From 6ff08d9653b26910ca9fd18005597618b76a0de1 Mon Sep 17 00:00:00 2001
From: abhi210 <27881020+Abhi210@users.noreply.github.com>
Date: Sat, 18 Jul 2026 22:57:33 +0530
Subject: [PATCH 1/3] Fixed OOM-0004 from gh-151763

---
 .../2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst       | 3 +++
 Objects/listobject.c                                     | 9 +++++----
 2 files changed, 8 insertions(+), 4 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst
new file mode 100644
index 00000000000000..c4df1473be49a1
--- /dev/null
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst
@@ -0,0 +1,3 @@
+Fix a crash in the free-threaded build where :c:func:`PyList_New` could leave
+a newly allocated list's item buffer pointer uninitialized when the backing
+array allocation failed under low memory, leading to an invalid free.
diff --git a/Objects/listobject.c b/Objects/listobject.c
index 8a9c9bda68269b..2a89d555f856ed 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -252,10 +252,11 @@ PyList_New(Py_ssize_t size)
             return NULL;
         }
     }
-    if (size <= 0) {
-        op->ob_item = NULL;
-    }
-    else {
+    op->ob_item = NULL;
+    Py_SET_SIZE(op, 0);
+    op->allocated = 0;
+
+    if (size > 0) {
 #ifdef Py_GIL_DISABLED
         _PyListArray *array = list_allocate_array(size);
         if (array == NULL) {

From 15ee20db6f3c74549b5c5d56a3f98c4370cd004d Mon Sep 17 00:00:00 2001
From: abhi210 <27881020+Abhi210@users.noreply.github.com>
Date: Sun, 19 Jul 2026 10:34:32 +0530
Subject: [PATCH 2/3] Resolve the comments on the PR 154019

---
 Objects/listobject.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/Objects/listobject.c b/Objects/listobject.c
index 2a89d555f856ed..d6499f6f03fcfc 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -253,8 +253,6 @@ PyList_New(Py_ssize_t size)
         }
     }
     op->ob_item = NULL;
-    Py_SET_SIZE(op, 0);
-    op->allocated = 0;
 
     if (size > 0) {
 #ifdef Py_GIL_DISABLED

From 46a6c1198e43afe5b86a75c57c1054388e1ac86c Mon Sep 17 00:00:00 2001
From: abhi210 <27881020+Abhi210@users.noreply.github.com>
Date: Sun, 19 Jul 2026 18:46:08 +0530
Subject: [PATCH 3/3] Resolve more comments on the PR 154019

---
 .../2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst            | 2 +-
 Objects/listobject.c                                          | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst
index c4df1473be49a1..ae66f69f206217 100644
--- a/Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst
+++ b/Misc/NEWS.d/next/Core_and_Builtins/2026-07-18-22-56-27.gh-issue-152125.sEPvJf.rst
@@ -1,3 +1,3 @@
-Fix a crash in the free-threaded build where :c:func:`PyList_New` could leave
+Fix a crash in the :term:`free-threaded build` where :c:func:`PyList_New` could leave
 a newly allocated list's item buffer pointer uninitialized when the backing
 array allocation failed under low memory, leading to an invalid free.
diff --git a/Objects/listobject.c b/Objects/listobject.c
index d6499f6f03fcfc..04db98bc28a5c8 100644
--- a/Objects/listobject.c
+++ b/Objects/listobject.c
@@ -253,6 +253,8 @@ PyList_New(Py_ssize_t size)
         }
     }
     op->ob_item = NULL;
+    Py_SET_SIZE(op, size);
+    op->allocated = size;
 
     if (size > 0) {
 #ifdef Py_GIL_DISABLED
@@ -271,8 +273,6 @@ PyList_New(Py_ssize_t size)
             return PyErr_NoMemory();
         }
     }
-    Py_SET_SIZE(op, size);
-    op->allocated = size;
     _PyObject_GC_TRACK(op);
     return (PyObject *) op;
 }