CPython-dev ASan np.prod SEGV reproducer

1. export BUILD_EDITABLE_PYTHON=false in your shell
2. pixi run repro to observe the crash
3. Uncomment branch = "3.15" in pixi.toml to demonstrate the regression

Crash signature (3.16-dev)

❯ pixi run repro
✨ Pixi task (repro): python repro.py
Python: 3.16.0a0 (heads/master-dirty:d8a1072491, Sep 16 2026, 22:19:03) [Clang 21.1.8 ]
AddressSanitizer:DEADLYSIGNAL
=================================================================
==54023==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x00010639c214 bp 0x00016afdf230 sp 0x00016afdf1d0 T0)
==54023==The signal is caused by a WRITE memory access.
==54023==HINT: address points to the zero page.
    #0 0x00010639c214 in _PyGCHead_SET_NEXT pycore_gc.h:151
    #1 0x00010639c214 in _PyObject_GC_UNTRACK pycore_gc.h:264
    #2 0x00010639c214 in type_dealloc typeobject.c:6898
    #3 0x000106338e40 in _Py_Dealloc object.c:3333
    #4 0x00010e880a34 in PyUFunc_GenericReduction+0x119c (_multiarray_umath.cpython-316-darwin.so:arm64+0x704a34)
    #5 0x000106237858 in _PyVectorcall_Call call.c:273
    #6 0x00010652b77c in _PyEval_EvalFrameDefault generated_cases.c.h:2831
    #7 0x0001065153bc in _PyEval_EvalFrame pycore_ceval.h:122
    #8 0x0001065153bc in _PyEval_Vector ceval.c:2176
    #9 0x000106237a78 in _PyObject_VectorcallTstate pycore_call.h:144
    #10 0x000106237a78 in PyObject_Vectorcall call.c:327
    #11 0x00010e54bd1c in dispatcher_vectorcall+0xc70 (_multiarray_umath.cpython-316-darwin.so:arm64+0x3cfd1c)
    #12 0x000106237a78 in _PyObject_VectorcallTstate pycore_call.h:144
    #13 0x000106237a78 in PyObject_Vectorcall call.c:327
    #14 0x000106515938 in _Py_VectorCall_StackRefSteal ceval.c:728
    #15 0x000106529170 in _PyEval_EvalFrameDefault generated_cases.c.h:3686
    #16 0x000106514db0 in _PyEval_EvalFrame pycore_ceval.h:122
    #17 0x000106514db0 in _PyEval_Vector ceval.c:2176
    #18 0x000106514db0 in PyEval_EvalCode ceval.c:681
    #19 0x00010665ba10 in run_mod pythonrun.c:1509
    #20 0x00010665633c in _PyRun_File pythonrun.c:1332
    #21 0x00010665633c in _PyRun_SimpleFile pythonrun.c:544
    #22 0x000106655998 in _PyRun_AnyFile pythonrun.c:92
    #23 0x0001066bd0b0 in pymain_run_file_obj main.c:478
    #24 0x0001066bd0b0 in pymain_run_file main.c:494
    #25 0x0001066bbe68 in pymain_run_python main.c:804
    #26 0x0001066bbe68 in Py_RunMain main.c:891
    #27 0x0001066bc830 in pymain_main main.c:921
    #28 0x0001066bc9e0 in Py_BytesMain main.c:945
    #29 0x000189febdfc in start+0x1b4c (dyld:arm64e+0x1fdfc)

==54023==Register values:
 x[0] = 0x00006190000dde88   x[1] = 0x000000010639c054   x[2] = 0x000000016afde9d0   x[3] = 0x000061600009a870
 x[4] = 0x0000000000000218   x[5] = 0x0000000000000218   x[6] = 0x0000000169fe4000   x[7] = 0x0000000000000001
 x[8] = 0x00006190000dde80   x[9] = 0x0000000000000000  x[10] = 0x0000000000000000  x[11] = 0x00000fffffffffff
x[12] = 0x0000000000000000  x[13] = 0xffffffffffffffff  x[14] = 0x0000000000000000  x[15] = 0x00007fffffffffff
x[16] = 0x0000000000000028  x[17] = 0x0000604000000410  x[18] = 0x0000000000000000  x[19] = 0x00006190000dde90
x[20] = 0x0000604000000438  x[21] = 0x0000000080805980  x[22] = 0x0000008000020000  x[23] = 0x0000000106c42940
x[24] = 0x0000008000020000  x[25] = 0x0000000000000000  x[26] = 0x000000016afdfb20  x[27] = 0x0000000000000000
x[28] = 0x00006110001f42e4     fp = 0x000000016afdf230     lr = 0x000000010639c1d8     sp = 0x000000016afdf1d0
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV pycore_gc.h:151 in _PyGCHead_SET_NEXT
==54023==ABORTING

Bisect result

git bisect on python/cpython, between the 3.15 branch point (f31a89bb901067dd105b00cfa90523cf7ffdbbdd, good) and main (d8a1072491069b825edcfef66a06761e074da18a, bad), converged on:

bba99f2b3272cbe47af9bee05a294961c0528829 is the first 'bad' commit
commit bba99f2b3272cbe47af9bee05a294961c0528829
Author: Victor Stinner <[email protected]>
Date:   Thu Sep 10 23:10:46 2026 +0200

    gh-121647: Fix _Py_TYPEOF() on C++ (#157267)

    Using MSVC (on Windows), _Py_TYPEOF() prefers decltype()
    over __typeof__() on C++.

    Fix also _Py_TYPEOF() usage in Py_CLEAR() and Py_SETREF() macros.
    Replace "_Py_TYPEOF(dst)*" with "_Py_TYPEOF(&(dst))". In C++,
    "_Py_TYPEOF(dst)*" can fail with a compiler error.

 Include/cpython/object.h |  4 ++--
 Include/pyport.h         | 11 +++++++----
 Include/refcount.h       |  2 +-