BUG: avoid segmentation fault in string_expandtabs_length_promoter
#29368
Conversation
riku-sakamoto
force-pushed
the
fix_expandtabs_length_segfault
branch
from
13d91c7 to
1aae38f
Compare
|
ping @lysnikolaou |
| new_op_dtypes[0] = op_dtypes[0]; | ||
| PyArray_DTypeMeta* _op_dtype = op_dtypes[0] ? op_dtypes[0] : op_dtypes[1]; | ||
| Py_INCREF(_op_dtype); | ||
| new_op_dtypes[0] = _op_dtype; |
There was a problem hiding this comment.
This is a bit of a ridiculous call anyway, since reducing doesn't make sense.
But if we want to put this in, please try with just making the old code an XINCREF instead should also work and makes more sense than something effectively random/wrong.
There was a problem hiding this comment.
Thank you for your comment! I agree.
I fixed my code to use Py_XINCREF instead.
…gth.reduce` Fixes the first item of numpy#28829. Use `Py_XINCREF` instead of `Py_INCREF` to safely handle the case where `op_dtypes[0]` is NULL
riku-sakamoto
force-pushed
the
fix_expandtabs_length_segfault
branch
from
1aae38f to
71a1502
Compare
|
Please add a test |
Thank you for your check! I added a test. |
|
CI tests on ARM64 are failing, and it seems to be related to the latest Python 3.11.14 release (Oct 9, 2025). |
|
I checked that the fix indeed prevents the segfault, and that the tests hit the desired codepath. Note that |
|
Thanks @riku-sakamoto |
5 participants
Fix to use
Py_XINCREFinstead ofPy_INCREFto safely handle the case whereop_dtypes[0]is NULLRoot Cause
string_expandtabs_length_promoter, the first item ofop_dtypescan be NULL.Rationale
ops, legacy type resolution does not handle NULL well. Therefore, I changed the logic to use the second item instead.Outcome
numpy._core.strings._expandtabs_length.reduce(numpy.zeros(200))now raises aUFuncTypeError, instead of causing a segmentation fault.