From ce8f5f98c6fc95a1704360d986a4d0281eeada79 Mon Sep 17 00:00:00 2001
From: Duane Griffin <duaneg@dghda.com>
Date: Thu, 15 Jan 2026 00:25:46 +1300
Subject: [PATCH] gh-106287: Do not write objects after an unmarshalling error
 (GH-132715)

Writing out an object may involve a slot lookup, which is not safe to do with
an exception raised. In debug mode an assertion failure will occur if this
happens.
---
 Lib/test/test_marshal.py                      | 20 +++++++++++++++++++
 ...-04-19-17-34-11.gh-issue-132715.XXl47F.rst |  1 +
 Python/marshal.c                              |  4 ++++
 3 files changed, 25 insertions(+)
 create mode 100644 Misc/NEWS.d/next/Library/2025-04-19-17-34-11.gh-issue-132715.XXl47F.rst

diff --git a/Lib/test/test_marshal.py b/Lib/test/test_marshal.py
index 662bdfccc79..28f24d0fc59 100644
--- a/Lib/test/test_marshal.py
+++ b/Lib/test/test_marshal.py
@@ -413,6 +413,26 @@ def test_deterministic_sets(self):
                     _, dump_1, _ = assert_python_ok(*args, PYTHONHASHSEED="1")
                     self.assertEqual(dump_0, dump_1)
 
+    def test_unmarshallable(self):
+        # Check no crash after encountering unmarshallable objects.
+        # See https://github.com/python/cpython/issues/106287.
+        fset = frozenset([int])
+        code = compile("a = 1", "<string>", "exec")
+        code = code.replace(co_consts=(1, fset, None))
+        cases = (('tuple', (fset,)),
+                 ('list', [fset]),
+                 ('set', fset),
+                 ('dict key', {fset: 'x'}),
+                 ('dict value', {'x': fset}),
+                 ('dict key & value', {fset: fset}),
+                 ('slice', slice(fset, fset)),
+                 ('code', code))
+        for name, arg in cases:
+            with self.subTest(name, arg=arg):
+                with self.assertRaisesRegex(ValueError, "unmarshallable object"):
+                    marshal.dumps((arg, memoryview(b'')))
+
+
 LARGE_SIZE = 2**31
 pointer_size = 8 if sys.maxsize > 0xFFFFFFFF else 4
 
diff --git a/Misc/NEWS.d/next/Library/2025-04-19-17-34-11.gh-issue-132715.XXl47F.rst b/Misc/NEWS.d/next/Library/2025-04-19-17-34-11.gh-issue-132715.XXl47F.rst
new file mode 100644
index 00000000000..191b4f16e0f
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2025-04-19-17-34-11.gh-issue-132715.XXl47F.rst
@@ -0,0 +1 @@
+Skip writing objects during marshalling once a failure has occurred.
diff --git a/Python/marshal.c b/Python/marshal.c
index 69d6dd7cf0f..190fcdc89af 100644
--- a/Python/marshal.c
+++ b/Python/marshal.c
@@ -432,6 +432,10 @@ w_object(PyObject *v, WFILE *p)
 {
     char flag = '\0';
 
+    if (p->error != WFERR_OK) {
+        return;
+    }
+
     p->depth++;
 
     if (p->depth > MAX_MARSHAL_STACK_DEPTH) {