gh-124697: fix slot-reuse edge cases for inlined comprehensions

Skip reuse for class-closure names; isolate reused frees with
LOAD_CLOSURE + empty MAKE_CELL; treat DEF_FREE_CLASS as reusable;
and handle temp frees in FrameLocalsProxy and LOAD_DEREF.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: iritkatriel

Doc/library/dis.rst

@@ -2003,21 +2003,11 @@ but are replaced by real opcodes or removed before bytecode is generated.
    .. versionchanged:: 3.13
       This opcode is now a pseudo-instruction.
 
-.. opcode:: LOAD_CLOSURE_AND_CLEAR (i)
-
-   Pushes a reference to the cell contained in slot ``i`` of the "fast locals"
-   storage and clears that slot. Used to isolate an inlined comprehension
-   local that reuses an enclosing free variable.
-
-   Note that ``LOAD_CLOSURE_AND_CLEAR`` is replaced with
-   ``LOAD_FAST_AND_CLEAR`` in the assembler.
-
-   .. versionadded:: next
-
 .. opcode:: STORE_CLOSURE (i)
 
    Stores the TOS into the cell slot ``i`` of the "fast locals" storage.
-   Used to restore a cell saved by ``LOAD_CLOSURE_AND_CLEAR``.
+   Used to restore a cell saved by ``LOAD_CLOSURE`` when isolating an
+   inlined comprehension that reuses an enclosing free variable.
 
    Note that ``STORE_CLOSURE`` is replaced with ``STORE_FAST`` in the assembler.
 

Include/internal/pycore_interpframe.h

@@ -376,6 +376,12 @@ _PyFrame_Traverse(_PyInterpreterFrame *frame, visitproc visit, void *arg);
 bool
 _PyFrame_HasHiddenLocals(_PyInterpreterFrame *frame);
 
+/* True when localsplus[oparg] is a free cell that currently differs from
+ * the function's func_closure cell — i.e. an inlined comprehension has
+ * temporarily replaced it. */
+PyAPI_FUNC(bool)
+_PyFrame_IsInlinedCompTempFree(_PyInterpreterFrame *frame, int oparg);
+
 PyObject *
 _PyFrame_GetLocals(_PyInterpreterFrame *frame);
 

Include/internal/pycore_opcode_metadata.h

@@ -87,10 +87,12 @@ Class-closure names that would otherwise be free through a class become
 `GLOBAL_IMPLICIT`.
 
 If the inlined name is `LOCAL` or `CELL` but the nearest non-inlined
-enclosing table has it as `FREE`, resolve it as `FREE` so the
-comprehension reuses that localsplus slot. `compiler_cellvars()` also
-skips adding those child cells, which would otherwise create a second
-same-named entry.
+enclosing table has it as `FREE` (or `DEF_FREE_CLASS`), resolve it as
+`FREE` so the comprehension reuses that localsplus slot.
+`compiler_cellvars()` also skips adding those child cells, which would
+otherwise create a second same-named entry. Class-closure names
+(`__class__` and friends) are never reused: zero-arg `super()` and
+class-cell bookkeeping need the real free cell.
 
 ### Isolating iteration variables
 
@@ -100,14 +102,12 @@ the comprehension on one of two paths:
 
 Reuse an enclosing free (`_PyCompile_GetRefType()` is `FREE`):
 
-* `LOAD_CLOSURE_AND_CLEAR` saves the enclosing cell.
-* `MAKE_CELL` always runs, so the slot holds a fresh empty cell.
-  The comprehension then uses `DEREF`; it must not store into the
-  enclosing cell.
-* Restore uses `STORE_CLOSURE`.
-* Those pseudo instructions carry a cell/free index so
-  `fix_cell_offsets` can remap them; they become `LOAD_FAST_AND_CLEAR`
-  / `STORE_FAST` in the assembler.
+* `LOAD_CLOSURE` saves the enclosing cell without clearing the slot
+  (so free-slot introspection never sees a NULL).
+* `MAKE_CELL` on a `CO_FAST_FREE` slot always installs a fresh empty
+  cell, replacing the saved one. The comprehension then uses `DEREF`.
+* Restore uses `STORE_CLOSURE` (a cell/free-index pseudo that becomes
+  `STORE_FAST` after `fix_cell_offsets`).
 
 Own fast-local slot (everything else):
 
@@ -133,6 +133,12 @@ seen by existing closures; lambdas that capture the iteration variable
 share the temporary cell. After the comprehension, the original cell
 is restored.
 
