python · markshannon · Dec 8, 2021 · Dec 15, 2021 · Jan 4, 2022 · Jan 5, 2022
diff --git a/Include/internal/pycore_ceval.h b/Include/internal/pycore_ceval.h
@@ -115,6 +115,8 @@ struct _interpreter_frame *_PyEval_GetFrame(void);
 
 PyObject *_Py_MakeCoro(PyFunctionObject *func);
 
+extern PyFunctionObject *_Py_InitCleanupFunc;
+
 #ifdef __cplusplus
 }
 #endif

diff --git a/Include/internal/pycore_object.h b/Include/internal/pycore_object.h
@@ -188,8 +188,10 @@ extern int _Py_CheckSlotResult(
 #define _PyType_IsReady(type) ((type)->tp_dict != NULL)
 
 extern PyObject* _PyType_AllocNoTrack(PyTypeObject *type, Py_ssize_t nitems);
+PyObject *_PyType_NewManagedObject(PyTypeObject *type);
 
 extern int _PyObject_InitializeDict(PyObject *obj);
+int _PyObject_InitInlineValues(PyObject *obj, PyTypeObject *tp);
 extern int _PyObject_StoreInstanceAttribute(PyObject *obj, PyDictValues *values,
                                           PyObject *name, PyObject *value);
 PyObject * _PyObject_GetInstanceAttribute(PyObject *obj, PyDictValues *values,

diff --git a/Include/opcode.h b/Include/opcode.h
diff --git a/Lib/opcode.py b/Lib/opcode.py
@@ -67,6 +67,7 @@ def jabs_op(name, op):
 def_op('UNARY_NOT', 12)
 
 def_op('UNARY_INVERT', 15)
+def_op('EXIT_INIT_CHECK', 16)
 
 def_op('BINARY_SUBSCR', 25)
 
@@ -254,6 +255,7 @@ def jabs_op(name, op):
     "CALL_NO_KW_LEN",
     "CALL_NO_KW_ISINSTANCE",
     "CALL_NO_KW_PY_SIMPLE",
+    "CALL_NO_KW_ALLOC_AND_ENTER_INIT",
     "CALL_NO_KW_LIST_APPEND",
     "CALL_NO_KW_METHOD_DESCRIPTOR_O",
     "CALL_NO_KW_TYPE_1",

diff --git a/Misc/NEWS.d/next/Core and Builtins/2022-01-05-11-12-00.bpo-44525.4E3Pwn.rst b/Misc/NEWS.d/next/Core and Builtins/2022-01-05-11-12-00.bpo-44525.4E3Pwn.rst
@@ -0,0 +1,11 @@
+Specializes calls to most Python classes. Specifically, any class that
+inherits from ``object``, or another Python class, and does not override
+``__new__``.
+
+The specialized instruction does the following:
+
+1. Creates the object (by calling ``object.__new__``)
+2. Pushes a shim frame to the frame stack (to cleanup after ``__init__``)
+3. Pushes the frame for ``__init__`` to the frame stack
+
+Speeds up the instantiation of most Python classes.
@@ -4957,11 +4957,10 @@ _PyDict_NewKeysForClass(void)
 
 #define CACHED_KEYS(tp) (((PyHeapTypeObject*)tp)->ht_cached_keys)
 
-static int
-init_inline_values(PyObject *obj, PyTypeObject *tp)
+int
+_PyObject_InitInlineValues(PyObject *obj, PyTypeObject *tp)
 {
     assert(tp->tp_flags & Py_TPFLAGS_HEAPTYPE);
-    // assert(type->tp_dictoffset > 0);  -- TO DO Update this assert.
     assert(tp->tp_flags & Py_TPFLAGS_MANAGED_DICT);
     PyDictKeysObject *keys = CACHED_KEYS(tp);
     assert(keys != NULL);
@@ -4972,6 +4971,7 @@ init_inline_values(PyObject *obj, PyTypeObject *tp)
     assert(size > 0);
     PyDictValues *values = new_values(size);
     if (values == NULL) {
+        *_PyObject_ValuesPointer(obj) = NULL;
         PyErr_NoMemory();
         return -1;
     }
@@ -4991,7 +4991,7 @@ _PyObject_InitializeDict(PyObject *obj)
         return 0;
     }
     if (tp->tp_flags & Py_TPFLAGS_MANAGED_DICT) {
-        return init_inline_values(obj, tp);
+        return _PyObject_InitInlineValues(obj, tp);
     }
     PyObject *dict;
     if (_PyType_HasFeature(tp, Py_TPFLAGS_HEAPTYPE) && CACHED_KEYS(tp)) {

