[perl #92264] Freeing $a or $b during sort causes a double free

On Sat Jan 14 22:53:05 2012, sprout wrote:
> On Sun Jun 05 15:51:34 2011, sprout wrote:
> > $ perl5.14.0 -e '@_ = sort { *a = \1 } 1, 2'
> > Attempt to free unreferenced scalar: SV 0x826480, Perl interpreter:
> > 0x800000.
> > 
> > I think pp_sort is misusing SAVESPTR.
> 
> Attached is a test case.  I don’t know how to fix this efficiently. 
> Currently GvSV(*a) and GvSV(*b) are not reference-counted during sort. 
> But no other code knows about that.
> 
> Making them reference-counted is the obvious fix, but I presume it was
> not done originally for efficency’s sake.

But incrementing and decrementing a reference count should not be too
slow, and correctness is definitely a good thing.  The attached patch is
the obvious fix, but it changes an existing TODO test into an assertion
failure.

So, this being rare enough, it should probably wait until the stack is
reference-counted.

-- 

Father Chrysostomos

• [perl #92264] Freeing $a or $b during sort causes a double free by Father Chrysostomos via RT
• [perl #92264] Freeing $a or $b during sort causes a double free by Father Chrysostomos via RT