Bug report

The order of operations in STORE_ATTR_WITH_HINT differs from the dictionary implementation in a way that is not safe:

It's not safe to call _PyObject_GC_MAY_BE_TRACKED(value) after the Py_XDECREF call. The dictionary may hold the only strong reference to value in ep->me_value, and that can be modified during the Py_XDECREF call.

Note that dictobject.c does the tracking before modifying the dictionary -- not after it -- and so avoids this problem.

Linked PRs

• gh-123083: Fix a potential use-after-free in STORE_ATTR_WITH_HINT #123092
• [3.13] gh-123083: Fix a potential use-after-free in ``STORE_ATTR_WITH… #123235
• [3.12] gh-123083: Fix a potential use-after-free in ``STORE_ATTR_WITH… #123237