Issue #16215: Fix potential double memory free in str.replace().

Patch by Serhiy Storchaka.

Misc/NEWS

@@ -10,6 +10,9 @@ What's New in Python 3.4.0 Alpha 1?
 Core and Builtins
 -----------------
 
+- Issue #16215: Fix potential double memory free in str.replace().  Patch
+  by Serhiy Storchaka.
+
 - Issue #16290: A float return value from the __complex__ special method is no
   longer accepted in the complex() constructor.
 

Objects/unicodeobject.c

@@ -9959,6 +9959,7 @@ replace(PyObject *self, PyObject *str1,
                 /* widen self and buf1 */
                 rkind = kind2;
                 if (release1) PyMem_Free(buf1);
+                release1 = 0;
                 sbuf = _PyUnicode_AsKind(self, rkind);
                 if (!sbuf) goto error;
                 srelease = 1;
@@ -10020,6 +10021,7 @@ replace(PyObject *self, PyObject *str1,
             if (!sbuf) goto error;
             srelease = 1;
             if (release1) PyMem_Free(buf1);
+            release1 = 0;
             buf1 = _PyUnicode_AsKind(str1, rkind);
             if (!buf1) goto error;
             release1 = 1;