Fixed #25693 -- Prevented data loss with Prefetch and ManyToManyField.

Thanks to Jamie Matthews for finding and explaining the bug.

django/db/models/query.py

@@ -1575,6 +1575,17 @@ def prefetch_one_level(instances, prefetcher, lookup, level):
         instance_attr_val = instance_attr(obj)
         vals = rel_obj_cache.get(instance_attr_val, [])
         to_attr, as_attr = lookup.get_current_to_attr(level)
+
+        # Check we are not shadowing a field on obj.
+        if as_attr:
+            try:
+                field = obj._meta.get_field(to_attr)
+            except exceptions.FieldDoesNotExist:
+                pass
+            else:
+                msg = 'to_attr={} conflicts with a field on the {} model.'
+                raise ValueError(msg.format(to_attr, field.model.__name__))
+
         if single:
             val = vals[0] if vals else None
             to_attr = to_attr if as_attr else cache_name

docs/releases/1.7.11.txt

+===========================
+Django 1.7.11 release notes
+===========================
+
+*Under development*
+
+Django 1.7.11 fixes a data loss bug in 1.7.10.
+
+Bugfixes
+========
+
+* Fixed a data loss possibility with :class:`~django.db.models.Prefetch` if
+  ``to_attr`` is set to a ``ManyToManyField`` (:ticket:`25693`).

docs/releases/1.8.7.txt

@@ -21,3 +21,6 @@ Bugfixes
 
 * Fixed a regression in 1.8.6 that caused an application with South migrations
   in the ``migrations`` directory to fail (:ticket:`25618`).
+
+* Fixed a data loss possibility with :class:`~django.db.models.Prefetch` if
+  ``to_attr`` is set to a ``ManyToManyField`` (:ticket:`25693`).

docs/releases/index.txt

@@ -53,6 +53,7 @@ versions of the documentation contain the release notes for any later releases.
 .. toctree::
    :maxdepth: 1
 
+   1.7.11
    1.7.10
    1.7.9
    1.7.8

tests/prefetch_related/tests.py

@@ -223,6 +223,17 @@ class PrefetchRelatedTests(TestCase):
         self.assertIn('prefetch_related', str(cm.exception))
         self.assertIn("name", str(cm.exception))
 
+    def test_m2m_shadow(self):
+        msg = 'to_attr=books conflicts with a field on the Author model.'
+        poems = Book.objects.filter(title='Poems')
+        with self.assertRaisesMessage(ValueError, msg):
+            list(Author.objects.prefetch_related(
+                Prefetch('books', queryset=poems, to_attr='books'),
+            ))
+        # Without the ValueError, a book was deleted due to the implicit
+        # save of reverse relation assignment.
+        self.assertEqual(self.author1.books.count(), 2)
+
 
 class CustomPrefetchTests(TestCase):
     @classmethod