@@ -1140,6 +1140,26 @@ type_call(PyTypeObject *type, PyObject *args, PyObject *kwds)
     return obj;
 }
 
+PyObject *
+_PyType_NewManagedObject(PyTypeObject *type)
+{
+    assert(type->tp_flags & Py_TPFLAGS_MANAGED_DICT);
+    assert(_PyType_IS_GC(type));
+    assert(type->tp_new == PyBaseObject_Type.tp_new);
+    assert(type->tp_alloc == PyType_GenericAlloc);
+    assert(type->tp_itemsize == 0);
+    PyObject *obj = PyType_GenericAlloc(type, 0);
+    if (obj == NULL) {
+        return PyErr_NoMemory();
+    }
+    *_PyObject_ManagedDictPointer(obj) = NULL;
+    if (_PyObject_InitInlineValues(obj, type)) {
+        Py_DECREF(obj);
+        return NULL;
+    }
+    return obj;
+}
+
 PyObject *
 _PyType_AllocNoTrack(PyTypeObject *type, Py_ssize_t nitems)
 {

@@ -104,6 +104,8 @@ static InterpreterFrame *
 _PyEvalFramePushAndInit(PyThreadState *tstate, PyFunctionObject *func,
                         PyObject *locals, PyObject* const* args,
                         size_t argcount, PyObject *kwnames);
+static InterpreterFrame *
+_PyEvalFramePush(PyThreadState *tstate, PyFunctionObject *func, PyObject *locals);
 static void
 _PyEvalFrameClearAndPop(PyThreadState *tstate, InterpreterFrame *frame);
 
@@ -2708,6 +2710,20 @@ _PyEval_EvalFrameDefault(PyThreadState *tstate, InterpreterFrame *frame, int thr
             return retval;
         }
 
+        TARGET(EXIT_INIT_CHECK) {
+            assert(STACK_LEVEL() == 2);
+            PyObject *should_be_none = TOP();
+            if (should_be_none != Py_None) {
+                PyErr_Format(PyExc_TypeError,
+                    "__init__() should return None, not '%.200s'",
+                    Py_TYPE(should_be_none)->tp_name);
+                goto error;
+            }
+            Py_DECREF(Py_None);
+            STACK_SHRINK(1);
+            DISPATCH();
+        }
+
         TARGET(POP_EXCEPT) {
             _PyErr_StackItem *exc_info = tstate->exc_info;
             PyObject *value = exc_info->exc_value;
@@ -4707,6 +4723,61 @@ _PyEval_EvalFrameDefault(PyThreadState *tstate, InterpreterFrame *frame, int thr
             goto start_frame;
         }
 
