Don’t leak when compiling /(?[\d\d])/

The ‘Operand with no preceding operator’ error was leaking the last
two operands.

(cherry picked from commit b573e7000fd9c1cfae30ae5fb328a25b9bf3870a)

2 files changed, 4 insertions, 1 deletions

diff --git a/regcomp.c b/regcomp.c
index befe078579..b2cf3e626d 100644
--- a/regcomp.c
+++ b/regcomp.c
@@ -11924,6 +11924,8 @@ S_handle_regex_sets(pTHX_ RExC_state_t *pRExC_state, SV** return_invlist, I32 *f
                     char current_operator;
 
                     if (IS_OPERAND(top)) {
+                        SvREFCNT_dec_NN(top);
+                        SvREFCNT_dec_NN(current);
                         vFAIL("Operand with no preceding operator");
                     }
                     current_operator = (char) SvUV(top);
diff --git a/t/op/svleak.t b/t/op/svleak.t
index c8e0354471..71bfbb734e 100644
--- a/t/op/svleak.t
+++ b/t/op/svleak.t
@@ -15,7 +15,7 @@ BEGIN {
 
 use Config;
 
-plan tests => 123;
+plan tests => 124;
 
 # run some code N times. If the number of SVs at the end of loop N is
 # greater than (N-1)*delta at the end of loop 1, we've got a leak
@@ -249,6 +249,7 @@ eleak(2,0,'no warnings; /(?[[a]^[b]])/');
 eleak(2,0,'no warnings; /(?[![a]])/');
 eleak(2,0,'no warnings; /(?[\p{Word}])/');
 eleak(2,0,'no warnings; /(?[[a]+)])/');
+eleak(2,0,'no warnings; /(?[\d\d)])/');
 
 # These can generate one ref count, but just  once.
 eleak(4,1,'chr(0x100) =~ /[[:punct:]]/');