### Navigation

- index
- modules |
- next |
- previous |
- Python »
- 3.3.4 Documentation »
- The Python Standard Library »
- 31. Python Language Services »

# 31.12. `dis` — Disassembler for Python bytecode

Source code: Lib/dis.py

The `dis` module supports the analysis of CPython bytecode by disassembling it. The CPython bytecode which this module takes as an input is defined in the file `Include/opcode.h` and used by the compiler and the interpreter.

CPython implementation detail: Bytecode is an implementation detail of the CPython interpreter. No guarantees are made that bytecode will not be added, removed, or changed between versions of Python. Use of this module should not be considered to work across Python VMs or Python releases.

Example: Given the function `myfunc()`:

    def myfunc(alist):
        return len(alist)

the following command can be used to get the disassembly of `myfunc()`:

    >>> dis.dis(myfunc)
      2           0 LOAD_GLOBAL              0 (len)
                  3 LOAD_FAST                0 (alist)
                  6 CALL_FUNCTION            1
                  9 RETURN_VALUE

(The “2” is a line number).

The `dis` module defines the following functions and constants:

`dis.``code_info`(x)

  Return a formatted multi-line string with detailed code object information for the supplied function, method, source code string or code object.

  Note that the exact contents of code info strings are highly implementation dependent and they may change arbitrarily across Python VMs or Python releases.

  New in version 3.2.

`dis.``show_code`(x)

  Print detailed code object information for the supplied function, method, source code string or code object to stdout.

  This is a convenient shorthand for `print(code_info(x))`, intended for interactive exploration at the interpreter prompt.

  New in version 3.2.

`dis.``dis`(x=None)

  Disassemble the x object. x can denote either a module, a class, a method, a function, a code object, a string of source code or a byte sequence of raw bytecode. For a module, it disassembles all functions. For a class, it disassembles all methods. For a code object or sequence of raw bytecode, it prints one line per bytecode instruction. Strings are first compiled to code objects with the `compile()` built-in function before being disassembled. If no object is provided, this function disassembles the last traceback.

`dis.``distb`(tb=None)

  Disassemble the top-of-stack function of a traceback, using the last traceback if none was passed. The instruction causing the exception is indicated.

`dis.``disassemble`(code, lasti=-1)
`dis.``disco`(code, lasti=-1)

  Disassemble a code object, indicating the last instruction if lasti was provided. The output is divided in the following columns:

  1. the line number, for the first instruction of each line
  2. the current instruction, indicated as `-->`,
  3. a labelled instruction, indicated with `>>`,
  4. the address of the instruction,
  5. the operation code name,
  6. operation parameters, and
  7. interpretation of the parameters in parentheses.

  The parameter interpretation recognizes local and global variable names, constant values, branch targets, and compare operators.

`dis.``findlinestarts`(code)

  This generator function uses the `co_firstlineno` and `co_lnotab` attributes of the code object code to find the offsets which are starts of lines in the source code. They are generated as `(offset, lineno)` pairs.

`dis.``findlabels`(code)

  Detect all offsets in the code object code which are jump targets, and return a list of these offsets.

`dis.``opname`

  Sequence of operation names, indexable using the bytecode.

`dis.``opmap`

  Dictionary mapping operation names to bytecodes.

`dis.``cmp_op`

  Sequence of all compare operation names.

`dis.``hasconst`

  Sequence of bytecodes that have a constant parameter.

`dis.``hasfree`

  Sequence of bytecodes that access a free variable.

`dis.``hasname`

  Sequence of bytecodes that access an attribute by name.

`dis.``hasjrel`

  Sequence of bytecodes that have a relative jump target.

`dis.``hasjabs`

  Sequence of bytecodes that have an absolute jump target.

`dis.``haslocal`

  Sequence of bytecodes that access a local variable.

`dis.``hascompare`

  Sequence of bytecodes of Boolean operations.

## 31.12.1. Python Bytecode Instructions

The Python compiler currently generates the following bytecode instructions.