+        TARGET(CALL_NO_KW_ALLOC_AND_ENTER_INIT) {
+            SpecializedCacheEntry *caches = GET_CACHE();
+            _PyAdaptiveEntry *cache0 = &caches[0].adaptive;
+            int argcount = cache0->original_oparg;
+            _PyObjectCache *cache1 = &caches[-1].obj;
+            PyObject *callable = PEEK(argcount+1);
+            DEOPT_IF(!PyType_Check(callable), CALL_NO_KW);
+            PyTypeObject *tp = (PyTypeObject *)callable;
+            DEOPT_IF(tp->tp_version_tag != cache0->version, CALL_NO_KW);
+            PyFunctionObject *init = (PyFunctionObject *)cache1->obj;
+            PyCodeObject *code = (PyCodeObject *)init->func_code;
+            DEOPT_IF(code->co_argcount != argcount+1, CALL_NO_KW);
+            PyObject *self = _PyType_NewManagedObject(tp);
+            if (self == NULL) {
+                goto error;
+            }
+            PEEK(argcount+1) = self;
+            Py_DECREF(tp);
+            assert(_Py_InitCleanupFunc != NULL);
+            InterpreterFrame *shim = _PyEvalFramePush(tstate, _Py_InitCleanupFunc, NULL);
+            if (shim == NULL) {
+                goto error;
+            }
+            shim->previous = frame;
+            shim->f_lasti = 1;
+            if (_Py_EnterRecursiveCall(tstate, "")) {
+                tstate->recursion_remaining--;
+                goto exit_unwind;
+            }
+            /* Push self onto stack of shim */
+            Py_INCREF(self);
+            shim->stacktop = 1;
+            shim->localsplus[0] = self;
+            size_t size = code->co_nlocalsplus + code->co_stacksize + FRAME_SPECIALS_SIZE;
+            InterpreterFrame *init_frame = _PyThreadState_BumpFramePointer(tstate, size);
+            if (init_frame == NULL) {
+                _PyEvalFrameClearAndPop(tstate, shim);
+                goto error;
+            }
+            _PyFrame_InitializeSpecials(init_frame, init,
+                                        NULL, code->co_nlocalsplus);
+            /* Copy self followed by args to __init__ frame */
+            STACK_SHRINK(argcount+1);
+            _PyFrame_SetStackPointer(frame, stack_pointer);
+            for (int i = 0; i < argcount+1; i++) {
+                init_frame->localsplus[i] = stack_pointer[i];
+            }
+            for (int i = argcount+1; i < code->co_nlocalsplus; i++) {
                init_frame->localsplus[i] = NULL;
+            }
+            init_frame->previous = shim;
+            frame = cframe.current_frame = init_frame;
+            goto start_frame;
+        }
+
         TARGET(CALL_NO_KW_TYPE_1) {
             assert(STACK_ADJUST_IS_RESET);
             assert(GET_CACHE()->adaptive.original_oparg == 1);
@@ -5945,6 +6016,23 @@ make_coro(PyThreadState *tstate, PyFunctionObject *func,
     return gen;
 }
 
+static InterpreterFrame *
+_PyEvalFramePush(PyThreadState *tstate, PyFunctionObject *func, PyObject *locals)
+{
+    PyCodeObject * code = (PyCodeObject *)func->func_code;
+    size_t size = code->co_nlocalsplus + code->co_stacksize + FRAME_SPECIALS_SIZE;
+    InterpreterFrame *frame = _PyThreadState_BumpFramePointer(tstate, size);
+    if (frame == NULL) {
+        return NULL;
+    }
+    _PyFrame_InitializeSpecials(frame, func, locals, code->co_nlocalsplus);
+    PyObject **localsarray = &frame->localsplus[0];
+    for (int i = 0; i < code->co_nlocalsplus; i++) {
+        localsarray[i] = NULL;
+    }
+    return frame;
+}
+
 /* Consumes all the references to the args */
 static InterpreterFrame *
 _PyEvalFramePushAndInit(PyThreadState *tstate, PyFunctionObject *func,

@@ -1115,6 +1115,9 @@ stack_effect(int opcode, int oparg, int jump)
         case LOAD_GLOBAL:
             return 1;
 
+  
580F
      case EXIT_INIT_CHECK:
+            return -1;
+
         /* Exception handling pseudo-instructions */
         case SETUP_FINALLY:
             /* 0 in the normal flow.
-Original file line number
+Diff line change
@@ Expand Up / @@ -115,6 +115,8 @@ struct _interpreter_frame *_PyEval_GetFrame(void); @@
     PyObject *_Py_MakeCoro(PyFunctionObject *func);
+    extern PyFunctionObject *_Py_InitCleanupFunc;
     #ifdef __cplusplus
     }
     #endif
@@ Expand Down @@