cd crates/compiler-core && wc -l src/bytecode.rs

cd crates/compiler-core && sed -n '480,510p' src/bytecode.rs

cd crates/compiler-core && sed -n '564,580p' src/bytecode.rs

cd crates/compiler-core && sed -n '440,460p' src/bytecode.rs

cd crates/compiler-core && sed -n '1,30p' src/bytecode.rs

cd crates/compiler-core && rg -A 3 -B 3 "read_op\(" src/bytecode.rs | head -40

cd crates/compiler-core && rg "read_arg\(" src/bytecode.rs | head -20

cd crates/compiler-core && rg "read_adaptive_counter\(" src/bytecode.rs | head -20

cd crates/compiler-core && sed -n '320,380p' src/bytecode.rs

cd crates/compiler-core && grep -n "struct CodeUnit\|struct CodeUnits\|#\[repr" src/bytecode.rs | head -20

cd crates/compiler-core && grep -rn "read_op\|read_arg\|read_adaptive_counter" src/ --include="*.rs" | grep -v "^\s*//" | head -40

cd crates/compiler-core && sed -n '630,680p' src/bytecode.rs

cd crates/compiler-core && sed -n '380,440p' src/bytecode.rs

cd crates/compiler-core && sed -n '590,640p' src/bytecode.rs

cd crates/compiler-core && grep -n "pub fn len\|pub fn is_empty\|impl.*CodeUnits" src/bytecode.rs

cd crates/compiler-core && sed -n '373,430p' src/bytecode.rs

cd crates/compiler-core && grep -rn "\.read_op\|\.read_arg\|\.read_adaptive_counter" . --include="*.rs" | grep -v "src/bytecode.rs"

cd crates/compiler-core && sed -n '446,480p' src/bytecode.rs

rg -r crates/ "\.read_op\(|\.read_arg\(|\.read_adaptive_counter\(" --include="*.rs" | head -50

rg "CodeUnits" --include="*.rs" -l | head -20

rg "\.read_op\(|\.read_arg\(|\.read_adaptive_counter\(" -t rs

rg "CodeUnits" -t rs -l

rg "\.read_op\(|\.read_arg\(|\.read_adaptive_counter\("

rg "CodeUnits"

sed -n '1,50p' crates/vm/src/frame.rs

rg -B 5 -A 5 "\.read_op\(" crates/vm/src/frame.rs | head -80

sed -n '700,800p' crates/vm/src/frame.rs | grep -A 10 "fn eval"

rg "idx.*read_op|instr_idx.*read_op" crates/vm/src/frame.rs -B 3 -A 3 | head -100

sed -n '485,500p' crates/compiler-core/src/bytecode.rs

sed -n '569,580p' crates/compiler-core/src/bytecode.rs

rg "while.*<.*len\(\)|for.*in.*0.*len" crates/vm/src/frame.rs -B 2 -A 5 | head -60

rg "pub fn" crates/compiler-core/src/bytecode.rs | head -20

sed -n '435,445p' crates/compiler-core/src/bytecode.rs

sed -n '435,500p' crates/compiler-core/src/bytecode.rs | grep -E "fn len|fn is_empty"

rg "impl.*Deref.*CodeUnits" crates/compiler-core/src/bytecode.rs -A 15

grep -n "pub fn len\|pub fn is_empty" crates/compiler-core/src/bytecode.rs

sed -n '435,450p' crates/compiler-core/src/bytecode.rs

rg "\.len\(\)" crates/compiler-core/src/bytecode.rs | head -10

sed -n '515,570p' crates/compiler-core/src/bytecode.rs

 pub fn read_op(&self, index: usize) -> Instruction {
     let units = unsafe { &*self.0.get() };
+    assert!(index < units.len(), "read_op: index out of bounds");
     let ptr = units.as_ptr().wrapping_add(index) as *const AtomicU8;
     let byte = unsafe { &*ptr }.load(Ordering::Acquire);
     // SAFETY: Only valid Instruction values are stored via replace_op/compare_exchange_op.
     unsafe { mem::transmute::<u8, Instruction>(byte) }
 }

 pub fn read_arg(&self, index: usize) -> OpArgByte {
     let units = unsafe { &*self.0.get() };
+    assert!(index < units.len(), "read_arg: index out of bounds");
     let ptr = units.as_ptr().wrapping_add(index) as *const u8;
     let arg_ptr = unsafe { ptr.add(1) } as *const AtomicU8;
     OpArgByte::from(unsafe { &*arg_ptr }.load(Ordering::Relaxed))
 }

 pub fn read_adaptive_counter(&self, index: usize) -> u8 {
     let units = unsafe { &*self.0.get() };
+    assert!(index < units.len(), "read_adaptive_counter: index out of bounds");
     let ptr = units.as_ptr().wrapping_add(index) as *const u8;
     let arg_ptr = unsafe { ptr.add(1) } as *const AtomicU8;
     unsafe { &*arg_ptr }.load(Ordering::Relaxed)
 }

Verify each finding against the current code and only fix it if needed.

