@Mark, agreed about properly defining the semantics.

For the current bug: I've narrowed it down to a corner case in how the -R tests work:

1. On each run cleanup, libregrtest will clear the type cache https://github.com/python/cpython/blob/6f84656dc188191225c8d5cdfd2a00de663988d0/Lib/test/libregrtest/refleak.py#L170

2. This calls PyType_ClearCache, which sets the global next_version_tag counter to 0 https://github.com/python/cpython/blob/cee67fa66129b5d1db5c8aa3884338f82f0da3de/Objects/typeobject.c#L292.

3. On next run, since runs and type cache is deterministic, we end up with exact same tp_version_tag for the type.

4. This repeats every run until crash.

One possible fix: we can tell sys._clear_type_cache to not reset next_version_tag to 0 (it can use another function, since PyType_ClearCache is part of public C API and shouldn't be modified).

This seems like a bug in libregrtest, the type method cache and tp_version_tag aren't at fault for this specific scenario. I'm submitting a PR soon.