SIGSEGV in TextIOWrapper.readline() after seek() with cookie containing negative chars_to_skip

Crash report

What happened?

import io, sys

COOKIE_VALUE = (100 << (12 * 8)) | (0x80 << (19 * 8))

data = b"Hello World!" * 100
raw = io.BytesIO(data)
buf = io.BufferedReader(raw)
tio = io.TextIOWrapper(buf, encoding='utf-8')

tio.read(20)
tio.seek(COOKIE_VALUE)
tio.readline()

sys.exit(0)

CPython versions tested on:

3.16

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.16.0a0 (tags/v3.15.0b1-959-gd0714388278:d0714388278, Jul 13 2026, 20:32:55) [GCC 12.3.0] Linux x86_64, GCC 12.3.0

Linked PRs

• gh-153667

首先在 Linux 上运行提供的 Python 复现程序，并检查与崩溃相关的 io.TextIOWrapper seek() 和 readline() 入口点。相同的 cookie 不再导致 SIGSEGV，且复现程序正常退出，即表示完成；开始前请先查看链接的 PR gh-153667，因为相关工作可能已经在进行中。