Missing argument validation with native subclassing

[jepler]

Port, board and/or hardware

unix port, coverage build, x86_64 linux

MicroPython version

MicroPython v1.26.0-preview.524.g255d74b5a8 on 2025-08-06; linux [GCC 12.2.0] version

Reproduction

Run the following Python code:

import framebuf
class FB(framebuffer.FrameBuffer): pass
FB.pixel(0,0,0)

Expected behaviour

A TypeError or other appropriate error is raised

Observed behaviour

A segmentation fault.

MicroPython v1.26.0-preview.524.g255d74b5a8 on 2025-08-06; linux [GCC 12.2.0] version
Use Ctrl-D to exit, Ctrl-E for paste mode
>>> import framebuf
>>> class FB(framebuf.FrameBuffer): pass
... 
>>> FB.pixel(0,0,0)

Program received signal SIGSEGV, Segmentation fault.
0x0000555555634845 in framebuf_pixel (n_args=3, args_in=0x7fffffffda30)
    at ../../extmod/modframebuf.c:376
376	    if (0 <= x && x < self->width && 0 <= y && y < self->height) {
(gdb) where
#0  0x0000555555634845 in framebuf_pixel (n_args=3, args_in=0x7fffffffda30)
    at ../../extmod/modframebuf.c:376
#1  0x00005555555fdf8d in fun_builtin_var_call (
    self_in=0x555555711250 <framebuf_pixel_obj>, n_args=3, n_kw=0, args=0x7fffffffda30)
    at ../../py/objfun.c:123

Additional Information

This was found by fuzzing.

Incidentally, when there is NOT a subclass involved, the error is detected:

>>> framebuf.FrameBuffer.pixel(0,0,0)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: argument should be a 'FrameBuffer' not a 'int'

Code of Conduct

Yes, I agree

[jepler]

This applies to other types which can be subclassed, such as

class T(tuple): pass
T.count(0,0)

(this new case was also minimized from a case that came from fuzzing)

The problem appears to lie in mp_convert_member_lookup which has the following special case:

Built-in functions on user types always behave like a staticmethod.

This special case is required for tests/basics/class_bind_self.py, where an object property is created like so:

class C:
    f6 = abs # builtin function

It's unclear how to bring extra information down into mp_convert_member_lookup which would differentiate between the T.count and C.f6 cases. However, it seems like it would have something to do with tracking whether the built-in function came from the Python subclass or a native class.

Request to add the py-core label to this PR.