diff -r 193327cabbbc Lib/test/test_descr.py --- a/Lib/test/test_descr.py Mon Nov 02 09:15:47 2015 -0800 +++ b/Lib/test/test_descr.py Tue Nov 03 18:44:50 2015 +0200 @@ -4988,6 +4988,23 @@ class PicklingTests(unittest.TestCase): objcopy2 = deepcopy(objcopy) self._assert_is_copy(obj, objcopy2) + def test_issue24097(self): + # Slot name is freed inside __getattr__ and is later used. + class S(str): # Not interned + pass + class A: + __slotnames__ = [S('spam')] + def __getattr__(self, attr): + if attr == 'spam': + A.__slotnames__[:] = [S('spam')] + return 42 + else: + raise AttributeError + + import copyreg + expected = (copyreg.__newobj__, (A,), (None, {'spam': 42}), None, None) + self.assertEqual(A().__reduce__(2), expected) # Shouldn't crash + class SharedKeyTests(unittest.TestCase): diff -r 193327cabbbc Misc/NEWS --- a/Misc/NEWS Mon Nov 02 09:15:47 2015 -0800 +++ b/Misc/NEWS Tue Nov 03 18:44:50 2015 +0200 @@ -10,6 +10,9 @@ Release date: tba Core and Builtins ----------------- +- Issue #24097: Fixed crash in object.__reduce__() if slot name is freed inside + __getattr__. + - Issue #24402: Fix input() to prompt to the redirected stdout when sys.stdout.fileno() fails. diff -r 193327cabbbc Objects/typeobject.c --- a/Objects/typeobject.c Mon Nov 02 09:15:47 2015 -0800 +++ b/Objects/typeobject.c Tue Nov 03 18:44:50 2015 +0200 @@ -3768,8 +3768,10 @@ Py_LOCAL(PyObject *) PyObject *name, *value; name = PyList_GET_ITEM(slotnames, i); + Py_INCREF(name); value = PyObject_GetAttr(obj, name); if (value == NULL) { + Py_DECREF(name); if (!PyErr_ExceptionMatches(PyExc_AttributeError)) { goto error; } @@ -3778,6 +3780,7 @@ Py_LOCAL(PyObject *) } else { int err = PyDict_SetItem(slots, name, value); + Py_DECREF(name); Py_DECREF(value); if (err) { goto error;