Skip to content

BUG: crashes found by fuzzing with fusil #28829

New issue
New issue
Open
Open
BUG: crashes found by fuzzing with fusil#28829
Labels
sprintable - C
@devdanzin

Description

@devdanzin
devdanzin
opened on Apr 26, 2025

These are some crashes found by fuzzing Numpy with fusil, condensed into a single issue as requested.

1- strings._expandtabs_length.reduce(numpy.zeros(200))

import numpy._core._strings

numpy._core.strings._expandtabs_length.reduce(numpy.zeros(200))

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb3907e4c in string_expandtabs_length_promoter(_object*, PyArray_DTypeMeta* const*, PyArray_DTypeMeta* const*, PyArray_DTypeMeta**) () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb3907e4c in string_expandtabs_length_promoter(_object*, PyArray_DTypeMeta* const*, PyArray_DTypeMeta* const*, PyArray_DTypeMeta**) ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007fffb38b2137 in call_promoter_and_recurse(_tagPyUFuncObject*, _object*, PyArray_DTypeMeta**, PyArray_DTypeMeta**, tagPyArrayObject* const*) ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x00007fffb38b1d0f in promote_and_get_info_and_ufuncimpl(_tagPyUFuncObject*, tagPyArrayObject* const*, PyArray_DTypeMeta**, PyArray_DTypeMeta**, unsigned char) ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#3  0x00007fffb38b26e1 in promote_and_get_ufuncimpl ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#4  0x00007fffb38b8a39 in reducelike_promote_and_resolve ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#5  0x00007fffb38c059d in PyUFunc_GenericReduction ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#6  0x00005555559a9204 in method_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb4b3aa40, args=0x629000005840, nargsf=<optimized out>,
    kwnames=<optimized out>) at Objects/descrobject.c:420
#7  0x0000555555977b32 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb4b3aa40,
    args=0x629000005840, nargsf=9223372036854775810, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#8  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb4b3aa40, args=args@entry=0x629000005840,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#9  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#10 0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119

2- numpy._core._multiarray_tests.incref_elide(int|str)

import numpy._core._multiarray_tests

numpy._core._multiarray_tests.incref_elide(int|str)

Backtrace:

Thread 1 "python" received signal SIGBUS, Bus error.
0x00007fffb37a5cec in PyArray_NewLikeArrayWithShape () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
(gdb) bt
#0  0x00007fffb37a5cec in PyArray_NewLikeArrayWithShape ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007fffb37a5eee in PyArray_NewLikeArray ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x00007fffb3794c2b in PyArray_NewCopy ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#3  0x00007ffff4010035 in incref_elide ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_tests.cpython-313t-x86_64-linux-gnu.so
#4  0x0000555555a937c7 in cfunction_call (func=func@entry=0x7fffb527f040, args=args@entry=0x7fffb5083b20, kwargs=kwargs@entry=0x0)
    at Objects/methodobject.c:551
#5  0x0000555555977439 in _PyObject_MakeTpCall (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>,
    callable=callable@entry=0x7fffb527f040, args=args@entry=0x629000005848, nargs=1, keywords=keywords@entry=0x0)
    at Objects/call.c:242
#6  0x0000555555977c61 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb527f040,
    args=0x629000005848, nargsf=<optimized out>, kwnames=0x0) at ./Include/internal/pycore_call.h:166
#7  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb527f040, args=args@entry=0x629000005848,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#8  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#9  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#10 _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb56d48d0,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816

3- numpy.lib._arraysetops_impl._array_converter().result_type()

Happens with _array_converter in many different modules.

import numpy.lib._arraysetops_impl

numpy.lib._arraysetops_impl._array_converter().result_type()

