Skip to content

Commit bc567fc

Browse files
committed
gh-124375: Avoid calling _PyMem_ProcessDelayed on other thread states
This fixes a crash when running the PyO3 test suite on the free-threaded build. The `qsbr` field is initialized after the `PyThreadState` is added to the interpreter's linked list -- it might still be NULL. Instead, we "steal" the queue of to-be-freed memory blocks. This is always initialized (possibly empty) and protected by the stop the world pause.
1 parent 17b3bc9 commit bc567fc

File tree

1 file changed

+12
-6
lines changed

1 file changed

+12
-6
lines changed

Python/gc_free_threading.c

Lines changed: 12 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -419,18 +419,24 @@ merge_queued_objects(_PyThreadStateImpl *tstate, struct collection_state *state)
419419
static void
420420
process_delayed_frees(PyInterpreterState *interp)
421421
{
422-
// In STW status, we can observe the latest write sequence by
423-
// advancing the write sequence immediately.
422+
// While we are in a "stop the world" pause, we can observe the latest
423+
// write sequence by advancing the write sequence immediately.
424424
_Py_qsbr_advance(&interp->qsbr);
425425
_PyThreadStateImpl *current_tstate = (_PyThreadStateImpl *)_PyThreadState_GET();
426426
_Py_qsbr_quiescent_state(current_tstate->qsbr);
427+
428+
// Merge the queues from other threads into our own queue so that we can
429+
// process all of the pending delayed free requests at once.
427430
HEAD_LOCK(&_PyRuntime);
428-
PyThreadState *tstate = interp->threads.head;
429-
while (tstate != NULL) {
430-
_PyMem_ProcessDelayed(tstate);
431-
tstate = (PyThreadState *)tstate->next;
431+
for (PyThreadState *p = interp->threads.head; p != NULL; p = p->next) {
432+
_PyThreadStateImpl *other = (_PyThreadStateImpl *)p;
433+
if (other != current_tstate) {
434+
llist_concat(&current_tstate->mem_free_queue, &other->mem_free_queue);
435+
}
432436
}
433437
HEAD_UNLOCK(&_PyRuntime);
438+
439+
_PyMem_ProcessDelayed((PyThreadState *)current_tstate);
434440
}
435441

436442
// Subtract an incoming reference from the computed "gc_refs" refcount.

0 commit comments

Comments
 (0)