tree 59f1161c85d92a96430e376c195fba05961808e0
parent 6dd1756f985816fbd06e13faeac9cda86c6b262e
author ymwang78 <wangym@gmail.com> 1785999923 +0800
committer GitHub <noreply@github.com> 1785999923 -0700
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJqdDIzCRC1aQ7uu5UhlAAAQKwQAB89ctSekNV1q8xxlr9oayPB
 uygA8cGchP+b+5qjgeX1LdzTtl3crnHHBx9fF4RE0gW5IiKWsSBUlmAauhIPbFQv
 a2GIfk1LK24yZ7Iv9GaG4ywtA/lC2X8rz3m6BjcpTh2Nm/WOvj22o0sMCV8GBZpl
 E/q8OQJB/7tcmTzcr4p1Hpvk3zxgz5lcFegm6byObamKlOyn6++TMu0opRQoNNi4
 OrzfDEQDB0QT9edM1FwbDHdsTTeEe+rTQuI4R3K8g3ySyUTWkr8rXtu3spOobCpd
 eUZMNRaildlGqv90eZk/5OaB60+YhO08PH0r8pUrVobnwKi7p1mC5wdFTDGQ0N5E
 z/0927dX0y2Co+sqK0jwV5nuQaMmLkQ2T9y7Zv/hTVy4hCbM3iUN1Z0D0QjMMi8k
 9bXr8IRiADKwHAycFrVW71Kz1GFWdK2NRAe2jQUiCO3nbU1Yq7czyDfj3shm5T+0
 idqXgZSbm4+PTBYRcmtrE6ynBUoDirpBlF6rRzGazR1/KG4qkdAlzSxLVDH3uM+Q
 xJsCrdJcFb04h88pbTZmKmk/94wSnc1lbvFcYmZLS0yDBq8ktEBNgreFb4/vFnWd
 tSTCYcpZiCwVzxeKJsZXi5p82wlvWMfQ+XQbT2s1uLF9wfZQv1YJP2AocpuFLoMj
 V8LDD4EY4ooH6OUL6HWM
 =5EZQ
 -----END PGP SIGNATURE-----
 

fix(subinterpreter): don't touch the thread state before create() attaches one (#6127)

`subinterpreter::create()` documents that "the main interpreter and its GIL
are not required to be held prior to calling this function", but its first
statement is `error_scope err_scope;`, i.e. `PyErr_Fetch()`, before
`main_guard` attaches a thread state. With no current `PyThreadState`,
`PyErr_Fetch()` -> `_PyErr_GetRaisedException(NULL)` dereferences null and
the process dies (SIGSEGV; 0xC0000005 on Windows). `~error_scope` is the
mirror image: it calls `PyErr_Restore()` after `main_guard` has already
swapped the thread state back away.

Two ordinary situations reach `create()` with no thread state:

- an embedder that ends its initialization with `PyEval_SaveThread()`,
  which is the documented way to hand the GIL back after
  `Py_InitializeFromConfig()`;
- any worker thread that has never touched Python.

Existing tests never hit this because they all run under the
`py::scoped_interpreter guard{}` in catch.cpp, which keeps the GIL held on
the main thread for the whole run.

Move `error_scope` inside the `main_guard` scope. The case it exists for is
unaffected: a caller that already holds the main GIL takes
`subinterpreter_scoped_activate`'s `simple_gil_` fast path, which keeps the
same thread state, so its pending error is still saved across
`Py_NewInterpreterFromConfig()` and restored afterwards. A caller sitting on
some other interpreter never had its error indicator touched in the first
place, since everything inside the block runs on the main interpreter's
thread state and `PyThreadState_Swap()` does not move error indicators. It
also makes the `pybind11_fail()` path unwind in a safer order: `~error_scope`
now runs while `main_guard` is still alive.

Add "Create Subinterpreter without a thread state", covering both a thread
that dropped its thread state via `gil_scoped_release` and a thread that
never had one. It segfaults without the fix and passes with it.

Verified on Windows / MSVC 14.51 / CPython 3.13.14: test_with_catch goes
from 33 to 34 test cases, all passing.

Assisted-by: ClaudeCode:claude-opus-5