On the free-threaded build, calling syslog.openlog() (without ident) in several threads while another thread assigns sys.argv[0] crashes the interpreter with SIGSEGV.
I ran the script below as a separate process (python3.14t repro.py, 5 times, default environment) on macOS 27.0.1 arm64 with the python-build-standalone build cpython-3.14.6+freethreaded-macos-aarch64-none installed by uv. Every run was killed by a signal: SIGSEGV in 2 runs and SIGTRAP in 3 (shell exit codes 139 and 133). An earlier driver with the same structure (three openlog() threads, one writer, 4 s, PYTHONMALLOC=debug) crashed 3.14.0rc1, 3.14.6 and 3.15.0b4 in 5 of 5 runs each; only the last 200 characters of stderr were kept from those runs, so they give no crash-site evidence. I have not tested 3.14.8 or main.
Reading the source on main (4c73f50, lines 109–110), syslog_get_argv() in Modules/syslogmodule.c takes sys.argv[0] with PyList_GetItem() (a borrowed reference) and increfs it only afterwards. This suggests a possible borrowed-reference lifetime race with a concurrent replacement of sys.argv[0]; I have not established that this race causes the observed SIGSEGV. PyList_GetItemRef() may address this particular window; I have not validated a patch.
The same pattern was listed as item 91 of #157197, which was closed for procedural reasons and whose linked gists are gone; I am not aware of another report specifically tracking it.
Reproducer (run as a separate process; repeat a few times)
importsysimportsyslogimportthreadingimporttimeassertnotsys._is_gil_enabled(), "needs a free-threaded build with the GIL disabled"stop=threading.Event()
defreader():
whilenotstop.is_set():
syslog.openlog()
defwriter():
i=0whilenotstop.is_set():
i+=1sys.argv[0] =f"prog-{i}"+"z"*24threads= [threading.Thread(target=reader) for_inrange(3)]
threads.append(threading.Thread(target=writer))
fortinthreads:
t.start()
time.sleep(4)
stop.set()
fortinthreads:
t.join()
syslog.closelog()
print("no crash in 4 s")
I can reproduce this on main with a free-threaded debug build. It crashes in syslog_get_argv() on the freed sys.argv[0], and switching to PyList_GetItemRef() fixes it. @espressolee do you want to open the PR, or should I?
Activity
lazerg commented on Oct 20, 2026
I can reproduce this on main with a free-threaded debug build. It crashes in syslog_get_argv() on the freed sys.argv[0], and switching to PyList_GetItemRef() fixes it. @espressolee do you want to open the PR, or should I?
espressolee commented on Oct 20, 2026
Thanks for confirming it on main and pinning down the cause! I'd like to open the PR, and I'll add you as a co-author. I'll link it here.