32.12. dis Disassembler for Python bytecode
Source code: Lib/dis.py
The dis module supports the analysis of CPython bytecode by
disassembling it. The CPython bytecode which this module takes as an input is
defined in the file Include/opcode.h and used by the compiler and the
interpreter.
CPython implementation detail: Bytecode is an implementation detail of the CPython interpreter. No guarantees are made that bytecode will not be added, removed, or changed between versions of Python. Use of this module should not be considered to work across Python VMs or Python releases.
Changed in version 3.6: Use 2 bytes for each instruction. Previously the number of bytes varied by instruction.
Example: Given the function myfunc():
def myfunc(alist):
return len(alist)
the following command can be used to display the disassembly of
myfunc():
>>> dis.dis(myfunc)
2 0 LOAD_GLOBAL 0 (len)
2 LOAD_FAST 0 (alist)
4 CALL_FUNCTION 1
6 RETURN_VALUE
(The 2 is a line number).
32.12.1. Bytecode analysis
New in version 3.4.
The bytecode analysis API allows pieces of Python code to be wrapped in a
Bytecode object that provides easy access to details of the compiled
code.
-
class
dis.Bytecode(x, *, first_line=None, current_offset=None) Analyse the bytecode corresponding to a function, generator, method, string of source code, or a code object (as returned by
compile()).This is a convenience wrapper around many of the functions listed below, most notably
get_instructions(), as iterating over aBytecodeinstance yields the bytecode operations asInstructioninstances.If first_line is not
None, it indicates the line number that should be reported for the first source line in the disassembled code. Otherwise, the source line information (if any) is taken directly from the disassembled code object.If current_offset is not
None, it refers to an instruction offset in the disassembled code. Setting this meansdis()will display a current instruction marker against the specified opcode.-
classmethod
from_traceback(tb) Construct a
Bytecodeinstance from the given traceback, setting current_offset to the instruction responsible for the exception.
-
dis() Return a formatted view of the bytecode operations (the same as printed by
dis.dis(), but returned as a multi-line string).
-
info() Return a formatted multi-line string with detailed information about the code object, like
code_info().
-
classmethod
Example:
>>> bytecode = dis.Bytecode(myfunc)
>>> for instr in bytecode:
... print(instr.opname)
...
LOAD_GLOBAL
LOAD_FAST
CALL_FUNCTION
RETURN_VALUE
32.12.2. Analysis functions
The dis module also defines the following analysis functions that convert
the input directly to the desired output. They can be useful if only a single
operation is being performed, so the intermediate analysis object isnt useful:
-
dis.code_info(x) Return a formatted multi-line string with detailed code object information for the supplied function, generator, method, source code string or code object.
Note that the exact contents of code info strings are highly implementation dependent and they may change arbitrarily across Python VMs or Python releases.
New in version 3.2.
-
dis.show_code(x, *, file=None) Print detailed code object information for the supplied function, method, source code string or code object to file (or
sys.stdoutif file is not specified).This is a convenient shorthand for
print(code_info(x), file=file), intended for interactive exploration at the interpreter prompt.New in version 3.2.
Changed in version 3.4: Added file parameter.
-
dis.dis(x=None, *, file=None) Disassemble the x object. x can denote either a module, a class, a method, a function, a generator, a code object, a string of source code or a byte sequence of raw bytecode. For a module, it disassembles all functions. For a class, it disassembles all methods (including class and static methods). For a code object or sequence of raw bytecode, it prints one line per bytecode instruction. Strings are first compiled to code objects with the
compile()built-in function before being disassembled. If no object is provided, this function disassembles the last traceback.The disassembly is written as text to the supplied file argument if provided and to
sys.stdoutotherwise.Changed in version 3.4: Added file parameter.
-
dis.distb(tb=None, *, file=None) Disassemble the top-of-stack function of a traceback, using the last traceback if none was passed. The instruction causing the exception is indicated.
The disassembly is written as text to the supplied file argument if provided and to
sys.stdoutotherwise.Changed in version 3.4: Added file parameter.
