[3.14] gh-159739: Keep descriptor metadata dictionaries alive during insertion (GH-160193) (#160383)

The classmethod and staticmethod metadata setters dropped their reference to the descriptor dictionary before inserting the new value. A key comparison or value finalizer can replace the dictionary during insertion, leaving the operation using released memory. Keep the dictionary alive until insertion finishes. Backport to 3.15 and 3.14.
(cherry picked from commit a076a55)

Co-authored-by: Jelle Zijlstra <jelle@openai.com>

Author: miss-islington

Misc/NEWS.d/next/Core_and_Builtins/2026-10-21-21-26-10.gh-issue-159739.CbTE4N.rst

@@ -0,0 +1 @@
+Fix a possible crash when assigning metadata to :class:`classmethod` or :class:`staticmethod` objects.

Objects/funcobject.c

@@ -1480,8 +1480,9 @@ descriptor_set_wrapped_attribute(PyObject *oobj, PyObject *name, PyObject *value
         return 0;
     }
     else {
+        int result = PyDict_SetItem(dict, name, value);
         Py_DECREF(dict);
-        return PyDict_SetItem(dict, name, value);
+        return result;
     }
 }