Fix crash with (??{undef *^R}) and (?{})

$ ./perl -Ilib -e '"" =~ /(??{undef *^R;""})(?{42})/'
Segmentation fault: 11

This started crashing in 4b22688e5c.

What happens is that the undef frees the scalar pointed to by oreplsv
in regtry,  Then that scalar is reused for the regexp object created
from the return value of the ?? block.  sv_setsv(oreplsv,...) ends up
trying to set the IV slot of a regexp, overwriting the engine field
(sv_setsv probably needs an assertion).  Then later accesses crash
because r->engine is now a bad pointer.

(Though why it only started crashing in 4b22688e5c and not before I
have not figured out.)

The solution is for S_regtry to hang on to the SV with an extra refer-
ence count in case it gets freed.

1 files changed, 10 insertions, 1 deletions

diff --git a/t/re/pat.t b/t/re/pat.t
index d875ea67f2..b53853b67b 100644
--- a/t/re/pat.t
+++ b/t/re/pat.t
@@ -20,7 +20,7 @@ BEGIN {
     require './test.pl';
 }
 
-plan tests => 710;  # Update this when adding/deleting tests.
+plan tests => 711;  # Update this when adding/deleting tests.
 
 run_tests() unless caller;
 
@@ -1485,6 +1485,15 @@ EOP
 	*^R = *caretRglobwithnoscalar;
 	"" =~ /(?{42})/;
 	is $^R, 42, 'assigning to *^R does not result in a crash';
+	is runperl(
+	     stderr => 1,
+	     prog => 'eval q|'
+	            .' q-..- =~ /(??{undef *^R;q--})(?{42})/; '
+                    .' print qq-$^R\n-'
+	            .'|'
+	   ),
+	   "42\n",
+	   'undefining *^R within (??{}) does not result in a crash';
     }
 
     {