BUG: Failed !PyErr_Occurred() assertion #28783
Description
Describe the issue:
It's possible to abort a debug build by calling some methods with invalid values like in the code example. Only reproductions using collections.Counter were identified, but I can search for other inputs than can also cause this abort if it would help.
Reproduce the code example:
import numpy
from collections import Counter
numpy.promote_types(Counter(), 1.1)
# or
numpy.clongdouble().getfield(Counter())
# or
numpy.long().sum(3655, Counter(), bytes(10 ** 5))Error message:
python: Objects/descrobject.c:268: int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *): Assertion `!PyErr_Occurred()' failed.
Aborted
#0 __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007ffff7c4519e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007ffff7c28902 in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007ffff7c2881e in __assert_fail_base (fmt=0x7ffff7dde2a0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5555561b23e0 <str> "!PyErr_Occurred()",
file=file@entry=0x5555561b1040 <str> "Objects/descrobject.c", line=line@entry=268,
function=function@entry=0x5555561b2420 <__PRETTY_FUNCTION__.method_check_args> "int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *)") at ./assert/assert.c:96
#6 0x00007ffff7c3b7c7 in __assert_fail (assertion=0x5555561b23e0 <str> "!PyErr_Occurred()", file=0x5555561b1040 <str> "Objects/descrobject.c", line=line@entry=268,
function=0x5555561b2420 <__PRETTY_FUNCTION__.method_check_args> "int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *)") at ./assert/assert.c:105
#7 0x0000555555a761de in method_check_args (func=func@entry=0x7fffb40bb8b0, args=0x7ffff5d6bbe0, nargs=nargs@entry=2, kwnames=0x0) at Objects/descrobject.c:268
#8 0x0000555555a7104e in method_vectorcall_O (func=0x7fffb40bb8b0, args=0x405b1, nargsf=<optimized out>, kwnames=0x7ffff7ca3f1c <__GI___pthread_kill+284>) at Objects/descrobject.c:458
#9 0x0000555555c1dcb3 in _PyObject_VectorcallTstate (tstate=tstate@entry=0x5555566c6300 <_PyRuntime+326528>, callable=callable@entry=0x7fffb40bb8b0, args=0x405b1,
args@entry=0x7ffff5d6bbe0, nargsf=6, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#10 0x0000555555c08f11 in vectorcall_unbound (tstate=0x5555566c6300 <_PyRuntime+326528>, func=0x7fffb40bb8b0, args=0x6, nargs=2, unbound=<optimized out>) at Objects/typeobject.c:2570
#11 vectorcall_method (name=0x555556686538 <_PyRuntime+64952>, args=args@entry=0x7ffff5d6bbe0, nargs=nargs@entry=2) at Objects/typeobject.c:2601
#12 0x0000555555c1c18e in slot_mp_subscript (self=0x7fffb4630c60, arg1=<optimized out>) at Objects/typeobject.c:9330
#13 0x00005555559ecc13 in PyObject_GetItem (o=0x405b1, o@entry=0x7fffb4630c60, key=0x405b1) at Objects/abstract.c:158
#14 0x00005555559fb209 in PyMapping_GetItemString (o=0x7fffb4630c60, key=<optimized out>) at Objects/abstract.c:2352
#15 0x00007ffff4390fe6 in _convert_from_any.part.0 ()
from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#16 0x00007ffff4394a92 in PyArray_DescrConverter2 ()
from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#17 0x00007ffff449074e in _npy_parse_arguments ()
from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#18 0x00007ffff43d05d8 in array_promote_types () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#19 0x0000555555b64335 in cfunction_vectorcall_FASTCALL (func=<optimized out>, args=0x529000005848, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/methodobject.c:425
#20 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb4bd8270, args=0x405b1, nargsf=6, kwnames=0x98)
at ./Include/internal/pycore_call.h:168
#21 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#22 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb54417d0, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#23 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb54417d0, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#24 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#25 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#26 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x405b1, nargsf=6, kwnames=0x98)
at ./Include/internal/pycore_call.h:168
#27 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#28 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#29 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#30 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#31 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#32 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x405b1, nargsf=6, kwnames=0x98)Python and NumPy Versions:
2.3.0.dev0+git20250415.e151f0d
3.13.3+ experimental free-threading build (heads/3.13:83cb89b941b, Apr 18 2025, 20:59:43) [Clang 19.1.7 (++20250114103253+cd708029e0b2-1exp120250114103309.40)]
Runtime Environment:
[{'numpy_version': '2.3.0.dev0+git20250415.e151f0d',
'python': '3.13.3+ experimental free-threading build '
'(heads/3.13:83cb89b941b, Apr 18 2025, 20:59:43) [Clang 19.1.7 '
'(++20250114103253+cd708029e0b2-1exp120250114103309.40)]',
'uname': uname_result(system='Linux', node='beesknees', release='6.11.0-24-generic', version='#24-Ubuntu SMP PREEMPT_DYNAMIC Fri Mar 14 18:13:56 UTC 2025', machine='x86_64')},
{'simd_extensions': {'baseline': ['SSE', 'SSE2', 'SSE3'],
'found': ['SSSE3',
'SSE41',
'POPCNT',
'SSE42',
'AVX',
'F16C',
'FMA3',
'AVX2',
'AVX512F',
'AVX512CD',
'AVX512_SKX',
'AVX512_CLX',
'AVX512_CNL',
'AVX512_ICL'],
'not_found': ['AVX512_KNL', 'AVX512_KNM', 'AVX512_SPR']}},
{'architecture': 'SkylakeX',
'filepath': '/home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy.libs/libscipy_openblas64_-56d6093b.so',
'internal_api': 'openblas',
'num_threads': 16,
'prefix': 'libscipy_openblas',
'threading_layer': 'pthreads',
'user_api': 'blas',
'version': '0.3.29'}]
Context for the issue:
I have been fuzzing Numpy using fusil by @vstinner. I realize these crashes are unlikely to be triggered in normal usage and therefore might be of low priority.
The fuzzing was done with an ASAN free-threading clang build and not confirmed on a GILfull non-sanitizer GCC build yet.