Similar to the "decref before set" issue solved by Py_CLEAR(), the code in typeobject.c calls DECREF in the middle of a cache update. This leaves one cache entry in an invalid state during the DECREF call, which might result in running cleanup code in this state. If this code depends on an attribute lookup, this might lead to a cache lookup, which in turn can access the infected part of the cache. In the worst case, such a scenario can lead to a crash as it accesses an already cleaned-up object. Here is a patch that fixes this.
This was actually not a bug because the object being decref'ed is guaranteed to be exactly a string or None, as told in the comment about the 'name' field. So no user code could possibly run during this Py_DECREF() call.
