"Anders Johnson (via RT)" wrote: [snip] > + if(PL_psig_ptr[i]) { > + to_dec=PL_psig_ptr[i]; > + PL_psig_ptr[i]=0; > + SvREFCNT_dec(to_dec); > + } How often is stuff like this used/needed, throughout perl's source? It's not exactly something one can grep for, after all... I suspect (fear) that many places where this should be done, but isn't. Eg, av_clear stores sv_undef in the array slot before decrementing the refcount of that sv, but neither av_undef nor av_fill do. In gv_fetchmeth, I see: SvREFCNT_dec(cv); GvCV(topgv) = cv = Nullcv; Should this do something similar (replace, then dec?)? I suppose that it's rare that coderefs get blessed at all, let alone into classes with destructors, so it would be hard to provoke this accidentally, but it's concievable. There're other places throughout perl which likewise derecemnt before replacing. perl -e '@x = (bless[]); sub DESTROY{pop @x}; undef @x' perl -e '@x = (bless[]); sub DESTROY{pop @x}; $#x=-1' perl -e '%x = (1,bless[]); sub DESTROY{ delete $x{1}; }; %x=()' Knowing that the problem exists, I'm sure that someone could come up with perl code which provokes the others. -- $..='(?:(?{local$^C=$^C|'.(1<<$_).'})|)'for+a..4; $..='(?{print+substr"\n !,$^C,1 if $^C<26})(?!)'; $.=~s'!'haktrsreltanPJ,r coeueh"';BEGIN{${"\cH"} |=(1<<21)}""=~$.;qw(Just another Perl hacker,\n);