Fix assertion failure with $#a=\1

If the array has been freed and a reference is then assigned to
the arylen scalar and then get-magic is called on that scalar,
Perl_magic_getarylen misbehaves.  SvOK_off is not sufficient if
arbitrary values can be assigned by Perl code.  Globs, refs and
regexps (among others) need special handling, which sv_setsv
knows how to do.

2 files changed, 6 insertions, 2 deletions

diff --git a/mg.c b/mg.c
index 5403f67dfd..305817c76f 100644
--- a/mg.c
+++ b/mg.c
@@ -2020,7 +2020,7 @@ Perl_magic_getarylen(pTHX_ SV *sv, const MAGIC *mg)
     if (obj) {
 	sv_setiv(sv, AvFILL(obj));
     } else {
-	SvOK_off(sv);
+	sv_setsv(sv, NULL);
     }
     return 0;
 }
diff --git a/t/op/array.t b/t/op/array.t
index 1064ed7da3..4c3be2c717 100644
--- a/t/op/array.t
+++ b/t/op/array.t
@@ -6,7 +6,7 @@ BEGIN {
     require 'test.pl';
 }
 
-plan (135);
+plan (136);
 
 #
 # @foo, @bar, and @ary are also used from tie-stdarray after tie-ing them
@@ -493,5 +493,9 @@ sub {
          'error when setting alias to -1 elem of empty array';
 }->($plink[0], $plink[-2], $plink[-5], $plunk[-1]);
 
+$_ = \$#{[]};
+$$_ = \1;
+"$$_";
+pass "no assertion failure after assigning ref to arylen when ary is gone";
 
 "We're included by lib/Tie/Array/std.t so we need to return something true";