Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Race on tp_version_tag under free threading #128759

Open
hawkinsp opened this issue Jan 12, 2025 · 1 comment
Open

Race on tp_version_tag under free threading #128759

hawkinsp opened this issue Jan 12, 2025 · 1 comment
Labels
3.13 bugs and security fixes 3.14 new features, bugs and security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) topic-free-threading type-bug An unexpected behavior, bug, or error

Comments

@hawkinsp
Copy link
Contributor

hawkinsp commented Jan 12, 2025 •
edited by bedevere-app bot
Loading

Bug report

Bug description:

TSAN reports a data race for the following program in a free-threaded build:

import collections.abc
import concurrent.futures
import functools
import threading

num_threads = 8

def closure(b, x):
  b.wait()
  for _ in range(10):
    type(x).__annotations__
    isinstance(x, collections.abc.Mapping)

with concurrent.futures.ThreadPoolExecutor(max_workers=num_threads) as executor:
  for i in range(1000):
    b = threading.Barrier(num_threads)
    class Foo:
      pass
    for _ in range(num_threads):
      executor.submit(functools.partial(closure, b, Foo()))

TSAN report:

WARNING: ThreadSanitizer: data race (pid=1896711)
  Read of size 4 at 0x7f766f2de990 by thread T8:
    #0 PyType_Modified /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:1053:15 (python3.13+0x305ab3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #1 type_get_annotations /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:1784:17 (python3.13+0x305ab3)
    #2 getset_get /usr/local/google/home/phawkins/p/cpython/Objects/descrobject.c:193:16 (python3.13+0x1ff888) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #3 _Py_type_getattro_impl /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:5405:19 (python3.13+0x2e955d) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #4 _Py_type_getattro /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:5465:12 (python3.13+0x2e99a0) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #5 PyObject_GetAttr /usr/local/google/home/phawkins/p/cpython/Objects/object.c:1261:18 (python3.13+0x2945c7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #6 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:3766:28 (python3.13+0x3ee2b0) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #7 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #8 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #9 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #10 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x572352) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #11 partial_vectorcall /usr/local/google/home/phawkins/p/cpython/./Modules/_functoolsmodule.c:252:16 (python3.13+0x572352)
    #12 _PyVectorcall_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:273:16 (python3.13+0x1eb2d3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #13 _PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:348:16 (python3.13+0x1eb2d3)
    #14 PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:373:12 (python3.13+0x1eb355) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #15 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:1355:26 (python3.13+0x3e4af2) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #16 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #17 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #18 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #19 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1ef62f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #20 method_vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/classobject.c:70:20 (python3.13+0x1ef62f)
    #21 _PyVectorcall_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:273:16 (python3.13+0x1eb2d3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #22 _PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:348:16 (python3.13+0x1eb2d3)
    #23 PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:373:12 (python3.13+0x1eb355) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #24 thread_run /usr/local/google/home/phawkins/p/cpython/./Modules/_threadmodule.c:337:21 (python3.13+0x564a32) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #25 pythread_wrapper /usr/local/google/home/phawkins/p/cpython/Python/thread_pthread.h:243:5 (python3.13+0x4bddb7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)

