Issue #14211: Oops, I removed the wrong file :-)

Lib/test/crashers/borrowed_ref_1.py

+"""
+_PyType_Lookup() returns a borrowed reference.
+This attacks the call in dictobject.c.
+"""
+
+class A(object):
+    pass
+
+class B(object):
+    def __del__(self):
+        print('hi')
+        del D.__missing__
+
+class D(dict):
+    class __missing__:
+        def __init__(self, *args):
+            pass
+
+
+d = D()
+a = A()
+a.cycle = a
+a.other = B()
+del a
+
+prev = None
+while 1:
+    d[5]
+    prev = (prev,)

Lib/test/crashers/borrowed_ref_2.py

-"""
-_PyType_Lookup() returns a borrowed reference.
-This attacks PyObject_GenericSetAttr().
-
-NB. on my machine this crashes in 2.5 debug but not release.
-"""
-
-class A(object):
-    pass
-
-class B(object):
-    def __del__(self):
-        print("hi")
-        del C.d
-
-class D(object):
-    def __set__(self, obj, value):
-        self.hello = 42
-
-class C(object):
-    d = D()
-
-    def g():
-        pass
-
-
-c = C()
-a = A()
-a.cycle = a
-a.other = B()
-
-lst = [None] * 1000000
-i = 0
-del a
-while 1:
-    c.d = 42         # segfaults in PyMethod_New(__func__=D.__set__, __self__=d)
-    lst[i] = c.g     # consume the free list of instancemethod objects
-    i += 1