Skip to content

BUG: crashes found by fuzzing with fusil #28829

New issue
New issue
Open
Open
BUG: crashes found by fuzzing with fusil#28829
Labels
sprintable - C
@devdanzin

Description

@devdanzin
devdanzin
opened on Apr 26, 2025

These are some crashes found by fuzzing Numpy with fusil, condensed into a single issue as requested.

1- strings._expandtabs_length.reduce(numpy.zeros(200))

import numpy._core._strings

numpy._core.strings._expandtabs_length.reduce(numpy.zeros(200))

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb3907e4c in string_expandtabs_length_promoter(_object*, PyArray_DTypeMeta* const*, PyArray_DTypeMeta* const*, PyArray_DTypeMeta**) () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb3907e4c in string_expandtabs_length_promoter(_object*, PyArray_DTypeMeta* const*, PyArray_DTypeMeta* const*, PyArray_DTypeMeta**) ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007fffb38b2137 in call_promoter_and_recurse(_tagPyUFuncObject*, _object*, PyArray_DTypeMeta**, PyArray_DTypeMeta**, tagPyArrayObject* const*) ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x00007fffb38b1d0f in promote_and_get_info_and_ufuncimpl(_tagPyUFuncObject*, tagPyArrayObject* const*, PyArray_DTypeMeta**, PyArray_DTypeMeta**, unsigned char) ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#3  0x00007fffb38b26e1 in promote_and_get_ufuncimpl ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#4  0x00007fffb38b8a39 in reducelike_promote_and_resolve ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#5  0x00007fffb38c059d in PyUFunc_GenericReduction ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#6  0x00005555559a9204 in method_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb4b3aa40, args=0x629000005840, nargsf=<optimized out>,
    kwnames=<optimized out>) at Objects/descrobject.c:420
#7  0x0000555555977b32 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb4b3aa40,
    args=0x629000005840, nargsf=9223372036854775810, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#8  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb4b3aa40, args=args@entry=0x629000005840,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#9  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#10 0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119

2- numpy._core._multiarray_tests.incref_elide(int|str)

import numpy._core._multiarray_tests

numpy._core._multiarray_tests.incref_elide(int|str)

Backtrace:

Thread 1 "python" received signal SIGBUS, Bus error.
0x00007fffb37a5cec in PyArray_NewLikeArrayWithShape () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
(gdb) bt
#0  0x00007fffb37a5cec in PyArray_NewLikeArrayWithShape ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007fffb37a5eee in PyArray_NewLikeArray ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x00007fffb3794c2b in PyArray_NewCopy ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#3  0x00007ffff4010035 in incref_elide ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_tests.cpython-313t-x86_64-linux-gnu.so
#4  0x0000555555a937c7 in cfunction_call (func=func@entry=0x7fffb527f040, args=args@entry=0x7fffb5083b20, kwargs=kwargs@entry=0x0)
    at Objects/methodobject.c:551
#5  0x0000555555977439 in _PyObject_MakeTpCall (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>,
    callable=callable@entry=0x7fffb527f040, args=args@entry=0x629000005848, nargs=1, keywords=keywords@entry=0x0)
    at Objects/call.c:242
#6  0x0000555555977c61 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb527f040,
    args=0x629000005848, nargsf=<optimized out>, kwnames=0x0) at ./Include/internal/pycore_call.h:166
#7  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb527f040, args=args@entry=0x629000005848,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#8  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#9  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#10 _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb56d48d0,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816

3- numpy.lib._arraysetops_impl._array_converter().result_type()

Happens with _array_converter in many different modules.

import numpy.lib._arraysetops_impl

numpy.lib._arraysetops_impl._array_converter().result_type()

