Python调用C++异步回调时sleep触发崩溃问题求助

我正在编写一个调用带异步回调的C++库的Python模块，遇到了特定场景下的崩溃问题，具体细节如下：

1. Python回调函数的传递与引用计数处理 #

传递Python函数作为回调的代码如下：

Py_XINCREF(cb_p);
if(!PyArg_ParseTuple(args, "ky#O",
  316                         &hdl,
  317                         &(buf_p), &(buflen),
  318                         &(cb_p->ctrl_cb))) {
;
;
;
Py_XINCREF(cb_p->ctrl_cb);

已通过PyCallable_Check校验，确认回调可调用。回调对应的PyObject *存储在堆上的cb_p中，且已对cb_p和cb_p->ctrl_cb调用Py_XINCREF增加引用计数。

2. C++回调触发时的调用逻辑 #

当C++回调被调用时，先获取cb_p，再通过PyEval_CallObject调用回调函数，代码如下：

274   arglist = Py_BuildValue("(y#, i)",
  275                           (const char *)(ack_p->ctrl_msg_p->ep_id.key),
  276                           (Py_ssize_t)ack_p->ctrl_msg_p->ep_id.klen,
  277                           status);
  278
  279   if (!PyCallable_Check(cb_p->ctrl_cb)) {
  280     PyErr_SetString(PyExc_TypeError, "callback invalid");
  281     return;
  282   }
  283   PyEval_CallObject(cb_p->ctrl_cb, arglist);
  284   Py_DECREF(arglist);

3. 崩溃场景差异 #

仅当主Python代码为以下内容时会崩溃：

while True:
    time.sleep(100)

若替换为以下代码则无崩溃，一切正常：

while True:
    pass

4. GDB堆栈信息 #

程序崩溃时的gdb堆栈跟踪如下：

(gdb) bt
#0  0x00000000005da418 in _PyFunction_FastCallDict ()
#1  0x00007ffff76fe53b in s_mpsc_pub_ctrl_cb (ack_p=<optimized out>) at py_mpsc.c:290
#2  0x00007ffff76c740c in s_mpsc_ctrl_msg_ack_recv (mpsc_p=0x9a9e00, buf=buf@entry=0x7fffb8003997 "\n\017/python/app/pub\020\001", len=len@entry=19, sequence=sequence@entry=0) at ./infra/pubsub/mpsc/mpsc_conn.cpp:1392
#3  0x00007ffff76c7cb2 in mpsc_ctrl_recv_obj_cookie (p_h=0x7fffc0005aa0, op=<optimized out>, msgtype=73006, buf=0x7fffb8003997 "\n\017/python/app/pub\020\001", len=19, sequence=0) at ./infra/pubsub/mpsc/mpsc_conn.cpp:1476
#4  0x00007ffff7297b4a in do_recv (ctx=<optimized out>, arg=<optimized out>, fsm_hdl=<optimized out>) at ./infra/msglib/lib/ml_peer_server.c:312
#5  0x00007ffff7297a69 in fsm_execute (f=0x7fffc0005a20, event=event@entry=1, arg=<optimized out>) at ./infra/msglib/lib/fsm.c:74
#6  0x00007ffff729acd3 in ml_peer_event (p=p@entry=0x7fffc0005aa0, ev=ev@entry=1, arg=<optimized out>) at ./infra/msglib/lib/ml_peer.c:116
#7  0x00007ffff729aee9 in ml_peer_signal_recv (p=p@entry=0x7fffc0005aa0, m=<optimized out>) at ./infra/msglib/lib/ml_peer.c:178
#8  0x00007ffff729d037 in input_recv (c=<optimized out>, msg=0x7fffc0000b68) at ./infra/msglib/lib/ml_client.c:30
#9  0x00007ffff72959a1 in read_cb (fd=<optimized out>, what=<optimized out>, _self=0x7fffc0000b40) at ./infra/msglib/lib/ml_cmn.c:234
#10 0x00007ffff74159ba in ?? () from /lib/x86_64-linux-gnu/libevent-2.1.so.6
#11 0x00007ffff7416537 in event_base_loop () from /lib/x86_64-linux-gnu/libevent-2.1.so.6
#12 0x00007ffff7656404 in s_dispatcher (in=<optimized out>) at ./infra/pubsub/common/tepool/tepool.cpp:182
#13 0x00007ffff7f72fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#14 0x00007ffff7cba06f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(gdb)

我原本期望Py_XINCREF(cb_p->ctrl_cb)能保证Python函数对象的引用计数正确，但显然存在未覆盖的问题，恳请协助分析崩溃原因。

内容的提问来源于stack exchange，提问作者Sridhar Pitchai