av_extend_guts: set correct ary_offset when unshifting an array (GH#18667)

2 files changed, 7 insertions, 0 deletions

diff --git a/av.c b/av.c
index ff0cb2340c..bf19c439c4 100644
--- a/av.c
+++ b/av.c
@@ -110,6 +110,7 @@ Perl_av_extend_guts(pTHX_ AV *av, SSize_t key, SSize_t *maxp, SV ***allocp,
         if (av && *allocp != *arrayp) { /* a shifted SV* array exists */
             to_null = *arrayp - *allocp;
             *maxp += to_null;
+            ary_offset = AvFILLp(av) + 1;
 
             Move(*arrayp, *allocp, AvFILLp(av)+1, SV*);
 
diff --git a/t/op/splice.t b/t/op/splice.t
index c786802354..abf497d9fb 100644
--- a/t/op/splice.t
+++ b/t/op/splice.t
@@ -108,4 +108,10 @@ is sprintf("%s", splice @a, 0, 1, undef), "",
         "croak when splicing into readonly array";
 }
 
+# GH#18667 - av_extend_guts must zero duplicate SV*s
+fresh_perl_is('my @data = (undef) x 4; splice @data, 1, 1;
+    splice @data, 2, 1; $data[3] = undef; splice @data, 3, 1;',
+    '', {}, 'GH#18667 - av_extend_guts must zero duplicate SV*s');
+
+
 done_testing;