BUG: avoid segmentation fault in string_expandtabs_length_promoter

Fixes the first item in #28829. `op_dtypes[0]` may be null, so use `op_dtypes[1]` instead.
numpy · riku-sakamoto · Jul 13, 2025 · Jul 13, 2025 · 1aae38fcec81efd9c8c7eaed83b65e9f29de2252
commit 1aae38fcec81efd9c8c7eaed83b65e9f29de2252
diff --git a/numpy/_core/src/umath/string_ufuncs.cpp b/numpy/_core/src/umath/string_ufuncs.cpp
@@ -941,8 +941,9 @@ string_expandtabs_length_promoter(PyObject *NPY_UNUSED(ufunc),
         PyArray_DTypeMeta *const op_dtypes[], PyArray_DTypeMeta *const signature[],
         PyArray_DTypeMeta *new_op_dtypes[])
 {
-    Py_INCREF(op_dtypes[0]);
-    new_op_dtypes[0] = op_dtypes[0];
+    PyArray_DTypeMeta* _op_dtype = op_dtypes[0] ? op_dtypes[0] : op_dtypes[1];
+    Py_INCREF(_op_dtype);
+    new_op_dtypes[0] = _op_dtype;
     new_op_dtypes[1] = NPY_DT_NewRef(&PyArray_Int64DType);
     new_op_dtypes[2] = PyArray_DTypeFromTypeNum(NPY_DEFAULT_INT);
     return 0;