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb3792b67 in PyArray_PromoteDTypeSequence () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb3792b67 in PyArray_PromoteDTypeSequence ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007fffb377f3b0 in array_converter_result_type ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x00005555559a9204 in method_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb4bacfe0, args=0x629000005840, nargsf=<optimized out>,
    kwnames=<optimized out>) at Objects/descrobject.c:420
#3  0x0000555555977b32 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb4bacfe0,
    args=0x629000005840, nargsf=9223372036854775809, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#4  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb4bacfe0, args=args@entry=0x629000005840,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#5  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#6  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#7  _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb5878290,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816
#8  0x0000555555d51727 in PyEval_EvalCode (co=co@entry=0x7fffb4b6fc10, globals=globals@entry=0x7fffb4765770,
    locals=locals@entry=0x7fffb4765770) at Python/ceval.c:604
#9  0x0000555555cf441a in builtin_exec_impl (module=module@entry=0x7fffb425e080, source=<optimized out>, globals=0x7fffb4765770,
    locals=0x7fffb4765770, closure=0x0) at Python/bltinmodule.c:1143
#10 0x0000555555cf4a9d in builtin_exec (module=<optimized out>, args=0x6290000057e0, nargs=<optimized out>, kwnames=0x0)
    at Python/clinic/bltinmodule.c.h:556
#11 0x0000555555a93bfb in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb425e780, args=0x6290000057e0, nargsf=<optimized out>,
    kwnames=0x0) at Objects/methodobject.c:441
#12 0x0000555555977b32 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb425e780,
    args=0x6290000057e0, nargsf=9223372036854775810, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#13 0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb425e780, args=args@entry=0x6290000057e0,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#14 0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813

4- numpy.ctypeslib.flagsobj().__setitem__("<\x11\x9B", -6.4)

import numpy.ctypeslib

numpy.ctypeslib.flagsobj().__setitem__("<\x11\x9B", -6.4)

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb37d2ce3 in arrayflags_setitem () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb37d2ce3 in arrayflags_setitem ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x0000555555b1f667 in wrap_objobjargproc (self=<optimized out>, args=<optimized out>,
    wrapped=0x7fffb37d2cb0 <arrayflags_setitem>) at Objects/typeobject.c:8717
#2  0x00005555559a5307 in wrapperdescr_raw_call (kwds=0x0, args=0x7fffb5493730, self=0x7fffb492c6d0, descr=0x7fffb4baa030)
    at Objects/descrobject.c:531
#3  wrapperdescr_call (_descr=_descr@entry=0x7fffb4baa030, args=0x7fffb5493730, args@entry=0x7fffb58629b0, kwds=kwds@entry=0x0)
    at Objects/descrobject.c:569
#4  0x0000555555977439 in _PyObject_MakeTpCall (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>,
    callable=callable@entry=0x7fffb4baa030, args=args@entry=0x629000005840, nargs=3, keywords=keywords@entry=0x0)
    at Objects/call.c:242
#5  0x0000555555977c61 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb4baa030,
    args=0x629000005840, nargsf=<optimized out>, kwnames=0x0) at ./Include/internal/pycore_call.h:166
#6  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb4baa030, args=args@entry=0x629000005840,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#7  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#8  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#9  _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb5876550,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816
#10 0x0000555555d51727 in PyEval_EvalCode (co=co@entry=0x7fffb4f1eed0, globals=globals@entry=0x7fffb4765770,
    locals=locals@entry=0x7fffb4765770) at Python/ceval.c:604
#11 0x0000555555cf441a in builtin_exec_impl (module=module@entry=0x7fffb425e080, source=<optimized out>, globals=0x7fffb4765770,
    locals=0x7fffb4765770, closure=0x0) at Python/bltinmodule.c:1143
#12 0x0000555555cf4a9d in builtin_exec (module=<optimized out>, args=0x6290000057e0, nargs=<optimized out>, kwnames=0x0)
    at Python/clinic/bltinmodule.c.h:556
#13 0x0000555555a93bfb in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb425e780, args=0x6290000057e0, nargsf=<optimized out>,
    kwnames=0x0) at Objects/methodobject.c:441

5- numpy._core._umath_tests._pickleable_module_global_ufunc()

import numpy._core._umath_tests

numpy._core._umath_tests._pickleable_module_global_ufunc()

