gh-159739: Keep SQLite list parameters alive while binding (#160192)

When a SQL parameter sequence is an exact list, sqlite3 retrieved an element as a borrowed reference before taking ownership. On free-threaded builds another thread can replace it in between, so binding can use a freed object and crash. Fetch a strong reference atomically. Backport to 3.15 and 3.14.

Author: jelle-openai

Misc/NEWS.d/next/Library/2026-10-21-21-26-10.gh-issue-159739.JIqZRY.rst

@@ -0,0 +1 @@
+Fix a possible crash when a list of :mod:`sqlite3` parameters is modified concurrently on a free-threaded build.

Modules/_sqlite/cursor.c

@@ -701,8 +701,7 @@ bind_parameters(pysqlite_state *state, pysqlite_Statement *self,
                 PyObject *item = PyTuple_GET_ITEM(parameters, i);
                 current_param = Py_NewRef(item);
             } else if (PyList_CheckExact(parameters)) {
-                PyObject *item = PyList_GetItem(parameters, i);
-                current_param = Py_XNewRef(item);
+                current_param = PyList_GetItemRef(parameters, i);
             } else {
                 current_param = PySequence_GetItem(parameters, i);
             }