gen_iternext(): repair subtle refcount problem.

NeilS, please check!  This came from staring at your genbug.py, but I'm
not sure it plugs all possible holes.  Without this, I caught a
frameobject refcount going negative, and it was also the cause (in debug
build) of _Py_ForgetReference's attempt to forget an object with already-
NULL _ob_prev and _ob_next pointers -- although I'm still not entirely
sure how!  Part of the difficulty is that frameobjects are stored on a
free list that gets recycled very quickly, so if there's a stray pointer
to one of them it never looks like an insane frameobject (never goes
trough the free() mangling MS debug forces, etc).

diff --git a/Python/ceval.c b/Python/ceval.c
index cf917dbcb564f79e0db805604af876918831422a..ea5c5378995a8c492dc6db60a753461e1890e498 100644 (file)
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -152,6 +152,11 @@ gen_iternext(genobject *gen)
         gen->running = 1;
        result = eval_frame(f);
         gen->running = 0;
+        /* The connection between this frame and its parent is over now, so
+           must NULL out f_back lest it get decref'ed when gen dies (note
+           that eval_frame sets f->f_back without bumping its refcount:  we
+           never had a fully legit reference to it). */
+       f->f_back = NULL;
         return result;
 }