1 """

     2 There is a way to put keys of any type in a type's dictionary.

     3 I think this allows various kinds of crashes, but so far I have only

     4 found a convoluted attack of _PyType_Lookup(), which uses the mro of the

     5 type without holding a strong reference to it.  Probably works with

     6 super.__getattribute__() too, which uses the same kind of code.

     7 """

     8 

     9 class MyKey(object):

    10     def __hash__(self):

    11         return hash('mykey')

    12 

    13     def __cmp__(self, other):

    14         # the following line decrefs the previous X.__mro__

    15         X.__bases__ = (Base2,)

    16         # trash all tuples of length 3, to make sure that the items of

    17         # the previous X.__mro__ are really garbage

    18         z = []

    19         for i in range(1000):

    20             z.append((i, None, None))

    21         return -1

    22 

    23 

    24 class Base(object):

    25     mykey = 'from Base'

    26 

    27 class Base2(object):

    28     mykey = 'from Base2'

    29 

    30 # you can't add a non-string key to X.__dict__, but it can be

    31 # there from the beginning :-)

    32 X = type('X', (Base,), {MyKey(): 5})

    33 

    34 print X.mykey

    35 # I get a segfault, or a slightly wrong assertion error in a debug build.