The bus is also reproducible upstream, although the python client segfaults there rather than reporting invalid pointers.

In any case, we have a nasty bug in python bindings. virDomainSnapshotGetDomain() API (called as snapshot.getDomain() in python) returns the domain object but does not increment its reference counter. However, we just take it and wrap it as virDomain object in python and once the object is deleted, it calls virDomainFree. And virDomainFree is called once more when the snapshot object is deleted (as it holds a reference to the domain). Thus, before creating a virDomain object from the domain pointer returned by virDomainSnapshotGetDomain, we need to call virDomainRef to increment its reference counter.

Unfortunately, it seems virDomainSnapshotGetDomain API is not the only one affected and we have similar bugs in other APIs too.

Fixed upstream by v1.0.2-rc1-6-g7b35fd7:

commit 7b35fd718d2156224797ace08f752dfbb9884520
Author: Jiri Denemark <jdenemar>
Date:   Wed Jan 23 12:14:57 2013 +0100

    python: Fix bindings for virDomainSnapshotGet{Domain,Connect}
    
    https://bugzilla.redhat.com/show_bug.cgi?id=895882
    
    virDomainSnapshot.getDomain() and virDomainSnapshot.getConnect()
    wrappers around virDomainSnapshotGet{Domain,Connect} were not supposed
    to be ever implemented. The class should contain proper domain() and
    connect() accessors that fetch python objects stored internally within
    the class. While domain() was already provided, connect() was missing.
    
    This patch adds connect() method to virDomainSnapshot class and
    reimplements getDomain() and getConnect() methods as aliases to domain()
    and connect() for backward compatibility.

Verify it as follows. The result is expected. 

# rpm -q libvirt-python
libvirt-python-0.10.2-19.el6.x86_64


# virsh snapshot-list kvm-rhel6.4-x86_64-qcow2-virtio
 Name                 Creation Time             State
------------------------------------------------------------
 1373349897           2013-07-09 02:04:57 -0400 running
 1373349908           2013-07-09 02:05:08 -0400 running


# cat snapshot.py
import libvirt
def snapshot():
    con = libvirt.open('')
    dom = con.lookupByName('kvm-rhel6.4-x86_64-qcow2-virtio')
    snapshot_list = dom.listAllSnapshots(0)
    print "snapshot object list:%s" % snapshot_list
    domain = snapshot_list[0].getDomain()
    domain_name = domain.name()
    print "domain name:%s" % domain_name
if __name__=='__main__':
    snapshot()

# python snapshot.py
snapshot object list:[<libvirt.virDomainSnapshot instance at 0x7fb2cb9a0e18>, <libvirt.virDomainSnapshot instance at 0x7fb2cb9a0e60>]
domain name:kvm-rhel6.4-x86_64-qcow2-virtio


# cat snapshot1.py 
#!/usr/bin/env python
import libvirt
def snapshot():
    con = libvirt.open('')
    dom = con.lookupByName('kvm-rhel6.4-x86_64-qcow2-virtio')
    snapshot_list = dom.listAllSnapshots(0)
    print "snapshot object list: %s" % snapshot_list
    for snapshot_item in snapshot_list:
        domain = snapshot_item.getDomain()
        print "domain name: %s " % domain.name()

if __name__=='__main__':
    snapshot()

# python snapshot1.py
snapshot object list: [<libvirt.virDomainSnapshot instance at 0x7fa941a7ae60>, <libvirt.virDomainSnapshot instance at 0x7fa941a7aea8>]
domain name: kvm-rhel6.4-x86_64-qcow2-virtio 
domain name: kvm-rhel6.4-x86_64-qcow2-virtio

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-1581.html