Change 28251 by [EMAIL PROTECTED] on 2006/05/20 11:58:07
[perl #32332] Perl segfaults; test case available
sub f { s/$var/f()/e } could free the wrong RE
Affected files ...
... //depot/perl/cop.h#118 edit
... //depot/perl/pp_ctl.c#566 edit
... //depot/perl/pp_hot.c#468 edit
Differences ...
==== //depot/perl/cop.h#118 (text) ====
Index: perl/cop.h
--- perl/cop.h#117~28250~ 2006-05-20 04:29:26.000000000 -0700
+++ perl/cop.h 2006-05-20 04:58:07.000000000 -0700
@@ -576,10 +576,12 @@
cx->sb_rxres = NULL, \
cx->sb_rx = rx, \
cx->cx_type = CXt_SUBST; \
- rxres_save(&cx->sb_rxres, rx)
+ rxres_save(&cx->sb_rxres, rx); \
+ ReREFCNT_inc(rx)
#define POPSUBST(cx) cx = &cxstack[cxstack_ix--]; \
- rxres_free(&cx->sb_rxres)
+ rxres_free(&cx->sb_rxres); \
+ ReREFCNT_dec(cx->sb_rx)
struct context {
U32 cx_type; /* what kind of context this is */
==== //depot/perl/pp_ctl.c#566 (text) ====
Index: perl/pp_ctl.c
--- perl/pp_ctl.c#565~28183~ 2006-05-12 13:57:07.000000000 -0700
+++ perl/pp_ctl.c 2006-05-20 04:58:07.000000000 -0700
@@ -197,7 +197,7 @@
if(old != rx) {
if(old)
ReREFCNT_dec(old);
- PM_SETRE(pm,rx);
+ PM_SETRE(pm,ReREFCNT_inc(rx));
}
rxres_restore(&cx->sb_rxres, rx);
@@ -256,7 +256,6 @@
SvTAINT(targ);
LEAVE_SCOPE(cx->sb_oldsave);
- ReREFCNT_dec(rx);
POPSUBST(cx);
RETURNOP(pm->op_next);
}
==== //depot/perl/pp_hot.c#468 (text) ====
Index: perl/pp_hot.c
--- perl/pp_hot.c#467~28086~ 2006-05-03 14:46:02.000000000 -0700
+++ perl/pp_hot.c 2006-05-20 04:58:07.000000000 -0700
@@ -2303,7 +2303,6 @@
if (!c) {
register PERL_CONTEXT *cx;
SPAGAIN;
- (void)ReREFCNT_inc(rx);
PUSHSUBST(cx);
RETURNOP(cPMOP->op_pmreplroot);
}
End of Patch.
