Treat the dictionary as owning values, not the object.

Author: ZeroIntensity

Lib/test/test_dict.py

@@ -1487,9 +1487,9 @@ def make_pairs():
                 self.assertGreaterEqual(eq_count, 1)
 
     def test_overwrite_managed_dict(self):
-        # GH-130327: Overwriting an object's managed dict incorrectly stored
-        # the new dictionary in the managed dict pointer for objects supporting
-        # inline values, leading to early clearing of the dictionary
+        # GH-130327: Overwriting an object's managed dictionary with another object's
+        # skipped traversal in favor of inline values, causing the GC to believe that
+        # the __dict__ wasn't reachable.
         import gc
 
         class Shenanigans:

Objects/dictobject.c

@@ -4577,10 +4577,8 @@ dict_traverse(PyObject *op, visitproc visit, void *arg)
 
     if (DK_IS_UNICODE(keys)) {
         if (_PyDict_HasSplitTable(mp)) {
-            if (!mp->ma_values->embedded) {
-                for (i = 0; i < n; i++) {
-                    Py_VISIT(mp->ma_values->values[i]);
-                }
+            for (i = 0; i < n; i++) {
+                Py_VISIT(mp->ma_values->values[i]);
             }
         }
         else {
@@ -7150,6 +7148,13 @@ PyObject_VisitManagedDict(PyObject *obj, visitproc visit, void *arg)
     if((tp->tp_flags & Py_TPFLAGS_MANAGED_DICT) == 0) {
         return 0;
     }
+    PyDictObject *dict = _PyObject_ManagedDictPointer(obj)->dict;
+    if (dict != NULL) {
+        // GH-130327: If there's a managed dictionary available, we should
+        // *always* traverse it, including when inline values are available.
+        Py_VISIT(dict);
+        return 0;
+    }
     if (tp->tp_flags & Py_TPFLAGS_INLINE_VALUES) {
         PyDictValues *values = _PyObject_InlineValues(obj);
         if (values->valid) {
@@ -7159,7 +7164,6 @@ PyObject_VisitManagedDict(PyObject *obj, visitproc visit, void *arg)
             return 0;
         }
     }
-    Py_VISIT(_PyObject_ManagedDictPointer(obj)->dict);
     return 0;
 }