@@ -264,20 +264,14 @@ def test_load_npy_cpp(self) -> None:
264264def _reuse_freed_memory (size : int , count : int = 2000 ) -> list [bytearray ]:
265265 """Fill recently freed memory with a recognizable pattern.
266266
267- This relies on an implementation detail of CPython: memory released by a
268- deallocated object is returned to the allocator, which hands it back out to
269- later allocations of a similar size. So allocating many `size`-byte buffers
270- right after the archive was freed is likely to land one of them on the
271- block the archive used to occupy. `count` repetitions raise that chance.
272-
273- The buffers are filled with `0xAB` so that a stale pointer into the freed
274- block reads this pattern instead of the original data, and the subsequent
275- `assert_array_equal` fails. Without it, a use-after-free would most likely
276- still read the original bytes and the test would pass.
277-
278- This is best-effort: it makes a regression *likely* to be caught, never
279- guaranteed. The deterministic guarantee comes from the refcount assertions
280- in `TestNpzBufferLifetime`.
267+ CPython hands memory from deallocated objects back out to later
268+ allocations of a similar size, so `count` buffers of `size` bytes are
269+ likely to land on the block the archive just freed. A stale pointer into
270+ it then reads `0xAB` and the caller's `assert_array_equal` fails; without
271+ this, it would likely read the original bytes and pass.
272+
273+ Best-effort by nature -- the refcount assertions below are the
274+ deterministic check.
281275 """
282276 return [bytearray (b"\xab " * size ) for _ in range (count )]
283277
0 commit comments