Possible data race between specialize_attr_loadclassattr and ensure_nonmanaged_dict under free-threading

[vfdev-5]

Bug report

Bug description:

I built main branch and observed the following races under free-threading in cpython 3.14 (Python 3.14.0a7+ experimental free-threading build (heads/main:e42bda94411, Apr 17 2025, 14:08:39) [Clang 18.1.3 (1ubuntu1)])

Race

==================
WARNING: ThreadSanitizer: data race (pid=921410)
  Read of size 8 at 0x7fffd22b01b8 by thread T13 (mutexes: read M0):
    #0 specialize_attr_loadclassattr /project/cpython/Python/specialize.c:1644:30 (python3.14+0x4ddf68) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #1 do_specialize_instance_load_attr /project/cpython/Python/specialize.c:1163:21 (python3.14+0x4d9fa1) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #2 specialize_instance_load_attr /project/cpython/Python/specialize.c:1340:18 (python3.14+0x4d9fa1)
    #3 _Py_Specialize_LoadAttr /project/cpython/Python/specialize.c:1368:16 (python3.14+0x4d9fa1)
    #4 _PyEval_EvalFrameDefault /project/cpython/Python/generated_cases.c.h:7674:21 (python3.14+0x410c34) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #5 _PyEval_EvalFrame /project/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.14+0x3f80f0) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #6 _PyEval_Vector /project/cpython/Python/ceval.c:1917:12 (python3.14+0x3f80f0)

...

  Previous atomic write of size 8 at 0x7fffd22b01b8 by thread T8 (mutexes: read M0):
    #0 _Py_atomic_store_ptr_release /project/cpython/./Include/cpython/pyatomic_gcc.h:565:3 (python3.14+0x283dbd) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #1 ensure_nonmanaged_dict /project/cpython/Objects/dictobject.c:7496:9 (python3.14+0x283dbd)
    #2 _PyObjectDict_SetItem /project/cpython/Objects/dictobject.c:7532:12 (python3.14+0x283e8e) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #3 _PyObject_GenericSetAttrWithDict /project/cpython/Objects/object.c:1872:19 (python3.14+0x2aa914) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #4 PyObject_GenericSetAttr /project/cpython/Objects/object.c:1900:12 (python3.14+0x2ab1d7) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #5 PyObject_SetAttr /project/cpython/Objects/object.c:1450:15 (python3.14+0x2a7ada) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #6 _PyEval_EvalFrameDefault /project/cpython/Python/generated_cases.c.h:10653:27 (python3.14+0x4197db) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #7 _PyEval_EvalFrame /project/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.14+0x3f80f0) (BuildId: d491981d76fd0b67bcb5e01a978d07da019800b8)
    #8 _PyEval_Vector /project/cpython/Python/ceval.c:1917:12 (python3.14+0x3f80f0)
 

Full report: https://gist.github.com/vfdev-5/18a83532a8589b02cd01ac21342727f6

cc @hawkinsp

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-132643: use atomic load for dict in specializer #132653

[kumaraditya303]

I think the loading of dict in specialization path should do an load on the object with offset using acquire memory ordering.

[colesbury]

Yeah, that sounds right to me.