Free-threading: dict() crashes when a key/value pair list is mutated concurrently #159244

Crash report

In the free-threaded build, dict() and dict.update() can crash when an item of the iterable is a list that another thread mutates. merge_from_seq2_lock_held() in Objects/dictobject.c checks that the pair has two items, then reads both with PySequence_Fast_GET_ITEM(), which returns borrowed references, without holding the list's lock. A concurrent clear() in between leaves it reading from a freed or NULL item array.

import threading

pair = [object(), object()]
done = threading.Event()

def writer():
    for _ in range(10000):
        pair.clear()
        pair.extend((object(), object()))
    done.set()

def reader():
    while not done.is_set():
        try:
            dict([pair])
        except ValueError:
            pass

threads = [threading.Thread(target=writer)]
threads += [threading.Thread(target=reader) for _ in range(4)]
for t in threads:
    t.start()
for t in threads:
    t.join()

On main (aab474a) built with --disable-gil --with-pydebug --with-address-sanitizer, this crashes in every run I tried:

==420189==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008
SUMMARY: AddressSanitizer: SEGV Objects/dictobject.c:4151 in merge_from_seq2_lock_held

str.join() (gh-119247) and bytes.join() (gh-158803) had the same pattern and now use Py_BEGIN_CRITICAL_SECTION_SEQUENCE_FAST. The same code is in 3.13, 3.14 and 3.15.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 free-threading build (remotes/upstream/main:aab474a35b7, Oct 12 2026, 02:18:00) [GCC 13.3.0]

Linked PRs

• gh-159244: Fix crash in dict() on a concurrently mutated key/value pair #159245
• [3.15] gh-159244: Fix crash in dict() on a concurrently mutated key/value pair (GH-159245) #160585
• [3.14] gh-159244: Fix crash in dict() on a concurrently mutated key/value pair (GH-159245) #160587