gh-124470: Fix crash when reading from object instance dictionary while replacing it #122489
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
DinoV
force-pushed
the
nogil_dict_incref
branch
3 times, most recently
from
c26d357 to
5a1b6fd
Compare
DinoV
force-pushed
the
nogil_dict_incref
branch
4 times, most recently
from
16ca39f to
0988d1a
Compare
DinoV
force-pushed
the
nogil_dict_incref
branch
2 times, most recently
from
0169a30 to
bd1c1a7
Compare
DinoV
changed the title
DinoV
force-pushed
the
nogil_dict_incref
branch
4 times, most recently
from
0146a13 to
2d05896
Compare
DinoV
requested review from
ericsnowcurrently,
methane and
markshannon
as code owners
colesbury
reviewed
Sep 26, 2024
Objects/dictobject.c
Outdated
| } | ||
|
|
||
| FT_ATOMIC_STORE_PTR(_PyObject_ManagedDictPointer(obj)->dict, | ||
| (PyDictObject *)Py_XNewRef(new_dict)); |
There was a problem hiding this comment.
nit: align (PyDictObject *)Py_XNewRef(new_dict)
DinoV
force-pushed
the
nogil_dict_incref
branch
4 times, most recently
from
1a199bf to
dc3d5ae
Compare
DinoV
changed the title
colesbury
approved these changes
Sep 30, 2024
Include/refcount.h
Outdated
| @@ -285,6 +285,7 @@ PyAPI_FUNC(void) _Py_DecRefSharedDebug(PyObject *, const char *, int); | |||
| // zero. Otherwise, the thread gives up ownership and merges the reference | |||
| // count fields. | |||
| PyAPI_FUNC(void) _Py_MergeZeroLocalRefcount(PyObject *); | |||
|
|
|||
| } | ||
|
|
||
| static int | ||
| set_or_clear_managed_dict(PyObject *obj, PyObject *new_dict, bool clear) | ||
| { | ||
| assert(Py_TYPE(obj)->tp_flags & Py_TPFLAGS_MANAGED_DICT); | ||
| assert(_PyObject_InlineValuesConsistencyCheck(obj)); |
There was a problem hiding this comment.
Do these consistency checks need to be within some sort of lock?
There was a problem hiding this comment.
The type flag one is fine, I'll add some ifdefs and lock for the inline check.
Objects/dictobject.c
Outdated
Comment on lines
7149
to
7113
| FT_ATOMIC_STORE_PTR(_PyObject_ManagedDictPointer(obj)->dict, | ||
| (PyDictObject *)Py_XNewRef(new_dict)); |
There was a problem hiding this comment.
Maybe align the wrapped line
colesbury
added
the
🔨 test-with-refleak-buildbots
|
🤖 New build scheduled with the buildbot fleet by @colesbury for commit dc3d5ae 🤖 If you want to schedule another build, you need to add the 🔨 test-with-refleak-buildbots label again. |
bedevere-bot
removed
the
🔨 test-with-refleak-buildbots
DinoV
force-pushed
the
nogil_dict_incref
branch
2 times, most recently
from
117a19e to
367e1f4
Compare
DinoV
force-pushed
the
nogil_dict_incref
branch
from
367e1f4 to
c9aee55
Compare
DinoV
added
the
🔨 test-with-refleak-buildbots
bedevere-bot
removed
the
🔨 test-with-refleak-buildbots
ebonnal
pushed a commit
to ebonnal/cpython
that referenced
this pull request
Jan 12, 2025
…ry while replacing it (python#122489) Delay free a dictionary when replacing it
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently when we have one thread reading an attribute from an object and another thread replacing the dictionary we can crash. This is because the reader thread is actually using a borrowed reference to the object and the writer will decref the dictionary and de-allocate it when replacing the dictionary.
This fixes this by changing the decref of the previous dictionary to be delayed via QSBR. We get rid of the
GC_SET_SHARED_INLINEflag which is not being used anywhere and instead we simply queue the decref via_PyObject_XDecRefDelayed.When we process these objects during GC we need to be careful because we don't want to run object finalizers during the destruction of the objects. Instead we do the same thing we do w/ merged dec refs and queue the objects to be decref'd once the world has resumed.