From: sobolevn <mail@sobolevn.me>
Date: Thu, 21 May 2026 09:53:54 +0000 (+0300)
Subject: [3.14] gh-149816: Fix a race condition in `_PyBytes_FromList` with free-threading... 
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=1d4f9ab0c66378790a2482b76d84462ef0d23cf2;p=thirdparty%2FPython%2Fcpython.git

[3.14] gh-149816: Fix a race condition in `_PyBytes_FromList` with free-threading (GH-149909) (#149912)

(cherry picked from commit 46afba7b9324bc9492c3527d0fe47dd74f1f598c)
---

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-05-16-11-03-54.gh-issue-149816.X_gqMT.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-16-11-03-54.gh-issue-149816.X_gqMT.rst
new file mode 100644
index 000000000000..d35f0857a1ae
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-05-16-11-03-54.gh-issue-149816.X_gqMT.rst
@@ -0,0 +1 @@
+Fix a race condition in ``_PyBytes_FromList`` in free-threading mode.
diff --git a/Objects/bytesobject.c b/Objects/bytesobject.c
index eb13f16f6729..765589d679cc 100644
--- a/Objects/bytesobject.c
+++ b/Objects/bytesobject.c
@@ -10,6 +10,7 @@
 #include "pycore_global_objects.h"// _Py_GET_GLOBAL_OBJECT()
 #include "pycore_initconfig.h"    // _PyStatus_OK()
 #include "pycore_long.h"          // _PyLong_DigitValue
+#include "pycore_list.h"          // _PyList_GetItemRef
 #include "pycore_object.h"        // _PyObject_GC_TRACK
 #include "pycore_pymem.h"         // PYMEM_CLEANBYTE
 #include "pycore_strhex.h"        // _Py_strhex_with_sep()
@@ -2866,7 +2867,6 @@ _PyBytes_FromList(PyObject *x)
     Py_ssize_t i, size = PyList_GET_SIZE(x);
     Py_ssize_t value;
     char *str;
-    PyObject *item;
     _PyBytesWriter writer;
 
     _PyBytesWriter_Init(&writer);
@@ -2877,8 +2877,10 @@ _PyBytes_FromList(PyObject *x)
     size = writer.allocated;
 
     for (i = 0; i < PyList_GET_SIZE(x); i++) {
-        item = PyList_GET_ITEM(x, i);
-        Py_INCREF(item);
+        PyObject *item = _PyList_GetItemRef((PyListObject *)x, i);
+        if (item == NULL) {
+            goto error;
+        }
         value = PyNumber_AsSsize_t(item, NULL);
         Py_DECREF(item);
         if (value == -1 && PyErr_Occurred())