René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Use-after-free while pickling dicts","articleBody":"Found [here](https://github.com/python/cpython/issues/90773), but this crash is unrelated, so opening a new issue.\r\n\r\nThe following could be simplified, but it crashes because PyDict_Next creates borrowed references.\r\n\r\n\r\n```python\r\nimport pickle\r\nfrom random import getrandbits\r\n\r\nclass Bad:\r\n    def __eq__(self, other):\r\n        if not ENABLED:\r\n            return False\r\n        break_things()\r\n        return getrandbits(4) == 0\r\n    def __hash__(self):\r\n        return getrandbits(1)\r\n    def __reduce__(self):\r\n        break_things()\r\n        return (Bad, (), ())\r\n    def __setstate__(self, *args):\r\n        break_things()\r\n    def __del__(self):\r\n        break_things()\r\n    def __getattr__(self):\r\n        break_things()\r\n\r\ndef break_things():\r\n    if getrandbits(6) == 0:\r\n        collection.clear()\r\n\r\nTRIALS = 10_000\r\nSIZE = 50\r\n\r\nfor i in range(TRIALS):\r\n    try:\r\n        ENABLED = False\r\n        collection = {Bad():Bad() for _ in range(SIZE)}\r\n        for bad in collection:\r\n            bad.bad = bad\r\n            bad.collection = collection\r\n        ENABLED = True\r\n        pickle.loads(pickle.dumps(collection))\r\n    except RuntimeError as e:\r\n        assert \"changed size during iteration\" in str(e)\r\n\r\nprint(\"ok\")\r\n```","author":{"url":"https://github.com/sweeneyde","@type":"Person","name":"sweeneyde"},"datePublished":"2022-05-18T18:06:28.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/92930/cpython/issues/92930"}