bpo-38525: Fix a segmentation fault when using reverse iterators of empty dict

Lib/test/test_dict.py

@@ -1312,6 +1312,15 @@ def test_reversed(self):
  self.assertEqual(list(r), list('dcba'))
  self.assertRaises(StopIteration, next, r)
 
+ def test_reverse_iterator_for_empty_dict(self):
+ # bpo-38525: revered iterator should work properly
+
+ # empty dict is directly used for reference count test
+ self.assertEqual(list(reversed({})), [])
+ self.assertEqual(list(reversed({}.items())), [])
+ self.assertEqual(list(reversed({}.values())), [])
+ self.assertEqual(list(reversed({}.keys())), [])
+
  def test_dict_copy_order(self):
  # bpo-34320
  od = collections.OrderedDict([('a', 1), ('b', 2)])

Misc/NEWS.d/next/Core and Builtins/2019-10-20-00-36-18.bpo-38525.Vty1cA.rst

@@ -0,0 +1,2 @@
+Fix a segmentation fault when using reverse iterators of empty ``dict``
+objects that were created as empty ``dict`` literals. Patch by Dong-hee Na.

Objects/dictobject.c

@@ -3826,7 +3826,7 @@ dictreviter_iternext(dictiterobject *di)
  PyObject *key, *value, *result;
 
  if (d->ma_values) {
- if (i < 0) {
+ if (i < 0 || i >= d->ma_used) {
  goto fail;
  }
  key = DK_ENTRIES(k)[i].me_key;