youknowone · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026 · Sep 24, 2026
diff --git a/crates/capi/src/descrobject.rs b/crates/capi/src/descrobject.rs
@@ -6,8 +6,8 @@ use crate::util::CStrExt;
 use core::ffi::{c_char, c_int, c_void};
 use core::ptr::NonNull;
 use rustpython_vm::builtins::{
-    DescriptorMemberDef, MemberAccess, MemberKind, PY_READONLY, PY_RELATIVE_OFFSET,
-    PyDescriptorOwned, PyGetSet, PyMappingProxy, PyMemberDescriptor, PyType,
+    DescriptorMemberDef, MemberAccess, MemberKind, PY_RELATIVE_OFFSET, PyDescriptorOwned, PyGetSet,
+    PyMappingProxy, PyMemberDescriptor, PyType,
 };
 use rustpython_vm::common::lock::PyRwLock;
 use rustpython_vm::function::PySetterValue;
@@ -145,17 +145,15 @@ impl PyMemberDef {
                 self.type_code
             )));
         };
-        if self.offset < 0 {
-            return Err(vm.new_system_error("PyDescr_NewMember does not support negative offsets"));
-        }
-        if self.flags & PY_RELATIVE_OFFSET != 0 {
-            return Err(
-                vm.new_system_error("PyDescr_NewMember does not support Py_RELATIVE_OFFSET")
-            );
+        let mut offset = self.offset;
+        let mut flags = self.flags;
+        if flags & PY_RELATIVE_OFFSET != 0 {
+            // type creation adds tp_basicsize and clears the flag before GetOne.
+            offset += (rustpython_vm::object::SIZEOF_PYOBJECT_HEAD + ty.slots.basicsize) as isize;
+            flags &= !PY_RELATIVE_OFFSET;
         }
 
         let doc = unsafe { self.doc.try_as_str_opt(vm) }?.map(str::to_owned);
-        let readonly = self.flags & PY_READONLY != 0;
 
         let descriptor = PyMemberDescriptor {
             common: PyDescriptorOwned {
@@ -166,11 +164,11 @@ impl PyMemberDef {
             member: DescriptorMemberDef {
                 name: name.to_owned(),
                 kind,
-                offset: self.offset,
-                flags: if readonly { PY_READONLY } else { 0 },
+                offset,
+                flags,
                 doc,
             },
-            // Instance members live in the slot array. `offset` is that index.
+            // `offset` is a byte offset from the object to a pointer cell.
             access: MemberAccess::Slot,
         };
 

diff --git a/crates/vm/src/builtins/descriptor.rs b/crates/vm/src/builtins/descriptor.rs
@@ -355,9 +355,9 @@ pub(crate) type MemberSetterFunc =
 
 /// Where `PyMemberDef.offset` points.
 ///
-/// Builtin payloads keep fields behind locks, so a byte offset from the
-/// object header does not address them. Slot members use `offset` as an
-/// index into the instance slot array. Function members ignore `offset`.
+/// Slot members use a byte offset from the object to an inline pointer cell.
+/// Builtin payloads keep fields behind locks, so those members use a function
+/// and ignore `offset`.
 #[derive(Clone, Copy)]
 pub enum MemberAccess {
     Func {
@@ -415,10 +415,10 @@ pub struct PyMemberDescriptor {
 }
 
 impl PyMemberDescriptor {
-    /// Slot index for an instance-slot member. `None` when the offset is not a slot.
-    pub(crate) fn slot_offset(&self) -> Option<usize> {
+    /// Byte offset of an instance-slot member. `None` when this is not a slot.
+    pub(crate) fn slot_offset(&self) -> Option<isize> {
         match self.access {
-            MemberAccess::Slot => Some(self.member.offset as usize),
+            MemberAccess::Slot => Some(self.member.offset),
             _ => None,
         }
     }
@@ -436,9 +436,7 @@ impl PyMemberDescriptor {
         }
         match self.access {
             MemberAccess::Func { get, .. } => get(vm, obj),
-            MemberAccess::Slot => {
-                get_slot_from_object(&obj, self.member.offset as usize, &self.member, vm)
-            }
+            MemberAccess::Slot => get_slot_from_object(&obj, self.member.offset, &self.member, vm),
             MemberAccess::TupleItem => {
                 let index = self.member.offset as usize;
                 let tuple = obj.downcast_ref::<PyTuple>().ok_or_else(|| {
@@ -468,7 +466,7 @@ impl PyMemberDescriptor {
                 None => Err(vm.new_attribute_error("readonly attribute")),
             },
             MemberAccess::Slot => {
-                set_slot_at_object(&obj, self.member.offset as usize, &self.member, value, vm)
+                set_slot_at_object(&obj, self.member.offset, &self.member, value, vm)
             }
             MemberAccess::TupleItem => Err(vm.new_attribute_error("readonly attribute")),
         }
@@ -566,7 +564,7 @@ impl PyMemberDescriptor {
 // PyMember_GetOne for a value stored in the instance slot array.
 fn get_slot_from_object(
     obj: &PyObject,
-    offset: usize,
+    offset: isize,
     member: &PyMemberDef,
     vm: &VirtualMachine,
 ) -> PyResult {
@@ -589,7 +587,7 @@ fn get_slot_from_object(
 // PyMember_SetOne for a value stored in the instance slot array.
 fn set_slot_at_object(
     obj: &PyObject,
-    offset: usize,
+    offset: isize,
     member: &PyMemberDef,
     value: PySetterValue,
     vm: &VirtualMachine,

