GeezerVison

I actually tried to do something with tag etc, but I wasn't able to crash the interpreter.

String literals are interned and saved in the constants list. You need to use something having a single reference. Try 'tag'.upper().

The safe way is to increase the reference count of the deepcopy() argument before calling any code that can release the GIL.

I've actually removed this code because I thought it wasn't needed, but I'll check with an evil non-interned string tomorrow.

I'll try to add more tests later as well.

Actually, it's much more tricky than what I thought. Even with the INCREF/DECREF and the additional checks, the following still crashes, but not during deepcopy() but during de-allocation:

class Evil(ET.Element):
    def __deepcopy__(self, memo):
        root.append(ET.Element('y'))
        root.append(ET.Element('z'))
        return self

Y = Evil('y')
root = ET.Element('a')
root.extend([Evil('x'), ET.Element('t'), Y])
c = deepcopy(root)
print(list(c))
print("ok")
assert 0

So I'll need a bit more work.

#133010 (comment) should help. It is good that you already have a reproducer.

Ah, you have a different issue -- growing children, not attributes. The solution should be the same -- either ignore new items or resize the array in process.

The solution should be the same -- either ignore new items or resize the array in process.

Yes, actually I found a way to fix it in the meantime (but the same can be said)

Thanks @picnixz for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14.
🐍🍒⛏🤖

GH-133805 is a backport of this pull request to the 3.14 branch.

GH-133806 is a backport of this pull request to the 3.13 branch.