Fix SliceBox-induced type confusion by manually performing type erasure.

Author: adamreichold

src/slice_box.rs

@@ -4,40 +4,49 @@ use pyo3::pyclass_slots::PyClassDummySlot;
 use pyo3::type_object::{LazyStaticType, PyTypeInfo};
 use pyo3::{ffi, types::PyAny, PyCell};
 
-pub(crate) struct SliceBox<T> {
-    data: Box<[T]>,
+pub(crate) struct SliceBox {
+    ptr: *mut [u8],
+    drop: unsafe fn(*mut [u8]),
 }
 
-impl<T> SliceBox<T> {
-    pub(crate) fn new(data: Box<[T]>) -> Self {
-        Self { data }
+unsafe impl Send for SliceBox {}
+
+impl SliceBox {
+    pub(crate) fn new<T: Send>(data: Box<[T]>) -> Self {
+        unsafe fn drop_boxed_slice<T>(ptr: *mut [u8]) {
+            let _ = Box::from_raw(ptr as *mut [T]);
+        }
+
+        let ptr = Box::into_raw(data) as *mut [u8];
+        let drop = drop_boxed_slice::<T>;
+
+        Self { ptr, drop }
+    }
+}
+
+impl Drop for SliceBox {
+    fn drop(&mut self) {
+        unsafe {
+            (self.drop)(self.ptr);
+        }
     }
 }
 
-impl<T> PyClass for SliceBox<T>
-where
-    T: Send,
-{
+impl PyClass for SliceBox {
     type Dict = PyClassDummySlot;
     type WeakRef = PyClassDummySlot;
     type BaseNativeType = PyAny;
 }
 
-impl<T> PyClassImpl for SliceBox<T>
-where
-    T: Send,
-{
+impl PyClassImpl for SliceBox {
     const DOC: &'static str = "Memory store for PyArray using rust's Box<[T]> \0";
 
     type BaseType = PyAny;
     type Layout = PyCell<Self>;
     type ThreadChecker = ThreadCheckerStub<Self>;
 }
 
-unsafe impl<T> PyTypeInfo for SliceBox<T>
-where
-    T: Send,
-{
+unsafe impl PyTypeInfo for SliceBox {
     type AsRefTarget = PyCell<Self>;
     const NAME: &'static str = "SliceBox";
     const MODULE: Option<&'static str> = Some("_rust_numpy");

tests/to_py.rs

@@ -248,6 +248,10 @@ fn slice_box_type_confusion() {
 
         let _py_arr = nd_arr.into_pyarray(py);
 
+        // Dropping `_arr` used to trigger a segmentation fault due to calling `Py_DECREF`
+        // on 1, 2 and 3 interpreted as pointers into the Python heap
+        // after having created a `SliceBox<PyObject>` backing `_py_arr`,
+        // c.f. https://github.com/PyO3/rust-numpy/issues/232.
         let vec = vec![1, 2, 3];
         let _arr = vec.into_pyarray(py);
     });