Don’t let active formats be freed

This crashes:

format FOO =
@<
undef *FOO
.
$~ = FOO;
write

The context stack needs to hold a reference count for formats, just as
it does for subs.

1 files changed, 2 insertions, 0 deletions

diff --git a/cop.h b/cop.h
index 4cf9fe4027..ed55483a94 100644
--- a/cop.h
+++ b/cop.h
@@ -627,6 +627,7 @@ struct block_format {
 	cx->blk_format.gv = gv;						\
 	cx->blk_format.retop = (retop);					\
 	cx->blk_format.dfoutgv = PL_defoutgv;				\
+	if (!CvDEPTH(cv)) SvREFCNT_inc_simple_void_NN(cv);		\
 	CvDEPTH(cv)++;							\
 	SvREFCNT_inc_void(cx->blk_format.dfoutgv)
 
@@ -681,6 +682,7 @@ struct block_format {
 #define POPFORMAT(cx)							\
 	setdefout(cx->blk_format.dfoutgv);				\
 	CvDEPTH(cx->blk_format.cv)--;					\
+	if (!CvDEPTH(cx->blk_format.cv)) SvREFCNT_dec(cx->blk_format.cv); \
 	SvREFCNT_dec(cx->blk_format.dfoutgv);
 
 /* eval context */