Double free in connection_dealloc; can connection_dealloc() be called twice?

Per subject -- my process is crashing with an error to the effect that 
glibc is detecting a double-free attempt. This is happening with 
pysqlite 2.3.2 trying to run trac via mod_python 3.2.10 under apache 2.2.3.

There are obviously a lot of moving parts here, but the stack trace 
shows pysqlite as the most immediately involved party. The issue is 
supposedly at +0x4e, which puts it at 0x880e in my binary:

     87f3:       e8 d0 d8 ff ff          callq  60c8 <sqlite3_close@plt>
     87f8:       48 89 df                mov    %rbx,%rdi
     87fb:       e8 d8 da ff ff          callq  62d8 
<PyEval_RestoreThread@plt>
     8800:       48 8b 7d 38             mov    0x38(%rbp),%rdi
     8804:       48 85 ff                test   %rdi,%rdi
     8807:       74 05                   je     880e 
<connection_dealloc+0x4e>
     8809:       e8 fa dc ff ff          callq  6508 <PyMem_Free@plt>
 >>> 880e:       48 8b 55 30             mov    0x30(%rbp),%rdx
     8812:       48 85 d2                test   %rdx,%rdx
     8815:       74 0e                   je     8825 
<connection_dealloc+0x65>
     8817:       8b 02                   mov    (%rdx),%eax

The stack trace follows:

*** glibc detected *** /usr/sbin/apache2: double free or corruption 
(fasttop): 0x0000000000a8ba70 ***
======= Backtrace: =========
/lib/libc.so.6[0x2b95c62f440d]
/lib/libc.so.6(__libc_free+0x6c)[0x2b95c62f5a0c]
/usr/lib64/python2.4/site-packages/pysqlite2/_sqlite.so(connection_dealloc+0x4e)[0x2b95ccc5f80e]
/usr/lib64/apache2/modules/mod_python.so[0x2b95c9aafa89]
/usr/lib64/apache2/modules/mod_python.so(PyEval_EvalCodeEx+0x363)[0x2b95c9a70fd3]
/usr/lib64/apache2/modules/mod_python.so[0x2b95c9ab1013]
/usr/lib64/apache2/modules/mod_python.so(PyObject_Call+0x10)[0x2b95c9a27e90]
/usr/lib64/apache2/modules/mod_python.so[0x2b95c9a2ce4c]
/usr/lib64/apache2/modules/mod_python.so(PyObject_Call+0x10)[0x2b95c9a27e90]
/usr/lib64/apache2/modules/mod_python.so[0x2b95c9a543ec]
/usr/lib64/apache2/modules/mod_python.so[0x2b95c9a507a8]
/usr/lib64/apache2/modules/mod_python.so(PyObject_Call+0x10)[0x2b95c9a27e90]
/usr/lib64/apache2/modules/mod_python.so(PyEval_EvalFrame+0x2ce6)[0x2b95c9a6ec06]
/usr/lib64/apache2/modules/mod_python.so(PyEval_EvalCodeEx+0x81c)[0x2b95c9a7148c]
/usr/lib64/apache2/modules/mod_python.so[0x2b95c9ab0fac]
/usr/lib64/apache2/modules/mod_python.so(PyObject_Call+0x10)[0x2b95c9a27e90]


Now, as to how it's happening, I'm completely miffed -- and I can't 
reproduce it from my own Python code. Could connection_dealloc() be 
getting called twice for the same object? If so, that would explain it 
since we aren't clearing self->begin_statement after we free the memory.

(After nulling out the pointer post-free and recompiling, Apache still 
crashes on retrieving the page in question -- but without the stack 
trace and other such miscellany associated).


Thanks!