Crash from arbitrary code object hashing

Crash report

What happened?

When attempting to hash a code object that has arbitrary opcodes that include the INSTRUMENTED_* instructions, among others, the interpreter can crash with a segmentation fault. A simple reproducer is given by

from opcode import opmap

def f(): pass

hash(f.__code__.replace(co_code=bytes([opmap["INSTRUMENTED_LINE"], 0])))

This behaviour was introduced in 3.12 alongside the low-impact monitoring API. Whilst it is expected that executing arbitrary opcodes can lead to crashes, simply hashing a Python object should not have such strong side effects. A more real-life example can be obtained with the use of PyArmor to obfuscate bytecode. Attempting to hash an obfuscated code object can lead to a segmentation fault for the reason mentioned above.

CPython versions tested on:

3.12, 3.13, 3.14, 3.15, 3.16, CPython main branch

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-154986

opcode.opmap、code.replace、hash(code)を使用する再現ケースから始め、実装のコンテキストを把握するために、リンクされているPR gh-154986を調べます。任意のINSTRUMENTED_* opcodeを含むコードオブジェクトのハッシュ計算によって、影響を受けるCPythonバージョンでsegmentation faultが発生しなくなれば完了です。