diff --git a/‎crates/vm/src/frame.rs‎
Lines changed: 5 additions & 1 deletion b/‎crates/vm/src/frame.rs‎
Lines changed: 5 additions & 1 deletion
diff --git a/‎extra_tests/snippets/vm_specialization.py‎
Lines changed: 30 additions & 0 deletions b/‎extra_tests/snippets/vm_specialization.py‎
Lines changed: 30 additions & 0 deletions
@@ -6430,7 +6430,11 @@ impl ExecutingFrame<'_> {
                 {
                     let mut vec = list.borrow_vec_mut();
                     if i < vec.len() {
-                        vec[i] = value;
+                        // Unlock before dropping the replaced element; its
+                        // finalizer may access this list.
+                        let old = core::mem::replace(&mut vec[i], value);
+                        drop(vec);
+                        drop(old);
                         return Ok(None);
                     }
                 }
 
@@ -342,3 +342,33 @@ def read():
 
 
 module_attribute_custom_dict_key()
+
+
+## STORE_SUBSCR_LIST_INT: the replaced element's finalizer can read the list
+
+
+def store_subscr_list_int_finalizer_reads_list():
+    target = [None]
+    seen = []
+
+    class Item:
+        def __init__(self, value):
+            self.value = value
+
+        def __del__(self):
+            seen.append((self.value, len(target), target[0] is self))
+
+    def store(value):
+        target[0] = value
+
+    for i in range(300):
+        store(Item(i))
+    assert any(
+        op.opname == "STORE_SUBSCR_LIST_INT"
+        for op in dis.get_instructions(store, adaptive=True)
+    )
+    store(None)
+    assert seen == [(i, 1, False) for i in range(300)]
+
+
+store_subscr_list_int_finalizer_reads_list()
Original file line number	Diff line number	Diff line change
@@ -6430,7 +6430,11 @@ impl ExecutingFrame<'_> {
6430	6430	{
6431	6431	let mut vec = list.borrow_vec_mut();
6432	6432	if i < vec.len() {
6433		- vec[i] = value;
	6433	+ // Unlock before dropping the replaced element; its
	6434	+ // finalizer may access this list.
	6435	+ let old = core::mem::replace(&mut vec[i], value);
	6436	+ drop(vec);
	6437	+ drop(old);
6434	6438	return Ok(None);
6435	6439	}
6436	6440	}