Copy str subclass keys of the class namespace to exact str.

type_new() now copies str subclass keys of the class namespace to exact
str, as type_setattro() already does for assigned names.  Lookups of a
slot name in a type dict then cannot call a user __eq__ through a str
subclass key.  Non-str keys are still allowed (with a RuntimeWarning) and
can still run __eq__; the type_update_dict() comment is corrected to say
so.

Remove the free-threading tests that relied on str subclass keys in the
type dict.

Author: nascheme

Lib/test/test_descr.py

@@ -5080,6 +5080,31 @@ def __new__(mcls, name, bases, ns):
         with self.assertWarnsRegex(RuntimeWarning, 'MyClass'):
             MyClass = meta('MyClass', (), {})
 
+    def test_str_subclass_namespace_keys(self):
+        # Keys of the class namespace that are str subclasses are copied
+        # to exact str in the type's __dict__, like type.__setattr__ does.
+        class Key(str):
+            def __hash__(self):
+                # Collide with the slot name assigned below.
+                return hash('__hash__')
+            def __eq__(self, other):
+                # Must not be called by type dict lookups.
+                raise AssertionError('Key.__eq__ called')
+
+        ns = {Key('other'): 1, '__repr__': lambda self: 'r', 'c': 2}
+        C = type('C', (), ns)
+        for key in C.__dict__:
+            self.assertIs(type(key), str)
+        self.assertEqual([str(k) for k in ns], list(C.__dict__)[:3])
+        self.assertEqual(repr(C()), 'r')
+        self.assertEqual(C.other, 1)
+        # Lookups and slot updates that hash-collide with 'other' do not
+        # call Key.__eq__.
+        C.__hash__ = None
+        with self.assertRaises(TypeError):
+            hash(C())
+        del C.__hash__
+
     def test_proxy_call(self):
         class FakeStr:
             __class__ = str

Lib/test/test_free_threading/test_type.py

@@ -1,7 +1,6 @@
 import gc
 import threading
 import unittest
-import weakref
 
 from concurrent.futures import ThreadPoolExecutor
 from threading import Barrier, Thread
@@ -470,76 +469,6 @@ def setter():
 
         self.check_stop_the_world_under_type_lock(setter)
 
-    def test_stop_the_world_in_setattr_key_eq_deadlock(self):
-        # type_setattro() compares the attribute name with a str subclass key
-        # of the type's __dict__ (calling its __eq__) with the type lock held.
-        N = 50
-
-        class S(str):
-            __hash__ = str.__hash__
-            def __eq__(self, other):
-                _testinternalcapi.stop_the_world()
-                return str.__eq__(self, other)
-
-        C = type("C", (), {S("x"): 0})
-
-        def setter():
-            for i in range(N):
-                C.x = i
-
-        self.check_stop_the_world_under_type_lock(setter)
-
-    def test_reentrant_slot_update_consistency(self):
-        # Updating Base queues its slot update before visiting Sub.  A key
-        # comparison in Sub's dict re-enters the setter and makes that queue
-        # stale.  It must be rebuilt rather than overwriting the inner update.
-        armed = False
-
-        class Base:
-            pass
-
-        class Key(str):
-            def __hash__(self):
-                return hash("__hash__")
-
-            def __eq__(self, other):
-                nonlocal armed
-                if armed and other == "__hash__":
-                    armed = False
-                    Base.__hash__ = object.__hash__
-                return str.__eq__(self, other)
-
-        # Collide with the special-method name without defining it on Sub,
-        # so that slot updates still propagate from Base to Sub.
-        Sub = type("Sub", (Base,), {Key("trigger"): None})
-        objects = [Base(), Sub()]
-
-        # Check actual slot dispatch, not just the class dictionaries.  None
-        # and object.__hash__ use distinct C slots, unlike Python functions
-        # which share a generic wrapper that looks up the current method.
-        Base.__hash__ = None
-        for obj in objects:
-            with self.assertRaises(TypeError):
-                hash(obj)
-        Base.__hash__ = object.__hash__
-        for obj in objects:
-            self.assertEqual(hash(obj), object.__hash__(obj))
-
-        armed = True
-        Base.__hash__ = None
-        self.assertFalse(armed)
-        self.assertIs(Base.__dict__["__hash__"], object.__hash__)
-        for obj in objects:
-            self.assertEqual(hash(obj), object.__hash__(obj))
-
-        # Both applied and discarded queues must release their references.
-        base_ref = weakref.ref(Base)
-        sub_ref = weakref.ref(Sub)
-        del obj, objects, Sub, Base
-        gc.collect()
-        self.assertIsNone(base_ref())
-        self.assertIsNone(sub_ref())
-
     def test_reentrant_mro_always_publishes(self):
         # A custom mro() that updates a slot on every call must not make
         # the __bases__ assignment retry forever.

