TSAN fixes

Author: pablogsal

Objects/object.c

@@ -2682,8 +2682,8 @@ _Py_SetImmortalUntracked(PyObject *op)
     }
 #ifdef Py_GIL_DISABLED
     op->ob_tid = _Py_UNOWNED_TID;
-    op->ob_ref_local = _Py_IMMORTAL_REFCNT_LOCAL;
-    op->ob_ref_shared = 0;
+    _Py_atomic_store_uint32_relaxed(&op->ob_ref_local, _Py_IMMORTAL_REFCNT_LOCAL);
+    _Py_atomic_store_ssize_relaxed(&op->ob_ref_shared, 0);
     _Py_atomic_or_uint8(&op->ob_gc_bits, _PyGC_BITS_DEFERRED);
 #elif SIZEOF_VOID_P > 4
     op->ob_flags = _Py_IMMORTAL_FLAGS;

Objects/unicodeobject.c

@@ -1329,7 +1329,7 @@ PyUnicode_New(Py_ssize_t size, Py_UCS4 maxchar)
     else
         data = unicode + 1;
     _PyUnicode_LENGTH(unicode) = size;
-    _PyUnicode_HASH(unicode) = -1;
+    PyUnicode_SET_HASH((PyObject *)unicode, -1);
     _PyUnicode_STATE(unicode).interned = 0;
     _PyUnicode_STATE(unicode).kind = kind;
     _PyUnicode_STATE(unicode).compact = 1;
@@ -13903,9 +13903,9 @@ unicode_subtype_new(PyTypeObject *type, PyObject *unicode)
 
     _PyUnicode_LENGTH(self) = length;
 #ifdef Py_DEBUG
-    _PyUnicode_HASH(self) = -1;
+    PyUnicode_SET_HASH((PyObject *)self, -1);
 #else
-    _PyUnicode_HASH(self) = _PyUnicode_HASH(unicode);
+    PyUnicode_SET_HASH((PyObject *)self, PyUnicode_HASH(unicode));
 #endif
     _PyUnicode_STATE(self).interned = 0;
     _PyUnicode_STATE(self).kind = kind;
@@ -13950,7 +13950,7 @@ unicode_subtype_new(PyTypeObject *type, PyObject *unicode)
     memcpy(data, PyUnicode_DATA(unicode), kind * (length + 1));
     assert(_PyUnicode_CheckConsistency(self, 1));
 #ifdef Py_DEBUG
-    _PyUnicode_HASH(self) = _PyUnicode_HASH(unicode);
+    PyUnicode_SET_HASH((PyObject *)self, PyUnicode_HASH(unicode));
 #endif
     return self;
 

Python/import.c

@@ -5441,7 +5441,10 @@ _imp__set_lazy_attributes_impl(PyObject *module, PyObject *child_module,
     PyThreadState *tstate = _PyThreadState_GET();
     PyObject *child_dict = NULL;
     PyObject *ret = NULL;
-    PyObject *lazy_modules = tstate->interp->imports.lazy_modules;
+    // Use atomic load and hold a reference to prevent use-after-free
+    // if another thread clears lazy_modules during interpreter shutdown.
+    PyObject *lazy_modules = FT_ATOMIC_LOAD_PTR_RELAXED(tstate->interp->imports.lazy_modules);
+    Py_XINCREF(lazy_modules);
     if (lazy_modules != NULL) {
         PyObject *lazy_submodules = PyDict_GetItemWithError(lazy_modules, name);
         if (lazy_submodules == NULL) {
@@ -5483,6 +5486,7 @@ _imp__set_lazy_attributes_impl(PyObject *module, PyObject *child_module,
     ret = Py_NewRef(Py_None);
 
   error:
+    Py_XDECREF(lazy_modules);
     Py_XDECREF(child_dict);
     return ret;
 }