gh-150277: Make _STORE_ATTR_SLOT lock-free on the free-threaded build

Lib/test/test_free_threading/test_slots.py

@@ -304,3 +304,21 @@ def reader():
  spam_new.T_CHAR
 
  run_in_threads([writer, reader])
+
+ def test_T_OBJECT(self):
+ # _Py_T_OBJECT exercises PyMember_GetOne / PyMember_SetOne for
+ # the object case from concurrent threads. Uses
+ # _testcapi.HeapCTypeWithDict which exposes its `dict` slot as a
+ # `_Py_T_OBJECT` member named `dictobj`.
+ obj = _testcapi.HeapCTypeWithDict()
+
+ def writer():
+ for i in range(1_000):
+ obj.dictobj = {"k": i}
+
+ def reader():
+ for _ in range(1_000):
+ v = obj.dictobj
+ assert v is None or isinstance(v, dict)
+
+ run_in_threads([writer, reader])

Misc/NEWS.d/next/Core_and_Builtins/2026-05-26-06-14-41.gh-issue-150277.Oz-ns0.rst

@@ -0,0 +1 @@
+Improve performance of storing attributes in slotted classes.

Python/bytecodes.c

@@ -3226,14 +3226,21 @@ dummy_func(
  op(_STORE_ATTR_SLOT, (index/1, value, owner -- o)) {
  PyObject *owner_o = PyStackRef_AsPyObjectBorrow(owner);
 
- DEOPT_IF(!LOCK_OBJECT(owner_o));
  char *addr = (char *)owner_o + index;
  STAT_INC(STORE_ATTR, hit);
+ // Atomic exchange of the slot pointer. Each concurrent writer
+ // observes a unique old value, so Py_XDECREF below cannot
+ // double-free. Concurrent readers (_LOAD_ATTR_SLOT,
+ // PyMember_GetOne) cope via _Py_TryIncrefCompare.
+#ifdef Py_GIL_DISABLED
+ PyObject *old_value = _Py_atomic_exchange_ptr(
+ (void **)addr, PyStackRef_AsPyObjectSteal(value));
+#else
  PyObject *old_value = *(PyObject **)addr;
- FT_ATOMIC_STORE_PTR_RELEASE(*(PyObject **)addr, PyStackRef_AsPyObjectSteal(value));
- UNLOCK_OBJECT(owner_o);
- INPUTS_DEAD();
+ *(PyObject **)addr = PyStackRef_AsPyObjectSteal(value);
+#endif
  o = owner;
+ DEAD(owner);
  Py_XDECREF(old_value);
  }
 

Python/structmember.c

@@ -97,36 +97,33 @@ PyMember_GetOne(const char *obj_addr, PyMemberDef *l)
  break;
  }
  case _Py_T_OBJECT:
- v = FT_ATOMIC_LOAD_PTR(*(PyObject **) addr);
- if (v != NULL) {
 #ifdef Py_GIL_DISABLED
- if (!_Py_TryIncrefCompare((PyObject **) addr, v)) {
- Py_BEGIN_CRITICAL_SECTION((PyObject *) obj_addr);
- v = FT_ATOMIC_LOAD_PTR(*(PyObject **) addr);
- Py_XINCREF(v);
- Py_END_CRITICAL_SECTION();
- }
+ // _Py_XGetRef does an atomic load + try-incref loop, retrying when
+ // a concurrent writer (lock-free atomic exchange in _STORE_ATTR_SLOT
+ // and PyMember_SetOne) mutates the slot. The previous critical-
+ // section fallback assumed writers also took ob_mutex, which they no
+ // longer do, so a plain Py_XINCREF inside the CS could resurrect a
+ // refcount-0 (about-to-be-freed) object.
+ v = _Py_XGetRef((PyObject **)addr);
 #else
- Py_INCREF(v);
+ v = *(PyObject **)addr;
+ Py_XINCREF(v);
 #endif
- }
  if (v == NULL) {
- v = Py_None;
+ v = Py_None; // immortal, no incref needed
  }
  break;
  case Py_T_OBJECT_EX:
+#ifdef Py_GIL_DISABLED
+ v = _Py_XGetRef((PyObject **)addr);
+ if (v == NULL) {
+ PyErr_Format(PyExc_AttributeError,
+ "'%T' object has no attribute '%s'",
+ (PyObject *)obj_addr, l->name);
+ }
+#else
  v = member_get_object(addr, obj_addr, l);
-#ifndef Py_GIL_DISABLED
  Py_XINCREF(v);
-#else
- if (v != NULL) {
- if (!_Py_TryIncrefCompare((PyObject **) addr, v)) {
- Py_BEGIN_CRITICAL_SECTION((PyObject *) obj_addr);
- v = member_get_object(addr, obj_addr, l);
- Py_XINCREF(v);
- Py_END_CRITICAL_SECTION();
- }
- }
 #endif
  break;
  case Py_T_LONGLONG:
@@ -320,11 +317,15 @@ PyMember_SetOne(char *addr, PyMemberDef *l, PyObject *v)
  break;
  }
  case _Py_T_OBJECT:
- case Py_T_OBJECT_EX:
- Py_BEGIN_CRITICAL_SECTION(obj);
+ case Py_T_OBJECT_EX: {
+ // Lock-free atomic exchange; matches _STORE_ATTR_SLOT.
+ PyObject *new_v = Py_XNewRef(v);
+#ifdef Py_GIL_DISABLED
+ oldv = (PyObject *)_Py_atomic_exchange_ptr((void **)addr, new_v);
+#else
  oldv = *(PyObject **)addr;
-FT_ATOMIC_STORE_PTR_RELEASE(*(PyObject **)addr, Py_XNewRef(v));
- Py_END_CRITICAL_SECTION();
+ *(PyObject **)addr = new_v;
+#endif
  if (v == NULL && oldv == NULL && l->type == Py_T_OBJECT_EX) {
  // Raise an exception when attempting to delete an already deleted
  // attribute.
@@ -336,6 +337,7 @@ PyMember_SetOne(char *addr, PyMemberDef *l, PyObject *v)
  }
  Py_XDECREF(oldv);
  break;
+ }
  case Py_T_CHAR: {
  const char *string;
  Py_ssize_t len;

Tools/cases_generator/analyzer.py

@@ -701,6 +701,7 @@ def has_error_without_pop(op: parser.CodeDef) -> bool:
  "_Py_TryIncrefCompare",
  "_Py_TryIncrefCompareStackRef",
  "_Py_atomic_compare_exchange_uint8",
+ "_Py_atomic_exchange_ptr",
  "_Py_atomic_load_ptr_acquire",
  "_Py_atomic_load_uintptr_relaxed",
  "_Py_set_eval_breaker_bit",