gh-117657: Fix TSAN race in free-threaded GC (#119883)

colesbury · web-flow · commit 60593b2052ca · 2024-06-01T10:04:05.000-04:00
Only call `gc_restore_tid()` from stop-the-world contexts.
`worklist_pop()` can be called while other threads are running, so use a
relaxed atomic to modify `ob_tid`.
diff --git a/Python/gc_free_threading.c b/Python/gc_free_threading.c
@@ -86,7 +86,7 @@ worklist_pop(struct worklist *worklist)
     PyObject *op = (PyObject *)worklist->head;
     if (op != NULL) {
         worklist->head = op->ob_tid;
-        op->ob_tid = 0;
+        _Py_atomic_store_uintptr_relaxed(&op->ob_tid, 0);
     }
     return op;
 }
@@ -189,6 +189,7 @@ merge_refcount(PyObject *op, Py_ssize_t extra)
 static void
 gc_restore_tid(PyObject *op)
 {
+    assert(_PyInterpreterState_GET()->stoptheworld.world_stopped);
     mi_segment_t *segment = _mi_ptr_segment(op);
     if (_Py_REF_IS_MERGED(op->ob_ref_shared)) {
         op->ob_tid = 0;
@@ -676,7 +677,6 @@ call_weakref_callbacks(struct collection_state *state)
             Py_DECREF(temp);
         }
 
-        gc_restore_tid(op);
         Py_DECREF(op);  // drop worklist reference
     }
 }
@@ -986,7 +986,6 @@ cleanup_worklist(struct worklist *worklist)
 {
     PyObject *op;
     while ((op = worklist_pop(worklist)) != NULL) {
-        gc_restore_tid(op);
         gc_clear_unreachable(op);
         Py_DECREF(op);
     }
diff --git a/Tools/tsan/suppressions_free_threading.txt b/Tools/tsan/suppressions_free_threading.txt
@@ -37,7 +37,6 @@ race_top:_PyImport_ReleaseLock
 race_top:_PyParkingLot_Park
 race_top:_PyType_HasFeature
 race_top:assign_version_tag
-race_top:gc_restore_tid
 race_top:insertdict
 race_top:lookup_tp_dict
 race_top:mi_heap_visit_pages
@@ -64,7 +63,6 @@ race_top:list_get_item_ref
 race_top:make_pending_calls
 race_top:set_add_entry
 race_top:should_intern_string
-race_top:worklist_pop
 race_top:_PyEval_IsGILEnabled
 race_top:llist_insert_tail
 race_top:_Py_slot_tp_getattr_hook
@@ -86,7 +84,6 @@ race_top:sock_close
 race_top:tstate_delete_common
 race_top:tstate_is_freed
 race_top:type_modified_unlocked
-race_top:update_refs
 race_top:write_thread_id
 race_top:PyThreadState_Clear
 

Original file line number	Diff line number	Diff line change
`@@ -86,7 +86,7 @@ worklist_pop(struct worklist *worklist)`
`86`	`86`	`PyObject op = (PyObject )worklist->head;`
`87`	`87`	`if (op != NULL) {`
`88`	`88`	`worklist->head = op->ob_tid;`
`89`		`- op->ob_tid = 0;`
	`89`	`+ _Py_atomic_store_uintptr_relaxed(&op->ob_tid, 0);`
`90`	`90`	`}`
`91`	`91`	`return op;`
`92`	`92`	`}`
`@@ -189,6 +189,7 @@ merge_refcount(PyObject *op, Py_ssize_t extra)`
`189`	`189`	`static void`
`190`	`190`	`gc_restore_tid(PyObject *op)`
`191`	`191`	`{`
	`192`	`+ assert(_PyInterpreterState_GET()->stoptheworld.world_stopped);`
`192`	`193`	`mi_segment_t *segment = _mi_ptr_segment(op);`
`193`	`194`	`if (_Py_REF_IS_MERGED(op->ob_ref_shared)) {`
`194`	`195`	`op->ob_tid = 0;`
`@@ -676,7 +677,6 @@ call_weakref_callbacks(struct collection_state *state)`
`676`	`677`	`Py_DECREF(temp);`
`677`	`678`	`}`
`678`	`679`
`679`		`- gc_restore_tid(op);`
`680`	`680`	`Py_DECREF(op); // drop worklist reference`
`681`	`681`	`}`
`682`	`682`	`}`
`@@ -986,7 +986,6 @@ cleanup_worklist(struct worklist *worklist)`
`986`	`986`	`{`
`987`	`987`	`PyObject *op;`
`988`	`988`	`while ((op = worklist_pop(worklist)) != NULL) {`
`989`		`- gc_restore_tid(op);`
`990`	`989`	`gc_clear_unreachable(op);`
`991`	`990`	`Py_DECREF(op);`
`992`	`991`	`}`