From: Sam Gross <colesbury@gmail.com>
Date: Wed, 26 Mar 2025 13:01:57 +0000 (-0400)
Subject: gh-117657: Fix data race in `compare_unicode_unicode_threadsafe` (gh-131746)
X-Git-Tag: v3.14.0a7~185
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5abff6960b4aecb0d5c81c7482cf3faa74e1983d;p=thirdparty%2FPython%2Fcpython.git

gh-117657: Fix data race in `compare_unicode_unicode_threadsafe` (gh-131746)

We can't safely check the type of the found key until we incref it or if we know that it's immortal.
---

diff --git a/Objects/dictobject.c b/Objects/dictobject.c
index 614c12bb250a..f302fc55f4b4 100644
--- a/Objects/dictobject.c
+++ b/Objects/dictobject.c
@@ -1412,18 +1412,20 @@ compare_unicode_unicode_threadsafe(PyDictObject *mp, PyDictKeysObject *dk,
 {
     PyDictUnicodeEntry *ep = &((PyDictUnicodeEntry *)ep0)[ix];
     PyObject *startkey = _Py_atomic_load_ptr_relaxed(&ep->me_key);
-    assert(startkey == NULL || PyUnicode_CheckExact(startkey));
     if (startkey == key) {
+        assert(PyUnicode_CheckExact(startkey));
         return 1;
     }
     if (startkey != NULL) {
         if (_Py_IsImmortal(startkey)) {
+            assert(PyUnicode_CheckExact(startkey));
             return unicode_get_hash(startkey) == hash && unicode_eq(startkey, key);
         }
         else {
             if (!_Py_TryIncrefCompare(&ep->me_key, startkey)) {
                 return DKIX_KEY_CHANGED;
             }
+            assert(PyUnicode_CheckExact(startkey));
             if (unicode_get_hash(startkey) == hash && unicode_eq(startkey, key)) {
                 Py_DECREF(startkey);
                 return 1;