bpo-38525: di_pos must be initialized from ma_used when dict is key sharing dict

Author: corona10

Lib/test/test_dict.py

@@ -1327,6 +1327,16 @@ def test_reverse_iterator_for_empty_dict(self):
         self.assertEqual(list(reversed(dict().values())), [])
         self.assertEqual(list(reversed(dict().keys())), [])
 
+    def test_reverse_iterator_for_shared_shared_dicts(self):
+        class A:
+            def __init__(self, x, y):
+                if x: self.x = x
+                if y: self.y = y
+
+        self.assertEqual(list(reversed(A(1, 2).__dict__)), ['y', 'x'])
+        self.assertEqual(list(reversed(A(1, 0).__dict__)), ['x'])
+        self.assertEqual(list(reversed(A(0, 1).__dict__)), ['y'])
+
     def test_dict_copy_order(self):
         # bpo-34320
         od = collections.OrderedDict([('a', 1), ('b', 2)])

Misc/NEWS.d/next/Core and Builtins/2019-10-20-00-36-18.bpo-38525.Vty1cA.rst

@@ -1,2 +1,2 @@
 Fix a segmentation fault when using reverse iterators of empty ``dict`` objects.
-Patch by Dong-hee Na.
+Patch by Dong-hee Na and Inada Naoki.

Objects/dictobject.c

@@ -3455,7 +3455,12 @@ dictiter_new(PyDictObject *dict, PyTypeObject *itertype)
     if ((itertype == &PyDictRevIterKey_Type ||
          itertype == &PyDictRevIterItem_Type ||
          itertype == &PyDictRevIterValue_Type) && dict->ma_used) {
+        if (dict->ma_values) {
+            di->di_pos = dict->ma_used - 1;
+        }
+        else {
             di->di_pos = dict->ma_keys->dk_nentries - 1;
+        }
     }
     else {
         di->di_pos = 0;