-
dis.disassemble(code, lasti=-1, *, file=None) -
dis.disco(code, lasti=-1, *, file=None) Disassemble a code object, indicating the last instruction if lasti was provided. The output is divided in the following columns:
the line number, for the first instruction of each line
the current instruction, indicated as
-->,a labelled instruction, indicated with
>>,the address of the instruction,
the operation code name,
operation parameters, and
interpretation of the parameters in parentheses.
The parameter interpretation recognizes local and global variable names, constant values, branch targets, and compare operators.
The disassembly is written as text to the supplied file argument if provided and to
sys.stdoutotherwise.Changed in version 3.4: Added file parameter.
-
dis.get_instructions(x, *, first_line=None) Return an iterator over the instructions in the supplied function, method, source code string or code object.
The iterator generates a series of
Instructionnamed tuples giving the details of each operation in the supplied code.If first_line is not
None, it indicates the line number that should be reported for the first source line in the disassembled code. Otherwise, the source line information (if any) is taken directly from the disassembled code object.New in version 3.4.
-
dis.findlinestarts(code) This generator function uses the
co_firstlinenoandco_lnotabattributes of the code object code to find the offsets which are starts of lines in the source code. They are generated as(offset, lineno)pairs. See Objects/lnotab_notes.txt for theco_lnotabformat and how to decode it.Changed in version 3.6: Line numbers can be decreasing. Before, they were always increasing.
-
dis.findlabels(code) Detect all offsets in the code object code which are jump targets, and return a list of these offsets.
-
dis.stack_effect(opcode[, oparg]) Compute the stack effect of opcode with argument oparg.
New in version 3.4.
32.12.3. Python Bytecode Instructions
The get_instructions() function and Bytecode class provide
details of bytecode instructions as Instruction instances:
-
class
dis.Instruction Details for a bytecode operation
-
opcode numeric code for operation, corresponding to the opcode values listed below and the bytecode values in the Opcode collections.
New in version 3.4.
-
The Python compiler currently generates the following bytecode instructions.
General instructions
-
DUP_TOP_TWO Duplicates the two references on top of the stack, leaving them in the same order.
New in version 3.2.
Unary operations
Unary operations take the top of the stack, apply the operation, and push the result back on the stack.
-
GET_YIELD_FROM_ITER If
TOSis a generator iterator or coroutine object it is left as is. Otherwise, implementsTOS = iter(TOS).New in version 3.5.
Binary operations
Binary operations remove the top of the stack (TOS) and the second top-most stack item (TOS1) from the stack. They perform the operation, and put the result back on the stack.
In-place operations
In-place operations are like binary operations, in that they remove TOS and TOS1, and push the result back on the stack, but the operation is done in-place when TOS1 supports it, and the resulting TOS may be (but does not have to be) the original TOS1.
Coroutine opcodes
-
GET_AWAITABLE Implements
TOS = get_awaitable(TOS), whereget_awaitable(o)returnsoifois a coroutine object or a generator object with the CO_ITERABLE_COROUTINE flag, or resolveso.__await__.New in version 3.5.
-
GET_AITER Implements
TOS = get_awaitable(TOS.__aiter__()). SeeGET_AWAITABLEfor details aboutget_awaitableNew in version 3.5.
-
GET_ANEXT Implements
PUSH(get_awaitable(TOS.__anext__())). SeeGET_AWAITABLEfor details aboutget_awaitableNew in version 3.5.
-
BEFORE_ASYNC_WITH Resolves
__aenter__and__aexit__from the object on top of the stack. Pushes__aexit__and result of__aenter__()to the stack.New in version 3.5.
Miscellaneous opcodes
-
PRINT_EXPR Implements the expression statement for the interactive mode. TOS is removed from the stack and printed. In non-interactive mode, an expression statement is terminated with
POP_TOP.
-
BREAK_LOOP Terminates a loop due to a
breakstatement.
-
CONTINUE_LOOP(target) Continues a loop due to a
continuestatement. target is the address to jump to (which should be aFOR_ITERinstruction).
-
MAP_ADD(i) Calls
dict.setitem(TOS1[-i], TOS, TOS1). Used to implement dict comprehensions.New in version 3.1.
For all of the SET_ADD, LIST_APPEND and MAP_ADD
instructions, while the added value or key/value pair is popped off, the
container object remains on the stack so that it is available for further
iterations of the loop.
-
YIELD_VALUE Pops TOS and yields it from a generator.
