[3.13] gh-118561: Fix crash involving list.extend in free-threaded build (GH-118723) (#118863)

The `list_preallocate_exact` function did not zero initialize array
contents. In the free-threaded build, this could expose uninitialized
memory to concurrent readers between the call to
`list_preallocate_exact` and the filling of the array contents with
items.
(cherry picked from commit 2402715e10d00ef60fad2948d8461559d084eb36)

Co-authored-by: Sam Gross <colesbury@gmail.com>

2 files changed, 4 insertions, 1 deletions

diff --git a/Misc/NEWS.d/next/Core and Builtins/2024-05-07-16-57-56.gh-issue-118561.wNMKVd.rst b/Misc/NEWS.d/next/Core and Builtins/2024-05-07-16-57-56.gh-issue-118561.wNMKVd.rst
new file mode 100644
index 0000000..9eaf0abb
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2024-05-07-16-57-56.gh-issue-118561.wNMKVd.rst
@@ -0,0 +1,2 @@
+Fix race condition in free-threaded build where :meth:`list.extend` could expose
+uninitialied memory to concurrent readers.
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 3c4e2d2..7070165 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -192,6 +192,7 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
         return -1;
     }
     items = array->ob_item;
+    memset(items, 0, size * sizeof(PyObject *));
 #else
     items = PyMem_New(PyObject*, size);
     if (items == NULL) {
@@ -199,7 +200,7 @@ list_preallocate_exact(PyListObject *self, Py_ssize_t size)
         return -1;
     }
 #endif
-    self->ob_item = items;
+    FT_ATOMIC_STORE_PTR_RELEASE(self->ob_item, items);
     self->allocated = size;
     return 0;
 }