gh-126312: Don't traverse frozen objects on the free-threaded build

Lib/test/test_gc.py

@@ -1082,6 +1082,28 @@ def __del__(self):
         gc.collect()
         self.assertTrue(collected)
 
+    def test_traverse_frozen_objects(self):
+        # See GH-126312: Objects that were not frozen could traverse over
+        # a frozen object on the free-threaded build, which would cause
+        # a negative reference count.
+        import textwrap
+
+        # We have to run this in subprocess because
+        # freezing the GC alongside deferred reference counting
+        # causes a seperate bug, that needs to get addressed in another PR.
+        source = textwrap.dedent("""
+        import gc
+
+        x = [1, 2, 3]
+        gc.freeze()
+        y = [x]
+        y.append(y)
+        del y
+        gc.collect()
+        gc.unfreeze()
+        """)
+        assert_python_ok("-c", source)
+
 
 class IncrementalGCTests(unittest.TestCase):
 

Misc/NEWS.d/next/Core_and_Builtins/2024-11-02-14-43-46.gh-issue-126312.LMHzLT.rst

@@ -0,0 +1,2 @@
+Fix crash when traversing an object frozen by the garbage collector on the
+free-threaded build.

Python/gc_free_threading.c

@@ -439,7 +439,10 @@ process_delayed_frees(PyInterpreterState *interp)
 static int
 visit_decref(PyObject *op, void *arg)
 {
-    if (_PyObject_GC_IS_TRACKED(op) && !_Py_IsImmortal(op)) {
+    if (_PyObject_GC_IS_TRACKED(op)
+        && !_Py_IsImmortal(op)
+        && (op->ob_gc_bits & _PyGC_BITS_FROZEN) == 0
+    ) {
         // If update_refs hasn't reached this object yet, mark it
         // as (tentatively) unreachable and initialize ob_tid to zero.
         gc_maybe_init_refs(op);