The virDomainSnapshotGetDomain() method does NOT increment the
refcount on the returned virDomain, so it must not be unrefed.

This double free is responsible for random failures of the
test_snapshot.py tests.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 src/domainsnapshot.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/domainsnapshot.c b/src/domainsnapshot.c
index f3571a1..78a9f9a 100644
--- a/src/domainsnapshot.c
+++ b/src/domainsnapshot.c
@@ -63,7 +63,7 @@ virtDBusDomainSnapshotGetParent(GVariant *inArgs,
     g_autoptr(virDomainSnapshot) domainSnapshot = NULL;
     g_autoptr(virDomainSnapshot) parent = NULL;
     guint flags;
-    g_autoptr(virDomain) domain = NULL;
+    virDomainPtr domain = NULL;
     g_autofree gchar *parentPath = NULL;
 
     g_variant_get(inArgs, "(u)", &flags);
@@ -159,7 +159,7 @@ virtDBusDomainSnapshotListAllChildren(GVariant *inArgs,
     guint flags;
     GVariantBuilder builder;
     GVariant *gdomainSnapshots;
-    g_autoptr(virDomain) domain = NULL;
+    virDomainPtr domain = NULL;
 
     g_variant_get(inArgs, "(u)", &flags);
 
-- 
2.26.2

On Wed, 2020-06-24 at 16:17 +0100, Daniel P. Berrangé wrote:
> The virDomainSnapshotGetDomain() method does NOT increment the
> refcount on the returned virDomain, so it must not be unrefed.
> 
> This double free is responsible for random failures of the
> test_snapshot.py tests.
> 
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
>  src/domainsnapshot.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Nice!

Reviewed-by: Andrea Bolognani <abologna@redhat.com>

-- 
Andrea Bolognani / Red Hat / Virtualization