This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
[rt.cpan.org #45885] File::Spec: Don’t use tainted tmpdir in 5.6
[perl5.git] / pp.c
diff --git a/pp.c b/pp.c
index c1e4c11..3c290dd 100644 (file)
--- a/pp.c
+++ b/pp.c
@@ -147,8 +147,6 @@ static const char S_no_symref_sv[] =
 
    When noinit is true, the absence of a gv will cause a retval of undef.
    This is unrelated to the cv-to-gv assignment case.
-
-   Make sure to use SPAGAIN after calling this.
 */
 
 static SV *
@@ -165,7 +163,7 @@ S_rv2gv(pTHX_ SV *sv, const bool vivify_sv, const bool strict,
        sv = SvRV(sv);
        if (SvTYPE(sv) == SVt_PVIO) {
            GV * const gv = MUTABLE_GV(sv_newmortal());
-           gv_init(gv, 0, "", 0, 0);
+           gv_init(gv, 0, "__ANONIO__", 10, 0);
            GvIOp(gv) = MUTABLE_IO(sv);
            SvREFCNT_inc_void_NN(sv);
            sv = MUTABLE_SV(gv);
@@ -253,7 +251,6 @@ PP(pp_rv2gv)
           ((PL_op->op_flags & OPf_SPECIAL) && !(PL_op->op_flags & OPf_MOD))
              || PL_op->op_type == OP_READLINE
          );
-    SPAGAIN;
     if (PL_op->op_private & OPpLVAL_INTRO)
        save_gp(MUTABLE_GV(sv), !(PL_op->op_flags & OPf_SPECIAL));
     SETs(sv);
@@ -315,7 +312,6 @@ PP(pp_rv2sv)
     if (SvROK(sv)) {
        if (SvAMAGIC(sv)) {
            sv = amagic_deref_call(sv, to_sv_amg);
-           SPAGAIN;
        }
 
        sv = SvRV(sv);
@@ -753,9 +749,11 @@ PP(pp_trans)
     }
     TARG = sv_newmortal();
     if(PL_op->op_type == OP_TRANSR) {
-       SV * const newsv = newSVsv(sv);
+       STRLEN len;
+       const char * const pv = SvPV(sv,len);
+       SV * const newsv = newSVpvn_flags(pv, len, SVs_TEMP|SvUTF8(sv));
        do_trans(newsv);
-       mPUSHs(newsv);
+       PUSHs(newsv);
     }
     else PUSHi(do_trans(sv));
     RETURN;
@@ -799,7 +797,7 @@ S_do_chomp(pTHX_ SV *retval, SV *sv, bool chomping)
             /* SV is copy-on-write */
            sv_force_normal_flags(sv, 0);
         }
-        if (SvREADONLY(sv))
+        else
             Perl_croak_no_modify(aTHX);
     }
 
@@ -884,7 +882,7 @@ S_do_chomp(pTHX_ SV *retval, SV *sv, bool chomping)
                    SvIVX(retval) += rs_charlen;
                }
            }
-           s = SvPV_force_nolen(sv);
+           s = SvPV_force_nomg_nolen(sv);
            SvCUR_set(sv, len);
            *SvEND(sv) = '\0';
            SvNIOK_off(sv);
@@ -2956,6 +2954,73 @@ PP(pp_length)
     RETURN;
 }
 
