homepage

It looks like the bug is the pattern "Py_DECREF(obj->attr); obj->attr = new_value;". Replacing it with "{ PyObject *tmp = obj->attr; obj->attr = new_value; Py_DECREF(tmp); }" does fix this specific issue.
We can use the coccinelle tool to replace all such patterns in the whole CPython code base using attached py_decref_replace.spatch "semantic patch". See also issue #16445, I proposed a similar idea (and another semantic patch).
Attached python27_decref_replace.patch patch is the result of the command "spatch -in_place -sp_file py_decref_replace.spatch -dir .".
The patch is quite huge, I didn't read it yet :-)
 Mac/Modules/carbonevt/_CarbonEvtmodule.c | 7 +++++--
 Mac/Modules/list/_Listmodule.c | 7 +++++--
 Modules/_bsddb.c | 42 ++++++++++++++++++++++++++++++------------
 Modules/_csv.c | 7 +++++--
 Modules/_ctypes/_ctypes.c | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----------------------------
 Modules/_curses_panel.c | 7 +++++--
 Modules/_elementtree.c | 81 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++---------------------
 Modules/_json.c | 7 +++++--
 Modules/_sqlite/connection.c | 28 ++++++++++++++++++++--------
 Modules/_sqlite/cursor.c | 42 ++++++++++++++++++++++++++++++------------
 Modules/bz2module.c | 9 +++++----
 Modules/cPickle.c | 36 +++++++++++++++++++++++++++---------
 Modules/flmodule.c | 28 ++++++++++++++++++++--------
 Modules/itertoolsmodule.c | 7 +++++--
 Modules/selectmodule.c | 7 +++++--
 Modules/signalmodule.c | 7 +++++--
 Modules/svmodule.c | 7 +++++--
 Modules/zlibmodule.c | 23 +++++++++++++++--------
 Objects/descrobject.c | 7 +++++--
 Objects/exceptions.c | 21 +++++++++++++++------
 Objects/fileobject.c | 14 ++++++++++----
 Objects/funcobject.c | 7 +++++--
 Objects/typeobject.c | 21 +++++++++++++++------
 Python/ceval.c | 7 +++++--
 Python/sysmodule.c | 7 +++++--
 25 files changed, 382 insertions(+), 152 deletions(-)