bpo-46841: Fix BINARY_OP's handling of inline caches (GH-31671)

diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-03-03-14-31-53.bpo-46841.agf-3X.rst b/Misc/NEWS.d/next/Core and Builtins/2022-03-03-14-31-53.bpo-46841.agf-3X.rst
new file mode 100644 (file)
index 0000000..690293e
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2022-03-03-14-31-53.bpo-46841.agf-3X.rst
@@ -0,0 +1,2 @@
+Fix incorrect handling of inline cache entries when specializing
+:opcode:`BINARY_OP`.

diff --git a/Python/ceval.c b/Python/ceval.c
index 67c8b46db2d63c076ee8e6d420dcca4f5127469d..0743894c457a7b709d8c7a3332dfae09fcbd1039 100644 (file)
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -2028,8 +2028,9 @@ handle_eval_breaker:
             DEOPT_IF(!PyUnicode_CheckExact(left), BINARY_OP);
             DEOPT_IF(Py_TYPE(right) != Py_TYPE(left), BINARY_OP);
             DEOPT_IF(Py_REFCNT(left) != 2, BINARY_OP);
-            int next_oparg = _Py_OPARG(*next_instr);
-            assert(_Py_OPCODE(*next_instr) == STORE_FAST);
+            _Py_CODEUNIT true_next = next_instr[INLINE_CACHE_ENTRIES_BINARY_OP];
+            int next_oparg = _Py_OPARG(true_next);
+            assert(_Py_OPCODE(true_next) == STORE_FAST);
             /* In the common case, there are 2 references to the value
             * stored in 'variable' when the v = v + ... is performed: one
             * on the value stack (in 'v') and one still stored in the

diff --git a/Python/specialize.c b/Python/specialize.c
index 912b9e29198ee0586fb685872608c58baa0f9419..6328f11f90407a9cc4c34dc2fcf8cd0cdb088c66 100644 (file)
--- a/Python/specialize.c
+++ b/Python/specialize.c
@@ -1951,7 +1951,8 @@ _Py_Specialize_BinaryOp(PyObject *lhs, PyObject *rhs, _Py_CODEUNIT *instr,
                 break;
             }
             if (PyUnicode_CheckExact(lhs)) {
-                if (_Py_OPCODE(instr[1]) == STORE_FAST && Py_REFCNT(lhs) == 2) {
+                _Py_CODEUNIT next = instr[INLINE_CACHE_ENTRIES_BINARY_OP + 1];
+                if (_Py_OPCODE(next) == STORE_FAST && Py_REFCNT(lhs) == 2) {
                     *instr = _Py_MAKECODEUNIT(BINARY_OP_INPLACE_ADD_UNICODE,
                                               oparg);
                     goto success;