[pypy-issue] Issue #2789: Crash (cpyext?) in pypy3 (as of 2018-04-05) at numpy object array dealloc (pypy/pypy)

[pv]

New issue 2789: Crash (cpyext?) in pypy3 (as of 2018-04-05) at numpy object array dealloc
https://bitbucket.org/pypy/pypy/issues/2789/crash-cpyext-in-pypy3-as-of-2018-04-05-at

pv:

The following code crashes in pypy3 (bcbefe2f5e14, py3.5 branch as of 2018-04-05):
https://github.com/pv/crash-pypy-1/tree/3e47f83de863ab21dc2dac412963982104638032
using `pip install numpy==1.14.2`.

pypy3-5.10.1 doesn't crash.

gdb says
```
$ gdb --args pypy3 crash.py
...
/home/pauli/prj/scipy/scipy/tmp/pypy3bug/idl.py:281: UserWarning: Not able to verify number of bytes from header
  warnings.warn("Not able to verify number of bytes from header")
0 [55 66]
1 [55 66]
2 [55 66]
3 [55 66]
4 [55 66]
5 [55 66]

Program received signal SIGSEGV, Segmentation fault.
(gdb) bt
#0  0x00007ffff3e54168 in malloc_consolidate () from /lib64/libc.so.6
#1  0x00007ffff3e56f00 in _int_malloc () from /lib64/libc.so.6
#2  0x00007ffff3e587e3 in malloc () from /lib64/libc.so.6
#3  0x00007fffe479f00a in PyArray_IterNew (obj=0x1c3b430) at numpy/core/src/multiarray/iterators.c:290
#4  0x00007fffe483403e in PyArray_XDECREF (mp=0x1c3b430) at numpy/core/src/multiarray/refcount.c:168
#5  0x00007fffe46d81ec in array_dealloc (self=0x1c3b430) at numpy/core/src/multiarray/arrayobject.c:514
#6  0x00007ffff6429bfd in _PyPy_tuple_dealloc () from /usr/local/stow/pypy3+20180405/lib/pypy3+20180405/bin/libpypy3-c.so
#7  0x00007ffff5b35d8a in pypy_g.rawrefcount_perform () from /usr/local/stow/pypy3+20180405/lib/pypy3+20180405/bin/libpypy3-c.so
...
```
That part of Numpy code is trying to DECREF items contained in an object array, but not clear if the issue is actually at that point.

(Didn't manage to reduce this so far to a simpler testcase, sorry, just extracted from scipy test suite. Interestingly, numpy test suite doesn't crash.)