gh-142663: resolving comments by refactoring unit tests and cache type check result

Author: superboy-zjc

Lib/test/test_memoryview.py

@@ -228,66 +228,31 @@ def test_compare(self):
                 self.assertRaises(TypeError, lambda: m >= c)
                 self.assertRaises(TypeError, lambda: c > m)
 
-    def test_compare_use_after_free(self):
-        # Prevent crash in comparisons of memoryview objs with re-entrant struct.unpack_from.
+    def test_compare_1d_concurrent_mutation(self):
+        # Prevent crashes during a mixed format 1-D comparison loop.
         # Regression test for https://github.com/python/cpython/issues/142663.
+        src1 = array.array("d", [1.0, 2.0])
+        src2 = array.array("l", [1, 2])
+        mv1, mv2 = memoryview(src1), memoryview(src2)
+        self.do_test_compare_concurrent_mutation(src1, mv1, mv2)
 
-        class ST(struct.Struct):
-            # Context set by the subtests
-            view = None
-            source = None
-
+    def test_compare_2d_concurrent_mutation(self):
+        # Prevent crashes during a mixed format 2-D comparison loop.
+        # Regression test for https://github.com/python/cpython/issues/142663.
+        src1 = array.array("d", [1.0, 2.0])
+        src2 = array.array("l", [1, 2])
+        mv1 = memoryview(src1).cast("B").cast("d", shape=(1, 2))
+        mv2 = memoryview(src2).cast("B").cast("l", shape=(1, 2))
+        self.do_test_compare_concurrent_mutation(src1, mv1, mv2)
+
+    def do_test_compare_concurrent_mutation(self, src1, mv1, mv2):
+        class S(struct.Struct):
             def unpack_from(self, buf, /, offset=0):
-                # Attempt to release the buffer while it's being used in comparison loop.
-                if self.view is not None:
-                    self.view.release()
-
-                # array resize invalidates the buffer pointer used by the comparison loop.
-                if self.source is not None:
-                    self.source.append(3.14)
-
+                mv1.release()
+                src1.append(3.14)
                 return (1,)
-
-        with support.swap_attr(struct, "Struct", ST):
-            # Case 1: 1-D comparison (uses cmp_base optimized loop)
-            # Use mixed types ('d' vs 'l') to force struct unpacking path.
-            with self.subTest(ndim=1):
-                a = array.array("d", [1.0, 2.0])
-                b = array.array("l", [1, 2])
-                mv_a = memoryview(a)
-                mv_b = memoryview(b)
-
-                ST.view = mv_a
-                ST.source = a
-                try:
-                    with self.assertRaises(BufferError):
-                        # Expect BufferError because the memoryview is locked during comparison
-                        mv_a == mv_b
-                finally:
-                    ST.view = None
-                    ST.source = None
-                    mv_a.release()
-                    mv_b.release()
-
-            # Case 2: N-D comparison (uses cmp_rec recursive function)
-            # Use mixed types ('d' vs 'l') to force struct unpacking path.
-            with self.subTest(ndim=2):
-                a = array.array("d", [1.0, 2.0])
-                b = array.array("l", [1, 2])
-                mv_a = memoryview(a).cast("B").cast("d", shape=(1, 2))
-                mv_b = memoryview(b).cast("B").cast("l", shape=(1, 2))
-
-                ST.view = mv_a
-                ST.source = a
-                try:
-                    with self.assertRaises(BufferError):
-                        # Expect BufferError because the memoryview is locked during comparison
-                        mv_a == mv_b
-                finally:
-                    ST.view = None
-                    ST.source = None
-                    mv_a.release()
-                    mv_b.release()
+        with support.swap_attr(struct, "Struct", S):
+            self.assertRaises(BufferError, mv1.__eq__, mv2)
 
     def check_attributes_with_type(self, tp):
         m = self._view(tp(self._source))

Misc/NEWS.d/next/Library/2025-12-30-22-12-27.gh-issue-142663.gq7iIf.rst

@@ -1,3 +1,2 @@
-:class:`memoryview`: Fix a use-after-free crash during comparison when an
-overridden :meth:`struct.Struct.unpack_from` releases and resizes the
-underlying buffer.
+Fix use-after-free crashes when a :class:`memoryview` is mutated
+during a comparison with another object.

Objects/memoryobject.c

@@ -3122,7 +3122,8 @@ memory_richcompare(PyObject *v, PyObject *w, int op)
     }
     vv = VIEW_ADDR(v);
 
-    if (PyMemoryView_Check(w)) {
+    int w_is_mv = PyMemoryView_Check(w);
+    if (w_is_mv) {
         if (BASE_INACCESSIBLE(w)) {
             equal = (v == w);
             goto result;
@@ -3169,7 +3170,7 @@ memory_richcompare(PyObject *v, PyObject *w, int op)
        reshaped during a mixed format comparison loop. */
     // See https://github.com/python/cpython/issues/142663.
     ((PyMemoryViewObject *)v)->exports++;
-    if (PyMemoryView_Check(w)) {
+    if (w_is_mv) {
         ((PyMemoryViewObject *)w)->exports++;
     }
 
@@ -3191,7 +3192,7 @@ memory_richcompare(PyObject *v, PyObject *w, int op)
     }
 
     ((PyMemoryViewObject *)v)->exports--;
-    if (PyMemoryView_Check(w)) {
+    if (w_is_mv) {
         ((PyMemoryViewObject *)w)->exports--;
     }