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb3792b67 in PyArray_PromoteDTypeSequence () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb3792b67 in PyArray_PromoteDTypeSequence ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007fffb377f3b0 in array_converter_result_type ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x00005555559a9204 in method_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb4bacfe0, args=0x629000005840, nargsf=<optimized out>,
    kwnames=<optimized out>) at Objects/descrobject.c:420
#3  0x0000555555977b32 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb4bacfe0,
    args=0x629000005840, nargsf=9223372036854775809, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#4  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb4bacfe0, args=args@entry=0x629000005840,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#5  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#6  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#7  _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb5878290,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816
#8  0x0000555555d51727 in PyEval_EvalCode (co=co@entry=0x7fffb4b6fc10, globals=globals@entry=0x7fffb4765770,
    locals=locals@entry=0x7fffb4765770) at Python/ceval.c:604
#9  0x0000555555cf441a in builtin_exec_impl (module=module@entry=0x7fffb425e080, source=<optimized out>, globals=0x7fffb4765770,
    locals=0x7fffb4765770, closure=0x0) at Python/bltinmodule.c:1143
#10 0x0000555555cf4a9d in builtin_exec (module=<optimized out>, args=0x6290000057e0, nargs=<optimized out>, kwnames=0x0)
    at Python/clinic/bltinmodule.c.h:556
#11 0x0000555555a93bfb in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb425e780, args=0x6290000057e0, nargsf=<optimized out>,
    kwnames=0x0) at Objects/methodobject.c:441
#12 0x0000555555977b32 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb425e780,
    args=0x6290000057e0, nargsf=9223372036854775810, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#13 0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb425e780, args=args@entry=0x6290000057e0,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#14 0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813

4- numpy.ctypeslib.flagsobj().__setitem__("<\x11\x9B", -6.4)

import numpy.ctypeslib

numpy.ctypeslib.flagsobj().__setitem__("<\x11\x9B", -6.4)

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb37d2ce3 in arrayflags_setitem () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb37d2ce3 in arrayflags_setitem ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x0000555555b1f667 in wrap_objobjargproc (self=<optimized out>, args=<optimized out>,
    wrapped=0x7fffb37d2cb0 <arrayflags_setitem>) at Objects/typeobject.c:8717
#2  0x00005555559a5307 in wrapperdescr_raw_call (kwds=0x0, args=0x7fffb5493730, self=0x7fffb492c6d0, descr=0x7fffb4baa030)
    at Objects/descrobject.c:531
#3  wrapperdescr_call (_descr=_descr@entry=0x7fffb4baa030, args=0x7fffb5493730, args@entry=0x7fffb58629b0, kwds=kwds@entry=0x0)
    at Objects/descrobject.c:569
#4  0x0000555555977439 in _PyObject_MakeTpCall (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>,
    callable=callable@entry=0x7fffb4baa030, args=args@entry=0x629000005840, nargs=3, keywords=keywords@entry=0x0)
    at Objects/call.c:242
#5  0x0000555555977c61 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb4baa030,
    args=0x629000005840, nargsf=<optimized out>, kwnames=0x0) at ./Include/internal/pycore_call.h:166
#6  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb4baa030, args=args@entry=0x629000005840,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#7  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#8  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#9  _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb5876550,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816
#10 0x0000555555d51727 in PyEval_EvalCode (co=co@entry=0x7fffb4f1eed0, globals=globals@entry=0x7fffb4765770,
    locals=locals@entry=0x7fffb4765770) at Python/ceval.c:604
#11 0x0000555555cf441a in builtin_exec_impl (module=module@entry=0x7fffb425e080, source=<optimized out>, globals=0x7fffb4765770,
    locals=0x7fffb4765770, closure=0x0) at Python/bltinmodule.c:1143
#12 0x0000555555cf4a9d in builtin_exec (module=<optimized out>, args=0x6290000057e0, nargs=<optimized out>, kwnames=0x0)
    at Python/clinic/bltinmodule.c.h:556
#13 0x0000555555a93bfb in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb425e780, args=0x6290000057e0, nargsf=<optimized out>,
    kwnames=0x0) at Objects/methodobject.c:441

5- numpy._core._umath_tests._pickleable_module_global_ufunc()

import numpy._core._umath_tests

numpy._core._umath_tests._pickleable_module_global_ufunc()

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb38b2623 in promote_and_get_ufuncimpl () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb38b2623 in promote_and_get_ufuncimpl ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007fffb38c345b in ufunc_generic_fastcall ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x0000555555977b32 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb4de1a50,
    args=0x629000005848, nargsf=9223372036854775808, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#3  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb4de1a50, args=args@entry=0x629000005848,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#4  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#5  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#6  _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb5404750,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816
#7  0x0000555555d51727 in PyEval_EvalCode (co=co@entry=0x7fffb52cf610, globals=globals@entry=0x7fffb4765770,
    locals=locals@entry=0x7fffb4765770) at Python/ceval.c:604
#8  0x0000555555cf441a in builtin_exec_impl (module=module@entry=0x7fffb425e080, source=<optimized out>, globals=0x7fffb4765770,
    locals=0x7fffb4765770, closure=0x0) at Python/bltinmodule.c:1143
#9  0x0000555555cf4a9d in builtin_exec (module=<optimized out>, args=0x6290000057e0, nargs=<optimized out>, kwnames=0x0)
    at Python/clinic/bltinmodule.c.h:556

