PyVisit::call segfaults when passed None

[neachdainn]

Bug Description

When PyVisit::call is passed a None value, this is converted into a null pointer and passed to the underlying visitproc function. However, (by my understanding) the visitproc function isn't meant to handle null pointers as the intended interface is actually Py_VISIT which does do a null check.

Steps to Reproduce

Minimal example:

use pyo3::{prelude::*, PyVisit, PyTraverseError, types::PyType};

#[pyclass]
struct Foo {
    #[pyo3(get, set)]
    other: Option<Py<Foo>>,

    obj: Option<Py<Bar>>,
}

#[pymethods]
impl Foo {
    #[new]
    fn new() -> Self {
        Self { other: None, obj: None }
    }

    fn __traverse__(&self, visit: PyVisit<'_>)  -> Result<(), PyTraverseError> {
        // Segfaults
        visit.call(&self.obj)?;
        Ok(())
    }

    fn __clear__(&mut self) {
        self.obj = None;
    }
}

#[pyclass]
struct Bar;

fn main()
{
    pyo3::prepare_freethreaded_python();
    Python::with_gil(|py| {
        let foo = PyType::new::<Foo>(py);
        pyo3::py_run!(py, foo foo, r#"
            import gc
            import time

            item = foo()
            item.other = item
            del item

            gc.collect()
        "#);
    });
}

Backtrace

No response

Your operating system and version

Ubuntu 22, Ubuntu 20

Your Python version (python --version)

Python 3.10.6, Python 3.8.10

Your Rust version (rustc --version)

rustc 1.66.1

Your PyO3 version

PyO3 0.17.0, PyO3 0.18.0

How did you install python? Did you use a virtualenv?

System installation

Additional Info

No response

[neachdainn]

I will open a PR tomorrow. I just wanted to document this and open it up for conversation before I left work for the day.

[davidhewitt]

Thanks for reporting, yep agreed this is a bug, PR much appreciated!