Possible data race in `new_keys_object` in `dictobject.c`

[Naserume]

Bug report

Bug description:

During fuzzing, I found this code produce TSAN warning on no-gil build.

Reproducer:

from threading import Thread
from io import BytesIO

OBJ = BytesIO()

def test1():
    for _ in range(1000):
        setattr(OBJ, 'x', 1)
        OBJ.__dict__.pop('x', None)

def test2():
    for _ in range(1000):
        OBJ.getvalue() 

threads = []
for _ in range(4):
    threads.append(Thread(target=test1))
    threads.append(Thread(target=test2))

for t in threads:
    t.start()
for t in threads:
    t.join()

TSAN report:

WARNING: ThreadSanitizer: data race (pid=2885807)
  Write of size 1 at 0x7fffb60c0108 by thread T1:
    #0 new_keys_object /cpython/Objects/dictobject.c:795:22 (python3.15t+0x29cfbf) 
    #1 dictresize /cpython/Objects/dictobject.c:2078:15 (python3.15t+0x2a29bb) 
    #2 insertion_resize /cpython/Objects/dictobject.c:1770:12 (python3.15t+0x2a24bd) 
    #3 insert_combined_dict /cpython/Objects/dictobject.c:1787:13 (python3.15t+0x2a24bd)
    #4 insertdict /cpython/Objects/dictobject.c:1909:13 (python3.15t+0x291d6d) 
    #5 setitem_take2_lock_held /cpython/Objects/dictobject.c:2674:12 (python3.15t+0x291217) 
    #6 setitem_lock_held /cpython/Objects/dictobject.c:2711:12 (python3.15t+0x29daf3) 
    #7 _PyDict_SetItem_LockHeld /cpython/Objects/dictobject.c:6840:16 (python3.15t+0x29daf3)
    #8 _PyObjectDict_SetItem /cpython/Objects/dictobject.c:7539:11 (python3.15t+0x2a1907) 
    #9 _PyObject_GenericSetAttrWithDict /cpython/Objects/object.c:2006:19 (python3.15t+0x2c9664) 
    #10 PyObject_GenericSetAttr /cpython/Objects/object.c:2034:12 (python3.15t+0x2c9db7) 
    #11 PyObject_SetAttr /cpython/Objects/object.c:1479:15 (python3.15t+0x2c67df) 
    #12 builtin_setattr_impl /cpython/Python/bltinmodule.c:1744:9 (python3.15t+0x4199f7) 
    #13 builtin_setattr /cpython/Python/clinic/bltinmodule.c.h:692:20 (python3.15t+0x4199f7)
    #14 _Py_BuiltinCallFast_StackRefSteal /cpython/Python/ceval.c:812:11 (python3.15t+0x41f994) 
    #15 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:2322:35 (python3.15t+0x4267f4) 
    #16 _PyEval_EvalFrame /cpython/./Include/internal/pycore_ceval.h:118:16 (python3.15t+0x41e7a0) 
    #17 _PyEval_Vector /cpython/Python/ceval.c:2094:12 (python3.15t+0x41e7a0)
    #18 _PyFunction_Vectorcall /cpython/Objects/call.c (python3.15t+0x20b19f) 
    #19 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:136:11 (python3.15t+0x20f876) 
    #20 method_vectorcall /cpython/Objects/classobject.c:73:20 (python3.15t+0x20f876)
    #21 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:136:11 (python3.15t+0x471ed1) 
    #22 context_run /cpython/Python/context.c:727:29 (python3.15t+0x471ed1)
    #23 method_vectorcall_FASTCALL_KEYWORDS /cpython/Objects/descrobject.c:421:24 (python3.15t+0x2243f7) 
    #24 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:136:11 (python3.15t+0x20ab23) 
    #25 PyObject_Vectorcall /cpython/Objects/call.c:327:12 (python3.15t+0x20ab23)
    #26 _Py_VectorCallInstrumentation_StackRefSteal /cpython/Python/ceval.c:762:11 (python3.15t+0x41f3cc) 
    #27 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:1788:35 (python3.15t+0x425236) 
    #28 _PyEval_EvalFrame /cpython/./Include/internal/pycore_ceval.h:118:16 (python3.15t+0x41e7a0) 
    #29 _PyEval_Vector /cpython/Python/ceval.c:2094:12 (python3.15t+0x41e7a0)
    #30 _PyFunction_Vectorcall /cpython/Objects/call.c (python3.15t+0x20b19f) 
    #31 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:136:11 (python3.15t+0x20f876) 
    #32 method_vectorcall /cpython/Objects/classobject.c:73:20 (python3.15t+0x20f876)
    #33 _PyVectorcall_Call /cpython/Objects/call.c:273:16 (python3.15t+0x20ae2b) 
    #34 _PyObject_Call /cpython/Objects/call.c:348:16 (python3.15t+0x20ae2b)
    #35 PyObject_Call /cpython/Objects/call.c:373:12 (python3.15t+0x20ae95) 
    #36 thread_run /cpython/./Modules/_threadmodule.c:387:21 (python3.15t+0x5f03d2) 
    #37 pythread_wrapper /cpython/Python/thread_pthread.h:234:5 (python3.15t+0x521417) 