-
YIELD_FROM Pops TOS and delegates to it as a subiterator from a generator.
New in version 3.3.
-
SETUP_ANNOTATIONS Checks whether
__annotations__is defined inlocals(), if not it is set up to an emptydict. This opcode is only emitted if a class or module body contains variable annotations statically.New in version 3.6.
-
IMPORT_STAR Loads all symbols not starting with
'_'directly from the module TOS to the local namespace. The module is popped after loading all names. This opcode implementsfrom module import *.
-
POP_BLOCK Removes one block from the block stack. Per frame, there is a stack of blocks, denoting nested loops, try statements, and such.
-
POP_EXCEPT Removes one block from the block stack. The popped block must be an exception handler block, as implicitly created when entering an except handler. In addition to popping extraneous values from the frame stack, the last three popped values are used to restore the exception state.
-
END_FINALLY Terminates a
finallyclause. The interpreter recalls whether the exception has to be re-raised, or whether the function returns, and continues with the outer-next block.
-
LOAD_BUILD_CLASS Pushes
builtins.__build_class__()onto the stack. It is later called byCALL_FUNCTIONto construct a class.
-
SETUP_WITH(delta) This opcode performs several operations before a with block starts. First, it loads
__exit__()from the context manager and pushes it onto the stack for later use byWITH_CLEANUP. Then,__enter__()is called, and a finally block pointing to delta is pushed. Finally, the result of calling the enter method is pushed onto the stack. The next opcode will either ignore it (POP_TOP), or store it in (a) variable(s) (STORE_FAST,STORE_NAME, orUNPACK_SEQUENCE).New in version 3.2.
-
WITH_CLEANUP_START Cleans up the stack when a
withstatement block exits. TOS is the context managers__exit__()bound method. Below TOS are 13 values indicating how/why the finally clause was entered:SECOND =
None(SECOND, THIRD) = (
WHY_{RETURN,CONTINUE}), retvalSECOND =
WHY_*; no retval below it(SECOND, THIRD, FOURTH) = exc_info()
In the last case,
TOS(SECOND, THIRD, FOURTH)is called, otherwiseTOS(None, None, None). Pushes SECOND and result of the call to the stack.
-
WITH_CLEANUP_FINISH Pops exception type and result of exit function call from the stack.
If the stack represents an exception, and the function call returns a true value, this information is zapped and replaced with a single
WHY_SILENCEDto preventEND_FINALLYfrom re-raising the exception. (But non-local gotos will still be resumed.)
All of the following opcodes use their arguments.
-
STORE_NAME(namei) Implements
name = TOS. namei is the index of name in the attributeco_namesof the code object. The compiler tries to useSTORE_FASTorSTORE_GLOBALif possible.
-
DELETE_NAME(namei) Implements
del name, where namei is the index intoco_namesattribute of the code object.
-
UNPACK_SEQUENCE(count) Unpacks TOS into count individual values, which are put onto the stack right-to-left.
-
UNPACK_EX(counts) Implements assignment with a starred target: Unpacks an iterable in TOS into individual values, where the total number of values can be smaller than the number of items in the iterable: one of the new values will be a list of all leftover items.
The low byte of counts is the number of values before the list value, the high byte of counts the number of values after it. The resulting values are put onto the stack right-to-left.
-
STORE_GLOBAL(namei) Works as
STORE_NAME, but stores the name as a global.
-
DELETE_GLOBAL(namei) Works as
DELETE_NAME, but deletes a global name.
-
BUILD_TUPLE(count) Creates a tuple consuming count items from the stack, and pushes the resulting tuple onto the stack.
-
BUILD_LIST(count) Works as
BUILD_TUPLE, but creates a list.
-
BUILD_SET(count) Works as
BUILD_TUPLE, but creates a set.
-
BUILD_MAP(count) Pushes a new dictionary object onto the stack. Pops
2 * countitems so that the dictionary holds count entries:{..., TOS3: TOS2, TOS1: TOS}.Changed in version 3.5: The dictionary is created from stack items instead of creating an empty dictionary pre-sized to hold count items.
-
BUILD_CONST_KEY_MAP(count) The version of
BUILD_MAPspecialized for constant keys. count values are consumed from the stack. The top element on the stack contains a tuple of keys.New in version 3.6.
