Data race between update_one_slot and PyObject_Hash under free-threading

[vfdev-5]

Bug report

Bug description:

We have the following TSAN report from coming JAX CI:

WARNING: ThreadSanitizer: data race (pid=164981)
   Write of size 8 at 0x7ad232d8eb88 by thread T3 (mutexes: read M0):
     #0 update_one_slot /__w/jax/jax/cpython/Objects/typeobject.c (python3.14+0x30de4e) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #1 update_slots_callback /__w/jax/jax/cpython/Objects/typeobject.c:11211:9 (python3.14+0x30d0e7) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #2 update_subclasses /__w/jax/jax/cpython/Objects/typeobject.c:11390:9 (python3.14+0x30d0e7)
     #3 update_slot /__w/jax/jax/cpython/Objects/typeobject.c:11249:12 (python3.14+0x3014d5) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #4 type_update_dict /__w/jax/jax/cpython/Objects/typeobject.c:6089:16 (python3.14+0x3014d5)
     #5 type_setattro /__w/jax/jax/cpython/Objects/typeobject.c:6163:11 (python3.14+0x3014d5)
     #6 PyObject_SetAttr /__w/jax/jax/cpython/Objects/object.c:1448:15 (python3.14+0x2a7a0a) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #7 builtin_setattr_impl /__w/jax/jax/cpython/Python/bltinmodule.c:1689:9 (python3.14+0x3f29e7) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
...
   Previous read of size 8 at 0x7ad232d8eb88 by thread T8 (mutexes: read M0):
     #0 PyObject_Hash /__w/jax/jax/cpython/Objects/object.c:1148:13 (python3.14+0x2a6c44) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #1 tuple_hash /__w/jax/jax/cpython/Objects/tupleobject.c:321:27 (python3.14+0x2f38bf) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #2 PyObject_Hash /__w/jax/jax/cpython/Objects/object.c (python3.14+0x2a6c56) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #3 tuple_hash /__w/jax/jax/cpython/Objects/tupleobject.c:321:27 (python3.14+0x2f38bf) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #4 PyObject_Hash /__w/jax/jax/cpython/Objects/object.c (python3.14+0x2a6c56) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #5 bounded_lru_cache_wrapper /__w/jax/jax/cpython/./Modules/_functoolsmodule.c:1292:12 (python3.14+0x5ad168) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #6 lru_cache_call /__w/jax/jax/cpython/./Modules/_functoolsmodule.c:1581:14 (python3.14+0x5abc5a) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)
     #7 _PyObject_Call /__w/jax/jax/cpython/Objects/call.c:361:18 (python3.14+0x1f16ec) (BuildId: 48c7ba326d9f22d081e76424a9d52fc8476e98f5)

TSAN full report: https://gist.github.com/vfdev-5/ea6f46aad5ab8aba0393f790ab681398

Unfortunately, not yet have a small reproducer (WIP).

CPython version: Python 3.14.0a6+ experimental free-threading build (heads/main:8680400, Apr 6 2025, 05:24:33) [Clang 18.1.3 (1ubuntu1)]

CPython versions tested on:

3.14

Operating systems tested on:

Linux

[srinivasreddy]

I would like to take it. Can i work on it?

[sobolevn]

Sure, @srinivasreddy, please go ahead! 🤝

[colesbury]

I think this will be addressed by Neil's PR: #131174