GNOME Bugzilla – Bug 504337
(PATCH) crash bug in gobject.Timeout and gobject.Idle
Last modified: 2008-07-14 21:41:50 UTC
The tp_flags fields for PyGTimeout_Type and PyGIdle_Type in gobject/pygsource.c have Py_TPFLAGS_HAVE_GC incorrectly set. The tp_traverse and tp_clear fields are only inherited from a base type if Py_TPFLAGS_HAVE_GC is _not_ set in subtypes (and if Py_TPFLAGS_HAVE_RICHCOMPARE _is_ set, which is covered by Py_TPFLAGS_DEFAULT). The Python GC therefore dereferences a NULL function pointer when attempting to traverse a timeout or idle source. Attaching a test case and patch against r721.
Created attachment 101217 [details] timeout_segfault.py Observed behavior: $ python timeout_segfault.py Segmentation fault
Created attachment 101218 [details] [review] bcs_pygsource_fix.patch
The GSource wrapper has additional problems, many of which are fixed by the patch attached to #510511. That patch should be applied instead.
2008-07-14 Johan Dahlin <johan@gnome.org> Bug 504337 - crash bug in gobject.Timeout and gobject.Idle * gobject/pygsource.c: * tests/test_source.py: Fix crash in Timeout and Idle, patch by Bryan Silverthorn.