gh-141805: Fix crash after concurrent addition objects with the same hash to set #143815
Conversation
… same hash to set This happens when the set contained several elements with the same hash, and then some of them were removed.
serhiy-storchaka
added
needs backport to 3.13
|
I think this also fixes #143546. (N.B.: on my system I can't trigger a crash with |
| found_unused_or_dummy: | ||
| if (freeslot == NULL) | ||
| goto found_unused; | ||
| if (freeslot->hash != -1) { |
There was a problem hiding this comment.
Can you add a comment explaining this case? I understand that it occurs if the set is modified indirectly by a PyObject_RichCompareBool() call.
rhettinger
left a comment
rhettinger
left a comment
There was a problem hiding this comment.
It took me a while to trace through this, but the fix looks correct.
All it does it verify that what was a dummy entry during the search is still a dummy entry when we're about to fill it. The root of the bug is that the PyObject_RichCompareBool call can reenter and fill the dummy slot while the original addition is still in-flight.
The cost of the edit is near zero. It only affects filling dummy objects, the entry->hash will already be in L1 cache, and the branch is 100% predictable.
|
Thanks @serhiy-storchaka for the PR 🌮🎉.. I'm working now to backport this PR to: 3.13, 3.14. |
… same hash to set (pythonGH-143815) This happens when the set contained several elements with the same hash, and then some of them were removed. (cherry picked from commit b8e925b4f8f6c5e28fbebc4f3965bf77610698b3) Co-authored-by: Serhiy Storchaka <[email protected]>
|
Sorry, @serhiy-storchaka, I could not cleanly backport this to |
|
GH-143849 is a backport of this pull request to the 3.14 branch. |
…ith the same hash to set (pythonGH-143815) This happens when the set contained several elements with the same hash, and then some of them were removed. (cherry picked from commit b8e925b) Co-authored-by: Serhiy Storchaka <[email protected]>
|
GH-143853 is a backport of this pull request to the 3.13 branch. |
…e same hash to set (GH-143815) (GH-143849) This happens when the set contained several elements with the same hash, and then some of them were removed. (cherry picked from commit b8e925b) Co-authored-by: Serhiy Storchaka <[email protected]>
4 participants
This happens when the set contained several elements with the same hash, and then some of them were removed.
repr()of a corrupted set #141805