[Numpy-discussion] SegFault/double free with simple array mask operation

[Nils Wagner]

On Wed, 14 Nov 2007 19:31:38 +0100
  Achim Gaedke <Achim.Gaedke@physik.tu-darmstadt.de> 
wrote:
> Hello everybody!
> 
> Please have a look at the program below:
> 
> # start
> import numpy
> 
> t_array=numpy.ones(2048, dtype=numpy.float32)
> sinc_array=numpy.array((len(t_array),),dtype=numpy.float32)
> sinc_array[(t_array > 0.)]=1.0
> # end
> 
> If you execute this program, it crashes with 
>Segmentation Fault or
> *** glibc detected *** python: double free or corruption 
>(out): 
> 0x081fe470 ***
> 
> It depends on the circumstances, which error occurs, 
>e.g. you must quit 
> your interpreter if you are in interactvie mode.
> 
> Obviously numpy.array() should be numpy.zeros() or 
>numpy.empty() .... 
> But this program should not crash with a core dump.
> 
> Used Linux Versions are:
> Debian Testing with numpy 1.0.3,
> Debian Stable with numpy 1.0.1,
> Ubuntu Linux 6.10 with numpy 1.0
> Also numpy-1.0.4 crashes.
> 
> Yours, Achim
> 
> _______________________________________________
> Numpy-discussion mailing list
> Numpy-discussion@scipy.org
> http://projects.scipy.org/mailman/listinfo/numpy-discussion

I can confirm the problem on opensuse10.2 x86_64
using python2.5
>>> numpy.__version__
'1.0.5.dev4453'

Here is a backtrace

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 46940023738768 (LWP 4279)]
0x00002ab1128cde47 in _PyObject_GC_Track () from 
/usr/lib64/libpython2.5.so.1.0
(gdb) bt
#0  0x00002ab1128cde47 in _PyObject_GC_Track () from 
/usr/lib64/libpython2.5.so.1.0
#1  0x00002ab1128ce514 in PyGC_Collect () from 
/usr/lib64/libpython2.5.so.1.0
#2  0x00002ab1128c3ce7 in Py_Finalize () from 
/usr/lib64/libpython2.5.so.1.0
#3  0x00002ab1128ccf34 in Py_Main () from 
/usr/lib64/libpython2.5.so.1.0
#4  0x00002ab1133e7bc4 in __libc_start_main () from 
/lib64/libc.so.6
#5  0x00000000004006a9 in _start ()
  

Nils