memoryview: count exports, hash the exporter, and index through __index__ - #8553

Three memoryview tests were marked expectedFailure for "re-entrant buffer release not detected". Chasing them turned up four separate defects underneath, each visible from Python on its own.

All comparisons below are against CPython 3.14.6.

A view kept no count of what it had exported

release() always succeeded, even while something was still reading through an export:

mv = memoryview(bytearray(b'abc'))
w = mv.__buffer__(0)
mv.release()      # CPython: BufferError: memoryview has 1 exported buffer
                  # before:  returns

PyMemoryView now carries the count _memory_release consults, kept by the bf_getbuffer/bf_releasebuffer slots, and __exit__ reports the same refusal.

memory_hash never asked the exporter

A view is no more hashable than what it looks at. memory_hash hashes view->obj and throws the answer away for exactly that reason:

hash(memoryview(bytearray(b'abc')).toreadonly())
# CPython: TypeError: unhashable type: 'bytearray'
# before:  returns a hash

Asking runs Python, so the view counts as exported for the duration and a release attempted from inside that hash is refused rather than obeyed. That is test_hash_use_after_free (gh-142664).

While fixing this it turned out array.array was hashable here despite being mutable, so an array could go into a set and then be changed underneath it. tp_hash = PyObject_HashNotImplemented there; it is unhashable now.

hex(sep) never called sep.__len__

The separator's length came from its bytes rather than from the object, and the check came after the bytes_per_sep == 0 and empty-data shortcuts. Four ways for bytes, bytearray and memoryview alike:

Measuring runs Python, and the bytes to be written out must not be borrowed while it does — bytearray.hex would have called __len__ holding its own lock. The separator is resolved from the arguments before the buffer is reached, which for a memoryview also means the view counts as exported for the duration. That is test_hex_use_after_free (gh-143195).

A tuple key was only taken apart when every item was already an int

c = memoryview(bytes(range(24))).cast('B', shape=(4, 6))
c[I(), 2]        # I has __index__; CPython: 8, before: TypeError: invalid slice key

What kind of key it is now follows from the types in it, the way is_multiindex decides, and each item is converted where it sits. An item that answers __index__ but raises on the way reports that rather than making the whole key invalid. The conversion runs Python and can release the view, so the multi-dimensional read goes through unpack_single and its re-check. That is test_use_released_memory (gh-92888).

IndexError also named the index that was out of bounds where lookup_dimension names the dimension, counted from one:

c = memoryview(bytearray(range(24))).cast('B', shape=(2, 3, 4))
c[0, 0, -5]   # CPython: index out of bounds on dimension 3
              # before:  index out of bounds on dimension -5

and the one-dimensional path had a message of its own (index out of range).

cast() accepted any number of dimensions

memoryview(bytearray(range(8))).cast('B', (1,)*64 + (8,))
# CPython: ValueError: memoryview: number of dimensions must not exceed 64
# before:  a 65-dimensional view

Tests

test_hash_use_after_free, test_hex_use_after_free and test_use_released_memory pass, and their expectedFailure decorators are removed. Six regression tests were added to extra_tests/snippets/builtin_memoryview.py, all of which pass under CPython 3.14.6 as well.

20 suites run clean locally — memoryview, buffer, bytes, struct, array, io, binascii, mmap, hashlib, codecs, zlib, bz2, marshal, socket, ssl, pickle, hmac, collections, set, dict.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P9HewXGX8qcGSccUxGdSPV

Summary by CodeRabbit

• Bug Fixes

  • Improved memoryview handling for exported buffers, hashing, indexing, casting, and context-manager release behavior.
  • Improved bounds and conversion error messages for multidimensional views.
  • Fixed validation of separators used by bytes.hex() and bytearray.hex().
  • Marked array.array objects as unhashable.

• Tests

  • Added regression coverage for memoryview exports, indexing, hashing, casting, bounds errors, and hexadecimal separators.