class IntWithDict:    def __init__(self, **kwargs):        self.kwargs = kwargs    def __index__(self):        self.kwargs.clear()        L = [2**i for i in range(10000)]        return 0x = IntWithDict(dont_inherit=float())compile("", "", "", x, **x.kwargs)The above crashes CPython due to the usage of borrowed references in _PyStack_UnpackDict(): the dict x.kwargs contains the only reference to the float() object stored in x.kwargsWhen parsing the arguments, x.__int__() is called, which clears the dict, removing the only reference to that float()

Ideally, this would be fixed together with#36904.

The idea of#36904 could be used here: define a special kind of tuple, which is like an ordinary tuple followed by a C array of PyObject* entries (all refcounted), terminated by a NULL to know where it ends. A special deallocation function would decref all entries.

New changeset77aa396bb9415428de09112ddf6b34bb843811eb by Petr Viktorin (Jeroen Demeyer) in branch 'master':bpo-36907: fix refcount bug in _PyStack_UnpackDict() (GH-13381)https://github.com/python/cpython/commit/77aa396bb9415428de09112ddf6b34bb843811eb

Jeroen, do you want to also do a backport for 3.7?

> Jeroen, do you want to also do a backport for 3.7?Don't we have a bot for that?

We do, but here the test will need to be changed:Python 3.7.3+ (heads/3.7:791e5fcbab, May 22 2019, 13:37:27) [GCC 9.1.1 20190503 (Red Hat 9.1.1-1)] on linuxType "help", "copyright", "credits" or "license" for more information.>>> class IntWithDict:...     def __init__(self, **kwargs):...         self.kwargs = kwargs...     def __index__(self):...         self.kwargs.clear()...         return 0... >>> x = IntWithDict(dont_inherit=float())>>> compile("", "", "", x, **x.kwargs)Traceback (most recent call last):  File "<stdin>", line 1, in <module>TypeError: an integer is required (got type IntWithDict)

Using __int__ instead of __index__ works. PR coming right away.

New changesetd092caf096fa48baadfc0900792206bb5aa0192d by Petr Viktorin (Jeroen Demeyer) in branch '3.7':bpo-36907: fix refcount bug in _PyStack_UnpackDict() (GH-13381) (GH-13493)https://github.com/python/cpython/commit/d092caf096fa48baadfc0900792206bb5aa0192d