It seems I forgot to paste the backtrace while filing this bug.

----

+ Trace 229584

All I can figure out is that in pygi_signal_closure_marshal():

a) "param_values[2]" is GStrv

(gdb) p g_type_name(param_values[2])
$148 = (const gchar *) 0x7ffff62de302 "GStrv"


b) but it has a corrupted value:

(gdb) p (GArray)param_values[2].data[0].v_pointer
$147 = {data = 0x7a2660 "", len = 134217728}


c) This causes a segfault in _pygi_argument_to_object():

array = arg->v_pointer;
[...]
memcpy (&item, &_g_array_index (array, GIArgument, i), item_size);


d) I was able to trace the origin of this back to g_signal_emit_valist():

(gdb) p (GArray)instance_and_params[2].data[0].v_pointer
$181 = {data = 0x7a2660 "", len = 134217728}


I have no idea how to take this through the va_args stuff in g_signal_emit, and hence I have no idea why param_values[2] is set to GStrv with a bad value.

The equivalent C code works perfectly, so I can't figure out why this is happening only with pygobject.

PS: my analysis of all this might be completely wrong.

I followed your instructions using the test case you attached. With latest pygobject I don't see any crash, but the test case does not print anything as well. Could you please attach a test case the demonstrates the problem with latest pygobject?

(In reply to comment #3)
> I followed your instructions using the test case you attached. With latest
> pygobject I don't see any crash, but the test case does not print anything as
> well. Could you please attach a test case the demonstrates the problem with
> latest pygobject?

Since it's a memory corruption bug, it sometimes carries on happily even when things are horribly wrong. One way to reproduce it more reliably (it makes no sense to me why this would work) is to do this:


 def playing_props_changed(*args, **kwargs):
+    print("test")
     print(args)


(Yes, add a dummy print in the signal handler)

I can reproduce the crash with pygobject 3.2.0 and attached test case. The first time it prints the currently played song in RB, but when I change it, it crashes.

I tested this again with pygobject 3.7.90 and this works fine now.

Please reopen if you can still reproduce. Thanks!

Yep, works now! Thanks. :)