builder: LOAD_ATTR_MODULE + LOAD_ATTR_INSTANCE_VALUE in C

SonicField · SonicField · commit f0891d7fb5a8 · 2026-04-21T19:19:06.000-07:00
Push 43 (85/144 → 87/144 emit methods, 60.4%): bundles MODULE +
INSTANCE_VALUE specialization conversion + 1 thin-wrapper bridge accessor
per supervisor 02:11:09Z bundle decision + theologian 02:10:50Z concur.

Re-audit at 02:09:21Z found that 4 of 5 originally-identified "new"
bridges already exist (hir_c_create_bit_cast, hir_c_create_int_binary_op,
hir_c_set_descr, hir_c_set_guilty_reg) — only ~5 LOC of new infra
needed (jit_rt_load_module_dict_entry_addr accessor).

================================================================
PART 1: BRIDGE ACCESSOR (LITE TEMPLATE)
================================================================

Bridge: jit_rt_load_module_dict_entry_addr
Purpose: extern C accessor returning JITRT_LoadModuleDictEntry function
         pointer for CallStatic in LOAD_ATTR_MODULE.
C++ source: Python/jit/jit_rt.h:656 (declaration), jit_rt.cpp:2587 (defn)
PRIOR DECISIONS: NONE (mirrors existing jit_rt_invoke_iter_next_addr)
INVARIANTS PRESERVED:
  1. Returns the unwrapped C++ function pointer (no copy, no transformation)
  2. Function signature: (PyDictKeysObject* keys, Py_ssize_t index) → PyObject*
  3. Caller must pass exactly 2 operands to CallStatic (keys, index)
Falsifier: bridge result called via CallStatic with valid (keys, index)
returns the dict entry; mismatch indicates bridge returned wrong pointer.

================================================================
PART 2: LOAD_ATTR_MODULE WIRING
================================================================

builder_emit_c.c: hir_builder_emit_load_attr_module_c, ~70 lines.
builder.cpp: emitLoadAttr LOAD_ATTR_MODULE case shrinks to delegating
stub (66 lines deleted, 7 lines added).

Per-spec rubric (theologian 00:24:00Z + 02:06:35Z):

Common items:
  C1. Source structural diff: C body mirrors C++ logic line-for-line
      (guard module type → cache lookup → dict_version!=0 fast path →
      load md_dict/ma_keys/dk_version → version Guard → CallStatic
      JITRT_LoadModuleDictEntry → CheckField).
  C2. Bridge usage audit: hir_c_create_guard_type_reg, hir_c_create_load_field_reg,
      hir_c_create_load_const, hir_c_create_primitive_compare,
      hir_c_create_guard + hir_deopt_set_frame_state, hir_c_create_call_static_reg
      + hir_c_set_operand, hir_c_create_check_field_reg + hir_c_set_guilty_reg.
      All bridges exist; ordering matches C++.
  C3. Reference annotation: receiver borrowed; intermediates (dict, keys,
      loaded_version) typed correctly per C++ original; result is OBJECT|NULL
      from CallStatic, narrowed to OBJECT by CheckField.
  C4. FrameState capture: emitSnapshot is in builder.cpp before the switch
      (unchanged); Guard + CheckField receive &amp;tc-&gt;frame.
  C5. Wiring exercise: test_phoenix_jit_loadattr_golden harness exercises
      sys.maxsize (LOAD_ATTR_MODULE) — covered.
  C6. Golden diff exact match (HARD GATE): MODULE block of
      docs/golden/loadattr_hir.txt must remain byte-identical.
      test_phoenix_jit_loadattr_golden internally diffs.
  C7. Py_REF_DEBUG delta: deferred per W8 retroactive trigger
      (pydebug infra block, supervisor 01:53:52Z).
  C8. ARM64 commit-match + 4 stash markers + BINARY_MATCH (clean) on
      both arches: testkeeper to verify.

