]> git.ipfire.org Git - thirdparty/Python/cpython.git/commit
gh-142349: Fix refcount corruption in lazy import specialization (#144733)
authorPablo Galindo Salgado <Pablogsal@gmail.com>
Thu, 12 Feb 2026 11:45:28 +0000 (11:45 +0000)
committerGitHub <noreply@github.com>
Thu, 12 Feb 2026 11:45:28 +0000 (11:45 +0000)
commit072cd7c33627a90e9399d9d880d764407584b08e
treeb1a90ba078deb976381376dcdf7d94b4b76250ae
parent2e3e76e5cde34786780f5b3723f495fdbdf37c84
gh-142349: Fix refcount corruption in lazy import specialization (#144733)

Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization

_PyDict_LookupIndexAndValue() returns a borrowed reference via
_Py_dict_lookup(), but specialize_load_global_lock_held() called
Py_DECREF(value) on it when bailing out for lazy imports. Each time
the adaptive counter fired while a lazy import was still in globals,
this stole one reference from the dict's object. With 8+ threads
racing through LOAD_GLOBAL during concurrent lazy import resolution,
enough triggers accumulated to drive the refcount to zero while the
dict and other threads still referenced the object, causing
use-after-free.
Python/specialize.c