dgelessus
diff --git a/‎rubicon/objc/ctypes_patch.py
Lines changed: 19 additions & 2 deletions b/‎rubicon/objc/ctypes_patch.py
Lines changed: 19 additions & 2 deletions
diff --git a/‎tests/test_ctypes_patch.py
Lines changed: 26 additions & 0 deletions b/‎tests/test_ctypes_patch.py
Lines changed: 26 additions & 0 deletions
@@ -99,7 +99,9 @@ class ffi_type(ctypes.Structure):
 
 # The GETFUNC and SETFUNC typedefs from "Modules/_ctypes/ctypes.h".
 GETFUNC = ctypes.PYFUNCTYPE(ctypes.py_object, ctypes.c_void_p, ctypes.c_ssize_t)
-SETFUNC = ctypes.PYFUNCTYPE(ctypes.py_object, ctypes.c_void_p, ctypes.py_object, ctypes.c_ssize_t)
+# The return type of SETFUNC is declared here as a c_void_p instead of py_object to work around ctypes bug
+# bpo-36880 (https://bugs.python.org/issue36880). See the comment in make_callback_returnable's setfunc for details.
+SETFUNC = ctypes.PYFUNCTYPE(ctypes.c_void_p, ctypes.c_void_p, ctypes.py_object, ctypes.c_ssize_t)
 
 
 # The StgDictObject structure from "Modules/_ctypes/ctypes.h".
@@ -119,6 +121,10 @@ class StgDictObject(ctypes.Structure):
     ]
 
 
+ctypes.pythonapi.Py_IncRef.restype = None
+ctypes.pythonapi.Py_IncRef.argtypes = [ctypes.POINTER(PyObject)]
+
+
 def unwrap_mappingproxy(proxy):
     """Return the mapping contained in a mapping proxy object."""
 
@@ -208,7 +214,18 @@ def setfunc(ptr, value, size):
             )
 
         ctypes.memmove(ptr, ctypes.addressof(value), actual_size)
-        return None
+        # Because of ctypes bug bpo-36880 (https://bugs.python.org/issue36880), returning None from a callback with
+        # restype py_object causes a reference counting error that can crash Python.
+        # To work around this bug, the restype of SETFUNC is declared as c_void_p instead.
+        # This way ctypes performs no automatic reference counting for the returned object, which avoids the bug.
+        # However, this way we have to manually convert the Python object to a pointer and adjust its reference count.
+        none_ptr = ctypes.cast(id(None), ctypes.POINTER(PyObject))
+        # The return value of a SETFUNC is expected to have an extra reference
+        # (which will be owned by the caller of the SETFUNC).
+        ctypes.pythonapi.Py_IncRef(none_ptr)
+        # The returned pointer must be returned as a plain int, not as a c_void_p,
+        # otherwise ctypes won't recognize it and will raise a TypeError.
+        return ctypes.cast(none_ptr, ctypes.c_void_p).value
 
     # Store the getfunc and setfunc as attributes on the ctype, so they don't get garbage-collected.
     ctype._rubicon_objc_ctypes_patch_getfunc = getfunc
 
@@ -94,3 +94,29 @@ def get_struct():
             struct = get_struct()
             self.assertEqual(struct.spam, 123)
             self.assertEqual(struct.ham, 123)
+
+    def test_patched_type_returned_often(self):
+        """Returning a patched type very often works properly without crashing anything.
+
+        This checks that bpo-36880 is either fixed or worked around.
+        """
+
+        class TestStruct(ctypes.Structure):
+            _fields_ = [
+                ("spam", ctypes.c_int),
+                ("ham", ctypes.c_double),
+            ]
+        functype = ctypes.CFUNCTYPE(TestStruct)
+
+        ctypes_patch.make_callback_returnable(TestStruct)
+
+        # After patching, the structure can be returned from a callback.
+        @functype
+        def get_struct():
+            return TestStruct(123, 123)
+
+        for _ in range(10000):
+            # After being returned from the callback, the structure's data is intact.
+            struct = get_struct()
+            self.assertEqual(struct.spam, 123)
+            self.assertEqual(struct.ham, 123)