python
diff --git a/‎Lib/test/test_baseexception.py‎
Lines changed: 25 additions & 0 deletions b/‎Lib/test/test_baseexception.py‎
Lines changed: 25 additions & 0 deletions
diff --git a/‎Misc/NEWS.d/next/Core and Builtins/2022-10-01-08-55-09.gh-issue-97591.pw6kkH.rst‎
Lines changed: 2 additions & 0 deletions b/‎Misc/NEWS.d/next/Core and Builtins/2022-10-01-08-55-09.gh-issue-97591.pw6kkH.rst‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎Objects/exceptions.c‎
Lines changed: 7 additions & 1 deletion b/‎Objects/exceptions.c‎
Lines changed: 7 additions & 1 deletion
@@ -114,6 +114,31 @@ def test_interface_no_arg(self):
                 [repr(exc), exc.__class__.__name__ + '()'])
         self.interface_test_driver(results)
 
+    def test_setstate_refcount_no_crash(self):
+        # gh-97591: Acquire strong reference before calling tp_hash slot
+        # in PyObject_SetAttr.
+        import gc
+        d = {}
+        class HashThisKeyWillClearTheDict(str):
+            def __hash__(self) -> int:
+                d.clear()
+                return super().__hash__()
+        class Value(str):
+            pass
+        exc = Exception()
+
+        d[HashThisKeyWillClearTheDict()] = Value()  # refcount of Value() is 1 now
+
+        # Exception.__setstate__ should aquire a strong reference of key and
+        # value in the dict. Otherwise, Value()'s refcount would go below
+        # zero in the tp_hash call in PyObject_SetAttr(), and it would cause
+        # crash in GC.
+        exc.__setstate__(d)  # __hash__() is called again here, clearing the dict.
+
+        # This GC would crash if the refcount of Value() goes below zero.
+        gc.collect()
+
+
 class UsageTests(unittest.TestCase):
 
     """Test usage of exceptions"""
 
@@ -0,0 +1,2 @@
+Fixed a missing incref/decref pair in `Exception.__setstate__()`.
+Patch by Ofey Chan.
@@ -167,8 +167,14 @@ BaseException_setstate(PyObject *self, PyObject *state)
             return NULL;
         }
         while (PyDict_Next(state, &i, &d_key, &d_value)) {
-            if (PyObject_SetAttr(self, d_key, d_value) < 0)
+            Py_INCREF(d_key);
+            Py_INCREF(d_value);
+            int res = PyObject_SetAttr(self, d_key, d_value);
+            Py_DECREF(d_value);
+            Py_DECREF(d_key);
+            if (res < 0) {
                 return NULL;
+            }
         }
     }
     Py_RETURN_NONE;
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	+Fixed a missing incref/decref pair in `Exception.__setstate__()`.
	`2`	`+Patch by Ofey Chan.`
Original file line number	Diff line number	Diff line change
`@@ -167,8 +167,14 @@ BaseException_setstate(PyObject self, PyObject state)`
`167`	`167`	`return NULL;`
`168`	`168`	`}`
`169`	`169`	`while (PyDict_Next(state, &i, &d_key, &d_value)) {`
`170`		`- if (PyObject_SetAttr(self, d_key, d_value) < 0)`
	`170`	`+ Py_INCREF(d_key);`
	`171`	`+ Py_INCREF(d_value);`
	`172`	`+ int res = PyObject_SetAttr(self, d_key, d_value);`
	`173`	`+ Py_DECREF(d_value);`
	`174`	`+ Py_DECREF(d_key);`
	`175`	`+ if (res < 0) {`
`171`	`176`	`return NULL;`
	`177`	`+ }`
`172`	`178`	`}`
`173`	`179`	`}`
`174`	`180`	`Py_RETURN_NONE;`