General instructions

`NOP`

  Do nothing code. Used as a placeholder by the bytecode optimizer.

`POP_TOP`

  Removes the top-of-stack (TOS) item.

`ROT_TWO`

  Swaps the two top-most stack items.

`ROT_THREE`

  Lifts second and third stack item one position up, moves top down to position three.

`DUP_TOP`

  Duplicates the reference on top of the stack.

`DUP_TOP_TWO`

  Duplicates the two references on top of the stack, leaving them in the same order.

Unary operations

Unary operations take the top of the stack, apply the operation, and push the result back on the stack.

`UNARY_POSITIVE`

  Implements `TOS = +TOS`.

`UNARY_NEGATIVE`

  Implements `TOS = -TOS`.

`UNARY_NOT`

  Implements `TOS = not TOS`.

`UNARY_INVERT`

  Implements `TOS = ~TOS`.

`GET_ITER`

  Implements `TOS = iter(TOS)`.

Binary operations

Binary operations remove the top of the stack (TOS) and the second top-most stack item (TOS1) from the stack. They perform the operation, and put the result back on the stack.

`BINARY_POWER`

  Implements `TOS = TOS1 ** TOS`.

`BINARY_MULTIPLY`

  Implements `TOS = TOS1 * TOS`.

`BINARY_FLOOR_DIVIDE`

  Implements `TOS = TOS1 // TOS`.

`BINARY_TRUE_DIVIDE`

  Implements `TOS = TOS1 / TOS`.

`BINARY_MODULO`

  Implements `TOS = TOS1 % TOS`.

`BINARY_ADD`

  Implements `TOS = TOS1 + TOS`.

`BINARY_SUBTRACT`

  Implements `TOS = TOS1 - TOS`.

`BINARY_SUBSCR`

  Implements `TOS = TOS1[TOS]`.

`BINARY_LSHIFT`

  Implements `TOS = TOS1 << TOS`.

`BINARY_RSHIFT`

  Implements `TOS = TOS1 >> TOS`.

`BINARY_AND`

  Implements `TOS = TOS1 & TOS`.

`BINARY_XOR`

  Implements `TOS = TOS1 ^ TOS`.

`BINARY_OR`

  Implements `TOS = TOS1 | TOS`.

In-place operations

In-place operations are like binary operations, in that they remove TOS and TOS1, and push the result back on the stack, but the operation is done in-place when TOS1 supports it, and the resulting TOS may be (but does not have to be) the original TOS1.

`INPLACE_POWER`

  Implements in-place `TOS = TOS1 ** TOS`.

`INPLACE_MULTIPLY`

  Implements in-place `TOS = TOS1 * TOS`.

`INPLACE_FLOOR_DIVIDE`

  Implements in-place `TOS = TOS1 // TOS`.

`INPLACE_TRUE_DIVIDE`

  Implements in-place `TOS = TOS1 / TOS`.

`INPLACE_MODULO`

  Implements in-place `TOS = TOS1 % TOS`.

`INPLACE_ADD`

  Implements in-place `TOS = TOS1 + TOS`.

`INPLACE_SUBTRACT`

  Implements in-place `TOS = TOS1 - TOS`.

`INPLACE_LSHIFT`

  Implements in-place `TOS = TOS1 << TOS`.

`INPLACE_RSHIFT`

  Implements in-place `TOS = TOS1 >> TOS`.

`INPLACE_AND`

  Implements in-place `TOS = TOS1 & TOS`.

`INPLACE_XOR`

  Implements in-place `TOS = TOS1 ^ TOS`.

`INPLACE_OR`

  Implements in-place `TOS = TOS1 | TOS`.

`STORE_SUBSCR`

  Implements `TOS1[TOS] = TOS2`.

`DELETE_SUBSCR`

  Implements `del TOS1[TOS]`.

Miscellaneous opcodes

`PRINT_EXPR`

  Implements the expression statement for the interactive mode. TOS is removed from the stack and printed. In non-interactive mode, an expression statement is terminated with `POP_STACK`.

