gh-159136: Keep eval-frame recorded function names alive

Hold a strong reference to func_name in both recording hooks before
PyList_Append can detach while acquiring the recording list lock.

Author: nascheme

Lib/test/test_capi/test_misc.py

@@ -2914,6 +2914,24 @@ def test_is_specialization_enabled_with_allow(self):
         finally:
             _testinternalcapi.set_eval_frame_default()
 
+    def test_record_replaced_function_name(self):
+        def target(arg):
+            pass
+
+        records = []
+        names = [f'dynamic_name_{i}' for i in range(100)]
+        try:
+            _testinternalcapi.set_eval_frame_interp(records)
+            for name in names:
+                target.__name__ = name
+                # Call through C to avoid inlining bypassing the hook.
+                list(map(target, [None]))
+        finally:
+            _testinternalcapi.set_eval_frame_default()
+        self.assertEqual(
+            [name for name in records if name.startswith('dynamic_name_')],
+            names)
+
     def test_allow_specialization_call(self):
         def func():
             pass

Lib/test/test_free_threading/test_functions.py

@@ -168,6 +168,39 @@ def reader():
         threading_helper.run_concurrently(
             [writer, reader] * (NUM_THREADS // 2))
 
+    def test_eval_frame_record_while_replacing_name(self):
+        from test.support import import_helper
+        _testinternalcapi = import_helper.import_module('_testinternalcapi')
+
+        def target():
+            pass
+
+        records = []
+
+        def writer():
+            for i in range(ITERS):
+                target.__name__ = f'target_{i}'
+
+        def caller():
+            for _ in range(ITERS):
+                target()
+
+        def contend():
+            for _ in range(ITERS):
+                # Contend with the recording hook for the list's lock.
+                records.extend(['padding'] * 1000)
+                records.clear()
+
+        try:
+            _testinternalcapi.set_eval_frame_record(records)
+            threading_helper.run_concurrently(
+                [writer, caller, contend, caller])
+            target()
+        finally:
+            _testinternalcapi.set_eval_frame_default()
+        self.assertTrue(any(name.startswith('target') for name in records))
+        self.assertTrue(all(isinstance(name, str) for name in records))
+
     def test_argument_errors_while_replacing_qualname(self):
         def target(x, *, y):
             pass

Lib/test/test_funcattrs.py

@@ -81,6 +81,27 @@ def __eq__(self, other):
         gc.collect()
         self.assertIsNone(ref())
 
+    def test_annotations_setter_reentrant_finalizer(self):
+        def target():
+            pass
+
+        observations = []
+        replacement = {'replacement': int}
+        finalizer_value = {'finalizer': str}
+
+        class Annotations(dict):
+            def __del__(self):
+                observations.append((target.__annotate__,
+                                     target.__annotations__ is replacement))
+                target.__annotations__ = finalizer_value
+
+        target.__annotate__ = lambda format: Annotations()
+        self.assertIsInstance(target.__annotations__, Annotations)
+        target.__annotations__ = replacement
+        support.gc_collect()
+        self.assertEqual(observations, [(None, True)])
+        self.assertIs(target.__annotations__, finalizer_value)
+
     def test_dir_includes_correct_attrs(self):
         self.b.known_attr = 7
         self.assertIn('known_attr', dir(self.b),

Lib/test/test_lltrace.py

@@ -91,6 +91,36 @@ def test_lltrace_different_module(self):
             self.assertEqual(instr_map[offset].opname, opname)
             self.assertEqual(instr_map[offset].arg, oparg)
 
+    def test_lltrace_replacing_function_attributes(self):
+        stdout = self.run_code("""
+            import gc
+
+            def target():
+                pass
+
+            class Name(str):
+                def __repr__(self):
+                    target.__qualname__ = 'replacement'
+                    gc.collect()
+                    return "'original_name'"
+
+            class Module:
+                def __repr__(self):
+                    target.__module__ = None
+                    gc.collect()
+                    return "'original_module'"
+
+            target.__qualname__ = Name('original_name')
+            target.__module__ = Module()
+            __lltrace__ = 1
+            target()
+            del __lltrace__
+            assert target.__qualname__ == 'replacement'
+            assert target.__module__ is None
+        """)
+        self.assertIn("'original_name'", stdout)
+        self.assertIn("'original_module'", stdout)
+
     def test_lltrace_does_not_crash_on_subscript_operator(self):
         # If this test fails, it will reproduce a crash reported as
         # bpo-34113. The crash happened at the command line console of

Modules/_testinternalcapi.c

@@ -1142,8 +1142,9 @@ record_eval(PyThreadState *tstate, struct _PyInterpreterFrame *f, int exc)
         assert(module != NULL);
         module_state *state = get_module_state(module);
         Py_DECREF(module);
-        int res = PyList_Append(state->record_list,
-                                FT_ATOMIC_LOAD_PTR_ACQUIRE(func->func_name));
+        PyObject *name = Py_NewRef(FT_ATOMIC_LOAD_PTR_ACQUIRE(func->func_name));
+        int res = PyList_Append(state->record_list, name);
+        Py_DECREF(name);
         if (res < 0) {
             return NULL;
         }
@@ -1204,8 +1205,9 @@ record_eval_interp(PyThreadState *tstate, struct _PyInterpreterFrame *f, int exc
         assert(module != NULL);
         module_state *state = get_module_state(module);
         Py_DECREF(module);
-        int res = PyList_Append(state->record_list,
-                                FT_ATOMIC_LOAD_PTR_ACQUIRE(func->func_name));
+        PyObject *name = Py_NewRef(FT_ATOMIC_LOAD_PTR_ACQUIRE(func->func_name));
+        int res = PyList_Append(state->record_list, name);
+        Py_DECREF(name);
         if (res < 0) {
             return NULL;
         }