Merge branch 'main' into gc-debug-ft-race

Author: nascheme

Doc/library/concurrent.interpreters.rst

@@ -224,11 +224,15 @@ This module defines the following functions:
    Initialize a new (idle) Python interpreter
    and return a :class:`Interpreter` object for it.
 
-.. function:: create_queue()
+.. function:: create_queue(maxsize=0)
 
    Initialize a new cross-interpreter queue and return a :class:`Queue`
    object for it.
 
+   *maxsize* is an integer that sets the upperbound limit on the number of
+   items that can be placed in the queue. Insertion will be blocked once this
+   size has been reached, until queue items are consumed. If *maxsize* is
+   less than or equal to zero, the queue size is infinite.
 
 Interpreter objects
 ^^^^^^^^^^^^^^^^^^^
@@ -268,7 +272,7 @@ Interpreter objects
       Some objects are actually shared and some are copied efficiently,
       but most are copied via :mod:`pickle`.  See :ref:`interp-object-sharing`.
 
-   .. method:: exec(code, /, dedent=True)
+   .. method:: exec(code, /)
 
       Run the given source code in the interpreter (in the current thread).
 
@@ -319,7 +323,9 @@ Communicating Between Interpreters
 .. class:: Queue(id)
 
    A wrapper around a low-level, cross-interpreter queue, which
-   implements the :class:`queue.Queue` interface.  The underlying queue
+   implements all the methods of :class:`queue.Queue` except for
+   :meth:`~queue.Queue.task_done`, :meth:`~queue.Queue.join`
+   and :meth:`~queue.Queue.shutdown`.  The underlying queue
    can only be created through :func:`create_queue`.
 
    Some objects are actually shared and some are copied efficiently,
@@ -331,17 +337,59 @@ Communicating Between Interpreters
 
       The queue's ID.
 
+   .. method:: qsize()
 
-.. exception:: QueueEmptyError
+      Return the number of items in the queue.
+
+   .. method:: empty()
+
+      Return ``True`` if the queue is empty, ``False`` otherwise.
+
+   .. method:: full()
+
+      Return ``True`` if the queue is full, ``False`` otherwise.
+
+   .. method:: put(obj, block=True, timeout=None)
+
+      Put *obj* into the queue.  If optional args *block* is true and
+      *timeout* is ``None`` (the default), block if necessary until a free
+      slot is available.  If *timeout* is a positive number, it blocks at
+      most *timeout* seconds and raises the :exc:`QueueFull` exception if
+      no free slot was available within that time.  Otherwise (*block* is
+      false), put an object on the queue if a free slot is immediately
+      available, else raise the :exc:`QueueFull` exception (*timeout* is
+      ignored in that case).
+
+   .. method:: put_nowait(obj)
+
+      Equivalent to ``put(obj, block=False)``.
+
+   .. method:: get(block=True, timeout=None)
+
+      Remove and return an object from the queue.  If optional args *block*
+      is true and *timeout* is ``None`` (the default), block if necessary
+      until an object is available.  If *timeout* is a positive number, it
+      blocks at most *timeout* seconds and raises the :exc:`QueueEmpty`
+      exception if no object was available within that time.  Otherwise
+      (*block* is false), return an object if one is immediately available,
+      else raise the :exc:`QueueEmpty` exception (*timeout* is ignored in
+      that case).
+
+   .. method:: get_nowait()
+
+      Equivalent to ``get(block=False)``.
+
+
+.. exception:: QueueEmpty
 
    This exception, a subclass of :exc:`queue.Empty`, is raised from
-   :meth:`!Queue.get` and :meth:`!Queue.get_nowait` when the queue
+   :meth:`Queue.get` and :meth:`Queue.get_nowait` when the queue
    is empty.
 
-.. exception:: QueueFullError
+.. exception:: QueueFull
 
    This exception, a subclass of :exc:`queue.Full`, is raised from
-   :meth:`!Queue.put` and :meth:`!Queue.put_nowait` when the queue
+   :meth:`Queue.put` and :meth:`Queue.put_nowait` when the queue
    is full.
 
 
@@ -382,3 +430,17 @@ Creating an interpreter and running code in it::
 
     t = interp.call_in_thread(run)
     t.join()
+
+Communicating between interpreters with a queue::
+
+    from concurrent import interpreters
+
+    interp = interpreters.create()
+    queue = interpreters.create_queue()
+
+    def worker(queue):
+        queue.put('spam!')
+
+    t = interp.call_in_thread(worker, queue)
+    print(queue.get())
+    t.join()

Doc/library/tarfile.rst

@@ -1067,7 +1067,8 @@ can be:
 
 * the string ``'tar'``: Honor most *tar*-specific features (i.e. features of
   UNIX-like filesystems), but block features that are very likely to be
-  surprising or malicious. See :func:`tar_filter` for details.
+  surprising or malicious. Note that this filter does not limit the targets of
+  symbolic links. See :func:`tar_filter` for details.
 
 * the string ``'data'``: Ignore or block most features specific to UNIX-like
   filesystems. Intended for extracting cross-platform data archives.
@@ -1135,6 +1136,17 @@ reused in custom filters:
 
   Return the modified ``TarInfo`` member.
 
