gh-144681: Fix JIT trace builder assertion failure when conditional branch jump target coincides with fallthrough target#144742
Merged
Fidget-Spinner merged 7 commits intopython:mainfrom Mar 10, 2026
Conversation
cocolato
requested review from
Fidget-Spinner and
markshannon
as code owners
Member
|
Related: #141797 |
markshannon
requested changes
Mar 9, 2026
Member
markshannon
left a comment
markshannon
left a comment
There was a problem hiding this comment.
Thanks for finding the root problem and coming up with a fix. This can be simplified by treating target_instr[1].cache & 1 as the source of truth for branches.
Python/optimizer.c
Outdated
| _Py_CODEUNIT *computed_jump_instr = computed_next_instr_without_modifiers + oparg; | ||
| assert(next_instr == computed_next_instr || next_instr == computed_jump_instr); | ||
| int jump_happened = computed_jump_instr == next_instr; | ||
| int jump_happened; |
Member
There was a problem hiding this comment.
Suggested change
| int jump_happened; | |
| int jump_happened = target_instr[1].cache & 1; |
The direction of the jump is always recorded.
Python/optimizer.c
Outdated
| } else { | ||
| jump_happened = computed_jump_instr == next_instr; | ||
| } | ||
| assert(jump_happened == (target_instr[1].cache & 1)); |
Member
There was a problem hiding this comment.
Suggested change
| assert(jump_happened == (target_instr[1].cache & 1)); | |
| assert(jump_happened ? (next_instr == computed_jump_instr) : (next_instr == computed_next_instr)); |
Python/optimizer.c
Outdated
| assert(next_instr == computed_next_instr || next_instr == computed_jump_instr); | ||
| int jump_happened = computed_jump_instr == next_instr; | ||
| int jump_happened; | ||
| if (computed_next_instr == computed_jump_instr) { |
Member
There was a problem hiding this comment.
Then there is no need to change behavior depending on how long the branch is.
|
A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated. Once you have made the requested changes, please leave a comment on this pull request containing the phrase And if you don't make the requested changes, you will be poked with soft cushions! |
Contributor
Author
|
Thanks for review! I have made the requested changes; please review again. |
|
Thanks for making the requested changes! @markshannon, @Fidget-Spinner: please review the changes made to this pull request. |
Fidget-Spinner
approved these changes
Mar 9, 2026
Contributor
Author
|
The failed test appears unrelated to the current PR. It seems to have been introduced here: #145279 |
Member
|
Let's see if updating the branch fixes it |
markshannon
approved these changes
Mar 9, 2026
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When the JIT trace builder translates
POP_JUMP_IF_TRUEinstructions, it determines the branch direction by comparingnext_instr(where execution actually went) againstcomputed_jump_instr(the jump target address). However, when oparg equals 1 and the instruction is followed by NOT_TAKEN, the computed jump target and the computed fallthrough target are the same address:In this minimal reproduction case:
which produces:
the address comparison
computed_jump_instr == next_instris always true regardless of which branch was actually taken, causing the assertionjump_happened == (target_instr[1].cache & 1)failed when the branch was not taken.So we should fall back to the
RECORD_BRANCH_TAKENcache bit (target_instr[1].cache & 1) to determine the branch direction, since address comparison is ambiguous.