Race on func_get_name/func_set_name under free threading

[hawkinsp]

Bug report

Bug description:

Test case (AI generated):

import concurrent.futures
import threading
import unittest


def _shared_target_fn():
  """A shared Python function whose __name__ attribute is concurrently accessed."""
  pass


class FunctionNameRaceTest(unittest.TestCase):

  def test_concurrent_get_and_set_name_race(self):
    """Concurrently read and write __name__ on a shared PyFunctionObject."""
    stop_event = threading.Event()

    def reader_worker():
      while not stop_event.is_set():
        _ = getattr(_shared_target_fn, "__name__", None)
        _ = _shared_target_fn.__name__

    def writer_worker():
      idx = 0
      while not stop_event.is_set():
        _shared_target_fn.__name__ = f"updated_name_{idx}"
        idx = (idx + 1) % 10

    with concurrent.futures.ThreadPoolExecutor(max_workers=8) as executor:
      futures = [
          executor.submit(reader_worker),
          executor.submit(reader_worker),
          executor.submit(reader_worker),
          executor.submit(reader_worker),
          executor.submit(writer_worker),
          executor.submit(writer_worker),
          executor.submit(writer_worker),
          executor.submit(writer_worker),
      ]
      # Run concurrent read/write operations for a short duration
      # to allow ThreadSanitizer to detect the unsynchronized op->func_name race.
      stop_event.wait(0.5)
      stop_event.set()
      for future in futures:
        future.result()


if __name__ == "__main__":
  unittest.main()

TSAN report:

==================
WARNING: ThreadSanitizer: data race (pid=2094959)
  Write of size 8 at 0x7fa296a18bb0 by thread T5:
    #0 func_set_name /home/phawkins/p/cpython/Objects/funcobject.c:711:5 (python+0x273dab) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #1 getset_set /home/phawkins/p/cpython/Objects/descrobject.c:250:16 (python+0x239deb) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #2 _PyObject_GenericSetAttrWithDict /home/phawkins/p/cpython/Objects/object.c:2049:19 (python+0x2e213e) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #3 PyObject_GenericSetAttr /home/phawkins/p/cpython/Objects/object.c:2120:12 (python+0x2e2a2b) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #4 PyObject_SetAttr /home/phawkins/p/cpython/Objects/object.c:1533:15 (python+0x2de756) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #5 _PyEval_EvalFrameDefault /home/phawkins/p/cpython/Python/generated_cases.c.h:12057:27 (python+0x4580fa) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #6 _PyEval_EvalFrame /home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:122:16 (python+0x43d2aa) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #7 _PyEval_Vector /home/phawkins/p/cpython/Python/ceval.c:2172:12 (python+0x43d2aa)
    #8 _PyFunction_Vectorcall /home/phawkins/p/cpython/Objects/call.c (python+0x221a63) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #9 _PyObject_VectorcallTstate /home/phawkins/p/cpython/./Include/internal/pycore_call.h:144:11 (python+0x2234a6) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #10 _PyObject_VectorcallPrepend /home/phawkins/p/cpython/Objects/call.c:855:20 (python+0x2234a6)
    #11 method_vectorcall /home/phawkins/p/cpython/Objects/classobject.c:55:12 (python+0x226a92) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #12 _PyObject_VectorcallTstate /home/phawkins/p/cpython/./Include/internal/pycore_call.h:144:11 (python+0x4937d5) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #13 context_run /home/phawkins/p/cpython/Python/context.c:731:29 (python+0x4937d5)
    #14 method_vectorcall_FASTCALL_KEYWORDS /home/phawkins/p/cpython/Objects/descrobject.c:421:24 (python+0x23acec) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #15 _PyObject_VectorcallTstate /home/phawkins/p/cpython/./Include/internal/pycore_call.h:144:11 (python+0x221418) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #16 PyObject_Vectorcall /home/phawkins/p/cpython/Objects/call.c:327:12 (python+0x221418)
    #17 _Py_VectorCallInstrumentation_StackRefSteal /home/phawkins/p/cpython/Python/ceval.c:768:11 (python+0x43dee5) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #18 _PyEval_EvalFrameDefault /home/phawkins/p/cpython/Python/generated_cases.c.h:1906:35 (python+0x443adb) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #19 _PyEval_EvalFrame /home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:122:16 (python+0x43d2aa) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #20 _PyEval_Vector /home/phawkins/p/cpython/Python/ceval.c:2172:12 (python+0x43d2aa)
    #21 _PyFunction_Vectorcall /home/phawkins/p/cpython/Objects/call.c (python+0x221a63) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #22 _PyObject_VectorcallTstate /home/phawkins/p/cpython/./Include/internal/pycore_call.h:144:11 (python+0x2234a6) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #23 _PyObject_VectorcallPrepend /home/phawkins/p/cpython/Objects/call.c:855:20 (python+0x2234a6)
    #24 method_vectorcall /home/phawkins/p/cpython/Objects/classobject.c:55:12 (python+0x226a92) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #25 _PyVectorcall_Call /home/phawkins/p/cpython/Objects/call.c:273:16 (python+0x2216fd) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #26 _PyObject_Call /home/phawkins/p/cpython/Objects/call.c:348:16 (python+0x2216fd)
    #27 PyObject_Call /home/phawkins/p/cpython/Objects/call.c:373:12 (python+0x221767) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #28 thread_run /home/phawkins/p/cpython/./Modules/_threadmodule.c:388:21 (python+0x61fd68) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #29 pythread_wrapper /home/phawkins/p/cpython/Python/thread_pthread.h:234:5 (python+0x54c16b) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)

