gh-133441: Fix STORE_ATTR_WITH_HINT bytecode

Deoptimize if the dict is a dict subclass.

Author: vstinner

Lib/test/test_dict.py

@@ -1594,6 +1594,24 @@ def make_pairs():
                 self.assertEqual(d.get(key3_3), 44)
                 self.assertGreaterEqual(eq_count, 1)
 
+    def test_store_attr_with_hint(self):
+        # gh-133441: Regression test for STORE_ATTR_WITH_HINT bytecode
+        class Node:
+            def __init__(self):
+                self.parents = {}
+
+            def __setstate__(self, data_dict):
+                self.__dict__ = data_dict
+                self.parents = {}
+
+        class Dict(dict):
+            pass
+
+        obj = Node()
+        obj.__setstate__({'parents': {}})
+        obj.__setstate__({'parents': {}})
+        obj.__setstate__(Dict({'parents': {}}))
+
 
 class CAPITest(unittest.TestCase):
 

Misc/NEWS.d/next/Core_and_Builtins/2025-05-05-17-02-08.gh-issue-133441.EpjHD4.rst

@@ -0,0 +1,2 @@
+Fix ``STORE_ATTR_WITH_HINT`` bytecode: deoptimize if the dictionary is a
+dict subclass. Patch by Victor Stinner.

Python/bytecodes.c

@@ -2149,7 +2149,8 @@ dummy_func(
             assert(tp->tp_flags & Py_TPFLAGS_MANAGED_DICT);
             PyDictObject *dict = _PyObject_GetManagedDict(owner);
             DEOPT_IF(dict == NULL);
-            assert(PyDict_CheckExact((PyObject *)dict));
+            DEOPT_IF(!PyDict_CheckExact((PyObject *)dict));
+
             PyObject *name = GETITEM(FRAME_CO_NAMES, oparg);
             DEOPT_IF(hint >= (size_t)dict->ma_keys->dk_nentries);
             PyObject *old_value;