Fix bug #15161 by increasing the refcount on the RE and making

sure to restore it correctly. Deals with both s//e and s///g.

p4raw-id: //depot/perl@19342

diff --git a/pp_ctl.c b/pp_ctl.c
index ac05b2f..91fc2ca 100644 (file)
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -98,7 +98,7 @@ PP(pp_regcomp)
            memNE(PM_GETRE(pm)->precomp, t, len))
        {
            if (PM_GETRE(pm)) {
-               ReREFCNT_dec(PM_GETRE(pm));
+               ReREFCNT_dec(PM_GETRE(pm));
                PM_SETRE(pm, Null(REGEXP*));    /* crucial if regcomp aborts */
            }
            if (PL_op->op_flags & OPf_SPECIAL)
@@ -159,6 +159,15 @@ PP(pp_substcont)
     register REGEXP *rx = cx->sb_rx;
     SV *nsv = Nullsv;
 
+    { 
+      REGEXP *old = PM_GETRE(pm);
+      if(old != rx) {
+       if(old) 
+         ReREFCNT_dec(old);
+       PM_SETRE(pm,rx);
+      }
+    }
+
     rxres_restore(&cx->sb_rxres, rx);
     RX_MATCH_UTF8_set(rx, SvUTF8(cx->sb_targ));
 
@@ -213,6 +222,7 @@ PP(pp_substcont)
            SvTAINT(targ);
 
            LEAVE_SCOPE(cx->sb_oldsave);
+           ReREFCNT_dec(rx);
            POPSUBST(cx);
            RETURNOP(pm->op_next);
        }
@@ -248,6 +258,7 @@ PP(pp_substcont)
            sv_pos_b2u(sv, &i);
        mg->mg_len = i;
     }
+    ReREFCNT_inc(rx);
     cx->sb_rxtainted |= RX_MATCH_TAINTED(rx);
     rxres_save(&cx->sb_rxres, rx);
     RETURNOP(pm->op_pmreplstart);

diff --git a/pp_hot.c b/pp_hot.c
index b740007..c6a533b 100644 (file)
--- a/pp_hot.c
+++ b/pp_hot.c
@@ -2161,6 +2161,7 @@ PP(pp_subst)
        if (!c) {
            register PERL_CONTEXT *cx;
            SPAGAIN;
+           ReREFCNT_inc(rx);
            PUSHSUBST(cx);
            RETURNOP(cPMOP->op_pmreplroot);
        }