Commit fd3304f
gh-146022: Fix free-threading crash in xml.etree.ElementTree's Element
_elementtree.c declares Py_MOD_GIL_NOT_USED but has no locking at all,
so concurrent readers and writers race on the Element type's internal
ElementObjectExtra struct (self->extra). For example, Element.clear()
sets self->extra to NULL and frees the old struct while another thread
concurrently indexes or measures the length of the same element,
causing a use-after-free/NULL-deref segfault.
Add the standard Py_BEGIN/END_CRITICAL_SECTION locking to every raw C
slot (__getitem__, __setitem__, __len__, __bool__, and the two
subscript slots, via the established *_lock_held extraction pattern
for functions with multiple return paths) and every tag/text/tail/attrib
property accessor, and add @critical_section Argument Clinic
annotations to the methods that read or write self->extra (append,
clear, extend, insert, remove, set, get, items, keys, find/findtext/
findall, __copy__/__deepcopy__/__sizeof__/__getstate__/__setstate__).
Verified against the reported crash reproducer (reliably segfaults
without this change, does not with it), a broader multithreaded stress
test exercising every touched method concurrently, and the full
test_xml_etree/test_xml_etree_c suites on both a regular and a
free-threaded (--disable-gil) Windows build.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>1 parent e620377 commit fd3304f
3 files changed
Lines changed: 209 additions & 67 deletions
File tree
- Misc/NEWS.d/next/Library
- Modules
- clinic
Lines changed: 7 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
| 1 | + | |
| 2 | + | |
| 3 | + | |
| 4 | + | |
| 5 | + | |
| 6 | + | |
| 7 | + | |
0 commit comments