MODULE-specific items:
  M1. CallStatic argument order EXACTLY matches C++: (keys, index_reg)
      via hir_c_set_operand(call, 0, keys) + hir_c_set_operand(call, 1, index_reg).
  M2. CheckField fallback target is the DEOPT path (FrameState replay),
      NOT raise-NameError directly. Achieved via hir_c_create_check_field_reg
      + tc-&gt;frame.
  M3. guiltyReg attached to CheckField via hir_c_set_guilty_reg(cf, receiver)
      for nice runtime errors.

================================================================
PART 3: LOAD_ATTR_INSTANCE_VALUE WIRING
================================================================

builder_emit_c.c: hir_builder_emit_load_attr_instance_value_c, ~92 lines.
builder.cpp: emitLoadAttr LOAD_ATTR_INSTANCE_VALUE case shrinks to delegating
stub (98 lines deleted, 7 lines added).

Per-spec rubric:

Common items C1-C8 same pattern as MODULE; key differences:
  C1. Mirrors C++ split-dict path: guard slot_type → load dorv from
      managed-dict slot (offset -3*sizeof(PyObject*)) → CheckField NULL
      → BitCast dorv to CUInt64 → IntBinaryOp kAnd 1 (low-bit test) →
      Guard with descr "dict values check" → IntBinaryOp kAdd 1 (strip tag)
      → BitCast to OptObject → LoadField at index*sizeof(PyObject*) →
      CheckField NULL.
  C3. dorv loaded with borrowed=1 (matches C++ — dorv may be tagged pointer,
      not valid PyObject*); attr loaded as OptObject (becomes owned via
      CheckField narrowing, then refcount_insertion adds Incref).

INSTANCE_VALUE-specific items:
  V1. Dispatch: handles split-dict (managed_dict + values pointer) ONLY,
      regular __dict__ deopts via Guard "dict values check". Matches C++
      single-branch pattern.
  V2. Values-pointer offset embedded as CUInt64[1] (the constant 1 used
      in the AND mask + tag-strip add). Code-state, preserved by
      canonicalization rule (NOT CUInt32 which is dk_version).
  V3. Py_NewRef on loaded value: handled implicitly by LoadField OptObject
      type; refcount_insertion pass adds Incref after CheckField result.
      Verify by checking golden HIR shows Incref after LoadField in the
      INSTANCE_VALUE block.

Static-builtin / subclass-fallback semantics: matches C++ early-return
behavior — if slot_type lookup fails OR has subclasses OR lacks
TPFLAGS_MANAGED_DICT OR ht_cached_keys is NULL, returns 0 (fallback to
generic LoadAttr). Optionally emits GuardType-only as the C++ does.

================================================================
VERIFICATION (compile-clean pre-commit)
================================================================

cmake --build phoenix_jit: PASS, 0 errors (warnings pre-existing).
make python: link PASS (no undefined references).

Includes added to builder_emit_c.c:
  - internal/pycore_moduleobject.h (PyModuleObject)
  - internal/pycore_dict.h (PyDictKeysObject)

Diff stat:
  Python/jit/hir/builder.cpp      | -159 +11 (-148 net, MODULE+INSTANCE_VALUE → stubs)
  Python/jit/hir/builder_emit_c.c | +163 (MODULE wiring + INSTANCE_VALUE wiring + extern decls)
  Python/jit/hir/hir_c_api.cpp    | +4 (jit_rt_load_module_dict_entry_addr)
  Python/jit/hir/hir_c_api.h      | +6 (accessor declaration + doc)
  4 files changed, 184 insertions(+), 158 deletions(-)

