Don't use the stack to allocate a SV that we hand out to another

function, only badness can ensure.
Message-Id: <20030418180131.GD10086@fdgroup.com>
Thanks go to Dave Mitchell for help in tracking down the bug!

p4raw-id: //depot/perl@19265

diff --git a/sv.c b/sv.c
index 5a51269..1de42fb 100644 (file)
--- a/sv.c
+++ b/sv.c
@@ -5309,34 +5309,37 @@ Perl_sv_clear(pTHX_ register SV *sv)
        if (PL_defstash) {              /* Still have a symbol table? */
            dSP;
            CV* destructor;
-           SV tmpref;
 
-           Zero(&tmpref, 1, SV);
-           sv_upgrade(&tmpref, SVt_RV);
-           SvROK_on(&tmpref);
-           SvREADONLY_on(&tmpref);     /* DESTROY() could be naughty */
-           SvREFCNT(&tmpref) = 1;
+
 
            do {        
                stash = SvSTASH(sv);
                destructor = StashHANDLER(stash,DESTROY);
                if (destructor) {
+                   SV* tmpref = newRV(sv);
+                   SvREADONLY_on(tmpref);   /* DESTROY() could be naughty */
                    ENTER;
                    PUSHSTACKi(PERLSI_DESTROY);
-                   SvRV(&tmpref) = SvREFCNT_inc(sv);
                    EXTEND(SP, 2);
                    PUSHMARK(SP);
-                   PUSHs(&tmpref);
+                   PUSHs(tmpref);
                    PUTBACK;
                    call_sv((SV*)destructor, G_DISCARD|G_EVAL|G_KEEPERR|G_VOID);
-                   SvREFCNT(sv)--;
+                  
+                   
                    POPSTACK;
                    SPAGAIN;
                    LEAVE;
+                   if(SvREFCNT(tmpref) < 2) {
+                       /* tmpref is not kept alive! */
+                       SvREFCNT(sv)--;
+                       SvRV(tmpref) = 0;
+                       SvROK_off(tmpref);
+                   }
+                   SvREFCNT_dec(tmpref);
                }
            } while (SvOBJECT(sv) && SvSTASH(sv) != stash);
 
-           del_XRV(SvANY(&tmpref));
 
            if (SvREFCNT(sv)) {
                if (PL_in_clean_objs)