@@ -2305,6 +2305,36 @@ def testfunc(n):
 self.assertNotIn("_GUARD_TOS_INT", uops)
 self.assertNotIn("_GUARD_NOS_INT", uops)
 
+def test_attr_promotion_failure(self):
+# We're not testing for any specific uops here, just
+# testing it doesn't crash.
+script_helper.assert_python_ok('-c', textwrap.dedent("""
+import _testinternalcapi
+import _opcode
+import email
+
+def get_first_executor(func):
+code = func.__code__
+co_code = code.co_code
+for i in range(0, len(co_code), 2):
+try:
+return _opcode.get_executor(code, i)
+except ValueError:
+pass
+return None
+
+def testfunc(n):
+for _ in range(n):
+email.jit_testing = None
+prompt = email.jit_testing
+del email.jit_testing
+
+
+testfunc(_testinternalcapi.TIER2_THRESHOLD)
+ex = get_first_executor(testfunc)
+assert ex is not None
+"""))
+
 
 def global_identity(x):
 return x

@@ -0,0 +1 @@
+Fix a crash in the JIT involving attributes of modules.

@@ -103,6 +103,10 @@ convert_global_to_const(_PyUOpInstruction *inst, PyObject *obj, bool pop)
 if ((int)index >= dict->ma_keys->dk_nentries) {
 return NULL;
 }
+PyDictKeysObject *keys = dict->ma_keys;
+if (keys->dk_version != inst->operand0) {
+return NULL;
+}
 PyObject *res = entries[index].me_value;
 if (res == NULL) {
 return NULL;

@@ -557,7 +557,13 @@ dummy_func(void) {
 PyDict_Watch(GLOBALS_WATCHER_ID, dict);
 _Py_BloomFilter_Add(dependencies, dict);
 PyObject *res = convert_global_to_const(this_instr, dict, true);
-attr = sym_new_const(ctx, res);
+if (res == NULL) {
+attr = sym_new_not_null(ctx);
+}
+else {
+attr = sym_new_const(ctx, res);
+}
+
 }
 }
 }