gh-96046: Initialize ht_cached_keys in PyType_Ready() (GH-96047)

(cherry picked from commit 53e6a9a)

Co-authored-by: Christian Heimes <christian@python.org>

Author: miss-islington

Misc/NEWS.d/next/Core and Builtins/2022-08-18-13-47-59.gh-issue-96046.5Hqbka.rst

@@ -0,0 +1,4 @@
+:c:func:`PyType_Ready` now initializes ``ht_cached_keys`` and performs
+additional checks to ensure that type objects are properly configured. This
+avoids crashes in 3rd party packages that don't use regular API to create
+new types.

Objects/typeobject.c

@@ -3202,11 +3202,6 @@ type_new_impl(type_new_ctx *ctx)
     // Put the proper slots in place
     fixup_slot_dispatchers(type);
 
-    if (type->tp_flags & Py_TPFLAGS_MANAGED_DICT) {
-        PyHeapTypeObject *et = (PyHeapTypeObject*)type;
-        et->ht_cached_keys = _PyDict_NewKeysForClass();
-    }
-
     if (type_new_set_names(type) < 0) {
         goto error;
     }
@@ -3588,10 +3583,6 @@ PyType_FromModuleAndSpec(PyObject *module, PyType_Spec *spec, PyObject *bases)
     if (PyType_Ready(type) < 0)
         goto fail;
 
-    if (type->tp_flags & Py_TPFLAGS_MANAGED_DICT) {
-        res->ht_cached_keys = _PyDict_NewKeysForClass();
-    }
-
     if (type->tp_doc) {
         PyObject *__doc__ = PyUnicode_FromString(_PyType_DocWithoutSignature(type->tp_name, type->tp_doc));
         if (!__doc__)
@@ -6409,6 +6400,29 @@ type_ready_set_new(PyTypeObject *type)
     return 0;
 }
 
+static int
+type_ready_managed_dict(PyTypeObject *type)
+{
+    if (!(type->tp_flags & Py_TPFLAGS_MANAGED_DICT)) {
+        return 0;
+    }
+    if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
+        PyErr_Format(PyExc_SystemError,
+                     "type %s has the Py_TPFLAGS_MANAGED_DICT flag "
+                     "but not Py_TPFLAGS_HEAPTYPE flag",
+                     type->tp_name);
+        return -1;
+    }
+    PyHeapTypeObject* et = (PyHeapTypeObject*)type;
+    if (et->ht_cached_keys == NULL) {
+        et->ht_cached_keys = _PyDict_NewKeysForClass();
+        if (et->ht_cached_keys == NULL) {
+            PyErr_NoMemory();
+            return -1;
+        }
+    }
+    return 0;
+}
 
 static int
 type_ready_post_checks(PyTypeObject *type)
@@ -6469,6 +6483,9 @@ type_ready(PyTypeObject *type)
     if (type_ready_add_subclasses(type) < 0) {
         return -1;
     }
+    if (type_ready_managed_dict(type) < 0) {
+        return -1;
+    }
     if (type_ready_post_checks(type) < 0) {
         return -1;
     }