[3.14] gh-158032: Keep the element tag alive during Element.iter comparison (GH-158044)

Lib/test/test_xml_etree_c.py

@@ -161,6 +161,35 @@ def test_xmlpullparser_leaks(self):
         del parser
         support.gc_collect()
 
+    def test_iter_tag_reentrant_compare(self):
+        destroyed = []
+        compared = []
+
+        class Tag:
+            def __del__(self):
+                destroyed.append(True)
+
+            def __eq__(self, other):
+                child.tag = "replaced"
+                return NotImplemented
+
+            __hash__ = object.__hash__
+
+        class Sought:
+            def __eq__(self, other):
+                if isinstance(other, Tag):
+                    compared.append(not destroyed)
+                return NotImplemented
+
+            __hash__ = object.__hash__
+
+        root = cET.Element("root")
+        child = cET.SubElement(root, "x")
+        child.tag = Tag()
+        self.assertEqual(list(root.iter(Sought())), [])
+        self.assertEqual(compared, [True])
+        self.assertEqual(child.tag, "replaced")
+
     def test_dict_disappearing_during_get_item(self):
         # test fix for seg fault reported in issue 27946
         class X:

Misc/NEWS.d/next/Library/2026-09-23-21-15-00.gh-issue-158032.k4nT9p.rst

@@ -0,0 +1,2 @@
+Fix a crash in :meth:`xml.etree.ElementTree.Element.iter` when a tag's
+equality comparison replaces that tag.

Modules/_elementtree.c

@@ -2300,7 +2300,9 @@ elementiter_next(PyObject *op)
         if (it->sought_tag == Py_None)
             return (PyObject *)elem;
 
-        rc = PyObject_RichCompareBool(elem->tag, it->sought_tag, Py_EQ);
+        PyObject *tag = Py_NewRef(elem->tag);
+        rc = PyObject_RichCompareBool(tag, it->sought_tag, Py_EQ);
+        Py_DECREF(tag);
         if (rc > 0)
             return (PyObject *)elem;