First of all, I guess this is a somewhat obscure error that is unlikely to occur in a usual context, nevertheless IMO worth reporting. We observed this when unit-testing custom exception reporting mechanism, raising different exceptions in different contexts and then analyzing whether they are processed correctly.

This is a somewhat dull example I managed to extract from our tests:


from pathlib import Path
from unittest.mock import patch


class TestException(MemoryError):
    pass


class report_ctx:
    def __enter__(self):
        return self
    def __exit__(self, exc_type, exc_value, tb):
        report(exc_value)


class raises:
    def __init__(self, ex):
        self.ex = ex
    def __enter__(self):
        return self
    def __exit__(self, exc_type, exc_value, tb):
        return issubclass(exc_type, self.ex)


def report(ex):
    pass


def error():
    raise MemoryError


modname = Path(__file__).stem

for _ in range(10):
    with patch(f"{modname}.report"):
        with raises(MemoryError), report_ctx():
            raise MemoryError

        with raises(TestException):
            raise TestException

        with raises(MemoryError):
            error()

that yields:

Fatal Python error: Segmentation fault

Current thread 0x00007fcf0833b740 (most recent call first):
  File "/home/oleg.hoefling/projects/private/python-memoryerror-segfault/main.py", line 38 in <module>
  File "<frozen importlib._bootstrap>", line 228 in _call_with_frames_removed
  File "<frozen importlib._bootstrap_external>", line 790 in exec_module
  File "<frozen importlib._bootstrap>", line 680 in _load_unlocked
  File "<frozen importlib._bootstrap>", line 986 in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 1007 in _find_and_load
  File "/usr/lib64/python3.9/unittest/mock.py", line 1236 in _importer
  File "/usr/lib64/python3.9/unittest/mock.py", line 1564 in <lambda>
  File "/usr/lib64/python3.9/unittest/mock.py", line 1389 in __enter__
  File "/home/oleg.hoefling/projects/private/python-memoryerror-segfault/main.py", line 36 in <module>

If this is of any help, I've set up an example repository containing the snippet: https://github.com/hoefling/bpo-issue-41654

Here are the results of running the snippet in Travis with Python 3.{5-10} and Pypy 3.6: https://travis-ci.com/github/hoefling/bpo-issue-41654

Aha, interesting bug report. I attached a simplified reproducer.

Output with a Python built in debug mode:
---
Objects/frameobject.c:590: _Py_NegativeRefcount: Assertion failed: object has negative ref count
<object at 0x25e8570 is freed>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized

Current thread 0x00007efd7a2d0740 (most recent call first):
  File "/home/vstinner/bug.py", line 29 in <module>
Abandon (core dumped)
---

Hm, Looks like we need check the double free risk of `Py_DECREF()`.

The problem is that the deallocator of MemoryError class is not taking into account subclasses for the freelist management, but the allocator (tp_new) is.

New changeset 9b648a95ccb4c3b14f1e87158f5c9f5dbb2f62c0 by Pablo Galindo in branch 'master':
bpo-41654: Fix deallocator of MemoryError to account for subclasses (GH-22020)
https://github.com/python/cpython/commit/9b648a95ccb4c3b14f1e87158f5c9f5dbb2f62c0

New changeset d14775ddbb067bcfa6eca516d3cbe968a8c1334e by Pablo Galindo in branch '3.9':
[3.9] bpo-41654: Fix deallocator of MemoryError to account for subclasses (GH-22020) (GH-22045)
https://github.com/python/cpython/commit/d14775ddbb067bcfa6eca516d3cbe968a8c1334e

New changeset 77f4000ae0d43a2685face80e7f14d4aba053973 by Pablo Galindo in branch '3.8':
[3.8] [3.9] bpo-41654: Fix deallocator of MemoryError to account for subclasses (GH-22020) (GH-22046)
https://github.com/python/cpython/commit/77f4000ae0d43a2685face80e7f14d4aba053973

Thanks for the fix Pablo! Thanks for the funny bug report Oleg Hoefling! I didn't expect that anyone would ever subclass MemoryError.

"AMD64 Arch Linux Asan 3.8" buildbot logs a compiler warning:
https://buildbot.python.org/all/#builders/580/builds/4

Objects/exceptions.c: In function ‘MemoryError_dealloc’:
Objects/exceptions.c:2298:23: warning: comparison of distinct pointer types lacks a cast
 2298 |     if (Py_TYPE(self) != PyExc_MemoryError) {
      |                       ^~

New changeset 6ae61959ec51a6b3dddc8e665ce6a7b8aeb26c04 by Pablo Galindo in branch '3.8':
bpo-41654: Explicitly cast PyExc_MemoryError to PyTypeObject to avoid warning (GH-22102)
https://github.com/python/cpython/commit/6ae61959ec51a6b3dddc8e665ce6a7b8aeb26c04

New changeset bbeb223e9a5e9f9374df384efa386b4068a65c0e by Victor Stinner in branch 'master':
bpo-41654: Fix compiler warning in MemoryError_dealloc() (GH-22387)
https://github.com/python/cpython/commit/bbeb223e9a5e9f9374df384efa386b4068a65c0e

New changeset 1f0cde678406749524d11e852a16bf243cef5c5f by Miss Islington (bot) in branch '3.9':
bpo-41654: Fix compiler warning in MemoryError_dealloc() (GH-22387) (GH-24894)
https://github.com/python/cpython/commit/1f0cde678406749524d11e852a16bf243cef5c5f