gh-144145: Track nullness of properties in the Tier 2 JIT optimizer #144122

cocolato · 2026-01-21T17:47:39Z

This PR implements symbolic tracking for __slots__ object attributes in the Tier 2 JIT optimizer.

Currently, when the JIT optimizer encounters _LOAD_ATTR_SLOT, it creates a new unknown symbol (<!NULL>) even if the same slot was previously written in the same trace. This prevents the optimizer from:

Knowing the type of values loaded from slots
Eliminating redundant type guards
Performing further type-based optimizations

Before(set PYTHON_OPT_DEBUG=5):

51 abs: _LOAD_ATTR_SLOT (4, target=48, operand0=0x10, ...)
    stack=[..., <Point at 0x...440>]
52 abs: _POP_TOP
    stack=[..., <!NULL at 0x7fb981d874c0>, <Point at 0x...440>]
                ↑↑↑ NOT NULL TYPE

Now:

51 abs: _LOAD_ATTR_SLOT (4, target=48, operand0=0x10, ...)
    stack=[..., <Point slots[2] v131145 at 0x...440>]
52 abs: _POP_TOP
    stack=[..., <compact_int at 0x7f02ba1d6490>, <Point slots[2]>]
                ↑↑↑ we know the exact type

Issue: Support track __slots__ object and its property in the Tier 2 optimizer #144145

cocolato · 2026-01-21T17:49:21Z

Include/internal/pycore_optimizer_types.h

+// Maximum slots per object tracked symbolically
+#define MAX_SYMBOLIC_SLOTS_SIZE 16
+#define SLOTS_ARENA_SIZE (MAX_SYMBOLIC_SLOTS_SIZE * 100)


We might need to adjust this arena_size.

markshannon · 2026-01-22T10:03:55Z

This PR seems unrelated to the issue. It tracks the internal state of objects, not the uniqueness of references.
Please create a new issue.

Tracking the internal state of objects is tricky, as we need to keep track of where code might escape and invalidate any knowledge prior to the escape. So far, we have only tracked properties of stateless objects, so it isn't an issue.
There is value in tracking the state of objects, but it needs to be done carefully.

In future, I would also advise waiting to see if there is general support on the issue before spending time on the implementation.

cocolato · 2026-01-22T10:32:51Z

Thanks for reply!

This PR seems unrelated to the issue. It tracks the internal state of objects, not the uniqueness of references.
Please create a new issue.

Sorry, I'm linking to this issue because I discussed the implementation logic with @Fidget-Spinner in this issue, and I think this should be a pre-task for unique reference tracking (if I'm wrong, please point it out, thanks!). I'll create a new issue to link to this PR.

Tracking the internal state of objects is tricky, as we need to keep track of where code might escape and invalidate any knowledge prior to the escape. So far, we have only tracked properties of stateless objects, so it isn't an issue.
There is value in tracking the state of objects, but it needs to be done carefully.

Sorry again for overlooking object escape. I think may be Ken Jin's original requirement was just to add tracking for the Slots object(if I'm wrong, please point it out again, thanks!). Perhaps I should remove the optimization in the _LOAD_ATTR_SLOT section?

In future, I would also advise waiting to see if there is general support on the issue before spending time on the implementation.

Thanks for the reminder. I'll be more careful in the future.

Fidget-Spinner · 2026-01-22T11:48:34Z

Sorry again for overlooking object escape. I think may be Ken Jin's original requirement was just to add tracking for the Slots object(if I'm wrong, please point it out again, thanks!). Perhaps I should remove the optimization in the _LOAD_ATTR_SLOT section?

Yeah we need to track for escapes. I mentioned it here how to do it #143414 (comment). It got lost in the noise though, so no worries.

@markshannon

In future, I would also advise waiting to see if there is general support on the issue before spending time on the implementation.

I advised @cocolato to embark on this issue. I think there is value in doing it. They waited for me to give my go-ahead before doing it. So I think they didn't do anything wrong.

cocolato · 2026-01-22T11:58:13Z

Thanks! I will refactor this to also support #144141.

cocolato · 2026-01-22T13:04:01Z

@Fidget-Spinner Hi, one thing i want to know. Should this PR flag which property escape during escape handling UOPs (e.g. _CALL_*)? This would allow us to reset only those objects instead of resetting all __slot__ objects tracked in s_arena. However, this will made this PR more complex.

Fidget-Spinner · 2026-01-22T22:13:34Z

Sorry I'm busy for these 2 days. I'll try to review on Saturday. If Mark reviews it earlier, we can go with his ideas.

Fidget-Spinner · 2026-01-24T09:45:04Z

@Fidget-Spinner Hi, one thing i want to know. Should this PR flag which property escape during escape handling UOPs (e.g. _CALL_*)? This would allow us to reset only those objects instead of resetting all __slot__ objects tracked in s_arena. However, this will made this PR more complex.

No. The problem is any uop that escapes must be handled. For example, anything with POP_TOP if not eliminated is escaping, because it might call __del__ which can trigger arbitrary code.

