Merge pull request scipy#8477 from pv/signal-refcnt

BUG: signal/signaltools: fix wrong refcounting in PyArray_OrderFilterND

scipy/signal/sigtoolsmodule.c

@@ -852,6 +852,7 @@ PyObject *PyArray_OrderFilterND(PyObject *op1, PyObject *op2, int order) {
 	intp *ret_ind;
 	CompareFunction compare_func;
 	char *zptr=NULL;
+	PyArray_CopySwapFunc *copyswap;
 
 	/* Get Array objects from input */
 	typenum = PyArray_ObjectType(op1, 0);  
@@ -907,6 +908,8 @@ PyObject *PyArray_OrderFilterND(PyObject *op1, PyObject *op2, int order) {
 	os = PyArray_ITEMSIZE(ret);
 	op = PyArray_DATA(ret);
 
+	copyswap = PyArray_DESCR(ret)->f->copyswap;
+
 	bytes_in_array = PyArray_NDIM(ap1)*sizeof(intp);
 	mode_dep = malloc(bytes_in_array);
 	for (k = 0; k < PyArray_NDIM(ap1); k++) { 
@@ -980,8 +983,15 @@ PyObject *PyArray_OrderFilterND(PyObject *op1, PyObject *op2, int order) {
 
 	  fill_buffer(ap1_ptr,ap1,ap2,sort_buffer,n2,check,b_ind,temp_ind,offsets);
 	  qsort(sort_buffer, n2_nonzero, is1, compare_func);
-	  memcpy(op, sort_buffer + order*is1, os);
-
+
+	  /*
+	   * Use copyswap for correct refcounting with object arrays
+	   * (sort_buffer has borrowed references, op owns references). Note
+	   * also that os == PyArray_ITEMSIZE(ret) and we are copying a single
+	   * scalar here.
+	   */
+	  copyswap(op, sort_buffer + order*is1, 0, NULL);
+
           /* increment index counter */
 	  incr = increment(ret_ind,PyArray_NDIM(ret),PyArray_DIMS(ret)); 
           /* increment to next output index */

scipy/signal/tests/test_signaltools.py

@@ -552,6 +552,21 @@ def test_none(self):
         a.strides = 16
         assert_(signal.medfilt(a, 1) == 5.)
 
+    def test_refcounting(self):
+        # Check a refcounting-related crash
+        a = Decimal(123)
+        x = np.array([a, a], dtype=object)
+        if hasattr(sys, 'getrefcount'):
+            n = 2 * sys.getrefcount(a)
+        else:
+            n = 10
+        # Shouldn't segfault:
+        for j in range(n):
+            signal.medfilt(x)
+        if hasattr(sys, 'getrefcount'):
+            assert_(sys.getrefcount(a) < n)
+        assert_equal(x, [a, a])
+
 
 class TestWiener(object):