Crash report

** is weird in that thetype of the result depends on thevalues of the inputs. The logic forint/float power is:

deftype_of_pow(lhs:float,rhs:float)->type[complex]:ifisinstance(lhs,int)andisinstance(rhs,int)andrhs>=0:returnintiflhs<0andnotrhs.is_integer():returncomplexreturnfloat

However, our optimizer wrongly assumes:

deftype_of_pow(lhs:float,rhs:float)->type[float]:ifisinstance(lhs,int)andisinstance(rhs,int):returnintreturnfloat

This means that tons of different poorly-chosen values can cause JIT code to crash:

import_testinternalcapiimportitertoolsdeff(a,b):for_inrange(_testinternalcapi.TIER2_THRESHOLD):a+b# Remove guards...a**b+a# ...BOOM!forla,ra,lb,rbinitertools.product([1,-1,1.0,-1.0,0.5,-0.5],repeat=4):f(la,ra)f(lb,rb)

Normally we could just ignore the problem and produce an unknown type during abstract interpretation, but a** containing at least one constant value is actually reasonably common (thinkx ** 2,2 ** n, ors ** 0.5).

We should probably teach the optimizer how to handle these properly.

Linked PRs

• GH-127809: Fix the JIT's understanding of** #127844