René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Race condition in `itertools.islice` under free-threading","articleBody":"# Bug report\n\n### Bug description:\n\n`islice_next` reads and writes three fields -- `lz-\u003ecnt`, `lz-\u003enext`, and `lz-\u003eit` -- and do operations on them without a critical section.\n\nhttps://github.com/python/cpython/blob/d986124d83465190987357f987ee24bd7a817cac/Modules/itertoolsmodule.c#L1628-L1661\n\nTwo threads calling `next` on the same `islice` object concurrently can race:\n\n- Both read `lz-\u003ecnt = N \u003c lz-\u003enext`, both execute the skip-loop body for the same   slot, advancing the underlying iterator twice for one step. In that case, the step arithmetic gets corrupted.\n- Both read `lz-\u003ecnt = N \u003c stop`, both pass the stop check, both call `iternext(it)`   and return an item -- the total number of yielded items exceeds `stop`.\n- There's a race on `lz-\u003ecnt++` and `lz-\u003enext += step`: both threads can read the same value, then both can increment locally, and both store the same result. After that, the counter is permanently incorrect (such that subsequent skip/stop decisions use a wrong baseline).\n- One of the threads reaches  exhaustion (`goto empty`) and calls `Py_CLEAR(lz-\u003eit)`, which sets `lz-\u003eit = NULL` and DECREF's the iterator, which frees it  (since each thread has ready `it = lz-\u003eit`. and not INCREF'd it). Another thread can have read `lz-\u003eit` before the clear and be in the middle of   `iternext(it)` on the now-freed object in which case there is a use-after-free.\n\n`chain_next` for example wraps its body in `Py_BEGIN_CRITICAL_SECTION(op)`, which I believe is what `islice` should do as well.\n\nhttps://github.com/python/cpython/blob/d986124d83465190987357f987ee24bd7a817cac/Modules/itertoolsmodule.c#L1937-L1945\n\n**Reproducer**\n\n```py\nimport itertools\nimport threading\n\nSTOP = 100\nNTHREADS = 8\n\ndata = iter(range(STOP + NTHREADS * 2))\nsl = itertools.islice(data, STOP)\n\nresults: list[int] = []\nlock = threading.Lock()\n\ndef consume() -\u003e None:\n    while True:\n        v = next(sl, None)\n        if v is None:\n            break\n        with lock:\n            results.append(v)\n\nthreads = [threading.Thread(target=consume) for _ in range(NTHREADS)]\nfor t in threads: t.start()\nfor t in threads: t.join()\n```\n\nThe reproducer, on a free-threaded build, gets reports like this one.\n\n```\nWARNING: ThreadSanitizer: data race (pid=49886)\n  Read of size 8 at 0x00030275f8b0 by thread T2:\n    #0 islice_next itertoolsmodule.c:1663 (python.exe:arm64+0x10042bce4)\n    #1 builtin_next bltinmodule.c:1770 (python.exe:arm64+0x10028a900)\n    #2 cfunction_vectorcall_FASTCALL methodobject.c:449 (python.exe:arm64+0x1001379dc)\n    #3 _PyObject_VectorcallTstate pycore_call.h:144 (python.exe:arm64+0x100090e80)\n    #4 PyObject_Vectorcall call.c:327 (python.exe:arm64+0x100090e80)\n...\n```\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\nmacOS\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-151410\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/KowalskiThomas","@type":"Person","name":"KowalskiThomas"},"datePublished":"2026-06-12T15:41:40.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":2},"url":"https://github.com/151409/cpython/issues/151409"}