René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Crash with non-consumed Tk timer handler","articleBody":"# Crash report\n\n### Bug description:\n\nPreviously, the following reproducers leaked:\n\n```py\nimport tkinter\nw = tkinter.Tk()\ntrace = lambda *_, **__: None\ntrace.evil = type(w.tk)\nw.tk.settrace(trace)\nw.mainloop()\n```\n\n```py\nimport tkinter\nw = tkinter.Tk()\nfunc = lambda *_, **__: None\nfunc.evil = type(w.tk.createtimerhandler(1234567, print))\nw.tk.createtimerhandler(1234567, func)\nw.mainloop()\n```\n\nAfter https://github.com/python/cpython/pull/138331 was merged, I observed that the first one doesn't leak anymore but the second one crash:\n\n```\npython: ./Modules/_tkinter.c:2784: int Tktt_Traverse(PyObject *, visitproc, void *): Assertion `TkttObject_Check(op)' failed.\n```\n\nThe reason is as follows:\n\n- whenever a timer handler is created, there are actually two references that are created; one regular and one that is used as client data and sent to Tcl\n- BUT a timer handler may not necessarily be destroyed when we deallocate the app.\n\nMore precisely, when the handler is called, this extra reference is cleared and the Tcl handler is destroyed. However, if the object is destroyed before that, this never happens, so we have a (non-visible) leak (on previous branches) or a crash (on main).\n\n### CPython versions tested on:\n\nCPython main branch\n\n### Operating systems tested on:\n\n_No response_\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-138789\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/picnixz","@type":"Person","name":"picnixz"},"datePublished":"2025-09-11T12:10:09.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/138791/cpython/issues/138791"}