  Previous read of size 8 at 0x7fa296a18bb0 by thread T2:
    #0 func_get_name /home/phawkins/p/cpython/Objects/funcobject.c:697:12 (python+0x273c4e) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #1 getset_get /home/phawkins/p/cpython/Objects/descrobject.c:194:16 (python+0x239baa) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #2 _PyObject_GenericGetAttrWithDict /home/phawkins/p/cpython/Objects/object.c (python+0x2df9b9) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #3 PyObject_GetOptionalAttr /home/phawkins/p/cpython/Objects/object.c:1405:19 (python+0x2dcdc3) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #4 builtin_getattr /home/phawkins/p/cpython/Python/bltinmodule.c:1325:13 (python+0x4365dc) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #5 _Py_BuiltinCallFast_StackRef /home/phawkins/p/cpython/Python/ceval.c:817:11 (python+0x445723) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #6 _PyEval_EvalFrameDefault /home/phawkins/p/cpython/Python/generated_cases.c.h:2510:35 (python+0x445723)
    #7 _PyEval_EvalFrame /home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:122:16 (python+0x43d2aa) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #8 _PyEval_Vector /home/phawkins/p/cpython/Python/ceval.c:2172:12 (python+0x43d2aa)
    #9 _PyFunction_Vectorcall /home/phawkins/p/cpython/Objects/call.c (python+0x221a63) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #10 _PyObject_VectorcallTstate /home/phawkins/p/cpython/./Include/internal/pycore_call.h:144:11 (python+0x2234a6) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #11 _PyObject_VectorcallPrepend /home/phawkins/p/cpython/Objects/call.c:855:20 (python+0x2234a6)
    #12 method_vectorcall /home/phawkins/p/cpython/Objects/classobject.c:55:12 (python+0x226a92) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #13 _PyObject_VectorcallTstate /home/phawkins/p/cpython/./Include/internal/pycore_call.h:144:11 (python+0x4937d5) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #14 context_run /home/phawkins/p/cpython/Python/context.c:731:29 (python+0x4937d5)
    #15 method_vectorcall_FASTCALL_KEYWORDS /home/phawkins/p/cpython/Objects/descrobject.c:421:24 (python+0x23acec) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #16 _PyObject_VectorcallTstate /home/phawkins/p/cpython/./Include/internal/pycore_call.h:144:11 (python+0x221418) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #17 PyObject_Vectorcall /home/phawkins/p/cpython/Objects/call.c:327:12 (python+0x221418)
    #18 _Py_VectorCallInstrumentation_StackRefSteal /home/phawkins/p/cpython/Python/ceval.c:768:11 (python+0x43dee5) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #19 _PyEval_EvalFrameDefault /home/phawkins/p/cpython/Python/generated_cases.c.h:1906:35 (python+0x443adb) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #20 _PyEval_EvalFrame /home/phawkins/p/cpython/./Include/internal/pycore_ceval.h:122:16 (python+0x43d2aa) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #21 _PyEval_Vector /home/phawkins/p/cpython/Python/ceval.c:2172:12 (python+0x43d2aa)
    #22 _PyFunction_Vectorcall /home/phawkins/p/cpython/Objects/call.c (python+0x221a63) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #23 _PyObject_VectorcallTstate /home/phawkins/p/cpython/./Include/internal/pycore_call.h:144:11 (python+0x2234a6) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #24 _PyObject_VectorcallPrepend /home/phawkins/p/cpython/Objects/call.c:855:20 (python+0x2234a6)
    #25 method_vectorcall /home/phawkins/p/cpython/Objects/classobject.c:55:12 (python+0x226a92) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #26 _PyVectorcall_Call /home/phawkins/p/cpython/Objects/call.c:273:16 (python+0x2216fd) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #27 _PyObject_Call /home/phawkins/p/cpython/Objects/call.c:348:16 (python+0x2216fd)
    #28 PyObject_Call /home/phawkins/p/cpython/Objects/call.c:373:12 (python+0x221767) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #29 thread_run /home/phawkins/p/cpython/./Modules/_threadmodule.c:388:21 (python+0x61fd68) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)
    #30 pythread_wrapper /home/phawkins/p/cpython/Python/thread_pthread.h:234:5 (python+0x54c16b) (BuildId: 76556ee2120edf1d343c27453536fde36dfa8e77)

