From: Brandt Bucher <brandtbucher@microsoft.com>
Date: Fri, 4 Mar 2022 18:51:27 +0000 (-0800)
Subject: bpo-46841: Fix BINARY_OP's handling of inline caches (GH-31671)
X-Git-Tag: v3.11.0a6~15
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c4d2d57eefb1224a12e2e95e4508658dfbf6a7c9;p=thirdparty%2FPython%2Fcpython.git

bpo-46841: Fix BINARY_OP's handling of inline caches (GH-31671)
---

diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-03-03-14-31-53.bpo-46841.agf-3X.rst b/Misc/NEWS.d/next/Core and Builtins/2022-03-03-14-31-53.bpo-46841.agf-3X.rst
new file mode 100644
index 000000000000..690293e97dcc
--- /dev/null
+++ b/Misc/NEWS.d/next/Core and Builtins/2022-03-03-14-31-53.bpo-46841.agf-3X.rst	
@@ -0,0 +1,2 @@
+Fix incorrect handling of inline cache entries when specializing
+:opcode:`BINARY_OP`.
diff --git a/Python/ceval.c b/Python/ceval.c
index 67c8b46db2d6..0743894c457a 100644
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -2028,8 +2028,9 @@ handle_eval_breaker:
             DEOPT_IF(!PyUnicode_CheckExact(left), BINARY_OP);
             DEOPT_IF(Py_TYPE(right) != Py_TYPE(left), BINARY_OP);
             DEOPT_IF(Py_REFCNT(left) != 2, BINARY_OP);
-            int next_oparg = _Py_OPARG(*next_instr);
-            assert(_Py_OPCODE(*next_instr) == STORE_FAST);
+            _Py_CODEUNIT true_next = next_instr[INLINE_CACHE_ENTRIES_BINARY_OP];
+            int next_oparg = _Py_OPARG(true_next);
+            assert(_Py_OPCODE(true_next) == STORE_FAST);
             /* In the common case, there are 2 references to the value
             * stored in 'variable' when the v = v + ... is performed: one
             * on the value stack (in 'v') and one still stored in the
diff --git a/Python/specialize.c b/Python/specialize.c
index 912b9e29198e..6328f11f9040 100644
--- a/Python/specialize.c
+++ b/Python/specialize.c
@@ -1951,7 +1951,8 @@ _Py_Specialize_BinaryOp(PyObject *lhs, PyObject *rhs, _Py_CODEUNIT *instr,
                 break;
             }
             if (PyUnicode_CheckExact(lhs)) {
-                if (_Py_OPCODE(instr[1]) == STORE_FAST && Py_REFCNT(lhs) == 2) {
+                _Py_CODEUNIT next = instr[INLINE_CACHE_ENTRIES_BINARY_OP + 1];
+                if (_Py_OPCODE(next) == STORE_FAST && Py_REFCNT(lhs) == 2) {
                     *instr = _Py_MAKECODEUNIT(BINARY_OP_INPLACE_ADD_UNICODE,
                                               oparg);
                     goto success;