Free-threading: weakref can revive an object being deallocated after its finalizer ran

Crash report

On the free-threaded build, a weakref to an object whose deallocation is in progress can
still be dereferenced after tp_finalize has run. Dropping that reference deallocates the
object a second time.

import io, weakref

class Raw(io.RawIOBase):
    __slots__ = ('a',)

class Attr:
    def __del__(self):
        print("weakref deref during dealloc ->", self.wr())

o = Raw()
o.a = Attr()
o.a.wr = weakref.ref(o)
del o

Default build: prints None. Free-threaded build: prints <__main__.Raw object at 0x...>, then hangs or crashes on the second deallocation.

CPython versions tested on:

CPython main branch

Linked PRs

gh-161419: fix weakref reviving a dying object in free-threading #161431

The fast path of _PyObject_ResurrectEnd() sets ob_ref_local to 0 and stops there, so the object is still owned by the current thread. _Py_TryIncrefFast() only checks ownership, and a weakref deref brings it back. The slow path sets ob_tid to 0 and merges the refcount, the fast path should leave the object in the same state.

--- a/Include/internal/pycore_object.h
+++ b/Include/internal/pycore_object.h
@@ -712,6 +712,8 @@ _PyObject_ResurrectEnd(PyObject *op)
     if (_Py_IsOwnedByCurrentThread(op) && local == 1 && shared == 0) {
         // Fast-path: object has a single refcount and is owned by this thread
         _Py_atomic_store_uint32_relaxed(&op->ob_ref_local, 0);
+        _Py_atomic_store_uintptr_relaxed(&op->ob_tid, _Py_UNOWNED_TID);
+        _Py_atomic_store_ssize_relaxed(&op->ob_ref_shared, _Py_REF_MERGED);
 # ifdef Py_TRACE_REFS
         _Py_ForgetReference(op);
 # endif

@NekoAsakura

@NekoAsakura Would you like to make a PR?

The proposed fix looks right to me

Merge branch 'main' into pythongh-161419/ft-weakref-dealloc

pythongh-161419: rename test variable to clarify weakref expectation

Navigation Menu

Repository navigation

Free-threading: weakref can revive an object being deallocated after its finalizer ran #161419

Crash report

CPython versions tested on:

Linked PRs

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Free-threading: weakref can revive an object being deallocated after its finalizer ran #161419

Description

Crash report

CPython versions tested on:

Linked PRs

Activity

NekoAsakura commented on Nov 5, 2026

eendebakpt commented on Nov 5, 2026

colesbury commented on Nov 5, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions