Data race between _Py_NewReference and _Py_IsOwnedByCurrentThread under free-threading

[vfdev-5]

Bug report

Bug description:

We see the following race in JAX free-threading TSAN instrumented CI:

WARNING: ThreadSanitizer: data race (pid=95875)
  Write of size 8 at 0x7fffc4030c00 by thread T6 (mutexes: read M0):
    #0 new_reference /__w/jax/jax/cpython/Objects/object.c:2464:16 (python3.13+0x29a5c2) (BuildId: d6d54de3753b7c6777cd2a5c08fbef6663ab66e8)
    #1 _Py_NewReference /__w/jax/jax/cpython/Objects/object.c:2483:5 (python3.13+0x29a5c2)
    #2 maybe_freelist_pop /__w/jax/jax/cpython/Objects/tupleobject.c:1151:13 (python3.13+0x2e0495) (BuildId: d6d54de3753b7c6777cd2a5c08fbef6663ab66e8)
    #3 tuple_alloc /__w/jax/jax/cpython/Objects/tupleobject.c:45:25 (python3.13+0x2e0495)
    #4 _PyTuple_FromArray /__w/jax/jax/cpython/Objects/tupleobject.c:380:28 (python3.13+0x2e0495)

  Previous atomic read of size 8 at 0x7fffc4030c00 by thread T5 (mutexes: read M0):
    #0 _Py_atomic_load_uintptr_relaxed /__w/jax/jax/cpython/./Include/cpython/pyatomic_gcc.h:347:10 (python3.13+0x261121) (BuildId: d6d54de3753b7c6777cd2a5c08fbef6663ab66e8)
    #1 _Py_IsOwnedByCurrentThread /__w/jax/jax/cpython/./Include/object.h:309:12 (python3.13+0x261121)
    #2 _Py_TryIncrefFast /__w/jax/jax/cpython/./Include/internal/pycore_object.h:444:9 (python3.13+0x261121)
    #3 _Py_TryIncrefCompare /__w/jax/jax/cpython/./Include/internal/pycore_object.h:483:9 (python3.13+0x261121)
    #4 _Py_TryXGetRef /__w/jax/jax/cpython/./Include/internal/pycore_object.h:522:9 (python3.13+0x261121)
    #5 _Py_dict_lookup_threadsafe /__w/jax/jax/cpython/Objects/dictobject.c:1507:25 (python3.13+0x261121)
    #6 _PyDict_Contains_KnownHash /__w/jax/jax/cpython/Objects/dictobject.c:4691:10 (python3.13+0x26b5c6) (BuildId: d6d54de3753b7c6777cd2a5c08fbef6663ab66e8)

Full data race logs: https://gist.github.com/vfdev-5/5441af8bc7a6a8eb76bdfdfcabbac245

Unfortunately, we do not have a minimal reproducer (may try to provide later if needed).

cc @hawkinsp

CPython versions tested on:

3.13

Operating systems tested on:

Linux

[colesbury]

This is fixed in 3.14, but not backported to 3.13:

cpython/Objects/object.c

Lines 2493 to 2498 in d16f455

	#ifdef _Py_THREAD_SANITIZER
	_Py_atomic_store_uintptr_relaxed(&op->ob_tid, _Py_ThreadId());
	_Py_atomic_store_uint8_relaxed(&op->ob_gc_bits, 0);
	_Py_atomic_store_uint32_relaxed(&op->ob_ref_local, 1);
	_Py_atomic_store_ssize_relaxed(&op->ob_ref_shared, 0);
	#else

To echo what I wrote in #128130 (comment), I'm inclined not to backport it's essentially just a TSAN warning and doesn't lead to user visible crashes or other misbehavior.

[hawkinsp]

That's fine. We just want to make sure these are reported.

[colesbury]

Fixed by #129665 in 3.14