Don’t allow OPpTARGET_MY on postdec/inc

I was wrong in 9e319cc4f.  postfix ++/-- writes to its return value
before reading its argument.  If we optimise away the scalar
assignment in

    $a = $b++;

(that’s what OPpTARGET_MY does), then $a gets written to before $b is
read.  If $a and $b are the same, we get the wrong answer.  This bug
has been present under ‘use integer’ since 5.6.0.  I accidentally
extended it to non-integer ++/-- in 9e319cc4f.

(It’s not likely that someone will write $a = $b++, but it could hap-
pen inadvertently in more complex code.)

5 files changed, 33 insertions, 20 deletions

diff --git a/lib/B/Op_private.pm b/lib/B/Op_private.pm
index 730964c261..cdc91dc510 100644
--- a/lib/B/Op_private.pm
+++ b/lib/B/Op_private.pm
@@ -142,7 +142,7 @@ $bits{$_}{7} = 'OPpPV_IS_UTF8' for qw(dump goto last next redo);
 $bits{$_}{6} = 'OPpREFCOUNTED' for qw(leave leaveeval leavesub leavesublv leavewrite);
 $bits{$_}{6} = 'OPpRUNTIME' for qw(match pushre qr subst substcont);
 $bits{$_}{2} = 'OPpSLICEWARNING' for qw(aslice hslice padav padhv rv2av rv2hv);
-$bits{$_}{4} = 'OPpTARGET_MY' for qw(abs add atan2 chdir chmod chomp chown chr chroot concat cos crypt divide exec exp flock getpgrp getppid getpriority hex i_add i_divide i_modulo i_multiply i_negate i_postdec i_postinc i_subtract index int kill left_shift length link log match mkdir modulo multiply oct ord postdec postinc pow push rand rename repeat right_shift rindex rmdir schomp setpgrp setpriority sin sleep split sqrt srand stringify subst subtract symlink system time trans transr unlink unshift utime vec wait waitpid);
+$bits{$_}{4} = 'OPpTARGET_MY' for qw(abs add atan2 chdir chmod chomp chown chr chroot concat cos crypt divide exec exp flock getpgrp getppid getpriority hex i_add i_divide i_modulo i_multiply i_negate i_subtract index int kill left_shift length link log match mkdir modulo multiply oct ord pow push rand rename repeat right_shift rindex rmdir schomp setpgrp setpriority sin sleep split sqrt srand stringify subst subtract symlink system time trans transr unlink unshift utime vec wait waitpid);
 $bits{$_}{5} = 'OPpTRANS_COMPLEMENT' for qw(trans transr);
 $bits{$_}{7} = 'OPpTRANS_DELETE' for qw(trans transr);
 $bits{$_}{0} = 'OPpTRANS_FROM_UTF' for qw(trans transr);
diff --git a/opcode.h b/opcode.h
index 996cab60e9..8260e2bc34 100644
--- a/opcode.h
+++ b/opcode.h
@@ -1791,10 +1791,10 @@ EXTCONST U32 PL_opargs[] = {
 	0x00001144,	/* i_preinc */
 	0x00001164,	/* predec */
 	0x00001144,	/* i_predec */
-	0x0000113c,	/* postinc */
-	0x0000111c,	/* i_postinc */
-	0x0000113c,	/* postdec */
-	0x0000111c,	/* i_postdec */
+	0x0000112c,	/* postinc */
+	0x0000110c,	/* i_postinc */
+	0x0000112c,	/* postdec */
+	0x0000110c,	/* i_postdec */
 	0x0001121e,	/* pow */
 	0x0001123e,	/* multiply */
 	0x0001121e,	/* i_multiply */
@@ -2412,10 +2412,10 @@ EXTCONST I16  PL_op_private_bitdef_ix[] = {
        0, /* i_preinc */
        0, /* predec */
        0, /* i_predec */
-      72, /* postinc */
-      72, /* i_postinc */
-      72, /* postdec */
-      72, /* i_postdec */
+       0, /* postinc */
+       0, /* i_postinc */
+       0, /* postdec */
+       0, /* i_postdec */
       74, /* pow */
       74, /* multiply */
       74, /* i_multiply */
@@ -2762,7 +2762,7 @@ EXTCONST I16  PL_op_private_bitdef_ix[] = {
  */
 
