JIT: assertion failure in `_PyJit_translate_single_bytecode_to_trace`

[devdanzin]

Crash report

What happened?

It's possible to trigger an assertion failure in a JIT build by running the code below:

def f1():

    class C:
        def __init__(self):
            self._items = [0, 1]
            self._index = 0

        def __iter__(self):
            return self

        def __next__(self):
            if self._index > len(self._items):
                raise StopIteration
            self._index += 1

    it = C()
    _ = [x for x in it if it._items.append(x) or True]
    
f1()

Backtrace:

python: Python/optimizer.c:759: int _PyJit_translate_single_bytecode_to_trace(PyThreadState *, _PyInterpreterFrame *, _Py_CODEUNIT *, int): Assertion `jump_happened == (target_instr[1].cache & 1)' failed.

Program received signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:100
#3  0x00007ffff7c45e2e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28888 in __GI_abort () at ./stdlib/abort.c:77
#5  0x00007ffff7c287f0 in __assert_fail_base (fmt=<optimized out>, assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>) at ./assert/assert.c:118
#6  0x00007ffff7c3c19f in __assert_fail (assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>) at ./assert/assert.c:127
#7  0x0000555556129d8a in _PyJit_translate_single_bytecode_to_trace (tstate=0x555556aead00 <_PyRuntime+358304>, frame=frame@entry=0x7e8ff6de5280, next_instr=next_instr@entry=0x7d2ff6dfd4d6,
    stop_tracing_opcode=0) at Python/optimizer.c:759
#8  0x0000555555e5d06d in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:12266
#9  0x0000555555e49d1b in _PyEval_EvalFrame (tstate=0x555556aead00 <_PyRuntime+358304>, frame=0x7e8ff6de5220, throwflag=0) at ./Include/internal/pycore_ceval.h:121
#10 _PyEval_Vector (tstate=<optimized out>, func=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=0x0) at Python/ceval.c:2104
#11 0x0000555555e49735 in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=0x7c7ff6e872c0) at Python/ceval.c:944
#12 0x00005555561bb04f in run_eval_code_obj (tstate=tstate@entry=0x555556aead00 <_PyRuntime+358304>, co=co@entry=0x7d1ff6e1bbd0, globals=globals@entry=0x7c7ff6e872c0,
    locals=locals@entry=0x7c7ff6e872c0) at Python/pythonrun.c:1372
#13 0x00005555561ba21c in run_mod (mod=<optimized out>, filename=<optimized out>, globals=<optimized out>, locals=<optimized out>, flags=<optimized out>, arena=<optimized out>,
    interactive_src=<optimized out>, generate_new_source=<optimized out>) at Python/pythonrun.c:1475

Output from running with PYTHON_LLTRACE=4:
6_abort_lltrace.txt

Running with PYTHON_OPT_DEBUG=4 generates no output.

Found using lafleur.

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.15.0a2+ (heads/main:b1558b6d3e2, Nov 20 2025, 13:04:18) [Clang 21.1.2 (2ubuntu6)]

[devdanzin]

Simpler MRE:

class BadIterator:
    def __iter__(self):
        return self
    def __next__(self):
        return 0
    def __bool__(self):
        return False

it = BadIterator()
_ = [x for x in it if it or True]

[Fidget-Spinner]

I think the assertion at that point is just wrong. We should remove it.