gh-NNNNN: Make _STORE_ATTR_SLOT lock-free on the free-threaded build

Replace the LOCK_OBJECT / atomic-release-store / UNLOCK_OBJECT sequence
in _STORE_ATTR_SLOT (and the matching critical section in
PyMember_SetOne for Py_T_OBJECT_EX / _Py_T_OBJECT) with a single atomic
exchange on the slot pointer.  Atomic exchange returns a unique old
value per writer, so Py_XDECREF cannot double-free across concurrent
writers.  Concurrent readers (_LOAD_ATTR_SLOT, PyMember_GetOne) already
use atomic load + _Py_TryIncrefCompare; PyMember_GetOne's locked
fallback is replaced by _Py_XGetRef so it also stays correct against
lock-free writers.

Drops HAS_DEOPT_FLAG from _STORE_ATTR_SLOT (no LOCK can fail anymore),
which removes one _DEOPT exit per occurrence from Tier 2 traces.  Adds
_Py_atomic_exchange_ptr to the cases-generator's NON_ESCAPING_FUNCTIONS
allowlist so the generator stops wrapping it in
_PyFrame_SetStackPointer / _GetStackPointer.

Adds a concurrent _Py_T_OBJECT test (test_T_OBJECT in test_slots.py).

Benchmarks (PGO+LTO, taskset -c 4, pyperf):
  micro_store_attr_slot   79.0 ns -> 54.5 ns   1.45x faster
  micro_attr_idiv          180 ns -> 149 ns    1.21x faster
  bm_float                87.4 ms -> 83.7 ms   1.04x faster
  bm_nbody (control)             unchanged

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: eendebakpt

Include/internal/pycore_opcode_metadata.h

@@ -304,3 +304,21 @@ def reader():
                 spam_new.T_CHAR
 
         run_in_threads([writer, reader])
+
+    def test_T_OBJECT(self):
+        # _Py_T_OBJECT exercises PyMember_GetOne / PyMember_SetOne for
+        # the object case from concurrent threads.  Uses
+        # _testcapi.HeapCTypeWithDict which exposes its `dict` slot as a
+        # `_Py_T_OBJECT` member named `dictobj`.
+        obj = _testcapi.HeapCTypeWithDict()
+
+        def writer():
+            for i in range(1_000):
+                obj.dictobj = {"k": i}
+
+        def reader():
+            for _ in range(1_000):
+                v = obj.dictobj
+                assert v is None or isinstance(v, dict)
+
+        run_in_threads([writer, reader])

Include/internal/pycore_uop_metadata.h

@@ -3225,14 +3225,21 @@ dummy_func(
         op(_STORE_ATTR_SLOT, (index/1, value, owner -- o)) {
             PyObject *owner_o = PyStackRef_AsPyObjectBorrow(owner);
 
-            DEOPT_IF(!LOCK_OBJECT(owner_o));
             char *addr = (char *)owner_o + index;
             STAT_INC(STORE_ATTR, hit);
+            // Atomic exchange of the slot pointer. Each concurrent writer
+            // observes a unique old value, so Py_XDECREF below cannot
+            // double-free. Concurrent readers (_LOAD_ATTR_SLOT,
+            // PyMember_GetOne) cope via _Py_TryIncrefCompare.
+#ifdef Py_GIL_DISABLED
+            PyObject *old_value = _Py_atomic_exchange_ptr(
+                (void **)addr, PyStackRef_AsPyObjectSteal(value));
+#else
             PyObject *old_value = *(PyObject **)addr;
-            FT_ATOMIC_STORE_PTR_RELEASE(*(PyObject **)addr, PyStackRef_AsPyObjectSteal(value));
-            UNLOCK_OBJECT(owner_o);
-            INPUTS_DEAD();
+            *(PyObject **)addr = PyStackRef_AsPyObjectSteal(value);
+#endif
             o = owner;
+            DEAD(owner);
             Py_XDECREF(old_value);
         }
 

