René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"BINARY_OP_SUBSCR_LIST_INT / STORE_SUBSCR_LIST_INT silently depend on _GUARD_TOS_INT enforcing compactness","articleBody":"## Summary\n\n`_BINARY_OP_SUBSCR_LIST_INT` and `_STORE_SUBSCR_LIST_INT` call `_PyLong_CompactValue`\non the subscript without verifying compactness themselves. They rely entirely on\n`_GUARD_TOS_INT` to have already rejected any non-compact int. This is an undocumented\ninvariant: if `_GUARD_TOS_INT` is ever relaxed, `_PyLong_CompactValue` will be called\non a wide int, reading `ob_digit[0]` as the index instead of the full value and\nsilently returning the wrong list element.\n\n## Details\n\nThe specializer gates `BINARY_OP_SUBSCR_LIST_INT`\n([specialize.c:2391](https://github.com/python/cpython/blob/main/Python/specialize.c#L2391))\nand `STORE_SUBSCR_LIST_INT`\n([specialize.c:1575](https://github.com/python/cpython/blob/main/Python/specialize.c#L1575))\non `_PyLong_IsNonNegativeCompact` — only compact non-negative subscripts trigger\nspecialization. The runtime guard `_GUARD_TOS_INT`\n([bytecodes.c:640](https://github.com/python/cpython/blob/main/Python/bytecodes.c#L640))\ncurrently checks `_PyLong_CheckExactAndCompact`, so the invariant holds today.\n\nHowever, the opcode bodies\n([`_BINARY_OP_SUBSCR_LIST_INT`](https://github.com/python/cpython/blob/main/Python/bytecodes.c#L1138),\n[`_STORE_SUBSCR_LIST_INT`](https://github.com/python/cpython/blob/main/Python/bytecodes.c#L1416))\ndo not re-verify compactness before calling `_PyLong_CompactValue`\n([longintrepr.h:130](https://github.com/python/cpython/blob/main/Include/cpython/longintrepr.h#L130)).\nIf `_GUARD_TOS_INT` were relaxed to accept wider ints (e.g. to `PyLong_CheckExact`),\na wide int subscript would pass the guard and reach `_PyLong_CompactValue` in an\ninvalid state. For a wide positive int `n = ob_digit[0] + ob_digit[1] * 2^30 + ...`,\n`_PyLong_CompactValue` reads only `ob_digit[0]`, silently producing the wrong index.\nOn a debug build this fires `assert(PyUnstable_Long_IsCompact(op))` inside\n`_PyLong_CompactValue`.\n\n## Fix\n\nAdd `EXIT_IF(!_PyLong_IsNonNegativeCompact((PyLongObject *)sub))` to\n`_BINARY_OP_SUBSCR_LIST_INT` and `DEOPT_IF(!_PyLong_IsNonNegativeCompact((PyLongObject *)sub))`\nto `_STORE_SUBSCR_LIST_INT`, immediately before the `_PyLong_CompactValue` call.\nEach opcode then enforces its own precondition rather than relying on the guard's\ncurrent strength.\n\n\u003c!-- gh-linked-prs -->\n### Linked PRs\n* gh-150588\n* gh-153004\n\u003c!-- /gh-linked-prs -->\n","author":{"url":"https://github.com/KRRT7","@type":"Person","name":"KRRT7"},"datePublished":"2026-05-29T19:26:42Z","url":"https://github.com/python/cpython/issues/150587"}