[Numpy-discussion] segfault caused by incorrect Py_DECREF in ufunc

[Tom Denniston]

Below is the code around line 900 for ufuncobject.c
(http://svn.scipy.org/svn/numpy/trunk/numpy/core/src/ufuncobject.c)

There is a decref labeled with ">>>" below that is incorrect.  As per
the python documentation
(http://docs.python.org/api/dictObjects.html):

#PyObject* PyDict_GetItem( PyObject *p, PyObject *key)
#
#Return value: Borrowed reference.
#Return the object from dictionary p which has a key key. Return NULL
if the key #key is not present, but without setting an exception.

PyDict_GetItem returns a borrowed reference.  Therefore this code does
not own the contents to which the obj pointer points and should not
decref on it.  Simply removing the Py_DECREF(obj) line gets rid of the
segfault.

I was wondering if someone could confirm that my interpretation is
correct and remove the line.  I don't have access to the svn or know
how to change it.

Most people do not see this problem because it only affects user defined types.

--Tom




	if (userdef > 0) {
		PyObject *key, *obj;
                int ret;
		obj = NULL;
		key = PyInt_FromLong((long) userdef);
		if (key == NULL) return -1;
		obj = PyDict_GetItem(self->userloops, key);
		Py_DECREF(key);
		if (obj == NULL) {
			PyErr_SetString(PyExc_TypeError,
					"user-defined type used in ufunc" \
					" with no registered loops");
			return -1;
		}
                /* extract the correct function
                   data and argtypes
                */
                ret = _find_matching_userloop(obj, arg_types, scalars,
                                              function, data, self->nargs,
                                              self->nin);
>>>            Py_DECREF(obj);
                return ret;
	}