gh-150277: Make _STORE_ATTR_SLOT lock-free on the free-threaded build

Lib/test/test_free_threading/test_slots.py

@@ -304,3 +304,21 @@ def reader():
                 spam_new.T_CHAR
 
         run_in_threads([writer, reader])
+
+    def test_T_OBJECT(self):
+        # _Py_T_OBJECT exercises PyMember_GetOne / PyMember_SetOne for
+        # the object case from concurrent threads.  Uses
+        # _testcapi.HeapCTypeWithDict which exposes its `dict` slot as a
+        # `_Py_T_OBJECT` member named `dictobj`.
+        obj = _testcapi.HeapCTypeWithDict()
+
+        def writer():
+            for i in range(1_000):
+                obj.dictobj = {"k": i}
+
+        def reader():
+            for _ in range(1_000):
+                v = obj.dictobj
+                assert v is None or isinstance(v, dict)
+
+        run_in_threads([writer, reader])

Misc/NEWS.d/next/Core_and_Builtins/2026-05-26-06-14-41.gh-issue-150277.Oz-ns0.rst

@@ -0,0 +1 @@
+Improve performance of storing attributes in slotted classes.

Python/bytecodes.c

@@ -3226,14 +3226,21 @@ dummy_func(
         op(_STORE_ATTR_SLOT, (index/1, value, owner -- o)) {
             PyObject *owner_o = PyStackRef_AsPyObjectBorrow(owner);
 
-            DEOPT_IF(!LOCK_OBJECT(owner_o));
             char *addr = (char *)owner_o + index;
             STAT_INC(STORE_ATTR, hit);
+            // Atomic exchange of the slot pointer. Each concurrent writer
+            // observes a unique old value, so Py_XDECREF below cannot
+            // double-free. Concurrent readers (_LOAD_ATTR_SLOT,
+            // PyMember_GetOne) cope via _Py_TryIncrefCompare.
+#ifdef Py_GIL_DISABLED
+            PyObject *old_value = _Py_atomic_exchange_ptr(
+                (void **)addr, PyStackRef_AsPyObjectSteal(value));
+#else
             PyObject *old_value = *(PyObject **)addr;
-            FT_ATOMIC_STORE_PTR_RELEASE(*(PyObject **)addr, PyStackRef_AsPyObjectSteal(value));
-            UNLOCK_OBJECT(owner_o);
-            INPUTS_DEAD();
+            *(PyObject **)addr = PyStackRef_AsPyObjectSteal(value);
+#endif
             o = owner;
+            DEAD(owner);
             Py_XDECREF(old_value);
         }
 

Python/structmember.c

@@ -97,36 +97,33 @@ PyMember_GetOne(const char *obj_addr, PyMemberDef *l)
         break;
     }
     case _Py_T_OBJECT:
-        v = FT_ATOMIC_LOAD_PTR(*(PyObject **) addr);
-        if (v != NULL) {
 #ifdef Py_GIL_DISABLED
-            if (!_Py_TryIncrefCompare((PyObject **) addr, v)) {
-                Py_BEGIN_CRITICAL_SECTION((PyObject *) obj_addr);
-                v = FT_ATOMIC_LOAD_PTR(*(PyObject **) addr);
-                Py_XINCREF(v);
-                Py_END_CRITICAL_SECTION();
-            }
+        // _Py_XGetRef does an atomic load + try-incref loop, retrying when
+        // a concurrent writer (lock-free atomic exchange in _STORE_ATTR_SLOT
+        // and PyMember_SetOne) mutates the slot. The previous critical-
+        // section fallback assumed writers also took ob_mutex, which they no
+        // longer do, so a plain Py_XINCREF inside the CS could resurrect a
+        // refcount-0 (about-to-be-freed) object.
+        v = _Py_XGetRef((PyObject **)addr);
 #else
-            Py_INCREF(v);
+        v = *(PyObject **)addr;
+        Py_XINCREF(v);
 #endif
-        }
         if (v == NULL) {
-            v = Py_None;
+            v = Py_None;  // immortal, no incref needed
         }
         break;
     case Py_T_OBJECT_EX:
+#ifdef Py_GIL_DISABLED
+        v = _Py_XGetRef((PyObject **)addr);
+        if (v == NULL) {
+            PyErr_Format(PyExc_AttributeError,
+                         "'%T' object has no attribute '%s'",
+                         (PyObject *)obj_addr, l->name);
+        }
+#else
         v = member_get_object(addr, obj_addr, l);
-#ifndef Py_GIL_DISABLED
         Py_XINCREF(v);
-#else
-        if (v != NULL) {
-            if (!_Py_TryIncrefCompare((PyObject **) addr, v)) {
-                Py_BEGIN_CRITICAL_SECTION((PyObject *) obj_addr);
-                v = member_get_object(addr, obj_addr, l);
-                Py_XINCREF(v);
-                Py_END_CRITICAL_SECTION();
-            }
-        }
 #endif
         break;
     case Py_T_LONGLONG:
@@ -320,11 +317,15 @@ PyMember_SetOne(char *addr, PyMemberDef *l, PyObject *v)
         break;
     }
     case _Py_T_OBJECT:
-    case Py_T_OBJECT_EX:
-        Py_BEGIN_CRITICAL_SECTION(obj);
+    case Py_T_OBJECT_EX: {
+        // Lock-free atomic exchange; matches _STORE_ATTR_SLOT.
+        PyObject *new_v = Py_XNewRef(v);
+#ifdef Py_GIL_DISABLED
+        oldv = (PyObject *)_Py_atomic_exchange_ptr((void **)addr, new_v);
+#else
         oldv = *(PyObject **)addr;
-        FT_ATOMIC_STORE_PTR_RELEASE(*(PyObject **)addr, Py_XNewRef(v));
-        Py_END_CRITICAL_SECTION();
+        *(PyObject **)addr = new_v;
+#endif
         if (v == NULL && oldv == NULL && l->type == Py_T_OBJECT_EX) {
             // Raise an exception when attempting to delete an already deleted
             // attribute.
@@ -336,6 +337,7 @@ PyMember_SetOne(char *addr, PyMemberDef *l, PyObject *v)
         }
         Py_XDECREF(oldv);
         break;
+    }
     case Py_T_CHAR: {
         const char *string;
         Py_ssize_t len;

Tools/cases_generator/analyzer.py

@@ -701,6 +701,7 @@ def has_error_without_pop(op: parser.CodeDef) -> bool:
     "_Py_TryIncrefCompare",
     "_Py_TryIncrefCompareStackRef",
     "_Py_atomic_compare_exchange_uint8",
+    "_Py_atomic_exchange_ptr",
     "_Py_atomic_load_ptr_acquire",
     "_Py_atomic_load_uintptr_relaxed",
     "_Py_set_eval_breaker_bit",