`BREAK_LOOP`

  Terminates a loop due to a `break` statement.

`CONTINUE_LOOP`(target)

  Continues a loop due to a `continue` statement. target is the address to jump to (which should be a `FOR_ITER` instruction).

`SET_ADD`(i)

  Calls `set.add(TOS1[-i], TOS)`. Used to implement set comprehensions.

`LIST_APPEND`(i)

  Calls `list.append(TOS[-i], TOS)`. Used to implement list comprehensions.

`MAP_ADD`(i)

  Calls `dict.setitem(TOS1[-i], TOS, TOS1)`. Used to implement dict comprehensions.

For all of the SET_ADD, LIST_APPEND and MAP_ADD instructions, while the added value or key/value pair is popped off, the container object remains on the stack so that it is available for further iterations of the loop.

`RETURN_VALUE`

  Returns with TOS to the caller of the function.

`YIELD_VALUE`

  Pops `TOS` and yields it from a generator.

`YIELD_FROM`

  Pops `TOS` and delegates to it as a subiterator from a generator.

  New in version 3.3.

`IMPORT_STAR`

  Loads all symbols not starting with `'_'` directly from the module TOS to the local namespace. The module is popped after loading all names. This opcode implements `from module import *`.

`POP_BLOCK`

  Removes one block from the block stack. Per frame, there is a stack of blocks, denoting nested loops, try statements, and such.

`POP_EXCEPT`

  Removes one block from the block stack. The popped block must be an exception handler block, as implicitly created when entering an except handler. In addition to popping extraneous values from the frame stack, the last three popped values are used to restore the exception state.

`END_FINALLY`

  Terminates a `finally` clause. The interpreter recalls whether the exception has to be re-raised, or whether the function returns, and continues with the outer-next block.

`LOAD_BUILD_CLASS`

  Pushes `builtins.__build_class__()` onto the stack. It is later called by `CALL_FUNCTION` to construct a class.

`SETUP_WITH`(delta)

  This opcode performs several operations before a with block starts. First, it loads `__exit__()` from the context manager and pushes it onto the stack for later use by `WITH_CLEANUP`. Then, `__enter__()` is called, and a finally block pointing to delta is pushed. Finally, the result of calling the enter method is pushed onto the stack. The next opcode will either ignore it (`POP_TOP`), or store it in (a) variable(s) (`STORE_FAST`, `STORE_NAME`, or `UNPACK_SEQUENCE`).

`WITH_CLEANUP`

  Cleans up the stack when a `with` statement block exits. TOS is the context manager’s `__exit__()` bound method. Below TOS are 1–3 values indicating how/why the finally clause was entered:

  - SECOND = `None`
  - (SECOND, THIRD) = (`WHY_{RETURN,CONTINUE}`), retval
  - SECOND = `WHY_*`; no retval below it
  - (SECOND, THIRD, FOURTH) = exc_info()

  In the last case, `TOS(SECOND, THIRD, FOURTH)` is called, otherwise `TOS(None, None, None)`. In addition, TOS is removed from the stack.

  If the stack represents an exception, and the function call returns a ‘true’ value, this information is “zapped” and replaced with a single `WHY_SILENCED` to prevent `END_FINALLY` from re-raising the exception. (But non-local gotos will still be resumed.)

`STORE_LOCALS`

  Pops TOS from the stack and stores it as the current frame’s `f_locals`. This is used in class construction.

All of the following opcodes expect arguments. An argument is two bytes, with the more significant byte last.

`STORE_NAME`(namei)

  Implements `name = TOS`. namei is the index of name in the attribute `co_names` of the code object. The compiler tries to use `STORE_FAST` or `STORE_GLOBAL` if possible.

`DELETE_NAME`(namei)

  Implements `del name`, where namei is the index into `co_names` attribute of the code object.

`UNPACK_SEQUENCE`(count)

  Unpacks TOS into count individual values, which are put onto the stack right-to-left.

