Fix object.__getstate__ deadlock and panic on __slotnames__ - #8981

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

object.__getstate__ now validates cached slot names, releases the list lock during attribute lookup, propagates lookup and insertion errors, and raises RuntimeError if the slot-name list changes length. Tests cover these cases and missing slots.

Changes

Object getstate slot handling

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Suggested reviewers: youknowone

Security Blast Radius

• inferred — The established exposure is serialization within a threaded interpreter where code can mutate the cached slot-name list. A native panic can disrupt the invoking execution context. No remote entrypoint, cross-tenant reachability, or privilege gain is established by the inspected call paths; whole-process impact remains embedding-dependent.

Security Findings and Attack Paths

• inferred — A concurrent mutator can clear the cached list after the serializer reads its original length but before the serializer acquires the next read guard. Indexing the shortened slice then raises a Rust bounds panic, not a Python exception. The same race can occur between iterations. This is a newly introduced failure path supported by source analysis, not an executed exploit.

Trust Boundaries and Controls

• observed — Thread creation retains its audit event, isolated-subinterpreter restriction, and shutdown check. The concern does not require bypassing these controls: it applies where concurrent execution is permitted and Python-controlled list contents reach unchecked native indexing.

Resilience and Maintainability Implications

• inferred — Normal serialization errors preserve local result containment, but a Rust panic is outside the thread runner's Python-error handling. If serialization runs in such a worker, unwinding can skip its later sentinel release and thread-count cleanup. VM attachment itself has an unwind cleanup guard, limiting but not eliminating the recovery concern.

Hardening Proposals

• proposed — Validate the current list length and obtain the next name under the same read guard, returning a Python error rather than indexing an invalid position. Release that guard before attribute lookup and retain the post-callback size check. This preserves reentrant callback handling while restoring atomic validation of each read.

❌ Failed checks (1 warning)

• X
• Mastodon
• Reddit
• LinkedIn