gh-130547: Fix race between dict_dealloc and split_keys_entry_added (gh-130778)

corona10 · web-flow · commit 80e6d3ec4972 · 2025-03-04T22:50:33.000+09:00
diff --git a/Objects/dictobject.c b/Objects/dictobject.c
@@ -3254,7 +3254,7 @@ dict_dealloc(PyObject *self)
     Py_TRASHCAN_BEGIN(mp, dict_dealloc)
     if (values != NULL) {
         if (values->embedded == 0) {
-            for (i = 0, n = mp->ma_keys->dk_nentries; i < n; i++) {
+            for (i = 0, n = values->capacity; i < n; i++) {
                 Py_XDECREF(values->values[i]);
             }
             free_values(values, false);

Original file line number	Diff line number	Diff line change
`@@ -3254,7 +3254,7 @@ dict_dealloc(PyObject *self)`
`3254`	`3254`	`Py_TRASHCAN_BEGIN(mp, dict_dealloc)`
`3255`	`3255`	`if (values != NULL) {`
`3256`	`3256`	`if (values->embedded == 0) {`
`3257`		`- for (i = 0, n = mp->ma_keys->dk_nentries; i < n; i++) {`
	`3257`	`+ for (i = 0, n = values->capacity; i < n; i++) {`
`3258`	`3258`	`Py_XDECREF(values->values[i]);`
`3259`	`3259`	`}`
`3260`	`3260`	`free_values(values, false);`