From 674a50ef2f8909c1c5d812e166bcc12ae6377908 Mon Sep 17 00:00:00 2001 From: Sam Gross Date: Wed, 7 Aug 2024 09:36:19 -0400 Subject: gh-117139: Fix an incorrect borrow in bytecodes.c (#122318) `_PyDict_SetItem_Take2` steals both the key (i.e., `sub`) and the value. --- Python/bytecodes.c | 7 ++++--- Python/executor_cases.c.h | 9 +++++---- Python/generated_cases.c.h | 9 +++++---- 3 files changed, 14 insertions(+), 11 deletions(-) diff --git a/Python/bytecodes.c b/Python/bytecodes.c index 9a1af0e..e4c97de 100644 --- a/Python/bytecodes.c +++ b/Python/bytecodes.c @@ -862,13 +862,14 @@ dummy_func( PyStackRef_CLOSE(list_st); } - inst(STORE_SUBSCR_DICT, (unused/1, value, dict_st, sub_st -- )) { - PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st); + inst(STORE_SUBSCR_DICT, (unused/1, value, dict_st, sub -- )) { PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st); DEOPT_IF(!PyDict_CheckExact(dict)); STAT_INC(STORE_SUBSCR, hit); - int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value)); + int err = _PyDict_SetItem_Take2((PyDictObject *)dict, + PyStackRef_AsPyObjectSteal(sub), + PyStackRef_AsPyObjectSteal(value)); PyStackRef_CLOSE(dict_st); ERROR_IF(err, error); } diff --git a/Python/executor_cases.c.h b/Python/executor_cases.c.h index afc7786..4def11c 100644 --- a/Python/executor_cases.c.h +++ b/Python/executor_cases.c.h @@ -1105,20 +1105,21 @@ } case _STORE_SUBSCR_DICT: { - _PyStackRef sub_st; + _PyStackRef sub; _PyStackRef dict_st; _PyStackRef value; - sub_st = stack_pointer[-1]; + sub = stack_pointer[-1]; dict_st = stack_pointer[-2]; value = stack_pointer[-3]; - PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st); PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st); if (!PyDict_CheckExact(dict)) { UOP_STAT_INC(uopcode, miss); JUMP_TO_JUMP_TARGET(); } STAT_INC(STORE_SUBSCR, hit); - int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value)); + int err = _PyDict_SetItem_Take2((PyDictObject *)dict, + PyStackRef_AsPyObjectSteal(sub), + PyStackRef_AsPyObjectSteal(value)); PyStackRef_CLOSE(dict_st); if (err) JUMP_TO_ERROR(); stack_pointer += -3; diff --git a/Python/generated_cases.c.h b/Python/generated_cases.c.h index f670353..e560372 100644 --- a/Python/generated_cases.c.h +++ b/Python/generated_cases.c.h @@ -6625,16 +6625,17 @@ static_assert(INLINE_CACHE_ENTRIES_STORE_SUBSCR == 1, "incorrect cache size"); _PyStackRef value; _PyStackRef dict_st; - _PyStackRef sub_st; + _PyStackRef sub; /* Skip 1 cache entry */ - sub_st = stack_pointer[-1]; + sub = stack_pointer[-1]; dict_st = stack_pointer[-2]; value = stack_pointer[-3]; - PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st); PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st); DEOPT_IF(!PyDict_CheckExact(dict), STORE_SUBSCR); STAT_INC(STORE_SUBSCR, hit); - int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value)); + int err = _PyDict_SetItem_Take2((PyDictObject *)dict, + PyStackRef_AsPyObjectSteal(sub), + PyStackRef_AsPyObjectSteal(value)); PyStackRef_CLOSE(dict_st); if (err) goto pop_3_error; stack_pointer += -3; -- cgit v0.12