gh-153419: Fix several issues around bytearray __init__

Lib/test/test_bytes.py

@@ -2197,6 +2197,50 @@ def __len__(self):
 
         self.assertRaises(BufferError, ba.hex, S(b':'))
 
+    def test_uninitialized_instance(self):
+        # A bytearray created with __new__ so that __init__ is never called
+        # (often as a side-effect of a subclass not calling super().__init__)
+        # is left with ob_bytes_object == NULL.  It's easy for implementation
+        # code to not realize that ob_bytes_object can be NULL, so these
+        # checks exercise code paths that have historically crashed or
+        # asserted (see gh-153419).
+        def uninitialized():
+            return bytearray.__new__(bytearray)
+
+        uninitialized().insert(0, 1)
+        uninitialized().extend(b"x")
+        uninitialized().extend([1, 2, 3])
+        uninitialized().resize(4)
+        uninitialized().__init__(5)
+        uninitialized().__init__(b"xyz")
+        uninitialized().take_bytes()
+        uninitialized().take_bytes(0)
+
+        a = uninitialized()
+        a.append(1)
+
+        a = uninitialized()
+        a += b"x"
+
+        a = uninitialized()
+        a[:] = b"xyz"
+
+    def test_reinit_length1(self):
+        # There is a shortcut taken when resizing, where alloc/2 < newsize.
+        # In this case, the existing buffer is reused, rather than reset.
+        # If this happens when newsize == 0 and alloc == 1, then various
+        # code assumptions can be violated.  This test should catch those
+        # in debug builds. (see gh-153419)
+        a = bytearray(1)
+        a.__init__()
+        self.assertEqual(a, b"")
+
+    def test_reinit_with_view(self):
+        a = bytearray()
+        with memoryview(a):
+            self.assertRaises(BufferError, a.__init__, "x", "ascii")
+        self.assertEqual(a, b"")
+
 
 class AssortedBytesTest(unittest.TestCase):
     #

Misc/NEWS.d/next/Core_and_Builtins/2026-07-11-01-17-57.gh-issue-153419.U8HJOJ.rst

@@ -0,0 +1 @@
+Fix several :class:`bytearray` crashes caused by calling :meth:`~object.__init__`/:meth:`~object.__new__` in unusual ways.

Objects/bytearrayobject.c

@@ -213,6 +213,15 @@ bytearray_resize_lock_held(PyObject *self, Py_ssize_t requested_size)
 {
     _Py_CRITICAL_SECTION_ASSERT_OBJECT_LOCKED(self);
     PyByteArrayObject *obj = ((PyByteArrayObject *)self);
+
+    /* If ob_bytes_object has not been initialized yet, eagerly initialize
+       it here so the following code can reason about state more easily,
+       and things like pointer comparisons are valid. */
+    if (obj->ob_bytes_object == NULL) {
+        obj->ob_bytes_object = Py_GetConstant(Py_CONSTANT_EMPTY_BYTES);
+        bytearray_reinit_from_bytes(obj, 0, 0);
+    }
+
     /* All computations are done unsigned to avoid integer overflows
        (see issue #22335). */
     size_t alloc = (size_t) obj->ob_alloc;
@@ -236,6 +245,15 @@ bytearray_resize_lock_held(PyObject *self, Py_ssize_t requested_size)
         return -1;
     }
 
+    /* When resizing to 0, always reset to the empty-bytes constant to avoid
+       complexity in the realloc path below (see gh-153419). */
+    if (requested_size == 0) {
+        Py_XSETREF(obj->ob_bytes_object,
+                   Py_GetConstant(Py_CONSTANT_EMPTY_BYTES));
+        bytearray_reinit_from_bytes(obj, 0, 0);
+        return 0;
+    }
+
     if (size + logical_offset <= alloc) {
         /* Current buffer is large enough to host the requested size,
            decide on a strategy. */
@@ -920,20 +938,17 @@ bytearray___init___impl(PyByteArrayObject *self, PyObject *arg,
     PyObject *it;
     PyObject *(*iternext)(PyObject *);
 
-    /* First __init__; set ob_bytes_object so ob_bytes is always non-null. */
-    if (self->ob_bytes_object == NULL) {
-        self->ob_bytes_object = Py_GetConstant(Py_CONSTANT_EMPTY_BYTES);
-        bytearray_reinit_from_bytes(self, 0, 0);
-        self->ob_exports = 0;
+    if (!_canresize(self)) {
+        return -1;
     }
 
-    if (Py_SIZE(self) != 0) {
-        /* Empty previous contents (yes, do this first of all!) */
-        if (PyByteArray_Resize((PyObject *)self, 0) < 0)
-            return -1;
+    /* Empty any previous contents (do this first of all!).
+       Also initializes ob_bytes_object if needed */
+    if (PyByteArray_Resize((PyObject *)self, 0) < 0) {
+        return -1;
     }
 
-    /* Should be caused by first init or the resize to 0. */
+    /* PyByteArray_Resize(,0) should always leave the empty bytes constant */
     assert(self->ob_bytes_object == Py_GetConstantBorrowed(Py_CONSTANT_EMPTY_BYTES));
     assert(self->ob_exports == 0);
 
@@ -1607,6 +1622,10 @@ bytearray_take_bytes_impl(PyByteArrayObject *self, PyObject *n)
     }
 
     if (_PyBytes_Resize(&self->ob_bytes_object, to_take) == -1) {
+        /* _PyBytes_Resize has made ob_bytes_object NULL here. We need to
+           ensure that the other bytearray fields are consistent. */
+        self->ob_bytes_object = Py_GetConstant(Py_CONSTANT_EMPTY_BYTES);
+        bytearray_reinit_from_bytes(self, 0, 0);
         Py_DECREF(remaining);
         return NULL;
     }