In `@crates/compiler-core/src/bytecode.rs` around lines 485 - 499, The public safe
readers (read_op, read_arg, read_adaptive_counter) currently compute raw
pointers with wrapping_add(index) and dereference without bounds checks, which
can cause UB on out-of-range indices; update each function to load units first
(as in read_cache_u16) and assert the index (and any additional byte offsets,
e.g., index+1 for arg) is within units.len() before computing pointers and
dereferencing so out-of-bounds inputs panic instead of producing UB, keeping the
existing pointer/dereference logic otherwise.

# First, locate and read the relevant section of the bytecode file
fd bytecode.rs | head -1

# Read the file to check the CodeUnit struct and the atomic operations around the mentioned lines
cat -n crates/compiler-core/src/bytecode.rs | sed -n '1,50p'

# Get the CodeUnit struct definition and surrounding code
cat -n crates/compiler-core/src/bytecode.rs | sed -n '30,100p'

# Check lines 509-525 to see the actual code
cat -n crates/compiler-core/src/bytecode.rs | sed -n '500,530p'

# Check the size and alignment assertions
cat -n crates/compiler-core/src/bytecode.rs | grep -A 3 "const _:"

# Find the CodeUnit struct definition
cat -n crates/compiler-core/src/bytecode.rs | sed -n '340,360p'

# Search for the CodeUnit struct definition more broadly
rg "struct CodeUnit" -A 5 crates/compiler-core/src/bytecode.rs

# Check if there's any alignment attribute or repr clause on CodeUnit
rg "CodeUnit" crates/compiler-core/src/bytecode.rs | head -20

# Check what Instruction and OpArgByte are
rg "type Instruction|struct Instruction|enum Instruction" crates/compiler-core/src/bytecode.rs

# Check OpArgByte definition
rg "type OpArgByte|struct OpArgByte|enum OpArgByte" crates/compiler-core/src/bytecode.rs

# Look at the instruction module for Instruction definition
cat -n crates/compiler-core/src/bytecode/instruction.rs | head -50

# Look at the oparg module for OpArgByte
cat -n crates/compiler-core/src/bytecode/oparg.rs | head -30

# Check what the alignment of AtomicU16 is and the current alignment of CodeUnit
cat > /tmp/check_alignment.rs << 'EOF'
use core::{mem, sync::atomic::AtomicU16};

#[repr(C)]
#[derive(Copy, Clone, Debug)]
pub struct CodeUnit {
    pub op: u8,
    pub arg: u8,
}

fn main() {
    println!("CodeUnit size: {}", mem::size_of::<CodeUnit>());
    println!("CodeUnit align: {}", mem::align_of::<CodeUnit>());
    println!("AtomicU16 size: {}", mem::size_of::<AtomicU16>());
    println!("AtomicU16 align: {}", mem::align_of::<AtomicU16>());
    println!("u16 align: {}", mem::align_of::<u16>());
}
EOF
rustc /tmp/check_alignment.rs -o /tmp/check_alignment && /tmp/check_alignment

# Verify the actual lines 509-510 and 521-523 in context
cat -n crates/compiler-core/src/bytecode.rs | sed -n '507,524p'

# Check if there are any other alignment-related comments or safety notes
rg "align|Alignment" crates/compiler-core/src/bytecode.rs -B 2 -A 2

# Verify the actual Instruction and OpArgByte alignment requirements by checking their definitions
rg "pub struct Instruction|pub enum Instruction" crates/compiler-core/src/bytecode/instruction.rs -A 1

# Look for any repr attributes on Instruction
cat -n crates/compiler-core/src/bytecode/instruction.rs | sed -n '16,30p'

# Check if there are any tests or documentation about alignment
rg "align|unsafe.*AtomicU16" crates/compiler-core/src/ -B 3 -A 3

# Check what the actual byte layout is for CodeUnit
python3 << 'EOF'
# Instruction is #[repr(u8)] - 1 byte
# OpArgByte is #[repr(transparent)] wrapping u8 - 1 byte
# So CodeUnit = 1 + 1 = 2 bytes, but with #[repr(C)], alignment is 1 byte

print("With #[repr(C)] and two u8 fields:")
print("  Size: 2 bytes")
print("  Alignment: 1 byte (minimum of field alignments)")
print()
print("AtomicU16 requires:")
print("  Size: 2 bytes")
print("  Alignment: 2 bytes (natural alignment for atomic operations)")
print()
print("Issue: Casting 1-byte aligned pointer to 2-byte aligned is UB")
EOF

# Check if there are any other unsafe pointer casts in the file that might have similar issues
rg "as \*const AtomicU" crates/compiler-core/src/bytecode.rs

# Check the SAFETY comment around these operations
cat -n crates/compiler-core/src/bytecode.rs | sed -n '495,535p'

-#[repr(C)]
+#[repr(C, align(2))]
 #[derive(Copy, Clone, Debug)]
 pub struct CodeUnit {
     pub op: Instruction,
     pub arg: OpArgByte,
 }

-const _: () = assert!(mem::size_of::<CodeUnit>() == 2);
+const _: () = {
+    assert!(mem::size_of::<CodeUnit>() == 2);
+    assert!(mem::align_of::<CodeUnit>() >= mem::align_of::<u16>());
+};

Verify each finding against the current code and only fix it if needed.

