Skip to content

Data races in typeobject.c for type structure updates #133467

Closed
Closed
Data races in typeobject.c for type structure updates#133467
Labels
interpreter-core(Objects, Python, Grammar, and Parser dirs)topic-free-threadingtype-bugAn unexpected behavior, bug, or error

Description

@nascheme
nascheme
opened on May 5, 2025

Bug report

Bug description:

There are some additional data races (producing TSAN warnings) for typeobject.c in the free-threaded build.

The following stores are unsafe:

  • _Py_slot_tp_getattr_hook re-assigns tp_getattro
  • slot_tp_descr_get assigns to tp_descr_get
  • type_set_name assigns to tp_name
  • tp_base and tp_bases are assigned in likely unsafe ways

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

Activity

  1. nascheme
    added
    type-bugAn unexpected behavior, bug, or error
    topic-free-threading
    on May 5, 2025
  2. picnixz
    added
    interpreter-core(Objects, Python, Grammar, and Parser dirs)
    on May 7, 2025
  3. nascheme
    added 2 commits that reference this issue on May 8, 2025

    Merge branch 'main' into pythongh-133467-typeobject-tsan-suppress

    62c4ce3

    gh-133467: Add TSAN suppressions for races in typeobject (gh-133534)

    8679c8d
  4. miss-islington
    added a commit that references this issue on May 8, 2025

    pythongh-133467: Add TSAN suppressions for races in typeobject (pytho…

    4e10033
  5. nascheme
    added a commit that references this issue on May 8, 2025

    [3.14] gh-133467: Add TSAN suppressions for races in typeobject (gh-1…

    4c6fa89
  6. Pranjal095
    added a commit that references this issue on Jul 12, 2025

    pythongh-133467: Add TSAN suppressions for races in typeobject (pytho…

    f24d7c9
  7. kumaraditya303
    added a commit that references this issue on Aug 1, 2025

    gh-133467: fix data race in `type_set_name` (#137302)

    e99bc7f
  8. miss-islington
    added a commit that references this issue on Aug 1, 2025

    pythongh-133467: fix data race in `type_set_name` (pythonGH-137302)

    7f428bb
  9. taegyunkim
    added a commit that references this issue on Aug 4, 2025

    pythongh-133467: Add TSAN suppressions for races in typeobject (pytho…

    e3e1bff
  10. Agent-Hellboy
    added a commit that references this issue on Aug 19, 2025

    pythongh-133467: fix data race in `type_set_name` (python#137302)

    04549a5
  11. kumaraditya303
    added a commit that references this issue on Oct 7, 2025

    [3.14] gh-133467: fix data race in `type_set_name` (GH-137302) (#137303)

    bf397e2

  12. LindaSummer commented on Oct 14, 2025

    @LindaSummer
    LindaSummer
    on Oct 14, 2025
    Contributor

    Hi @nascheme ,

    I'm interested in the free-threading topic and want to try the 'tp_base and tp_bases are assigned in likely unsafe ways' subtask. 😊

    Best Regards,
    Edward

  13. nascheme commented on Oct 15, 2025

    @nascheme
    nascheme
    on Oct 15, 2025
    MemberAuthor

    I'm interested in the free-threading topic and want to try the 'tp_base and tp_bases are assigned in likely unsafe ways' subtask.

    I don't have specific instructions for that but here are some general thoughts. Inside typeobject.c, look at places where ->tp_base and ->tp_bases get assigned. If they are inside a function that has ASSERT_NEW_TYPE_OR_LOCKED then those should be safe. If not, you need to follow the logic to see how those functions get called. If those assignments happen after the type has been potentially revealed to other threads then the assignment is likely a data race. Possible fix would be to stop-the-world, do the assignment and then start the world again. Note that while the world is stopped, it is not safe to call most of the Python APIs. That's the reason for the complex logic related to apply_type_slot_updates(). I'm not sure but I suspect change base or bases could require similar levels of care.

  14. LindaSummer commented on Oct 16, 2025

    @LindaSummer
    LindaSummer
    on Oct 16, 2025
    Contributor

    I'm interested in the free-threading topic and want to try the 'tp_base and tp_bases are assigned in likely unsafe ways' subtask.

    I don't have specific instructions for that but here are some general thoughts. Inside typeobject.c, look at places where ->tp_base and ->tp_bases get assigned. If they are inside a function that has ASSERT_NEW_TYPE_OR_LOCKED then those should be safe. If not, you need to follow the logic to see how those functions get called. If those assignments happen after the type has been potentially revealed to other threads then the assignment is likely a data race. Possible fix would be to stop-the-world, do the assignment and then start the world again. Note that while the world is stopped, it is not safe to call most of the Python APIs. That's the reason for the complex logic related to apply_type_slot_updates(). I'm not sure but I suspect change base or bases could require similar levels of care.

    Hi @nascheme ,

    Thanks very much for your instructions! ❤ It helps me a lot and guides the way!
    I will try to construct the data race case and update if I have any new findings.

    Best Regards,
    Edward

  15. colesbury
    added a commit that references this issue on Nov 5, 2025

    gh-133467: Fix typeobject `tp_base` race in free threading (gh-140549)

    b83f379

  16. kumaraditya303 commented on Nov 12, 2025

    @kumaraditya303
    kumaraditya303
    on Nov 12, 2025
    Contributor

    Closing as all the races are fixed.

  17. kumaraditya303
    closed this as completedon Nov 12, 2025
  18. StanFromIreland
    added a commit that references this issue on Dec 6, 2025

    pythongh-133467: Fix typeobject `tp_base` race in free threading (pyt…

    59e12fb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    interpreter-core(Objects, Python, Grammar, and Parser dirs)topic-free-threadingtype-bugAn unexpected behavior, bug, or error

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions