From 91760e64c85c146a989be476706690b2668708c9 Mon Sep 17 00:00:00 2001
From: hauntsaninja <hauntsaninja@gmail.com>
Date: Wed, 15 Apr 2026 21:31:02 -0700
Subject: [PATCH] Incref items before releasing tuple

Found by @devdanzin
---
 mypyc/lib-rt/dict_ops.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mypyc/lib-rt/dict_ops.c b/mypyc/lib-rt/dict_ops.c
index 5c6f31bf6f152..13e5637eec382 100644
--- a/mypyc/lib-rt/dict_ops.c
+++ b/mypyc/lib-rt/dict_ops.c
@@ -407,6 +407,7 @@ tuple_T4CIOO CPyDict_NextItem(PyObject *dict_or_iter, CPyTagged offset) {
         if (item == NULL || !PyTuple_Check(item) || PyTuple_GET_SIZE(item) != 2) {
             if (item != NULL) {
                 PyErr_SetString(PyExc_TypeError, "a tuple of length 2 expected");
+                Py_DECREF(item);
             }
             ret.f0 = 0;
             ret.f2 = Py_None;
@@ -415,7 +416,10 @@ tuple_T4CIOO CPyDict_NextItem(PyObject *dict_or_iter, CPyTagged offset) {
             ret.f0 = 1;
             ret.f2 = PyTuple_GET_ITEM(item, 0);
             ret.f3 = PyTuple_GET_ITEM(item, 1);
+            Py_INCREF(ret.f2);
+            Py_INCREF(ret.f3);
             Py_DECREF(item);
+            return ret;
         }
     }
     // PyDict_Next() returns borrowed references.