Tested at commit 2ffab08 from main from July 28 2026.

Seen in the wild under CPython 3.14 in the JAX test suite: https://github.com/jax-ml/jax/actions/runs/30333298885/job/90192841159

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-154821: fix data races on function attributes #154826
• [3.15] gh-154821: fix data races on function attributes (GH-154826) #154829
• [3.14] gh-154821: Fix data races when setting attributes of function objects #154831

[zangjiucheng]

Confirmed on macOS 15 / arm64 with Apple clang 21 too, so it is not Linux- or x86-specific.

The failure mode is worse than a data race. It is a use-after-free, and your own test case triggers it: on a free-threaded --with-pydebug build with no sanitizer enabled, it aborts 10 out of 10 runs.

_Py_NegativeRefcount: Assertion failed: object has negative ref count
<object at 0x200081706d0 is freed>
Fatal Python error: _PyObject_AssertFailed

cpython/Objects/funcobject.c

Lines 693 to 713 in 6f7bb29

	static PyObject *
	func_get_name(PyObject *self, void *Py_UNUSED(ignored))
	{
	PyFunctionObject *op = _PyFunction_CAST(self);
	return Py_NewRef(op->func_name);
	}
	static int
	func_set_name(PyObject *self, PyObject *value, void *Py_UNUSED(ignored))
	{
	PyFunctionObject *op = _PyFunction_CAST(self);
	/* Not legal to del f.func_name or to set it to anything
	* other than a string object. */
	if (value == NULL || !PyUnicode_Check(value)) {
	PyErr_SetString(PyExc_TypeError,
	"__name__ must be set to a string object");
	return -1;
	}
	Py_XSETREF(op->func_name, Py_NewRef(value));
	return 0;
	}

func_get_name loads op->func_name and then increfs it, while func_set_name does Py_XSETREF, which stores the new pointer and then decrefs the displaced one. When that decref reaches zero in the gap, the reader increfs freed memory.

The first assignment is safe, since func_name starts out as the interned co_name and is immortal, but every later one displaces a mortal string held only by the function.

Smaller reproducer

import sys, threading

assert not sys._is_gil_enabled(), "needs a free-threaded build with PYTHON_GIL=0"

def target():
    pass

stop = threading.Event()

def reader():
    while not stop.is_set():
        for _ in range(1000):
            target.__name__

def writer():
    n = 0
    while not stop.is_set():
        for _ in range(1000):
            n += 1
            target.__name__ = str(n)

threading.Thread(target=reader, daemon=True).start()
threading.Thread(target=writer, daemon=True).start()
stop.wait(0.5)
stop.set()
print("survived")

This was flagged once already. gh-133931 says in its body, "Also, function object seems to have exactly the same problem".

The fix is merged code already: gen_get_name uses an acquire load, and gen_set_name a critical section plus _PyObject_XSetRefDelayed.

Two other readers of the field are unprotected as well:

• make_gen (genobject.c:1109-1112) increfs func_name and func_qualname on every generator and coroutine creation, so this is not only an introspection path.
• PyEval_GetFuncName (ceval.c:2912) calls PyUnicode_AsUTF8 with no incref, returning a const char * that a concurrent assignment can free.

__qualname__ is identical and belongs in the same change.

__code__, __defaults__ and __kwdefaults__ are unprotected too, but they are read lock-free on the argument-binding path, and PyFunction_GetDefaults returns a borrowed reference. Those look like a separate job.