pp_ctl.c - refetch @INC from *INC after hook

The original value may have been freed by the time the hook
returns, so we have to refetch it immediately after execution.

We also move the declaration into a more minimal scope.

1 files changed, 8 insertions, 1 deletions

diff --git a/pp_ctl.c b/pp_ctl.c
index 02c67fc91c..1b0be6f196 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -4260,7 +4260,6 @@ S_require_file(pTHX_ SV *sv)
      * For searchable paths, just search @INC normally
      */
     if (!tryrsfp && !(errno == EACCES && !path_searchable)) {
-        AV * const inc_ar = GvAVn(PL_incgv);
         SSize_t inc_idx;
 #ifdef VMS
         if (vms_unixname)
@@ -4268,6 +4267,7 @@ S_require_file(pTHX_ SV *sv)
         {
             SV *nsv = sv;
             namesv = newSV_type(SVt_PV);
+            AV *inc_ar = GvAVn(PL_incgv);
             for (inc_idx = 0; inc_idx <= AvFILL(inc_ar); inc_idx++) {
                 SV * const dirsv = *av_fetch(inc_ar, inc_idx, TRUE);
 
@@ -4376,6 +4376,13 @@ S_require_file(pTHX_ SV *sv)
                     FREETMPS;
                     LEAVE_with_name("call_INC_hook");
 
+                    /*
+                     It is possible that @INC has been replaced and that inc_ar
+                     now points at a freed AV. So we have to refresh it from
+                     the GV to be sure.
+                    */
+                    inc_ar = GvAVn(PL_incgv);
+
                     /* Now re-mortalize it. */
                     sv_2mortal(filter_cache);