In Perl_sv_del_backref(), don't panic if the backref array is already freed.

During global destruction, it's possible for the array containing
backreferences to be freed before the SV that owns it. If this happens, don't
mistake it for a scalar backreference stored directly, and then get confused
and panic because things seem inconsistent.

http://www.xray.mpe.mpg.de/mailing-lists/perl5-porters/2011-12/msg00039.html
gives more information.

1 files changed, 3 insertions, 0 deletions

diff --git a/sv.c b/sv.c
index 7a11a79145..8f623db95f 100644
--- a/sv.c
+++ b/sv.c
@@ -5618,6 +5618,9 @@ Perl_sv_del_backref(pTHX_ SV *const tsv, SV *const sv)
 	assert(count ==1);
 	AvFILLp(av) = fill-1;
     }
+    else if (SvIS_FREED(*svp) && PL_phase == PERL_PHASE_DESTRUCT) {
+	/* freed AV; skip */
+    }
     else {
 	/* optimisation: only a single backref, stored directly */
 	if (*svp != sv)