Undeffing a gv in DESTROY triggered by undeffing the same gv

$ ./perl -Ilib -e 'sub foo{} bless \&foo; DESTROY { undef *foo } undef *foo'
Attempt to free unreferenced glob pointers, Perl interpreter: 0x7fd6a3803200 at -e line 1.

Lowering the reference count on the glob pointer only after freeing
the contents fixes this.

1 files changed, 3 insertions, 1 deletions

diff --git a/gv.c b/gv.c
index 1c86029d84..d29b1ef3cd 100644
--- a/gv.c
+++ b/gv.c
@@ -2351,9 +2351,10 @@ Perl_gp_free(pTHX_ GV *gv)
 			 pTHX__FORMAT pTHX__VALUE);
         return;
     }
-    if (--gp->gp_refcnt > 0) {
+    if (gp->gp_refcnt > 1) {
 	if (gp->gp_egv == gv)
 	    gp->gp_egv = 0;
+	gp->gp_refcnt--;
 	GvGP_set(gv, NULL);
         return;
     }
@@ -2411,6 +2412,7 @@ Perl_gp_free(pTHX_ GV *gv)
       }
     }
 
+    gp->gp_refcnt--;
     Safefree(gp);
     GvGP_set(gv, NULL);
 }