-
BUILD_STRING(count) Concatenates count strings from the stack and pushes the resulting string onto the stack.
New in version 3.6.
-
BUILD_TUPLE_UNPACK(count) Pops count iterables from the stack, joins them in a single tuple, and pushes the result. Implements iterable unpacking in tuple displays
(*x, *y, *z).New in version 3.5.
-
BUILD_TUPLE_UNPACK_WITH_CALL(count) This is similar to
BUILD_TUPLE_UNPACK, but is used forf(*x, *y, *z)call syntax. The stack item at positioncount + 1should be the corresponding callablef.New in version 3.6.
-
BUILD_LIST_UNPACK(count) This is similar to
BUILD_TUPLE_UNPACK, but pushes a list instead of tuple. Implements iterable unpacking in list displays[*x, *y, *z].New in version 3.5.
-
BUILD_SET_UNPACK(count) This is similar to
BUILD_TUPLE_UNPACK, but pushes a set instead of tuple. Implements iterable unpacking in set displays{*x, *y, *z}.New in version 3.5.
-
BUILD_MAP_UNPACK(count) Pops count mappings from the stack, merges them into a single dictionary, and pushes the result. Implements dictionary unpacking in dictionary displays
{**x, **y, **z}.New in version 3.5.
-
BUILD_MAP_UNPACK_WITH_CALL(count) This is similar to
BUILD_MAP_UNPACK, but is used forf(**x, **y, **z)call syntax. The stack item at positioncount + 2should be the corresponding callablef.New in version 3.5.
Changed in version 3.6: The position of the callable is determined by adding 2 to the opcode argument instead of encoding it in the second byte of the argument.
-
IMPORT_NAME(namei) Imports the module
co_names[namei]. TOS and TOS1 are popped and provide the fromlist and level arguments of__import__(). The module object is pushed onto the stack. The current namespace is not affected: for a proper import statement, a subsequentSTORE_FASTinstruction modifies the namespace.
-
IMPORT_FROM(namei) Loads the attribute
co_names[namei]from the module found in TOS. The resulting object is pushed onto the stack, to be subsequently stored by aSTORE_FASTinstruction.
-
POP_JUMP_IF_TRUE(target) If TOS is true, sets the bytecode counter to target. TOS is popped.
New in version 3.1.
-
POP_JUMP_IF_FALSE(target) If TOS is false, sets the bytecode counter to target. TOS is popped.
New in version 3.1.
-
JUMP_IF_TRUE_OR_POP(target) If TOS is true, sets the bytecode counter to target and leaves TOS on the stack. Otherwise (TOS is false), TOS is popped.
New in version 3.1.
-
JUMP_IF_FALSE_OR_POP(target) If TOS is false, sets the bytecode counter to target and leaves TOS on the stack. Otherwise (TOS is true), TOS is popped.
New in version 3.1.
-
FOR_ITER(delta) TOS is an iterator. Call its
__next__()method. If this yields a new value, push it on the stack (leaving the iterator below it). If the iterator indicates it is exhausted TOS is popped, and the byte code counter is incremented by delta.
-
SETUP_LOOP(delta) Pushes a block for a loop onto the block stack. The block spans from the current instruction with a size of delta bytes.
-
SETUP_EXCEPT(delta) Pushes a try block from a try-except clause onto the block stack. delta points to the first except block.
-
SETUP_FINALLY(delta) Pushes a try block from a try-except clause onto the block stack. delta points to the finally block.
-
STORE_ANNOTATION(namei) Stores TOS as
locals()['__annotations__'][co_names[namei]] = TOS.New in version 3.6.
-
LOAD_CLOSURE(i) Pushes a reference to the cell contained in slot i of the cell and free variable storage. The name of the variable is
co_cellvars[i]if i is less than the length of co_cellvars. Otherwise it isco_freevars[i - len(co_cellvars)].
-
LOAD_DEREF(i) Loads the cell contained in slot i of the cell and free variable storage. Pushes a reference to the object the cell contains on the stack.
-
LOAD_CLASSDEREF(i) Much like
LOAD_DEREFbut first checks the locals dictionary before consulting the cell. This is used for loading free variables in class bodies.New in version 3.4.
