@ order (MRO) for bases """
         self.assertRegex(repr(method),
             r"<bound method qualname of <object object at .*>>")
 
+    def test_deleting_new_in_subclasses(self):
+        class X:
+            def __init__(self, a):
+                pass
+        X.__new__ = None
+        del X.__new__
+        X(1) # should work
+
 
 class DictProxyTests(unittest.TestCase):
     def setUp(self):

Misc/NEWS

@@ -10,6 +10,8 @@ Release date: tba
 Core and Builtins
 -----------------
 
+- Issue #25731: Fix set and deleting __new__ on a class.
+
 - Issue #22995: [UPDATE] Comment out the one of the pickleability tests in
   _PyObject_GetState() due to regressions observed in Cython-based projects.
 

Objects/typeobject.c

@@ -6777,7 +6777,7 @@ update_one_slot(PyTypeObject *type, slotdef *p)
                sanity checks and constructing a new argument
                list.  Cut all that nonsense short -- this speeds
                up instance creation tremendously. */
-            specific = (void *)type->tp_new;
+            specific = (void *)((PyTypeObject *)PyCFunction_GET_SELF(descr))->tp_new;
             /* XXX I'm not 100% sure that there isn't a hole
                in this reasoning that requires additional
                sanity checks.  I'll buy the first person to