Directly constructed `uvloop.loop.Server(None)` segfaults in `close()`

Summary

uvloop.loop.Server(None) constructs an object, but calling close() on it terminates the interpreter.
I found this while fuzzing Python C extension modules.
I realize this is not a realistic input or usage pattern, but I would expect a Python exception rather than a process crash.

Versions

uvloop 0.22.1, CPython 3.12.3, Debian 12 x86_64, glibc 2.36

Reproducer

from uvloop.loop import Server

server = Server(None)
server.close()

Segmentation fault (core dumped)

ASan/UBSan result

I built uvloop 0.22.1 from source with Clang 18 using ASan and UBSan instrumentation.
ASan reports a read from address 0x158 on the Server.close() path:

AddressSanitizer:DEADLYSIGNAL
ERROR: AddressSanitizer: SEGV on unknown address 0x000000000158
The signal is caused by a READ memory access.
Hint: address points to the zero page.

    #0 PyType_IsSubtype
    #1 CPython set operation
    #2 __Pyx_PySet_Discard  uvloop/loop.c:194862:17
    #3 Server._unref        uvloop/loop.c:160673:15
    #4 Server.close         uvloop/loop.c:161676:19

SUMMARY: AddressSanitizer: SEGV in PyType_IsSubtype

The sanitizer process exits with code 134 after ASan aborts.
UBSan did not emit a separate diagnostic before the ASan failure.

从 uvloop/loop.c 中确定的 Server.close 和 Server._unref 路径开始，然后使用 Server(None) 的 Python 代码片段复现该故障。在 ASan 下跟踪 close 路径，并验证复现程序会引发 Python 异常，或以其他方式完成而不会终止解释器。