aio-libs / multidict / 35610986105

87%

push

github

Recheck the reader gate after taking the retired list (#1502)

<!-- Thank you for your contribution! -->

## What do these changes do?

Fixes the use-after-free described in #1497, which has now reproduced in
CI: the Windows cp314t wheel job crashed with an access violation in
`reader_worker` of `test_drain_retired_defers_busy_table_thread_safety`
([job](https://github.com/aio-libs/multidict/actions/runs/35597109357/job/106324457575)).

`_md_drain_retired()` checked `num_active_readers` and then exchanged
`md->retired` out. A table retired between those two steps could be
freed while a reader that had already loaded it as `md->keys` had not
yet incremented its `num_readers`. The drain now rechecks
`num_active_readers` after the exchange and frees nothing if it is
nonzero; every table it took was retired after its readers entered, so a
zero there means they have all exited.

Only the free-threaded C extension has this code; the GIL build and the
pure Python implementation are unaffected.

## Are there changes in behavior for the user?

No, apart from the crash being gone.

## Is it a substantial burden for the maintainers to support this?

No; it is one extra atomic load in the drain path.

## Related issue number

Fixes #1497

## Checklist

- [x] I think the code is well written
- [x] Unit tests for the changes exist (the existing
`test_drain_retired_defers_busy_table_thread_safety` covers this race,
though only probabilistically; a deterministic test would need a timing
hook in the C code)
- [x] Documentation reflects the changes (N/A, internal only)
- [ ] If you provide code modification, please add yourself to
`CONTRIBUTORS.txt` (N/A)
- [x] Add a new news fragment into the `CHANGES/` folder
- [x] `make doc-spelling` passes and any new technical words are added
to `docs/spelling_wordlist.txt`

Drafted with Claude Code (Claude Opus 5); reviewed by @asvetlov.

<details>
<summary>Agent run details (optional, for reviewers)</summary>

Reproduction: temp... (continued)

762 of 1524 branches covered (50.0%)

Branch coverage included in aggregate %.

6475 of 6747 relevant lines covered (95.97%)

1.92 hits per line