Skip to content

gh-151722: Fix data race on frozendict reads during construction in free-threading build #151724

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
tonghuaroot wants to merge 3 commits into from
Closed

gh-151722: Fix data race on frozendict reads during construction in free-threading build #151724

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
675a368
gh-151722: Fix data race on frozendict reads during construction in f…
tonghuaroot Jun 19, 2026
8a4795a
gh-151722: Add free-threading regression test for frozendict read race
tonghuaroot Jun 19, 2026
47a4974
gh-151722: Move frozendict free-threading regression test into test_d…
tonghuaroot Jun 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
gh-151722: Fix data race on frozendict reads during construction in f… 
…ree-threading build

len(), repr() and hash() on a frozendict read internal state without
synchronization. That is safe for a finished frozendict but not while one is
being constructed from a user mapping, where the half-built object is already
observable from other threads. Read ma_used through GET_USED() and run the
repr/hash entry-table walk inside a critical section, matching dict_repr /
set_repr and set_len; the cached hash short-circuit stays lock-free like
frozenset_hash.
  • Loading branch information
@tonghuaroot
tonghuaroot committed Jun 19, 2026
commit 675a368a1748f32745a22064f10058b3d60f7a99
4 changes: 4 additions & 0 deletions Misc/NEWS.d/next/Core_and_Builtins/2026-06-19-10-03-42.gh-issue-151722.oTiOPF.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
Fix a data race in the free-threading build where :func:`len`, :func:`repr`
and :func:`hash` on a :class:`frozendict` could observe internal state being
concurrently mutated while the ``frozendict`` was still being constructed from
a user mapping.
44 changes: 31 additions & 13 deletions Objects/dictobject.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3698,7 +3698,7 @@ dict_length(PyObject *self)
static Py_ssize_t
frozendict_length(PyObject *self)
{
return _PyAnyDict_CAST(self)->ma_used;
return GET_USED(_PyAnyDict_CAST(self));
}

PyObject *
Expand Down Expand Up @@ -4386,7 +4386,7 @@ copy_lock_held(PyObject *o, int as_frozendict)
}

mp = (PyDictObject *)o;
if (mp->ma_used == 0) {
if (GET_USED(mp) == 0) {
/* The dict is empty; just return a new dict. */
if (as_frozendict) {
return PyFrozenDict_New(NULL);
Expand Down Expand Up @@ -8264,11 +8264,14 @@ static PyObject *
frozendict_repr(PyObject *self)
{
PyDictObject *mp = _PyAnyDict_CAST(self);
if (mp->ma_used == 0) {
if (GET_USED(mp) == 0) {
return PyUnicode_FromFormat("%s()", Py_TYPE(self)->tp_name);
}

PyObject *repr = anydict_repr_impl(self);
PyObject *repr;
Py_BEGIN_CRITICAL_SECTION(self);
repr = anydict_repr_impl(self);
Py_END_CRITICAL_SECTION();
if (repr == NULL) {
return NULL;
}
Expand Down Expand Up @@ -8322,14 +8325,9 @@ frozendict_pair_hash(Py_hash_t key_hash, PyObject *value)

// Code copied from frozenset_hash()
static Py_hash_t
frozendict_hash(PyObject *op)
frozendict_hash_lock_held(PyObject *op)
{
PyFrozenDictObject *self = _PyFrozenDictObject_CAST(op);
Py_hash_t shash = FT_ATOMIC_LOAD_SSIZE_RELAXED(self->ma_hash);
if (shash != -1) {
return shash;
}

ASSERT_DICT_LOCKED(op);
PyDictObject *mp = _PyAnyDict_CAST(op);
Py_uhash_t hash = 0;

Expand All @@ -8345,7 +8343,7 @@ frozendict_hash(PyObject *op)
}

/* Factor in the number of active entries */
hash ^= ((Py_uhash_t)mp->ma_used + 1) * 1927868237UL;
hash ^= ((Py_uhash_t)GET_USED(mp) + 1) * 1927868237UL;

/* Disperse patterns arising in nested frozendicts */
hash ^= (hash >> 11) ^ (hash >> 25);
Expand All @@ -8356,10 +8354,30 @@ frozendict_hash(PyObject *op)
hash = 590923713UL;
}

FT_ATOMIC_STORE_SSIZE_RELAXED(self->ma_hash, (Py_hash_t)hash);
return (Py_hash_t)hash;
}

static Py_hash_t
frozendict_hash(PyObject *op)
{
PyFrozenDictObject *self = _PyFrozenDictObject_CAST(op);
Py_hash_t shash = FT_ATOMIC_LOAD_SSIZE_RELAXED(self->ma_hash);
if (shash != -1) {
return shash;
}

Py_hash_t hash;
Py_BEGIN_CRITICAL_SECTION(op);
hash = frozendict_hash_lock_held(op);
Py_END_CRITICAL_SECTION();
if (hash == -1) {
return -1;
}

FT_ATOMIC_STORE_SSIZE_RELAXED(self->ma_hash, hash);
return hash;
}


static PyObject *
frozendict_new(PyTypeObject *type, PyObject *args, PyObject *kwds)
Expand Down
Loading