gh-151895: Fix marshal.loads() crash on dict reference-tracking failure (GH-151896)

Loading a reference-tracked dictionary dereferenced a NULL pointer when
the allocation that registers it for back-references failed under low
memory.  It now raises MemoryError, matching the tuple and list paths.

Author: tonghuaroot

Misc/NEWS.d/next/Core_and_Builtins/2026-06-22-11-05-56.gh-issue-151895.QQsjUQ.rst

@@ -0,0 +1,2 @@
+Fixed a crash in :func:`marshal.loads` when an allocation failed while
+loading a reference-tracked dictionary; it now raises :exc:`MemoryError`.

Python/marshal.c

@@ -1471,6 +1471,9 @@ r_object(RFILE *p)
         }
         if (type == TYPE_DICT) {
             R_REF(v);
+            if (v == NULL) {
+                break;
+            }
         }
         else {
             idx = r_ref_reserve(flag, p);