[perl #99660] Remove elems from hashes before freeing them

Commit f50383f58 made the ‘HeVAL(entry) = &PL_sv_placeholder;’ in the
hash-element-deletion code unconditional.  In doing so, it put it
after the if/else statement containing the SvREFCNT_dec.  So the freed
SV was visible in the hash to destructors called by SvREFCNT_dec.

1 files changed, 11 insertions, 1 deletions

diff --git a/t/op/hash.t b/t/op/hash.t
index fa66f4cbdb..b8aeaa7d2e 100644
--- a/t/op/hash.t
+++ b/t/op/hash.t
@@ -8,7 +8,7 @@ BEGIN {
 
 use strict;
 
-plan tests => 9;
+plan tests => 10;
 
 my %h;
 
@@ -158,3 +158,13 @@ is($destroyed, 1, 'Timely hash destruction with lvalue keys');
     delete $a{a};
     ok $gone, 'deleting the current iterator in void context frees the val'
 }
+
+# [perl #99660] Deleted hash element visible to destructor
+{
+    my %h;
+    $h{k} = bless [];
+    my $normal_exit;
+    local *::DESTROY = sub { my $x = $h{k}; ++$normal_exit };
+    delete $h{k}; # must be in void context to trigger the bug
+    ok $normal_exit, 'freed hash elems are not visible to DESTROY';
+}