_remote_debugging: RemoteUnwinder caches the interpreters list head in __init__ as the main interpreter #159262

Bug report

An existing RemoteUnwinder misses interpreters created after its constructor runs. If the saved interpreter closes, later samples can read freed memory. The default mode also selects the main thread of the newest interpreter and can omit the main interpreter.

Found while reviewing #158900, #158971 and working on #159259.

Reproduction

A new interpreter is missing from an existing unwinder

The existing unwinder returns only interpreter 0. A new unwinder sees both interpreters:

import os
from concurrent import interpreters
from _remote_debugging import RemoteUnwinder

unwinder = RemoteUnwinder(os.getpid(), all_threads=True)
interp = interpreters.create()
try:
    print([i.interpreter_id for i in unwinder.get_stack_trace()])
    fresh = RemoteUnwinder(os.getpid(), all_threads=True)
    print([i.interpreter_id for i in fresh.get_stack_trace()])
finally:
    interp.close()

2026-10-12T22:43:31.492120000+0200 maurycy@gimel /Users/maurycy/work/cpython (main 5e049c3) % ./python.exe /tmp/aaa.py
[0]
[1, 0]

The saved interpreter closes

maurycy@gimel cpython (main 9028df3) % cat /tmp/repro_dangling.py
import os
from concurrent import interpreters
from _remote_debugging import RemoteUnwinder

interp = interpreters.create()
unwinder = RemoteUnwinder(os.getpid(), all_threads=True)
interp.close()
print([i.interpreter_id for i in unwinder.get_stack_trace()])
maurycy@gimel cpython (main 9028df3) % ./python.exe /tmp/repro_dangling.py
Traceback (most recent call last):
  File "/tmp/repro_dangling.py", line 8, in <module>
    print([i.interpreter_id for i in unwinder.get_stack_trace()])
                                     ~~~~~~~~~~~~~~~~~~~~~~~~^^
RuntimeError: mach_vm_read_overwrite failed for PID 32948 at address 0xdddddddddddddddd (size 888): kern_return_t 1

0xdd is the debug allocator's dead byte (with PYTHONMALLOC=debug)

The default mode omits the main interpreter

from concurrent import interpreters

interp = interpreters.create()
try:
    interp.exec("""
import os
from _remote_debugging import RemoteUnwinder
for all_threads in (False, True):
    unwinder = RemoteUnwinder(os.getpid(), all_threads=all_threads)
    unwinder.get_stack_trace()
    print(all_threads, [i.interpreter_id for i in unwinder.get_stack_trace()])
""")
finally:
    interp.close()

2026-10-12T22:54:47.076383000+0200 maurycy@gimel /Users/maurycy/work/cpython (main 5e049c3) % ./python.exe /tmp/xoxo.py
False [1]
True [1, 0]

2026-10-12T22:54:49.923205000+0200 maurycy@gimel /Users/maurycy/work/cpython (main 5e049c3) % cat /tmp/repro_idle_default.py
import os, threading, time
from concurrent import interpreters
from _remote_debugging import RemoteUnwinder

ev = threading.Event()
t = threading.Thread(target=ev.wait); t.start()
interp = interpreters.create()
for kwargs in ({}, {"all_threads": True}):
    u = RemoteUnwinder(os.getpid(), **kwargs); u.get_stack_trace()
    print(kwargs, [(i.interpreter_id, len(i.threads)) for i in u.get_stack_trace()])
ev.set(); t.join(); interp.close()
2026-10-12T22:55:14.833746000+0200 maurycy@gimel /Users/maurycy/work/cpython (main 5e049c3) % ./python.exe /tmp/repro_idle_default.py
{} [(1, 0), (0, 2)]
{'all_threads': True} [(1, 0), (0, 2)]

maurycy@gimel cpython (main 9028df3) % cat /tmp/repro_stale_tstate.py
import os, threading, time
from concurrent import interpreters
from _remote_debugging import RemoteUnwinder

interp = interpreters.create()
t = threading.Thread(target=interp.exec, args=("import time; time.sleep(0.5)",)); t.start(); time.sleep(0.2)
unwinder = RemoteUnwinder(os.getpid())
t.join()
print([(i.interpreter_id, [f.funcname for t in i.threads for f in t.frame_info]) for i in unwinder.get_stack_trace()])
interp.close()
maurycy@gimel cpython (main 9028df3) % ./python.exe /tmp/repro_stale_tstate.py
[(1, [])]

Cause

The constructor saves runtime->interpreters.head as self->interpreter_addr.

With all_threads=False, it also saves head->threads_main as self->tstate_addr:

Where:

• New interpreters are prepended. A saved head can omit new entries or point to freed memory.
• The head provides the thread to sample. It is the newest interpreter, and get_stack_trace() stops after it when the saved thread address is non-zero.

An idle subinterpreter has threads_main == NULL. That sets tstate_addr to zero, which seems to select all threads. A running subinterpreter can also release its saved main thread state after exec() returns:

Two questions:

• The CLI docs say "only the main thread". The method docstring says "the main thread of each interpreter". Sampling each interpreter's main thread would follow the method docstring.
• Some embedders may not set threads.main. The proposed selection returns no default-mode threads for those interpreters, instead of accidentally returning all threads.

CPython versions tested on:

CPython main branch

Operating systems tested on:

macOS