gh-117657: Fix data race in compare_unicode_unicode_threadsafe (gh-131746)

We can't safely check the type of the found key until we incref it or if we know that it's immortal.
This commit is contained in:
Sam Gross 2025-03-26 09:01:57 -04:00 committed by GitHub
parent ac12de2e6a
commit 5abff6960b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -1412,18 +1412,20 @@ compare_unicode_unicode_threadsafe(PyDictObject *mp, PyDictKeysObject *dk,
{
PyDictUnicodeEntry *ep = &((PyDictUnicodeEntry *)ep0)[ix];
PyObject *startkey = _Py_atomic_load_ptr_relaxed(&ep->me_key);
assert(startkey == NULL || PyUnicode_CheckExact(startkey));
if (startkey == key) {
assert(PyUnicode_CheckExact(startkey));
return 1;
}
if (startkey != NULL) {
if (_Py_IsImmortal(startkey)) {
assert(PyUnicode_CheckExact(startkey));
return unicode_get_hash(startkey) == hash && unicode_eq(startkey, key);
}
else {
if (!_Py_TryIncrefCompare(&ep->me_key, startkey)) {
return DKIX_KEY_CHANGED;
}
assert(PyUnicode_CheckExact(startkey));
if (unicode_get_hash(startkey) == hash && unicode_eq(startkey, key)) {
Py_DECREF(startkey);
return 1;