fix: serialize cross-extension Go calls via a process-wide pthread mutex

Loading two gopy extensions in the same Python process embeds two
independent Go runtimes. On macOS x86_64 / Go ≥1.24 this causes
"fatal error: bad sweepgen in refill" (issue #370) when both runtimes
run Go code concurrently.

Add a process-wide pthread_mutex_t stored as a Python capsule in
builtins._gopy_global_mu so every gopy extension in the same interpreter
shares the same lock. The generated CGo wrappers:

  1. Call gopy_ensure_mu() (lazy init, Python GIL must be held) before
     releasing the GIL.
  2. Release the GIL via PyEval_SaveThread.
  3. Acquire the mutex via gopy_lock() — blocking until any other
     extension's Go call finishes.
  4. Release the mutex (gopy_unlock()) before restoring the GIL
     (PyEval_RestoreThread), avoiding the GIL/mutex deadlock.

On Windows the lock/unlock are compiled as no-ops.

Fixes #370 / #385.

Author: b-long

bind/gen.go

@@ -87,6 +87,42 @@ static inline void gopy_err_handle() {
 		PyErr_Print();
 	}
 }
+// gopy_lock / gopy_unlock serialize all gopy extension calls to prevent
+// concurrent Go runtimes in the same process from corrupting each other's
+// GC sweep-generation counters (issue #370 / #385).
+// On non-Windows, the mutex lives in builtins._gopy_global_mu so every
+// extension loaded in the same Python process shares the same instance.
+// gopy_ensure_mu() must be called while the Python GIL is held (before
+// each PyEval_SaveThread), after which gopy_lock/unlock need no GIL.
+#ifndef _WIN32
+#include <pthread.h>
+#include <stdlib.h>
+static pthread_mutex_t *_gopy_mu = NULL;
+static void gopy_ensure_mu(void) {
+	if (_gopy_mu) return;
+	PyObject *bi = PyImport_ImportModule("builtins");
+	if (!bi) { PyErr_Clear(); return; }
+	PyObject *cap = PyObject_GetAttrString(bi, "_gopy_global_mu");
+	if (cap && PyCapsule_CheckExact(cap)) {
+		_gopy_mu = (pthread_mutex_t *)PyCapsule_GetPointer(cap, "gopy.global_mu");
+		Py_DECREF(cap);
+	} else {
+		PyErr_Clear();
+		pthread_mutex_t *mu = (pthread_mutex_t *)malloc(sizeof(pthread_mutex_t));
+		pthread_mutex_init(mu, NULL);
+		PyObject *nc = PyCapsule_New(mu, "gopy.global_mu", NULL);
+		if (nc) { PyObject_SetAttrString(bi, "_gopy_global_mu", nc); Py_DECREF(nc); }
+		_gopy_mu = mu;
+	}
+	Py_DECREF(bi);
+}
+static inline void gopy_lock(void)   { if (_gopy_mu) pthread_mutex_lock(_gopy_mu); }
+static inline void gopy_unlock(void) { if (_gopy_mu) pthread_mutex_unlock(_gopy_mu); }
+#else
+static void          gopy_ensure_mu(void) {}
+static inline void   gopy_lock(void)      {}
+static inline void   gopy_unlock(void)    {}
+#endif
 %[8]s
 */
 import "C"

bind/gen_func.go

@@ -305,11 +305,19 @@ func (g *pyGen) genFuncBody(sym *symbol, fsym *Func) {
 		g.gofile.Printf("C.PyGILState_Release(_gstate)\n")
 	}
 
-	// release GIL
+	// Ensure the process-wide mutex is initialized (lazy, GIL must be held).
+	g.gofile.Printf("C.gopy_ensure_mu()\n")
+	// release GIL then acquire the process-wide runtime mutex.
+	// Ordering: GIL released first so that a second Python thread blocked on
+	// the mutex does not hold the GIL while we try to reclaim it, which would
+	// deadlock.  gopy_unlock must run before PyEval_RestoreThread (LIFO defer).
 	g.gofile.Printf("_saved_thread := C.PyEval_SaveThread()\n")
+	g.gofile.Printf("C.gopy_lock()\n")
 	if !rvIsErr && nres != 2 {
-		// reacquire GIL after return
+		// PyEval_RestoreThread deferred first → runs last (LIFO).
 		g.gofile.Printf("defer C.PyEval_RestoreThread(_saved_thread)\n")
+		// gopy_unlock deferred second → runs first (LIFO): release mutex before reclaiming GIL.
+		g.gofile.Printf("defer C.gopy_unlock()\n")
 	}
 
 	if isMethod {
@@ -462,7 +470,8 @@ if __err != nil {
 
 	if rvIsErr || nres == 2 {
 		g.gofile.Printf("\n")
-		// reacquire GIL
+		// release mutex then reacquire GIL
+		g.gofile.Printf("C.gopy_unlock()\n")
 		g.gofile.Printf("C.PyEval_RestoreThread(_saved_thread)\n")
 
 		g.gofile.Printf("if __err != nil {\n")