6- numpy._core.overrides._ArrayFunctionDispatcher()

import numpy._core.overrides

numpy._core.overrides._ArrayFunctionDispatcher()

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb3783a95 in dispatcher_dealloc () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb3783a95 in dispatcher_dealloc ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x0000555555aa2632 in _Py_Dealloc (op=op@entry=0x7fffb529a110) at Objects/object.c:2939
#2  0x0000555555aa2a7c in _Py_MergeZeroLocalRefcount (op=0x7fffb529a110) at Objects/object.c:434
#3  0x00007fffb378437e in dispatcher_new ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#4  0x0000555555b44cdf in type_call (self=self@entry=0x7fffb3fd9a40 <PyArrayFunctionDispatcher_Type>,
    args=args@entry=0x5555565df9e0 <_PyRuntime+128544>, kwds=kwds@entry=0x0) at Objects/typeobject.c:1985
#5  0x0000555555977439 in _PyObject_MakeTpCall (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>,
    callable=callable@entry=0x7fffb3fd9a40 <PyArrayFunctionDispatcher_Type>, args=args@entry=0x629000005848, nargs=0,
    keywords=keywords@entry=0x0) at Objects/call.c:242
#6  0x0000555555977c61 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>,
    callable=0x7fffb3fd9a40 <PyArrayFunctionDispatcher_Type>, args=0x629000005848, nargsf=<optimized out>, kwnames=0x0)
    at ./Include/internal/pycore_call.h:166
#7  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb3fd9a40 <PyArrayFunctionDispatcher_Type>,
    args=args@entry=0x629000005848, nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#8  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#9  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#10 _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb5404ed0,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816
#11 0x0000555555d51727 in PyEval_EvalCode (co=co@entry=0x7fffb52cf790, globals=globals@entry=0x7fffb4765770,
    locals=locals@entry=0x7fffb4765770) at Python/ceval.c:604
#12 0x0000555555cf441a in builtin_exec_impl (module=module@entry=0x7fffb425e080, source=<optimized out>, globals=0x7fffb4765770,
    locals=0x7fffb4765770, closure=0x0) at Python/bltinmodule.c:1143
#13 0x0000555555cf4a9d in builtin_exec (module=<optimized out>, args=0x6290000057e0, nargs=<optimized out>, kwnames=0x0)
    at Python/clinic/bltinmodule.c.h:556
#14 0x0000555555a93bfb in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb425e780, args=0x6290000057e0, nargsf=<optimized out>,
    kwnames=0x0) at Objects/methodobject.c:441

7- MaskedArray with invalid setflags segfaults

import numpy.ma

obj = numpy.ma.MaskedArray()

obj.setflags(None, None, {})
obj.__div__(None)

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x000055555592337b in Py_TYPE (ob=0x5b000005) at ./Include/object.h:336
336         return ob->ob_type;

#0  0x000055555592337b in Py_TYPE (ob=0x5b000005) at ./Include/object.h:336
#1  binary_op1 (v=v@entry=0x5b000005, w=w@entry=0x55555647bfe0 <_Py_NoneStruct>, op_slot=op_slot@entry=240,
    op_name=op_name@entry=0x5555560bc9e0 "/") at Objects/abstract.c:934
#2  0x0000555555923b90 in binary_op (v=0x5b000005, w=0x55555647bfe0 <_Py_NoneStruct>, op_slot=op_slot@entry=240,
    op_name=op_name@entry=0x5555560bc9e0 "/") at Objects/abstract.c:1000
#3  0x00005555559281a4 in PyNumber_TrueDivide (v=<optimized out>, w=<optimized out>) at Objects/abstract.c:1197
#4  0x00007fffb3711d4f in PyUFunc_OO_O ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#5  0x00007fffb38b4925 in generic_wrapped_legacy_loop ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#6  0x00007fffb38c4906 in ufunc_generic_fastcall ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#7  0x000055555597ccc7 in _PyVectorcall_Call (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=<optimized out>,
    callable=callable@entry=0x7fffb450e890, tuple=tuple@entry=0x7fffb5517090, kwargs=kwargs@entry=0x7fffb4341ab0)
    at Objects/call.c:273
#8  0x000055555597d43a in _PyObject_Call (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=callable@entry=0x7fffb450e890,
    args=args@entry=0x7fffb5517090, kwargs=kwargs@entry=0x7fffb4341ab0) at Objects/call.c:348
#9  0x000055555597d4ab in PyObject_Call (callable=callable@entry=0x7fffb450e890, args=args@entry=0x7fffb5517090,
    kwargs=kwargs@entry=0x7fffb4341ab0) at Objects/call.c:373
#10 0x0000555555d22e62 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:1355
#11 0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119

