at-spi2 and a11ytesting core dump

I am getting a repeatable core dump from ldtp when running the gcalctool.xml
test from a11ytesting (bin/mago --log-level=debug -a a11y -f gcalctool.xml):

Core was generated by `python2.6'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f7ff77d66c0 in ?? ()
(gdb) bt
#0  0x00007f7ff77d66c0 in ?? ()
#1  0x00007f7fe0e12e05 in _atspi_send_event (e=0x7f7fffffa430)
    at atspi-event-listener.c:817
#2  0x00007f7fe0e13390 in _atspi_dbus_handle_event (bus=0x7f7ff6788400, 
    message=0x7f7ff77069e0, data=0x0) at atspi-event-listener.c:944
#3  0x00007f7fe0e15c18 in process_deferred_message (closure=0x7f7ff2319320)
    at atspi-misc.c:673
#4  0x00007f7fe0e15d2d in _atspi_process_deferred_messages (data=0x0)
    at atspi-misc.c:703
#5  0x00007f7ff0c3ffd2 in g_main_context_dispatch ()
   from /usr/pkg/lib/libglib-2.0.so.0

(gdb) frame 1
#1  0x00007f7fe0e12e05 in _atspi_send_event (e=0x7f7fffffa430)
    at atspi-event-listener.c:817
817             entry->callback (atspi_event_copy (e), entry->user_data);
(gdb) print e
$1 = (AtspiEvent *) 0x7f7fffffa430
(gdb) print *e
$2 = {type = 0x7f7ff23197c0 "object:children-changed:add", 
  source = 0x7f7ff2ff2810, detail1 = 0, detail2 = 0, any_data = {
    g_type = 140187568332640, data = {{v_int = -218158304, 
        v_uint = 4076808992, v_long = 140187514383136, 
        v_ulong = 140187514383136, v_int64 = 140187514383136, 
        v_uint64 = 140187514383136, v_float = -1.0108264e+31, 
        v_double = 6.9261834832583127e-310, v_pointer = 0x7f7ff2ff2b20}, {
        v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, 
        v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}}
(gdb) print *entry
$3 = {callback = 0x7f7ff77d66c0, user_data = 0x7f7ff2ff8c50, 
  callback_destroyed = 0x7f7ff77d65c0, category = 0x7f7ff7703c50 "Object", 
  name = 0x7f7ff77d3a20 "ChildrenChanged", detail = 0x0}


The test box is using (at-spi2-core, at-spi2-atk, pyatspi) all version 2.4,
ldtp 2.3.0, accerciser 3.4.0. (i.e., latest tar balls)

One oddity is that the terminal in which ldtp -v is running generates:
(LDTB_DEBG 2 is set)

ldtp -v
sem_wait: Invalid argument
sem_post: Invalid argument
sem_wait: Invalid argument
sem_post: Invalid argument
sem_wait: Invalid argument
Segmentation fault (core dumped)

Who is using semaphores? (A quick look doesn't find any in at-spi2-core,
accerciser nor ldtp - have I missed some?)


The only trivial change I made to a11ytesting was:

--- mago/cmd/result.py  2011-10-09 16:01:33 +0000
+++ mago/cmd/result.py  2012-04-05 11:10:55 +0000
@ -45,4 +45,4 @@
           self.append('screenshot', _logFile)
         except:
           # Screenshots fail to connect to xmlrpc socket in GNOME 3.0
-          self.append('screenshot failed',_logFile)
+          self.append('screenshot_failed',_logFile)

so I basically have no local modifications in the long string of
dependencies...


Any thoughts on where to look?

Cheers,

Patrick