gh-142349: Fix refcount corruption in lazy import specialization (#144733)
Remove spurious Py_DECREF on borrowed ref in LOAD_GLOBAL specialization _PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.
P
Pablo Galindo Salgado committed
072cd7c33627a90e9399d9d880d764407584b08e
Parent: 2e3e76e
Committed by GitHub <noreply@github.com>
on 2/12/2026, 11:45:28 AM