gh-146152: Fix memory leak in _json encoder error paths

Lib/test/test_json/test_recursion.py

@@ -1,11 +1,12 @@
+import weakref
+import sys
 from test import support
 from test.test_json import PyTest, CTest
 
 
 class JSONTestObject:
     pass
 
-
 class TestRecursion:
     def test_listrecursion(self):
         x = []
@@ -115,6 +116,36 @@ def default(self, o):
             with support.infinite_recursion(1000):
                 EndlessJSONEncoder(check_circular=False).encode(5j)
 
+    @support.skip_if_unlimited_stack_size
+    @support.skip_emscripten_stack_overflow()
+    @support.skip_wasi_stack_overflow()
+    def test_memory_leak_on_recursion_error(self):
+        # Test that no memory leak occurs when a RecursionError is raised.
+        class LeakTestObj:
+            pass
+
+        weak_refs = []
+        def default(obj):
+            if isinstance(obj, LeakTestObj):
+                new_obj = LeakTestObj()
+                weak_refs.append(weakref.ref(new_obj))
+                return [new_obj]
+            raise TypeError
+
+        depth = min(500, sys.getrecursionlimit() - 10)
+        obj = LeakTestObj()
+        for _ in range(depth):
+            obj = [obj]
+
+        with support.infinite_recursion():
+            with self.assertRaises(RecursionError):
+                self.dumps(obj, default=default)
+
+        support.gc_collect()
+        self.assertTrue(weak_refs, "No objects were created to track")
+        for i, ref in enumerate(weak_refs):
+            self.assertIsNone(ref(), f"object {i} still alive")
+
 
 class TestPyRecursion(TestRecursion, PyTest): pass
 class TestCRecursion(TestRecursion, CTest): pass

Misc/NEWS.d/next/Library/2026-03-22-15-25-27.gh-issue-146152.jdQhly.rst

@@ -0,0 +1,5 @@
+Fix a memory leak in the :mod:`json` module when a RecursionError occurs
+during encoding. Previously, objects created in the ``default()`` function
+while recursively encoding JSON could remain alive due to being tracked
+indefinitely in the encoder's internal circular-reference dictionary. This
+change ensures such objects are properly freed after the exception.

Modules/_json.c

@@ -1632,8 +1632,17 @@ encoder_listencode_obj(PyEncoderObject *s, PyUnicodeWriter *writer,
         }
 
         if (_Py_EnterRecursiveCall(" while encoding a JSON object")) {
+            if (ident != NULL) {
+                int del_rv = PyDict_DelItem(s->markers, ident);
+                Py_DECREF(ident);
+                if (del_rv < 0) {
+                    Py_DECREF(newobj);
+                    return -1;
+                }
+
+            }
+
             Py_DECREF(newobj);
-            Py_XDECREF(ident);
             return -1;
         }
         rv = encoder_listencode_obj(s, writer, newobj, indent_level, indent_cache);
@@ -1642,15 +1651,21 @@ encoder_listencode_obj(PyEncoderObject *s, PyUnicodeWriter *writer,
         Py_DECREF(newobj);
         if (rv) {
             _PyErr_FormatNote("when serializing %T object", obj);
-            Py_XDECREF(ident);
+            if (ident != NULL) {
+                int del_rv = PyDict_DelItem(s->markers, ident);
+                Py_DECREF(ident);
+                if (del_rv < 0) {
+                    return -1;
+                }
+            }
             return -1;
         }
         if (ident != NULL) {
-            if (PyDict_DelItem(s->markers, ident)) {
-                Py_XDECREF(ident);
+            int del_rv = PyDict_DelItem(s->markers, ident);
+            Py_DECREF(ident);
+            if (del_rv < 0) {
                 return -1;
             }
-            Py_XDECREF(ident);
         }
         return rv;
     }