python · fatelei · Dec 30, 2025 · Dec 30, 2025 · Dec 30, 2025 · Dec 30, 2025
diff --git a/Lib/test/test_frame.py b/Lib/test/test_frame.py
@@ -177,6 +177,25 @@ class C:
             self.clear_traceback_frames(exc.__traceback__)
             self.assertIs(None, wr())
 
+    @support.cpython_only
+    def test_frame_clear_during_load_name(self):
+        def get_frame():
+            try:
+                raise RuntimeError
+            except RuntimeError as e:
+                return e.__traceback__.tb_frame
+
+        frame = get_frame()
+
+        class Fuse(dict):
+            def __getitem__(self, key):
+                if key == "boom":
+                    frame.clear()
+                raise KeyError(key)
+
+        with self.assertRaises(NameError):
+            exec("boom", {}, Fuse())
+
 
 class FrameAttrsTest(unittest.TestCase):
 

diff --git a/Misc/NEWS.d/next/Library/2025-12-30-13-56-40.gh-issue-143236.IxHw2y.rst b/Misc/NEWS.d/next/Library/2025-12-30-13-56-40.gh-issue-143236.IxHw2y.rst
@@ -0,0 +1 @@
+Fix a bug in ceval where the load name has use-after-free bug.
@@ -4061,9 +4061,17 @@ _PyEval_LoadName(PyThreadState *tstate, _PyInterpreterFrame *frame, PyObject *na
                             "no locals found");
         return NULL;
     }
-    if (PyMapping_GetOptionalItem(frame->f_locals, name, &value) < 0) {
+
+    PyObject *locals = frame->f_locals;
+    Py_INCREF(locals);
+
+    if (PyMapping_GetOptionalItem(locals, name, &value) < 0) {
+        Py_DECREF(locals);
         return NULL;
     }
+
+    Py_DECREF(locals);
+
     if (value != NULL) {
         return value;
     }
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		Fix a bug in ceval where the load name has use-after-free bug.