The correct solution is to reference count the regexp in PL_reg_curpm,

rather than put in lots of hacks to work round not reference counting
it.

p4raw-id: //depot/perl@32938

1 files changed, 6 insertions, 3 deletions

diff --git a/regexec.c b/regexec.c
index 9a41f202ca..5ce1ee3de1 100644
--- a/regexec.c
+++ b/regexec.c
@@ -2256,15 +2256,18 @@ S_regtry(pTHX_ regmatch_info *reginfo, char **startpos)
 #ifdef USE_ITHREADS
             {
 		SV* const repointer = newSViv(0);
-                /* so we know which PL_regex_padav element is PL_reg_curpm
-		   when clearing up in perl_destruct() */
-                SvFLAGS(repointer) |= SVf_BREAK;
+                /* this regexp is also owned by the new PL_reg_curpm, which
+		   will try to free it.  */
                 av_push(PL_regex_padav, repointer);
                 PL_reg_curpm->op_pmoffset = av_len(PL_regex_padav);
                 PL_regex_pad = AvARRAY(PL_regex_padav);
             }
 #endif      
         }
+	/* This is safe against NULLs: */
+	ReREFCNT_dec(PM_GETRE(PL_reg_curpm));
+	/* PM_reg_curpm owns a reference to this regexp.  */
+	ReREFCNT_inc(rx);
 	PM_SETRE(PL_reg_curpm, rx);
 	PL_reg_oldcurpm = PL_curpm;
 	PL_curpm = PL_reg_curpm;