[issue17263] crash when tp_dealloc allows other threads

[Charles-François Natali]

Charles-François Natali added the comment:

> Note that in threadmodule.c, in local_clear, we are iterating through all threads:
>
> In PyDict_DelItem, if the GIL is released and meanwhile, the list of threadstates is altered, is that a problem for this loop? So maybe tstate becomes invalid there.

Yes.
If PyDict_DelItem() releases the GIL and tstate is deleted,
PyThreadState_Next(tstate) is undefined behavior (it accesses
tstate->next).

Changing your reproducer to create/wait for termination of threads in
a loop in a background thread.

----------

_______________________________________
Python tracker <report at bugs.python.org>
<http://bugs.python.org/issue17263>
_______________________________________