[3.15] gh-149459: Fix segfault when _LOAD_SPECIAL guard deoptimizes (GH-149478) (#149552)

gh-149459: Fix segfault when `_LOAD_SPECIAL` guard deoptimizes (GH-149478)
(cherry picked from commit c341e341b2)

Co-authored-by: Hai Zhu <haiizhu@outlook.com>
This commit is contained in:
Miss Islington (bot) 2026-05-08 13:48:04 +02:00 committed by GitHub
parent b922b42be7
commit f9e5975deb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 30 additions and 2 deletions

View file

@ -2043,7 +2043,16 @@ dummy_func(void) {
PyObject *name = _Py_SpecialMethods[oparg].name;
PyObject *descr = _PyType_Lookup(type, name);
if (descr != NULL && (Py_TYPE(descr)->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR)) {
ADD_OP(_GUARD_TYPE_VERSION, 0, type->tp_version_tag);
/* LOAD_SPECIAL expands to _RECORD_TOS_TYPE + _INSERT_NULL +
* _LOAD_SPECIAL. Insert _GUARD_TYPE_VERSION before the
* already-emitted _INSERT_NULL so deopt sees the original
* stack shape.*/
_PyUOpInstruction *insert_null = uop_buffer_last(&ctx->out_buffer);
assert(insert_null->opcode == _INSERT_NULL);
assert(insert_null->target == this_instr->target);
REPLACE_OP(insert_null, _GUARD_TYPE_VERSION, 0, type->tp_version_tag);
ADD_OP(_INSERT_NULL, 0, 0);
bool immortal = _Py_IsImmortal(descr) || (type->tp_flags & Py_TPFLAGS_IMMUTABLETYPE);
ADD_OP(immortal ? _LOAD_CONST_INLINE_BORROW : _LOAD_CONST_INLINE,
0, (uintptr_t)descr);

View file

@ -3896,7 +3896,11 @@
PyObject *name = _Py_SpecialMethods[oparg].name;
PyObject *descr = _PyType_Lookup(type, name);
if (descr != NULL && (Py_TYPE(descr)->tp_flags & Py_TPFLAGS_METHOD_DESCRIPTOR)) {
ADD_OP(_GUARD_TYPE_VERSION, 0, type->tp_version_tag);
_PyUOpInstruction *insert_null = uop_buffer_last(&ctx->out_buffer);
assert(insert_null->opcode == _INSERT_NULL);
assert(insert_null->target == this_instr->target);
REPLACE_OP(insert_null, _GUARD_TYPE_VERSION, 0, type->tp_version_tag);
ADD_OP(_INSERT_NULL, 0, 0);
bool immortal = _Py_IsImmortal(descr) || (type->tp_flags & Py_TPFLAGS_IMMUTABLETYPE);
ADD_OP(immortal ? _LOAD_CONST_INLINE_BORROW : _LOAD_CONST_INLINE,
0, (uintptr_t)descr);