Merge branch '3.15' into backport-ac2e14b-3.15

Author: sobolevn

.github/workflows/build.yml

@@ -601,7 +601,6 @@ jobs:
         - Thread
         free-threading:
         - false
-        - true
         sanitizer:
         - TSan
         include:
@@ -613,6 +612,17 @@ jobs:
       sanitizer: ${{ matrix.sanitizer }}
       free-threading: ${{ matrix.free-threading }}
 
+  # XXX: Temporarily allow this job to fail to not block PRs.
+  build-san-free-threading:
+    # ${{ '' } is a hack to nest jobs under the same sidebar category.
+    name: Sanitizers${{ '' }}  # zizmor: ignore[obfuscation]
+    needs: build-context
+    if: needs.build-context.outputs.run-ubuntu == 'true'
+    uses: ./.github/workflows/reusable-san.yml
+    with:
+      sanitizer: TSan
+      free-threading: true
+
   cross-build-linux:
     name: Cross build Linux
     runs-on: ubuntu-latest
@@ -716,6 +726,7 @@ jobs:
     - test-hypothesis
     - build-asan
     - build-san
+    - build-san-free-threading
     - cross-build-linux
     - cifuzz
     if: always()
@@ -727,6 +738,7 @@ jobs:
         allowed-failures: >-
           build-android,
           build-emscripten,
+          build-san-free-threading,
           build-windows-msi,
           build-ubuntu-ssltests,
           test-hypothesis,

Lib/test/test_ssl.py

@@ -1606,19 +1606,24 @@ def dummycallback(sock, servername, ctx, cycle=ctx):
         gc.collect()
         self.assertIs(wr(), None)
 
-    @unittest.skipUnless(support.Py_GIL_DISABLED,
-                         "test is only useful if the GIL is disabled")
     @threading_helper.requires_working_threading()
     def test_sni_callback_race(self):
-        # Replacing sni_callback while handshakes are in-flight must not
+        # Replacing sni_callback while a handshake is in-flight must not
         # crash (use-after-free on the callback in free-threaded builds).
+        #
+        # Use a single handshake thread: OpenSSL has internal data races
+        # on shared SSL_CTX state when multiple handshakes run
+        # concurrently against the same context (gh-150191). Concurrency
+        # on the *setter* is what exercises the fix from gh-149816, so
+        # multiple toggler threads race against each other and against
+        # the one handshake worker.
         client_ctx, server_ctx, hostname = testing_context()
 
         server_ctx.sni_callback = lambda *a: None
-        done = threading.Event()
+        deadline = time.monotonic() + 0.1
 
         def do_handshakes():
-            while not done.is_set():
+            while time.monotonic() < deadline:
                 c_in = ssl.MemoryBIO()
                 c_out = ssl.MemoryBIO()
                 s_in = ssl.MemoryBIO()
@@ -1645,19 +1650,11 @@ def do_handshakes():
                         c_in.write(s_out.read())
 
         def toggle_callback():
-            while not done.is_set():
+            while time.monotonic() < deadline:
                 server_ctx.sni_callback = lambda *a: None
                 server_ctx.sni_callback = None
 
-        workers = max(4, (os.cpu_count() or 4) * 2)
-        threads = [threading.Thread(target=do_handshakes)
-                   for _ in range(workers)]
-        threads.append(threading.Thread(target=toggle_callback))
-
-        with threading_helper.catch_threading_exception() as cm:
-            with threading_helper.start_threads(threads):
-                done.set()
-            self.assertIsNone(cm.exc_value)
+        threading_helper.run_concurrently([do_handshakes] + 4 * [toggle_callback])
 
     def test_cert_store_stats(self):
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

