The problem of PyObject_GC_UnTrack() is just the most visible effect of the trashcan mecanism: tp_dealloc can be called twice, and this is *not* expected by the tp_dealloc API.

Putting trashcan mecanism outside tp_dealloc can allow to make sure that tp_dealloc is called exactly once. _Py_Dealloc() sounds like a good candidate, but I didn't check if it's the only way to call tp_dealloc. Are there other places where tp_dealloc is called *directly*?

Using military grade regex, I found the following functions calling tp_dealloc:

grep 'dealloc[) ]*([a-zA-Z]\+)' */*.c

* _Py_Dealloc() obviously
* _PyTrash_thread_destroy_chain()
* subtype_dealloc()
* Modules/_testcapimodule.c: check_pyobject_freed_is_freed() <= unit test, it can be ignored

So if we move the trashcan usage inside functions, 3 functions must be modified:

* _Py_Dealloc()
* _PyTrash_thread_destroy_chain()
* subtype_dealloc()