+/* Returns false if substring is completely outside original string.
+   No length is indicated by len_iv = 0 and len_is_uv = 0.  len_is_uv must
+   always be true for an explicit 0.
+*/
+bool
+Perl_translate_substr_offsets(pTHX_ STRLEN curlen, IV pos1_iv,
+                                   bool pos1_is_uv, IV len_iv,
+                                   bool len_is_uv, STRLEN *posp,
+                                   STRLEN *lenp)
+{
+    IV pos2_iv;
+    int    pos2_is_uv;
+
+    PERL_ARGS_ASSERT_TRANSLATE_SUBSTR_OFFSETS;
+
+    if (!pos1_is_uv && pos1_iv < 0 && curlen) {
+       pos1_is_uv = curlen-1 > ~(UV)pos1_iv;
+       pos1_iv += curlen;
+    }
+    if ((pos1_is_uv || pos1_iv > 0) && (UV)pos1_iv > curlen)
+       return FALSE;
+
+    if (len_iv || len_is_uv) {
+       if (!len_is_uv && len_iv < 0) {
+           pos2_iv = curlen + len_iv;
+           if (curlen)
+               pos2_is_uv = curlen-1 > ~(UV)len_iv;
+           else
+               pos2_is_uv = 0;
+       } else {  /* len_iv >= 0 */
+           if (!pos1_is_uv && pos1_iv < 0) {
+               pos2_iv = pos1_iv + len_iv;
+               pos2_is_uv = (UV)len_iv > (UV)IV_MAX;
+           } else {
+               if ((UV)len_iv > curlen-(UV)pos1_iv)
+                   pos2_iv = curlen;
+               else
+                   pos2_iv = pos1_iv+len_iv;
+               pos2_is_uv = 1;
+           }
+       }
+    }
+    else {
+       pos2_iv = curlen;
+       pos2_is_uv = 1;
+    }
+
+    if (!pos2_is_uv && pos2_iv < 0) {
+       if (!pos1_is_uv && pos1_iv < 0)
+           return FALSE;
+       pos2_iv = 0;
+    }
+    else if (!pos1_is_uv && pos1_iv < 0)
+       pos1_iv = 0;
+
+    if ((UV)pos2_iv < (UV)pos1_iv)
+       pos2_iv = pos1_iv;
+    if ((UV)pos2_iv > curlen)
+       pos2_iv = curlen;
+
+    /* pos1_iv and pos2_iv both in 0..curlen, so the cast is safe */
+    *posp = (STRLEN)( (UV)pos1_iv );
+    *lenp = (STRLEN)( (UV)pos2_iv - (UV)pos1_iv );
+
+    return TRUE;
+}
+
 PP(pp_substr)
 {
     dVAR; dSP; dTARGET;
@@ -2965,12 +3030,10 @@ PP(pp_substr)
     SV *   pos_sv;
     IV     pos1_iv;
     int    pos1_is_uv;
-    IV     pos2_iv;
-    int    pos2_is_uv;
     SV *   len_sv;
     IV     len_iv = 0;
-    int    len_is_uv = 1;
-    const I32 lvalue = PL_op->op_flags & OPf_MOD || LVRET;
+    int    len_is_uv = 0;
+    I32 lvalue = PL_op->op_flags & OPf_MOD || LVRET;
     const bool rvalue = (GIMME_V != G_VOID);
     const char *tmps;
     SV *repl_sv = NULL;
@@ -2982,15 +3045,11 @@ PP(pp_substr)
 