Item 6 HARD GATE: testkeeper to re-capture loadattr_hir.txt and verify
MODULE + INSTANCE_VALUE blocks byte-identical to C++ baseline. If either
block diverges, HALT push 43.
Item 7 deferred per W8 retroactive trigger.
diff --git a/Python/jit/hir/builder.cpp b/Python/jit/hir/builder.cpp
@@ -3849,6 +3849,8 @@ void HIRBuilder::emitDeleteAttr(
 
 extern "C" void hir_builder_emit_load_attr_generic_c(void *tc, void *func, void *receiver, int name_idx);
 extern "C" int hir_builder_emit_load_attr_slot_c(void *tc, void *func, void *builder, void *receiver, PyCodeObject *code, int name_idx, int instr_idx);
+extern "C" int hir_builder_emit_load_attr_module_c(void *tc, void *func, void *builder, void *receiver, PyCodeObject *code, int name_idx, int instr_idx);
+extern "C" int hir_builder_emit_load_attr_instance_value_c(void *tc, void *func, void *builder, void *receiver, PyCodeObject *code, int name_idx, int instr_idx);
 
 void HIRBuilder::emitLoadAttr(
     TranslationContext& tc,
@@ -3874,70 +3876,10 @@ void HIRBuilder::emitLoadAttr(
   if (jit_get_config()->specialized_opcodes) {
     switch (bc_instr.specializedOpcode()) {
       case LOAD_ATTR_MODULE: {
-        // Guard receiver is a module
-        Type mod_type = Type::fromTypeExact(&PyModule_Type);
-        tc.emitGuardType(receiver, mod_type, receiver);
-
-        // Read dict_version and index from CPython's inline cache
-        _Py_CODEUNIT* code_units = codeUnit(code_);
-        int instr_idx = bc_instr.opcodeIndex().value();
-        const _PyAttrCache* cache =
-            reinterpret_cast<const _PyAttrCache*>(
-                &code_units[instr_idx + 1]);
-        uint32_t dict_version = cache->version[0] |
-            (static_cast<uint32_t>(cache->version[1]) << 16);
-        uint16_t index = cache->index;
-
-        if (dict_version != 0) {
-          // Inline dict access: module->md_dict->ma_keys->dk_version
-          Register* dict = temps_.AllocateStack();
-          tc.emitLoadField(
-              dict, receiver, "md_dict",
-              offsetof(PyModuleObject, md_dict), TObject);
-
-          Register* keys = temps_.AllocateStack();
-          tc.emitLoadField(
-              keys, dict, "ma_keys",
-              offsetof(PyDictObject, ma_keys), TCPtr);
-
-          Register* loaded_version = temps_.AllocateStack();
-          tc.emitLoadField(
-              loaded_version, keys, "dk_version",
-              offsetof(PyDictKeysObject, dk_version), TCUInt32);
-
-          Register* expected_version = temps_.AllocateStack();
-          tc.emitLoadConst(
-              expected_version,
-              Type::fromCUInt(dict_version, TCUInt32));
-
-          Register* version_match = temps_.AllocateStack();
-          tc.emitPrimitiveCompare(
-              version_match, PrimitiveCompareOp::kEqual,
-              loaded_version, expected_version);
-          tc.emitGuard(version_match, tc.frame);
-
-          // Load entry value via helper (computes DK_UNICODE_ENTRIES)
-          Register* index_reg = temps_.AllocateStack();
-          tc.emitLoadConst(
-              index_reg,
-              Type::fromCInt(static_cast<int64_t>(index), TCInt64));
-
-          Register* result = temps_.AllocateStack();
-          auto call = tc.emitCallStatic(
-              2, result,
-              reinterpret_cast<void*>(JITRT_LoadModuleDictEntry),
-              TOptObject);
-          call->SetOperand(0, keys);
-          call->SetOperand(1, index_reg);
-
-          // Deopt if value is NULL (attribute deleted)
-          PyObject* attr_name =
-              PyTuple_GET_ITEM(code_->co_names, name_idx);
-          auto cf = tc.emitCheckField(
-              result, result, attr_name, tc.frame);
-          cf->setGuiltyReg(receiver);
-
-          phx_ptr_arr_push(&tc.frame.stack, result);
+        if (hir_builder_emit_load_attr_module_c(
+                static_cast<void*>(&tc), static_cast<void*>(current_func_),
+                static_cast<void*>(this), static_cast<void*>(receiver),
+                code_, name_idx, bc_instr.opcodeIndex().value())) {
           return;
         }
         break;
@@ -3952,100 +3894,11 @@ void HIRBuilder::emitLoadAttr(
         break;
       }
       case LOAD_ATTR_INSTANCE_VALUE: {
-        // LOAD_ATTR_INSTANCE_VALUE direct LoadField specialisation.
-        // Instead of falling through to generic LoadAttr (which goes through
-        // C++ inline cache -> dict lookup -> branch mispredictions), emit
-        // a direct field load at the cached offset from CPython's adaptive
-        // cache. This matches what simplifyLoadAttrSplitDict does in the
-        // Simplify pass, but at build time.
-        _Py_CODEUNIT* code_units = codeUnit(code_);
-        int instr_idx = bc_instr.opcodeIndex().value();
-        const _PyAttrCache* cache =
