Address review comment

Author: gf712

integration/tests/buffered_writer.py

@@ -137,4 +137,24 @@ def write(self, b):
     except ValueError:
         pass
 
+# 12. the oversized path calls back into Python once per chunk; a raw whose
+#     write() reallocates the source object's storage must not leave the write
+#     loop walking freed memory
+ba = bytearray(b"A" * 100)
+chunks = []
+
+
+class MutatingWriter:
+    def write(self, b):
+        # reallocates ba's backing storage mid-write
+        ba[0:1] = b"B" * 200000
+        chunks.append(1)
+        return 1
+
+
+w = _io.BufferedWriter(MutatingWriter(), 8)
+assert w.write(ba) == 100
+# 100 bytes, one accepted per call, until the 8 byte tail is buffered instead
+assert len(chunks) == 92, len(chunks)
+
 print("buffered_writer: ok")

src/runtime/modules/IOModule.cpp

@@ -1498,14 +1498,20 @@ class BufferedWriter
 			return PyInteger::create(len);
 		}
 
+		// everything below re-enters Python (flush() and raw_write() both end up calling
+		// raw.write()), which can run arbitrary code that reallocates the source object's
+		// storage - e.g. a raw whose write() resizes the very bytearray being written. Take a
+		// snapshot now so `start` cannot dangle mid-write.
+		const std::vector<char> payload{ start, start + len };
+
 		// the data does not fit: drain our buffer to raw first
 		if (auto r = flush(); r.is_err()) { return r; }
 
 		// write oversized data directly to raw, bypassing the buffer
 		size_t written = 0;
 		size_t remaining = len;
 		while (remaining > m_buffer_size) {
-			auto r = raw_write(start + written, remaining);
+			auto r = raw_write(payload.data() + written, remaining);
 			if (r.is_err()) { return r; }
 			if (r.unwrap() == py_none()) {
 				// TODO: raise BlockingIOError
@@ -1535,7 +1541,7 @@ class BufferedWriter
 
 		// buffer the tail, which is now guaranteed to fit
 		if (remaining > 0) {
-			const auto count = this->buffer->sputn(start + written, remaining);
+			const auto count = this->buffer->sputn(payload.data() + written, remaining);
 			ASSERT(static_cast<size_t>(count) == remaining);
 			m_buffered_bytes += remaining;
 			written += remaining;