[3.11] gh-99886: Fix crash when freeing objects with managed dictionaries

Lib/test/test_sqlite3/test_regression.py

@@ -469,6 +469,18 @@ def test_executescript_step_through_select(self):
             con.executescript("select step(t) from t")
             self.assertEqual(steps, values)
 
+    def test_custom_cursor_object_crash_gh_99886(self):
+        # This test segfaults on GH-99886
+        class MyCursor(sqlite3.Cursor):
+            def __init__(self, *args, **kwargs):
+                super().__init__(*args, **kwargs)
+                # this can go before or after the super call; doesn't matter
+                self.some_attr = None
+
+        conn = sqlite3.connect(':memory:')
+        cur = conn.cursor(MyCursor)
+        cur.close()
+        del cur
 
 class RecursiveUseOfCursors(unittest.TestCase):
     # GH-80254: sqlite3 should not segfault for recursive use of cursors.

Misc/NEWS.d/next/Core and Builtins/2022-11-30-15-29-08.gh-issue-99886.feJkSv.rst

@@ -0,0 +1 @@
+Fix a crash when an object which does not have a dictionary frees its instance values.

Objects/dictobject.c

@@ -5581,6 +5581,7 @@ _PyObject_FreeInstanceAttributes(PyObject *self)
         Py_XDECREF((*values_ptr)->values[i]);
     }
     free_values(*values_ptr);
+    *values_ptr = NULL;
 }
 
 PyObject *