-            reinterpret_cast<const _PyAttrCache*>(&code_units[instr_idx + 1]);
-        uint32_t type_version =
-            cache->version[0] |
-            (static_cast<uint32_t>(cache->version[1]) << 16);
-        uint16_t index = cache->index;
-
-        PyTypeObject* slot_type = findTypeByVersionTag(type_version);
-        if (slot_type != nullptr &&
-            (slot_type->tp_subclasses == nullptr ||
-             PyDict_GET_SIZE(slot_type->tp_subclasses) == 0) &&
-            PyType_HasFeature(slot_type, Py_TPFLAGS_MANAGED_DICT)) {
-
-          PyHeapTypeObject* ht = reinterpret_cast<PyHeapTypeObject*>(slot_type);
-          if (ht->ht_cached_keys != nullptr) {
-            // Root the type so it lives as long as the compiled code.
-            current_func_->env.addReference((PyObject*)(
-                reinterpret_cast<PyObject*>(slot_type)));
-            Type type = Type::fromTypeExact(slot_type);
-            tc.emitGuardType(receiver, type, receiver);
-
-            PyObject* attr_name =
-                PyTuple_GET_ITEM(code_->co_names, name_idx);
-
-            // Load PyDictOrValues from managed dict slot (offset -3).
-            // In CPython 3.12, managed dict pointer is at
-            // -3 * sizeof(PyObject*) from the object.
-            // Must remain borrowed: dorv can be a tagged pointer (low bit
-            // set for inline values) which is not a valid PyObject*.
-            Register* dorv = temps_.AllocateStack();
-            tc.emitLoadField(
-                dorv, receiver, "__dict__",
-                -3 * static_cast<int>(sizeof(PyObject*)), TOptDict, true);
-
-            // Check dorv is not NULL (object has dict/values allocated).
-            Register* checked_dorv = temps_.AllocateStack();
-            auto cf = tc.emitCheckField(
-                checked_dorv, dorv, attr_name, tc.frame);
-            cf->setGuiltyReg(receiver);
-
-            // Check low bit: 1 means inline values, 0 means regular dict.
-            Register* one = temps_.AllocateStack();
-            tc.emitLoadConst(one, Type::fromCUInt(1, TCUInt64));
-            Register* dorv_int = temps_.AllocateStack();
-            tc.emitBitCast(dorv_int, checked_dorv, TCUInt64);
-            Register* is_values = temps_.AllocateStack();
-            tc.emitIntBinaryOp(
-                is_values, BinaryOpKind::kAnd, dorv_int, one);
-            auto* guard = static_cast<DeoptBase*>(tc.emitGuard(is_values, tc.frame));
-            guard->setGuiltyReg(receiver);
-            guard->setDescr("dict values check");
-
-            // Get values pointer: dorv + 1 (see simplifyLoadAttrSplitDict).
-            // The tagged pointer layout makes dorv+1 point to the start
-            // of the values array for LoadField indexing.
-            Register* values_ptr = temps_.AllocateStack();
-            tc.emitIntBinaryOp(
-                values_ptr, BinaryOpKind::kAdd, dorv_int, one);
-            Register* values_obj = temps_.AllocateStack();
-            tc.emitBitCast(values_obj, values_ptr, TOptObject);
-
-            // Load attribute at cached index.
-            Register* attr = temps_.AllocateStack();
-            tc.emitLoadField(
-                attr, values_obj, "attr",
-                static_cast<int>(index) * static_cast<int>(sizeof(PyObject*)),
-                TOptObject);
-
-            // Check attribute is not NULL (not deleted).
-            Register* result = temps_.AllocateStack();
-            auto cf2 = tc.emitCheckField(
-                result, attr, attr_name, tc.frame);
-            cf2->setGuiltyReg(receiver);
-
-            phx_ptr_arr_push(&tc.frame.stack, result);
-            return;
-          }
-        }
-        // Fallback: emit GuardType only if we found the type but couldn't
-        // do the direct load (e.g., no MANAGED_DICT, has subclasses).
-        if (slot_type != nullptr) {
-          if (slot_type->tp_subclasses == nullptr ||
-              PyDict_GET_SIZE(slot_type->tp_subclasses) == 0) {
-            Type type = Type::fromTypeExact(slot_type);
-            tc.emitGuardType(receiver, type, receiver);
-          }
+        if (hir_builder_emit_load_attr_instance_value_c(
+                static_cast<void*>(&tc), static_cast<void*>(current_func_),
+                static_cast<void*>(this), static_cast<void*>(receiver),
+                code_, name_idx, bc_instr.opcodeIndex().value())) {
+          return;
         }
         break;
       }
diff --git a/Python/jit/hir/builder_emit_c.c b/Python/jit/hir/builder_emit_c.c
@@ -12,6 +12,8 @@
 #include "cinderx/Jit/hir/hir_type_c.h"
 #include "cinderx/Jit/jit_config_c.h"
 #include "Python.h"
+#include "internal/pycore_moduleobject.h"  /* PyModuleObject (LOAD_ATTR_MODULE) */
+#include "internal/pycore_dict.h"          /* PyDictKeysObject (LOAD_ATTR_MODULE) */
 #include "opcode.h"
 
