gh-158934: determine if instance or class attribute specialisation is done based off the instance slot value

Lib/test/test_opcache.py

@@ -1760,6 +1760,33 @@ def set_value(n):
         set_value(_testinternalcapi.SPECIALIZATION_COOLDOWN)
         self.assert_no_opcode(set_value, "STORE_ATTR_WITH_HINT")
 
+    @cpython_only
+    @requires_specialization
+    def test_load_attr_class_default_not_set_on_instance(self):
+        class C:
+            timeout = 30
+
+            def set_timeout(self, value):
+                self.timeout = value  # puts "timeout" in C's shared keys
+
+        c = C()  # never sets timeout, so c.timeout is the class default
+
+        @reset_code
+        def get_timeout(n):
+            for _ in range(n):
+                value = c.timeout
+            return value
+
+        self.assertEqual(get_timeout(_testinternalcapi.SPECIALIZATION_THRESHOLD), 30)
+        # Must load the class attribute, not specialize as an instance
+        # attribute load that misses on every execution.
+        self.assert_specialized(get_timeout, "LOAD_ATTR_NONDESCRIPTOR_WITH_VALUES")
+        self.assert_no_opcode(get_timeout, "LOAD_ATTR_INSTANCE_VALUE")
+
+        # Setting the attribute on the instance must be seen.
+        c.set_timeout(5)
+        self.assertEqual(get_timeout(1), 5)
+
     @cpython_only
     @requires_specialization
     def test_to_bool(self):

Misc/NEWS.d/next/Core_and_Builtins/2026-10-06-21-39-58.gh-issue-158934.wuXP68.rst

@@ -0,0 +1,3 @@
+Fix specialization of attribute loads that find a class attribute because the
+instance has not set its own value, when the class sets that attribute on
+``self`` elsewhere. These loads previously missed on every execution.

Python/bytecodes.c

@@ -4197,6 +4197,15 @@ dummy_func(
             DEAD(exc);
         }
 
+        /* Slots are created even if not assigend to */
+        op(_GUARD_SHADOWING_SLOT_EMPTY, (slot_offset/1, owner -- owner)) {
+            if (slot_offset != 0) {
+                PyObject *owner_o = PyStackRef_AsPyObjectBorrow(owner);
+                PyObject **value_ptr = (PyObject **)(((char *)owner_o) + slot_offset);
+                EXIT_IF(FT_ATOMIC_LOAD_PTR_RELAXED(*value_ptr) != NULL);
+            }
+        }
+
         op(_LOAD_ATTR_METHOD_WITH_VALUES, (descr/4, owner -- attr, self)) {
             assert(oparg & 1);
             /* Cached method object */
@@ -4213,7 +4222,8 @@ dummy_func(
             _RECORD_TOS_TYPE +
             _GUARD_TYPE_VERSION +
             _CHECK_MANAGED_OBJECT_HAS_VALUES +
-            unused/2 +
+            _GUARD_SHADOWING_SLOT_EMPTY +
+            unused/1 +
             _LOAD_ATTR_METHOD_WITH_VALUES;
 
         op(_LOAD_ATTR_METHOD_NO_DICT, (descr/4, owner -- attr, self)) {
@@ -4247,7 +4257,8 @@ dummy_func(
             _RECORD_TOS_TYPE +
             _GUARD_TYPE_VERSION +
             _CHECK_MANAGED_OBJECT_HAS_VALUES +
-            unused/2 +
+            _GUARD_SHADOWING_SLOT_EMPTY +
+            unused/1 +
             _LOAD_ATTR_NONDESCRIPTOR_WITH_VALUES;
 
         op(_LOAD_ATTR_NONDESCRIPTOR_NO_DICT, (descr/4, owner -- attr)) {

Python/optimizer_bytecodes.c

@@ -1028,6 +1028,12 @@ dummy_func(void) {
                            _POP_TOP, _NOP);
     }
 
+    op(_GUARD_SHADOWING_SLOT_EMPTY, (slot_offset/1, owner -- owner)) {
+        if (slot_offset == 0) {
+            ADD_OP(_NOP, 0, 0);
+        }
+    }
+
     op(_LOAD_ATTR_NONDESCRIPTOR_WITH_VALUES, (descr/4, owner -- attr)) {
         (void)descr;
         PyTypeObject *type = sym_get_type(owner);