fix PyTypeObject->tp_base race in free threading

Author: LindaSummer

Lib/test/test_free_threading/test_type.py

@@ -141,6 +141,25 @@ def reader():
 
         self.run_one(writer, reader)
 
+    def test_bases_change(self):
+        class BaseA:
+            pass
+
+        class Derived(BaseA):
+            pass
+
+        def writer():
+            for _ in range(1000):
+                class BaseB:
+                    pass
+                Derived.__bases__ = (BaseB,)
+
+        def reader():
+            for _ in range(1000):
+                Derived.__base__
+
+        self.run_one(writer, reader)
+
     def run_one(self, writer_func, reader_func):
         barrier = threading.Barrier(NTHREADS)
 

Misc/NEWS.d/next/Core_and_Builtins/2025-10-24-14-29-12.gh-issue-133465.A5d6TM.rst

@@ -0,0 +1 @@
+Fix race when updating ``type.__bases__`` that could allow a read of ``type.__base__`` to observe an inconsistent value on the free threaded build.

Objects/typeobject.c

@@ -1920,8 +1920,10 @@ type_set_bases_unlocked(PyTypeObject *type, PyObject *new_bases, PyTypeObject *b
     assert(old_bases != NULL);
     PyTypeObject *old_base = type->tp_base;
 
+    types_stop_world();
     set_tp_bases(type, Py_NewRef(new_bases), 0);
     type->tp_base = (PyTypeObject *)Py_NewRef(best_base);
+    types_start_world();
 
     PyObject *temp = PyList_New(0);
     if (temp == NULL) {
@@ -1982,8 +1984,10 @@ type_set_bases_unlocked(PyTypeObject *type, PyObject *new_bases, PyTypeObject *b
     if (lookup_tp_bases(type) == new_bases) {
         assert(type->tp_base == best_base);
 
+        types_stop_world();
         set_tp_bases(type, old_bases, 0);
         type->tp_base = old_base;
+        types_start_world();
 
         Py_DECREF(new_bases);
         Py_DECREF(best_base);