 /* ---- PhxTranslationContext ---- */
@@ -711,6 +713,167 @@ int hir_builder_emit_load_attr_slot_c(
     return 1;
 }
 
+/* emitLoadAttrModule — LOAD_ATTR_MODULE specialization */
+extern void *jit_rt_load_module_dict_entry_addr(void);
+extern void *hir_c_create_call_static_reg(size_t n_operands, void *dst,
+                                           void *addr, HirType ret_type);
+extern void *hir_c_create_guard(void *src);
+extern void *hir_c_create_load_const(void *dst, HirType type);
+extern void hir_c_set_descr(void *instr, const char *descr);
+
+int hir_builder_emit_load_attr_module_c(
+        PhxTranslationContext *tc, void *func, void *builder,
+        void *receiver, PyCodeObject *code, int name_idx, int instr_idx) {
+    HirType t_module = hir_type_from_pytype(&PyModule_Type, 1);
+    phx_tc_emit(tc, hir_c_create_guard_type_reg(receiver, t_module, receiver));
+
+    uint32_t dict_version;
+    uint16_t index;
+    hir_builder_get_attr_cache(builder, instr_idx, &dict_version, &index);
+
+    if (dict_version == 0) {
+        return 0; /* fallback to generic LoadAttr */
+    }
+
+    HirType t_object   = (HirType)HIR_TYPE_OBJECT;
+    HirType t_cptr     = (HirType)HIR_TYPE_CPTR;
+    HirType t_cuint32  = (HirType)HIR_TYPE_CUINT32;
+    HirType t_cint64   = (HirType)HIR_TYPE_CINT64;
+    HirType t_optobj   = hir_type_union((HirType)HIR_TYPE_OBJECT, (HirType)HIR_TYPE_NULLPTR);
+
+    void *dict = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_load_field_reg(dict, receiver, "md_dict",
+        (intptr_t)offsetof(PyModuleObject, md_dict), t_object, 0));
+
+    void *keys = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_load_field_reg(keys, dict, "ma_keys",
+        (intptr_t)offsetof(PyDictObject, ma_keys), t_cptr, 0));
+
+    void *loaded_version = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_load_field_reg(loaded_version, keys, "dk_version",
+        (intptr_t)offsetof(PyDictKeysObject, dk_version), t_cuint32, 0));
+
+    void *expected_version = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_load_const(expected_version,
+        hir_type_from_cuint((uint64_t)dict_version, t_cuint32)));
+
+    void *version_match = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_primitive_compare(version_match,
+        HIR_PCMP_Equal, loaded_version, expected_version));
+
+    void *guard = hir_c_create_guard(version_match);
+    hir_deopt_set_frame_state(guard, &tc->frame);
+    phx_tc_emit(tc, guard);
+
+    void *index_reg = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_load_const(index_reg,
+        hir_type_from_cint((int64_t)index, t_cint64)));
+
+    void *result = hir_func_alloc_register(func);
+    void *call = hir_c_create_call_static_reg(2, result,
+        jit_rt_load_module_dict_entry_addr(), t_optobj);
+    hir_c_set_operand(call, 0, keys);
+    hir_c_set_operand(call, 1, index_reg);
+    phx_tc_emit(tc, call);
+
+    PyObject *attr_name = PyTuple_GET_ITEM(code->co_names, name_idx);
+    void *cf = hir_c_create_check_field_reg(result, result, attr_name, &tc->frame);
+    hir_c_set_guilty_reg(cf, receiver);
+    phx_tc_emit(tc, cf);
+
+    phx_ptr_arr_push(&tc->frame.stack, result);
+    return 1;
+}
+
+/* emitLoadAttrInstanceValue — LOAD_ATTR_INSTANCE_VALUE specialization */
+int hir_builder_emit_load_attr_instance_value_c(
+        PhxTranslationContext *tc, void *func, void *builder,
+        void *receiver, PyCodeObject *code, int name_idx, int instr_idx) {
+    uint32_t type_version;
+    uint16_t index;
+    hir_builder_get_attr_cache(builder, instr_idx, &type_version, &index);
+
+    PyTypeObject *slot_type = hir_find_type_by_version_tag(type_version);
+    if (slot_type == NULL ||
+        (slot_type->tp_subclasses != NULL &&
