gh-152107: Guard GC untrack on untracked dict iterator under OOM

dictiter_new() allocates di->di_result via _PyTuple_FromPairSteal() for
item iterators before calling _PyObject_GC_TRACK(di). When that
allocation fails (OOM), the error path runs Py_DECREF(di) on the
still-untracked iterator, and dictiter_dealloc() unconditionally called
_PyObject_GC_UNTRACK(di) -- which asserts the object is GC-tracked.

This aborts on a debug build (Objects/dictobject.c) and corrupts the GC
list (later segfault) on a release build. Guard the untrack with
_PyObject_GC_IS_TRACKED() so the never-tracked iterator is freed cleanly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: zangjiucheng

Lib/test/test_dict.py

@@ -9,7 +9,7 @@
 import unittest
 import weakref
 from test import support
-from test.support import import_helper
+from test.support import import_helper, script_helper
 
 
 class CustomHash:
@@ -116,6 +116,30 @@ def test_items(self):
         self.assertRaises(TypeError, d.items, None)
         self.assertEqual(repr(dict(a=1).items()), "dict_items([('a', 1)])")
 
+    @support.cpython_only
+    def test_item_iterator_no_memory(self):
+        # gh-152107: dictiter_new() for a dict item-iterator allocates
+        # di_result via _PyTuple_FromPairSteal() before _PyObject_GC_TRACK().
+        # When that allocation fails under OOM the error path decref'd the
+        # still-untracked iterator, and dictiter_dealloc() unconditionally
+        # untracked it -- asserting on a debug build and corrupting the GC
+        # list (later segfault) on a release build.  Make sure it doesn't crash.
+        import_helper.import_module("_testcapi")
+        # _strptime() builds dict item-iterators while the size-2 tuple
+        # freelist is drained, so _PyTuple_FromPairSteal() in dictiter_new()
+        # actually allocates and can fail under the set_nomemory() sweep.
+        code = """if 1:
+            import _strptime
+            from _testcapi import set_nomemory
+            for start in range(60):
+                set_nomemory(start)
+                try:
+                    _strptime._strptime("", "")
+                except BaseException:
+                    pass
+        """
+        script_helper.assert_python_ok("-c", code)
+
     def test_views_mapping(self):
         mappingproxy = type(type.__dict__)
         class Dict(dict):

Misc/NEWS.d/next/Core_and_Builtins/2026-06-24-14-05-00.gh-issue-152107.K3jX9p.rst

@@ -0,0 +1,3 @@
+Fix a crash when creating a :class:`dict` item iterator (for example
+``iter(d.items())`` or ``reversed(d.items())``) under a memory-allocation
+failure.  Patch by Jiucheng Zang.

Objects/dictobject.c

@@ -5539,8 +5539,13 @@ static void
 dictiter_dealloc(PyObject *self)
 {
     dictiterobject *di = (dictiterobject *)self;
-    /* bpo-31095: UnTrack is needed before calling any callbacks */
-    _PyObject_GC_UNTRACK(di);
+    /* bpo-31095: UnTrack is needed before calling any callbacks.
+       The iterator may not be GC-tracked yet if dictiter_new() failed to
+       allocate di_result and decref'd the partially built iterator before
+       calling _PyObject_GC_TRACK(); guard against untracking it twice. */
+    if (_PyObject_GC_IS_TRACKED(di)) {
+        _PyObject_GC_UNTRACK(di);
+    }
     Py_XDECREF(di->di_dict);
     Py_XDECREF(di->di_result);
     PyObject_GC_Del(di);