[3.12] gh-106092: Fix use-after-free crash in frame_dealloc (GH-106875) (#107532)

[3.12] gh-106092: Fix use-after-free crash in frame_dealloc (GH-106875) (#107532)

gh-106092: Fix use-after-free crash in frame_dealloc (GH-106875)

It was possible for the trashcan to delay the deallocation of a
PyFrameObject until after its corresponding _PyInterpreterFrame has
already been freed.  So frame_dealloc needs to avoid dereferencing the
f_frame pointer unless it first checks that the pointer still points
to the interpreter frame within the frame object.

(cherry picked from commit 557b05c7a5334de5da3dc94c108c0121f10b9191)

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
Co-authored-by: Anders Kaseorg <andersk@mit.edu>