+         PyDict_GET_SIZE((PyObject *)slot_type->tp_subclasses) > 0) ||
+        !PyType_HasFeature(slot_type, Py_TPFLAGS_MANAGED_DICT)) {
+        /* Optional fallback: emit GuardType only if type found and no subclasses */
+        if (slot_type != NULL &&
+            (slot_type->tp_subclasses == NULL ||
+             PyDict_GET_SIZE((PyObject *)slot_type->tp_subclasses) == 0)) {
+            HirType t_only = hir_type_from_pytype(slot_type, 1);
+            phx_tc_emit(tc, hir_c_create_guard_type_reg(receiver, t_only, receiver));
+        }
+        return 0;
+    }
+
+    PyHeapTypeObject *ht = (PyHeapTypeObject *)slot_type;
+    if (ht->ht_cached_keys == NULL) {
+        HirType t_only = hir_type_from_pytype(slot_type, 1);
+        phx_tc_emit(tc, hir_c_create_guard_type_reg(receiver, t_only, receiver));
+        return 0;
+    }
+
+    hir_func_add_reference(func, (PyObject *)slot_type);
+    HirType t_type = hir_type_from_pytype(slot_type, 1);
+    phx_tc_emit(tc, hir_c_create_guard_type_reg(receiver, t_type, receiver));
+
+    PyObject *attr_name = PyTuple_GET_ITEM(code->co_names, name_idx);
+
+    /* Load PyDictOrValues from managed-dict slot at offset -3 * sizeof(PyObject*).
+     * borrowed=true: dorv may be a tagged pointer (low bit = inline values) which is
+     * not a valid PyObject*. */
+    HirType t_optdict = hir_type_union((HirType)HIR_TYPE_DICT, (HirType)HIR_TYPE_NULLPTR);
+    void *dorv = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_load_field_reg(dorv, receiver, "__dict__",
+        (intptr_t)(-3 * (intptr_t)sizeof(PyObject *)), t_optdict, 1));
+
+    /* CheckField dorv != NULL */
+    void *checked_dorv = hir_func_alloc_register(func);
+    void *cf1 = hir_c_create_check_field_reg(checked_dorv, dorv, attr_name, &tc->frame);
+    hir_c_set_guilty_reg(cf1, receiver);
+    phx_tc_emit(tc, cf1);
+
+    /* dorv low bit: 1 = inline values, 0 = regular dict (deopt the regular case) */
+    HirType t_cuint64 = (HirType)HIR_TYPE_CUINT64;
+    HirType t_optobj  = hir_type_union((HirType)HIR_TYPE_OBJECT, (HirType)HIR_TYPE_NULLPTR);
+    void *one = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_load_const(one, hir_type_from_cuint(1, t_cuint64)));
+
+    void *dorv_int = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_bit_cast(dorv_int, checked_dorv, t_cuint64));
+
+    void *is_values = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_int_binary_op(is_values, /*kAnd*/1, dorv_int, one));
+
+    void *guard = hir_c_create_guard(is_values);
+    hir_deopt_set_frame_state(guard, &tc->frame);
+    hir_c_set_guilty_reg(guard, receiver);
+    hir_c_set_descr(guard, "dict values check");
+    phx_tc_emit(tc, guard);
+
+    /* values_ptr = dorv + 1 (tag stripped → pointer to values array) */
+    void *values_ptr = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_int_binary_op(values_ptr, /*kAdd*/0, dorv_int, one));
+
+    void *values_obj = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_bit_cast(values_obj, values_ptr, t_optobj));
+
+    /* Load attribute at cached index */
+    void *attr = hir_func_alloc_register(func);
+    phx_tc_emit(tc, hir_c_create_load_field_reg(attr, values_obj, "attr",
+        (intptr_t)((intptr_t)index * (intptr_t)sizeof(PyObject *)), t_optobj, 0));
+
+    void *result = hir_func_alloc_register(func);
+    void *cf2 = hir_c_create_check_field_reg(result, attr, attr_name, &tc->frame);
+    hir_c_set_guilty_reg(cf2, receiver);
+    phx_tc_emit(tc, cf2);
+
+    phx_ptr_arr_push(&tc->frame.stack, result);
+    return 1;
+}
+
 /* emitLoadAttr generic — non-specialized LoadAttr2 fallback */
 extern void *hir_c_create_load_attr_reg2(void *dst, void *receiver, int32_t name_idx, void *fs);
 
