Free-threading race betwen two Py_SETREF
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
研究方向
The race is in the Py_SETREF and Py_XSETREF macros, which copy the old pointer, store the new one, and then decref in separate non-atomic steps. Run the reproducer with a free-threaded debug build and read the assertion at Include/refcount.h:617 to confirm the negative refcount on a tuple. Done would mean the reproducer runs clean under free-threading, which needs a design decision about atomic swap semantics first.
由索引模型根據 Issue 內容生成。
描述
Bug report
This can be triggered with existing Python objects that use Py_SETREF or Py_XSETREF such as Exceptions (although slightly contrived):
import threading
e = Exception()
def worker():
for _ in range(1_000_000):
e.__init__(1)
threads = [threading.Thread(target=worker) for _ in range(2)]
for t in threads:
t.start()
for t in threads:
t.join()
Gives on a 3.16 free-threaded debug build:
../cpython/Include/refcount.h:617: _Py_NegativeRefcount: Assertion failed: object has negative ref count
Enable tracemalloc to get the memory block allocation traceback
object address : 0x2000204c3b0
object refcount : 0
object type : 0x5623737ad5c8
object type name: tuple
object repr : <refcnt 0 at 0x2000204c3b0>
Fatal Python error: _PyObject_AssertFailed: _PyObject_AssertFailed
Python runtime state: initialized
Stack (most recent call first):
File "/<home>/projects/python/setref_bug.py", line 8 in worker
File "/<home>/projects/python/cpython/Lib/threading.py", line 1161 in run
File "/<home>/projects/python/cpython/Lib/threading.py", line 1219 in _bootstrap_inner
File "/<home>/projects/python/cpython/Lib/threading.py", line 1181 in _bootstrap
[1] 397225 abort (core dumped) ./build/python setref_bug.py
This arrives because Py_SETREF copies the ref and stores a new new one as two separate non-atomic steps. So two threads can do:
T1: old = *slot
T2: old = *slot // same object as T1
T1: *slot = a
T2: *slot = b // a's reference is lost, so a leaks
T1: Py_XDECREF(old)
T2: Py_XDECREF(old) // the slot's one reference to old is dropped twice
I ran into this trying to build a cache which swapped an old value for a new value with Py_SETREF and finding it sometimes resulted in a double free when two threads swapped the value simultaneously (And ended up thinking they had the last reference).
CPython versions tested on:
3.16, CPython main branch
Operating systems tested on:
Linux
- 主要語言
- Python
- 星號
- 78.2k
- 分支
- 36.6k
- 平均合併
- 19 小時 57 分鐘
- 30 天內合併 PR
- 630
環境準備
在瀏覽器裡用你自己的 GitHub 帳號啟動這個專案的開發容器。
- 沒有 Dockerfile 或 Docker Compose 檔案
- 有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
python/cpython 的其他 Issue
-
SequenceMatcher.get_grouped_opcodes() changes the result of later get_opcodes() calls可能已有人在做 關聯的 PR 仍在進行中或已合併。 未關閉
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆
-
stdlib type-bug
難度 2/5 1-3 小時 新手友好度 75/100
維護者通常 1 天內回覆
-
extension-modules stdlib topic-XML type-bug
難度 2/5 1-3 小時 新手友好度 76/100
python/cpython#161807 · 1 則留言 ·
維護者通常 1 天內回覆
-
stdlib type-feature
難度 2/5 1-3 小時 新手友好度 78/100
python/cpython#161788 · 7 則留言 ·
維護者通常 1 天內回覆
-
extension-modules topic-IO type-bug
難度 2/5 1-3 小時 新手友好度 75/100
維護者通常 1 天內回覆
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 62/100
cpp-best-practices/project_validator#267 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 72/100
Project-N-E-K-O/N.E.K.O#3725 ·
維護者通常 1 天內回覆
-
[Bug] Sending a Telegram message chain twice duplicates mentions可能已有人在做 @123XieC 今天認領。 未關閉
難度 2/5 1-3 小時 新手友好度 72/100
AstrBotDevs/AstrBot#11125 ·
維護者通常 1 天內回覆
-
backend bug priority: high
難度 2/5 1-3 小時 新手友好度 72/100
nooriegarg/ContribIQ#73 ·
維護者通常 1 天內回覆
-
bug p3 security
難度 2/5 1-3 小時 新手友好度 68/100
維護者通常 1 天內回覆