2
There is a way to put keys of any type in a type's dictionary.
3
I think this allows various kinds of crashes, but so far I have only
4
found a convoluted attack of _PyType_Lookup(), which uses the mro of the
5
type without holding a strong reference to it. Probably works with
6
super.__getattribute__() too, which uses the same kind of code.
13
def __eq__(self, other):
14
# the following line decrefs the previous X.__mro__
15
X.__bases__ = (Base2,)
16
# trash all tuples of length 3, to make sure that the items of
17
# the previous X.__mro__ are really garbage
20
z.append((i, None, None))
30
# you can't add a non-string key to X.__dict__, but it can be
31
# there from the beginning :-)
32
X = type('X', (Base,), {MyKey(): 5})
35
# I get a segfault, or a slightly wrong assertion error in a debug build.