[perl #92264] Freeing $a or $b during sort causes a double free

On Sun Jun 05 15:51:34 2011, sprout wrote:
> $ perl5.14.0 -e '@_ = sort { *a = \1 } 1, 2'
> Attempt to free unreferenced scalar: SV 0x826480, Perl interpreter:
> 0x800000.
> 
> I think pp_sort is misusing SAVESPTR.

Attached is a test case.  I don’t know how to fix this efficiently. 
Currently GvSV(*a) and GvSV(*b) are not reference-counted during sort. 
But no other code knows about that.

Making them reference-counted is the obvious fix, but I presume it was
not done originally for efficency’s sake.

-- 

Father Chrysostomos

• [perl #92264] Freeing $a or $b during sort causes a double free by Father Chrysostomos via RT
• [perl #92264] Freeing $a or $b during sort causes a double free by Father Chrysostomos via RT