Use a different approach, only copy dicts themself

Author: sobolevn

Lib/test/test_types.py

@@ -1463,9 +1463,20 @@ def __eq__(self, other):
                 return other
 
         leaked = mp1 == Evil()
-        self.assertIs(type(leaked), dict)
+        self.assertIs(type(leaked), CustomMapping)
+        self.assertEqual(leaked, mp1)
         self.assertEqual(leaked, dt1)
 
+        class CustomMapping2(CustomMapping):
+            def __eq__(self, other):
+                return (
+                    isinstance(other, CustomMapping)
+                    and self._data == other._data
+                )
+
+        self.assertEqual(mp1, CustomMapping2({'a': 1}))
+        self.assertNotEqual(CustomMapping2({'a': 1}), mp1)
+
     def test_richcompare_odict(self):
         od1 = OrderedDict(x=1, y=2)
         od1_2 = OrderedDict(x=1, y=2)

Misc/NEWS.d/next/Core_and_Builtins/2026-06-28-14-39-05.gh-issue-152405.-_3YRo.rst

@@ -2,6 +2,4 @@ Fixes a crash, when modifing :class:`types.MappingProxyType` exposed via a
 rich-compare operation with :func:`vars` function. It was possible to mutate
 the internals of builtins types via this technique.
 
-It changes the object that is passed to custom rich-compare methods
-from the original internal mapping type to be always a new :class:`dict` copy
-with all the keys and values from the original mapping.
+Now we pass not the original :class:`dict` instance, but its copy.

Objects/descrobject.c

@@ -1234,28 +1234,21 @@ mappingproxy_richcompare(PyObject *self, PyObject *w, int op)
 {
     if (op == Py_EQ || op == Py_NE) {
         mappingproxyobject *v = (mappingproxyobject *)self;
-        // Common path optimizations, where we can expose the real mapping:
-        if (
-            PyAnyDict_CheckExact(w)
-            || PyODict_CheckExact(w)
-            || Py_TYPE(w) == &PyDictProxy_Type
-        ) {
-            return PyObject_RichCompare(v->mapping, w, op);
-        }
-        // We can't expose the `v->mapping` itself, so we create a dict copy:
-        // it was possible to mutate `v->mapping` in rich-compare methods.
+        // We have to guard the mutable `dict` instances, because it can
+        // otherwise mutate the type's `__dict__` entries and cause crashes:
         // See gh-152405 on the details.
-        PyObject *copy = PyDict_New();
-        if (copy == NULL) {
-            return NULL;
-        }
-        if (PyDict_Update(copy, v->mapping)) {
+        if (PyDict_CheckExact(v->mapping)) {
+            // So, instead we send a copy:
+            PyObject *copy = PyDict_Copy(v->mapping);
+            if (copy == NULL) {
+                return NULL;
+            }
+            PyObject *res = PyObject_RichCompare(copy, w, op);
             Py_DECREF(copy);
-            return NULL;
+            return res;
         }
-        PyObject *res = PyObject_RichCompare(copy, w, op);
-        Py_DECREF(copy);
-        return res;
+        // Otherwise we are free to share the mapping directly:
+        return PyObject_RichCompare(v->mapping, w, op);
     }
     Py_RETURN_NOTIMPLEMENTED;
 }