@@ -485,6 +485,19 @@ class MyList(list):
         self.assertFalse(type_issubtype(frozendict, dict))
         self.assertFalse(type_issubtype(MyList, tuple))
 
+    def test_subclass_type_with_dict_subclass_tp_dict(self):
+        # gh-132042: MyListDictSubclass initializes tp_dict with a dict
+        # subclass before PyType_Ready(), as extensions may do.  Creating a
+        # subclass must still find the special methods in that dict.
+        class Sub(_testcapi.MyListDictSubclass):
+            pass
+        self.assertEqual(len(Sub([1, 2, 3])), 3)
+
+        class Sub2(_testcapi.MyListDictSubclass):
+            def __len__(self):
+                return 5
+        self.assertEqual(len(Sub2([1, 2, 3])), 5)
+
     def test_type_modified(self):
         # Test PyType_Modified()
         type_modified = _testlimitedcapi.type_modified
 
@@ -401,6 +401,74 @@ class B(A):
         with threading_helper.start_threads(threads):
             pass
 
+    def test_class_creation_with_concurrent_setattr(self):
+        # Creating a class resolves its slots from the dicts along the MRO
+        # while holding the type lock, before the class is reachable from
+        # its bases.  If that resolution blocked on a base's dict mutex, the
+        # type lock would be released while blocked, and another thread
+        # could then assign a special method on a base that was already
+        # resolved.  The new class would end up with a slot that does not
+        # match its MRO.
+        N = 300
+
+        class B2:
+            pass
+
+        class B1(B2):
+            pass
+
+        lock = threading.Lock()
+        mismatches = []
+        done = False
+
+        def custom_repr(self):
+            return "custom repr"
+
+        def setter():
+            # Toggle B1.__repr__, so a stale resolution of B1 gives the new
+            # class object.__repr__ while B1.__repr__ is custom_repr.
+            barrier.wait()
+            while not done:
+                with lock:
+                    B1.__repr__ = custom_repr
+                with lock:
+                    del B1.__repr__
+
+        def churner():
+            # type.__setattr__ takes B2's dict mutex before the type lock
+            # and holds it while waiting for the type lock, so B2's dict
+            # mutex is contended whenever creator holds the type lock.
+            barrier.wait()
+            n = 0
+            while not done:
+                n += 1
+                B2.attr = n
+
+        def creator():
+            nonlocal done
+            # Mark the base dicts as shared, so lookups from this thread
+            # never need to take their mutexes.
+            getattr(B1, "nope", None)
+            barrier.wait()
+            try:
+                for _ in range(N):
+                    C = type("C", (B1,), {})
+                    c = C()
+                    with lock:
+                        slot_result = repr(c)
+                        mro_result = C.__repr__(c)
+                    if slot_result != mro_result:
+                        mismatches.append((slot_result, mro_result))
+            finally:
+                done = True
+
+        targets = (setter, churner, churner, creator)
+        barrier = threading.Barrier(len(targets))
+        threads = [Thread(target=target) for target in targets]
+        with threading_helper.start_threads(threads):
+            pass
+        self.assertEqual(mismatches, [])
+
 
 if __name__ == "__main__":
     unittest.main()
@@ -0,0 +1,3 @@
+Speed up class creation by resolving the special method slots of a new class
+with one pass over each class dict along the MRO instead of one lookup per
+slot name and per class.
@@ -3307,6 +3307,17 @@ static PyTypeObject MyList_Type = {
     MyList_new,                                 /* tp_new */
 };
 
+/* Like MyList, but tp_dict is initialized with a dict subclass before
+   PyType_Ready(), as extension modules may do (e.g. ctypes before 3.13). */
+static PyTypeObject MyListDictSubclass_Type = {
+    PyVarObject_HEAD_INIT(NULL, 0)
+    "MyListDictSubclass",
+    sizeof(MyListObject),
+    .tp_dealloc = MyList_dealloc,
+    .tp_flags = Py_TPFLAGS_DEFAULT | Py_TPFLAGS_BASETYPE,
+    .tp_new = MyList_new,
+};
+
 /* Test PEP 560 */
 
 typedef struct {
@@ -3623,6 +3634,28 @@ _testcapi_exec(PyObject *m)
     Py_INCREF(&MyList_Type);
     PyModule_AddObject(m, "MyList", (PyObject *)&MyList_Type);
 
+    MyListDictSubclass_Type.tp_base = &PyList_Type;
+    if (MyListDictSubclass_Type.tp_dict == NULL) {
+        PyObject *cls = PyObject_CallFunction((PyObject *)&PyType_Type,
+                                              "s(O){}", "DictSubclass",
+                                              &PyDict_Type);
+        if (cls == NULL) {
+            return -1;
+        }
+        MyListDictSubclass_Type.tp_dict = PyObject_CallNoArgs(cls);
+        Py_DECREF(cls);
+        if (MyListDictSubclass_Type.tp_dict == NULL) {
+            return -1;
+        }
+    }
+    /* PyModule_AddType() would skip PyType_Ready() as tp_dict is set. */
+    if (PyType_Ready(&MyListDictSubclass_Type) < 0) {
+        return -1;
+    }
+    if (PyModule_AddType(m, &MyListDictSubclass_Type) < 0) {
+        return -1;
+    }
+
     if (PyType_Ready(&GenericAlias_Type) < 0)
         return -1;
     Py_INCREF(&GenericAlias_Type);
Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+Speed up class creation by resolving the special method slots of a new class`
	`2`	`+with one pass over each class dict along the MRO instead of one lookup per`
	`3`	`+slot name and per class.`