Fix _PyDict_Pop() on pending key

Issue #28120: Fix dict.pop() for splitted dictionary when trying to remove a
"pending key" (Not yet inserted in split-table).

Patch by Xiang Zhang.

3 files changed, 13 insertions, 1 deletions

diff --git a/Lib/test/test_dict.py b/Lib/test/test_dict.py
index fb954c8132..ed66ddbcb4 100644
--- a/Lib/test/test_dict.py
+++ b/Lib/test/test_dict.py
@@ -892,6 +892,15 @@ class DictTest(unittest.TestCase):
         self.assertEqual(list(b), ['x', 'y', 'z'])
 
     @support.cpython_only
+    def test_splittable_pop_pending(self):
+        """pop a pending key in a splitted table should not crash"""
+        a, b = self.make_shared_key_dict(2)
+
+        a['a'] = 4
+        with self.assertRaises(KeyError):
+            b.pop('a')
+
+    @support.cpython_only
     def test_splittable_popitem(self):
         """split table must be combined when d.popitem()"""
         a, b = self.make_shared_key_dict(2)
diff --git a/Misc/NEWS b/Misc/NEWS
index 34c3748ee4..57f1b53938 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@ What's New in Python 3.6.0 beta 2
 Core and Builtins
 -----------------
 
+- Issue #28120: Fix dict.pop() for splitted dictionary when trying to remove a
+  "pending key" (Not yet inserted in split-table). Patch by Xiang Zhang.
+
 Library
 -------
 
diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index bb5962a1a5..06c54b5665 100644
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -1721,7 +1721,7 @@ _PyDict_Pop(PyDictObject *mp, PyObject *key, PyObject *deflt)
     ix = (mp->ma_keys->dk_lookup)(mp, key, hash, &value_addr, &hashpos);
     if (ix == DKIX_ERROR)
         return NULL;
-    if (ix == DKIX_EMPTY) {
+    if (ix == DKIX_EMPTY || *value_addr == NULL) {
         if (deflt) {
             Py_INCREF(deflt);
             return deflt;