Fix set___name__ and set___qualname__ deadlock (#5956)

youknowone · web-flow · commit e21ec550d4cf · 2025-07-13T00:22:41.000+09:00
diff --git a/Lib/test/test_descr.py b/Lib/test/test_descr.py
@@ -4261,7 +4261,6 @@ class C(object):
         C.__name__ = 'D.E'
         self.assertEqual((C.__module__, C.__name__), (mod, 'D.E'))
 
-    @unittest.skip("TODO: RUSTPYTHON, rustpython hang")
     def test_evil_type_name(self):
         # A badly placed Py_DECREF in type_set_name led to arbitrary code
         # execution while the type structure was not in a sane state, and a
diff --git a/vm/src/builtins/type.rs b/vm/src/builtins/type.rs
@@ -680,7 +680,15 @@ impl PyType {
             .heaptype_ext
             .as_ref()
             .expect("HEAPTYPE should have heaptype_ext");
-        *heap_type.qualname.write() = str_value;
+
+        // Use std::mem::replace to swap the new value in and get the old value out,
+        // then drop the old value after releasing the lock
+        let _old_qualname = {
+            let mut qualname_guard = heap_type.qualname.write();
+            std::mem::replace(&mut *qualname_guard, str_value)
+        };
+        // old_qualname is dropped here, outside the lock scope
+
         Ok(())
     }
 
@@ -837,7 +845,13 @@ impl PyType {
             return Err(vm.new_value_error("type name must not contain null characters"));
         }
 
-        *self.heaptype_ext.as_ref().unwrap().name.write() = name;
+        // Use std::mem::replace to swap the new value in and get the old value out,
+        // then drop the old value after releasing the lock (similar to CPython's Py_SETREF)
+        let _old_name = {
+            let mut name_guard = self.heaptype_ext.as_ref().unwrap().name.write();
+            std::mem::replace(&mut *name_guard, name)
+        };
+        // old_name is dropped here, outside the lock scope
 
         Ok(())
     }
