From 20c327aff8f2cfce56af44891e2f84639e4b2edd Mon Sep 17 00:00:00 2001
From: sunmy2019 <59365878+sunmy2019@users.noreply.github.com>
Date: Tue, 31 Mar 2026 15:48:02 +0800
Subject: [PATCH] gh-146615: Fix crash in __get__() for METH_METHOD descriptors
 with invalid type argument (GH-146634) (cherry picked from commit
 72d29ea363f1515115753653aeca735a1a817a7f)

Co-authored-by: sunmy2019 <59365878+sunmy2019@users.noreply.github.com>
---
 Lib/test/test_descr.py                        | 22 +++++++++++++++++++
 ...1-06-35.gh-issue-146615.fix-method-get.rst |  3 +++
 Objects/descrobject.c                         |  2 +-
 3 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-03-31-01-06-35.gh-issue-146615.fix-method-get.rst

diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
index e98dccc39c178a..b5ed28ec859823 100644
--- a/Lib/test/test_descr.py
+++ b/Lib/test/test_descr.py
@@ -1662,6 +1662,28 @@ class SubSpam(spam.spamlist): pass
             spam_cm.__get__(None, list)
         self.assertEqual(str(cm.exception), expected_errmsg)
 
+    @support.cpython_only
+    def test_method_get_meth_method_invalid_type(self):
+        # gh-146615: method_get() for METH_METHOD descriptors used to pass
+        # Py_TYPE(type)->tp_name as the %V fallback instead of the separate
+        # %s argument, causing a missing argument for %s and a crash.
+        # Verify the error message is correct when __get__() is called with a
+        # non-type as the second argument.
+        #
+        # METH_METHOD|METH_FASTCALL|METH_KEYWORDS is the only flag combination
+        # that enters the affected branch in method_get().
+        import io
+
+        obj = io.StringIO()
+        descr = io.TextIOBase.read
+
+        with self.assertRaises(TypeError) as cm:
+            descr.__get__(obj, "not_a_type")
+        self.assertEqual(
+            str(cm.exception),
+            "descriptor 'read' needs a type, not 'str', as arg 2",
+        )
+
     def test_staticmethods(self):
         # Testing static methods...
         class C(object):
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-03-31-01-06-35.gh-issue-146615.fix-method-get.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-31-01-06-35.gh-issue-146615.fix-method-get.rst
new file mode 100644
index 00000000000000..7a205f1d6dda61
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-03-31-01-06-35.gh-issue-146615.fix-method-get.rst
@@ -0,0 +1,3 @@
+Fix a crash in :meth:`~object.__get__` for :c:expr:`METH_METHOD` descriptors
+when an invalid (non-type) object is passed as the second argument.
+Patch by Steven Sun.
diff --git a/Objects/descrobject.c b/Objects/descrobject.c
index d33152bb85489e..7fe850f80ae582 100644
--- a/Objects/descrobject.c
+++ b/Objects/descrobject.c
@@ -149,7 +149,7 @@ method_get(PyObject *self, PyObject *obj, PyObject *type)
         } else {
             PyErr_Format(PyExc_TypeError,
                         "descriptor '%V' needs a type, not '%s', as arg 2",
-                        descr_name((PyDescrObject *)descr),
+                        descr_name((PyDescrObject *)descr), "?",
                         Py_TYPE(type)->tp_name);
             return NULL;
         }