Backport r60246.

Fix issue #1303614, test67.py.

Objects/object.c

@@ -1335,12 +1335,15 @@ PyObject_GenericGetAttr(PyObject *obj, PyObject *name)
 		dictptr = (PyObject **) ((char *)obj + dictoffset);
 		dict = *dictptr;
 		if (dict != NULL) {
+			Py_INCREF(dict);
 			res = PyDict_GetItem(dict, name);
 			if (res != NULL) {
 				Py_INCREF(res);
 				Py_XDECREF(descr);
+                                Py_DECREF(dict);
 				goto done;
 			}
+                        Py_DECREF(dict);
 		}
 	}
 
@@ -1421,12 +1424,14 @@ PyObject_GenericSetAttr(PyObject *obj, PyObject *name, PyObject *value)
 			*dictptr = dict;
 		}
 		if (dict != NULL) {
+			Py_INCREF(dict);
 			if (value == NULL)
 				res = PyDict_DelItem(dict, name);
 			else
 				res = PyDict_SetItem(dict, name, value);
 			if (res < 0 && PyErr_ExceptionMatches(PyExc_KeyError))
 				PyErr_SetObject(PyExc_AttributeError, name);
+			Py_DECREF(dict);
 			goto done;
 		}
 	}