`with lock`: can skip `__exit__` when a signal handler raises right after `__enter__`

[colesbury]

Bug report

A with X: statement can return without calling X.__exit__ when a Python signal handler raises between __enter__ returning and the body starting.

This leaks whatever resource __enter__ acquired (e.g. a threading.Lock stays locked forever).

Cause

In 3.14, the following changed how with X: compiles:

• Lower BEFORE_WITH and BEFORE_ASYNC_WITH to attribute lookups and calls. #120507

Before 3.14:

LOAD X
BEFORE_WITH        # single op: calls enter, sets up exit on stack
POP_TOP            # <- exception table starts here
... body ...

BEFORE_WITH has no periodic/eval-breaker check, so there was no window for a signal handler to fire between __enter__ returning and the with-statement's exception handler being established.

From 3.14 onward:

LOAD X
COPY 1
LOAD_SPECIAL exit
SWAP 2 / SWAP 3
LOAD_SPECIAL enter
CALL 0             # ends with _CHECK_PERIODIC_AT_END
POP_TOP            # <- exception table starts here
... body ...

CALL includes _CHECK_PERIODIC_AT_END, which runs the Python signal handler. If that handler raises, JUMP_TO_LABEL(error) fires with frame->instr_ptr still pointing at CALL (set before the micro-ops run).

Reproducer (via Claude Code)

test_with_signal_leak.py

import ctypes, ctypes.util, signal, sys, threading

# signal.pthread_kill / os.kill both call PyErr_CheckSignals after the syscall,
# which perturbs timing enough to suppress the race. Use libc.pthread_kill
# directly.
_pthread_kill = ctypes.CDLL(ctypes.util.find_library("c")).pthread_kill
_pthread_kill.argtypes = [ctypes.c_ulong, ctypes.c_int]
_pthread_kill.restype = ctypes.c_int

_MAIN_TID = threading.get_ident()

def _handler(signum, frame):
    raise RuntimeError("signal")

def _send():
    _pthread_kill(_MAIN_TID, signal.SIGUSR1)

def run_trial(lock, iterations=200):
    t = threading.Thread(target=_send)
    t.start()
    try:
        for _ in range(iterations):
            with lock:
                pass
    except BaseException:
        pass
    try:
        t.join()
    except BaseException:
        pass
    if lock.locked():
        lock.release()
        return True
    return False

signal.signal(signal.SIGUSR1, _handler)
lock = threading.Lock()
leaked = 0
for _ in range(2000):
    try:
        if run_trial(lock):
            leaked += 1
    except BaseException:
        if lock.locked():
            lock.release()
print(f"leaked={leaked}/2000")

cc @markshannon

Linked PRs

• gh-148874: add flag to CALL to skip periodic check in with #149019
• GH-148874: Make sure that mngr.__exit__() is always called in a with statement #150911
• [3.15] Backport GH-148874: Make sure that mngr.__exit__() is always called in a with statement (GH-150911) #154830

[markshannon]

I see a three possible fixes for this:

1. Revert to the old START_WITH instruction
2. Add a new CALL_NO_CHECK instruction to replace the CALL in this case
3. Add a flag to the CALL instruction to tell it whether to do the periodic check

I don't like 1 as we would loose all interpreter specialization and JIT optimizations that we get for free by using LOAD_SPECIAL and CALL

2 is OK, but adds another instruction but we can't afford to specialize it, and optimizing it in the JIT would be awkward.

3 is clearly the best for this case, but potentially slows down all other calls which outnumber the calls to __enter__ considerably. Slowing down all other calls would be bad, but I think we can avoid the slowdown:

• Moving the check inside the the eval_breaker check, so we have no extra branch on the fast path.
• There is a shift to remove the flag, but that's a single ALU operation with no branching or memory access.

Overall, I think 3 is the best, and will allow us to skip the eval_breaker check for other calls where we don't want to allow interrupts.

[colesbury]

I think it'd be good to have an option that we can backport to 3.14 without changing the bytecode:

• Would it be possible to do the periodic check before the call (instead of after)?
• Maybe we could add logic to _Py_HandlePending to handle this case in 3.14?

[markshannon]

For 3.14 we could check whether the previous instruction was LOAD_SPECIAL. There is no harm in skipping the eval_breaker on the very rare false positive