     if (num_args > 2) {
        if (num_args > 3) {
-         if((repl_sv = POPs)) {
-           repl = SvPV_const(repl_sv, repl_len);
-           repl_is_utf8 = DO_UTF8(repl_sv) && repl_len;
-         }
-         else num_args--;
+         if(!(repl_sv = POPs)) num_args--;
        }
        if ((len_sv = POPs)) {
            len_iv    = SvIV(len_sv);
-           len_is_uv = SvIOK_UV(len_sv);
+           len_is_uv = len_iv ? SvIOK_UV(len_sv) : 1;
        }
        else num_args--;
     }
@@ -2998,8 +3057,14 @@ PP(pp_substr)
     pos1_iv    = SvIV(pos_sv);
     pos1_is_uv = SvIOK_UV(pos_sv);
     sv = POPs;
+    if (PL_op->op_private & OPpSUBSTR_REPL_FIRST) {
+       assert(!repl_sv);
+       repl_sv = POPs;
+    }
     PUTBACK;
     if (repl_sv) {
+       repl = SvPV_const(repl_sv, repl_len);
+       repl_is_utf8 = DO_UTF8(repl_sv) && repl_len;
        if (repl_is_utf8) {
            if (!DO_UTF8(sv))
                sv_utf8_upgrade(sv);
@@ -3007,6 +3072,25 @@ PP(pp_substr)
        else if (DO_UTF8(sv))
            repl_need_utf8_upgrade = TRUE;
     }
+    else if (lvalue) {
+       SV * ret;
+       ret = sv_2mortal(newSV_type(SVt_PVLV));  /* Not TARG RT#67838 */
+       sv_magic(ret, NULL, PERL_MAGIC_substr, NULL, 0);
+       LvTYPE(ret) = 'x';
+       LvTARG(ret) = SvREFCNT_inc_simple(sv);
+       LvTARGOFF(ret) =
+           pos1_is_uv || pos1_iv >= 0
+               ? (STRLEN)(UV)pos1_iv
+               : (LvFLAGS(ret) |= 1, (STRLEN)(UV)-pos1_iv);
+       LvTARGLEN(ret) =
+           len_is_uv || len_iv > 0
+               ? (STRLEN)(UV)len_iv
+               : (LvFLAGS(ret) |= 2, (STRLEN)(UV)-len_iv);
+
+       SPAGAIN;
+       PUSHs(ret);    /* avoid SvSETMAGIC here */
+       RETURN;
+    }
     tmps = SvPV_const(sv, curlen);
     if (DO_UTF8(sv)) {
         utf8_curlen = sv_len_utf8(sv);
@@ -3018,87 +3102,16 @@ PP(pp_substr)
     else
        utf8_curlen = 0;
 
-    if (!pos1_is_uv && pos1_iv < 0 && curlen) {
-       pos1_is_uv = curlen-1 > ~(UV)pos1_iv;
-       pos1_iv += curlen;
-    }
-    if ((pos1_is_uv || pos1_iv > 0) && (UV)pos1_iv > curlen)
-       goto bound_fail;
-
-    if (num_args > 2) {
-       if (!len_is_uv && len_iv < 0) {
-           pos2_iv = curlen + len_iv;
-           if (curlen)
-               pos2_is_uv = curlen-1 > ~(UV)len_iv;
-           else
-               pos2_is_uv = 0;
-       } else {  /* len_iv >= 0 */
-           if (!pos1_is_uv && pos1_iv < 0) {
-               pos2_iv = pos1_iv + len_iv;
-               pos2_is_uv = (UV)len_iv > (UV)IV_MAX;
-           } else {
-               if ((UV)len_iv > curlen-(UV)pos1_iv)
-                   pos2_iv = curlen;
-               else
-                   pos2_iv = pos1_iv+len_iv;
-               pos2_is_uv = 1;
-           }
-       }
-    }
-    else {
-       pos2_iv = curlen;
-       pos2_is_uv = 1;
-    }
-
-    if (!pos2_is_uv && pos2_iv < 0) {
-       if (!pos1_is_uv && pos1_iv < 0)
-           goto bound_fail;
-       pos2_iv = 0;
-    }
-    else if (!pos1_is_uv && pos1_iv < 0)
-       pos1_iv = 0;
-
-    if ((UV)pos2_iv < (UV)pos1_iv)
-       pos2_iv = pos1_iv;
-    if ((UV)pos2_iv > curlen)
-       pos2_iv = curlen;
-
     {
-       /* pos1_iv and pos2_iv both in 0..curlen, so the cast is safe */
-       const STRLEN pos = (STRLEN)( (UV)pos1_iv );
-       const STRLEN len = (STRLEN)( (UV)pos2_iv - (UV)pos1_iv );
-       STRLEN byte_len = len;
-       STRLEN byte_pos = utf8_curlen
-           ? sv_pos_u2b_flags(sv, pos, &byte_len, SV_CONST_RETURN) : pos;
-
-       if (lvalue && !repl) {
-           SV * ret;
-
-           if (!SvGMAGICAL(sv)) {
-               if (SvROK(sv)) {
-                   SvPV_force_nolen(sv);
-                   Perl_ck_warner(aTHX_ packWARN(WARN_SUBSTR),
-                                  "Attempt to use reference as lvalue in substr");
-               }
-               if (isGV_with_GP(sv))
-                   SvPV_force_nolen(sv);
-               else if (SvOK(sv))      /* is it defined ? */
-                   (void)SvPOK_only_UTF8(sv);
-               else
-                   sv_setpvs(sv, ""); /* avoid lexical reincarnation */
-           }
+       STRLEN pos, len, byte_len, byte_pos;
 
