merge 3.3 (#24407)

diff --cc Lib/test/test_dict.py
index c96d0006edd4b534c5913eeb10ca21f7f6536b2e,bd3040a7f6a33b01dd614e300ec6702ed51a8800..bd79728c34a665227c6f31739ae2297cb665fb8b
--- 1/Lib/test/test_dict.py
--- 2/Lib/test/test_dict.py
+++ b/Lib/test/test_dict.py
@@@ -909,34 -906,20 +909,48 @@@ class DictTest(unittest.TestCase)
          f.a = 'a'
          self.assertEqual(f.__dict__, {1:1, 'a':'a'})
  
 +    def check_reentrant_insertion(self, mutate):
 +        # This object will trigger mutation of the dict when replaced
 +        # by another value.  Note this relies on refcounting: the test
 +        # won't achieve its purpose on fully-GCed Python implementations.
 +        class Mutating:
 +            def __del__(self):
 +                mutate(d)
 +
 +        d = {k: Mutating() for k in 'abcdefghijklmnopqr'}
 +        for k in list(d):
 +            d[k] = k
 +
 +    def test_reentrant_insertion(self):
 +        # Reentrant insertion shouldn't crash (see issue #22653)
 +        def mutate(d):
 +            d['b'] = 5
 +        self.check_reentrant_insertion(mutate)
 +
 +        def mutate(d):
 +            d.update(self.__dict__)
 +            d.clear()
 +        self.check_reentrant_insertion(mutate)
 +
 +        def mutate(d):
 +            while d:
 +                d.popitem()
 +        self.check_reentrant_insertion(mutate)
 +
+     def test_merge_and_mutate(self):
+         class X:
+             def __hash__(self):
+                 return 0
+ 
+             def __eq__(self, o):
+                 other.clear()
+                 return False
+ 
+         l = [(i,0) for i in range(1, 1337)]
+         other = dict(l)
+         other[X()] = 0
+         d = {X(): 0, 1: 1}
+         self.assertRaises(RuntimeError, d.update, other)
  
  from test import mapping_tests
  

diff --cc Misc/NEWS
index becb9ef1937ea892c54a228b8eb87881a920a338,c5d7e65bcb130ad87854cb64610df056dff406f9..9e78e77df78e48dc6cbac686930729a7226e9cf7
--- 1/Misc/NEWS
--- 2/Misc/NEWS
+++ b/Misc/NEWS
@@@ -10,28 -10,8 +10,30 @@@ Release date: tb
  Core and Builtins
  -----------------
  
 +- Issue #24467: Fixed possible buffer over-read in bytearray. The bytearray
 +  object now always allocates place for trailing null byte and it's buffer now
 +  is always null-terminated.
 +
 +- Issue #24115: Update uses of PyObject_IsTrue(), PyObject_Not(),
 +  PyObject_IsInstance(), PyObject_RichCompareBool() and _PyDict_Contains()
 +  to check for and handle errors correctly.
 +
 +- Issue #24257: Fixed system error in the comparison of faked
 +  types.SimpleNamespace.
 +
 +- Issue #22939: Fixed integer overflow in iterator object.  Patch by
 +  Clement Rouault.
 +
 +- Issue #23985: Fix a possible buffer overrun when deleting a slice from
 +  the front of a bytearray and then appending some other bytes data.
 +
 +- Issue #24102: Fixed exception type checking in standard error handlers.
 +
 +- Issue #23757:  PySequence_Tuple() incorrectly called the concrete list API
 +  when the data was a list subclass.
 +
+ - Issue #24407: Fix crash when dict is mutated while being updated.
+ 
  - Issue #24096: Make warnings.warn_explicit more robust against mutation of the
    warnings.filters list.
  

diff --cc Objects/dictobject.c
Simple merge