Previous atomic write of size 4 at 0x7f766f2de990 by thread T7:
    #0 _Py_atomic_store_uint32_relaxed /usr/local/google/home/phawkins/p/cpython/./Include/cpython/pyatomic_gcc.h:461:3 (python3.13+0x2e4bd9) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #1 set_version_unlocked /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:978:5 (python3.13+0x2e4bd9)
    #2 assign_version_tag /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c (python3.13+0x2e4bd9)
    #3 _PyType_LookupRef /usr/local/google/home/phawkins/p/cpython/Objects/typeobject.c:5262:23 (python3.13+0x2e6495) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #4 _PyObject_GenericGetAttrWithDict /usr/local/google/home/phawkins/p/cpython/Objects/object.c:1659:13 (python3.13+0x295db9) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #5 PyObject_GenericGetAttr /usr/local/google/home/phawkins/p/cpython/Objects/object.c:1747:12 (python3.13+0x295c62) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #6 PyObject_GetAttr /usr/local/google/home/phawkins/p/cpython/Objects/object.c:1261:18 (python3.13+0x2945c7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #7 _abc__abc_instancecheck_impl /usr/local/google/home/phawkins/p/cpython/./Modules/_abc.c:625:16 (python3.13+0x56ddb7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #8 _abc__abc_instancecheck /usr/local/google/home/phawkins/p/cpython/./Modules/clinic/_abc.c.h:106:20 (python3.13+0x56ddb7)
    #9 cfunction_vectorcall_FASTCALL /usr/local/google/home/phawkins/p/cpython/Objects/methodobject.c:425:24 (python3.13+0x289e0b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #10 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1eafea) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #11 PyObject_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c:327:12 (python3.13+0x1eafea)
    #12 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:813:23 (python3.13+0x3e290b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #13 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #14 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #15 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #16 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1ef575) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #17 method_vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/classobject.c:62:18 (python3.13+0x1ef575)
    #18 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1eb482) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #19 PyObject_CallOneArg /usr/local/google/home/phawkins/p/cpython/Objects/call.c:395:12 (python3.13+0x1eb482)
    #20 object_recursive_isinstance /usr/local/google/home/phawkins/p/cpython/Objects/abstract.c:2717:25 (python3.13+0x1c3e69) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #21 PyObject_IsInstance /usr/local/google/home/phawkins/p/cpython/Objects/abstract.c:2742:12 (python3.13+0x1c3d7b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #22 builtin_isinstance_impl /usr/local/google/home/phawkins/p/cpython/Python/bltinmodule.c:2751:14 (python3.13+0x3d9e16) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #23 builtin_isinstance /usr/local/google/home/phawkins/p/cpython/Python/clinic/bltinmodule.c.h:1191:20 (python3.13+0x3d9e16)
    #24 cfunction_vectorcall_FASTCALL /usr/local/google/home/phawkins/p/cpython/Objects/methodobject.c:425:24 (python3.13+0x289e0b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #25 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1eafea) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #26 PyObject_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c:327:12 (python3.13+0x1eafea)
    #27 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:813:23 (python3.13+0x3e290b) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #28 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #29 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #30 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #31 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x572352) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #32 partial_vectorcall /usr/local/google/home/phawkins/p/cpython/./Modules/_functoolsmodule.c:252:16 (python3.13+0x572352)
    #33 _PyVectorcall_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:273:16 (python3.13+0x1eb2d3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #34 _PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:348:16 (python3.13+0x1eb2d3)
    #35 PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:373:12 (python3.13+0x1eb355) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #36 _PyEval_EvalFrameDefault /usr/local/google/home/phawkins/p/cpython/Python/generated_cases.c.h:1355:26 (python3.13+0x3e4af2) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #37 _PyEval_EvalFrame /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:119:16 (python3.13+0x3dea3a) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #38 _PyEval_Vector /usr/local/google/home/phawkins/p/cpython/Python/ceval.c:1807:12 (python3.13+0x3dea3a)
    #39 _PyFunction_Vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/call.c (python3.13+0x1eb65f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #40 _PyObject_VectorcallTstate /usr/local/google/home/phawkins/p/cpython/./Include/internal/pycore_call.h:168:11 (python3.13+0x1ef62f) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #41 method_vectorcall /usr/local/google/home/phawkins/p/cpython/Objects/classobject.c:70:20 (python3.13+0x1ef62f)
    #42 _PyVectorcall_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:273:16 (python3.13+0x1eb2d3) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #43 _PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:348:16 (python3.13+0x1eb2d3)
    #44 PyObject_Call /usr/local/google/home/phawkins/p/cpython/Objects/call.c:373:12 (python3.13+0x1eb355) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #45 thread_run /usr/local/google/home/phawkins/p/cpython/./Modules/_threadmodule.c:337:21 (python3.13+0x564a32) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)
    #46 pythread_wrapper /usr/local/google/home/phawkins/p/cpython/Python/thread_pthread.h:243:5 (python3.13+0x4bddb7) (BuildId: 19c569fa942016d8ac49d19fd40ccb1ddded939b)

Tested at Python 3.13 commit 65da5db

CPython versions tested on:

3.13

Operating systems tested on:

Linux

Linked PRs
@hawkinsp hawkinsp added the type-bug An unexpected behavior, bug, or error label Jan 12, 2025
@picnixz picnixz added interpreter-core (Objects, Python, Grammar, and Parser dirs) 3.13 bugs and security fixes topic-free-threading 3.14 new features, bugs and security fixes labels Jan 12, 2025
@colesbury
Copy link
Contributor

Non-atomic read of type->tp_version_tag outside the lock is here:

cpython/Objects/typeobject.c

Lines 1091 to 1102 in 5e65a1a

void
PyType_Modified(PyTypeObject *type)
{
// Quick check without the lock held
if (type->tp_version_tag == 0) {
return;
}
BEGIN_TYPE_LOCK();
type_modified_unlocked(type);
END_TYPE_LOCK();
}

sobolevn added a commit to sobolevn/cpython that referenced this issue Jan 12, 2025
@sobolevn
pythongh-128759: fix data race in type_modified_unlocked
a767905
@bedevere-app bedevere-app bot mentioned this issue Jan 12, 2025
Merged
sobolevn added a commit that referenced this issue Jan 13, 2025
@sobolevn
gh-128759: fix data race in type_modified_unlocked (#128764)
6e1e780
miss-islington pushed a commit to miss-islington/cpython that referenced this issue Jan 13, 2025
@sobolevn @miss-islington
pythongh-128759: fix data race in type_modified_unlocked (pythonGH-…
acf7da9 
…128764)

(cherry picked from commit 6e1e780)

Co-authored-by: sobolevn <[email protected]>
@bedevere-app bedevere-app bot mentioned this issue Jan 13, 2025
Open
sobolevn added a commit to miss-islington/cpython that referenced this issue Jan 13, 2025
@sobolevn
pythongh-128759: fix data race in type_modified_unlocked (pythonGH-…
1919228 
…128764)

(cherry picked from commit 6e1e780)

Co-authored-by: sobolevn <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
3.13 bugs and security fixes 3.14 new features, bugs and security fixes interpreter-core (Objects, Python, Grammar, and Parser dirs) topic-free-threading type-bug An unexpected behavior, bug, or error
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@hawkinsp @colesbury @picnixz