-           ret = sv_2mortal(newSV_type(SVt_PVLV));  /* Not TARG RT#67838 */
-           sv_magic(ret, NULL, PERL_MAGIC_substr, NULL, 0);
-           LvTYPE(ret) = 'x';
-           LvTARG(ret) = SvREFCNT_inc_simple(sv);
-           LvTARGOFF(ret) = pos;
-           LvTARGLEN(ret) = len;
+       if (!translate_substr_offsets(
+               curlen, pos1_iv, pos1_is_uv, len_iv, len_is_uv, &pos, &len
+       )) goto bound_fail;
 
-           SPAGAIN;
-           PUSHs(ret);    /* avoid SvSETMAGIC here */
-           RETURN;
-       }
+       byte_len = len;
+       byte_pos = utf8_curlen
+           ? sv_pos_u2b_flags(sv, pos, &byte_len, SV_CONST_RETURN) : pos;
 
        tmps += byte_pos;
 
@@ -3122,6 +3135,10 @@ PP(pp_substr)
                repl = SvPV_const(repl_sv_copy, repl_len);
                repl_is_utf8 = DO_UTF8(repl_sv_copy) && repl_len;
            }
+           if (SvROK(sv))
+               Perl_ck_warner(aTHX_ packWARN(WARN_SUBSTR),
+                           "Attempt to use reference as lvalue in substr"
+               );
            if (!SvOK(sv))
                sv_setpvs(sv, "");
            sv_insert_flags(sv, byte_pos, byte_len, repl, repl_len, 0);
@@ -3138,7 +3155,7 @@ PP(pp_substr)
     RETURN;
 
 bound_fail:
-    if (lvalue || repl)
+    if (repl)
        Perl_croak(aTHX_ "substr outside of string");
     Perl_ck_warner(aTHX_ packWARN(WARN_SUBSTR), "substr outside of string");
     RETPUSHUNDEF;
@@ -3430,63 +3447,15 @@ PP(pp_crypt)
 /* Generally UTF-8 and UTF-EBCDIC are indistinguishable at this level.  So 
  * most comments below say UTF-8, when in fact they mean UTF-EBCDIC as well */
 
-/* Below are several macros that generate code */
 /* Generates code to store a unicode codepoint c that is known to occupy
- * exactly two UTF-8 and UTF-EBCDIC bytes; it is stored into p and p+1. */
-#define STORE_UNI_TO_UTF8_TWO_BYTE(p, c)                                   \
-    STMT_START {                                                           \
-       *(p) = UTF8_TWO_BYTE_HI(c);                                         \
-       *((p)+1) = UTF8_TWO_BYTE_LO(c);                                     \
-    } STMT_END
-
-/* Like STORE_UNI_TO_UTF8_TWO_BYTE, but advances p to point to the next
- * available byte after the two bytes */
+ * exactly two UTF-8 and UTF-EBCDIC bytes; it is stored into p and p+1,
+ * and p is advanced to point to the next available byte after the two bytes */
 #define CAT_UNI_TO_UTF8_TWO_BYTE(p, c)                                     \
     STMT_START {                                                           \
        *(p)++ = UTF8_TWO_BYTE_HI(c);                                       \
        *((p)++) = UTF8_TWO_BYTE_LO(c);                                     \
     } STMT_END
 
