Several ArrayMethod descriptor resolvers acquire references in loop_descrs and return immediately if a later descriptor allocation fails.
The NumPy ArrayMethod contract requires loop_descrs not to retain references when resolve_descriptors returns an error.
Affected code includes:
- Binary one-output resolver
- Binary two-output resolver
ldexp resolver- Comparison resolver
- Matmul resolver
For example, a resolver may Py_INCREF both input descriptors and then return -1 when allocating the output descriptor fails, without releasing the input references. This is primarily observable under OOM/fault injection.
Resolvers should initialize every loop_descrs entry to NULL and use one failure path that calls Py_CLEAR/Py_XDECREF on all acquired descriptors.
Acceptance criteria:
- Every resolver leaves no owned references in
loop_descrs on error.
- Existing error exceptions are preserved.
- Normal descriptor resolution remains unchanged.
- Fault-injection tests are added where practical.
Several ArrayMethod descriptor resolvers acquire references in
loop_descrsand return immediately if a later descriptor allocation fails.The NumPy ArrayMethod contract requires
loop_descrsnot to retain references whenresolve_descriptorsreturns an error.Affected code includes:
ldexpresolverFor example, a resolver may
Py_INCREFboth input descriptors and then return-1when allocating the output descriptor fails, without releasing the input references. This is primarily observable under OOM/fault injection.Resolvers should initialize every
loop_descrsentry toNULLand use one failure path that callsPy_CLEAR/Py_XDECREFon all acquired descriptors.Acceptance criteria:
loop_descrson error.