Crash from arbitrary code object hashing

Crash report

What happened?

When attempting to hash a code object that has arbitrary opcodes that include the INSTRUMENTED_* instructions, among others, the interpreter can crash with a segmentation fault. A simple reproducer is given by

from opcode import opmap

def f(): pass

hash(f.__code__.replace(co_code=bytes([opmap["INSTRUMENTED_LINE"], 0])))

This behaviour was introduced in 3.12 alongside the low-impact monitoring API. Whilst it is expected that executing arbitrary opcodes can lead to crashes, simply hashing a Python object should not have such strong side effects. A more real-life example can be obtained with the use of PyArmor to obfuscate bytecode. Attempting to hash an obfuscated code object can lead to a segmentation fault for the reason mentioned above.

CPython versions tested on:

3.12, 3.13, 3.14, 3.15, 3.16, CPython main branch

Operating systems tested on:

macOS

Output from running 'python -VV' on the command line:

No response

Linked PRs

• gh-154986

Bắt đầu với reproducer sử dụng opcode.opmap, code.replace và hash(code), sau đó kiểm tra PR được liên kết gh-154986 để hiểu ngữ cảnh triển khai. Công việc được xem là hoàn tất khi việc băm một đối tượng code chứa các opcode INSTRUMENTED_* bất kỳ không còn gây ra segmentation fault trên các phiên bản CPython bị ảnh hưởng.