-/* Generates code to store the upper case of latin1 character l which is known
- * to have its upper case be non-latin1 into the two bytes p and p+1.  There
- * are only two characters that fit this description, and this macro knows
- * about them, and that the upper case values fit into two UTF-8 or UTF-EBCDIC
- * bytes */
-#define STORE_NON_LATIN1_UC(p, l)                                          \
-STMT_START {                                                               \
-    if ((l) == LATIN_SMALL_LETTER_Y_WITH_DIAERESIS) {                      \
-       STORE_UNI_TO_UTF8_TWO_BYTE((p), LATIN_CAPITAL_LETTER_Y_WITH_DIAERESIS);  \
-    } else { /* Must be the following letter */                                                                    \
-       STORE_UNI_TO_UTF8_TWO_BYTE((p), GREEK_CAPITAL_LETTER_MU);           \
-    }                                                                      \
-} STMT_END
-
-/* Like STORE_NON_LATIN1_UC, but advances p to point to the next available byte
- * after the character stored */
-#define CAT_NON_LATIN1_UC(p, l)                                                    \
-STMT_START {                                                               \
-    if ((l) == LATIN_SMALL_LETTER_Y_WITH_DIAERESIS) {                      \
-       CAT_UNI_TO_UTF8_TWO_BYTE((p), LATIN_CAPITAL_LETTER_Y_WITH_DIAERESIS);    \
-    } else {                                                               \
-       CAT_UNI_TO_UTF8_TWO_BYTE((p), GREEK_CAPITAL_LETTER_MU);             \
-    }                                                                      \
-} STMT_END
-
-/* Generates code to add the two UTF-8 bytes (probably u) that are the upper
- * case of l into p and p+1.  u must be the result of toUPPER_LATIN1_MOD(l),
- * and must require two bytes to store it.  Advances p to point to the next
- * available position */
-#define CAT_TWO_BYTE_UNI_UPPER_MOD(p, l, u)                                \
-STMT_START {                                                               \
-    if ((u) != LATIN_SMALL_LETTER_Y_WITH_DIAERESIS) {                      \
-       CAT_UNI_TO_UTF8_TWO_BYTE((p), (u)); /* not special, just save it */ \
-    } else if (l == LATIN_SMALL_LETTER_SHARP_S) {                          \
-       *(p)++ = 'S'; *(p)++ = 'S'; /* upper case is 'SS' */                \
-    } else {/* else is one of the other two special cases */               \
-       CAT_NON_LATIN1_UC((p), (l));                                        \
-    }                                                                      \
-} STMT_END
-
 PP(pp_ucfirst)
 {
     /* Actually is both lcfirst() and ucfirst().  Only the first character
@@ -3512,6 +3481,7 @@ PP(pp_ucfirst)
     STRLEN tculen;  /* tculen is the byte length of the freshly titlecased (or
                     * lowercased) character stored in tmpbuf.  May be either
                     * UTF-8 or not, but in either case is the number of bytes */
+    bool tainted = FALSE;
 
     SvGETMAGIC(source);
     if (SvOK(source)) {
@@ -3534,96 +3504,28 @@ PP(pp_ucfirst)
 
