gh-148286: Fix undefined behaviour in per-thread refcount merging

Misc/NEWS.d/next/Core_and_Builtins/2026-07-30-14-30-00.gh-issue-148286.Wn5Tz4.rst

@@ -0,0 +1,5 @@
+Fix undefined behaviour in ``_PyObject_MergePerThreadRefcounts()`` on the
+free-threaded build. The per-thread reference count delta being merged is
+routinely negative, and it was shifted left by ``_Py_REF_SHARED_SHIFT``,
+which is undefined behaviour for a negative value. The shift is now done in
+the unsigned domain.

Python/uniqueid.c

@@ -181,8 +181,12 @@ _PyObject_MergePerThreadRefcounts(_PyThreadStateImpl *tstate)
         Py_ssize_t refcnt = tstate->refcounts.values[i];
         if (refcnt != 0) {
             PyObject *obj = pool->table[i].obj;
+            /* `refcnt` is a per-thread delta, so it is routinely negative,
+               and shifting a negative value left is undefined behaviour.
+               Shift in the unsigned domain instead. */
             _Py_atomic_add_ssize(&obj->ob_ref_shared,
-                                 refcnt << _Py_REF_SHARED_SHIFT);
+                                 (Py_ssize_t)((size_t)refcnt
+                                              << _Py_REF_SHARED_SHIFT));
             tstate->refcounts.values[i] = 0;
         }
     }