GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-132070: Fix PyObject_Realloc thread-safety in free threaded Python by colesbury · Pull Request #143441 · python/cpython

Conversation

@colesbury

@colesbury colesbury commented Jan 5, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

The PyObject header reference count fields must be initialized using atomic operations because they may be concurrently read by another thread (e.g., from _Py_TryIncref).

  • Issue: data race when resizing unicode objects #132070

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@colesbury
pythongh-132070: Fix PyObject_Realloc thread-safety in free threaded …
a4c76a6 
…Python

The PyObject header reference count fields must be initialized using
atomic operations because they may be concurrently read by another
thread (e.g., from _Py_TryIncref).
@colesbury
colesbury requested review from Yhg1s and mpage January 5, 2026 19:25
@colesbury colesbury added skip news topic-free-threading labels Jan 5, 2026
@bedevere-app bedevere-app Bot added the awaiting core review label Jan 5, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Jan 5, 2026
data race when resizing unicode objects #132070
Closed
@colesbury

colesbury commented Jan 5, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor Author

Reimplementing the mi_realloc logic in obmalloc.c feels a bit dirty, but it also seems better than the alternatives.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Yhg1s
Yhg1s approved these changes Jan 5, 2026
View reviewed changes
Comment thread Objects/obmalloc.c Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Objects/obmalloc.c
for (size_t i = 0; i != offset; i += sizeof(void*)) {
void *word;
memcpy(&word, (char*)ptr + i, sizeof(void*));
_Py_atomic_store_ptr_relaxed((void**)((char*)newp + i), word);

@Yhg1s Yhg1s Jan 5, 2026

Copy link
Copy Markdown
Member

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there a reason for the intermediate word? And why the memcpy instead of just a cast + deref + assignment? Can't this just be:

Suggested change
_Py_atomic_store_ptr_relaxed((void**)((char*)newp + i), word);
_Py_atomic_store_ptr_relaxed((void**)((char*)newp + i), (void *)((char *)ptr + 1));

(If it can't be, it probably deserves a comment.)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@colesbury colesbury Jan 6, 2026

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

My thinking was that the memcpy avoids accessing data the pointers of an incorrect size or strict aliasing issues. For example, we read ob_flags, ob_mutex, ob_gc_bits, and ob_ref_local together as a 64-bit load (on 64-bit systems).

I guess there's still the same issue when we write the data with _Py_atomic_store_ptr_relaxed, so maybe it doesn't matter.

From what I can tell, UBSan and ASan don't check for this kind of thing.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@colesbury colesbury Jan 6, 2026

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I added a comment

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Jan 5, 2026
colesbury and others added 2 commits January 5, 2026 16:21
@colesbury @Yhg1s
Update Objects/obmalloc.c
da8b157 
Co-authored-by: T. Wouters <[email protected]>
@colesbury
Add comment about memcpy
3387cd2
@colesbury colesbury added the 🔨 test-with-refleak-buildbots Test PR w/ refleak buildbots; report in status section label Jan 6, 2026
@bedevere-bot

bedevere-bot commented Jan 6, 2026

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @colesbury for commit 3387cd2 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F143441%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-refleak-buildbots label again.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the 🔨 test-with-refleak-buildbots Test PR w/ refleak buildbots; report in status section label Jan 6, 2026
Yhg1s
Yhg1s approved these changes Jan 6, 2026
View reviewed changes
@colesbury
colesbury merged commit 98e55d7 into python:main Jan 6, 2026
56 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@colesbury
colesbury deleted the gh-132070-pyobject-realloc branch January 6, 2026 20:55
@bedevere-app bedevere-app Bot removed the awaiting merge label Jan 6, 2026
thunder-coding pushed a commit to thunder-coding/cpython that referenced this pull request Feb 15, 2026
@colesbury @thunder-coding
pythongh-132070: Fix PyObject_Realloc thread-safety in free threaded …
140f221 
…Python (pythongh-143441)

The PyObject header reference count fields must be initialized using
atomic operations because they may be concurrently read by another
thread (e.g., from `_Py_TryIncref`).
@nascheme nascheme mentioned this pull request Jul 14, 2026
Backport free-threading memory-safety fixes to 3.14 and 3.15 #153714
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Yhg1s Yhg1s Yhg1s approved these changes
@mpage mpage Awaiting requested review from mpage

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

skip news topic-free-threading

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@colesbury @bedevere-bot @Yhg1s
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.