From 0813c2a794de236bc723888b4f9455325e978bf9 Mon Sep 17 00:00:00 2001 From: Sam Gross Date: Wed, 30 Jul 2025 15:32:17 +0000 Subject: [PATCH 1/2] gh-137238: Fix data race in `_Py_slot_tp_getattr_hook` Replacing the slot isn't thread-safe if the GIL is disabled. Don't require that the slot has been replaced when specializing. --- Objects/typeobject.c | 3 +++ Python/specialize.c | 3 +-- Tools/tsan/suppressions_free_threading.txt | 1 - 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/Objects/typeobject.c b/Objects/typeobject.c index d952a58d94af55..c7e818be0d34ae 100644 --- a/Objects/typeobject.c +++ b/Objects/typeobject.c @@ -10581,7 +10581,10 @@ _Py_slot_tp_getattr_hook(PyObject *self, PyObject *name) getattr = _PyType_LookupRef(tp, &_Py_ID(__getattr__)); if (getattr == NULL) { /* No __getattr__ hook: use a simpler dispatcher */ +#ifndef Py_GIL_DISABLED + // Replacing the slot is only thread-safe if there is a GIL. tp->tp_getattro = _Py_slot_tp_getattro; +#endif return _Py_slot_tp_getattro(self, name); } /* speed hack: we could use lookup_maybe, but that would resolve the diff --git a/Python/specialize.c b/Python/specialize.c index fe8d04cf3442f1..f7f822230b1779 100644 --- a/Python/specialize.c +++ b/Python/specialize.c @@ -935,8 +935,7 @@ analyze_descriptor_load(PyTypeObject *type, PyObject *name, PyObject **descr, un PyObject *getattr = _PyType_Lookup(type, &_Py_ID(__getattr__)); has_getattr = getattr != NULL; if (has_custom_getattribute) { - if (getattro_slot == _Py_slot_tp_getattro && - !has_getattr && + if (!has_getattr && Py_IS_TYPE(getattribute, &PyFunction_Type)) { *descr = getattribute; *tp_version = ga_version; diff --git a/Tools/tsan/suppressions_free_threading.txt b/Tools/tsan/suppressions_free_threading.txt index 93421b623b92f9..31b5e179524def 100644 --- a/Tools/tsan/suppressions_free_threading.txt +++ b/Tools/tsan/suppressions_free_threading.txt @@ -43,7 +43,6 @@ race:list_inplace_repeat_lock_held race:PyObject_Realloc # gh-133467. Some of these could be hard to trigger. -race_top:_Py_slot_tp_getattr_hook race_top:slot_tp_descr_get race_top:type_set_name race_top:set_tp_bases From 75385711ea94b2110fef2edf86ce3765853bb18b Mon Sep 17 00:00:00 2001 From: Sam Gross Date: Wed, 30 Jul 2025 15:43:09 +0000 Subject: [PATCH 2/2] Remove assertion --- Python/specialize.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/Python/specialize.c b/Python/specialize.c index f7f822230b1779..38df5741f32520 100644 --- a/Python/specialize.c +++ b/Python/specialize.c @@ -1258,12 +1258,6 @@ do_specialize_instance_load_attr(PyObject* owner, _Py_CODEUNIT* instr, PyObject* return -1; case GETATTRIBUTE_IS_PYTHON_FUNCTION: { - #ifndef Py_GIL_DISABLED - // In free-threaded builds it's possible for tp_getattro to change - // after the call to analyze_descriptor. That is fine: the version - // guard will fail. - assert(type->tp_getattro == _Py_slot_tp_getattro); - #endif assert(Py_IS_TYPE(descr, &PyFunction_Type)); _PyLoadMethodCache *lm_cache = (_PyLoadMethodCache *)(instr + 1); if (!function_check_args(descr, 2, LOAD_ATTR)) {