+  .. warning::
+     This filter does not check :attr:`TarInfo.linkname`. This means it does
+     not limit where a symbolic link member points. An absolute symbolic-link
+     target will remain absolute, and a relative target may resolve outside the
+     extraction destination. The destination path protection described above
+     concerns only where the archive member itself is written, not where a
+     symbolic link resolves. The stricter :func:`data_filter` rejects these
+     unsafe link targets, raising :class:`~tarfile.AbsoluteLinkError` for
+     absolute link targets or :class:`~tarfile.LinkOutsideDestinationError`
+     for link targets outside the destination.
+
   .. versionchanged:: next
 
      Filenames containing ``..`` components are now normalized.

Doc/tools/removed-ids.txt

@@ -114,3 +114,7 @@ library/turtle.html: changes-since-python-3-0
 # 'turtle' documentation reorganisation (gh-157847)
 library/turtle.html: note
 library/turtle.html: introduction
+
+# Wrong exception names in 'concurrent.interpreters' docs (gh-136563)
+library/concurrent.interpreters.html: concurrent.interpreters.QueueEmptyError
+library/concurrent.interpreters.html: concurrent.interpreters.QueueFullError

Lib/test/test_free_threading/test_weakref.py

@@ -0,0 +1,92 @@
+"""Regression tests for weakref races in subtype_getweakref() (gh-149816)."""
+
+import gc
+import sys
+import unittest
+import weakref
+
+from test.support import threading_helper
+
+
+@threading_helper.requires_working_threading()
+class TestWeakrefRaces(unittest.TestCase):
+
+    ITERATIONS = 5_000
+
+    def test_getweakref_no_crash(self):
+        """obj.__weakref__ racing with concurrent weakref creation/destruction."""
+        class Target:
+            pass
+
+        obj = Target()
+
+        def reader():
+            for _ in range(self.ITERATIONS):
+                ref = obj.__weakref__
+                self.assertIn(type(ref), (type(None), weakref.ref))
+                if ref is not None:
+                    self.assertIn(ref(), (None, obj))
+
+        def mutator():
+            for _ in range(self.ITERATIONS):
+                weakref.ref(obj, lambda _: None)
+
+        threading_helper.run_concurrently([reader, mutator])
+
+    def test_getweakref_return_type(self):
+        """__weakref__ must return None or a live weakref.ref."""
+        class Target:
+            pass
+
+        obj = Target()
+
+        self.assertIsNone(obj.__weakref__)
+
+        ref = weakref.ref(obj)
+        result = obj.__weakref__
+        self.assertIsInstance(result, weakref.ref)
+        self.assertIs(result(), obj)
+
+        del ref, result
+        gc.collect()
+        self.assertIsNone(obj.__weakref__)
+
+    def test_getweakref_no_refcount_leak(self):
+        """Each __weakref__ access must not inflate the weakref's refcount."""
+        class Target:
+            pass
+
+        obj = Target()
+        ref = weakref.ref(obj)
+        before = sys.getrefcount(ref)
+
+        for _ in range(1_000):
+            r = obj.__weakref__
+            del r
+
+        gc.collect()
+        self.assertEqual(sys.getrefcount(ref), before)
+
+    def test_getweakref_many_readers(self):
+        """Multiple concurrent readers and mutators must not crash."""
+        class Target:
+            pass
+
+        obj = Target()
+        n = 4
+        iters = self.ITERATIONS // n
+
+        def reader():
+            for _ in range(iters):
+                ref = obj.__weakref__
+                self.assertIn(type(ref), (type(None), weakref.ref))
+
+        def mutator():
+            for _ in range(iters):
+                weakref.ref(obj, lambda _: None)
+
+        threading_helper.run_concurrently([reader] * n + [mutator] * n)
+
+
+if __name__ == "__main__":
+    unittest.main()

Misc/NEWS.d/next/Core_and_Builtins/2026-05-22-17-10-29.gh-issue-149816.u1-iqT.rst

@@ -0,0 +1,2 @@
+Fix a Use-After-Free race condition in ``subtype_getweakref()`` during
+concurrent weakref creation and destruction in the free-threading build.

Objects/typeobject.c

@@ -4058,12 +4058,24 @@ subtype_getweakref(PyObject *obj, void *context)
     _PyObject_ASSERT((PyObject *)type,
                      ((type->tp_weaklistoffset + (Py_ssize_t)sizeof(PyObject *))
                       <= type->tp_basicsize));
+
+    /* Synchronize with weakref creation/destruction so the list head cannot
+     * be removed and freed between loading it and taking a reference. */
+    LOCK_WEAKREFS(obj);
     weaklistptr = (PyObject **)((char *)obj + type->tp_weaklistoffset);
-    if (*weaklistptr == NULL)
-        result = Py_None;
-    else
+    if (*weaklistptr == NULL) {
+        result = Py_NewRef(Py_None);
+    }
+    else if (_Py_TryIncref(*weaklistptr)) {
         result = *weaklistptr;
-    return Py_NewRef(result);
+    }
+    else {
+        result = Py_NewRef(Py_None);
+    }
+
+    UNLOCK_WEAKREFS(obj);
+
+    return result;
 }
 
 /* getset definitions for common descriptors */