Re: [perl #15439] unreferenced scalar due to double DESTROY

Message-ID: <20030119164353.B24444@fdgroup.com>

p4raw-id: //depot/perl@18554

diff --git a/av.c b/av.c
index acc9963..10cc2fe 100644 (file)
--- a/av.c
+++ b/av.c
@@ -453,8 +453,11 @@ Perl_av_clear(pTHX_ register AV *av)
        ary = AvARRAY(av);
        key = AvFILLp(av) + 1;
        while (key) {
-           SvREFCNT_dec(ary[--key]);
+           SV * sv = ary[--key];
+           /* undef the slot before freeing the value, because a
+            * destructor might try to modify this arrray */
            ary[key] = &PL_sv_undef;
+           SvREFCNT_dec(sv);
        }
     }
     if ((key = AvARRAY(av) - AvALLOC(av))) {

diff --git a/t/op/array.t b/t/op/array.t
index 472e02c..8f2f1a9 100755 (executable)
--- a/t/op/array.t
+++ b/t/op/array.t
@@ -1,6 +1,12 @@
 #!./perl
 
-print "1..72\n";
+
+BEGIN {
+    chdir 't' if -d 't';
+    @INC = '../lib';
+}
+
+print "1..73\n";
 
 #
 # @foo, @bar, and @ary are also used from tie-stdarray after tie-ing them
@@ -247,3 +253,22 @@ sub tary {
 
 @tary = (0..50);
 tary();
+
+
+require './test.pl';
+
+# bugid #15439 - clearing an array calls destructors which may try
+# to modify the array - caused 'Attempt to free unreferenced scalar'
+
+my $got = runperl (
+       prog => q{
+                   sub X::DESTROY { @a = () }
+                   @a = (bless {}, 'X');
+                   @a = ();
+               },
+       stderr => 1
+    );
+
+$got =~ s/\n/ /g;
+print "# $got\nnot " unless $got eq '';
+print "ok 73\n";