+While the temporary cell is installed, `_PyFrame_IsInlinedCompTempFree()`
+is true (frame cell differs from `func_closure`). That drives
+class/module `locals()` to use `FrameLocalsProxy` even without a
+`CO_FAST_HIDDEN` slot, and makes an empty temporary cell raise
+`UnboundLocalError` rather than `NameError`.
+
 Source
 ------
 

Include/opcode_ids.h

@@ -1,11 +1,12 @@
 import doctest
+import sys
 import textwrap
 import traceback
 import types
 import unittest
 
 from test import support
-from test.support import BrokenIter
+from test.support import BrokenIter, import_helper
 
 
 doctests = """
@@ -359,6 +360,133 @@ def inner():
             return inner()
         self.assertEqual(outer([1, 2]), [1, 2])
 
+    def test_reuse_class_closure_name_as_param_with_lambda(self):
+        # Class-closure names are not reused. Lambdas share the last
+        # iteration value; the enclosing binding is unchanged.
+        def outer(__class__):
+            class C:
+                result = [lambda: __class__ for __class__ in __class__]
+            return [f() for f in C.result], __class__
+        self.assertEqual(outer([1, 2]), ([2, 2], [1, 2]))
+
+        def outer(__classdict__):
+            class C:
+                result = [lambda: __classdict__ for __classdict__ in __classdict__]
+            return [f() for f in C.result], __classdict__
+        self.assertEqual(outer([1, 2]), ([2, 2], [1, 2]))
+
+    def test_reuse_class_closure_name_as_param_preserves_enclosing(self):
+        def outer(__class__):
+            class C:
+                result = [__class__ for __class__ in __class__]
+            return C.result, __class__
+        self.assertEqual(outer([1, 2]), ([1, 2], [1, 2]))
+
+        def outer(__classdict__):
+            class C:
+                result = [__classdict__ for __classdict__ in __classdict__]
+            return C.result, __classdict__
+        self.assertEqual(outer([1, 2]), ([1, 2], [1, 2]))
+
+    def test_reuse_free_slot_visible_to_opcode_trace_getvar(self):
+        # Isolation must not leave a free slot temporarily NULL where
+        # PyFrame_GetVar() (and similar) assume a cell is always present.
+        _testcapi = import_helper.import_module("_testcapi")
+
+        def outer(x):
+            def inner():
+                return [x for x in x]
+            return inner
+
+        f = outer([1])
+
+        def trace(frame, event, arg):
+            if frame.f_code is f.__code__:
+                frame.f_trace_opcodes = True
+                if event == "opcode":
+                    try:
+                        _testcapi.frame_getvar(frame, "x")
+                    except NameError:
+                        pass
+            return trace
+
+        sys.settrace(trace)
+        try:
+            self.assertEqual(f(), [1])
+        finally:
+            sys.settrace(None)
+
+    def test_reuse_does_not_break_zero_arg_super(self):
+        # Temporary reuse of the __class__ free must not change what
+        # zero-argument super() observes during the comprehension.
+        class C:
+            def method(self):
+                __class__
+                return [super() for __class__ in (int,)]
+
+        self.assertIs(C().method()[0].__thisclass__, C)
+
+    def test_reuse_class_body_locals_sees_iteration_var(self):
+        # Class-body locals() must still expose the comprehension target
+        # when that name reuses an enclosing free (no separate hidden slot).
+        def outer(x):
+            class C:
+                values = [locals()["x"] for x in x]
+            return C.values
+        self.assertEqual(outer([1, 2]), [1, 2])
+
+        def outer_eval(x):
+            class C:
+                values = [eval("x") for x in x]
+            return C.values
+        self.assertEqual(outer_eval([1, 2]), [1, 2])
+
+    def test_reuse_uninitialized_comp_local_is_unbound_local(self):
+        # Reading the comprehension target before it is assigned must remain
+        # UnboundLocalError, not NameError from LOAD_DEREF on a free slot.
+        def outer(x):
+            def inner():
+                return [x for y in x for x in x]
+            return inner()
+
+        with self.assertRaises(UnboundLocalError):
+            outer([1, 2])
+
+        def outer_lambda(x):
+            def inner():
+                return [lambda: x for y in x for x in x]
+            return inner()
+
+        with self.assertRaises(UnboundLocalError):
+            outer_lambda([1, 2])
+
+    def test_reuse_def_free_class_avoids_duplicate_f_locals(self):
+        # Class-local names with DEF_FREE_CLASS are in freevars but scoped
+        # LOCAL; reuse must still apply so f_locals has a unique 'x'.
+        def outer():
+            x = 1
+            class C:
+                x = 2
+                vals = [(
+                    dict(**sys._getframe().f_locals),
+                    len(sys._getframe().f_locals),
+                    list(sys._getframe().f_locals.keys()),
+                    list(sys._getframe().f_locals.values()),
+                    list(sys._getframe().f_locals.items()),
+                ) for x in [3]]
+                def m():
+                    return x
+            return C
+
+        d, n, ks, vs, it = outer().vals[0]
+        self.assertEqual(d["x"], 3)
+        self.assertEqual(n, len(ks))
+        self.assertEqual(n, len(vs))
+        self.assertEqual(n, len(it))
+        self.assertEqual(ks.count("x"), 1)
+        self.assertEqual(d, dict(zip(ks, vs)))
+        self.assertEqual(d, dict(it))
+
     def test_free_inner_cell_outer(self):
         code = """
             g = 2