This corruption is so strange that I can't even reappear it.

(gdb) bt
#0  0x00000000006d7e9f in func_dealloc.lto_priv () at Objects/funcobject.c:451
#1  0x00000000005c730b in ask (printException=true, okIfFunctionNull=<optimized out>, errorPrefix=0x884bca "", pArgs=0x300dd440, pFunction=0x1d1f1de8) at script.cpp:758
#2  Script::call(_object*, _object*, char const*, bool) (pFunction=0x1d1f1de8, pArgs=0x300dd440, errorPrefix=0x884bca "", okIfFunctionNull=<optimized out>) at /home/smj/original/bwengine/src/lib/pyscript/script.ipp:25

now I know that in _PyObject_GC_UNTRACK, 
(gdb) x/40x  op
0x1d1f1da8:	0x6d	0x6f	0x6e	0x5f	0x73	0x65	0x72	0x76
0x1d1f1db0:	0x65	0x72	0x2f	0x72	0x75	0x6e	0x5f	0x73
0x1d1f1db8:	0x63	0x72	0x69	0x70	0x74	0x2e	0x70	0x79
0x1d1f1dc0:	0x00	0x00	0x00	0x00	0x00	0x00	0x00	0x00
0x1d1f1dc8:	0x00	0x00	0x00	0x00	0x00	0x00	0x00	0x00        ->  mov  -0x20(%rdi),%rax    -> %rax = 0
0x1d1f1dd0:	0xf8	0x4d	0xc5	0x2a	0x00	0x00	0x00	0x00        ->  mov  -0x18(%rdi),%rdx    -> %rdx = 0x2ac54df8
0x1d1f1dd8:	0xfe	0xff	0xff	0xff	0xff	0xff	0xff	0xff
0x1d1f1de0:	0xff	0xff	0xff	0xff	0xff	0xff	0xff	0xff
0x1d1f1de8:	0x00	0x00	0x00	0x00	0x00	0x00	0x00	0x00         <--PyFunctionObject      ob_refcnt 0         %rdi
0x1d1f1df0:	0x00	0xff	0xba	0x00	0x00	0x00	0x00	0x00        -> _typeobject* -> name function
0x1d1f1df8:	0x30	0x1e	0x78	0x21	0x00	0x00	0x00	0x00
0x1d1f1e00:	0x28	0xaa	0xba	0x24	0x00	0x00	0x00	0x00
0x1d1f1e08:	0x10	0x53	0xfb	0x2f	0x00	0x00	0x00	0x00

When corruption,
the ob_refcnt is 0, the gc_refs is _PyGC_REFS_UNTRACKED, the gc_next is NULL but gc_prev is not.

How can it be? Is there some unknown bug in GC?