From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Fri, 15 May 2026 13:07:18 +0000 (+0200)
Subject: [3.15] gh-149816: Fix race condition in `memoryview` with free-threading (GH-149858... 
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b3819aeff3dde744bab025b5b451182e3fc5a3a6;p=thirdparty%2FPython%2Fcpython.git

[3.15] gh-149816: Fix race condition in `memoryview` with free-threading (GH-149858) (#149875)

gh-149816: Fix race condition in `memoryview` with free-threading (GH-149858)
(cherry picked from commit 1fdf0337742762cc47837042747cc607f024a202)

Co-authored-by: sobolevn <mail@sobolevn.me>
---

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-05-15-11-31-57.gh-issue-149816.ugN2rx.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-15-11-31-57.gh-issue-149816.ugN2rx.rst
new file mode 100644
index 000000000000..016c17dd66b1
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-15-11-31-57.gh-issue-149816.ugN2rx.rst
@@ -0,0 +1 @@
+Fix a race condition in :class:`memoryview` with free-threading.
diff --git a/Objects/memoryobject.c b/Objects/memoryobject.c
index 900db864621a..9d1ca633780f 100644
--- a/Objects/memoryobject.c
+++ b/Objects/memoryobject.c
@@ -1629,11 +1629,7 @@ memory_getbuf(PyObject *_self, Py_buffer *view, int flags)
 
 
     view->obj = Py_NewRef(self);
-#ifdef Py_GIL_DISABLED
-    _Py_atomic_add_ssize(&self->exports, 1);
-#else
-    self->exports++;
-#endif
+    FT_ATOMIC_ADD_SSIZE(self->exports, 1);
 
     return 0;
 }
@@ -1642,11 +1638,7 @@ static void
 memory_releasebuf(PyObject *_self, Py_buffer *view)
 {
     PyMemoryViewObject *self = (PyMemoryViewObject *)_self;
-#ifdef Py_GIL_DISABLED
-    _Py_atomic_add_ssize(&self->exports, -1);
-#else
-    self->exports--;
-#endif
+    FT_ATOMIC_ADD_SSIZE(self->exports, -1);
     return;
     /* PyBuffer_Release() decrements view->obj after this function returns. */
 }
@@ -2434,9 +2426,9 @@ memoryview_hex_impl(PyMemoryViewObject *self, PyObject *sep,
         // Prevent 'self' from being freed if computing len(sep) mutates 'self'
         // in _Py_strhex_with_sep().
         // See: https://github.com/python/cpython/issues/143195.
-        self->exports++;
+        FT_ATOMIC_ADD_SSIZE(self->exports, 1);
         PyObject *ret = _Py_strhex_with_sep(src->buf, src->len, sep, bytes_per_sep);
-        self->exports--;
+        FT_ATOMIC_ADD_SSIZE(self->exports, -1);
         return ret;
     }
 
@@ -3363,9 +3355,9 @@ memory_hash(PyObject *_self)
         if (view->obj != NULL) {
             // Prevent 'self' from being freed when computing the item's hash.
             // See https://github.com/python/cpython/issues/142664.
-            self->exports++;
+            FT_ATOMIC_ADD_SSIZE(self->exports, 1);
             Py_hash_t h = PyObject_Hash(view->obj);
-            self->exports--;
+            FT_ATOMIC_ADD_SSIZE(self->exports, -1);
             if (h == -1) {
                 /* Keep the original error message */
                 return -1;