  Previous read of size 1 at 0x7fffb60c0108 by thread T2:
    #0 do_lookup /cpython/Objects/dictobject.c:1002:19 (python3.15t+0x28e1fb) 
    #1 unicodekeys_lookup_unicode_threadsafe /cpython/Objects/dictobject.c:1445:12 (python3.15t+0x28e1fb)
    #2 lookup_threadsafe_unicode /cpython/Objects/dictobject.c:1589:21 (python3.15t+0x28edc1) 
    #3 _PyDict_GetMethodStackRef /cpython/Objects/dictobject.c:1675:25 (python3.15t+0x28f031) 
    #4 _PyObject_GetMethodStackRef /cpython/Objects/object.c:1759:21 (python3.15t+0x2c8ecd) 
    #5 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:7883:35 (python3.15t+0x4317eb) 
    #6 _PyEval_EvalFrame /cpython/./Include/internal/pycore_ceval.h:118:16 (python3.15t+0x41e7a0) 
    #7 _PyEval_Vector /cpython/Python/ceval.c:2094:12 (python3.15t+0x41e7a0)
    #8 _PyFunction_Vectorcall /cpython/Objects/call.c (python3.15t+0x20b19f) 
    #9 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:136:11 (python3.15t+0x20f876) 
    #10 method_vectorcall /cpython/Objects/classobject.c:73:20 (python3.15t+0x20f876)
    #11 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:136:11 (python3.15t+0x471ed1) 
    #12 context_run /cpython/Python/context.c:727:29 (python3.15t+0x471ed1)
    #13 method_vectorcall_FASTCALL_KEYWORDS /cpython/Objects/descrobject.c:421:24 (python3.15t+0x2243f7) 
    #14 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:136:11 (python3.15t+0x20ab23) 
    #15 PyObject_Vectorcall /cpython/Objects/call.c:327:12 (python3.15t+0x20ab23)
    #16 _Py_VectorCallInstrumentation_StackRefSteal /cpython/Python/ceval.c:762:11 (python3.15t+0x41f3cc) 
    #17 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:1788:35 (python3.15t+0x425236) 
    #18 _PyEval_EvalFrame /cpython/./Include/internal/pycore_ceval.h:118:16 (python3.15t+0x41e7a0) 
    #19 _PyEval_Vector /cpython/Python/ceval.c:2094:12 (python3.15t+0x41e7a0)
    #20 _PyFunction_Vectorcall /cpython/Objects/call.c (python3.15t+0x20b19f) 
    #21 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:136:11 (python3.15t+0x20f876) 
    #22 method_vectorcall /cpython/Objects/classobject.c:73:20 (python3.15t+0x20f876)
    #23 _PyVectorcall_Call /cpython/Objects/call.c:273:16 (python3.15t+0x20ae2b) 
    #24 _PyObject_Call /cpython/Objects/call.c:348:16 (python3.15t+0x20ae2b)
    #25 PyObject_Call /cpython/Objects/call.c:373:12 (python3.15t+0x20ae95) 
    #26 thread_run /cpython/./Modules/_threadmodule.c:387:21 (python3.15t+0x5f03d2) 
    #27 pythread_wrapper /cpython/Python/thread_pthread.h:234:5 (python3.15t+0x521417)
SUMMARY: ThreadSanitizer: data race /cpython/Objects/dictobject.c:795:22 in new_keys_object 

Version: Python 3.15.0a5+ free-threading build (heads/main:48795b6460e, Jan 21 2026, 04:16:17) [Clang 18.1.3 (1ubuntu1)]

CPython versions tested on:

3.15, CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-144295: Fix data race in dict method lookup and global load #144312

[colesbury]

Thanks, I can reproduce the issue. I think the bug is that in:

• gh-134043: use stackrefs for dict lookup in _PyObject_GetMethodStackRef #136412

We are missing a ensure_shared_on_read(mp) before we access the dictionary keys without a lock. So the keys object isn't freed with QSBR and the access without a lock isn't safe.