1""" 2There is a way to put keys of any type in a type's dictionary. 3I think this allows various kinds of crashes, but so far I have only 4found a convoluted attack of _PyType_Lookup(), which uses the mro of the 5type without holding a strong reference to it. Probably works with 6super.__getattribute__() too, which uses the same kind of code. 7""" 8 9class MyKey(object): 10 def __hash__(self): 11 return hash('mykey') 12 13 def __cmp__(self, other): 14 # the following line decrefs the previous X.__mro__ 15 X.__bases__ = (Base2,) 16 # trash all tuples of length 3, to make sure that the items of 17 # the previous X.__mro__ are really garbage 18 z = [] 19 for i in range(1000): 20 z.append((i, None, None)) 21 return -1 22 23 24class Base(object): 25 mykey = 'from Base' 26 27class Base2(object): 28 mykey = 'from Base2' 29 30# you can't add a non-string key to X.__dict__, but it can be 31# there from the beginning :-) 32X = type('X', (Base,), {MyKey(): 5}) 33 34print X.mykey 35# I get a segfault, or a slightly wrong assertion error in a debug build. 36