diff --git a/crates/vm/src/builtins/type.rs b/crates/vm/src/builtins/type.rs
@@ -2782,7 +2782,11 @@ impl Constructor for PyType {
                 let member_def = PyMemberDef {
                     name: mangled_name.clone(),
                     kind: MemberKind::ObjectEx,
-                    offset: offset as isize,
+                    offset: crate::object::slot_member_offset(
+                        typ.slots.flags.has_feature(PyTypeFlags::HAS_WEAKREF),
+                        typ.slots.member_count,
+                        offset,
+                    ),
                     flags: 0,
                     doc: None,
                 };

diff --git a/crates/vm/src/frame.rs b/crates/vm/src/frame.rs
@@ -6291,7 +6291,7 @@ impl ExecutingFrame<'_> {
 
                 if type_version != 0 && owner.class().tp_version_tag.load(Acquire) == type_version {
                     let slot_offset =
-                        self.code.instructions.read_cache_u32(cache_base + 3) as usize;
+                        self.code.instructions.read_cache_u32(cache_base + 3) as i32 as isize;
                     if let Some(value) = owner.get_slot(slot_offset) {
                         self.pop_stackref();
                         if oparg.is_method() {
@@ -6381,7 +6381,7 @@ impl ExecutingFrame<'_> {
 
                 if version_match {
                     let slot_offset =
-                        self.code.instructions.read_cache_u16(cache_base + 3) as usize;
+                        self.code.instructions.read_cache_u16(cache_base + 3) as i16 as isize;
                     let owner = self.pop_value();
                     let value = self.pop_value();
                     owner.set_slot(slot_offset, Some(value));

diff --git a/crates/vm/src/object/core.rs b/crates/vm/src/object/core.rs
@@ -30,7 +30,6 @@ use crate::{
     class::StaticType,
     object::traverse::{MaybeTraverse, Traverse, TraverseFn},
 };
-use itertools::Itertools;
 
 use alloc::fmt;
 
@@ -244,7 +243,7 @@ pub(super) unsafe fn default_dealloc<T: PyPayload>(obj: *mut PyObject) {
                 let old = dict.d.write().take();
                 drop(old);
             }
-            for slot in &ext.slots {
+            for slot in obj_ref.0.slot_cells() {
                 drop(slot.store(None));
             }
         }
@@ -367,28 +366,16 @@ unsafe impl Link for GcLink {
 #[repr(C, align(8))]
 pub(super) struct ObjExt {
     pub(super) dict: Option<InstanceDict>,
-    /// Owned `PyObject*` cells. Null is empty. Each cell is one pointer so a
-    /// later step can place the same cells at a byte offset from the object.
-    pub(super) slots: Box<[PyAtomicRef<PyObject>]>,
 }
 
 impl ObjExt {
-    fn new(
-        dict: Option<PyDictRef>,
-        member_count: usize,
-        has_dict: bool,
-        inline_values: bool,
-    ) -> Self {
+    fn new(dict: Option<PyDictRef>, has_dict: bool, inline_values: bool) -> Self {
         Self {
             dict: if has_dict {
                 Some(InstanceDict::from_opt(dict, inline_values))
             } else {
                 None
             },
-            slots: core::iter::repeat_with(PyAtomicRef::<PyObject>::new_empty)
-                .take(member_count)
-                .collect_vec()
-                .into_boxed_slice(),
         }
     }
 }
@@ -403,6 +390,28 @@ impl fmt::Debug for ObjExt {
 /// All prefix components are align(8) and their sizes are multiples of 8,
 /// so Layout::extend adds no inter-padding.
 const EXT_OFFSET: usize = core::mem::size_of::<ObjExt>();
+
+/// Byte offset of member cell `index` from the start of `PyInner`.
+/// Cells live in front of the object, so the offset is negative.
+pub(crate) fn slot_member_offset(has_weakref: bool, member_count: usize, index: usize) -> isize {
+    let ext_offset = if has_weakref {
+        WEAKREF_OFFSET + EXT_OFFSET
+    } else {
+        EXT_OFFSET
+    };
+    let region = slot_region_layout(member_count).map_or(0, |layout| layout.size());
+    let cell = core::mem::size_of::<PyAtomicRef<PyObject>>() as isize;
+    -((ext_offset + region) as isize) + index as isize * cell
+}
+
+fn slot_region_layout(member_count: usize) -> Option<core::alloc::Layout> {
+    if member_count == 0 {
+        return None;
+    }
+    let bytes = member_count * core::mem::size_of::<PyAtomicRef<PyObject>>();
+    let align = core::mem::align_of::<ObjExt>();
+    Some(core::alloc::Layout::from_size_align(bytes.next_multiple_of(align), align).unwrap())
+}
 const WEAKREF_OFFSET: usize = core::mem::size_of::<WeakRefList>();
 
