`MultiDict.extend` segfaults while iterating its own entries

[marinelay]

I've been fuzzing Python C extension modules for a small research project, and this one came up.
It reproduces with the binary wheel from a plain pip install multidict.

Versions

multidict 6.7.1, CPython 3.12.3, Ubuntu 24.04 x86_64, glibc 2.39.

Reproducer

from multidict import MultiDict

mapping = MultiDict((str(index), index) for index in range(6))
mapping.extend(mapping)

Running it produces:

$ python reproducer.py
Segmentation fault (core dumped)

An ASan build reports that the source entry array is freed when the destination tble grows, then read again by the same self-extension loop:

ERROR: AddressSanitizer: heap-use-after-free
READ of size 8
    #0 md_update_from_ht  multidict/_multilib/hashtable.h:1334
    #1 _multidict_extend multidict/_multidict.c:81
    #2 multidict_extend  multidict/_multidict.c:598

This looks to me like a bug, but I'm not certain it is one.
But, even if extending a mapping with itself is not intended, I would expect it to complete or raise an exception rather than terminate the interpreter.