GH-93990: fix refcounting bug in `add_subclass` in `typeobject.c` (GH-93989)

diff --git a/Objects/typeobject.c b/Objects/typeobject.c
index 513055168062f192c5e52be6f01ce327487d91f6..1236acdcd1930bef2b2ea26120211e44d1a52f90 100644 (file)
--- a/Objects/typeobject.c
+++ b/Objects/typeobject.c
@@ -6671,8 +6671,11 @@ add_subclass(PyTypeObject *base, PyTypeObject *type)
     PyObject *subclasses = base->tp_subclasses;
     if (subclasses == NULL) {
         base->tp_subclasses = subclasses = PyDict_New();
-        if (subclasses == NULL)
+        if (subclasses == NULL) {
+            Py_DECREF(key);
+            Py_DECREF(ref);
             return -1;
+        }
     }
     assert(PyDict_CheckExact(subclasses));