 const _: () =
@@ -441,7 +450,7 @@ pub(super) struct PyInner<T> {
 
     pub(super) payload: T,
 }
-pub(crate) const SIZEOF_PYOBJECT_HEAD: usize = core::mem::size_of::<PyInner<()>>();
+pub const SIZEOF_PYOBJECT_HEAD: usize = core::mem::size_of::<PyInner<()>>();
 
 // ref_count, vtable, gc_pointers (two) and typ are one word each; the gc bits,
 // generation, owner and refs take eight bytes between them. A 64-bit header had
@@ -496,6 +505,21 @@ impl<T> PyInner<T> {
         Some(unsafe { &*ext_ptr })
     }
 
+    /// Member cells are the pointer array immediately before [`ObjExt`].
+    /// Layout: `[PyAtomicRef<PyObject>; N][ObjExt?][WeakRefList?][PyInner]`.
+    pub(super) fn slot_cells(&self) -> &[PyAtomicRef<PyObject>] {
+        let Some(ext) = self.ext_ref() else {
+            return &[];
+        };
+        let (_, member_count) = self.read_type_flags();
+        let Some(region) = slot_region_layout(member_count) else {
+            return &[];
+        };
+        let base = (ext as *const ObjExt).addr().wrapping_sub(region.size());
+        let ptr = core::ptr::with_exposed_provenance::<PyAtomicRef<PyObject>>(base);
+        unsafe { core::slice::from_raw_parts(ptr, member_count) }
+    }
+
     /// Access the WeakRefList prefix at a fixed negative offset from this PyInner.
     /// Returns None if the type does not support weakrefs.
     ///
@@ -1192,7 +1216,7 @@ impl<T: PyPayload> PyInner<T> {
     }
 
     /// Deallocate a PyInner, handling optional prefix(es).
-    /// Layout: [ObjExt?][WeakRefList?][PyInner<T>]
+    /// Layout: `[PyAtomicRef<PyObject>; N][ObjExt?][WeakRefList?][PyInner<T>]`
     ///
     /// # Safety
     /// `ptr` must be a valid pointer from `PyInner::new` and must not be used after this call.
@@ -1210,6 +1234,9 @@ impl<T: PyPayload> PyInner<T> {
                 // Reconstruct the same layout used in new()
                 let mut layout = core::alloc::Layout::from_size_align(0, 1).unwrap();
 
+                if let Some(region) = slot_region_layout(member_count) {
+                    layout = layout.extend(region).unwrap().0;
+                }
                 if has_ext {
                     layout = layout
                         .extend(core::alloc::Layout::new::<ObjExt>())
@@ -1230,9 +1257,17 @@ impl<T: PyPayload> PyInner<T> {
 
                 Self::drop_fields(ptr);
 
-                // Drop ObjExt if present (dict, slots)
+                // Drop member cells, then ObjExt. Cells are the allocation prefix.
+                let mut cursor = alloc_ptr;
+                if let Some(region) = slot_region_layout(member_count) {
+                    let cells = cursor.cast::<PyAtomicRef<PyObject>>();
+                    for i in 0..member_count {
+                        core::ptr::drop_in_place(cells.add(i));
+                    }
+                    cursor = cursor.add(region.size());
+                }
                 if has_ext {
-                    core::ptr::drop_in_place(alloc_ptr as *mut ObjExt);
+                    core::ptr::drop_in_place(cursor.cast::<ObjExt>());
                 }
                 // WeakRefList has no Drop (just raw pointers), no drop_in_place needed
 
