gc_crash.py:
* PyObject_GC_UnTrack() + PyObject_GC_Track() is used to order objects in the GC collection 0, the objects which are involved in the reference cycle.
* BadGC2Type type is implemented in C, uses Py_TPFLAGS_HAVE_GC, implements tp_traverse, but it doesn't implement tp_clear.
* IHMO gc_crash.py is only legit code. BadGC2Type implements the GC protocol (except to tp_clear).
I'm not sure that it's the same bug than reproducer.tar.gz which uses a weak reference.
BadGC2Type is used to call a function in tp_dealloc. It should be possible to use a weak reference for that: the weak reference can use a callback. But I failed write a reproducer script using a weak reference.