Race in pickle.dumps/loads per-interpreter cache leaks references
Open
Nobody has claimed this yet.
interpreter-core
topic-subinterpreters
type-bug
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 35.9k
- PR merge metrics
- PR metrics pending
Description
Bug report
Bug description:
PyObject *dumps = state->pickle.dumps;
if (dumps != NULL) {
return dumps;
}
dumps = PyImport_ImportModuleAttrString("pickle", "dumps");
if (dumps == NULL) return NULL;
state->pickle.dumps = dumps;
return dumps;
This is a check-then-act race. Two threads in the same interpreter can both run this code:
- Thread A reads state->pickle.dumps → NULL
- Thread B reads state->pickle.dumps → NULL
- Thread A imports pickle.dumps, holds a strong reference R_A
- Thread B imports pickle.dumps, holds a strong reference R_B
- Thread A stores R_A into the slot
- Thread B stores R_B into the slot, overwriting R_A
Now the slot owns R_B, and R_A is leaked forever.
CPython versions tested on:
CPython main branch
Operating systems tested on:
macOS
Linked PRs
- gh-149002
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start from the per-interpreter pickle.dumps and pickle.loads cache access shown in the report, then inspect linked PR gh-149002 to understand the work already underway. Verify the concurrent initialization and reference ownership; done means the race no longer leaks a reference.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100