The following example crashes:

class TypeVar:
    @property
    def __module__(self):
        1/0

str | TypeVar()

Output:
Fatal Python error: _Py_CheckSlotResult: Slot | of type type succeeded with an exception set
Python runtime state: initialized
Traceback (most recent call last):
  File "<stdin>", line 4, in __module__
ZeroDivisionError: division by zero
Aborted (core dumped)

The problem in Objects/unionobject.c is that is_typing_module() (and therefore is_typevar() and is_special_form()) can return not only 0 and 1, but -1 as a signal of error, but is_unionable() does not check results for error and interprets it as boolean true.

A possible simple fix is to change these lines https://github.com/python/cpython/blob/main/Objects/unionobject.c#L294-L301

to:

    return (
        is_typevar(obj) |
        is_new_type(obj) |
        is_special_form(obj) |
        PyType_Check(obj) |
        PyObject_TypeCheck(obj, &Py_GenericAliasType) |
        (int)(type == &_Py_UnionType));

However, that may slow down union a little since we lose the short-circuiting that || provides over |, and all checks have to be evaluated.

Checking each result individually and mimicking the short circuiting behavior works too, so I did that. What do you think Serhiy?

New changeset adfa1ba by Ken Jin in branch 'main':
bpo-44483: Fix crash in union object with bad __module__ (GH-26848)
adfa1ba

New changeset 7e6cad7 by Miss Islington (bot) in branch '3.10':
bpo-44483: Fix crash in union object with bad __module__ (GH-26848) (GH-26852)
7e6cad7

Yes, Checking each result individually is a right way. Not only because performance, but because calling any Python code while an error is set will cause a crash in debug build and weird bugs in release build. It is better to return as fast as you have an error.

Thank you for your PR Ken Jin.

Oh, that's a good point too. Thanks for the explanation, reviews and merge Serhiy.