`bytearray.take_bytes()` can corrupt shared single-byte bytes objects

[StanFromIreland]

Bug report

Bug description:

To reproduce, run:

ba = bytearray(b"abc")
ba.take_bytes(2)
ba[0] = 0x42

print(b'c')

However, this does not print b'c' as you'd expect, instead you get:

$ python3.15 /tmp/repro.py
b'B'

This is becasue take_bytes() builds the leftover buffer with PyBytes_FromStringAndSize, which for one remaining character returns the immortal, process-wide one-character bytes singleton instead of a fresh allocation:

cpython/Objects/bytearrayobject.c

Lines 1622 to 1624 in 14a93f4

	// Copy remaining bytes to a new bytes.
	PyObject *remaining = PyBytes_FromStringAndSize(self->ob_start + to_take,
	remaining_length);

The bytearray then installs that singleton as its mutable ob_bytes_object, so any write to it modifies the shared singleton that every b'c' refers to.

CPython versions tested on:

3.15, CPython main branch

Operating systems tested on:

Linux

Linked PRs

• gh-156995: Fix bytearray.take_bytes() corrupting shared single-byte bytes objects #156996
• [3.15] gh-156995: Fix bytearray.take_bytes() corrupting shared single-byte singletons (GH-156996) #157260
• gh-156995: Add caution around API behavior change #157292
• [3.14] gh-156995: Fix _PyBytes_Resize() in Free Threading (#156996) #157373
• [3.13] gh-156995: Fix _PyBytes_Resize() in Free Threading (#156996) (#157373) #157436
• [3.14] gh-156995: Fix typo in the _PyBytes_Resize() NEWS entry #157477

[encukou]

Marking as a potential release blocker

[cmaloney]

Proposing adding a docs caution for PyUnstable_Object_IsUniquelyReferenced behavior between GIL-enabled and free-threaded builds: #157292