PyFrameObject.f_gen is a pointer (not a reference) to a generator/coroutine object.  But the latter doesn't always correctly clean it up when it dies.  This pointer is used by frame.clear().

Here is an example I made, which ends in a segfault.  This example assumes we apply the patch of issue27811 first, otherwise it just crashes earlier in the same way as issue27811.

    # execute this with "python -Werror"
    import gc
    async def f():
        pass
    cr = f()
    frame = cr.cr_frame
    del cr
    gc.collect()
    # create some randomness to reuse the memory just freed by 'cr'
    import asyncio
    print("ping")
    frame.clear()

Patch attached.  No test, but you can copy the above example.

New changeset 3e4452424f9b by Benjamin Peterson in branch '3.5':
clear out f_gen during generator finalization (closes #27812)
https://hg.python.org/cpython/rev/3e4452424f9b

New changeset 1d7a938b1e47 by Benjamin Peterson in branch 'default':
merge 3.5 (#27812)
https://hg.python.org/cpython/rev/1d7a938b1e47