Possible data race in `dictiter_iternext` with with free-threading build

[Naserume]

Bug description:

With free-threading, it is possible to read di->di_dict, while it is being written.

cpython/Objects/dictobject.c

Lines 5611 to 5615 in f93834f

	static PyObject*
	dictiter_iternextkey(PyObject *self)
	{
	dictiterobject *di = (dictiterobject *)self;
	PyDictObject *d = di->di_dict;

cpython/Objects/dictobject.c

Lines 5848 to 5862 in f93834f

	di->di_pos = i+1;
	di->len--;
	if (out_key != NULL) {
	*out_key = Py_NewRef(key);
	}
	if (out_value != NULL) {
	*out_value = Py_NewRef(value);
	}
	return 0;
	fail:
	di->di_dict = NULL;
	Py_DECREF(d);
	return -1;
	}

Reproducer:

import threading

d = {str(i): i for i in range(1000)}
it = iter(d)

barrier = threading.Barrier(2)


def run():
    barrier.wait()
    for _ in range(10000):
        try:
            next(it)
        except StopIteration:
            pass


t1 = threading.Thread(target=run)
t2 = threading.Thread(target=run)
t1.start()
t2.start()
t1.join()
t2.join()

TSAN report:

WARNING: ThreadSanitizer: data race (pid=2919507)
  Write of size 8 at 0x7fffb66d6bf0 by thread T2:
    #0 dictiter_iternextitem_lock_held /cpython/Objects/dictobject.c:5859:17 (python3.15t+0x2ada61) 
    #1 dictiter_iternext_threadsafe /cpython/Objects/dictobject.c:5995:11 (python3.15t+0x2ada61)
    #2 dictiter_iternextkey /cpython/Objects/dictobject.c:5622:9 (python3.15t+0x2a2211) 
    #3 builtin_next /cpython/Python/bltinmodule.c:1764:11 (python3.15t+0x423b62) 
    #4 _Py_BuiltinCallFast_StackRef /cpython/Python/ceval.c:824:11 (python3.15t+0x43223d) 
    #5 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:2409:35 (python3.15t+0x43223d)
    #6 _PyEval_EvalFrame /cpython/./Include/internal/pycore_ceval.h:118:16 (python3.15t+0x429900) 
    #7 _PyEval_Vector /cpython/Python/ceval.c:2124:12 (python3.15t+0x429900)
    #8 _PyFunction_Vectorcall /cpython/Objects/call.c (python3.15t+0x21131f) 
    #9 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11 (python3.15t+0x212e59) 
    #10 _PyObject_VectorcallPrepend /cpython/Objects/call.c:855:20 (python3.15t+0x212e59)
    #11 method_vectorcall /cpython/Objects/classobject.c:55:12 (python3.15t+0x21638f) 
    #12 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11 (python3.15t+0x481401) 
    #13 context_run /cpython/Python/context.c:727:29 (python3.15t+0x481401)
    #14 method_vectorcall_FASTCALL_KEYWORDS /cpython/Objects/descrobject.c:421:24 (python3.15t+0x22b067) 
    #15 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11 (python3.15t+0x210ca3) 
    #16 PyObject_Vectorcall /cpython/Objects/call.c:327:12 (python3.15t+0x210ca3)
    #17 _Py_VectorCallInstrumentation_StackRefSteal /cpython/Python/ceval.c:775:11 (python3.15t+0x42a52c) 
    #18 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:1846:35 (python3.15t+0x43031e) 
    #19 _PyEval_EvalFrame /cpython/./Include/internal/pycore_ceval.h:118:16 (python3.15t+0x429900) 
    #20 _PyEval_Vector /cpython/Python/ceval.c:2124:12 (python3.15t+0x429900)
    #21 _PyFunction_Vectorcall /cpython/Objects/call.c (python3.15t+0x21131f) 
    #22 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11 (python3.15t+0x212e59) 
    #23 _PyObject_VectorcallPrepend /cpython/Objects/call.c:855:20 (python3.15t+0x212e59)
    #24 method_vectorcall /cpython/Objects/classobject.c:55:12 (python3.15t+0x21638f) 
    #25 _PyVectorcall_Call /cpython/Objects/call.c:273:16 (python3.15t+0x210fab) 
    #26 _PyObject_Call /cpython/Objects/call.c:348:16 (python3.15t+0x210fab)
    #27 PyObject_Call /cpython/Objects/call.c:373:12 (python3.15t+0x211015) 
    #28 thread_run /cpython/./Modules/_threadmodule.c:388:21 (python3.15t+0x606be2) 
    #29 pythread_wrapper /cpython/Python/thread_pthread.h:234:5 (python3.15t+0x536447) 