Objects/typeobject.c

@@ -4978,10 +4978,72 @@ type_new_get_slots(type_new_ctx *ctx, PyObject *dict)
 }
 
 
+/* Copy the class namespace.  Keys that are str subclasses are replaced by
+   exact str copies so that the type dict only holds exact str keys (see
+   type_setattro() which does the same for assigned names).  Lookups in a
+   dict with exact str keys cannot run user __eq__ methods, which the slot
+   update code relies on.  Non-str keys are left alone; type_new_impl()
+   warns about them. */
+static PyObject *
+type_new_copy_dict(PyObject *orig_dict)
+{
+    PyObject *dict = _PyDict_CopyAsDict(orig_dict);
+    if (dict == NULL) {
+        return NULL;
+    }
+    if (((PyDictObject *)dict)->ma_keys->dk_kind != DICT_KEYS_GENERAL) {
+        // Only exact str keys are possible, nothing to do.
+        return dict;
+    }
+    Py_ssize_t pos = 0;
+    PyObject *key, *value;
+    int rebuild = 0;
+    while (PyDict_Next(dict, &pos, &key, &value)) {
+        if (PyUnicode_Check(key) && !PyUnicode_CheckExact(key)) {
+            rebuild = 1;
+            break;
+        }
+    }
+    if (!rebuild) {
+        return dict;
+    }
+    // Rebuild rather than delete/insert so that the key order is kept.
+    PyObject *newdict = PyDict_New();
+    if (newdict == NULL) {
+        Py_DECREF(dict);
+        return NULL;
+    }
+    pos = 0;
+    while (PyDict_Next(dict, &pos, &key, &value)) {
+        PyObject *newkey;
+        if (PyUnicode_Check(key) && !PyUnicode_CheckExact(key)) {
+            newkey = _PyUnicode_Copy(key);
+            if (newkey == NULL) {
+                goto error;
+            }
+        }
+        else {
+            newkey = Py_NewRef(key);
+        }
+        int err = PyDict_SetItem(newdict, newkey, value);
+        Py_DECREF(newkey);
+        if (err < 0) {
+            goto error;
+        }
+    }
+    Py_DECREF(dict);
+    return newdict;
+
+error:
+    Py_DECREF(dict);
+    Py_DECREF(newdict);
+    return NULL;
+}
+
 static PyTypeObject*
 type_new_init(type_new_ctx *ctx)
 {
-    PyObject *dict = _PyDict_CopyAsDict(ctx->orig_dict);
+    PyObject *dict = type_new_copy_dict(ctx->orig_dict);
     if (dict == NULL) {
         goto error;
     }
@@ -6673,9 +6735,11 @@ type_update_dict(PyTypeObject *type, PyDictObject *dict, PyObject *name,
     // We don't want any re-entrancy between when we update the dict
     // and call _PyType_Modified_Unlocked, including running the destructor
     // of the current value as it can observe the cache in an inconsistent
-    // state.  Because we have an exact unicode and our dict has exact
-    // unicodes we know that this will all complete without releasing
-    // the locks.
+    // state.  The name is an exact unicode (see type_setattro()) and
+    // str subclass keys are copied to exact str by type_new_copy_dict()
+    // and type_setattro().  The type dict can still hold non-str keys
+    // (type_new_impl() only warns about them) and comparing with one of
+    // those can run user code that releases the locks.
     if (_PyDict_GetItemRef_Unicode_LockHeld(dict, name, old_value) < 0) {
         return -1;
     }