`UNPACK_EX`(counts)

  Implements assignment with a starred target: Unpacks an iterable in TOS into individual values, where the total number of values can be smaller than the number of items in the iterable: one the new values will be a list of all leftover items.

  The low byte of counts is the number of values before the list value, the high byte of counts the number of values after it. The resulting values are put onto the stack right-to-left.

`STORE_ATTR`(namei)

  Implements `TOS.name = TOS1`, where namei is the index of name in `co_names`.

`DELETE_ATTR`(namei)

  Implements `del TOS.name`, using namei as index into `co_names`.

`STORE_GLOBAL`(namei)

  Works as `STORE_NAME`, but stores the name as a global.

`DELETE_GLOBAL`(namei)

  Works as `DELETE_NAME`, but deletes a global name.

`LOAD_CONST`(consti)

  Pushes `co_consts[consti]` onto the stack.

`LOAD_NAME`(namei)

  Pushes the value associated with `co_names[namei]` onto the stack.

`BUILD_TUPLE`(count)

  Creates a tuple consuming count items from the stack, and pushes the resulting tuple onto the stack.

`BUILD_LIST`(count)

  Works as `BUILD_TUPLE`, but creates a list.

`BUILD_SET`(count)

  Works as `BUILD_TUPLE`, but creates a set.

`BUILD_MAP`(count)

  Pushes a new dictionary object onto the stack. The dictionary is pre-sized to hold count entries.

`LOAD_ATTR`(namei)

  Replaces TOS with `getattr(TOS, co_names[namei])`.

`COMPARE_OP`(opname)

  Performs a Boolean operation. The operation name can be found in `cmp_op[opname]`.

`IMPORT_NAME`(namei)

  Imports the module `co_names[namei]`. TOS and TOS1 are popped and provide the fromlist and level arguments of `__import__()`. The module object is pushed onto the stack. The current namespace is not affected: for a proper import statement, a subsequent `STORE_FAST` instruction modifies the namespace.

`IMPORT_FROM`(namei)

  Loads the attribute `co_names[namei]` from the module found in TOS. The resulting object is pushed onto the stack, to be subsequently stored by a `STORE_FAST` instruction.

`JUMP_FORWARD`(delta)

  Increments bytecode counter by delta.

`POP_JUMP_IF_TRUE`(target)

  If TOS is true, sets the bytecode counter to target. TOS is popped.

`POP_JUMP_IF_FALSE`(target)

  If TOS is false, sets the bytecode counter to target. TOS is popped.

`JUMP_IF_TRUE_OR_POP`(target)

  If TOS is true, sets the bytecode counter to target and leaves TOS on the stack. Otherwise (TOS is false), TOS is popped.

`JUMP_IF_FALSE_OR_POP`(target)

  If TOS is false, sets the bytecode counter to target and leaves TOS on the stack. Otherwise (TOS is true), TOS is popped.

`JUMP_ABSOLUTE`(target)

  Set bytecode counter to target.

`FOR_ITER`(delta)

  `TOS` is an iterator. Call its `__next__()` method. If this yields a new value, push it on the stack (leaving the iterator below it). If the iterator indicates it is exhausted `TOS` is popped, and the byte code counter is incremented by delta.

`LOAD_GLOBAL`(namei)

  Loads the global named `co_names[namei]` onto the stack.

`SETUP_LOOP`(delta)

  Pushes a block for a loop onto the block stack. The block spans from the current instruction with a size of delta bytes.

`SETUP_EXCEPT`(delta)

  Pushes a try block from a try-except clause onto the block stack. delta points to the first except block.

`SETUP_FINALLY`(delta)

  Pushes a try block from a try-except clause onto the block stack. delta points to the finally block.

`STORE_MAP`

  Store a key and value pair in a dictionary. Pops the key and value while leaving the dictionary on the stack.

`LOAD_FAST`(var_num)

  Pushes a reference to the local `co_varnames[var_num]` onto the stack.