-
DELETE_DEREF(i) Empties the cell contained in slot i of the cell and free variable storage. Used by the
delstatement.New in version 3.2.
-
RAISE_VARARGS(argc) Raises an exception. argc indicates the number of arguments to the raise statement, ranging from 0 to 3. The handler will find the traceback as TOS2, the parameter as TOS1, and the exception as TOS.
-
CALL_FUNCTION(argc) Calls a callable object with positional arguments. argc indicates the number of positional arguments. The top of the stack contains positional arguments, with the right-most argument on top. Below the arguments is a callable object to call.
CALL_FUNCTIONpops all arguments and the callable object off the stack, calls the callable object with those arguments, and pushes the return value returned by the callable object.Changed in version 3.6: This opcode is used only for calls with positional arguments.
-
CALL_FUNCTION_KW(argc) Calls a callable object with positional (if any) and keyword arguments. argc indicates the total number of positional and keyword arguments. The top element on the stack contains a tuple of keyword argument names. Below that are keyword arguments in the order corresponding to the tuple. Below that are positional arguments, with the right-most parameter on top. Below the arguments is a callable object to call.
CALL_FUNCTION_KWpops all arguments and the callable object off the stack, calls the callable object with those arguments, and pushes the return value returned by the callable object.Changed in version 3.6: Keyword arguments are packed in a tuple instead of a dictionary, argc indicates the total number of arguments.
-
CALL_FUNCTION_EX(flags) Calls a callable object with variable set of positional and keyword arguments. If the lowest bit of flags is set, the top of the stack contains a mapping object containing additional keyword arguments. Below that is an iterable object containing positional arguments and a callable object to call.
BUILD_MAP_UNPACK_WITH_CALLandBUILD_TUPLE_UNPACK_WITH_CALLcan be used for merging multiple mapping objects and iterables containing arguments. Before the callable is called, the mapping object and iterable object are each unpacked and their contents passed in as keyword and positional arguments respectively.CALL_FUNCTION_EXpops all arguments and the callable object off the stack, calls the callable object with those arguments, and pushes the return value returned by the callable object.New in version 3.6.
-
MAKE_FUNCTION(argc) Pushes a new function object on the stack. From bottom to top, the consumed stack must consist of values if the argument carries a specified flag value
0x01a tuple of default values for positional-only and positional-or-keyword parameters in positional order0x02a dictionary of keyword-only parameters default values0x04an annotation dictionary0x08a tuple containing cells for free variables, making a closurethe code associated with the function (at TOS1)
the qualified name of the function (at TOS)
-
BUILD_SLICE(argc) Pushes a slice object on the stack. argc must be 2 or 3. If it is 2,
slice(TOS1, TOS)is pushed; if it is 3,slice(TOS2, TOS1, TOS)is pushed. See theslice()built-in function for more information.
-
EXTENDED_ARG(ext) Prefixes any opcode which has an argument too big to fit into the default two bytes. ext holds two additional bytes which, taken together with the subsequent opcodes argument, comprise a four-byte argument, ext being the two most-significant bytes.
-
FORMAT_VALUE(flags) Used for implementing formatted literal strings (f-strings). Pops an optional fmt_spec from the stack, then a required value. flags is interpreted as follows:
(flags & 0x03) == 0x00: value is formatted as-is.(flags & 0x03) == 0x01: callstr()on value before formatting it.(flags & 0x03) == 0x02: callrepr()on value before formatting it.(flags & 0x03) == 0x03: callascii()on value before formatting it.(flags & 0x04) == 0x04: pop fmt_spec from the stack and use it, else use an empty fmt_spec.
Formatting is performed using
PyObject_Format(). The result is pushed on the stack.New in version 3.6.
-
HAVE_ARGUMENT This is not really an opcode. It identifies the dividing line between opcodes which dont use their argument and those that do (
< HAVE_ARGUMENTand>= HAVE_ARGUMENT, respectively).Changed in version 3.6: Now every instruction has an argument, but opcodes
< HAVE_ARGUMENTignore it. Before, only opcodes>= HAVE_ARGUMENThad an argument.
32.12.4. Opcode collections
These collections are provided for automatic introspection of bytecode instructions: