$ref++, $ref-- leaked referent

[perl #9466]

pp_postinc and pp_postdec used a pad TARG to return a copy of the
original value. When that value was a reference, it meant a copy
of the reference would hang out in the pad forever and so the referent
would leak. Fix this by using a mortal instead.

1 files changed, 17 insertions, 1 deletions

diff --git a/t/op/inc.t b/t/op/inc.t
index 99123c79d6..8cbc63b163 100644
--- a/t/op/inc.t
+++ b/t/op/inc.t
@@ -2,7 +2,7 @@
 
 # use strict;
 
-print "1..54\n";
+print "1..56\n";
 
 my $test = 1;
 
@@ -281,3 +281,19 @@ ok (scalar eval { my $pvbm = PVBM; $pvbm-- });
 ok (scalar eval { my $pvbm = PVBM; ++$pvbm });
 ok (scalar eval { my $pvbm = PVBM; --$pvbm });
 
+# #9466
+
+# don't use pad TARG when the thing you're copying is a ref, or the referent
+# won't get freed.
+{
+    package P9466;
+    my $x;
+    sub DESTROY { $x = 1 }
+    for (0..1) {
+	$x = 0;
+	my $a = bless {};
+	my $b = $_ ? $a++ : $a--;
+	undef $a; undef $b;
+	::ok ($x, $x, "9466 case $_");
+    }
+}