Add PyMemoryView::from_owned_buffer for zero-copy memoryview creation

Adds a new method to create a Python memoryview that exposes a read-only
view of byte data owned by a frozen PyClass instance without copying.
This is useful for libraries like pyca/cryptography that need to expose
internal buffers efficiently.

The method uses PyBuffer_FillInfo + PyMemoryView_FromBuffer to create a
memoryview backed by the owner's data, with the owner kept alive via
the buffer's obj reference.

Safety is enforced at compile time:
- T: PyClass<Frozen = True> prevents mutation that could invalidate pointers
- for<'a> FnOnce(&'a T) -> &'a [u8] ensures the slice borrows from T or is 'static

Closes #5871

https://claude.ai/code/session_01EEP1DaqJwHGCoNufi2JT9H

Author: claude

newsfragments/5937.added.md

@@ -0,0 +1 @@
+Added `PyMemoryView::from_owned_buffer` to create a read-only `memoryview` from data owned by a frozen `PyClass` instance without copying.

pytests/src/buf_and_str.rs

@@ -52,6 +52,22 @@ pub mod buf_and_str {
         PyMemoryView::from(&bytes)
     }
 
+    #[pyclass(frozen)]
+    struct OwnedData {
+        data: Vec<u8>,
+    }
+
+    #[pyfunction]
+    fn return_owned_memoryview(py: Python<'_>) -> PyResult<Bound<'_, PyMemoryView>> {
+        let obj = pyo3::Py::new(
+            py,
+            OwnedData {
+                data: b"owned buffer data".to_vec(),
+            },
+        )?;
+        PyMemoryView::from_owned_buffer(py, obj, |d| &d.data)
+    }
+
     #[pyfunction]
     fn map_byte_slice(bytes: &[u8]) -> &[u8] {
         bytes

pytests/tests/test_buf_and_str.py

@@ -1,4 +1,8 @@
-from pyo3_pytests.buf_and_str import BytesExtractor, return_memoryview
+from pyo3_pytests.buf_and_str import (
+    BytesExtractor,
+    return_memoryview,
+    return_owned_memoryview,
+)
 
 
 def test_extract_bytes():
@@ -34,3 +38,20 @@ def test_return_memoryview():
     assert view.readonly
     assert view.contiguous
     assert view.tobytes() == b"hello world"
+
+
+def test_return_owned_memoryview():
+    view = return_owned_memoryview()
+    assert view.readonly
+    assert view.contiguous
+    assert view.tobytes() == b"owned buffer data"
+    assert len(view) == len(b"owned buffer data")
+
+
+def test_owned_memoryview_keeps_data_alive():
+    """Ensure the memoryview keeps the owner alive even after Python-side references are dropped."""
+    view = return_owned_memoryview()
+    # Access the data multiple times to ensure it's still valid
+    assert view.tobytes() == b"owned buffer data"
+    assert view[0] == ord(b"o")
+    assert view[-1] == ord(b"a")

src/types/memoryview.rs

@@ -1,6 +1,10 @@
 use crate::err::PyResult;
 use crate::ffi_ptr_ext::FfiPtrExt;
 use crate::py_result_ext::PyResultExt;
+#[cfg(any(Py_3_11, not(Py_LIMITED_API)))]
+use crate::pycell::impl_::PyClassObjectLayout;
+#[cfg(any(Py_3_11, not(Py_LIMITED_API)))]
+use crate::Python;
 use crate::{ffi, Bound, PyAny};
 
 /// Represents a Python `memoryview`.
@@ -22,6 +26,97 @@ impl PyMemoryView {
                 .cast_into_unchecked()
         }
     }
+
+    /// Creates a new Python `memoryview` that exposes a read-only view of the
+    /// byte data owned by a frozen `PyClass` instance.
+    ///
+    /// This avoids copying data when you want to expose the internal buffer of
+    /// a Python object as a `memoryview`. The `owner` keeps the data alive for
+    /// the lifetime of the `memoryview`.
+    ///
+    /// # Arguments
+    ///
+    /// * `py` — The Python GIL token.
+    /// * `owner` — A `Py<T>` reference to a frozen `PyClass` instance that owns
+    ///   the underlying data.
+    /// * `getbuf` — A closure that borrows `T` and returns the byte slice to
+    ///   expose. The higher-ranked lifetime ensures the slice is derived from
+    ///   `T` (or is `'static`), preventing dangling pointers.
+    ///
+    /// # Safety guarantees
+    ///
+    /// * `T: PyClass<Frozen = True>` ensures the class is immutable, so the
+    ///   buffer pointer cannot be invalidated by mutation.
+    /// * The `for<'a> FnOnce(&'a T) -> &'a [u8]` signature ensures the returned
+    ///   slice borrows from `T` or is `'static`, preventing references to
+    ///   temporaries.
+    ///
+    /// # Example
+    ///
+    /// ```rust
+    /// # #[cfg(any(Py_3_11, not(Py_LIMITED_API)))]
+    /// # {
+    /// use pyo3::prelude::*;
+    /// use pyo3::types::PyMemoryView;
+    ///
+    /// #[pyclass(frozen)]
+    /// struct MyData {
+    ///     data: Vec<u8>,
+    /// }
+    ///
+    /// Python::attach(|py| {
+    ///     let obj = Py::new(py, MyData { data: vec![1, 2, 3] }).unwrap();
+    ///     let view = PyMemoryView::from_owned_buffer(py, obj, |data| &data.data).unwrap();
+    ///     assert_eq!(view.len().unwrap(), 3);
+    /// });
+    /// # }
+    /// ```
+    #[cfg(any(Py_3_11, not(Py_LIMITED_API)))]
+    pub fn from_owned_buffer<'py, T>(
+        py: Python<'py>,
+        owner: crate::Py<T>,
+        getbuf: impl for<'a> FnOnce(&'a T) -> &'a [u8],
+    ) -> PyResult<Bound<'py, Self>>
+    where
+        T: crate::PyClass<Frozen = crate::pyclass::boolean_struct::True> + Sync,
+    {
+        // Get the raw object pointer. This is a borrowed reference (no refcount change).
+        let owner_ptr = owner.as_ptr();
+
+        // SAFETY: T is frozen and Sync, so we can safely obtain &T via the
+        // class object layout. The reference is valid as long as `owner` is
+        // alive (which it is — we still hold it on the stack).
+        let obj_ref: &T = unsafe { &*owner.bind(py).get_class_object().get_ptr() };
+        let buf = getbuf(obj_ref);
+
+        let mut view = ffi::Py_buffer::new();
+
+        // SAFETY: PyBuffer_FillInfo initializes the Py_buffer struct. On
+        // success it calls Py_INCREF on the owner object (via view.obj).
+        // We pass readonly=1 since we only expose an immutable view.
+        let rc = unsafe {
+            ffi::PyBuffer_FillInfo(
+                &mut view,
+                owner_ptr,
+                buf.as_ptr() as *mut std::ffi::c_void,
+                buf.len() as ffi::Py_ssize_t,
+                1, // readonly
+                ffi::PyBUF_FULL_RO,
+            )
+        };
+        if rc == -1 {
+            return Err(crate::PyErr::fetch(py));
+        }
+
+        // SAFETY: PyMemoryView_FromBuffer creates a memoryview that takes
+        // ownership of the buffer (it will call PyBuffer_Release when the
+        // memoryview is deallocated, which will decref view.obj).
+        unsafe {
+            ffi::PyMemoryView_FromBuffer(&view)
+                .assume_owned_or_err(py)
+                .cast_into_unchecked()
+        }
+    }
 }
 
