gh-158380: Fix the stack operand used by JIT dict access guards (GH-158381)

Author: cocolato

Include/internal/pycore_uop_ids.h

@@ -2445,7 +2445,18 @@ def f(n):
         self.assertEqual(uops.count("_STORE_SUBSCR_DICT_KNOWN_HASH"), 1)
         self.assertEqual(uops.count("_GUARD_NOS_DICT_SUBSCRIPT"), 0)
         self.assertEqual(uops.count("_GUARD_NOS_DICT_STORE_SUBSCRIPT"), 0)
-        self.assertEqual(uops.count("_GUARD_TYPE"), 1)
+        self.assertEqual(uops.count("_GUARD_NOS_TYPE"), 1)
+
+    def test_dict_subscr_probable_type(self):
+        def f(d):
+            for _ in range(TIER2_THRESHOLD):
+                value = d["key"]
+            return value
+
+        res, ex = self._run_with_optimizer(f, {"key": 1})
+        self.assertEqual(res, 1)
+        self.assertIsNotNone(ex)
+        self.assertIn("_GUARD_NOS_TYPE", get_opnames(ex))
 
     def test_dict_subclass_subscr_with_override(self):
         class MyDict(dict):

Include/internal/pycore_uop_metadata.h

@@ -0,0 +1 @@
+Fix incorrect type guards for ``dict`` reads and writes in the experimental JIT.

Lib/test/test_capi/test_opt.py

@@ -3846,9 +3846,9 @@ dummy_func(
             next = item;
         }
 
-        tier2 op(_GUARD_TYPE_ITER, (expected_type/4, iter, null_or_index -- iter, null_or_index)) {
-            PyObject *iter_o = PyStackRef_AsPyObjectBorrow(iter);
-            EXIT_IF(Py_TYPE(iter_o) != (PyTypeObject *)expected_type);
+        tier2 op(_GUARD_NOS_TYPE, (expected_type/4, nos, unused -- nos, unused)) {
+            PyObject *nos_o = PyStackRef_AsPyObjectBorrow(nos);
+            EXIT_IF(Py_TYPE(nos_o) != (PyTypeObject *)expected_type);
         }
 
         tier2 op(_ITER_NEXT_INLINE, (iternext_fn/4, iter, null_or_index -- iter, null_or_index, next)) {

Misc/NEWS.d/next/Core_and_Builtins/2026-09-29-07-28-20.gh-issue-158380.F0J0PO.rst

@@ -1472,7 +1472,7 @@ dummy_func(void) {
                 sym_set_type(iter, type);
                 assert((this_instr - 1)->opcode == _RECORD_NOS_TYPE);
                 int32_t orig_target = (this_instr - 1)->target;
-                ADD_OP(_GUARD_TYPE_ITER, 0, (uintptr_t)type);
+                ADD_OP(_GUARD_NOS_TYPE, 0, (uintptr_t)type);
                 uop_buffer_last(&ctx->out_buffer)->target = orig_target;
             }
             ADD_OP(_ITER_NEXT_INLINE, 0, (uintptr_t)type->tp_iternext);
@@ -2216,7 +2216,7 @@ dummy_func(void) {
                 ADD_OP(_NOP, 0, 0);
             }
             else {
-                ADD_OP(_GUARD_TYPE, 0, (uintptr_t)tp);
+                ADD_OP(_GUARD_NOS_TYPE, 0, (uintptr_t)tp);
                 sym_set_type(nos, tp);
             }
             PyType_Watch(TYPE_WATCHER_ID, (PyObject *)tp);
@@ -2237,7 +2237,7 @@ dummy_func(void) {
                 ADD_OP(_NOP, 0, 0);
             }
             else {
-                ADD_OP(_GUARD_TYPE, 0, (uintptr_t)tp);
+                ADD_OP(_GUARD_NOS_TYPE, 0, (uintptr_t)tp);
                 sym_set_type(nos, tp);
             }
             PyType_Watch(TYPE_WATCHER_ID, (PyObject *)tp);