fix PyTypeObject->tp_base race in free threading

Author: LindaSummer

Lib/test/test_free_threading/test_type.py

@@ -141,6 +141,25 @@ def reader():
 
         self.run_one(writer, reader)
 
+    def test_bases_change(self):
+        class BaseA:
+            pass
+
+        class Derived(BaseA):
+            pass
+
+        def writer():
+            for _ in range(1000):
+                class BaseB:
+                    pass
+                Derived.__bases__ = (BaseB,)
+
+        def reader():
+            for _ in range(1000):
+                Derived.__base__
+
+        self.run_one(writer, reader)
+
     def run_one(self, writer_func, reader_func):
         barrier = threading.Barrier(NTHREADS)
 

Misc/NEWS.d/next/Core_and_Builtins/2025-10-24-14-29-12.gh-issue-133465.A5d6TM.rst

@@ -0,0 +1 @@
+Fix race when updating ``type.__bases__`` that could allow a read of ``type.__base__`` to observe an inconsistent value on the free threaded build.

Objects/typeobject.c

@@ -1921,7 +1921,11 @@ type_set_bases_unlocked(PyTypeObject *type, PyObject *new_bases, PyTypeObject *b
     PyTypeObject *old_base = type->tp_base;
 
     set_tp_bases(type, Py_NewRef(new_bases), 0);
+
+    PyInterpreterState *interp = _PyInterpreterState_GET();
+    _PyEval_StopTheWorld(interp);
     type->tp_base = (PyTypeObject *)Py_NewRef(best_base);
+    _PyEval_StartTheWorld(interp);
 
     PyObject *temp = PyList_New(0);
     if (temp == NULL) {
@@ -1983,7 +1987,9 @@ type_set_bases_unlocked(PyTypeObject *type, PyObject *new_bases, PyTypeObject *b
         assert(type->tp_base == best_base);
 
         set_tp_bases(type, old_bases, 0);
+        _PyEval_StopTheWorld(interp);
         type->tp_base = old_base;
+        _PyEval_StartTheWorld(interp);
 
         Py_DECREF(new_bases);
         Py_DECREF(best_base);