gh-159739: Keep descriptor metadata dictionaries alive during insertion

The classmethod and staticmethod metadata setters dropped their reference to the descriptor dictionary before inserting the new value. A key comparison or value finalizer can replace the dictionary during insertion, leaving the operation using released memory. Keep the dictionary alive until insertion finishes. Backport to 3.15 and 3.14.

Author: jelle-openai

Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst

@@ -0,0 +1 @@
+Fix a possible crash when assigning metadata to :class:`classmethod` or :class:`staticmethod` objects.

Objects/funcobject.c

@@ -1460,8 +1460,9 @@ descriptor_set_wrapped_attribute(PyObject *oobj, PyObject *name, PyObject *value
         return 0;
     }
     else {
+        int result = PyDict_SetItem(dict, name, value);
         Py_DECREF(dict);
-        return PyDict_SetItem(dict, name, value);
+        return result;
     }
 }