@@ -1258,7 +1293,7 @@ impl<T: PyPayload> PyInner<T> {
 impl<T: PyPayload + core::fmt::Debug> PyInner<T> {
     /// Allocate a new PyInner, optionally with prefix(es).
     /// Returns a raw pointer to the PyInner (NOT the allocation start).
-    /// Layout: [ObjExt?][WeakRefList?][PyInner<T>]
+    /// Layout: `[PyAtomicRef<PyObject>; N][ObjExt?][WeakRefList?][PyInner<T>]`
     fn new(payload: T, typ: PyTypeRef, dict: Option<PyDictRef>) -> *mut Self {
         let member_count = typ.slots.member_count;
         let needs_ext = typ
@@ -1277,9 +1312,17 @@ impl<T: PyPayload + core::fmt::Debug> PyInner<T> {
         );
 
         if needs_ext || needs_weakref {
-            // Build layout left-to-right: [ObjExt?][WeakRefList?][PyInner]
+            // Build layout left-to-right: [slots?][ObjExt?][WeakRefList?][PyInner]
             let mut layout = core::alloc::Layout::from_size_align(0, 1).unwrap();
 
+            let slots_start = if let Some(region) = slot_region_layout(member_count) {
+                let (combined, offset) = layout.extend(region).unwrap();
+                layout = combined;
+                Some(offset)
+            } else {
+                None
+            };
+
             let ext_start = if needs_ext {
                 let (combined, offset) =
                     layout.extend(core::alloc::Layout::new::<ObjExt>()).unwrap();
@@ -1311,12 +1354,19 @@ impl<T: PyPayload + core::fmt::Debug> PyInner<T> {
             alloc_ptr.expose_provenance();
 
             unsafe {
+                if let Some(offset) = slots_start {
+                    let cells = alloc_ptr.add(offset).cast::<PyAtomicRef<PyObject>>();
+                    for i in 0..member_count {
+                        cells.add(i).write(PyAtomicRef::<PyObject>::new_empty());
+                    }
+                }
+
                 if let Some(offset) = ext_start {
                     let ext_ptr = alloc_ptr.add(offset) as *mut ObjExt;
                     let flags = typ.slots.flags;
                     let has_dict = flags.has_feature(crate::types::PyTypeFlags::HAS_DICT);
                     let inline_values = flags.has_feature(crate::types::PyTypeFlags::INLINE_VALUES);
-                    ext_ptr.write(ObjExt::new(dict, member_count, has_dict, inline_values));
+                    ext_ptr.write(ObjExt::new(dict, has_dict, inline_values));
                 }
 
                 if let Some(offset) = weakref_start {
@@ -2120,12 +2170,20 @@ impl PyObject {
         self.0.ref_count.is_immortal()
     }
 
-    pub(crate) fn get_slot(&self, offset: usize) -> Option<PyObjectRef> {
-        self.0.ext_ref().unwrap().slots[offset].load_owned()
+    pub(crate) fn get_slot(&self, byte_offset: isize) -> Option<PyObjectRef> {
+        self.slot_cell_at(byte_offset).load_owned()
+    }
+
+    pub(crate) fn set_slot(&self, byte_offset: isize, value: Option<PyObjectRef>) {
+        drop(self.slot_cell_at(byte_offset).store(value));
     }
 
-    pub(crate) fn set_slot(&self, offset: usize, value: Option<PyObjectRef>) {
-        drop(self.0.ext_ref().unwrap().slots[offset].store(value));
+    fn slot_cell_at(&self, byte_offset: isize) -> &PyAtomicRef<PyObject> {
+        let addr = (self as *const Self as *const u8)
+            .addr()
+            .wrapping_add(byte_offset as usize);
+        let ptr = core::ptr::with_exposed_provenance::<PyAtomicRef<PyObject>>(addr);
+        unsafe { &*ptr }
     }
 
     /// _PyObject_GC_IS_TRACKED
@@ -2250,7 +2308,7 @@ impl PyObject {
             if let Some(dict_ref) = ext.dict.as_ref().and_then(|d| d.replace(None)) {
                 result.push(dict_ref.into());
             }
-            for slot in &ext.slots {
+            for slot in obj.0.slot_cells() {
                 if let Some(val) = slot.store(None) {
                     result.push(val);
                 }
@@ -2278,10 +2336,8 @@ impl PyObject {
     // Py_TPFLAGS_HAVE_GC types have tp_clear
     pub fn gc_has_clear(&self) -> bool {
         self.0.vtable.clear.is_some()
-            || self
-                .0
-                .ext_ref()
-                .is_some_and(|ext| ext.dict.is_some() || !ext.slots.is_empty())
+            || self.0.ext_ref().is_some_and(|ext| ext.dict.is_some())
+            || self.0.read_type_flags().1 > 0
     }
 }
 
@@ -2930,7 +2986,7 @@ pub(crate) fn init_type_hierarchy() -> BootstrapTypeHierarchy {
         alloc_ptr.expose_provenance();
 
         unsafe {
-            (alloc_ptr as *mut ObjExt).write(ObjExt::new(None, 0, true, false));
+            (alloc_ptr as *mut ObjExt).write(ObjExt::new(None, true, false));
             (alloc_ptr.add(weakref_offset) as *mut WeakRefList).write(WeakRefList::new());
             alloc_ptr.add(inner_offset).cast()
         }