bpo-38525: Fix a segmentation fault when using reverse iterators of empty dict

Lib/test/test_dict.py

@@ -1312,6 +1312,19 @@ def test_reversed(self):
         self.assertEqual(list(r), list('dcba'))
         self.assertRaises(StopIteration, next, r)
 
+    def test_reverse_iterator_for_empty_dict(self):
+        empty_dict = {}
+        self.assertEqual(list(reversed(empty_dict)), [])
+        self.assertEqual(list(reversed(empty_dict.items())), [])
+        self.assertEqual(list(reversed(empty_dict.values())), [])
+        self.assertEqual(list(reversed(empty_dict.keys())), [])
+
+        empty_dict = dict()
+        self.assertEqual(list(reversed(empty_dict)), [])
+        self.assertEqual(list(reversed(empty_dict.items())), [])
+        self.assertEqual(list(reversed(empty_dict.values())), [])
+        self.assertEqual(list(reversed(empty_dict.keys())), [])
+
     def test_dict_copy_order(self):
         # bpo-34320
         od = collections.OrderedDict([('a', 1), ('b', 2)])

Misc/NEWS.d/next/Library/2019-10-19-23-58-09.bpo-38525.CzEl2G.rst

@@ -0,0 +1,2 @@
+Fix a segmentation fault when using reverse iterators of empty ``dict``
+objects that were created as empty ``dict`` literals. Patch by Dong-hee Na.

Objects/dictobject.c

@@ -3826,7 +3826,7 @@ dictreviter_iternext(dictiterobject *di)
     PyObject *key, *value, *result;
 
     if (d->ma_values) {
-        if (i < 0) {
+        if (i < 0 || i >= d->ma_used) {
             goto fail;
         }
         key = DK_ENTRIES(k)[i].me_key;