I would probably say that releasing the code is better than not.
In all likelihood the reviewer won't look at the code even if you include it, they may in-fact give you a little tick for including it even if they don't look at it since it would help with the reproducibility of your results by other people who do bother to look at it.
If they do look at it and don't like it there will be one of three outcomes:
- They request more comments in the code
- They say your code is not incorrect but it should be re-written for efficiency or style
- They find a mistake in your code
I have ignored the case of them only running your code and not looking through it since it shouldn't give a different result when they run it compared to when you run it.
1) If they request more comments, fair's fair. Comments are important for readability, and in-fact you should make sure there are enough comments there now to make sure you'll quickly remember what you were trying to do with the code when you look at it in a few months time.
2) If they say you should improve the efficiency or style of your code then in all likelihood you can argue to the editor that only the code's results are relevant for the peer review, not the code style for your field. After that the editor will just ignore any similar comments from said reviewer. The exception is if they complain about your choice of variable/function names, which really falls more under 1) rather than 2). However if that happens then all that is involved is ctrl+f to find the bad variable names and give them a better, more explanatory, one.
3) The worst case scenario is they find a mistake in your code, in which case you can correct and check if/how this changes your results and modify your paper accordingly. The people who do this would probably include any reviewers who might try to reproduce your results on their own if they didn't have the code. In which case they may make different assumptions to you and therefore get different results which leads to a headache arguing over who's code is correct. Since they have your code you can now challenge them to point out the mistake if they just say your results don't match with my results.
Now it is possible that you will find nothing of interest after making this correction which makes it seem like all your work in the project was for nothing, but its important to remember you would have done all this work and written/verified your code before reaching this point, so in fact all you've lost is the time taken to write the paper, which while not good is still a learning experience for you so the next paper you write is done quicker/better. Furthermore it means you don't have a paper that is incorrect and leading to confusion when people try to replicate/extend the research that is tied to your name.
While this case sounds very bad it will only occur if your code is wrong. If you are confident in your code then its fairly safe to exclude this case, if you aren't confident in your code then you should check it until you are.
One last thing that you should keep in mind is that if you release your code you will want to provide a license with your code without the license nobody has a legal right to use it/extend it/write code based off reading your code. Or at the very least this falls into a gray area. Normally scientific code is released with a very open license (I think MIT license is the standard) but you can google to find out what types of licenses there are.