GH-91153: Fixup comments and NEWS entry

bast0006 · picnixz · web-flow · commit 18e6597b9eac · 2025-06-02T23:44:52.000-07:00
Co-authored-by: Bénédikt Tran &lt;10796600+picnixz@users.noreply.github.com&gt;
diff --git a/Lib/test/test_bytes.py b/Lib/test/test_bytes.py
@@ -1893,21 +1893,14 @@ def test_mutating_index_inbounds(self):
         # See gh-91153
 
         class MutatesOnIndex:
-            new_ba: bytearray
 
             def __init__(self):
                 self.ba = bytearray(0x180)
 
             def __index__(self):
-                # Clear the original bytearray, mutating it during index assignment.
-                # If the internal buffers are held over this operation, they become dangling
-                # However, this will fail a bounds check as above (as the clear sets bounds to zero)
                 self.ba.clear()
-                # At this moment, the bytearray potentially has a dangling pointer
-                # Create a new bytearray to catch any writes
-                self.new_ba = bytearray(0x180)
-                # Ensure bounds check passes
-                self.ba.extend([0] * 0x180)
+                self.new_ba = bytearray(0x180)  # to catch out-of-bounds writes
+                self.ba.extend([0] * 0x180)     # to check bounds checks
                 return 0
 
         with self.subTest("skip_bounds_safety"):
diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2025-05-17-20-56-05.gh-issue-91153.afgtG2.rst b/Misc/NEWS.d/next/Core_and_Builtins/2025-05-17-20-56-05.gh-issue-91153.afgtG2.rst
@@ -1,3 +1 @@
-Fix an issue where a :class:`bytearray` item assignment could crash or write
-to the wrong bytearray when resized by the new value's
-:meth:`~object.__index__` method.
+Fix a crash when a :class:`bytearray` is concurrently mutated during item assignment.
diff --git a/Objects/bytearrayobject.c b/Objects/bytearrayobject.c
@@ -709,8 +709,9 @@ bytearray_ass_subscript_lock_held(PyObject *op, PyObject *index, PyObject *value
     _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(op);
     PyByteArrayObject *self = _PyByteArray_CAST(op);
     Py_ssize_t start, stop, step, slicelen;
-    // GH-91153: we cannot store a reference to the internal buffer here, as _getbytevalue might call into python code
-    // that could then invalidate it.
+    // Do not store a reference to the internal buffer since
+    // index.__index__() or _getbytevalue() may alter 'self'.
+    // See https://github.com/python/cpython/issues/91153.
 
     if (_PyIndex_Check(index)) {
         Py_ssize_t i = PyNumber_AsSsize_t(index, PyExc_IndexError);
