Crash from arbitrary code object hashing

Crash report

What happened?

When attempting to hash a code object that has arbitrary opcodes that include the INSTRUMENTED_* instructions, among others, the interpreter can crash with a segmentation fault. A simple reproducer is given by

from opcode import opmap

def f(): pass

hash(f.__code__.replace(co_code=bytes([opmap["INSTRUMENTED_LINE"], 0])))

This behaviour was introduced in 3.12 alongside the low-impact monitoring API. Whilst it is expected that executing arbitrary opcodes can lead to crashes, simply hashing a Python object should not have such strong side effects. A more real-life example can be obtained with the use of PyArmor to obfuscate bytecode. Attempting to hash an obfuscated code object can lead to a segmentation fault for the reason mentioned above.

CPython versions tested on:

3.12, 3.13, 3.14, 3.15, 3.16, CPython main branch

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-154986

Beginne mit dem Reproducer unter Verwendung von opcode.opmap, code.replace und hash(code), und untersuche anschließend den verknüpften PR gh-154986, um den Implementierungskontext zu verstehen. Als erledigt gilt die Aufgabe, wenn das Hashing eines Codeobjekts, das beliebige INSTRUMENTED_*-Opcodes enthält, auf den betroffenen CPython-Versionen keinen Segmentation Fault mehr verursacht.