gh-150587: Harden BINARY_OP_SUBSCR_LIST_INT/STORE_SUBSCR_LIST_INT against non-compact int subscripts

Lib/test/test_opcache.py

@@ -2039,6 +2039,36 @@ def __setitem__(self, key, value):
         store_subscr_dict_subclass_override()
         self.assert_no_opcode(store_subscr_dict_subclass_override, "STORE_SUBSCR_DICT")
 
+    @cpython_only
+    @requires_specialization
+    def test_binary_subscr_list_int_wide_int(self):
+        def load(lst, idx):
+            return lst[idx]
+
+        lst = [1, 2, 3]
+        for _ in range(_testinternalcapi.SPECIALIZATION_THRESHOLD):
+            load(lst, 0)
+        self.assert_specialized(load, "BINARY_OP_SUBSCR_LIST_INT")
+        # 2**30+2 is non-compact; ob_digit[0]=2 so _PyLong_CompactValue
+        # would silently return 2 and read lst[2] instead of raising IndexError.
+        with self.assertRaises(IndexError):
+            load(lst, 2**30 + 2)
+
+    @cpython_only
+    @requires_specialization
+    def test_store_subscr_list_int_wide_int(self):
+        def store(lst, idx):
+            lst[idx] = 99
+
+        lst = [1, 2, 3]
+        for _ in range(_testinternalcapi.SPECIALIZATION_THRESHOLD):
+            store(lst, 0)
+        self.assert_specialized(store, "STORE_SUBSCR_LIST_INT")
+        # 2**30+2 is non-compact; ob_digit[0]=2 so _PyLong_CompactValue
+        # would silently write to lst[2] instead of raising IndexError.
+        with self.assertRaises(IndexError):
+            store(lst, 2**30 + 2)
+
     @cpython_only
     @requires_specialization
     def test_compare_op(self):

Misc/NEWS.d/next/Core_and_Builtins/2026-05-29-00-00-00.gh-issue-150587.xK3mPq.rst

@@ -0,0 +1,4 @@
+``BINARY_OP_SUBSCR_LIST_INT`` and ``STORE_SUBSCR_LIST_INT`` now verify that
+the subscript is a compact non-negative int before calling the compact-only
+internal helper, rather than relying solely on the shared ``_GUARD_TOS_INT``
+guard to enforce that invariant.

Python/bytecodes.c

@@ -1141,6 +1141,7 @@ dummy_func(
 
             assert(PyLong_CheckExact(sub));
             assert(PyList_CheckExact(list));
+            EXIT_IF(!_PyLong_IsNonNegativeCompact((PyLongObject *)sub));
 
             Py_ssize_t index = _PyLong_CompactValue((PyLongObject *)sub);
             if (index < 0) {
@@ -1419,6 +1420,7 @@ dummy_func(
 
             assert(PyLong_CheckExact(sub));
             assert(PyList_CheckExact(list));
+            DEOPT_IF(!_PyLong_IsNonNegativeCompact((PyLongObject *)sub));
 
             Py_ssize_t index = _PyLong_CompactValue((PyLongObject *)sub);
             DEOPT_IF(!LOCK_OBJECT(list));