From 748e89eb05e54cbdc9bacb2df7402e7180dda21b Mon Sep 17 00:00:00 2001 From: sobolevn Date: Mon, 29 Jun 2026 19:22:22 +0300 Subject: [PATCH] gh-152228: Fix an assertion failure in `str.replace` under a limited memory case (GH-152229) (cherry picked from commit c5043dce1c6743682d93c71e937b95e7d27e0b35) Co-authored-by: sobolevn --- Lib/test/test_str.py | 15 +++++++++++++++ ...6-06-25-21-34-15.gh-issue-152228.a6K14K.rst | 2 ++ Objects/unicodeobject.c | 18 +++++++++--------- 3 files changed, 26 insertions(+), 9 deletions(-) create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-06-25-21-34-15.gh-issue-152228.a6K14K.rst diff --git a/Lib/test/test_str.py b/Lib/test/test_str.py index cdd54cc19a2de7..dbd9e049ef98bd 100644 --- a/Lib/test/test_str.py +++ b/Lib/test/test_str.py @@ -600,6 +600,21 @@ def test_replace_id(self): text = 'abc def' self.assertIs(text.replace(pattern, pattern), text) + @support.nomemtest + def test_replace_oom(self): + # https://github.com/python/cpython/issues/152228 + s1 = "轘" * 4 + s2 = "&" + s3 = "&" + assertion = self.assertRaises(MemoryError) + _testcapi.set_nomemory(0, 0) + try: + # No allocations made in the test itself: + with assertion: + s1.replace(s2, s3) # this line used to crash before + finally: + _testcapi.remove_mem_hooks() + def test_repeat_id_preserving(self): a = '123abc1@' b = '456zyx-+' diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-06-25-21-34-15.gh-issue-152228.a6K14K.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-25-21-34-15.gh-issue-152228.a6K14K.rst new file mode 100644 index 00000000000000..8af7ae0d173913 --- /dev/null +++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-06-25-21-34-15.gh-issue-152228.a6K14K.rst @@ -0,0 +1,2 @@ +Fix an assertion failure when python is built in a debug mode +that happened in :meth:`str.replace` under a limited memory situation. diff --git a/Objects/unicodeobject.c b/Objects/unicodeobject.c index 4c987fa7dbc356..028ff8c73fcc0c 100644 --- a/Objects/unicodeobject.c +++ b/Objects/unicodeobject.c @@ -10598,9 +10598,9 @@ replace(PyObject *self, PyObject *str1, } done: - assert(srelease == (sbuf != PyUnicode_DATA(self))); - assert(release1 == (buf1 != PyUnicode_DATA(str1))); - assert(release2 == (buf2 != PyUnicode_DATA(str2))); + assert(srelease == (sbuf != NULL && sbuf != PyUnicode_DATA(self))); + assert(release1 == (buf1 != NULL && buf1 != PyUnicode_DATA(str1))); + assert(release2 == (buf2 != NULL && buf2 != PyUnicode_DATA(str2))); if (srelease) PyMem_Free((void *)sbuf); if (release1) @@ -10612,9 +10612,9 @@ replace(PyObject *self, PyObject *str1, nothing: /* nothing to replace; return original string (when possible) */ - assert(srelease == (sbuf != PyUnicode_DATA(self))); - assert(release1 == (buf1 != PyUnicode_DATA(str1))); - assert(release2 == (buf2 != PyUnicode_DATA(str2))); + assert(srelease == (sbuf != NULL && sbuf != PyUnicode_DATA(self))); + assert(release1 == (buf1 != NULL && buf1 != PyUnicode_DATA(str1))); + assert(release2 == (buf2 != NULL && buf2 != PyUnicode_DATA(str2))); if (srelease) PyMem_Free((void *)sbuf); if (release1) @@ -10624,9 +10624,9 @@ replace(PyObject *self, PyObject *str1, return unicode_result_unchanged(self); error: - assert(srelease == (sbuf != PyUnicode_DATA(self))); - assert(release1 == (buf1 != PyUnicode_DATA(str1))); - assert(release2 == (buf2 != PyUnicode_DATA(str2))); + assert(srelease == (sbuf != NULL && sbuf != PyUnicode_DATA(self))); + assert(release1 == (buf1 != NULL && buf1 != PyUnicode_DATA(str1))); + assert(release2 == (buf2 != NULL && buf2 != PyUnicode_DATA(str2))); if (srelease) PyMem_Free((void *)sbuf); if (release1)