GeezerVison

calliter_iternext() called it_callable and compared the result against it_sentinel through borrowed pointers.

• In all builds, the sentinel's __eq__ can call __setstate__() and free the sentinel while the comparison is using it (uaf of it_sentinel in callable_iterator.__next__ #158031).
• In the free-threaded build, another thread can free the fields by exhausting the iterator or calling __setstate__(), and two threads exhausting the iterator can both DECREF the callable (Crash when a callable iterator is shared between threads #161792).

Sharing a callable iterator between threads, or calling __setstate__() on one that is in use, is not supported: the values produced are unspecified. It must not crash, though. That lets the fix avoid a lock:

• Readers load a field (acquire) and take a strong reference right away, before any code can run. The callable is held across the call and the sentinel across the comparison.
• Writers (exhaustion and __setstate__()) swap the field with an atomic exchange, so only one thread gets the old value, and release it with _PyObject_XDecRefDelayed(). In the free-threaded build that defers the DECREF until no thread can still be between its load and its incref; in the default build it is a plain Py_XDECREF().

This also covers gh-158031, so it overlaps with #158046, which takes a strong reference to the sentinel only.

Performance

Release builds (Clang 20, no PGO/LTO), single thread pinned to one CPU, ns per item including consumption overhead (deque(islice(it, N), maxlen=0)), best of 7, mean of two runs.

Free-threaded build:

Default (GIL) build:

The cost is about 1 ns per item in the free-threaded build and 0-3 ns in the default build, from the strong references to the callable and sentinel. It is only visible when the callable is trivially cheap.