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb38b2623 in promote_and_get_ufuncimpl () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb38b2623 in promote_and_get_ufuncimpl ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007fffb38c345b in ufunc_generic_fastcall ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x0000555555977b32 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=0x7fffb4de1a50,
    args=0x629000005848, nargsf=9223372036854775808, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#3  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb4de1a50, args=args@entry=0x629000005848,
    nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#4  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#5  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#6  _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb5404750,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816
#7  0x0000555555d51727 in PyEval_EvalCode (co=co@entry=0x7fffb52cf610, globals=globals@entry=0x7fffb4765770,
    locals=locals@entry=0x7fffb4765770) at Python/ceval.c:604
#8  0x0000555555cf441a in builtin_exec_impl (module=module@entry=0x7fffb425e080, source=<optimized out>, globals=0x7fffb4765770,
    locals=0x7fffb4765770, closure=0x0) at Python/bltinmodule.c:1143
#9  0x0000555555cf4a9d in builtin_exec (module=<optimized out>, args=0x6290000057e0, nargs=<optimized out>, kwnames=0x0)
    at Python/clinic/bltinmodule.c.h:556

6- numpy._core.overrides._ArrayFunctionDispatcher()

import numpy._core.overrides

numpy._core.overrides._ArrayFunctionDispatcher()

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffb3783a95 in dispatcher_dealloc () from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007fffb3783a95 in dispatcher_dealloc ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x0000555555aa2632 in _Py_Dealloc (op=op@entry=0x7fffb529a110) at Objects/object.c:2939
#2  0x0000555555aa2a7c in _Py_MergeZeroLocalRefcount (op=0x7fffb529a110) at Objects/object.c:434
#3  0x00007fffb378437e in dispatcher_new ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#4  0x0000555555b44cdf in type_call (self=self@entry=0x7fffb3fd9a40 <PyArrayFunctionDispatcher_Type>,
    args=args@entry=0x5555565df9e0 <_PyRuntime+128544>, kwds=kwds@entry=0x0) at Objects/typeobject.c:1985
#5  0x0000555555977439 in _PyObject_MakeTpCall (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>,
    callable=callable@entry=0x7fffb3fd9a40 <PyArrayFunctionDispatcher_Type>, args=args@entry=0x629000005848, nargs=0,
    keywords=keywords@entry=0x0) at Objects/call.c:242
#6  0x0000555555977c61 in _PyObject_VectorcallTstate (tstate=0x55555660ff40 <_PyRuntime+326528>,
    callable=0x7fffb3fd9a40 <PyArrayFunctionDispatcher_Type>, args=0x629000005848, nargsf=<optimized out>, kwnames=0x0)
    at ./Include/internal/pycore_call.h:166
#7  0x0000555555977c8d in PyObject_Vectorcall (callable=callable@entry=0x7fffb3fd9a40 <PyArrayFunctionDispatcher_Type>,
    args=args@entry=0x629000005848, nargsf=<optimized out>, kwnames=kwnames@entry=0x0) at Objects/call.c:327
#8  0x0000555555d1e174 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:813
#9  0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119
#10 _PyEval_Vector (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=func@entry=0x7fffb5404ed0,
    locals=locals@entry=0x7fffb4765770, args=args@entry=0x0, argcount=argcount@entry=0, kwnames=kwnames@entry=0x0)
    at Python/ceval.c:1816
#11 0x0000555555d51727 in PyEval_EvalCode (co=co@entry=0x7fffb52cf790, globals=globals@entry=0x7fffb4765770,
    locals=locals@entry=0x7fffb4765770) at Python/ceval.c:604
#12 0x0000555555cf441a in builtin_exec_impl (module=module@entry=0x7fffb425e080, source=<optimized out>, globals=0x7fffb4765770,
    locals=0x7fffb4765770, closure=0x0) at Python/bltinmodule.c:1143
#13 0x0000555555cf4a9d in builtin_exec (module=<optimized out>, args=0x6290000057e0, nargs=<optimized out>, kwnames=0x0)
    at Python/clinic/bltinmodule.c.h:556
#14 0x0000555555a93bfb in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7fffb425e780, args=0x6290000057e0, nargsf=<optimized out>,
    kwnames=0x0) at Objects/methodobject.c:441

7- MaskedArray with invalid setflags segfaults

import numpy.ma

obj = numpy.ma.MaskedArray()

obj.setflags(None, None, {})
obj.__div__(None)

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x000055555592337b in Py_TYPE (ob=0x5b000005) at ./Include/object.h:336
336         return ob->ob_type;

