From 5abff6960b4aecb0d5c81c7482cf3faa74e1983d Mon Sep 17 00:00:00 2001 From: Sam Gross Date: Wed, 26 Mar 2025 09:01:57 -0400 Subject: gh-117657: Fix data race in `compare_unicode_unicode_threadsafe` (gh-131746) We can't safely check the type of the found key until we incref it or if we know that it's immortal. --- Objects/dictobject.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/Objects/dictobject.c b/Objects/dictobject.c index 614c12b..f302fc5 100644 --- a/Objects/dictobject.c +++ b/Objects/dictobject.c @@ -1412,18 +1412,20 @@ compare_unicode_unicode_threadsafe(PyDictObject *mp, PyDictKeysObject *dk, { PyDictUnicodeEntry *ep = &((PyDictUnicodeEntry *)ep0)[ix]; PyObject *startkey = _Py_atomic_load_ptr_relaxed(&ep->me_key); - assert(startkey == NULL || PyUnicode_CheckExact(startkey)); if (startkey == key) { + assert(PyUnicode_CheckExact(startkey)); return 1; } if (startkey != NULL) { if (_Py_IsImmortal(startkey)) { + assert(PyUnicode_CheckExact(startkey)); return unicode_get_hash(startkey) == hash && unicode_eq(startkey, key); } else { if (!_Py_TryIncrefCompare(&ep->me_key, startkey)) { return DKIX_KEY_CHANGED; } + assert(PyUnicode_CheckExact(startkey)); if (unicode_get_hash(startkey) == hash && unicode_eq(startkey, key)) { Py_DECREF(startkey); return 1; -- cgit v0.12