Lib/test/test_tkinter/test_misc.py

@@ -2,13 +2,15 @@
 import functools
 import platform
 import sys
+import textwrap
 import unittest
 import weakref
 import tkinter
 from tkinter import TclError
 import enum
 from test import support
 from test.support import os_helper
+from test.support.script_helper import assert_python_ok
 from test.test_tkinter.support import setUpModule  # noqa: F401
 from test.test_tkinter.support import (AbstractTkTest, AbstractDefaultRootTest,
                                        requires_tk, get_tk_patchlevel,
@@ -53,6 +55,33 @@ class Button2(tkinter.Button):
         b4 = Button2(f2)
         self.assertEqual(len({str(b), str(b2), str(b3), str(b4)}), 4)
 
+    def test_dealloc_in_wrong_thread(self):
+        # gh-83274: deallocating the interpreter in the wrong thread must not
+        # crash.
+        script = textwrap.dedent("""
+            import threading
+            import tkinter
+            root = tkinter.Tk()
+            root.destroy()
+            # Let another thread drop the last reference.
+            ready = threading.Event()
+            t = threading.Thread(target=lambda obj: ready.wait(), args=(root,))
+            t.start()
+            del root
+            ready.set()
+            t.join()
+            print('ok')
+        """)
+        rc, out, err = assert_python_ok('-c', script)
+        self.assertEqual(out.strip(), b'ok')
+        if not support.Py_GIL_DISABLED:
+            # On the free-threaded build the interpreter may instead be
+            # deallocated in its own thread (deferred reference counting), so
+            # the warning is not necessarily emitted.  The crucial guarantee --
+            # no crash -- is already checked by assert_python_ok() above.
+            self.assertIn(b'RuntimeWarning', err)
+            self.assertIn(b'gh-83274', err)
+
     @requires_tk(8, 6, 6)
     def test_tk_busy(self):
         root = self.root

Misc/NEWS.d/next/Core_and_Builtins/2026-07-07-04-16-48.gh-issue-153205.5fE8QZ.rst

@@ -0,0 +1,2 @@
+Fix a potential :exc:`SystemError` during vector calls when memory allocation fails.
+A :exc:`MemoryError` is now raised instead.

Misc/NEWS.d/next/Library/2026-06-26-16-30-00.gh-issue-83274.Kx9mQv.rst

@@ -0,0 +1,3 @@
+Deallocating a :mod:`tkinter` application from a thread other than the one it
+was created in no longer crashes the interpreter.  The underlying Tcl
+interpreter is leaked instead, and a :exc:`RuntimeWarning` is reported.

Modules/_tkinter.c

@@ -3132,10 +3132,24 @@ Tkapp_Dealloc(PyObject *op)
 {
     TkappObject *self = TkappObject_CAST(op);
     PyTypeObject *tp = Py_TYPE(self);
-    /*CHECK_TCL_APPARTMENT;*/
-    ENTER_TCL
-    Tcl_DeleteInterp(Tkapp_Interp(self));
-    LEAVE_TCL
+    if (self->threaded && self->thread_id != Tcl_GetCurrentThread()) {
+        /* Deleting the interpreter from another thread aborts the process
+           ("Tcl_AsyncDelete: async handler deleted by the wrong thread").
+           Leak it instead (gh-83274). */
+        if (PyErr_WarnEx(PyExc_RuntimeWarning,
+                         "the Tcl interpreter is leaked because it was "
+                         "deallocated in a thread other than the one it was "
+                         "created in (see gh-83274)", 1) < 0)
+        {
+            PyErr_FormatUnraisable("Exception ignored while finalizing "
+                                   "a Tcl interpreter");
+        }
+    }
+    else {
+        ENTER_TCL
+        Tcl_DeleteInterp(Tkapp_Interp(self));
+        LEAVE_TCL
+    }
     Py_XDECREF(self->trace);
     PyObject_Free(self);
     Py_DECREF(tp);

Python/ceval.c

@@ -1057,6 +1057,7 @@ _PyObjectArray_FromStackRefArray(_PyStackRef *input, Py_ssize_t nargs, PyObject
         // +1 in case PY_VECTORCALL_ARGUMENTS_OFFSET is set.
         result = PyMem_Malloc((nargs + 1) * sizeof(PyObject *));
         if (result == NULL) {
+            PyErr_NoMemory();
             return NULL;
         }
     }