fix [perl #24660], [perl #24663].

p4raw-id: //depot/perl@21936

diff --git a/mg.c b/mg.c
index d98a6d5..66e02b7 100644 (file)
--- a/mg.c
+++ b/mg.c
@@ -1927,14 +1927,14 @@ Perl_magic_killbackrefs(pTHX_ SV *sv, MAGIC *mg)
     SV **svp = AvARRAY(av);
     I32 i = AvFILLp(av);
     while (i >= 0) {
-       if (svp[i] && svp[i] != &PL_sv_undef) {
+       if (svp[i]) {
            if (!SvWEAKREF(svp[i]))
                Perl_croak(aTHX_ "panic: magic_killbackrefs");
            /* XXX Should we check that it hasn't changed? */
            SvRV(svp[i]) = 0;
            (void)SvOK_off(svp[i]);
            SvWEAKREF_off(svp[i]);
-           svp[i] = &PL_sv_undef;
+           svp[i] = Nullsv;
        }
        i--;
     }

diff --git a/sv.c b/sv.c
index fdfa6d0..1202fe2 100644 (file)
--- a/sv.c
+++ b/sv.c
@@ -5137,15 +5137,13 @@ S_sv_add_backref(pTHX_ SV *tsv, SV *sv)
         * by magic_killbackrefs() when tsv is being freed */
     }
     if (AvFILLp(av) >= AvMAX(av)) {
+        I32 i;
         SV **svp = AvARRAY(av);
-        I32 i = AvFILLp(av);
-        while (i >= 0) {
-            if (svp[i] == &PL_sv_undef) {
+        for (i = AvFILLp(av); i >= 0; i--)
+            if (!svp[i]) {
                 svp[i] = sv;        /* reuse the slot */
                 return;
             }
-            i--;
-        }
         av_extend(av, AvFILLp(av)+1);
     }
     AvARRAY(av)[++AvFILLp(av)] = sv; /* av_push() */
@@ -5167,13 +5165,8 @@ S_sv_del_backref(pTHX_ SV *sv)
        Perl_croak(aTHX_ "panic: del_backref");
     av = (AV *)mg->mg_obj;
     svp = AvARRAY(av);
-    i = AvFILLp(av);
-    while (i >= 0) {
-       if (svp[i] == sv) {
-           svp[i] = &PL_sv_undef; /* XXX */
-       }
-       i--;
-    }
+    for (i = AvFILLp(av); i >= 0; i--)
+       if (svp[i] == sv) svp[i] = Nullsv;
 }
 
 /*
@@ -9799,16 +9792,15 @@ Perl_mg_dup(pTHX_ MAGIC *mg, CLONE_PARAMS* param)
            nmg->mg_obj = (SV*)re_dup((REGEXP*)mg->mg_obj, param);
        }
        else if(mg->mg_type == PERL_MAGIC_backref) {
-            AV *av = (AV*) mg->mg_obj;
-            SV **svp;
-            I32 i;
-            nmg->mg_obj = (SV*)newAV();
-            svp = AvARRAY(av);
-            i = AvFILLp(av);
-            while (i >= 0) {
-                 av_push((AV*)nmg->mg_obj,sv_dup(svp[i],param));
-                 i--;
-            }
+           AV *av = (AV*) mg->mg_obj;
+           SV **svp;
+           I32 i;
+           SvREFCNT_inc(nmg->mg_obj = (SV*)newAV());
+           svp = AvARRAY(av);
+           for (i = AvFILLp(av); i >= 0; i--) {
+               if (!svp[i] || SvREFCNT(svp[i]) < 2) continue;
+               av_push((AV*)nmg->mg_obj,sv_dup(svp[i],param));
+           }
        }
        else {
            nmg->mg_obj = (mg->mg_flags & MGf_REFCOUNTED)