Race on tp_version_tag under free threading #128759

hawkinsp · 2025-01-12T17:40:00Z

Bug report

Bug description:

TSAN reports a data race for the following program in a free-threaded build:

import collections.abc
import concurrent.futures
import functools
import threading

num_threads = 8

def closure(b, x):
  b.wait()
  for _ in range(10):
    type(x).__annotations__
    isinstance(x, collections.abc.Mapping)

with concurrent.futures.ThreadPoolExecutor(max_workers=num_threads) as executor:
  for i in range(1000):
    b = threading.Barrier(num_threads)
    class Foo:
      pass
    for _ in range(num_threads):
      executor.submit(functools.partial(closure, b, Foo()))

TSAN report:

WARNING: ThreadSanitizer: data race (pid=1896711)
  Read of size 4 at 0x7f766f2de990 by thread T8:
    #0 PyType_Modified /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:1053:15 (python3.13+0x305ab3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #1 type_get_annotations /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:1784:17 (python3.13+0x305ab3)
    #2 getset_get /usr/local/google/home/phawkins/p/cpython/Objects/descrobject.c:193:16 (python3.13+0x1ff888) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #3 _Py_type_getattro_impl /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:5405:19 (python3.13+0x2e955d) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #4 _Py_type_getattro /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:5465:12 (python3.13+0x2e99a0) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #5 PyObject_GetAttr /usr/local/google/home/phawkins/p/cpython/Objects/object.c:1261:18 (python3.13+0x2945c7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #6 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:3766:28 (python3.13+0x3ee2b0) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #7 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #8 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #9 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #10 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x572352) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #11 partial_vectorcall /usr/local/google/home/phawkins/p/cpython/./Modules/_functoolsmodule.c:252:16 (python3.13+0x572352)
    #12 _PyVectorcall_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:273:16 (python3.13+0x1eb2d3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #13 _PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:348:16 (python3.13+0x1eb2d3)
    #14 PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:373:12 (python3.13+0x1eb355) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #15 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:1355:26 (python3.13+0x3e4af2) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #16 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #17 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #18 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #19 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1ef62f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #20 method_vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/classobject.c:70:20 (python3.13+0x1ef62f)
    #21 _PyVectorcall_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:273:16 (python3.13+0x1eb2d3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #22 _PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:348:16 (python3.13+0x1eb2d3)
    #23 PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:373:12 (python3.13+0x1eb355) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #24 thread_run /usr/local/google/home/phawkins/p/cpython/./Modules/_threadmodule.c:337:21 (python3.13+0x564a32) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #25 pythread_wrapper /usr/local/google/home/phawkins/p/cpython/Python/thread_pthread.h:243:5 (python3.13+0x4bddb7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)

