Crash report

What happened?

types.GenericAlias calculates its __parameters__ only when they are first needed, then caches the result on the alias.

If an argument gains a __typing_subst__ attribute after the result has been cached, the cached parameters no longer match the alias arguments. During a later substitution, _Py_subs_parameters() recognizes the changed argument as a parameter but cannot find it in the cached tuple, so tuple_index() returns -1.

In a debug build, this triggers a failed C assertion. In a release build, the -1 is used as an array index and can crash the process.

class Parameter:
    pass
first = Parameter()
first.__typing_subst__ = lambda value: value
late = Parameter()
alias = dict[first, late]
alias.__parameters__
late.__typing_subst__ = lambda value: value
alias[0,]

CPython versions tested on:

3.15, 3.14, 3.13, 3.12, 3.11

Operating systems tested on:

macOS, Linux

Output from running 'python -VV' on the command line:

Python 3.14.6 (main, Jun 10 2026, 10:03:53) [Clang 21.0.0 (clang-2100.0.123.102)]

Crash report

What happened?

CPython versions tested on:

Operating systems tested on:

Output from running 'python -VV' on the command line:

Linked PRs