Variety of small INC/DECREF patches that fix reported memory leaks

with free variables.  Thanks to Martin v. Loewis for finding two of
the problems.  This fixes SF buf 405583.

There is also a C API change: PyFrame_New() is reverting to its
pre-2.1 signature.  The change introduced by nested scopes was a
mistake.  XXX Is this okay between beta releases?

cell_clear(), the GC helper, must decref its reference to break
cycles.

frame_dealloc() must dealloc all cell vars and free vars in addition
to locals.

eval_code2() setup code must INCREF cells it copies out of the
closure.

The STORE_DEREF opcode implementation must DECREF the object it passes
to PyCell_Set().

1 files changed, 7 insertions, 4 deletions

diff --git a/Python/ceval.c b/Python/ceval.c
index 8f449a1..cb5936d 100644
--- a/Python/ceval.c
+++ b/Python/ceval.c
@@ -430,7 +430,7 @@ eval_code2(PyCodeObject *co, PyObject *globals, PyObject *locals,
 
 	f = PyFrame_New(tstate,			/*back*/
 			co,			/*code*/
-			globals, locals, closure);
+			globals, locals);
 	if (f == NULL)
 		return NULL;
 
@@ -578,8 +578,11 @@ eval_code2(PyCodeObject *co, PyObject *globals, PyObject *locals,
 	}
 	if (f->f_nfreevars) {
 		int i;
-		for (i = 0; i < f->f_nfreevars; ++i)
-			freevars[f->f_ncells + i] = PyTuple_GET_ITEM(closure, i);
+		for (i = 0; i < f->f_nfreevars; ++i) {
+			PyObject *o = PyTuple_GET_ITEM(closure, i);
+			Py_INCREF(o);
+			freevars[f->f_ncells + i] = o;
+		}
 	}
 
 	if (tstate->sys_tracefunc != NULL) {
@@ -1662,7 +1665,6 @@ eval_code2(PyCodeObject *co, PyObject *globals, PyObject *locals,
 				err = -1;
 				break;
 			}
-			Py_INCREF(w);
 			PUSH(w);
 			break;
 
@@ -1670,6 +1672,7 @@ eval_code2(PyCodeObject *co, PyObject *globals, PyObject *locals,
 			w = POP();
 			x = freevars[oparg];
 			PyCell_Set(x, w);
+			Py_DECREF(w);
 			continue;
 
 		case BUILD_TUPLE: