gh-152431: Update StreamReader transport after asyncio TLS upgrade

Lib/asyncio/streams.py

@@ -216,6 +216,9 @@ def _stream_reader(self):
     def _replace_transport(self, transport):
         self._transport = transport
         self._over_ssl = transport.get_extra_info('sslcontext') is not None
+        reader = self._stream_reader
+        if reader is not None:
+            reader.set_transport(transport)
 
     def connection_made(self, transport):
         if self._reject_connection:
@@ -472,7 +475,9 @@ def _wakeup_waiter(self):
                 waiter.set_result(None)
 
     def set_transport(self, transport):
-        assert self._transport is None, 'Transport already set'
+        assert self._transport is None or self._transport is transport, (
+            'Transport already set'
+        )
         self._transport = transport
 
     def _maybe_resume_transport(self):

Lib/test/test_asyncio/test_ssl.py

@@ -1737,6 +1737,36 @@ async def client(addr):
             loop.run_until_complete(client(srv.addr))
 
 
+    async def test_start_tls_updates_stream_reader_transport(self):
+        # gh-152431: after start_tls, the StreamReader must use the new
+        # transport, not the old one.
+        srv_ctx = test_utils.simple_server_sslcontext()
+        cli_ctx = test_utils.simple_client_sslcontext()
+
+        async def handler(reader, writer):
+            writer.close()
+
+        srv = await asyncio.start_server(handler, '127.0.0.1', 0)
+        addr = srv.sockets[0].getsockname()
+
+        reader, writer = await asyncio.open_connection(*addr)
+
+        old_transport = reader._transport
+        self.assertIsNotNone(old_transport)
+
+        new_transport = await self.loop.start_tls(
+            writer.transport, writer._protocol, srv_ctx,
+            server_side=False, ssl_handshake_timeout=self.TIMEOUT)
+
+        # The reader should now reference the TLS transport
+        self.assertIs(reader._transport, new_transport)
+        self.assertIsNot(reader._transport, old_transport)
+
+        writer.close()
+        srv.close()
+        await srv.wait_closed()
+
+
 ###############################################################################
 # Socket Testing Utilities
 ###############################################################################

Misc/NEWS.d/next/Library/2026-06-29-00-00-00.gh-issue-152431.XxYyZz.rst

@@ -0,0 +1,2 @@
+Fix :meth:`asyncio.StreamWriter.start_tls` to update the linked
+:class:`~asyncio.StreamReader` transport after the TLS handshake.