Edited to add:

8- segfault from calling __class__ on functions like atleast_1d

import numpy
numpy.atleast_1d.__class__()

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.

#0  0x00007ffff4359385 in dispatcher_dealloc ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x0000555555b70b19 in _Py_Dealloc (op=0x7fffb5c19cb0) at Objects/object.c:2939
#2  0x00007ffff4359c98 in dispatcher_new ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#3  0x0000555555bf74df in type_call (
    self=self@entry=0x7ffff4c38ac0 <PyArrayFunctionDispatcher_Type>, args=0x7fffb5b05090,
    kwds=kwds@entry=0x0) at Objects/typeobject.c:1985
#4  0x0000555555a48f82 in _PyObject_MakeTpCall (tstate=0x5555566c6300 <_PyRuntime+326528>,
    callable=0x7ffff4c38ac0 <PyArrayFunctionDispatcher_Type>, args=<optimized out>, nargs=0,
    keywords=0x0) at Objects/call.c:242
#5  0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>,
    frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#6  0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb544dc10,
    globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770)
    at Python/ceval.c:604
#7  0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb544dc10, globals=0x7fffb4755770,
    locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#8  builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0,
    nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#9  0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>,
    args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#10 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>,
    callable=0x7fffb425e780, args=0x7fffb5b05090, nargsf=140737352520448,
    kwnames=0x7ffff4c38acc <PyArrayFunctionDispatcher_Type+12>)
    at ./Include/internal/pycore_call.h:168
#11 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>,
    frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#12 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690,
    globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770)
    at Python/ceval.c:604
#13 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770,
    locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#14 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380,
    nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#15 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>,
    args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#16 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>,
    callable=0x7fffb425e780, args=0x7fffb5b05090, nargsf=140737352520448,
    kwnames=0x7ffff4c38acc <PyArrayFunctionDispatcher_Type+12>)
    at ./Include/internal/pycore_call.h:168
#17 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>,
    frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#18 0x0000555555fbbba3 in pymain_run_module (modname=0x5555562e34a0 <str> L"_pyrepl",
    set_argv0=set_argv0@entry=0) at Modules/main.c:349
#19 0x0000555555fbd3a9 in pymain_run_stdin (
    config=config@entry=0x555556697d88 <_PyRuntime+136712>) at Modules/main.c:575
#20 0x0000555555fbac61 in pymain_run_python (exitcode=0x7fffffffd7e4) at Modules/main.c:699
#21 Py_RunMain () at Modules/main.c:775
#22 0x0000555555fbb73e in pymain_main (args=<optimized out>) at Modules/main.c:805
#23 0x0000555555fbb8a4 in Py_BytesMain (argc=1, argv=<optimized out>) at Modules/main.c:829
#24 0x00007ffff7c2a3b8 in __libc_start_call_main (main=main@entry=0x55555588a630 <main>,
    argc=argc@entry=1, argv=argv@entry=0x7fffffffdbc8)
    at ../sysdeps/nptl/libc_start_call_main.h:58
#25 0x00007ffff7c2a47b in __libc_start_main_impl (main=0x55555588a630 <main>, argc=1,
    argv=0x7fffffffdbc8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
    stack_end=0x7fffffffdbb8) at ../csu/libc-start.c:360
#26 0x00005555557a9105 in _start ()

Formely #28788

9- segfault by rounding number by -2**31

import numpy
numpy.float128().round(-2**31)