#0  0x000055555592337b in Py_TYPE (ob=0x5b000005) at ./Include/object.h:336
#1  binary_op1 (v=v@entry=0x5b000005, w=w@entry=0x55555647bfe0 <_Py_NoneStruct>, op_slot=op_slot@entry=240,
    op_name=op_name@entry=0x5555560bc9e0 "/") at Objects/abstract.c:934
#2  0x0000555555923b90 in binary_op (v=0x5b000005, w=0x55555647bfe0 <_Py_NoneStruct>, op_slot=op_slot@entry=240,
    op_name=op_name@entry=0x5555560bc9e0 "/") at Objects/abstract.c:1000
#3  0x00005555559281a4 in PyNumber_TrueDivide (v=<optimized out>, w=<optimized out>) at Objects/abstract.c:1197
#4  0x00007fffb3711d4f in PyUFunc_OO_O ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#5  0x00007fffb38b4925 in generic_wrapped_legacy_loop ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#6  0x00007fffb38c4906 in ufunc_generic_fastcall ()
   from /home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#7  0x000055555597ccc7 in _PyVectorcall_Call (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, func=<optimized out>,
    callable=callable@entry=0x7fffb450e890, tuple=tuple@entry=0x7fffb5517090, kwargs=kwargs@entry=0x7fffb4341ab0)
    at Objects/call.c:273
#8  0x000055555597d43a in _PyObject_Call (tstate=0x55555660ff40 <_PyRuntime+326528>, callable=callable@entry=0x7fffb450e890,
    args=args@entry=0x7fffb5517090, kwargs=kwargs@entry=0x7fffb4341ab0) at Objects/call.c:348
#9  0x000055555597d4ab in PyObject_Call (callable=callable@entry=0x7fffb450e890, args=args@entry=0x7fffb5517090,
    kwargs=kwargs@entry=0x7fffb4341ab0) at Objects/call.c:373
#10 0x0000555555d22e62 in _PyEval_EvalFrameDefault (tstate=tstate@entry=0x55555660ff40 <_PyRuntime+326528>, frame=<optimized out>,
    throwflag=throwflag@entry=0) at Python/generated_cases.c.h:1355
#11 0x0000555555d51500 in _PyEval_EvalFrame (throwflag=0, frame=<optimized out>, tstate=0x55555660ff40 <_PyRuntime+326528>)
    at ./Include/internal/pycore_ceval.h:119

Edited to add:

8- segfault from calling __class__ on functions like atleast_1d

import numpy
numpy.atleast_1d.__class__()

Backtrace:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.

#0  0x00007ffff4359385 in dispatcher_dealloc ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x0000555555b70b19 in _Py_Dealloc (op=0x7fffb5c19cb0) at Objects/object.c:2939
#2  0x00007ffff4359c98 in dispatcher_new ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#3  0x0000555555bf74df in type_call (
    self=self@entry=0x7ffff4c38ac0 <PyArrayFunctionDispatcher_Type>, args=0x7fffb5b05090,
    kwds=kwds@entry=0x0) at Objects/typeobject.c:1985
#4  0x0000555555a48f82 in _PyObject_MakeTpCall (tstate=0x5555566c6300 <_PyRuntime+326528>,
    callable=0x7ffff4c38ac0 <PyArrayFunctionDispatcher_Type>, args=<optimized out>, nargs=0,
    keywords=0x0) at Objects/call.c:242
#5  0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>,
    frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#6  0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb544dc10,
    globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770)
    at Python/ceval.c:604
#7  0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb544dc10, globals=0x7fffb4755770,
    locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#8  builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0,
    nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#9  0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>,
    args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#10 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>,
    callable=0x7fffb425e780, args=0x7fffb5b05090, nargsf=140737352520448,
    kwnames=0x7ffff4c38acc <PyArrayFunctionDispatcher_Type+12>)
    at ./Include/internal/pycore_call.h:168
#11 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>,
    frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#12 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690,
    globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770)
    at Python/ceval.c:604
#13 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770,
    locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#14 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380,
    nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#15 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>,
    args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#16 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>,
    callable=0x7fffb425e780, args=0x7fffb5b05090, nargsf=140737352520448,
    kwnames=0x7ffff4c38acc <PyArrayFunctionDispatcher_Type+12>)
    at ./Include/internal/pycore_call.h:168
#17 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>,
    frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#18 0x0000555555fbbba3 in pymain_run_module (modname=0x5555562e34a0 <str> L"_pyrepl",
    set_argv0=set_argv0@entry=0) at Modules/main.c:349
#19 0x0000555555fbd3a9 in pymain_run_stdin (
    config=config@entry=0x555556697d88 <_PyRuntime+136712>) at Modules/main.c:575
#20 0x0000555555fbac61 in pymain_run_python (exitcode=0x7fffffffd7e4) at Modules/main.c:699
#21 Py_RunMain () at Modules/main.c:775
#22 0x0000555555fbb73e in pymain_main (args=<optimized out>) at Modules/main.c:805
#23 0x0000555555fbb8a4 in Py_BytesMain (argc=1, argv=<optimized out>) at Modules/main.c:829
#24 0x00007ffff7c2a3b8 in __libc_start_call_main (main=main@entry=0x55555588a630 <main>,
    argc=argc@entry=1, argv=argv@entry=0x7fffffffdbc8)
    at ../sysdeps/nptl/libc_start_call_main.h:58
#25 0x00007ffff7c2a47b in __libc_start_main_impl (main=0x55555588a630 <main>, argc=1,
    argv=0x7fffffffdbc8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
    stack_end=0x7fffffffdbb8) at ../csu/libc-start.c:360
#26 0x00005555557a9105 in _start ()

