I gets to a dict of class circumventing dictproxy. It's yet unclear why it segfaults.

The crash as well as the output "1" are both caused because updating the class dictionary directly doesn't invalidate the method cache. When the new value for "f" is assigned to the dict, the old "f" gets garbage collected (because the method cache uses borrowed references), but there is still an entry in the cache for the (now garbage-collected) function. When "a.f" is executed next, the entry of the cache is used and a new method is created. When that method gets called, it returns "1" and when the interpreter tries to garbage collect the new method on interpreter finalization, it segfaults because the referenced "f" is already collected. Regards, Andreas