Python/optimizer_symbols.c

Include/internal/pycore_optimizer_types.h

cocolato · 2026-01-26T12:29:53Z

Python/optimizer_analysis.c

+        // Track escapes
+        if (_PyUop_Flags[out_ptr->opcode] & HAS_ESCAPES_FLAG) {
+            ctx->last_escape_index = uop_buffer_length(&ctx->out_buffer);
+        }


@Fidget-Spinner If we use this method to detect escapes, then each POP_TOP following _STORE_ATTR_SLOT will cause tracked slot values invalid due to HAS_ESCAPES_FLAG. Could you please give me some guidance? Thanks！

cocolato · 2026-01-28T14:56:14Z

Updated.

cocolato · 2026-01-29T02:40:50Z

Added new uop STORE_ATTR_SLOT_NULL and now use the was_init_shim and is_init_shim flag to avoid track escape when Initializing the shim frame (e.g. _CREATE_INIT_FRAME and _RETUEN_VALUE ).

Fidget-Spinner · 2026-01-29T16:59:00Z

Added new uop STORE_ATTR_SLOT_NULL and now use the was_init_shim and is_init_shim flag to avoid track escape when Initializing the shim frame (e.g. _CREATE_INIT_FRAME and _RETUEN_VALUE ).

That doesn't seem right. RETURN_VALUE is escaping, as it's possibly freeing locals in a frame, which can trigger arbitrary code.

Fidget-Spinner

Looks pretty good, just two comments

Python/optimizer_symbols.c

cocolato · 2026-01-30T08:43:49Z

Updated, added _STORE_ATTR_INSTANCE_VALUE_NULL and now only use is_init_shim flag to avoid _CREATE_INIT_FRAME escaping.

Fidget-Spinner · 2026-01-30T09:24:17Z

Cool, this LGTM now I think. This deserves a news entry. Potentially call it:

Track nullness of attributes of objects in the JIT optimizer. Patch by Hai Zhu.

I know it's not just nullness, but in all practicality due to the escapes, it's just nullness for now.

…e-gh-144145.mxJyUj.rst

Fidget-Spinner · 2026-01-30T09:57:04Z

Include/internal/pycore_optimizer_types.h

+typedef struct {
+    uint16_t slot_index;
+    uint16_t symbol;
+} JitOptDescrMapping;


Is it safe to use this for both normal objects and objects with __slots__, or do we need a separate symbol?

Basically I'm asking if it's possible for an object to both have STORE_ATTR_INSTANCE_VALUE and STORE_ATTR_SLOT, as this will cause a index collision between the slots and offset. It it safe also with STORE_ATTR_WITH_HINT, as can that can mix with STORE_ATTR_INSTANCE_VALUE?

If you think of an answer, please let me know, and we can add it as a comment in the code. otherwise, this is kind of scary.

These two never appear on the same object type because:
STORE_ATTR_INSTANCE_VALUE needs Py_TPFLAGS_MANAGED_DICT flag.
Therefore, there is no index collision between slot offsets and inline value offsets.

cpython/Python/specialize.c

Lines 665 to 669 in 5f57f69

// No descriptor, or non overriding.

if ((type->tp_flags & Py_TPFLAGS_MANAGED_DICT) == 0) {

SPECIALIZATION_FAIL(base_op, SPEC_FAIL_ATTR_NOT_MANAGED_DICT);

return 0;

}

However, conflicts between STORE_ATTR_INSTANCE_VALUE and STORE_ATTR_WITH_HINT can indeed occur. Perhaps a flag could be added to the index to distinguish between the two types?

Should we track STORE_ATTR_WITH_HINT in this PR?

No lets ignore with hint for now.

Fidget-Spinner

Thanks

Fidget-Spinner · 2026-01-30T15:25:42Z

Thanks! Do you want to handle STORE_ATTR_WITH_HINT Too?

cocolato · 2026-01-30T15:30:54Z

Thanks! Do you want to handle STORE_ATTR_WITH_HINT Too?

Sure, I will work on it :)

cocolato added 2 commits January 20, 2026 22:09

Add slots object property tracking for the Tier 2 JIT optimizer

dfd99d7

use s_arena to save slots mapping

7bb2c20

cocolato requested review from Fidget-Spinner, markshannon, savannahostrowski and tomasr8 as code owners January 21, 2026 17:47

bedevere-app bot mentioned this pull request Jan 21, 2026

JIT: Implement unique reference tracking in Tier 2 for reference count optimizations #143414