  Previous read of size 8 at 0x7fffb66d6bf0 by thread T1:
    #0 dictiter_iternextkey /cpython/Objects/dictobject.c:5615:27 (python3.15t+0x2a21f9) 
    #1 builtin_next /cpython/Python/bltinmodule.c:1764:11 (python3.15t+0x423b62) 
    #2 _Py_BuiltinCallFast_StackRef /cpython/Python/ceval.c:824:11 (python3.15t+0x43223d) 
    #3 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:2409:35 (python3.15t+0x43223d)
    #4 _PyEval_EvalFrame /cpython/./Include/internal/pycore_ceval.h:118:16 (python3.15t+0x429900) 
    #5 _PyEval_Vector /cpython/Python/ceval.c:2124:12 (python3.15t+0x429900)
    #6 _PyFunction_Vectorcall /cpython/Objects/call.c (python3.15t+0x21131f) 
    #7 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11 (python3.15t+0x212e59) 
    #8 _PyObject_VectorcallPrepend /cpython/Objects/call.c:855:20 (python3.15t+0x212e59)
    #9 method_vectorcall /cpython/Objects/classobject.c:55:12 (python3.15t+0x21638f) 
    #10 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11 (python3.15t+0x481401) 
    #11 context_run /cpython/Python/context.c:727:29 (python3.15t+0x481401)
    #12 method_vectorcall_FASTCALL_KEYWORDS /cpython/Objects/descrobject.c:421:24 (python3.15t+0x22b067) 
    #13 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11 (python3.15t+0x210ca3) 
    #14 PyObject_Vectorcall /cpython/Objects/call.c:327:12 (python3.15t+0x210ca3)
    #15 _Py_VectorCallInstrumentation_StackRefSteal /cpython/Python/ceval.c:775:11 (python3.15t+0x42a52c) 
    #16 _PyEval_EvalFrameDefault /cpython/Python/generated_cases.c.h:1846:35 (python3.15t+0x43031e) 
    #17 _PyEval_EvalFrame /cpython/./Include/internal/pycore_ceval.h:118:16 (python3.15t+0x429900) 
    #18 _PyEval_Vector /cpython/Python/ceval.c:2124:12 (python3.15t+0x429900)
    #19 _PyFunction_Vectorcall /cpython/Objects/call.c (python3.15t+0x21131f) 
    #20 _PyObject_VectorcallTstate /cpython/./Include/internal/pycore_call.h:144:11 (python3.15t+0x212e59) 
    #21 _PyObject_VectorcallPrepend /cpython/Objects/call.c:855:20 (python3.15t+0x212e59)
    #22 method_vectorcall /cpython/Objects/classobject.c:55:12 (python3.15t+0x21638f) 
    #23 _PyVectorcall_Call /cpython/Objects/call.c:273:16 (python3.15t+0x210fab) 
    #24 _PyObject_Call /cpython/Objects/call.c:348:16 (python3.15t+0x210fab)
    #25 PyObject_Call /cpython/Objects/call.c:373:12 (python3.15t+0x211015) 
    #26 thread_run /cpython/./Modules/_threadmodule.c:388:21 (python3.15t+0x606be2) 
    #27 pythread_wrapper /cpython/Python/thread_pthread.h:234:5 (python3.15t+0x536447) 

CPython versions tested on:

Python 3.15.0a8+ free-threading build (heads/main:f93834ff011, Apr 22 2026, 11:41:06)

Operating systems tested on:

Linux