[3.13] gh-137400: Fix a crash when disabling profiling across all threads (gh-137471) (gh-137649)

colesbury · web-flow · commit e236568c0ea3 · 2025-08-11T16:07:21.000Z
The `PyEval_SetProfileAllThreads` function and other related functions had a race condition on `tstate->c_profilefunc` that could lead to a crash when disable profiling or tracing on all threads while another thread is starting to profile or trace a a call. There are still potential crashes when threads exit concurrently with profiling or tracing be enabled/disabled across all threads. (cherry picked from commit 3626928)
diff --git a/Lib/test/test_free_threading/test_monitoring.py b/Lib/test/test_free_threading/test_monitoring.py
@@ -2,6 +2,7 @@
 environment to verify things are thread-safe in a free-threaded build"""
 
 import sys
+import threading
 import time
 import unittest
 import weakref
@@ -192,6 +193,40 @@ def during_threads(self):
         self.set = not self.set
 
 
+@threading_helper.requires_working_threading()
+class SetProfileAllMultiThreaded(TestCase):
+    def test_profile_all_threads(self):
+        done = threading.Event()
+
+        def func():
+            pass
+
+        def bg_thread():
+            while not done.is_set():
+                func()
+                func()
+                func()
+                func()
+                func()
+
+        def my_profile(frame, event, arg):
+            return None
+
+        bg_threads = []
+        for i in range(10):
+            t = threading.Thread(target=bg_thread)
+            t.start()
+            bg_threads.append(t)
+
+        for i in range(100):
+            threading.setprofile_all_threads(my_profile)
+            threading.setprofile_all_threads(None)
+
+        done.set()
+        for t in bg_threads:
+            t.join()
+
+
 @threading_helper.requires_working_threading()
 class MonitoringMisc(MonitoringTestMixin, TestCase):
     def register_callback(self):
diff --git a/Misc/NEWS.d/next/Core and Builtins/2025-08-06-15-39-54.gh-issue-137400.xIw0zs.rst b/Misc/NEWS.d/next/Core and Builtins/2025-08-06-15-39-54.gh-issue-137400.xIw0zs.rst
@@ -0,0 +1,4 @@
+Fix a crash in the :term:`free threading` build when disabling profiling or tracing
+across all threads with :c:func:`PyEval_SetProfileAllThreads` or
+:c:func:`PyEval_SetTraceAllThreads` or their Python equivalents
+:func:`threading.settrace_all_threads` and :func:`threading.setprofile_all_threads`.
diff --git a/Python/legacy_tracing.c b/Python/legacy_tracing.c
@@ -479,13 +479,16 @@ setup_profile(PyThreadState *tstate, Py_tracefunc func, PyObject *arg, PyObject
         }
     }
 
+    _PyEval_StopTheWorld(tstate->interp);
     int delta = (func != NULL) - (tstate->c_profilefunc != NULL);
     tstate->c_profilefunc = func;
     *old_profileobj = tstate->c_profileobj;
     tstate->c_profileobj = Py_XNewRef(arg);
     tstate->interp->sys_profiling_threads += delta;
     assert(tstate->interp->sys_profiling_threads >= 0);
-    return tstate->interp->sys_profiling_threads;
+    Py_ssize_t profiling_threads = tstate->interp->sys_profiling_threads;
+    _PyEval_StartTheWorld(tstate->interp);
+    return profiling_threads;
 }
 
 int
@@ -574,13 +577,16 @@ setup_tracing(PyThreadState *tstate, Py_tracefunc func, PyObject *arg, PyObject
         }
     }
 
+    _PyEval_StopTheWorld(tstate->interp);
     int delta = (func != NULL) - (tstate->c_tracefunc != NULL);
     tstate->c_tracefunc = func;
     *old_traceobj = tstate->c_traceobj;
     tstate->c_traceobj = Py_XNewRef(arg);
     tstate->interp->sys_tracing_threads += delta;
     assert(tstate->interp->sys_tracing_threads >= 0);
-    return tstate->interp->sys_tracing_threads;
+    Py_ssize_t tracing_threads = tstate->interp->sys_tracing_threads;
+    _PyEval_StartTheWorld(tstate->interp);
+    return tracing_threads;
 }
 
 int

Original file line number	Diff line number	Diff line change
`@@ -479,13 +479,16 @@ setup_profile(PyThreadState tstate, Py_tracefunc func, PyObject arg, PyObject`
`479`	`479`	`}`
`480`	`480`	`}`
`481`	`481`
	`482`	`+ _PyEval_StopTheWorld(tstate->interp);`
`482`	`483`	`int delta = (func != NULL) - (tstate->c_profilefunc != NULL);`
`483`	`484`	`tstate->c_profilefunc = func;`
`484`	`485`	`*old_profileobj = tstate->c_profileobj;`
`485`	`486`	`tstate->c_profileobj = Py_XNewRef(arg);`
`486`	`487`	`tstate->interp->sys_profiling_threads += delta;`
`487`	`488`	`assert(tstate->interp->sys_profiling_threads >= 0);`
`488`		`- return tstate->interp->sys_profiling_threads;`
	`489`	`+ Py_ssize_t profiling_threads = tstate->interp->sys_profiling_threads;`
	`490`	`+ _PyEval_StartTheWorld(tstate->interp);`
	`491`	`+ return profiling_threads;`
`489`	`492`	`}`
`490`	`493`
`491`	`494`	`int`
`@@ -574,13 +577,16 @@ setup_tracing(PyThreadState tstate, Py_tracefunc func, PyObject arg, PyObject`
`574`	`577`	`}`
`575`	`578`	`}`
`576`	`579`
	`580`	`+ _PyEval_StopTheWorld(tstate->interp);`
`577`	`581`	`int delta = (func != NULL) - (tstate->c_tracefunc != NULL);`
`578`	`582`	`tstate->c_tracefunc = func;`
`579`	`583`	`*old_traceobj = tstate->c_traceobj;`
`580`	`584`	`tstate->c_traceobj = Py_XNewRef(arg);`
`581`	`585`	`tstate->interp->sys_tracing_threads += delta;`
`582`	`586`	`assert(tstate->interp->sys_tracing_threads >= 0);`
`583`		`- return tstate->interp->sys_tracing_threads;`
	`587`	`+ Py_ssize_t tracing_threads = tstate->interp->sys_tracing_threads;`
	`588`	`+ _PyEval_StartTheWorld(tstate->interp);`
	`589`	`+ return tracing_threads;`
`584`	`590`	`}`
`585`	`591`
`586`	`592`	`int`