In `@crates/compiler-core/src/bytecode.rs` around lines 509 - 510, The code casts
CodeUnit pointers to *const AtomicU16 (see usages like
units.as_ptr().wrapping_add(index) as *const AtomicU16 and the subsequent .store
calls), but CodeUnit is currently #[repr(C)] with two u8 fields and only 1-byte
alignment, which violates atomic alignment requirements; fix by changing the
struct declaration to #[repr(C, align(2))] for CodeUnit and add a compile-time
assertion to ensure alignment (e.g. assert_eq!(std::mem::align_of::<CodeUnit>(),
2) or a const_assert) so the AtomicU16 casts are safe.

     #[pygetset(setter)]
     fn set___code__(&self, code: PyRef<PyCode>, vm: &VirtualMachine) {
-        self.code.swap_to_temporary_refs(code, vm);
         #[cfg(feature = "jit")]
         {
-            *self.jitted_code.lock() = None;
+            let mut jitted = self.jitted_code.lock();
+            *jitted = None;
+            self.code.swap_to_temporary_refs(code, vm);
+        }
+        #[cfg(not(feature = "jit"))]
+        {
+            self.code.swap_to_temporary_refs(code, vm);
         }
         self.func_version.store(0, Relaxed);
     }

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/builtins/function.rs` around lines 711 - 716, The update to
__code__ must be atomic with JIT-cache invalidation to avoid running stale
jitted code; modify set___code__ so it acquires the jitted_code mutex and clears
the cached entry before performing self.code.swap_to_temporary_refs, or hold the
same jitted_code lock while doing both operations so no other thread can observe
cleared/uncleared state in between. Specifically, in set___code__, lock
jitted_code (the Mutex used at *self.jitted_code.lock()), set it to None, then
call self.code.swap_to_temporary_refs(code, vm) while still holding the lock,
and finally release the lock so the swap and cache invalidation occur
atomically.

     #[cfg(feature = "jit")]
     #[pymethod]
     fn __jit__(zelf: PyRef<Self>, vm: &VirtualMachine) -> PyResult<()> {
         if zelf.jitted_code.lock().is_some() {
             return Ok(());
         }
+        let code_snapshot: PyRef<PyCode> = (*zelf.code).to_owned();
+        let code_id = code_snapshot.get_id();

         let arg_types = jit::get_jit_arg_types(&zelf, vm)?;
         let ret_type = jit::jit_ret_type(&zelf, vm)?;
-        let code: &Py<PyCode> = &zelf.code;
-        let compiled = rustpython_jit::compile(&code.code, &arg_types, ret_type)
+        let compiled = rustpython_jit::compile(&code_snapshot.code, &arg_types, ret_type)
             .map_err(|err| jit::new_jit_error(err.to_string(), vm))?;
-        *zelf.jitted_code.lock() = Some(compiled);
+        let mut jitted = zelf.jitted_code.lock();
+        if jitted.is_none() && (*zelf.code).get_id() == code_id {
+            *jitted = Some(compiled);
+        }
         Ok(())
     }

         // Invalidate inline caches before modifying attributes.
         // This ensures other threads see the version invalidation before
         // any attribute changes, preventing use-after-free of cached descriptors.
         zelf.modified();

         if let PySetterValue::Assign(value) = value {
             zelf.attributes.write().insert(attr_name, value);
         } else {
             let prev_value = zelf.attributes.write().shift_remove(attr_name); // TODO: swap_remove applicable?
             if prev_value.is_none() {
                 return Err(vm.new_attribute_error(format!(
                     "type object '{}' has no attribute '{}'",
                     zelf.name(),
                     attr_name,
                 )));
             }
         }

         if attr_name.as_wtf8().starts_with("__") && attr_name.as_wtf8().ends_with("__") {
             if assign {
                 zelf.update_slot::<true>(attr_name, &vm.ctx);
             } else {
                 zelf.update_slot::<false>(attr_name, &vm.ctx);
             }
         }
+        // Close the race: another thread may have assigned/cached a fresh
+        // version while mutation was in-flight.
+        zelf.modified();
         Ok(())

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/builtins/type.rs` around lines 2171 - 2175, The current
pre-invalidation (calling zelf.modified() once before attribute mutation) leaves
a window where a concurrent find_name_in_mro may cache results under the new tag
during the mutation; fix this by invoking zelf.modified() both before starting
the mutation and once more immediately after finishing attribute modifications
so any caches created during the mutation are replay-invalidated; update the
code path where attributes are changed (the block containing the single
zelf.modified() call) to perform a second modified() post-mutation and ensure
this behavior aligns with the cache-checking logic in find_name_in_mro.