-
-
Notifications
You must be signed in to change notification settings - Fork 34.2k
Closed as not planned
Description
Bug description:
_elementtree.c declares Py_MOD_GIL_NOT_USED but has several data races in the free-threaded build (audited for #116738):
PyDict_GetItemWithErrorin the expat entity handler returns a borrowed ref that another thread can invalidate by modifying the entity dict
concurrentlyclear_extra/element_resizemodifyself->extraand the children array without any lock — concurrentappend()+clear()on the same element
can crashelement_get_text,element_get_tail,element_get_attribreturn borrowed refs into the struct with no lock held by the caller — a concurrent write
can free the pointed-to object before it's used- All four property getters/setters (
tag,text,tail,attrib) access struct fields with no critical section __copy__snapshots struct fields without a lock__deepcopy__has the same problem and additionally callsPyDict_Nextonattribwithout a critical section on the dicttreebuilder_handle_endreadsself->stackand decrementsself->indexwithout a lock
Fix and tests in #145569.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels