Re: [perl #15439] unreferenced scalar due to double DESTROY

Message-ID: <20030119164353.B24444@fdgroup.com>

p4raw-id: //depot/perl@18554

2 files changed, 30 insertions, 2 deletions

diff --git a/av.c b/av.c
index acc9963eec..10cc2fef99 100644
--- a/av.c
+++ b/av.c
@@ -453,8 +453,11 @@ Perl_av_clear(pTHX_ register AV *av)
 	ary = AvARRAY(av);
 	key = AvFILLp(av) + 1;
 	while (key) {
-	    SvREFCNT_dec(ary[--key]);
+	    SV * sv = ary[--key];
+	    /* undef the slot before freeing the value, because a
+	     * destructor might try to modify this arrray */
 	    ary[key] = &PL_sv_undef;
+	    SvREFCNT_dec(sv);
 	}
     }
     if ((key = AvARRAY(av) - AvALLOC(av))) {
diff --git a/t/op/array.t b/t/op/array.t
index 472e02cd35..8f2f1a9510 100755
--- a/t/op/array.t
+++ b/t/op/array.t
@@ -1,6 +1,12 @@
 #!./perl
 
-print "1..72\n";
+
+BEGIN {
+    chdir 't' if -d 't';
+    @INC = '../lib';
+}
+
+print "1..73\n";
 
 #
 # @foo, @bar, and @ary are also used from tie-stdarray after tie-ing them
@@ -247,3 +253,22 @@ sub tary {
 
 @tary = (0..50);
 tary();
+
+
+require './test.pl';
+
+# bugid #15439 - clearing an array calls destructors which may try
+# to modify the array - caused 'Attempt to free unreferenced scalar'
+
+my $got = runperl (
+	prog => q{
+		    sub X::DESTROY { @a = () }
+		    @a = (bless {}, 'X');
+		    @a = ();
+		},
+	stderr => 1
+    );
+
+$got =~ s/\n/ /g;
+print "# $got\nnot " unless $got eq '';
+print "ok 73\n";