Commit 96cee0b
committed
BUG: core: result_type(0, np.timedelta64(4)) would seg. fault.
Before this change, the line in convert_datatype.c
result = PyArray_CastDescrToDType(all_descriptors[0], common_dtype);
would trigger a seg. fault with a call such as
np.result_type(0, np.timedelta64(4))
The problem was that `all_descriptors[0]` was NULL, and it was
dereferenced in PyArray_CastDescrToDType.
The code in the loop that followed the above line avoided passing
NULL values in all_descriptors[i] to PyArray_CastDescrToDType by
checking that the corresponding input argument to `result_type`
was not a Python scalar. A different code path was taken in that
case. The seg. fault is fixed by applying that same check to the
first argument.
Closes gh-200077.1 parent 286e6b8 commit 96cee0b
2 files changed
Lines changed: 49 additions & 20 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1548,6 +1548,40 @@ should_use_min_scalar(npy_intp narrs, PyArrayObject **arr, | |||
| 1548 | 1548 | } | |
| 1549 | 1549 | ||
| 1550 | 1550 | ||
| 1551 | + /* | ||
| 1552 | + * Utility function used in PyArray_ResultType. | ||
| 1553 | + * See that function for the meaning and contents of the parameters. | ||
| 1554 | + */ | ||
| 1555 | + static PyArray_Descr * | ||
| 1556 | + get_dtype_from_descr_and_common( | ||
| 1557 | + npy_intp i, | ||
| 1558 | + PyArrayObject *arrs[], | ||
| 1559 | + npy_intp ndtypes, | ||
| 1560 | + PyArray_Descr *descriptor, | ||
| 1561 | + PyArray_DTypeMeta *common_dtype) | ||
| 1562 | + { | ||
| 1563 | + PyArray_Descr *curr; | ||
| 1564 | + if (NPY_LIKELY(i < ndtypes || | ||
| 1565 | + !(PyArray_FLAGS(arrs[i-ndtypes]) & _NPY_ARRAY_WAS_PYSCALAR))) { | ||
| 1566 | + curr = PyArray_CastDescrToDType(descriptor, common_dtype); | ||
| 1567 | + } | ||
| 1568 | + else { | ||
| 1569 | + /* | ||
| 1570 | + * Unlike `PyArray_CastToDTypeAndPromoteDescriptors`, deal with | ||
| 1571 | + * plain Python values "graciously". This recovers the original | ||
| 1572 | + * value the long route, but it should almost never happen... | ||
| 1573 | + */ | ||
| 1574 | + PyObject *tmp = PyArray_GETITEM(arrs[i-ndtypes], | ||
| 1575 | + PyArray_BYTES(arrs[i-ndtypes])); | ||
| 1576 | + if (tmp == NULL) { | ||
| 1577 | + return NULL; | ||
| 1578 | + } | ||
| 1579 | + curr = NPY_DT_CALL_discover_descr_from_pyobject(common_dtype, tmp); | ||
| 1580 | + Py_DECREF(tmp); | ||
| 1581 | + } | ||
| 1582 | + return curr; | ||
| 1583 | + } | ||
| 1584 | + | ||
| 1551 | 1585 | /*NUMPY_API | |
| 1552 | 1586 | * | |
| 1553 | 1587 | * Produces the result type of a bunch of inputs, using the same rules | |
@@ -1684,28 +1718,15 @@ PyArray_ResultType( | |||
| 1684 | 1718 | result = NPY_DT_CALL_default_descr(common_dtype); | |
| 1685 | 1719 | } | |
| 1686 | 1720 | else { | |
| 1687 | - result = PyArray_CastDescrToDType(all_descriptors[0], common_dtype); | ||
| 1721 | + result = get_dtype_from_descr_and_common( | ||
| 1722 | + 0, arrs, ndtypes, all_descriptors[0], common_dtype); | ||
| 1723 | + if (result == NULL) { | ||
| 1724 | + goto error; | ||
| 1725 | + } | ||
| 1688 | 1726 | ||
| 1689 | 1727 | for (npy_intp i = 1; i < ndtypes+narrs; i++) { | |
| 1690 | - PyArray_Descr *curr; | ||
| 1691 | - if (NPY_LIKELY(i < ndtypes || | ||
| 1692 | - !(PyArray_FLAGS(arrs[i-ndtypes]) & _NPY_ARRAY_WAS_PYSCALAR))) { | ||
| 1693 | - curr = PyArray_CastDescrToDType(all_descriptors[i], common_dtype); | ||
| 1694 | - } | ||
| 1695 | - else { | ||
| 1696 | - /* | ||
| 1697 | - * Unlike `PyArray_CastToDTypeAndPromoteDescriptors` deal with | ||
| 1698 | - * plain Python values "graciously". This recovers the original | ||
| 1699 | - * value the long route, but it should almost never happen... | ||
| 1700 | - */ | ||
| 1701 | - PyObject *tmp = PyArray_GETITEM( | ||
| 1702 | - arrs[i-ndtypes], PyArray_BYTES(arrs[i-ndtypes])); | ||
| 1703 | - if (tmp == NULL) { | ||
| 1704 | - goto error; | ||
| 1705 | - } | ||
| 1706 | - curr = NPY_DT_CALL_discover_descr_from_pyobject(common_dtype, tmp); | ||
| 1707 | - Py_DECREF(tmp); | ||
| 1708 | - } | ||
| 1728 | + PyArray_Descr *curr = get_dtype_from_descr_and_common( | ||
| 1729 | + i, arrs, ndtypes, all_descriptors[i], common_dtype); | ||
| 1709 | 1730 | if (curr == NULL) { | |
| 1710 | 1731 | goto error; | |
| 1711 | 1732 | } | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -1590,6 +1590,14 @@ def test_subscript_scalar(self) -> None: | |||
| 1590 | 1590 | assert np.dtype[Any] | |
| 1591 | 1591 | ||
| 1592 | 1592 | ||
| 1593 | + def test_result_type_integers_and_unitless_timedelta64(): | ||
| 1594 | + # Regression test for gh-200077. The following call of `result_type` | ||
| 1595 | + # would cause a seg. fault. | ||
| 1596 | + td = np.timedelta64(4) | ||
| 1597 | + result = np.result_type(0, td) | ||
| 1598 | + assert_dtype_equal(result, td.dtype) | ||
| 1599 | + | ||
| 1600 | + | ||
| 1593 | 1601 | @pytest.mark.skipif(sys.version_info >= (3, 9), reason="Requires python 3.8") | |
| 1594 | 1602 | def test_class_getitem_38() -> None: | |
| 1595 | 1603 | match = "Type subscription requires python >= 3.9" | |
0 commit comments