Previous atomic write of size 4 at 0x7f766f2de990 by thread T7:
    #0 _Py_atomic_store_uint32_relaxed /usr/local/google/home/phawkins/p/cpython/./Include/cpython/pyatomic_gcc.h:461:3 (python3.13+0x2e4bd9) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #1 set_version_unlocked /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:978:5 (python3.13+0x2e4bd9)
    #2 assign_version_tag /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c (python3.13+0x2e4bd9)
    #3 _PyType_LookupRef /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:5262:23 (python3.13+0x2e6495) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #4 _PyObject_GenericGetAttrWithDict /usr/local/google/home/phawkins/p/cpython/Objects/object.c:1659:13 (python3.13+0x295db9) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #5 PyObject_GenericGetAttr /usr/local/google/home/phawkins/p/cpython/Objects/object.c:1747:12 (python3.13+0x295c62) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #6 PyObject_GetAttr /usr/local/google/home/phawkins/p/cpython/Objects/object.c:1261:18 (python3.13+0x2945c7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #7 _abc__abc_instancecheck_impl /usr/local/google/home/phawkins/p/cpython/./Modules/_abc.c:625:16 (python3.13+0x56ddb7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #8 _abc__abc_instancecheck /usr/local/google/home/phawkins/p/cpython/./Modules/clinic/_abc.c.h:106:20 (python3.13+0x56ddb7)
    #9 cfunction_vectorcall_FASTCALL /usr/local/google/home/phawkins/p/cpython/Objects/methodobject.c:425:24 (python3.13+0x289e0b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #10 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1eafea) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #11 PyObject_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c:327:12 (python3.13+0x1eafea)
    #12 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:813:23 (python3.13+0x3e290b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #13 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #14 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #15 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #16 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1ef575) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #17 method_vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/classobject.c:62:18 (python3.13+0x1ef575)
    #18 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1eb482) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #19 PyObject_CallOneArg /usr/local/google/home/phawkins/p/cpython/Objects/call.c:395:12 (python3.13+0x1eb482)
    #20 object_recursive_isinstance /usr/local/google/home/phawkins/p/cpython/Objects/abstract.c:2717:25 (python3.13+0x1c3e69) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #21 PyObject_IsInstance /usr/local/google/home/phawkins/p/cpython/Objects/abstract.c:2742:12 (python3.13+0x1c3d7b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #22 builtin_isinstance_impl /usr/local/google/home/phawkins/p/cpython/Python/bltinmodule.c:2751:14 (python3.13+0x3d9e16) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #23 builtin_isinstance /usr/local/google/home/phawkins/p/cpython/Python/clinic/bltinmodule.c.h:1191:20 (python3.13+0x3d9e16)
    #24 cfunction_vectorcall_FASTCALL /usr/local/google/home/phawkins/p/cpython/Objects/methodobject.c:425:24 (python3.13+0x289e0b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #25 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1eafea) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #26 PyObject_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c:327:12 (python3.13+0x1eafea)
    #27 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:813:23 (python3.13+0x3e290b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #28 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #29 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #30 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #31 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x572352) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #32 partial_vectorcall /usr/local/google/home/phawkins/p/cpython/./Modules/_functoolsmodule.c:252:16 (python3.13+0x572352)
    #33 _PyVectorcall_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:273:16 (python3.13+0x1eb2d3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #34 _PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:348:16 (python3.13+0x1eb2d3)
    #35 PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:373:12 (python3.13+0x1eb355) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #36 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:1355:26 (python3.13+0x3e4af2) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #37 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #38 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #39 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #40 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1ef62f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #41 method_vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/classobject.c:70:20 (python3.13+0x1ef62f)
    #42 _PyVectorcall_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:273:16 (python3.13+0x1eb2d3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #43 _PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:348:16 (python3.13+0x1eb2d3)
    #44 PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:373:12 (python3.13+0x1eb355) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #45 thread_run /usr/local/google/home/phawkins/p/cpython/./Modules/_threadmodule.c:337:21 (python3.13+0x564a32) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #46 pythread_wrapper /usr/local/google/home/phawkins/p/cpython/Python/thread_pthread.h:243:5 (python3.13+0x4bddb7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)

Tested at Python 3.13 commit 65da5db

CPython versions tested on:

3.13

Operating systems tested on:

Linux

Linked PRs

The text was updated successfully, but these errors were encountered:

colesbury · 2025-01-12T20:15:05Z

Non-atomic read of type->tp_version_tag outside the lock is here:

cpython/Objects/typeobject.c

Lines 1091 to 1102 in 5e65a1a

    
           void 
        
           PyType_Modified(PyTypeObject *type) 
        
           { 
        
               // Quick check without the lock held 
        
               if (type->tp_version_tag == 0) { 
        
                   return; 
        
               } 
        
               BEGIN_TYPE_LOCK(); 
        
               type_modified_unlocked(type); 
        
               END_TYPE_LOCK(); 
        
           }

…128764) (cherry picked from commit 6e1e780) Co-authored-by: sobolevn <mail@sobolevn.me>

… (#128769) * gh-128759: fix data race in `type_modified_unlocked` (GH-128764) (cherry picked from commit 6e1e780) Co-authored-by: sobolevn <mail@sobolevn.me>

hawkinsp · 2025-01-13T14:49:03Z

Thanks!