Formely #28788

9- segfault by rounding number by -2**31

import numpy
numpy.float128().round(-2**31)

Backtrace:

shell
Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007ffff436062a in PyArray_Round () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so

#0  0x00007ffff436062a in PyArray_Round () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#1  0x00007ffff43c6f31 in array_round () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#2  0x0000555555b661da in cfunction_call (func=0x7fffb4d52230, args=0x7fffb4bc71d0, kwargs=0x0) at Objects/methodobject.c:540
#3  0x0000555555a4aed3 in _PyObject_Call (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=<optimized out>, args=<optimized out>, kwargs=<optimized out>) at Objects/call.c:361
#4  0x00007ffff42c67c3 in gentype_generic_method ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#5  0x0000555555a70759 in method_vectorcall_VARARGS_KEYWORDS (func=0x7fffb50472b0, args=0x529000005840, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/descrobject.c:358
#6  0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb50472b0, args=0x5020000058f0, nargsf=1031, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#7  0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#8  0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4d91690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#9  0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4d91690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#10 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#11 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#12 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x5020000058f0, nargsf=1031, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#13 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#14 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#15 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#16 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#17 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#18 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x5020000058f0, nargsf=1031, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#19 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#20 0x0000555555fbbba3 in pymain_run_module (modname=0x5555562e34a0 <str> L"_pyrepl", set_argv0=set_argv0@entry=0) at Modules/main.c:349
#21 0x0000555555fbd3a9 in pymain_run_stdin (config=config@entry=0x555556697d88 <_PyRuntime+136712>) at Modules/main.c:575
#22 0x0000555555fbac61 in pymain_run_python (exitcode=0x7fffffffd7e4) at Modules/main.c:699
#23 Py_RunMain () at Modules/main.c:775
#24 0x0000555555fbb73e in pymain_main (args=<optimized out>) at Modules/main.c:805
#25 0x0000555555fbb8a4 in Py_BytesMain (argc=1, argv=<optimized out>) at Modules/main.c:829
#26 0x00007ffff7c2a3b8 in __libc_start_call_main (main=main@entry=0x55555588a630 <main>, argc=argc@entry=1, argv=argv@entry=0x7fffffffdbc8) at ../sysdeps/nptl/libc_start_call_main.h:58
#27 0x00007ffff7c2a47b in __libc_start_main_impl (main=0x55555588a630 <main>, argc=1, argv=0x7fffffffdbc8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>,
    stack_end=0x7fffffffdbb8) at ../csu/libc-start.c:360
#28 0x00005555557a9105 in _start ()

Formely #28787

10- Failed !PyErr_Occurred() assertion

import numpy
from collections import Counter
numpy.promote_types(Counter(), 1.1)

# or

numpy.clongdouble().getfield(Counter())

# or

numpy.long().sum(3655, Counter(), bytes(10 ** 5))

Backtrace:

python: Objects/descrobject.c:268: int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *): Assertion `!PyErr_Occurred()' failed.
Aborted

