Crash in PyDict_AsFrozenDictAndClear() with obj.__dict__ #161767

Crash report

The frozendict C API crashes when given an instance __dict__ that still has inline values:

import _testcapi
class A: pass
a = A(); a.x = 1; a.y = 2
f = _testcapi.dict_as_frozendict_and_clear(a.__dict__)
a.x = 'MUTATED'
print(f)

Debug build fails an assertion in Objects/dictobject.c. The keys are moved to the frozendict but the values stay in the object's inline values, so both end up sharing them (use-after-free after del a).

CPython versions tested on:

CPython main branch

Operating systems tested on:

Windows

Output from running 'python -VV' on the command line:

Python 3.16.0a1+dev (heads/main:9d05428, Nov 10 2026, 19:53:18) [MSC v.1951 64 bit (AMD64)]

Linked PRs

• gh-161767: Fix crash in PyDict_AsFrozenDictAndClear() with inline values #161768