Incorrect MRO cache entry is populated for types that do not have a version assigned

[mpage]

Bug report

Bug description:

_PyType_LookupRefAndVersion will populate the incorrect cache entry if it is called with a type that does not have a version tag (tp_version_tag is 0). I think this only impacts performance, not correctness. The next call to _PyType_LookupRefAndVersion for the same (type, name) pair will miss the cache, but will populate the correct entry, so any subsequent calls will hit the cache. Additionally, this may create some amount of unnecessary thrash on the cache.

The root of the issue is that the version tag is an input to the hash that is used to determine the cache entry and we do not recompute the hash, and the associated cache entry, after assigning a version.

_PyType_LookupRefAndVersion first computes the cache entry:

cpython/Objects/typeobject.c

Lines 5542 to 5544 in 39e69a7

	unsigned int h = MCACHE_HASH_METHOD(type, name);
	struct type_cache *cache = get_type_cache();
	struct type_cache_entry *entry = &cache->hashtable[h];

If the cache entry doesn't match, and a type version was assigned successfully, it populates the same entry:

cpython/Objects/typeobject.c

Lines 5629 to 5634 in 39e69a7

	#if Py_GIL_DISABLED
	update_cache_gil_disabled(entry, name, assigned_version, res);
	#else
	PyObject *old_value = update_cache(entry, name, assigned_version, res);
	Py_DECREF(old_value);
	#endif

The next call for the same (type, name) pair, will find a different entry, because the type version is used to compute the hash that indexes into the cache:

cpython/Objects/typeobject.c

Lines 46 to 48 in 39e69a7

	#define MCACHE_HASH_METHOD(type, name) \
	MCACHE_HASH(FT_ATOMIC_LOAD_UINT32_RELAXED((type)->tp_version_tag), \
	((Py_ssize_t)(name)) >> 3)

It looks like the change to use the same entry was introduced in gh-113930. cc @DinoV

CPython versions tested on:

3.13, 3.14

Operating systems tested on:

Linux

[DinoV]

Maybe the fix here is to just use the type's address as the entry into hash table.

[mpage]

Maybe the fix here is to just use the type's address as the entry into hash table.

That sounds reasonable to me, assuming you mean using the address of the type in place of the version. Though I assume there was some reason why they used the version in the first place...