From c2dbfe2139065a29bbe83a8e3a7fbe1d1060d16e Mon Sep 17 00:00:00 2001
From: Sam Gross <colesbury@gmail.com>
Date: Fri, 26 Jul 2024 16:50:29 +0000
Subject: [PATCH] gh-117139: Fix an incorrect borrow in bytecodes.c

`_PyDict_SetItem_Take2` steals both the key (i.e., `sub`) and the value.
---
 Python/bytecodes.c         | 7 ++++---
 Python/executor_cases.c.h  | 9 +++++----
 Python/generated_cases.c.h | 9 +++++----
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/Python/bytecodes.c b/Python/bytecodes.c
index d74f2aae0483ce..a9edd78f0bf7d7 100644
--- a/Python/bytecodes.c
+++ b/Python/bytecodes.c
@@ -851,13 +851,14 @@ dummy_func(
             PyStackRef_CLOSE(list_st);
         }
 
-        inst(STORE_SUBSCR_DICT, (unused/1, value, dict_st, sub_st -- )) {
-            PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st);
+        inst(STORE_SUBSCR_DICT, (unused/1, value, dict_st, sub -- )) {
             PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st);
 
             DEOPT_IF(!PyDict_CheckExact(dict));
             STAT_INC(STORE_SUBSCR, hit);
-            int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value));
+            int err = _PyDict_SetItem_Take2((PyDictObject *)dict,
+                                            PyStackRef_AsPyObjectSteal(sub),
+                                            PyStackRef_AsPyObjectSteal(value));
             PyStackRef_CLOSE(dict_st);
             ERROR_IF(err, error);
         }
diff --git a/Python/executor_cases.c.h b/Python/executor_cases.c.h
index 6e3f6cc62fe11f..9a4fb541d36ebe 100644
--- a/Python/executor_cases.c.h
+++ b/Python/executor_cases.c.h
@@ -1055,20 +1055,21 @@
         }
 
         case _STORE_SUBSCR_DICT: {
-            _PyStackRef sub_st;
+            _PyStackRef sub;
             _PyStackRef dict_st;
             _PyStackRef value;
-            sub_st = stack_pointer[-1];
+            sub = stack_pointer[-1];
             dict_st = stack_pointer[-2];
             value = stack_pointer[-3];
-            PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st);
             PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st);
             if (!PyDict_CheckExact(dict)) {
                 UOP_STAT_INC(uopcode, miss);
                 JUMP_TO_JUMP_TARGET();
             }
             STAT_INC(STORE_SUBSCR, hit);
-            int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value));
+            int err = _PyDict_SetItem_Take2((PyDictObject *)dict,
+                PyStackRef_AsPyObjectSteal(sub),
+                PyStackRef_AsPyObjectSteal(value));
             PyStackRef_CLOSE(dict_st);
             if (err) JUMP_TO_ERROR();
             stack_pointer += -3;
diff --git a/Python/generated_cases.c.h b/Python/generated_cases.c.h
index 76d1cc7ad6cf95..44bffbe69216bf 100644
--- a/Python/generated_cases.c.h
+++ b/Python/generated_cases.c.h
@@ -6556,16 +6556,17 @@
             static_assert(INLINE_CACHE_ENTRIES_STORE_SUBSCR == 1, "incorrect cache size");
             _PyStackRef value;
             _PyStackRef dict_st;
-            _PyStackRef sub_st;
+            _PyStackRef sub;
             /* Skip 1 cache entry */
-            sub_st = stack_pointer[-1];
+            sub = stack_pointer[-1];
             dict_st = stack_pointer[-2];
             value = stack_pointer[-3];
-            PyObject *sub = PyStackRef_AsPyObjectBorrow(sub_st);
             PyObject *dict = PyStackRef_AsPyObjectBorrow(dict_st);
             DEOPT_IF(!PyDict_CheckExact(dict), STORE_SUBSCR);
             STAT_INC(STORE_SUBSCR, hit);
-            int err = _PyDict_SetItem_Take2((PyDictObject *)dict, sub, PyStackRef_AsPyObjectSteal(value));
+            int err = _PyDict_SetItem_Take2((PyDictObject *)dict,
+                PyStackRef_AsPyObjectSteal(sub),
+                PyStackRef_AsPyObjectSteal(value));
             PyStackRef_CLOSE(dict_st);
             if (err) goto pop_3_error;
             stack_pointer += -3;