Lib/test/test_free_threading/test_slots.py

@@ -97,36 +97,33 @@ PyMember_GetOne(const char *obj_addr, PyMemberDef *l)
         break;
     }
     case _Py_T_OBJECT:
-        v = FT_ATOMIC_LOAD_PTR(*(PyObject **) addr);
-        if (v != NULL) {
 #ifdef Py_GIL_DISABLED
-            if (!_Py_TryIncrefCompare((PyObject **) addr, v)) {
-                Py_BEGIN_CRITICAL_SECTION((PyObject *) obj_addr);
-                v = FT_ATOMIC_LOAD_PTR(*(PyObject **) addr);
-                Py_XINCREF(v);
-                Py_END_CRITICAL_SECTION();
-            }
+        // _Py_XGetRef does an atomic load + try-incref loop, retrying when
+        // a concurrent writer (lock-free atomic exchange in _STORE_ATTR_SLOT
+        // and PyMember_SetOne) mutates the slot. The previous critical-
+        // section fallback assumed writers also took ob_mutex, which they no
+        // longer do, so a plain Py_XINCREF inside the CS could resurrect a
+        // refcount-0 (about-to-be-freed) object.
+        v = _Py_XGetRef((PyObject **)addr);
 #else
-            Py_INCREF(v);
+        v = *(PyObject **)addr;
+        Py_XINCREF(v);
 #endif
-        }
         if (v == NULL) {
-            v = Py_None;
+            v = Py_None;  // immortal, no incref needed
         }
         break;
     case Py_T_OBJECT_EX:
+#ifdef Py_GIL_DISABLED
+        v = _Py_XGetRef((PyObject **)addr);
+        if (v == NULL) {
+            PyErr_Format(PyExc_AttributeError,
+                         "'%T' object has no attribute '%s'",
+                         (PyObject *)obj_addr, l->name);
+        }
+#else
         v = member_get_object(addr, obj_addr, l);
-#ifndef Py_GIL_DISABLED
         Py_XINCREF(v);
-#else
-        if (v != NULL) {
-            if (!_Py_TryIncrefCompare((PyObject **) addr, v)) {
-                Py_BEGIN_CRITICAL_SECTION((PyObject *) obj_addr);
-                v = member_get_object(addr, obj_addr, l);
-                Py_XINCREF(v);
-                Py_END_CRITICAL_SECTION();
-            }
-        }
 #endif
         break;
     case Py_T_LONGLONG:
@@ -320,11 +317,15 @@ PyMember_SetOne(char *addr, PyMemberDef *l, PyObject *v)
         break;
     }
     case _Py_T_OBJECT:
-    case Py_T_OBJECT_EX:
-        Py_BEGIN_CRITICAL_SECTION(obj);
+    case Py_T_OBJECT_EX: {
+        // Lock-free atomic exchange; matches _STORE_ATTR_SLOT.
+        PyObject *new_v = Py_XNewRef(v);
+#ifdef Py_GIL_DISABLED
+        oldv = (PyObject *)_Py_atomic_exchange_ptr((void **)addr, new_v);
+#else
         oldv = *(PyObject **)addr;
-        FT_ATOMIC_STORE_PTR_RELEASE(*(PyObject **)addr, Py_XNewRef(v));
-        Py_END_CRITICAL_SECTION();
+        *(PyObject **)addr = new_v;
+#endif
         if (v == NULL && oldv == NULL && l->type == Py_T_OBJECT_EX) {
             // Raise an exception when attempting to delete an already deleted
             // attribute.
@@ -336,6 +337,7 @@ PyMember_SetOne(char *addr, PyMemberDef *l, PyObject *v)
         }
         Py_XDECREF(oldv);
         break;
+    }
     case Py_T_CHAR: {
         const char *string;
         Py_ssize_t len;

Modules/_testinternalcapi/test_cases.c.h

@@ -700,6 +700,7 @@ def has_error_without_pop(op: parser.CodeDef) -> bool:
     "_Py_TryIncrefCompare",
     "_Py_TryIncrefCompareStackRef",
     "_Py_atomic_compare_exchange_uint8",
+    "_Py_atomic_exchange_ptr",
     "_Py_atomic_load_ptr_acquire",
     "_Py_atomic_load_uintptr_relaxed",
     "_Py_set_eval_breaker_bit",