diff -r 5988caffbff9 Objects/typeobject.c
--- a/Objects/typeobject.c	Tue Jan 03 11:17:53 2017 +0200
+++ b/Objects/typeobject.c	Tue Jan 03 15:29:38 2017 +0100
@@ -2608,6 +2608,7 @@ type_getattro(PyTypeObject *type, PyObje
     PyTypeObject *metatype = Py_TYPE(type);
     PyObject *meta_attribute, *attribute;
     descrgetfunc meta_get;
+    PyObject* res;
 
     if (!PyString_Check(name)) {
         PyErr_Format(PyExc_TypeError,
@@ -2629,6 +2630,7 @@ type_getattro(PyTypeObject *type, PyObje
     meta_attribute = _PyType_Lookup(metatype, name);
 
     if (meta_attribute != NULL) {
+        Py_INCREF(meta_attribute);
         meta_get = Py_TYPE(meta_attribute)->tp_descr_get;
 
         if (meta_get != NULL && PyDescr_IsData(meta_attribute)) {
@@ -2636,10 +2638,11 @@ type_getattro(PyTypeObject *type, PyObje
              * writes. Assume the attribute is not overridden in
              * type's tp_dict (and bases): call the descriptor now.
              */
-            return meta_get(meta_attribute, (PyObject *)type,
+            res = meta_get(meta_attribute, (PyObject *)type,
                             (PyObject *)metatype);
+            Py_DECREF(meta_attribute);
+            return res;
         }
-        Py_INCREF(meta_attribute);
     }
 
     /* No data descriptor found on metatype. Look in tp_dict of this
@@ -2647,6 +2650,7 @@ type_getattro(PyTypeObject *type, PyObje
     attribute = _PyType_Lookup(type, name);
     if (attribute != NULL) {
         /* Implement descriptor functionality, if any */
+        Py_INCREF(attribute);
         descrgetfunc local_get = Py_TYPE(attribute)->tp_descr_get;
 
         Py_XDECREF(meta_attribute);
@@ -2654,11 +2658,12 @@ type_getattro(PyTypeObject *type, PyObje
         if (local_get != NULL) {
             /* NULL 2nd argument indicates the descriptor was
              * found on the target object itself (or a base)  */
-            return local_get(attribute, (PyObject *)NULL,
+            res = local_get(attribute, (PyObject *)NULL,
                              (PyObject *)type);
+            Py_DECREF(attribute);
+            return res;
         }
 
-        Py_INCREF(attribute);
         return attribute;
     }