Skip to content

gh-149816: Fix race condition in memoryview with free-threading#149858

Merged
sobolevn merged 2 commits into
python:mainfrom
sobolevn:issue-149816-132
May 15, 2026
Merged

gh-149816: Fix race condition in memoryview with free-threading#149858
sobolevn merged 2 commits into
python:mainfrom
sobolevn:issue-149816-132

Conversation

@sobolevn
Copy link
Copy Markdown
Member

@sobolevn sobolevn commented May 15, 2026

Before:

» ./python.exe /Users/sobolev/Desktop/cpython-ft/repros/132.py         
finding: 132 memoryview.hex() export/release race
expected signal: memoryview.release() unexpectedly succeeds inside sep.__len__, or native crash/sanitizer report
parameters: seconds=30; GIL=disabled (free-threaded build); size=1048576; hexers=6; exporters=12; len_yields=1
------------------------------------------------------------------------
Exception in thread hex-1:
Fatal Python error: Segmentation fault

<Cannot show all threads while the GIL is disabled>
Stack (most recent call first):
  File "/Users/sobolev/Desktop/cpython-ft/repros/132.py", line 152 in hex_worker
  File "/Users/sobolev/Desktop/cpython/Lib/threading.py", line 1160 in run
  File "/Users/sobolev/Desktop/cpython/Lib/threading.py", line 1218 in _bootstrap_inner
  File "/Users/sobolev/Desktop/cpython/Lib/threading.py", line 1180 in _bootstrap

Current thread's C stack trace (most recent call first):
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _Py_DumpStack+0x44 [0x105012b3c]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at faulthandler_fatal_error+0x240 [0x105034d74]
  Binary file "/usr/lib/system/libsystem_platform.dylib", at _sigtramp+0x38 [0x19ce6d6a4]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _Py_strhex_impl+0x170 [0x105017858]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at memoryview_hex+0x1d8 [0x104e19fa8]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyCallMethodDescriptorFastWithKeywords_StackRef+0xcc [0x104f26100]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyEval_EvalFrameDefault+0x82a4 [0x104f2eda8]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyEval_Vector+0x340 [0x104f2511c]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyObject_VectorcallTstate+0x6c [0x104d9d318]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyObject_VectorcallPrepend+0xec [0x104d9f3b0]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at context_run+0xa4 [0x104f697d0]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyObject_VectorcallTstate+0x6c [0x104d9d318]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _Py_VectorCallInstrumentation_StackRefSteal+0x11c [0x104f25830]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyEval_EvalFrameDefault+0x4020 [0x104f2ab24]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyEval_Vector+0x340 [0x104f2511c]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyObject_VectorcallTstate+0x6c [0x104d9d318]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at _PyObject_VectorcallPrepend+0xec [0x104d9f3b0]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at thread_run+0x84 [0x1050ace48]
  Binary file "/Users/sobolev/Desktop/cpython/python.exe", at pythread_wrapper+0x1c [0x10500f810]
  Binary file "/usr/lib/system/libsystem_pthread.dylib", at _pthread_start+0x88 [0x19ce33c0c]
  Binary file "/usr/lib/system/libsystem_pthread.dylib", at thread_start+0x8 [0x19ce2eb80]
[1]    88946 segmentation fault  ./python.exe /Users/sobolev/Desktop/cpython-ft/repros/132.py

After: code snippet passes.
I am not really sure that there's an easy and predictable way to trigger this error without going really deep into implementation details and making a test too fragile.

132.py
132.md

Comment thread Objects/memoryobject.c Outdated
@picnixz picnixz changed the title gh-149816: Fix RC in memoryview with free-threading gh-149816: Fix race condition in memoryview with free-threading May 15, 2026
@sobolevn sobolevn force-pushed the issue-149816-132 branch from 7d91098 to d9d920d Compare May 15, 2026 10:17
@sobolevn
Copy link
Copy Markdown
Member Author

#143209 was backported to 3.13, but 3.13 does not have FT_ATOMIC_ADD_SSIZE, so I propose to implement local _FT_ATOMIC_ADD_SSIZE macro in Objects/memoryobject.c.

@sobolevn sobolevn added needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels May 15, 2026
@sobolevn sobolevn merged commit 1fdf033 into python:main May 15, 2026
65 checks passed
@miss-islington-app
Copy link
Copy Markdown

Thanks @sobolevn for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 15, 2026

GH-149875 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label May 15, 2026
@miss-islington-app
Copy link
Copy Markdown

Sorry, @sobolevn, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1fdf0337742762cc47837042747cc607f024a202 3.13

@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 15, 2026

GH-149876 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 15, 2026
@bedevere-app
Copy link
Copy Markdown

bedevere-app Bot commented May 15, 2026

GH-149877 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label May 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants