From: Dave Mitchell <davem@fdisolutions.com>
Date: Thu, 23 Oct 2003 19:13:20 +0000 (+0000)
Subject: Fix two threads::shared leaks
X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?a=commitdiff_plain;h=aa49c2f8cdfe618e292a459ac4668178f67243bd;p=p5sagit%2Fp5-mst-13.2.git

Fix two threads::shared leaks
#24061 - AV in shared interpreter wasn't set to AvREAL
#24255 - mortals were added to the shared interpreter's tmpstack
	and never freed.

p4raw-id: //depot/perl@21527
---

diff --git a/ext/threads/shared/shared.xs b/ext/threads/shared/shared.xs
index b19da1e..52f54be 100644
--- a/ext/threads/shared/shared.xs
+++ b/ext/threads/shared/shared.xs
@@ -308,6 +308,8 @@ Perl_sharedsv_associate(pTHX_ SV **psv, SV *ssv, shared_sv *data)
     if (sv && SvTYPE(ssv) < SvTYPE(sv)) {
 	SHARED_CONTEXT;
 	sv_upgrade(ssv, SvTYPE(*psv));
+	if (SvTYPE(ssv) == SVt_PVAV)	/* #24061 */
+	    AvREAL_on(ssv);
 	CALLER_CONTEXT;
     }
 
@@ -436,6 +438,12 @@ sharedsv_scalar_store(pTHX_ SV *sv, shared_sv *shared)
 	if (target) {
 	    SV *tmp;
 	    SHARED_CONTEXT;
+	    /* #24255: sv_setsv() (via sv_unref_flags()) may cause a
+	     * deferred free with sv_2mortal(). Ensure that the free_tmps
+	     * is done within this inpterpreter. DAPM.
+	     */
+	    ENTER;
+	    SAVETMPS;
 	    tmp = newRV(SHAREDSvPTR(target));
 	    sv_setsv_nomg(SHAREDSvPTR(shared), tmp);
 	    SvREFCNT_dec(tmp);
@@ -444,6 +452,8 @@ sharedsv_scalar_store(pTHX_ SV *sv, shared_sv *shared)
 	      SvOBJECT_on(SHAREDSvPTR(target));
 	      SvSTASH(SHAREDSvPTR(target)) = (HV*)fake_stash;
 	    }
+	    FREETMPS;
+	    LEAVE;
 	    CALLER_CONTEXT;
 	}
 	else {