gh-155452: Prevent recursion crash in dir()

Author: BHUVANSH855

Lib/test/test_builtin.py

@@ -700,6 +700,20 @@ def __init__(self):
         f = Foo()
         self.assertIn("y", dir(f))
 
+        # dir(obj) - cyclic __bases__ must raise RecursionError
+        class Fake:
+            pass
+
+        a = Fake()
+        a.__bases__ = (a,)
+
+        class C:
+            @property
+            def __class__(self):
+                return a
+
+        self.assertRaises(RecursionError, dir, C())
+
         # dir(obj_no__dict__)
         class Foo(object):
             __slots__ = []

Misc/NEWS.d/next/Core_and_Builtins/2026-08-09-21-24-08.gh-issue-155452.4mUzjM.rst

@@ -0,0 +1,2 @@
+Fix a crash in :func:`dir` when an object's ``__class__`` has cyclic
+``__bases__``.

Objects/typeobject.c

@@ -3,6 +3,7 @@
 #include "Python.h"
 #include "pycore_abstract.h"      // _PySequence_IterSearch()
 #include "pycore_call.h"          // _PyObject_VectorcallTstate()
+#include "pycore_ceval.h"         // _Py_EnterRecursiveCall()
 #include "pycore_code.h"          // CO_FAST_FREE
 #include "pycore_descrobject.h"   // _PyMember_GetOffset()
 #include "pycore_dict.h"          // _PyDict_KeysSize()
@@ -6949,22 +6950,27 @@ merge_class_dict(PyObject *dict, PyObject *aclass)
             Py_DECREF(bases);
             return -1;
         }
-        else {
-            for (i = 0; i < n; i++) {
-                int status;
-                PyObject *base = PySequence_GetItem(bases, i);
-                if (base == NULL) {
-                    Py_DECREF(bases);
-                    return -1;
-                }
-                status = merge_class_dict(dict, base);
-                Py_DECREF(base);
-                if (status < 0) {
-                    Py_DECREF(bases);
-                    return -1;
-                }
+        if (_Py_EnterRecursiveCall(" in __bases__")) {
+            Py_DECREF(bases);
+            return -1;
+        }
+        for (i = 0; i < n; i++) {
+            int status;
+            PyObject *base = PySequence_GetItem(bases, i);
+            if (base == NULL) {
+                _Py_LeaveRecursiveCall();
+                Py_DECREF(bases);
+                return -1;
+            }
+            status = merge_class_dict(dict, base);
+            Py_DECREF(base);
+            if (status < 0) {
+                _Py_LeaveRecursiveCall();
+                Py_DECREF(bases);
+                return -1;
             }
         }
+        _Py_LeaveRecursiveCall();
         Py_DECREF(bases);
     }
     return 0;