gh-156995: Fix bytearray.take_bytes() corrupting shared single-byte bytes objects - #156996
gh-156995: Fix bytearray.take_bytes() corrupting shared single-byte bytes objects#156996StanFromIreland wants to merge 4 commits into
bytearray.take_bytes() corrupting shared single-byte bytes objects#156996Conversation
There was a problem hiding this comment.
Double checking against implementation this change looks correct.
I think should add an assert as a safety net to help catch this bug into bytearray_reinit_from_bytes which is called every time self->ob_bytes_object is set to re-init.
bytearray_reinit_from_bytes(PyByteArrayObject *self, Py_ssize_t size,
Py_ssize_t alloc)
{
/* Only the empty bytes may be immortal. */
assert((alloc == 0) == _Py_IsImmortal(self->ob_bytes_object));That safety net in free-threaded builds finds an additional case that can happen. _PyBytes_Resize uses _PyObject_IsUniquelyReferenced which under free threading includes that the object is owned by the current thread. If another thread swapped out the underlying bytes the unquiely reference returns false. if it is a downsize that calls PyBytes_FromStringAndSize which passes non-NULL to its first parameter...
Not sure the best way to fix that... I'd lean that _PyBytes_Resize should never return an immutable object for size >= 1 as that can lead to a really subtle only under free-threading bug...
Co-authored-by: Cody Maloney <cmaloney@theoreticalchaos.com>
Co-authored-by: Cody Maloney <cmaloney@users.noreply.github.com>

bytearray.take_bytes()can corrupt shared single-byte bytes objects #156995