Completely free hashes containing nulls

This fixes a regression introduced since 5.14.0, by commit e0171a1a3.

The new Perl_hfree_next_entry function that that commit introduced
returns the value of the hash element, or NULL if there are none left.
If the value of the hash element is NULL, the two cases are indistin-
guishable.

Before e0171a1a3, all the hash code took null values into account.
mro_package_moved took advantage of that, stealing values out of a
hash and leaving it to the freeing code to delete the elements.

The two places that call Perl_hfree_next_entry (there was only one,
S_hfreeentries, with commit e0171a1a3, but the following commit,
104d7b699c, made sv_clear call it, too) were not accounting for NULL
values’ being returned, and could terminate early, resulting in mem-
ory leaks.

One could argue that the perl core should not be assigning nulls to
HeVAL, but HeVAL is part of the public API and there could be CPAN
code assigning NULL to it, too.

So the safest approach seems to be to modify Perl_hfree_next_entry’s
callers to check the number of keys and not to attribute a signifi-
cance to a returned NULL.

1 files changed, 3 insertions, 2 deletions

diff --git a/sv.c b/sv.c
index faddfdc8aa..6750ef197e 100644
--- a/sv.c
+++ b/sv.c
@@ -6180,8 +6180,8 @@ Perl_sv_clear(pTHX_ SV *const orig_sv)
 		    goto free_body;
 		}
 	    } else if (SvTYPE(iter_sv) == SVt_PVHV) {
-		sv = Perl_hfree_next_entry(aTHX_ (HV*)iter_sv, &hash_index);
-		if (!sv) { /* no more elements of current HV to free */
+		if (!HvTOTALKEYS((HV *)iter_sv)) {
+		    /* no more elements of current HV to free */
 		    sv = iter_sv;
 		    type = SvTYPE(sv);
 		    /* Restore previous value of iter_sv, squirrelled away */
@@ -6197,6 +6197,7 @@ Perl_sv_clear(pTHX_ SV *const orig_sv)
 		    assert(!HvARRAY((HV*)sv));
 		    goto free_body;
 		}
+		sv = Perl_hfree_next_entry(aTHX_ (HV*)iter_sv, &hash_index);
 	    }
 
 	    /* unrolled SvREFCNT_dec and sv_free2 follows: */