Uh oh!
There was an error while loading. Please reload this page.
gh-142349: Fix refcount corruption in lazy import specialization - #144733
Merged
Conversation
pablogsal
requested review from
kumaraditya303, ncoghlan and warsaw
as code ownersFebruary 12, 2026 08:26
pablogsalforce-pushed
the
lazy-cleanup-2
branch
from
February 12, 2026 08:26
3007570 to
239c717Comparepablogsal
commented
Feb 12, 2026
Uh oh!
There was an error while loading. Please reload this page.
Yhg1s
reviewed
Feb 12, 2026
Yhg1s
left a comment
Member
There was a problem hiding this comment.
I don't think this is good enough for a free-threaded build. The error case happens when _PyImport_LoadLazyImportTstate is called with a borrowed reference. The GIL won't be protecting that borrowed reference in a free-threaded build, so the INCREF already happens too late. We need the caller to acquire an owned reference instead, in a safe way. But... where does this happen? As far as I can tell the callers all own the reference they pass.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
pablogsal
marked this pull request as draft
February 12, 2026 10:49
pablogsal
commented
Feb 12, 2026
MemberAuthor
If that were true then there would not be crashes no? |
Yhg1s
commented
Feb 12, 2026
Member
Unless the problem is actually something different, yes :) I would like to know which it is. |
pablogsalforce-pushed
the
lazy-cleanup-2
branch
from
February 12, 2026 11:13
ca6f0f9 to
2fe3763Compare_PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
pablogsalforce-pushed
the
lazy-cleanup-2
branch
from
February 12, 2026 11:17
2fe3763 to
c7defe2Comparepablogsal
marked this pull request as ready for review
February 12, 2026 11:21
pablogsal
commented
Feb 12, 2026
MemberAuthor
Narrator: and the problem was indeed something different. Kind of |
Yhg1s
approved these changes
Feb 12, 2026
Yhg1s
enabled auto-merge (squash)
February 12, 2026 11:22
kumaraditya303
approved these changes
Feb 12, 2026
Uh oh!
There was an error while loading. Please reload this page.
thunder-coding pushed a commit
to thunder-coding/cpython
that referenced
this pull request
Feb 15, 2026
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
pablogsal added a commit
to pablogsal/cpython
that referenced
this pull request
Feb 15, 2026
Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
pablogsal added a commit
to pablogsal/cpython
that referenced
this pull request
Feb 15, 2026
Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
pablogsal added a commit
that referenced
this pull request
Feb 15, 2026
brijkapadia pushed a commit
to brijkapadia/cpython
that referenced
this pull request
Feb 28, 2026
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
brijkapadia pushed a commit
to brijkapadia/cpython
that referenced
this pull request
Feb 28, 2026
…) (python#144838) Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
ljfp pushed a commit
to ljfp/cpython
that referenced
this pull request
Apr 25, 2026
python#144733) Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
ljfp pushed a commit
to ljfp/cpython
that referenced
this pull request
Apr 25, 2026
…) (python#144838) Add a regression test ensuring that circular lazy imports raise a proper error (ImportCycleError) instead of crashing with a segfault. The crash was fixed in pythongh-144733 but no test was added at the time.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
_PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.