Backtrace:

shell
Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007ffff436062a in PyArray_Round () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007ffff436062a in PyArray_Round () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007ffff43c6f31 in array_round () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x0000555555b661da in cfunction_call (func=0x7fffb4d52230, args=0x7fffb4bc71d0, kwargs=0x0) at Objects/methodobject.c:540
#3  0x0000555555a4aed3 in _PyObject_Call (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=<optimized out>, args=<optimized out>, kwargs=<optimized out>) at Objects/call.c:361
#4  0x00007ffff42c67c3 in gentype_generic_method ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#5  0x0000555555a70759 in method_vectorcall_VARARGS_KEYWORDS (func=0x7fffb50472b0, args=0x529000005840, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/descrobject.c:358
#6  0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb50472b0, args=0x5020000058f0, nargsf=1031, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#7  0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#8  0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4d91690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#9  0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4d91690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#10 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#11 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#12 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x5020000058f0, nargsf=1031, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#13 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#14 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#15 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#16 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#17 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#18 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x5020000058f0, nargsf=1031, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#19 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#20 0x0000555555fbbba3 in pymain_run_module (modname=0x5555562e34a0 <str> L"_pyrepl", set_argv0=set_argv0@entry=0) at Modules/main.c:349
#21 0x0000555555fbd3a9 in pymain_run_stdin (config=config@entry=0x555556697d88 <_PyRuntime+136712>) at Modules/main.c:575
#22 0x0000555555fbac61 in pymain_run_python (exitcode=0x7fffffffd7e4) at Modules/main.c:699
#23 Py_RunMain () at Modules/main.c:775
#24 0x0000555555fbb73e in pymain_main (args=<optimized out>) at Modules/main.c:805
#25 0x0000555555fbb8a4 in Py_BytesMain (argc=1, argv=<optimized out>) at Modules/main.c:829
#26 0x00007ffff7c2a3b8 in __libc_start_call_main (main=main@entry=0x55555588a630 <main>, argc=argc@entry=1, argv=argv@entry=0x7fffffffdbc8) at ../sysdeps/nptl/libc_start_call_main.h:58
#27 0x00007ffff7c2a47b in __libc_start_main_impl (main=0x55555588a630 <main>, argc=1, argv=0x7fffffffdbc8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
    stack_end=0x7fffffffdbb8) at ../csu/libc-start.c:360
#28 0x00005555557a9105 in _start ()

Formely #28787

10- Failed !PyErr_Occurred() assertion

import numpy
from collections import Counter
numpy.promote_types(Counter(), 1.1)

# or

numpy.clongdouble().getfield(Counter())

# or

numpy.long().sum(3655, Counter(), bytes(10 ** 5))

Backtrace:

python: Objects/descrobject.c:268: int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *): Assertion `!PyErr_Occurred()' failed.
Aborted

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7c4519e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28902 in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff7c2881e in __assert_fail_base (fmt=0x7ffff7dde2a0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5555561b23e0 <str> "!PyErr_Occurred()",
    file=file@entry=0x5555561b1040 <str> "Objects/descrobject.c", line=line@entry=268,
    function=function@entry=0x5555561b2420 <__PRETTY_FUNCTION__.method_check_args> "int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *)") at ./assert/assert.c:96
#6  0x00007ffff7c3b7c7 in __assert_fail (assertion=0x5555561b23e0 <str> "!PyErr_Occurred()", file=0x5555561b1040 <str> "Objects/descrobject.c", line=line@entry=268,
    function=0x5555561b2420 <__PRETTY_FUNCTION__.method_check_args> "int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *)") at ./assert/assert.c:105
#7  0x0000555555a761de in method_check_args (func=func@entry=0x7fffb40bb8b0, args=0x7ffff5d6bbe0, nargs=nargs@entry=2, kwnames=0x0) at Objects/descrobject.c:268
#8  0x0000555555a7104e in method_vectorcall_O (func=0x7fffb40bb8b0, args=0x405b1, nargsf=<optimized out>, kwnames=0x7ffff7ca3f1c <__GI___pthread_kill+284>) at Objects/descrobject.c:458
#9  0x0000555555c1dcb3 in _PyObject_VectorcallTstate (tstate=tstate@entry=0x5555566c6300 <_PyRuntime+326528>, callable=callable@entry=0x7fffb40bb8b0, args=0x405b1,
    args@entry=0x7ffff5d6bbe0, nargsf=6, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#10 0x0000555555c08f11 in vectorcall_unbound (tstate=0x5555566c6300 <_PyRuntime+326528>, func=0x7fffb40bb8b0, args=0x6, nargs=2, unbound=<optimized out>) at Objects/typeobject.c:2570
#11 vectorcall_method (name=0x555556686538 <_PyRuntime+64952>, args=args@entry=0x7ffff5d6bbe0, nargs=nargs@entry=2) at Objects/typeobject.c:2601
#12 0x0000555555c1c18e in slot_mp_subscript (self=0x7fffb4630c60, arg1=<optimized out>) at Objects/typeobject.c:9330
#13 0x00005555559ecc13 in PyObject_GetItem (o=0x405b1, o@entry=0x7fffb4630c60, key=0x405b1) at Objects/abstract.c:158
#14 0x00005555559fb209 in PyMapping_GetItemString (o=0x7fffb4630c60, key=<optimized out>) at Objects/abstract.c:2352
#15 0x00007ffff4390fe6 in _convert_from_any.part.0 ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#16 0x00007ffff4394a92 in PyArray_DescrConverter2 ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#17 0x00007ffff449074e in _npy_parse_arguments ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#18 0x00007ffff43d05d8 in array_promote_types () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#19 0x0000555555b64335 in cfunction_vectorcall_FASTCALL (func=<optimized out>, args=0x529000005848, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/methodobject.c:425
#20 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb4bd8270, args=0x405b1, nargsf=6, kwnames=0x98)
    at ./Include/internal/pycore_call.h:168
#21 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#22 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb54417d0, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#23 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb54417d0, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#24 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#25 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#26 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x405b1, nargsf=6, kwnames=0x98)
    at ./Include/internal/pycore_call.h:168
#27 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#28 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#29 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#30 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#31 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#32 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x405b1, nargsf=6, kwnames=0x98)

