gh-157194: Read the opcode atomically in the specializer

set_opcode() writes instr->op.code with an atomic compare-exchange and
unspecialize() reads it with FT_ATOMIC_LOAD_UINT8_RELAXED, but two reads
added later compare it directly. In a free-threaded build with -X tlbc=0
the bytecode is shared between threads, so those plain reads race with
the atomic write, as ThreadSanitizer reported on the CI job for
test_thread_local_bytecode.

Author: iamsharduld

Misc/NEWS.d/next/Core_and_Builtins/2026-09-08-17-40-00.gh-issue-157194.17Ffhk.rst

@@ -0,0 +1,4 @@
+Fix a data race in the free-threaded build, reported by ThreadSanitizer,
+between the specializer reading an instruction opcode and another thread
+writing it. Only reachable when thread-local bytecode is disabled with
+``-X tlbc=0``, which makes threads share one copy of the bytecode.

Python/specialize.c

@@ -2348,7 +2348,7 @@ _Py_Specialize_BinaryOp(_PyStackRef lhs_st, _PyStackRef rhs_st, _Py_CODEUNIT *in
     assert(_PyOpcode_Caches[BINARY_OP] == INLINE_CACHE_ENTRIES_BINARY_OP);
 
     _PyBinaryOpCache *cache = (_PyBinaryOpCache *)(instr + 1);
-    if (instr->op.code == BINARY_OP_EXTEND) {
+    if (FT_ATOMIC_LOAD_UINT8_RELAXED(instr->op.code) == BINARY_OP_EXTEND) {
         write_ptr(cache->external_cache, NULL);
     }
 
@@ -2954,7 +2954,8 @@ _Py_Specialize_GetIter(_PyStackRef iterable, _Py_CODEUNIT *instr)
 void
 _Py_Specialize_Resume(_Py_CODEUNIT *instr, PyThreadState *tstate, _PyInterpreterFrame *frame)
 {
-    if (tstate->tracing == 0 && instr->op.code == RESUME) {
+    if (tstate->tracing == 0 &&
+        FT_ATOMIC_LOAD_UINT8_RELAXED(instr->op.code) == RESUME) {
         if (tstate->interp->jit) {
             PyCodeObject *co = (PyCodeObject *)PyStackRef_AsPyObjectBorrow(frame->f_executable);
             if (co != NULL &&