BUG: fix refcount issue caused by numpy#12524

Author: mattip

numpy/core/src/common/ufunc_override.c

@@ -71,20 +71,22 @@ PyUFunc_HasOverride(PyObject * obj)
  * Get possible out argument from kwds, and returns the number of outputs
  * contained within it: if a tuple, the number of elements in it, 1 otherwise.
  * The out argument itself is returned in out_kwd_obj, and the outputs
- * in the out_obj array (all as borrowed references).
+ * in the out_obj array (as borrowed references).
  *
  * Returns 0 if no outputs found, -1 if kwds is not a dict (with an error set).
  */
 NPY_NO_EXPORT int
 PyUFuncOverride_GetOutObjects(PyObject *kwds, PyObject **out_kwd_obj, PyObject ***out_objs)
 {
     if (kwds == NULL) {
+        *out_kwd_obj = NULL;
         return 0;
     }
     if (!PyDict_CheckExact(kwds)) {
         PyErr_SetString(PyExc_TypeError,
                         "Internal Numpy error: call to PyUFuncOverride_GetOutObjects "
                         "with non-dict kwds");
+        *out_kwd_obj = NULL;
         return -1;
     }
     /* borrowed reference */
@@ -97,8 +99,11 @@ PyUFuncOverride_GetOutObjects(PyObject *kwds, PyObject **out_kwd_obj, PyObject *
          * The C-API recommends calling PySequence_Fast before any of the other
          * PySequence_Fast* functions. This is required for PyPy
          */
-        PyObject *seq = PySequence_Fast(*out_kwd_obj, "Could not convert object to sequence");
+        PyObject *seq;
         int ret;
+        Py_INCREF(*out_kwd_obj);
+        seq = PySequence_Fast(*out_kwd_obj,
+                              "Could not convert object to sequence");
         if (seq == NULL) {
             return -1;
         }
@@ -108,6 +113,7 @@ PyUFuncOverride_GetOutObjects(PyObject *kwds, PyObject **out_kwd_obj, PyObject *
         return ret;
     }
     else {
+        Py_INCREF(*out_kwd_obj);
         *out_objs = out_kwd_obj;
         return 1;
     }

numpy/core/src/common/ufunc_override.h

@@ -28,7 +28,7 @@ PyUFunc_HasOverride(PyObject *obj);
  * Get possible out argument from kwds, and returns the number of outputs
  * contained within it: if a tuple, the number of elements in it, 1 otherwise.
  * The out argument itself is returned in out_kwd_obj, and the outputs
- * in the out_obj array (all as borrowed references).
+ * in the out_obj array (as borrowed references).
  *
  * Returns 0 if no outputs found, -1 if kwds is not a dict (with an error set).
  */

numpy/core/src/multiarray/methods.c

@@ -1026,13 +1026,16 @@ any_array_ufunc_overrides(PyObject *args, PyObject *kwds)
     /* check outputs, if any */
     nout = PyUFuncOverride_GetOutObjects(kwds, &out_kwd_obj, &out_objs);
     if (nout < 0) {
+        Py_XDECREF(out_kwd_obj);
         return -1;
     }
     for (i = 0; i < nout; i++) {
         if (PyUFunc_HasOverride(out_objs[i])) {
+            Py_XDECREF(out_kwd_obj);
             return 1;
         }
     }
+    Py_XDECREF(out_kwd_obj);
     return 0;
 }
 

numpy/core/src/umath/override.c

@@ -39,6 +39,7 @@ get_array_ufunc_overrides(PyObject *args, PyObject *kwds,
 
     nout = PyUFuncOverride_GetOutObjects(kwds, &out_kwd_obj, &out_objs);
     if (nout < 0) {
+        Py_XDECREF(out_kwd_obj);
         return -1;
     }
 
@@ -86,13 +87,15 @@ get_array_ufunc_overrides(PyObject *args, PyObject *kwds,
             ++num_override_args;
         }
     }
+    Py_XDECREF(out_kwd_obj);
     return num_override_args;
 
 fail:
     for (i = 0; i < num_override_args; i++) {
         Py_DECREF(with_override[i]);
         Py_DECREF(methods[i]);
     }
+    Py_XDECREF(out_kwd_obj);
     return -1;
 }