Open

bedevere-app bot added the awaiting review label Jan 21, 2026

cocolato commented Jan 21, 2026

View reviewed changes

fix switch syntax error

20920fc

cocolato changed the title ~~gh-143414: Add __slots__ object property tracking for the Tier 2 JIT optimizer~~ gh-144145: Add __slots__ object property tracking for the Tier 2 JIT optimizer Jan 22, 2026

bedevere-app bot mentioned this pull request Jan 22, 2026

Support track __slots__ object and its property in the Tier 2 optimizer #144145

Closed

cocolato marked this pull request as draft January 22, 2026 10:56

bedevere-app bot removed the awaiting review label Jan 22, 2026

Fidget-Spinner mentioned this pull request Jan 22, 2026

Eliminate overhead of fetching and testing NULL attributes in STORE_ATTR specializations for new objects #144141

Open

Merge branch 'main' into dev_143414

2e9c5a6

fix arena struct

5b4bd5f

Fidget-Spinner reviewed Jan 24, 2026

View reviewed changes

Python/optimizer_symbols.c Outdated Show resolved Hide resolved

Fidget-Spinner reviewed Jan 24, 2026

View reviewed changes

Include/internal/pycore_optimizer_types.h Show resolved Hide resolved

cocolato and others added 3 commits January 26, 2026 09:46

support track escape

6a828d7

check null ptr

90e4800

fix escape check

bf29c13

cocolato commented Jan 26, 2026

View reviewed changes

cocolato and others added 2 commits January 27, 2026 16:31

Merge branch 'main' into dev_143414

ec50130

regen-cases

da39868

cocolato changed the title ~~gh-144145: Add __slots__ object property tracking for the Tier 2 JIT optimizer~~ gh-144145: Add object property tracking for the Tier 2 JIT optimizer Jan 27, 2026

don't track escape in init shim frame

7c0c815

cocolato marked this pull request as ready for review January 28, 2026 14:57

bedevere-app bot added the awaiting review label Jan 28, 2026

fix lint

873ca91

cocolato requested a review from Fidget-Spinner January 29, 2026 02:41

Fidget-Spinner reviewed Jan 29, 2026

View reviewed changes

Python/optimizer_symbols.c Outdated Show resolved Hide resolved

Python/optimizer_symbols.c Outdated Show resolved Hide resolved

cocolato and others added 2 commits January 30, 2026 14:21

Merge branch 'main' into dev_143414

8bd0ff9

fix escape && add _STORE_ATTR_INSTANCE_VALUE_NULL

0a7cb9a

Fidget-Spinner changed the title ~~gh-144145: Add object property tracking for the Tier 2 JIT optimizer~~ gh-144145: Track nullness of properties in the Tier 2 JIT optimizer Jan 30, 2026

blurb-it bot and others added 3 commits January 30, 2026 09:42

📜🤖 Added by blurb_it.

2f8c2ce

Delete Misc/NEWS.d/next/Core_and_Builtins/2026-01-30-09-42-30.gh-issu…

ddbb9c5

…e-gh-144145.mxJyUj.rst

📜🤖 Added by blurb_it.

9c91e86

Fidget-Spinner reviewed Jan 30, 2026

View reviewed changes

cocolato added 2 commits January 30, 2026 11:41

add comment

f74096b

format comment

a7f00bf

Fidget-Spinner approved these changes Jan 30, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Jan 30, 2026

Fidget-Spinner merged commit 1dc12b2 into python:main Jan 30, 2026
75 checks passed

bedevere-app bot removed the awaiting merge label Jan 30, 2026

	// No descriptor, or non overriding.
	if ((type->tp_flags & Py_TPFLAGS_MANAGED_DICT) == 0) {
	SPECIALIZATION_FAIL(base_op, SPEC_FAIL_ATTR_NOT_MANAGED_DICT);
	return 0;
	}

Uh oh!

gh-144145: Track nullness of properties in the Tier 2 JIT optimizer #144122

gh-144145: Track nullness of properties in the Tier 2 JIT optimizer #144122

Conversation

cocolato commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cocolato Jan 21, 2026

Choose a reason for hiding this comment

Uh oh!

markshannon commented Jan 22, 2026

Uh oh!

cocolato commented Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Fidget-Spinner commented Jan 22, 2026

Uh oh!

cocolato commented Jan 22, 2026

Uh oh!

cocolato commented Jan 22, 2026

Uh oh!

Fidget-Spinner commented Jan 22, 2026

Uh oh!

Fidget-Spinner commented Jan 24, 2026

Uh oh!

Uh oh!

Uh oh!

cocolato Jan 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cocolato commented Jan 28, 2026

Uh oh!

cocolato commented Jan 29, 2026

Uh oh!

Fidget-Spinner commented Jan 29, 2026

Uh oh!

Fidget-Spinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cocolato commented Jan 30, 2026

Uh oh!

Fidget-Spinner commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Fidget-Spinner Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

cocolato Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

cocolato Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

cocolato Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Fidget-Spinner Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Fidget-Spinner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Fidget-Spinner commented Jan 30, 2026

Uh oh!

cocolato commented Jan 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

cocolato commented Jan 21, 2026 •

edited

Loading

cocolato commented Jan 22, 2026 •

edited

Loading

cocolato Jan 26, 2026 •

edited

Loading

Fidget-Spinner commented Jan 30, 2026 •

edited

Loading