Validate instance slot for specialised attribute is NULL

This ensures that we correct specialise class attribute loads
even if a slot is defined but not set.

Author: johng

Include/internal/pycore_opcode_metadata.h

@@ -1760,6 +1760,33 @@ def set_value(n):
         set_value(_testinternalcapi.SPECIALIZATION_COOLDOWN)
         self.assert_no_opcode(set_value, "STORE_ATTR_WITH_HINT")
 
+    @cpython_only
+    @requires_specialization
+    def test_load_attr_class_default_not_set_on_instance(self):
+        class C:
+            timeout = 30
+
+            def set_timeout(self, value):
+                self.timeout = value  # puts "timeout" in C's shared keys
+
+        c = C()  # never sets timeout, so c.timeout is the class default
+
+        @reset_code
+        def get_timeout(n):
+            for _ in range(n):
+                value = c.timeout
+            return value
+
+        self.assertEqual(get_timeout(_testinternalcapi.SPECIALIZATION_THRESHOLD), 30)
+        # Must load the class attribute, not specialize as an instance
+        # attribute load that misses on every execution.
+        self.assert_specialized(get_timeout, "LOAD_ATTR_NONDESCRIPTOR_WITH_VALUES")
+        self.assert_no_opcode(get_timeout, "LOAD_ATTR_INSTANCE_VALUE")
+
+        # Setting the attribute on the instance must be seen.
+        c.set_timeout(5)
+        self.assertEqual(get_timeout(1), 5)
+
     @cpython_only
     @requires_specialization
     def test_to_bool(self):

Include/internal/pycore_uop_ids.h

@@ -4197,6 +4197,15 @@ dummy_func(
             DEAD(exc);
         }
 
+        /* Slots are created even if not assigend to */
+        op(_GUARD_SHADOWING_SLOT_EMPTY, (slot_offset/1, owner -- owner)) {
+            if (slot_offset != 0) {
+                PyObject *owner_o = PyStackRef_AsPyObjectBorrow(owner);
+                PyObject **value_ptr = (PyObject **)(((char *)owner_o) + slot_offset);
+                EXIT_IF(FT_ATOMIC_LOAD_PTR_RELAXED(*value_ptr) != NULL);
+            }
+        }
+
         op(_LOAD_ATTR_METHOD_WITH_VALUES, (descr/4, owner -- attr, self)) {
             assert(oparg & 1);
             /* Cached method object */
@@ -4213,7 +4222,8 @@ dummy_func(
             _RECORD_TOS_TYPE +
             _GUARD_TYPE_VERSION +
             _CHECK_MANAGED_OBJECT_HAS_VALUES +
-            unused/2 +
+            _GUARD_SHADOWING_SLOT_EMPTY +
+            unused/1 +
             _LOAD_ATTR_METHOD_WITH_VALUES;
 
         op(_LOAD_ATTR_METHOD_NO_DICT, (descr/4, owner -- attr, self)) {
@@ -4247,7 +4257,8 @@ dummy_func(
             _RECORD_TOS_TYPE +
             _GUARD_TYPE_VERSION +
             _CHECK_MANAGED_OBJECT_HAS_VALUES +
-            unused/2 +
+            _GUARD_SHADOWING_SLOT_EMPTY +
+            unused/1 +
             _LOAD_ATTR_NONDESCRIPTOR_WITH_VALUES;
 
         op(_LOAD_ATTR_NONDESCRIPTOR_NO_DICT, (descr/4, owner -- attr)) {

Include/internal/pycore_uop_metadata.h

@@ -1028,6 +1028,12 @@ dummy_func(void) {
                            _POP_TOP, _NOP);
     }
 
+    op(_GUARD_SHADOWING_SLOT_EMPTY, (slot_offset/1, owner -- owner)) {
+        if (slot_offset == 0) {
+            ADD_OP(_NOP, 0, 0);
+        }
+    }
+
     op(_LOAD_ATTR_NONDESCRIPTOR_WITH_VALUES, (descr/4, owner -- attr)) {
         (void)descr;
         PyTypeObject *type = sym_get_type(owner);