From 60a26c797bbff039ea7f861903732e7cceae415a Mon Sep 17 00:00:00 2001
From: Hugo van der Sanden <hv@crypt.org>
Date: Sun, 15 May 2016 13:48:58 -0700
Subject: [PATCH 1/2] [perl #128086] Fix precedence in hv_ename_delete
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A stash’s array of names may have null for the first entry, in which
case it is not one of the effective names, and the name count will
be negative.

The ‘count > 0’ is meant to prevent hv_ename_delete from trying to
read that entry, but a precedence problem introduced in 4643eb699
stopped it from doing that.

[This commit message was written by the committer.]

Signed-off-by: Petr Písař <ppisar@redhat.com>
---
 hv.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hv.c b/hv.c
index 7b5ad95..5523475 100644
--- a/hv.c
+++ b/hv.c
@@ -2476,9 +2476,10 @@ Perl_hv_ename_delete(pTHX_ HV *hv, const char *name, U32 len, U32 flags)
 		return;
 	    }
 	if (
-	    count > 0 && (HEK_UTF8(*namep) || (flags & SVf_UTF8)) 
+	    count > 0 && ((HEK_UTF8(*namep) || (flags & SVf_UTF8)) 
                 ? hek_eq_pvn_flags(aTHX_ *namep, name, (I32)len, flags)
 	        : (HEK_LEN(*namep) == (I32)len && memEQ(HEK_KEY(*namep), name, len))
+            )
 	) {
 	    aux->xhv_name_count = -count;
 	}
-- 
2.5.5

From 7f1bd063e5aa5aeb26ed9c39db6864cc0ecd7a73 Mon Sep 17 00:00:00 2001
From: Father Chrysostomos <sprout@cpan.org>
Date: Sun, 15 May 2016 13:49:33 -0700
Subject: [PATCH 2/2] [perl #128086] Test the prev commit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Petr Písař <ppisar@redhat.com>
---
 t/op/stash.t | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/t/op/stash.t b/t/op/stash.t
index 151b729..b8e0f34 100644
--- a/t/op/stash.t
+++ b/t/op/stash.t
@@ -7,7 +7,7 @@ BEGIN {
 
 BEGIN { require "./test.pl"; }
 
-plan( tests => 51 );
+plan( tests => 52 );
 
 # Used to segfault (bug #15479)
 fresh_perl_like(
@@ -334,3 +334,10 @@ is runperl(
    ),
    "ok\n",
    '[perl #123847] no crash from *foo::=*bar::=*glob_with_hash';
+
+is runperl(
+    prog => '%h; *::::::=*h; delete $::{q|::|}; print qq|ok\n|',
+    stderr => 1,
+   ),
+   "ok\n",
+   '[perl #128086] no crash from assigning hash to *:::::: & deleting it';
-- 
2.5.5