np.clip with a too-small out= silently writes out of bounds under njit #10682

Reporting a bug

• I have tried using the latest released version of Numba (most recent is
  visible in the release notes
  (https://numba.readthedocs.io/en/stable/release-notes-overview.html).
• I have included a self contained code sample to reproduce the problem.
  i.e. it's possible to run as 'python bug.py'.

np.clip with an explicit out= that is too small for the result writes into it silently under njit, where NumPy raises a ValueError. Only part of the result is written and the rest of out keeps its old values, so the call returns a wrong array with no error.

import numpy as np
from numba import njit

@njit
def clip_out(a, a_min, a_max, out):
    return np.clip(a, a_min, a_max, out)

a = np.arange(5.0)
print(clip_out(a, 0.0, 3.0, np.full(3, -1.0)))   # njit, out too small
np.clip(a, 0.0, 3.0, out=np.full(3, -1.0))        # numpy, same call

Output:

[0. 1. 2.]
ValueError: operands could not be broadcast together with shapes (5,) () () (3,)

With boundscheck=True element 0 of the result changes (from 0. to 3.), so out is being written out of bounds rather than just left partly filled.

This looks like the same class as #9166, which was fixed for the ufunc path in #10671. np.clip takes a separate path that the fix there does not cover.

Environment:

python: 3.11.15
numpy: 2.0.2
numba: 0.66.0