INADA Naoki added the comment: It's similar to issue27945, but different.
I confirmed this issue is in 3.4 too. https://github.com/python/cpython/blob/3.4/Objects/dictobject.c#L3798 // _PyObjectDict_SetItem() if ((tp->tp_flags & Py_TPFLAGS_HEAPTYPE) && (cached = CACHED_KEYS(tp))) { ... res = PyDict_DelItem(dict, key); // <- may run arbitrary code. CACHED_KEYS(tp) can be changed and cached can be freed here. if (cached != ((PyDictObject *)dict)->ma_keys) { CACHED_KEYS(tp) = NULL; DK_DECREF(cached); // !!! } } else { res = PyDict_SetItem(dict, key, value); // Same to DelItem(). if (cached != ((PyDictObject *)dict)->ma_keys) { /* Either update tp->ht_cached_keys or delete it */ if (cached->dk_refcnt == 1) { // !!! ---------- _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue29438> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