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7c4519e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28902 in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff7c2881e in __assert_fail_base (fmt=0x7ffff7dde2a0 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x5555561b23e0 <str> "!PyErr_Occurred()",
    file=file@entry=0x5555561b1040 <str> "Objects/descrobject.c", line=line@entry=268,
    function=function@entry=0x5555561b2420 <__PRETTY_FUNCTION__.method_check_args> "int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *)") at ./assert/assert.c:96
#6  0x00007ffff7c3b7c7 in __assert_fail (assertion=0x5555561b23e0 <str> "!PyErr_Occurred()", file=0x5555561b1040 <str> "Objects/descrobject.c", line=line@entry=268,
    function=0x5555561b2420 <__PRETTY_FUNCTION__.method_check_args> "int method_check_args(PyObject *, PyObject *const *, Py_ssize_t, PyObject *)") at ./assert/assert.c:105
#7  0x0000555555a761de in method_check_args (func=func@entry=0x7fffb40bb8b0, args=0x7ffff5d6bbe0, nargs=nargs@entry=2, kwnames=0x0) at Objects/descrobject.c:268
#8  0x0000555555a7104e in method_vectorcall_O (func=0x7fffb40bb8b0, args=0x405b1, nargsf=<optimized out>, kwnames=0x7ffff7ca3f1c <__GI___pthread_kill+284>) at Objects/descrobject.c:458
#9  0x0000555555c1dcb3 in _PyObject_VectorcallTstate (tstate=tstate@entry=0x5555566c6300 <_PyRuntime+326528>, callable=callable@entry=0x7fffb40bb8b0, args=0x405b1,
    args@entry=0x7ffff5d6bbe0, nargsf=6, kwnames=0x0) at ./Include/internal/pycore_call.h:168
#10 0x0000555555c08f11 in vectorcall_unbound (tstate=0x5555566c6300 <_PyRuntime+326528>, func=0x7fffb40bb8b0, args=0x6, nargs=2, unbound=<optimized out>) at Objects/typeobject.c:2570
#11 vectorcall_method (name=0x555556686538 <_PyRuntime+64952>, args=args@entry=0x7ffff5d6bbe0, nargs=nargs@entry=2) at Objects/typeobject.c:2601
#12 0x0000555555c1c18e in slot_mp_subscript (self=0x7fffb4630c60, arg1=<optimized out>) at Objects/typeobject.c:9330
#13 0x00005555559ecc13 in PyObject_GetItem (o=0x405b1, o@entry=0x7fffb4630c60, key=0x405b1) at Objects/abstract.c:158
#14 0x00005555559fb209 in PyMapping_GetItemString (o=0x7fffb4630c60, key=<optimized out>) at Objects/abstract.c:2352
#15 0x00007ffff4390fe6 in _convert_from_any.part.0 ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#16 0x00007ffff4394a92 in PyArray_DescrConverter2 ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#17 0x00007ffff449074e in _npy_parse_arguments ()
   from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#18 0x00007ffff43d05d8 in array_promote_types () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#19 0x0000555555b64335 in cfunction_vectorcall_FASTCALL (func=<optimized out>, args=0x529000005848, nargsf=<optimized out>, kwnames=<optimized out>) at Objects/methodobject.c:425
#20 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb4bd8270, args=0x405b1, nargsf=6, kwnames=0x98)
    at ./Include/internal/pycore_call.h:168
#21 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#22 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb54417d0, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#23 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb54417d0, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#24 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#25 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#26 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x405b1, nargsf=6, kwnames=0x98)
    at ./Include/internal/pycore_call.h:168
#27 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#28 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#29 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#30 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#31 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#32 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x405b1, nargsf=6, kwnames=0x98)

Formely #28783

11- Failed !PyErr_Occurred() assertion II

import numpy._core
f = numpy._core.float32()
f.put([[]], (), -2**31)

Backtrace:

Fatal Python error: _Py_CheckSlotResult: Slot __len__ of type list succeeded with an exception set
Python runtime state: initialized

Thread 1 "python" received signal SIGABRT, Aborted.

