Skip to content

BUG: fix np.fromiter corruption when reusing a StringDType instance - #32012

Merged
ngoldbaum merged 6 commits into
numpy:mainfrom
Yeshwanth-G:fromiter_reuse_segfault
Jul 17, 2026
Merged

BUG: fix np.fromiter corruption when reusing a StringDType instance #32012
ngoldbaum merged 6 commits into
numpy:mainfrom
Yeshwanth-G:fromiter_reuse_segfault

Conversation

@Yeshwanth-G

@Yeshwanth-G Yeshwanth-G commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

PR summary

Fixes #32013

np.fromiter is buggy for StringDtype arrays. Specifically, when the dtype instance is already owned by someother array,
it creates corrupted structures since it re-uses the input dtype instance to create the output array.

This PR fixes this issue to avoid using the input dtype descriptor to write the output.

Reproducer which this PR fixes:

In [2]: sd = np.dtypes.StringDType()

In [3]: a = ["a"*18, "b"*18]*10_000

In [4]: np.fromiter(iter(a), dtype=sd, count=len(a))
Out[4]: 
array(['aaaaaaaaaaaaaaaaaa', 'bbbbbbbbbbbbbbbbbb', 'aaaaaaaaaaaaaaaaaa',
       ..., 'bbbbbbbbbbbbbbbbbb', 'aaaaaaaaaaaaaaaaaa',
       'bbbbbbbbbbbbbbbbbb'], shape=(20000,), dtype=StringDType())

In [5]: np.fromiter(iter(a), dtype=sd, count=len(a))
Out[5]: Fatal Python error: Segmentation fault

AI Disclosure

I’ve used Claude Opus to shepherd this along.

Gopu Yeshwanth Reddy added 2 commits July 14, 2026 10:10
    PyArray_FromIter packed values using the caller-supplied ``dtype`` rather
    than the descriptor of the array it actually allocated.  Those differ when
    PyArray_NewFromDescr returns a distinct descriptor -- notably for
    StringDType, where reusing an already array-owned instance yields a clone
    with its own string arena.  Packing then wrote the strings into the
    original instance's arena while the array's descriptor referenced a
    different one, so on cleanup the data was freed against the wrong
    (already-freed) arena, corrupting memory and crashing.

    Pack with the array's own descriptor instead, except for subarray dtypes
    where the subarray ``dtype`` must still be used.
@Yeshwanth-G Yeshwanth-G changed the title (bugfix) np.fromiter corruption when reusing a StringDType instance BUG: fix np.fromiter corruption when reusing a StringDType instance Jul 16, 2026
Comment thread numpy/_core/src/multiarray/ctors.c
@Yeshwanth-G
Yeshwanth-G force-pushed the fromiter_reuse_segfault branch from 534fe8b to b4174c6 Compare July 16, 2026 09:44
Gopu Yeshwanth Reddy added 2 commits July 16, 2026 05:46
@Yeshwanth-G
Yeshwanth-G marked this pull request as ready for review July 16, 2026 09:53
@Yeshwanth-G
Yeshwanth-G requested a review from ngoldbaum July 16, 2026 09:54

@ngoldbaum ngoldbaum left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, just two nits inline.

Comment thread numpy/_core/src/multiarray/ctors.c Outdated
Comment thread numpy/_core/tests/test_stringdtype.py Outdated
@ngoldbaum ngoldbaum added the 09 - Backport-Candidate PRs tagged should be backported label Jul 16, 2026
Comment thread numpy/_core/src/multiarray/ctors.c

@ngoldbaum ngoldbaum left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@ngoldbaum
ngoldbaum merged commit adf557d into numpy:main Jul 17, 2026
89 checks passed
@Yeshwanth-G

Copy link
Copy Markdown
Contributor Author

Thanks for the reviews here @ngoldbaum , @seberg !

@charris charris removed the 09 - Backport-Candidate PRs tagged should be backported label Jul 27, 2026
charris pushed a commit that referenced this pull request Jul 27, 2026
…ce (#32012)

Co-authored-by: Gopu Yeshwanth Reddy <Gopu.Reddy@deshaw.com>
charris added a commit that referenced this pull request Jul 27, 2026
BUG: fix `np.fromiter` corruption when reusing a `StringDType` instance  (#32012)
ngoldbaum pushed a commit to ngoldbaum/numpy that referenced this pull request Aug 4, 2026
…ce (numpy#32012)

Co-authored-by: Gopu Yeshwanth Reddy <Gopu.Reddy@deshaw.com>
(cherry picked from commit adf557d)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

BUG: np.fromiter creates corrupted arrays when re-using StringDType instance

4 participants