As pointed out by @AK2000, it is still possible for _Task._submit() to be invoked twice.

The condition is that a task's parent future is already completed, so adding the callback immediately invokes the callback. The callback, which can run in a separate thread (depending on the executor implementation), get's far enough to remove the future from self.pending_futures, making it's length 0. Then, before the callback invokes _submit(), the thread executing __init__() gets to the end, sees len(self.pending_futures) == 0 and calls _submit() itself. Afterwards, the callback thread continues executing and calls _submit() again.

I think this calls for an RLock around __init__ and _pending_future_callback.