`STORE_FAST`(var_num)

  Stores TOS into the local `co_varnames[var_num]`.

`DELETE_FAST`(var_num)

  Deletes local `co_varnames[var_num]`.

`LOAD_CLOSURE`(i)

  Pushes a reference to the cell contained in slot i of the cell and free variable storage. The name of the variable is `co_cellvars[i]` if i is less than the length of co_cellvars. Otherwise it is `co_freevars[i - len(co_cellvars)]`.

`LOAD_DEREF`(i)

  Loads the cell contained in slot i of the cell and free variable storage. Pushes a reference to the object the cell contains on the stack.

`STORE_DEREF`(i)

  Stores TOS into the cell contained in slot i of the cell and free variable storage.

`DELETE_DEREF`(i)

  Empties the cell contained in slot i of the cell and free variable storage. Used by the `del` statement.

`RAISE_VARARGS`(argc)

  Raises an exception. argc indicates the number of parameters to the raise statement, ranging from 0 to 3. The handler will find the traceback as TOS2, the parameter as TOS1, and the exception as TOS.

`CALL_FUNCTION`(argc)

  Calls a function. The low byte of argc indicates the number of positional parameters, the high byte the number of keyword parameters. On the stack, the opcode finds the keyword parameters first. For each keyword argument, the value is on top of the key. Below the keyword parameters, the positional parameters are on the stack, with the right-most parameter on top. Below the parameters, the function object to call is on the stack. Pops all function arguments, and the function itself off the stack, and pushes the return value.

`MAKE_FUNCTION`(argc)

  Pushes a new function object on the stack. From bottom to top, the consumed stack must consist of

  - `argc & 0xFF` default argument objects in positional order
  - `(argc >> 8) & 0xFF` pairs of name and default argument, with the name just below the object on the stack, for keyword-only parameters
  - `(argc >> 16) & 0x7FFF` parameter annotation objects
  - a tuple listing the parameter names for the annotations (only if there are ony annotation objects)
  - the code associated with the function (at TOS1)
  - the qualified name of the function (at TOS)

`MAKE_CLOSURE`(argc)

  Creates a new function object, sets its __closure__ slot, and pushes it on the stack. TOS is the qualified name of the function, TOS1 is the code associated with the function, and TOS2 is the tuple containing cells for the closure’s free variables. The function also has argc default parameters, which are found below the cells.

`BUILD_SLICE`(argc)

  Pushes a slice object on the stack. argc must be 2 or 3. If it is 2, `slice(TOS1, TOS)` is pushed; if it is 3, `slice(TOS2, TOS1, TOS)` is pushed. See the `slice()` built-in function for more information.

`EXTENDED_ARG`(ext)

  Prefixes any opcode which has an argument too big to fit into the default two bytes. ext holds two additional bytes which, taken together with the subsequent opcode’s argument, comprise a four-byte argument, ext being the two most-significant bytes.

`CALL_FUNCTION_VAR`(argc)

  Calls a function. argc is interpreted as in `CALL_FUNCTION`. The top element on the stack contains the variable argument list, followed by keyword and positional arguments.

`CALL_FUNCTION_KW`(argc)

  Calls a function. argc is interpreted as in `CALL_FUNCTION`. The top element on the stack contains the keyword arguments dictionary, followed by explicit keyword and positional arguments.

`CALL_FUNCTION_VAR_KW`(argc)

  Calls a function. argc is interpreted as in `CALL_FUNCTION`. The top element on the stack contains the keyword arguments dictionary, followed by the variable-arguments tuple, followed by explicit keyword and positional arguments.

`HAVE_ARGUMENT`

  This is not really an opcode. It identifies the dividing line between opcodes which don’t take arguments `< HAVE_ARGUMENT` and those which do `>= HAVE_ARGUMENT`.

### Navigation

- index
- modules |
- next |
- previous |
- Python »
- 3.3.4 Documentation »
- The Python Standard Library »
- 31. Python Language Services »