gh-142349: Fix refcount corruption in lazy import specialization

[pablogsal]

_PyDict_LookupIndexAndValue() returns a borrowed reference via _Py_dict_lookup(), but specialize_load_global_lock_held() called Py_DECREF(value) on it when bailing out for lazy imports. Each time the adaptive counter fired while a lazy import was still in globals, this stole one reference from the dict's object. With 8+ threads racing through LOAD_GLOBAL during concurrent lazy import resolution, enough triggers accumulated to drive the refcount to zero while the dict and other threads still referenced the object, causing use-after-free.

• Issue: Implement PEP 810 #142349

[Yhg1s]

I don't think this is good enough for a free-threaded build. The error case happens when _PyImport_LoadLazyImportTstate is called with a borrowed reference. The GIL won't be protecting that borrowed reference in a free-threaded build, so the INCREF already happens too late. We need the caller to acquire an owned reference instead, in a safe way. But... where does this happen? As far as I can tell the callers all own the reference they pass.

[pablogsal]

But... where does this happen? As far as I can tell the callers all own the reference they pass.

If that were true then there would not be crashes no?

[Yhg1s]

If that were true then there would not be crashes no?

Unless the problem is actually something different, yes :) I would like to know which it is.

[pablogsal]

If that were true then there would not be crashes no?

Unless the problem is actually something different, yes :) I would like to know which it is.

Narrator: and the problem was indeed something different. Kind of