Formely #28783

11- Failed !PyErr_Occurred() assertion II

import numpy._core
f = numpy._core.float32()
f.put([[]], (), -2**31)

Backtrace:

Fatal Python error: _Py_CheckSlotResult: Slot __len__ of type list succeeded with an exception set
Python runtime state: initialized

Thread 1 "python" received signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7c4519e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28902 in __GI_abort () at ./stdlib/abort.c:79
#5  0x000055555581ae82 in fatal_error_exit (status=<optimized out>) at Python/pylifecycle.c:3160
#6  0x000055555581c8ed in fatal_error (fd=fd@entry=2, header=header@entry=0, prefix=prefix@entry=0x0,
    msg=msg@entry=0x0, status=status@entry=-1) at Python/pylifecycle.c:3376
#7  0x000055555581d189 in _Py_FatalErrorFormat (
    func=func@entry=0x5555559235e0 <__func__.21> "_Py_CheckSlotResult",
    format=format@entry=0x5555558ec840 "Slot %s of type %s succeeded with an exception set")
    at Python/pylifecycle.c:3422
#8  0x000055555567432a in _Py_CheckSlotResult (obj=obj@entry=0x7fffef283840,
    slot_name=slot_name@entry=0x5555558c1477 "__len__", success=success@entry=1) at Objects/call.c:88
#9  0x000055555565a289 in PySequence_Size (s=0x7fffef283840) at Objects/abstract.c:1734
#10 0x00007fff87331d70 in PyArray_DiscoverDTypeAndShape_Recursive ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#11 0x00007fff873323a5 in PyArray_DiscoverDTypeAndShape ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#12 0x00007fff87355bfb in PyArray_FromAny_int ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#13 0x00007fff87356153 in PyArray_FromAny ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#14 0x00007fff87384d8a in PyArray_PutTo ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#15 0x00007fff873979f5 in array_put ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#16 0x00005555556c6a5c in cfunction_call (func=func@entry=0x7fffec127350, args=args@entry=0x7fffdd568770,
    kwargs=kwargs@entry=0x0) at Objects/methodobject.c:540

Formely #28783

12- Slot * of type X succeeded with an exception set

import numpy

numpy.convolve.__wrapped__('a', [list[int], 1])
# or
numpy.polymul._implementation('a', [list[int], 1])

Backtrace:

Fatal Python error: _Py_CheckSlotResult: Slot * of type int succeeded with an exception set
Python runtime state: initialized
TypeError: can't multiply sequence by non-int of type 'types.GenericAlias'

Extension modules: numpy._core._multiarray_umath, numpy.linalg._umath_linalg (total: 2)
Aborted

