Share ctypes array-field storage with its owner - #9186

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

⚙️ Run configuration

• Configuration used: Repository: RustPython/RustPython/.coderabbit.yml
• Review profile: CHILL
• Plan: Advanced
• Run ID: e97df5df-c811-4bbd-934b-627297a3a2cd

📥 Commits

Reviewing files that changed from the base of the PR and between a58a435 and dd03339.

📒 Files selected for processing: 5

• crates/vm/src/builtins/memory.rs
• crates/vm/src/stdlib/_ctypes.rs
• crates/vm/src/stdlib/_ctypes/base.rs
• crates/vm/src/stdlib/mod.rs
• extra_tests/snippets/stdlib_ctypes.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

ctypes array fields now use borrowed views into their containing buffer. Mutable access preserves borrowed storage, and equal-size resize returns without replacing the buffer. Memoryview slice assignment snapshots the source when exporter identity is unavailable or matches.

Changes: ctypes Buffer Views

Layer / File(s)	Summary
Borrowed array views and resize handling crates/vm/src/stdlib/_ctypes/base.rs, crates/vm/src/stdlib/_ctypes.rs, extra_tests/snippets/stdlib_ctypes.py	Array fields use borrowed views into the containing buffer, and mutable access no longer copies borrowed storage. The safety documentation describes storage validity and aliasing conditions. Equal-size resize returns without replacing the buffer. Tests check shared mutations, owner retention, and access after resizing.
Alias-safe memoryview assignment crates/vm/src/stdlib/_ctypes.rs, crates/vm/src/stdlib/mod.rs, crates/vm/src/builtins/memory.rs, extra_tests/snippets/stdlib_ctypes.py	A helper identifies borrowed ctypes buffers. root_exporter returns no identity for those buffers. Slice assignment snapshots the source when either exporter identity is unavailable or both identities match. Tests cover overlapping fields, bytearray-backed views, and raw-address views.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: youknowone

Resizing an owner while an array-field view remains in use can leave that view pointing to invalid memory. Resolve or explicitly accept this risk before merging.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: sharing ctypes array-field storage with its owning object.

🧪 Generate unit tests (beta)

• Create a new PR

• X
• Mastodon
• Reddit
• LinkedIn

🏁 Script executed:

#!/bin/bash
set -euo pipefail
ast-grep outline crates/vm/src/builtins/memory.rs --match 'root_exporter' --view expanded
ast-grep outline crates/vm/src/stdlib/mod.rs --match 'ctypes_buffer_base' --view expanded
ast-grep outline extra_tests/snippets/stdlib_ctypes.py
rg -n -C 14 'fn root_exporter|root_exporter\(|source_snapshot|snapshot|same_exporter' crates/vm/src/builtins/memory.rs
rg -n -C 14 'fn ctypes_buffer_base' crates/vm/src/stdlib/mod.rs
rg -n -C 18 'Union|overlap|\[::2\]|\[1::2\]' extra_tests/snippets/stdlib_ctypes.py

Length of output: 8684

Learnt from: 1ndahous3
URL: https://github.com/RustPython/RustPython/pull/9186

Timestamp: 2026-10-18T10:14:48.996Z
Learning: In RustPython PR #9186, crates/vm/src/builtins/memory.rs::root_exporter follows ctypes base objects through crates/vm/src/stdlib/mod.rs::ctypes_buffer_base. Memoryview assignments between ctypes fields sharing an owner therefore use the existing contiguous source snapshot before writable buffer access. extra_tests/snippets/stdlib_ctypes.py covers overlapping union fields with strided assignment. This addresses the assignment-specific overlap path, not the broader storage-lifetime or external-alias concerns.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

🏁 Script executed:

#!/bin/bash
set -euo pipefail
ast-grep outline crates/vm/src/builtins/memory.rs --match 'root_exporter|assign' --view expanded
ast-grep outline crates/vm/src/stdlib/_ctypes.rs --match 'is_borrowed_buffer' --view expanded
ast-grep outline crates/vm/src/stdlib/mod.rs --match 'is_borrowed_ctypes_buffer' --view expanded
ast-grep outline extra_tests/snippets/stdlib_ctypes.py
rg -n -C 22 'root_exporter|buffer_source|source_snapshot' crates/vm/src/builtins/memory.rs
rg -n -C 10 'fn is_borrowed_buffer' crates/vm/src/stdlib/_ctypes.rs
rg -n -C 14 'fn is_borrowed_ctypes_buffer' crates/vm/src/stdlib/mod.rs
rg -n -C 18 'OverlappingFields|memoryview_at|from_address|pointer\(|buffer_backed|_objects.clear' extra_tests/snippets/stdlib_ctypes.py

Length of output: 11701

Learnt from: 1ndahous3
URL: https://github.com/RustPython/RustPython/pull/9186

Timestamp: 2026-10-18T11:30:38.270Z
Learning: In RustPython PR #9186, crates/vm/src/builtins/memory.rs::root_exporter now returns None for borrowed ctypes storage rather than following its base chain. crates/vm/src/stdlib/_ctypes.rs::is_borrowed_buffer identifies borrowed PyCData and RawMemoryBuffer objects. If either memoryview assignment operand has unknown exporter identity, assignment snapshots the source before writable access. Known shared exporters also trigger a snapshot; distinct known exporters retain direct copying. extra_tests/snippets/stdlib_ctypes.py covers from_address aliases in both operand directions, conditional memoryview_at aliases, and from_buffer storage with cleared _objects metadata. This supersedes the earlier base-chain description and addresses assignment overlap only, not resize/lifetime or concurrent foreign-access safety.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

Learnt from: 1ndahous3
URL: https://github.com/RustPython/RustPython/pull/9186

Timestamp: 2026-10-18T10:14:49.116Z
Learning: In RustPython PR #9186, crates/vm/src/builtins/memory.rs::root_exporter follows ctypes base objects through crates/vm/src/stdlib/mod.rs::ctypes_buffer_base. Memoryview assignments between ctypes fields sharing an owner therefore use the existing contiguous source snapshot before writable buffer access. extra_tests/snippets/stdlib_ctypes.py covers overlapping union fields with strided assignment. This addresses the assignment-specific overlap path, not the broader storage-lifetime or external-alias concerns.

Learnt from: 1ndahous3
Repo: RustPython/RustPython PR: 9186
File: crates/vm/src/stdlib/_ctypes/base.rs:1048-1057
Timestamp: 2026-10-18T09:29:14.644Z
Learning: In RustPython's crates/vm/src/stdlib/_ctypes/base.rs, non-character ctypes array fields must share the containing object's storage so addressof(), FFI calls, and buffer writes access the owner’s memory. Restoring owned field copies breaks this requirement. Retaining the owner does not pin its allocation, and locks on separate views do not synchronize shared storage. CPython compatibility does not establish Rust reference validity; storage-lifetime and aliasing protection require separate analysis.