Segfault when unloading script if it uses hook_url in a buffer close callback

[Trygve Aaberge]

Describe the bug

If I have a script that runs hook_url in a buffer close callback and unload or reload the script, WeeChat will segfault when the network request is finished.

Steps to reproduce

1. Start WeeChat with the below script: weechat -t -r '/script load script_unload_crash.py'
2. Run /script unload script_unload_crash

import weechat


def my_url_cb(
    data: str, url: str, options: dict[str, str], output: dict[str, str]
) -> int:
    weechat.prnt("", "output: %s" % output)
    return weechat.WEECHAT_RC_OK


def my_close_cb(data: str, buffer: str) -> int:
    weechat.hook_url("https://www.google.com", {}, 30000, "my_url_cb", "")
    return weechat.WEECHAT_RC_OK


if weechat.register("script_unload_crash", "trygveaa", "0.1", "MIT", "", "", ""):
    buffer = weechat.buffer_new("nicklist", "", "", "my_close_cb", "")

Current behavior

WeeChat segfaults with this dump:

*** Very bad! WeeChat is crashing (SIGSEGV received)
*** Full crash dump was saved to /tmp/weechat_temp_52yijG/weechat_crash_20240204_1789707.log file.
***
*** Please help WeeChat developers to fix this bug:
***
***   1. If you have a core file, please run: gdb /path/to/weechat core
***      then issue command: "bt full" and send result to developers.
***      See the user's guide for more info about enabling the core files
***      and reporting crashes:
***      https://weechat.org/doc/weechat/stable/user/#report_crashes
***
***   2. Otherwise send the backtrace (below), only if it is a complete trace.
***      Keep the crash log file, just in case developers ask you some info
***      (be careful, private info like passwords may be in this file).

======= WeeChat backtrace =======
(written by WeeChat 4.3.0-dev (git: v4.2.0-25-g5c869722c), compiled on Feb  4 2024 10:51:56)
001  /home/trygve/dev/weechat/src/core/wee-backtrace.c:167 [function weechat_backtrace]
002  /home/trygve/dev/weechat/src/core/wee-debug.c:195 [function debug_sigsegv_cb]
003  ??:? [function rb_bug_reporter_add]
004  ??:? [function ruby_sysinit]
005  ??:? [function __sigaction]
006  ??:? [function _PyArena_New]
007  ??:? [function PyImport_AddModuleObject]
008  ??:? [function PyImport_AddModule]
009  /home/trygve/dev/weechat/src/plugins/python/weechat-python.c:421 [function weechat_python_exec]
010  /home/trygve/dev/weechat/src/plugins/python/weechat-python-api.c:2661 [function weechat_python_api_hook_url_cb]
011  /home/trygve/dev/weechat/src/core/hook/wee-hook-url.c:105 [function hook_url_run_callback]
012  /home/trygve/dev/weechat/src/core/hook/wee-hook-url.c:174 [function hook_url_timer_cb]
013  /home/trygve/dev/weechat/src/core/hook/wee-hook-timer.c:334 [function hook_timer_exec]
014  /home/trygve/dev/weechat/src/gui/curses/gui-curses-main.c:421 [function gui_main_loop]
015  /home/trygve/dev/weechat/src/gui/curses/normal/main.c:45 [function main]
016  ??:? [function __libc_init_first]
017  ??:? [function __libc_start_main]
018  ??:? [function _start]
======= End of  backtrace =======
zsh: IOT instruction (core dumped)  ~/dev/weechat/install/bin/weechat -t -r 

Expected behavior

No crash. The result of the network request would probably have to be dropped, since the callback for it is gone.

Suggested solutions

No response

Additional information

The issue was introduced with commit 2b0c274.

WeeChat version

master (5c86972)

What OS are you using?

Arch Linux

On which terminal are you running WeeChat?

No response

Which terminal multiplexer are you using?

No response