Stowage/cpython
2
0
Fork 0
mirror of https://github.com/python/cpython.git synced 2026-06-05 01:10:53 +00:00
Code Issues Projects Releases Packages Wiki Activity

gh-149459: Fix segfault when _LOAD_SPECIAL guard deoptimizes (#149478)

Browse source
This commit is contained in:
Hai Zhu 2026-05-08 19:20:27 +08:00 • committed by GitHub
parent d2d24e46d3
commit c341e341b2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 30 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

14
Lib/test/test_capi/test_opt.py
View file

@ -6138,6 +6138,20 @@ def __init__(self, x):
C(0) if i else str(0)
"""))
def test_load_special_type_guard_deopt(self):
script_helper.assert_python_ok("-s", "-c", textwrap.dedent(f"""
def f1():
class Context:
def __enter__(self): ...
def __exit__(self, e, v, t): ...
with Context():
pass
for _ in range({TIER2_THRESHOLD + 5}):
f1()
"""), PYTHON_JIT="1")
def global_identity(x):
return x

1
Misc/NEWS.d/next/Core_and_Builtins/2026-05-07-03-18-59.gh-issue-149459.5fhAqP.rst Normal file
View file

@ -0,0 +1 @@
Fix a crash in the JIT optimizer when a specialized ``LOAD_SPECIAL`` guard deoptimized after inserting the synthetic ``NULL`` stack entry.

11
Python/optimizer_bytecodes.c
View file

@ -2043,7 +2043,16 @@ dummy_func(void) {
PyObject *name = _Py_SpecialMethods[oparg].name;
PyObject *descr = _PyType_Lookup(type, name);
if (descr != NULL && (Py_TYPE(descr)->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR)) {
ADD_OP(_GUARD_TYPE_VERSION, 0, type->tp_version_tag);
/* LOAD_SPECIAL expands to _RECORD_TOS_TYPE + _INSERT_NULL +
* _LOAD_SPECIAL. Insert _GUARD_TYPE_VERSION before the
* already-emitted _INSERT_NULL so deopt sees the original
* stack shape.*/
_PyUOpInstruction *insert_null = uop_buffer_last(&ctx->out_buffer);
assert(insert_null->opcode == _INSERT_NULL);
assert(insert_null->target == this_instr->target);
REPLACE_OP(insert_null, _GUARD_TYPE_VERSION, 0, type->tp_version_tag);
ADD_OP(_INSERT_NULL, 0, 0);
bool immortal = _Py_IsImmortal(descr) || (type->tp_flags & Py_TPFLAGS_IMMUTABLETYPE);
ADD_OP(immortal ? _LOAD_CONST_INLINE_BORROW : _LOAD_CONST_INLINE,
0, (uintptr_t)descr);

6
Python/optimizer_cases.c.h generated
View file

@ -3896,7 +3896,11 @@
PyObject *name = _Py_SpecialMethods[oparg].name;
PyObject *descr = _PyType_Lookup(type, name);
if (descr != NULL && (Py_TYPE(descr)->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR)) {
ADD_OP(_GUARD_TYPE_VERSION, 0, type->tp_version_tag);
_PyUOpInstruction *insert_null = uop_buffer_last(&ctx->out_buffer);
assert(insert_null->opcode == _INSERT_NULL);
assert(insert_null->target == this_instr->target);
REPLACE_OP(insert_null, _GUARD_TYPE_VERSION, 0, type->tp_version_tag);
ADD_OP(_INSERT_NULL, 0, 0);
bool immortal = _Py_IsImmortal(descr) || (type->tp_flags & Py_TPFLAGS_IMMUTABLETYPE);
ADD_OP(immortal ? _LOAD_CONST_INLINE_BORROW : _LOAD_CONST_INLINE,
0, (uintptr_t)descr);