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7c4519e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28902 in __GI_abort () at ./stdlib/abort.c:79
#5  0x0000555555f13714 in fatal_error_exit (status=status@entry=-1) at Python/pylifecycle.c:3160
#6  0x0000555555f133de in fatal_error (fd=fd@entry=2, header=header@entry=0, prefix=prefix@entry=0x0, msg=msg@entry=0x0, status=status@entry=-1) at Python/pylifecycle.c:3376
#7  0x0000555555f136ee in _Py_FatalErrorFormat (func=<optimized out>, format=<optimized out>) at Python/pylifecycle.c:3422
#8  0x0000555555a48370 in _Py_CheckSlotResult (obj=obj@entry=0x55555667dd38 <_PyRuntime+30136>, slot_name=slot_name@entry=0x555556194b60 <str> "*", success=<optimized out>)
    at Objects/call.c:80
#9  0x00005555559f2833 in binary_op1 (v=0x55555667dd38 <_PyRuntime+30136>, w=0x555556692dd0 <_PyRuntime+116304>, op_slot=op_slot@entry=16, op_name=0x555556194b60 <str> "*")
    at Objects/abstract.c:962
#10 0x00005555559f2bc8 in PyNumber_Multiply (v=0x40851, w=0x40851) at Objects/abstract.c:1179
#11 0x00007ffff4241cf3 in OBJECT_dot () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#12 0x00007ffff43d0fda in _pyarray_correlate () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#13 0x00007ffff43d23a2 in PyArray_Correlate () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#14 0x00007ffff43d25a4 in array_correlate () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#15 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000058d0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#16 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb4bd8040, args=0x40851, nargsf=6, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#17 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#18 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb5461690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#19 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb5461690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#20 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#21 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#22 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x40851, nargsf=6, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#23 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#24 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#25 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#26 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#27 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#28 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x40851, nargsf=6, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#29 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#30 0x0000555555fbbba3 in pymain_run_module (modname=0x5555562e34a0 <str> L"_pyrepl", set_argv0=set_argv0@entry=0) at Modules/main.c:349
#31 0x0000555555fbd3a9 in pymain_run_stdin (config=config@entry=0x555556697d88 <_PyRuntime+136712>) at Modules/main.c:575
#32 0x0000555555fbac61 in pymain_run_python (exitcode=0x7fffffffd7e4) at Modules/main.c:699
#33 Py_RunMain () at Modules/main.c:775
#34 0x0000555555fbb73e in pymain_main (args=<optimized out>) at Modules/main.c:805
#35 0x0000555555fbb8a4 in Py_BytesMain (argc=1, argv=<optimized out>) at Modules/main.c:829

Formely #28786

Python and NumPy Versions:

2.2.5
3.13.3+ experimental free-threading build (heads/3.13:d8b90117024, Apr 21 2025, 15:20:00) [GCC 11.4.0]

Runtime Environment:

[{'numpy_version': '2.2.5',
  'python': '3.13.3+ experimental free-threading build '
            '(heads/3.13:d8b90117024, Apr 21 2025, 15:20:00) [GCC 11.4.0]',
  'uname': uname_result(system='Linux', node='LAPTOP-CS6PE5KB', release='5.15.167.4-microsoft-standard-WSL2', version='#1 SMP Tue Nov 5 00:21:55 UTC 2024', machine='x86_64')},
 {'simd_extensions': {'baseline': ['SSE', 'SSE2', 'SSE3'],
                      'found': ['SSSE3',
                                'SSE41',
                                'POPCNT',
                                'SSE42',
                                'AVX',
                                'F16C',
                                'FMA3',
                                'AVX2'],
                      'not_found': ['AVX512F',
                                    'AVX512CD',
                                    'AVX512_KNL',
                                    'AVX512_KNM',
                                    'AVX512_SKX',
                                    'AVX512_CLX',
                                    'AVX512_CNL',
                                    'AVX512_ICL']}},
 {'architecture': 'Haswell',
  'filepath': '/home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy.libs/libscipy_openblas64_-6bb31eeb.so',
  'internal_api': 'openblas',
  'num_threads': 8,
  'prefix': 'libscipy_openblas',
  'threading_layer': 'pthreads',
  'user_api': 'blas',
  'version': '0.3.28'}]

Context for the issue:

I have been fuzzing Numpy using fusil by @vstinner. I realize these crashes are unlikely to be triggered in normal usage and therefore might be of low priority.

The fuzzing was done with an ASAN free-threading clang build and not confirmed on a GILfull non-sanitizer GCC build yet.

Metadata

Metadata

Assignees

No one assigned

    Labels

    sprintable - C

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions