[3.14] gh-146452: Improve locking granularity in pickle's batch_dict_… (#150062)

[3.14] gh-146452: Improve locking granularity in pickle's batch_dict_exact and fix race condition (GH-150025)

Remove assertion that could fail in rare race condition.

Replace the coarse critical section wrapping the entire function with
fine-grained sections covering only PyDict_Next + Py_INCREF.
Also handle PyDict_Next returning 0 in the single-item fast path.
(cherry picked from commit 57a0e570d36f41b953a91bbaf4262a5d05d0391b)

diff --git a/Misc/NEWS.d/next/Library/2026-05-18-15-30-34.gh-issue-146452.RM0EVJ.rst b/Misc/NEWS.d/next/Library/2026-05-18-15-30-34.gh-issue-146452.RM0EVJ.rst
new file mode 100644 (file)
index 0000000..66f9acf
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-05-18-15-30-34.gh-issue-146452.RM0EVJ.rst
@@ -0,0 +1,2 @@
+Fix race condition when pickling dictionaries in free threaded builds. Also
+reduce critical section cover.

diff --git a/Modules/_pickle.c b/Modules/_pickle.c
index 75e1c4dea85e0041a0b43b7cd2f2c341da58aca4..201ea9af8b2a8bb88c08c231b8fba040f326efff 100644 (file)
--- a/Modules/_pickle.c
+++ b/Modules/_pickle.c
@@ -3351,9 +3351,12 @@ batch_dict(PickleState *state, PicklerObject *self, PyObject *iter, PyObject *or
  * Returns 0 on success, -1 on error.
  *
  * Note that this currently doesn't work for protocol 0.
+
+ * gh-146452: Wrap the dict iteration in a critical sections to prevent
+ * concurrent mutation from invalidating PyDict_Next() iteration state.
  */
 static int
-batch_dict_exact_impl(PickleState *state, PicklerObject *self, PyObject *obj)
+batch_dict_exact(PickleState *state, PicklerObject *self, PyObject *obj)
 {
     PyObject *key = NULL, *value = NULL;
     int i;
@@ -3370,9 +3373,19 @@ batch_dict_exact_impl(PickleState *state, PicklerObject *self, PyObject *obj)
 
     /* Special-case len(d) == 1 to save space. */
     if (dict_size == 1) {
-        PyDict_Next(obj, &ppos, &key, &value);
-        Py_INCREF(key);
-        Py_INCREF(value);
+        int next;
+        Py_BEGIN_CRITICAL_SECTION(obj);
+        next = PyDict_Next(obj, &ppos, &key, &value);
+        if (next) {
+            Py_INCREF(key);
+            Py_INCREF(value);
+        }
+        Py_END_CRITICAL_SECTION();
+        if (!next) {
+            PyErr_SetString(PyExc_RuntimeError,
+                            "dictionary changed size during iteration");
+            goto error;
+        }
         if (save(state, self, key, 0) < 0) {
             goto error;
         }
@@ -3392,9 +3405,18 @@ batch_dict_exact_impl(PickleState *state, PicklerObject *self, PyObject *obj)
         i = 0;
         if (_Pickler_Write(self, &mark_op, 1) < 0)
             return -1;
-        while (PyDict_Next(obj, &ppos, &key, &value)) {
-            Py_INCREF(key);
-            Py_INCREF(value);
+        int next;
+        while (1) {
+            Py_BEGIN_CRITICAL_SECTION(obj);
+            next = PyDict_Next(obj, &ppos, &key, &value);
+            if (next) {
+                Py_INCREF(key);
+                Py_INCREF(value);
+            }
+            Py_END_CRITICAL_SECTION();
+            if (!next) {
+                break;
+            }
             if (save(state, self, key, 0) < 0) {
                 goto error;
             }
@@ -3424,18 +3446,6 @@ error:
     return -1;
 }
 
-/* gh-146452: Wrap the dict iteration in a critical section to prevent
-   concurrent mutation from invalidating PyDict_Next() iteration state. */
-static int
-batch_dict_exact(PickleState *state, PicklerObject *self, PyObject *obj)
-{
-    int ret;
-    Py_BEGIN_CRITICAL_SECTION(obj);
-    ret = batch_dict_exact_impl(state, self, obj);
-    Py_END_CRITICAL_SECTION();
-    return ret;
-}
-
 static int
 save_dict(PickleState *state, PicklerObject *self, PyObject *obj)
 {