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7c4519e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28902 in __GI_abort () at ./stdlib/abort.c:79
#5  0x000055555581ae82 in fatal_error_exit (status=<optimized out>) at Python/pylifecycle.c:3160
#6  0x000055555581c8ed in fatal_error (fd=fd@entry=2, header=header@entry=0, prefix=prefix@entry=0x0,
    msg=msg@entry=0x0, status=status@entry=-1) at Python/pylifecycle.c:3376
#7  0x000055555581d189 in _Py_FatalErrorFormat (
    func=func@entry=0x5555559235e0 <__func__.21> "_Py_CheckSlotResult",
    format=format@entry=0x5555558ec840 "Slot %s of type %s succeeded with an exception set")
    at Python/pylifecycle.c:3422
#8  0x000055555567432a in _Py_CheckSlotResult (obj=obj@entry=0x7fffef283840,
    slot_name=slot_name@entry=0x5555558c1477 "__len__", success=success@entry=1) at Objects/call.c:88
#9  0x000055555565a289 in PySequence_Size (s=0x7fffef283840) at Objects/abstract.c:1734
#10 0x00007fff87331d70 in PyArray_DiscoverDTypeAndShape_Recursive ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#11 0x00007fff873323a5 in PyArray_DiscoverDTypeAndShape ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#12 0x00007fff87355bfb in PyArray_FromAny_int ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#13 0x00007fff87356153 in PyArray_FromAny ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#14 0x00007fff87384d8a in PyArray_PutTo ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#15 0x00007fff873979f5 in array_put ()
   from /home/danzin/venvs/3.13_pandas_gilfull_venv/lib/python3.13/site-packages/numpy/_core/_multiarray_umath.cpython-313-x86_64-linux-gnu.so
#16 0x00005555556c6a5c in cfunction_call (func=func@entry=0x7fffec127350, args=args@entry=0x7fffdd568770,
    kwargs=kwargs@entry=0x0) at Objects/methodobject.c:540

Formely #28783

12- Slot * of type X succeeded with an exception set

import numpy

numpy.convolve.__wrapped__('a', [list[int], 1])
# or
numpy.polymul._implementation('a', [list[int], 1])

Backtrace:

Fatal Python error: _Py_CheckSlotResult: Slot * of type int succeeded with an exception set
Python runtime state: initialized
TypeError: can't multiply sequence by non-int of type 'types.GenericAlias'

Extension modules: numpy._core._multiarray_umath, numpy.linalg._umath_linalg (total: 2)
Aborted

#0  __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=0) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7c4519e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c28902 in __GI_abort () at ./stdlib/abort.c:79
#5  0x0000555555f13714 in fatal_error_exit (status=status@entry=-1) at Python/pylifecycle.c:3160
#6  0x0000555555f133de in fatal_error (fd=fd@entry=2, header=header@entry=0, prefix=prefix@entry=0x0, msg=msg@entry=0x0, status=status@entry=-1) at Python/pylifecycle.c:3376
#7  0x0000555555f136ee in _Py_FatalErrorFormat (func=<optimized out>, format=<optimized out>) at Python/pylifecycle.c:3422
#8  0x0000555555a48370 in _Py_CheckSlotResult (obj=obj@entry=0x55555667dd38 <_PyRuntime+30136>, slot_name=slot_name@entry=0x555556194b60 <str> "*", success=<optimized out>)
    at Objects/call.c:80
#9  0x00005555559f2833 in binary_op1 (v=0x55555667dd38 <_PyRuntime+30136>, w=0x555556692dd0 <_PyRuntime+116304>, op_slot=op_slot@entry=16, op_name=0x555556194b60 <str> "*")
    at Objects/abstract.c:962
#10 0x00005555559f2bc8 in PyNumber_Multiply (v=0x40851, w=0x40851) at Objects/abstract.c:1179
#11 0x00007ffff4241cf3 in OBJECT_dot () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#12 0x00007ffff43d0fda in _pyarray_correlate () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#13 0x00007ffff43d23a2 in PyArray_Correlate () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#14 0x00007ffff43d25a4 in array_correlate () from /home/danzin/venvs/3.13_upstream_fusil_venv/lib/python3.13t/site-packages/numpy/_core/_multiarray_umath.cpython-313t-x86_64-linux-gnu.so
#15 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000058d0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#16 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb4bd8040, args=0x40851, nargsf=6, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#17 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#18 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb5461690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#19 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb5461690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#20 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x5290000057e0, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#21 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x5290000057e0, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#22 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x40851, nargsf=6, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#23 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#24 0x0000555555dac3eb in PyEval_EvalCode (co=co@entry=0x7fffb4f01690, globals=globals@entry=0x7fffb4755770, locals=locals@entry=0x7fffb4755770) at Python/ceval.c:604
#25 0x0000555555da0ac6 in builtin_exec_impl (source=0x7fffb4f01690, globals=0x7fffb4755770, locals=0x7fffb4755770, closure=0x0, module=<optimized out>) at Python/bltinmodule.c:1143
#26 builtin_exec (module=<optimized out>, args=<optimized out>, args@entry=0x529000005380, nargs=nargs@entry=2, kwnames=kwnames@entry=0x0) at Python/clinic/bltinmodule.c.h:556
#27 0x0000555555b645ca in cfunction_vectorcall_FASTCALL_KEYWORDS (func=<optimized out>, args=0x529000005380, nargsf=<optimized out>, kwnames=0x0) at Objects/methodobject.c:441
#28 0x0000555555a484db in _PyObject_VectorcallTstate (tstate=0x5555566c6300 <_PyRuntime+326528>, callable=0x7fffb425e780, args=0x40851, nargsf=6, kwnames=0x0)
    at ./Include/internal/pycore_call.h:168
#29 0x0000555555dbd570 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at Python/generated_cases.c.h:813
#30 0x0000555555fbbba3 in pymain_run_module (modname=0x5555562e34a0 <str> L"_pyrepl", set_argv0=set_argv0@entry=0) at Modules/main.c:349
#31 0x0000555555fbd3a9 in pymain_run_stdin (config=config@entry=0x555556697d88 <_PyRuntime+136712>) at Modules/main.c:575
#32 0x0000555555fbac61 in pymain_run_python (exitcode=0x7fffffffd7e4) at Modules/main.c:699
#33 Py_RunMain () at Modules/main.c:775
#34 0x0000555555fbb73e in pymain_main (args=<optimized out>) at Modules/main.c:805
#35 0x0000555555fbb8a4 in Py_BytesMain (argc=1, argv=<optimized out>) at Modules/main.c:829