diff --git a/Python/jit/hir/hir_c_api.cpp b/Python/jit/hir/hir_c_api.cpp
@@ -526,6 +526,10 @@ void *jit_rt_invoke_iter_next_addr(void) {
   return reinterpret_cast<void*>(JITRT_InvokeIterNext);
 }
 
+void *jit_rt_load_module_dict_entry_addr(void) {
+  return reinterpret_cast<void*>(JITRT_LoadModuleDictEntry);
+}
+
 const char *jit_builtins_find(void *method_def) {
   auto* meth = static_cast<PyMethodDef*>(method_def);
   auto result = ::jit::getContext()->builtins().find(meth);
diff --git a/Python/jit/hir/hir_c_api.h b/Python/jit/hir/hir_c_api.h
@@ -760,6 +760,12 @@ void *hir_phi_create_2way(HirFunction func, void *bb1, void *reg1,
  * Lifetime: static (function pointer, never changes). */
 void *jit_rt_invoke_iter_next_addr(void);
 
+/* Returns function pointer for JITRT_LoadModuleDictEntry. Used by the
+ * LOAD_ATTR_MODULE specialization to invoke a CallStatic against the
+ * 2-arg runtime helper (PyDictKeysObject* keys, Py_ssize_t index)
+ * → PyObject*. Lifetime: static. */
+void *jit_rt_load_module_dict_entry_addr(void);
+
 /* ---- Context/Preload bridges ---- */
 
 /* Check if a PyMethodDef is a known builtin. Returns the builtin name
