only fast-path fromkeys() when the constructor returns a empty dict (closes #16345)

Lib/test/test_dict.py

@@ -254,6 +254,14 @@ class DictTest(unittest.TestCase):
         d = dict(zip(range(6), range(6)))
         self.assertEqual(dict.fromkeys(d, 0), dict(zip(range(6), [0]*6)))
 
+        class baddict3(dict):
+            def __new__(cls):
+                return d
+        d = {i : i for i in range(10)}
+        res = d.copy()
+        res.update(a=None, b=None, c=None)
+        self.assertEqual(baddict3.fromkeys({"a", "b", "c"}), res)
+
     def test_copy(self):
         d = {1:1, 2:2, 3:3}
         self.assertEqual(d.copy(), {1:1, 2:2, 3:3})

Misc/NEWS

@@ -10,6 +10,9 @@ What's New in Python 3.2.4
 Core and Builtins
 -----------------
 
+- Issue #16345: Fix an infinite loop when ``fromkeys`` on a dict subclass
+  recieved a nonempty dict from the constructor.
+
 - Issue #16197: Update winreg docstrings and documentation to match code.
   Patch by Zachary Ware.
 

Objects/dictobject.c

@@ -1335,7 +1335,8 @@ dict_fromkeys(PyObject *cls, PyObject *args)
     if (d == NULL)
         return NULL;
 
-    if (PyDict_CheckExact(d) && PyDict_CheckExact(seq)) {
+    if (PyDict_CheckExact(d) && PyDict_Size(d) == 0) {
+        if (PyDict_CheckExact(seq)) {
             PyDictObject *mp = (PyDictObject *)d;
             PyObject *oldvalue;
             Py_ssize_t pos = 0;
@@ -1357,8 +1358,7 @@ dict_fromkeys(PyObject *cls, PyObject *args)
             }
             return d;
         }
-
+        if (PyAnySet_CheckExact(seq)) {
-    if (PyDict_CheckExact(d) && PyAnySet_CheckExact(seq)) {
             PyDictObject *mp = (PyDictObject *)d;
             Py_ssize_t pos = 0;
             PyObject *key;
@@ -1379,6 +1379,7 @@ dict_fromkeys(PyObject *cls, PyObject *args)
             }
             return d;
         }
+    }
 
     it = PyObject_GetIter(seq);
     if (it == NULL){