 EXTCONST U16  PL_op_private_bitdefs[] = {
-    0x0003, /* scalar, prototype, refgen, srefgen, ref, readline, regcmaybe, regcreset, regcomp, chop, schop, defined, undef, study, preinc, i_preinc, predec, i_predec, negate, not, complement, ucfirst, lcfirst, uc, lc, quotemeta, aeach, akeys, avalues, each, values, pop, shift, range, and, or, dor, andassign, orassign, dorassign, method, method_named, entergiven, leavegiven, enterwhen, leavewhen, untie, tied, dbmclose, getsockname, getpeername, lstat, stat, readlink, readdir, telldir, rewinddir, closedir, localtime, alarm, require, dofile, entertry, ghbyname, gnbyname, gpbyname, shostent, snetent, sprotoent, sservent, gpwnam, gpwuid, ggrnam, ggrgid, lock, once, reach, rvalues, fc */
+    0x0003, /* scalar, prototype, refgen, srefgen, ref, readline, regcmaybe, regcreset, regcomp, chop, schop, defined, undef, study, preinc, i_preinc, predec, i_predec, postinc, i_postinc, postdec, i_postdec, negate, not, complement, ucfirst, lcfirst, uc, lc, quotemeta, aeach, akeys, avalues, each, values, pop, shift, range, and, or, dor, andassign, orassign, dorassign, method, method_named, entergiven, leavegiven, enterwhen, leavewhen, untie, tied, dbmclose, getsockname, getpeername, lstat, stat, readlink, readdir, telldir, rewinddir, closedir, localtime, alarm, require, dofile, entertry, ghbyname, gnbyname, gpbyname, shostent, snetent, sprotoent, sservent, gpwnam, gpwuid, ggrnam, ggrgid, lock, once, reach, rvalues, fc */
     0x281c, 0x3a19, /* pushmark */
     0x00bd, /* wantarray, runcv */
     0x03b8, 0x1490, 0x3acc, 0x3588, 0x2be5, /* const */
@@ -2784,7 +2784,7 @@ EXTCONST U16  PL_op_private_bitdefs[] = {
     0x0c9c, 0x1c18, 0x0834, 0x3d30, 0x384c, 0x1fa8, 0x01e4, 0x0141, /* trans, transr */
     0x0adc, 0x0458, 0x0067, /* sassign */
     0x0758, 0x290c, 0x0067, /* aassign */
-    0x3d30, 0x0003, /* chomp, schomp, postinc, i_postinc, postdec, i_postdec, i_negate, sin, cos, exp, log, sqrt, int, hex, oct, abs, length, ord, chr, chroot, rmdir */
+    0x3d30, 0x0003, /* chomp, schomp, i_negate, sin, cos, exp, log, sqrt, int, hex, oct, abs, length, ord, chr, chroot, rmdir */
     0x3d30, 0x0067, /* pow, multiply, i_multiply, divide, i_divide, modulo, i_modulo, add, i_add, subtract, i_subtract, concat, left_shift, right_shift */
     0x0f78, 0x3d30, 0x0067, /* repeat */
     0x3d30, 0x012f, /* stringify, atan2, rand, srand, index, rindex, crypt, push, unshift, flock, chdir, chown, unlink, chmod, utime, rename, link, symlink, mkdir, waitpid, system, exec, kill, getpgrp, setpgrp, getpriority, setpriority, sleep */