 impl<'py> TryFrom<&Bound<'py, PyAny>> for Bound<'py, PyMemoryView> {

tests/test_memoryview.rs

@@ -0,0 +1,92 @@
+#![cfg(feature = "macros")]
+#![cfg(any(Py_3_11, not(Py_LIMITED_API)))]
+
+use pyo3::prelude::*;
+use pyo3::types::PyMemoryView;
+
+#[pyclass(frozen)]
+struct ByteOwner {
+    data: Vec<u8>,
+}
+
+#[test]
+fn test_from_owned_buffer_basic() {
+    Python::attach(|py| {
+        let owner = Py::new(
+            py,
+            ByteOwner {
+                data: vec![1, 2, 3, 4, 5],
+            },
+        )
+        .unwrap();
+        let view = PyMemoryView::from_owned_buffer(py, owner, |o| &o.data).unwrap();
+        assert_eq!(view.len().unwrap(), 5);
+        assert!(view.is_truthy().unwrap());
+    });
+}
+
+#[test]
+fn test_from_owned_buffer_readonly() {
+    Python::attach(|py| {
+        let owner = Py::new(py, ByteOwner { data: vec![42] }).unwrap();
+        let view = PyMemoryView::from_owned_buffer(py, owner, |o| &o.data).unwrap();
+        // Verify the memoryview is readonly via Python
+        let readonly: bool = view.getattr("readonly").unwrap().extract().unwrap();
+        assert!(readonly);
+    });
+}
+
+#[test]
+fn test_from_owned_buffer_content() {
+    Python::attach(|py| {
+        let owner = Py::new(
+            py,
+            ByteOwner {
+                data: b"hello".to_vec(),
+            },
+        )
+        .unwrap();
+        let view = PyMemoryView::from_owned_buffer(py, owner, |o| &o.data).unwrap();
+        let bytes: Vec<u8> = view.call_method0("tobytes").unwrap().extract().unwrap();
+        assert_eq!(bytes, b"hello");
+    });
+}
+
+#[test]
+fn test_from_owned_buffer_empty() {
+    Python::attach(|py| {
+        let owner = Py::new(py, ByteOwner { data: vec![] }).unwrap();
+        let view = PyMemoryView::from_owned_buffer(py, owner, |o| &o.data).unwrap();
+        assert_eq!(view.len().unwrap(), 0);
+    });
+}
+
+#[test]
+fn test_from_owned_buffer_static_data() {
+    // The closure can also return a &'static [u8]
+    Python::attach(|py| {
+        let owner = Py::new(py, ByteOwner { data: vec![] }).unwrap();
+        let view =
+            PyMemoryView::from_owned_buffer(py, owner, |_o| b"static data" as &[u8]).unwrap();
+        let bytes: Vec<u8> = view.call_method0("tobytes").unwrap().extract().unwrap();
+        assert_eq!(bytes, b"static data");
+    });
+}
+
+#[test]
+fn test_from_owned_buffer_keeps_owner_alive() {
+    Python::attach(|py| {
+        let owner = Py::new(
+            py,
+            ByteOwner {
+                data: b"kept alive".to_vec(),
+            },
+        )
+        .unwrap();
+        let view = PyMemoryView::from_owned_buffer(py, owner, |o| &o.data).unwrap();
+        // Force GC to ensure the owner is kept alive by the memoryview
+        py.run(c"import gc; gc.collect()", None, None).unwrap();
+        let bytes: Vec<u8> = view.call_method0("tobytes").unwrap().extract().unwrap();
+        assert_eq!(bytes, b"kept alive");
+    });
+}