Formely #28786

Python and NumPy Versions:

2.2.5
3.13.3+ experimental free-threading build (heads/3.13:d8b90117024, Apr 21 2025, 15:20:00) [GCC 11.4.0]

Runtime Environment:

[{'numpy_version': '2.2.5',
  'python': '3.13.3+ experimental free-threading build '
            '(heads/3.13:d8b90117024, Apr 21 2025, 15:20:00) [GCC 11.4.0]',
  'uname': uname_result(system='Linux', node='LAPTOP-CS6PE5KB', release='5.15.167.4-microsoft-standard-WSL2', version='#1 SMP Tue Nov 5 00:21:55 UTC 2024', machine='x86_64')},
 {'simd_extensions': {'baseline': ['SSE', 'SSE2', 'SSE3'],
                      'found': ['SSSE3',
                                'SSE41',
                                'POPCNT',
                                'SSE42',
                                'AVX',
                                'F16C',
                                'FMA3',
                                'AVX2'],
                      'not_found': ['AVX512F',
                                    'AVX512CD',
                                    'AVX512_KNL',
                                    'AVX512_KNM',
                                    'AVX512_SKX',
                                    'AVX512_CLX',
                                    'AVX512_CNL',
                                    'AVX512_ICL']}},
 {'architecture': 'Haswell',
  'filepath': '/home/danzin/venvs/3.13_upstream_venv/lib/python3.13t/site-packages/numpy.libs/libscipy_openblas64_-6bb31eeb.so',
  'internal_api': 'openblas',
  'num_threads': 8,
  'prefix': 'libscipy_openblas',
  'threading_layer': 'pthreads',
  'user_api': 'blas',
  'version': '0.3.28'}]

Context for the issue:

I have been fuzzing Numpy using fusil by @vstinner. I realize these crashes are unlikely to be triggered in normal usage and therefore might be of low priority.

The fuzzing was done with an ASAN free-threading clang build and not confirmed on a GILfull non-sanitizer GCC build yet.

Metadata

Metadata

Assignees

No one assigned

    Labels

    sprintable - C

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions
      pFad - Phonifier reborn

      Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

      Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


      Alternative Proxies:

      Alternative Proxy

      pFad Proxy

      pFad v3 Proxy

      pFad v4 Proxy