@@ -2885,10 +2885,10 @@ EXTCONST U8 PL_op_private_valid[] = {
     /* I_PREINC   */ (OPpARG1_MASK),
     /* PREDEC     */ (OPpARG1_MASK),
     /* I_PREDEC   */ (OPpARG1_MASK),
-    /* POSTINC    */ (OPpARG1_MASK|OPpTARGET_MY),
-    /* I_POSTINC  */ (OPpARG1_MASK|OPpTARGET_MY),
-    /* POSTDEC    */ (OPpARG1_MASK|OPpTARGET_MY),
-    /* I_POSTDEC  */ (OPpARG1_MASK|OPpTARGET_MY),
+    /* POSTINC    */ (OPpARG1_MASK),
+    /* I_POSTINC  */ (OPpARG1_MASK),
+    /* POSTDEC    */ (OPpARG1_MASK),
+    /* I_POSTDEC  */ (OPpARG1_MASK),
     /* POW        */ (OPpARG2_MASK|OPpTARGET_MY),
     /* MULTIPLY   */ (OPpARG2_MASK|OPpTARGET_MY),
     /* I_MULTIPLY */ (OPpARG2_MASK|OPpTARGET_MY),
diff --git a/pp.c b/pp.c
index b18c15ad4e..ce21640f88 100644
--- a/pp.c
+++ b/pp.c
@@ -1080,7 +1080,7 @@ PP(pp_postinc)
 	PL_op->op_type == OP_POSTINC || PL_op->op_type == OP_I_POSTINC;
     if (SvTYPE(TOPs) >= SVt_PVAV || (isGV_with_GP(TOPs) && !SvFAKE(TOPs)))
 	Perl_croak_no_modify();
-    if (!(PL_op->op_private & OPpTARGET_MY) && SvROK(TOPs))
+    if (SvROK(TOPs))
 	TARG = sv_newmortal();
     sv_setsv(TARG, TOPs);
     if (!SvREADONLY(TOPs) && !SvGMAGICAL(TOPs) && SvIOK_notUV(TOPs) && !SvNOK(TOPs) && !SvPOK(TOPs)
diff --git a/regen/opcodes b/regen/opcodes
index 0176e55b1a..2a0430dc0e 100644
--- a/regen/opcodes
+++ b/regen/opcodes
@@ -111,10 +111,10 @@ preinc		preincrement (++)		ck_lfun		dIs1	S
 i_preinc	integer preincrement (++)	ck_lfun		dis1	S
 predec		predecrement (--)		ck_lfun		dIs1	S
 i_predec	integer predecrement (--)	ck_lfun		dis1	S
-postinc		postincrement (++)		ck_lfun		IsT1	S
-i_postinc	integer postincrement (++)	ck_lfun		isT1	S
-postdec		postdecrement (--)		ck_lfun		IsT1	S
-i_postdec	integer postdecrement (--)	ck_lfun		isT1	S
+postinc		postincrement (++)		ck_lfun		Ist1	S
+i_postinc	integer postincrement (++)	ck_lfun		ist1	S
+postdec		postdecrement (--)		ck_lfun		Ist1	S
+i_postdec	integer postdecrement (--)	ck_lfun		ist1	S
 
 # Ordinary operators.
 
diff --git a/t/op/inc.t b/t/op/inc.t
index 7fa7592b36..a563d7057d 100644
--- a/t/op/inc.t
+++ b/t/op/inc.t
@@ -336,4 +336,17 @@ tie my $t, "";
 }
 is $store::called, 4, 'STORE called on "my" target';
 
+{
+    # Temporarily broken between before 5.6.0 (b162f9ea/21f5b33c) and
+    # between 5.21.5 and 5.21.6 (9e319cc4fd)
+    my $x = 7;
+    $x = $x++;
+    is $x, 7, '$lex = $lex++';
+    $x = 7;
+    # broken in b162f9ea (5.6.0); fixed in 5.21.6
+    use integer;
+    $x = $x++;
+    is $x, 7, '$lex = $lex++ under use integer';
+}
+
 done_testing();