GeezerVison

Issues

Fixes #158031, fixes #158033 — two same-class heap-use-after-free reports in the callable-with-sentinel iterators added by gh-98469.

Root cause

Both calliter_iternext() (sync iter(callable, sentinel)) and acallawaitable_handle_error() (async aiter(callable, sentinel)) compare it->it_sentinel against the produced value with PyObject_RichCompareBool() while holding only a borrowed reference. The comparison can run arbitrary Python code via a custom __eq__, and that code can release the sentinel mid-comparison:

• sync: Sentinel.__eq__ calls it.__setstate__(((), StopIteration)), which does Py_XSETREF(it->it_sentinel, NULL); once the __eq__ frame is torn down the last reference is gone and do_richcompare() continues with a freed v (ASan: UAF read at iterobject.c:285).
• async: Sentinel.__eq__ drives ait.__anext__().__await__().send(None), which reaches acallawaitable_start → callable raises StopAsyncIteration → acalliter_exhaust() → Py_CLEAR(it->it_sentinel); same freed-v continuation (ASan: UAF read at iterobject.c:644).

Fix

Hold a strong reference to the sentinel across the PyObject_RichCompareBool() call in both functions — the same pattern already used elsewhere for callbacks that can mutate the iterator (see the ordering note in calliter_reduce, gh-101765). No behavior change: the in-flight comparison still uses the sentinel that was current when the comparison started, and subsequent state (calliter_exhaust, _PyGen_SetStopIterationValue) reads the post-mutation fields as before.

Tests

• test_calliter_sentinel_reentrant_setstate in test_iter.py — __eq__ re-entrantly calls __setstate__ during next().
• test_aiter_callable_sentinel_reentrant_exhaustion in test_asyncgen.py — __eq__ re-entrantly exhausts the iterator via a nested __anext__() send.

Verification (local, ASan, --without-pymalloc, arm64 macOS)

• Both reporter PoCs: heap-use-after-free inside do_richcompare before the fix; clean run and correct semantics after (sync: next() returns the result; async: StopIteration with the produced value).
• New regression tests pass; test_iter.py and test_asyncgen.py suites unchanged otherwise.

This PR was prepared with AI-agent assistance; the changes are small, reviewed line-by-line, and covered by the added regression tests.

• Issue: uaf of it_sentinel in callable_iterator.__next__ #158031