Guard lvpy_release_callback_user_data against interpreter finalization

lv.deinit() called from an atexit hook (as pydevices' display_driver
does) triggers lv_deinit()'s object-tree teardown, which fires
LV_EVENT_DELETE per object during Py_FinalizeEx(). That path reaches
lvpy_release_callback_user_data(), which called PyDict_Check() and
PyObject_TypeCheck() on the stored callback user_data -- probing
PyObject internals that are unsafe to touch once the interpreter has
started finalizing, and crashing with SIGSEGV inside the type check.

Guard the release path with Py_IsFinalizing() (3.13+) /
_Py_IsFinalizing() (3.10-3.12, via PY_VERSION_HEX) and skip the
DECREF once finalization has begun. Leaking that reference is correct
at that point: the process is exiting and the memory is reclaimed by
the OS regardless.

Adds a subprocess-based regression test that registers an atexit hook
calling lv.deinit() on a display with widgets carrying several
per-registration callbacks, asserting a clean exit.

Author: bdbarnett

src/lvpy_runtime.c

@@ -704,9 +704,24 @@ PyObject *get_callback_dict_from_user_data(void *user_data)
     return mp_get_callbacks(obj);
 }
 
+/* Py_IsFinalizing() is 3.13+; _Py_IsFinalizing() covers 3.10-3.12. Both
+ * report whether the interpreter is inside Py_FinalizeEx(). */
+#if PY_VERSION_HEX >= 0x030d0000
+#define LVPY_IS_FINALIZING() Py_IsFinalizing()
+#else
+#define LVPY_IS_FINALIZING() _Py_IsFinalizing()
+#endif
+
 int lvpy_is_per_registration_callback_dict(void *user_data)
 {
     if (!user_data) return 0;
+    /* During Py_FinalizeEx(), lv_deinit()'s object-tree teardown fires
+     * LV_EVENT_DELETE per object, which reaches here through
+     * lvpy_release_callback_user_data(). At that point PyObject internals
+     * (the type object graph PyDict_Check/PyObject_TypeCheck walk) may
+     * already be torn down, so probing them is unsafe. Treat user_data as
+     * opaque once finalization has started. */
+    if (LVPY_IS_FINALIZING()) return 0;
     PyObject *obj = (PyObject *)user_data;
     if (!PyDict_Check(obj)) return 0;
     PyTypeObject *base = py_get_base_obj_type();
@@ -716,6 +731,11 @@ int lvpy_is_per_registration_callback_dict(void *user_data)
 
 void lvpy_release_callback_user_data(void *user_data)
 {
+    /* Same finalization hazard as above: Py_DECREF touches the object's
+     * type/refcount machinery, which is unsafe once Py_FinalizeEx() has
+     * started tearing down the interpreter. Skip the release and leak —
+     * the process is exiting, so this memory is reclaimed by the OS. */
+    if (LVPY_IS_FINALIZING()) return;
     if (lvpy_is_per_registration_callback_dict(user_data)) {
         Py_DECREF((PyObject *)user_data);
     }

tests/test_lvgl_init.py

@@ -1,10 +1,69 @@
 # SPDX-License-Identifier: MIT
 """Unit tests for the native lvgl CPython extension."""
 
+import os
+import subprocess
+import sys
 import unittest
 from pathlib import Path
 
 
+_ATEXIT_DEINIT_SCRIPT = """
+import atexit
+
+import lvgl as lv
+
+lv.init()
+disp = lv.display_create(64, 64)
+disp.set_color_format(lv.COLOR_FORMAT.RGB565)
+buf = lv.draw_buf_create(64, 64, lv.COLOR_FORMAT.RGB565, 0)
+disp.set_draw_buffers(buf, None)
+disp.set_render_mode(lv.DISPLAY_RENDER_MODE.PARTIAL)
+scr = lv.screen_active()
+
+widgets = []
+
+
+class Row:
+    def __init__(self, parent, i):
+        self.btn = lv.button(parent)
+        self.label = lv.label(self.btn)
+        self.label.set_text("r%d" % i)
+        # Bound-method callbacks registered for several event types so the
+        # per-object event dsc list has several per-registration callback
+        # dicts by the time lv_deinit() walks it.
+        self.btn.add_event_cb(self.on_click, lv.EVENT.CLICKED, None)
+        self.btn.add_event_cb(self.on_value_changed, lv.EVENT.VALUE_CHANGED, None)
+        self.btn.add_event_cb(self.on_delete, lv.EVENT.DELETE, None)
+
+    def on_click(self, event):
+        self.label.set_text("clicked")
+
+    def on_value_changed(self, event):
+        pass
+
+    def on_delete(self, event):
+        pass
+
+
+for i in range(40):
+    widgets.append(Row(scr, i))
+kept = widgets
+
+
+def _deinit_at_exit():
+    lv.deinit()
+
+
+# pydevices' display_driver registers its LVGL teardown the same way: an
+# atexit hook that calls lv.deinit() during interpreter shutdown. lv_deinit()
+# fires LV_EVENT_DELETE per object, which used to crash inside
+# lvpy_release_callback_user_data (PyDict_Check / PyObject_TypeCheck on a
+# stored callback user_data pointer) once Python began tearing itself down.
+atexit.register(_deinit_at_exit)
+"""
+
+
 class LvglInitTests(unittest.TestCase):
     def test_exact_bindings_source_is_recorded(self):
         root = Path(__file__).resolve().parents[1]
@@ -54,6 +113,28 @@ def test_label_on_active_screen(self):
         finally:
             lv.deinit()
 
+    def test_atexit_deinit_does_not_crash(self):
+        # Regression test for the use-after-free in
+        # lvpy_release_callback_user_data() during interpreter finalization
+        # (fixed by guarding the release path with Py_IsFinalizing() /
+        # _Py_IsFinalizing()). Runs in a subprocess because the crash only
+        # reproduces on real interpreter shutdown, not inside a running test.
+        env = dict(os.environ)
+        env.setdefault("SDL_VIDEODRIVER", "dummy")
+        result = subprocess.run(
+            [sys.executable, "-c", _ATEXIT_DEINIT_SCRIPT],
+            env=env,
+            capture_output=True,
+            text=True,
+            timeout=30,
+        )
+        self.assertEqual(
+            result.returncode,
+            0,
+            "atexit-triggered lv.deinit() crashed (rc=%r); stdout=%r stderr=%r"
+            % (result.returncode, result.stdout, result.stderr),
+        )
+
 
 if __name__ == "__main__":
     unittest.main()