We should use a relaxed atomic load in the free threading build in `PyType_Modified()` because that's called without the type lock held. It's not necessary to use atomics in `type_modified_unlocked()`. We should also use `FT_ATOMIC_STORE_UINT_RELAXED()` instead of the `UINT32` variant because `tp_version_tag` is declared as `unsigned int`.

…29750) We should use a relaxed atomic load in the free threading build in `PyType_Modified()` because that's called without the type lock held. It's not necessary to use atomics in `type_modified_unlocked()`. We should also use `FT_ATOMIC_STORE_UINT_RELAXED()` instead of the `UINT32` variant because `tp_version_tag` is declared as `unsigned int`. (cherry picked from commit 57f45ee) Co-authored-by: Sam Gross <colesbury@gmail.com>

…30042) We should use a relaxed atomic load in the free threading build in `PyType_Modified()` because that's called without the type lock held. It's not necessary to use atomics in `type_modified_unlocked()`. We should also use `FT_ATOMIC_STORE_UINT_RELAXED()` instead of the `UINT32` variant because `tp_version_tag` is declared as `unsigned int`. (cherry picked from commit 57f45ee)

hawkinsp added the type-bug An unexpected behavior, bug, or error label Jan 12, 2025

picnixz added interpreter-core (Objects, Python, Grammar, and Parser dirs) 3.13 bugs and security fixes topic-free-threading 3.14 new features, bugs and security fixes labels Jan 12, 2025

sobolevn added a commit to sobolevn/cpython that referenced this issue Jan 12, 2025

pythongh-128759: fix data race in type_modified_unlocked

a767905

bedevere-app bot mentioned this issue Jan 12, 2025

gh-128759: fix data race in type_modified_unlocked #128764

Merged

sobolevn added a commit that referenced this issue Jan 13, 2025

gh-128759: fix data race in type_modified_unlocked (#128764)

6e1e780

miss-islington pushed a commit to miss-islington/cpython that referenced this issue Jan 13, 2025

pythongh-128759: fix data race in type_modified_unlocked (pythonGH-…

acf7da9

…128764) (cherry picked from commit 6e1e780) Co-authored-by: sobolevn <mail@sobolevn.me>

bedevere-app bot mentioned this issue Jan 13, 2025

[3.13] gh-128759: fix data race in type_modified_unlocked (GH-128764) #128769

Merged

sobolevn added a commit to miss-islington/cpython that referenced this issue Jan 13, 2025

pythongh-128759: fix data race in type_modified_unlocked (pythonGH-…

1919228

…128764) (cherry picked from commit 6e1e780) Co-authored-by: sobolevn <mail@sobolevn.me>

kumaraditya303 closed this as completed Jan 13, 2025

colesbury mentioned this issue Feb 6, 2025

Race in type_get_annotations under free-threading #129547

Closed

bedevere-app bot mentioned this issue Feb 6, 2025

gh-128759: Fix accesses to tp_version_tag. #129750

Merged

bedevere-app bot mentioned this issue Feb 12, 2025

[3.13] gh-128759: Fix accesses to tp_version_tag. (GH-129750) #130042

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Race on tp_version_tag under free threading #128759

Race on tp_version_tag under free threading #128759

hawkinsp commented Jan 12, 2025 •

edited by bedevere-app bot

Loading

colesbury commented Jan 12, 2025

hawkinsp commented Jan 13, 2025

Race on tp_version_tag under free threading #128759

Race on tp_version_tag under free threading #128759

Comments

hawkinsp commented Jan 12, 2025 • edited by bedevere-app bot Loading

Bug report

Bug description:

CPython versions tested on:

Operating systems tested on:

Linked PRs

colesbury commented Jan 12, 2025

hawkinsp commented Jan 13, 2025

hawkinsp commented Jan 12, 2025 •

edited by bedevere-app bot

Loading