     if (! slen) {   /* If empty */
        need = 1; /* still need a trailing NUL */
+       ulen = 0;
     }
     else if (DO_UTF8(source)) {        /* Is the source utf8? */
        doing_utf8 = TRUE;
-
-       if (UTF8_IS_INVARIANT(*s)) {
-
-           /* An invariant source character is either ASCII or, in EBCDIC, an
-            * ASCII equivalent or a caseless C1 control.  In both these cases,
-            * the lower and upper cases of any character are also invariants
-            * (and title case is the same as upper case).  So it is safe to
-            * use the simple case change macros which avoid the overhead of
-            * the general functions.  Note that if perl were to be extended to
-            * do locale handling in UTF-8 strings, this wouldn't be true in,
-            * for example, Lithuanian or Turkic.  */
-           *tmpbuf = (op_type == OP_LCFIRST) ? toLOWER(*s) : toUPPER(*s);
-           tculen = ulen = 1;
-           need = slen + 1;
-       }
-       else if (UTF8_IS_DOWNGRADEABLE_START(*s)) {
-           U8 chr;
-
-           /* Similarly, if the source character isn't invariant but is in the
-            * latin1 range (or EBCDIC equivalent thereof), we have the case
-            * changes compiled into perl, and can avoid the overhead of the
-            * general functions.  In this range, the characters are stored as
-            * two UTF-8 bytes, and it so happens that any changed-case version
-            * is also two bytes (in both ASCIIish and EBCDIC machines). */
-           tculen = ulen = 2;
-           need = slen + 1;
-
-           /* Convert the two source bytes to a single Unicode code point
-            * value, change case and save for below */
-           chr = TWO_BYTE_UTF8_TO_UNI(*s, *(s+1));
-           if (op_type == OP_LCFIRST) {    /* lower casing is easy */
-               U8 lower = toLOWER_LATIN1(chr);
-               STORE_UNI_TO_UTF8_TWO_BYTE(tmpbuf, lower);
-           }
-           else {      /* ucfirst */
-               U8 upper = toUPPER_LATIN1_MOD(chr);
-
-               /* Most of the latin1 range characters are well-behaved.  Their
-                * title and upper cases are the same, and are also in the
-                * latin1 range.  The macro above returns their upper (hence
-                * title) case, and all that need be done is to save the result
-                * for below.  However, several characters are problematic, and
-                * have to be handled specially.  The MOD in the macro name
-                * above means that these tricky characters all get mapped to
-                * the single character LATIN_SMALL_LETTER_Y_WITH_DIAERESIS.
-                * This mapping saves some tests for the majority of the
-                * characters */
-
-               if (upper != LATIN_SMALL_LETTER_Y_WITH_DIAERESIS) {
-
-                   /* Not tricky.  Just save it. */
-                   STORE_UNI_TO_UTF8_TWO_BYTE(tmpbuf, upper);
-               }
-               else if (chr == LATIN_SMALL_LETTER_SHARP_S) {
-
-                   /* This one is tricky because it is two characters long,
-                    * though the UTF-8 is still two bytes, so the stored
-                    * length doesn't change */
-                   *tmpbuf = 'S';  /* The UTF-8 is 'Ss' */
-                   *(tmpbuf + 1) = 's';
-               }
-               else {
-
-                   /* The other two have their title and upper cases the same,
-                    * but are tricky because the changed-case characters
-                    * aren't in the latin1 range.  They, however, do fit into
-                    * two UTF-8 bytes */
-                   STORE_NON_LATIN1_UC(tmpbuf, chr);    
-               }
-           }
+        ulen = UTF8SKIP(s);
+        if (op_type == OP_UCFIRST) {
+           _to_utf8_title_flags(s, tmpbuf, &tculen,
+                                cBOOL(IN_LOCALE_RUNTIME), &tainted);
        }
-       else {
-
-           /* Here, can't short-cut the general case */
-
-           utf8_to_uvchr(s, &ulen);
-           if (op_type == OP_UCFIRST) toTITLE_utf8(s, tmpbuf, &tculen);
-           else toLOWER_utf8(s, tmpbuf, &tculen);
-
-           /* we can't do in-place if the length changes.  */
-           if (ulen != tculen) inplace = FALSE;
-           need = slen + 1 - ulen + tculen;
+        else {
+           _to_utf8_lower_flags(s, tmpbuf, &tculen,
+                                cBOOL(IN_LOCALE_RUNTIME), &tainted);
        }
+
+        /* we can't do in-place if the length changes.  */
+        if (ulen != tculen) inplace = FALSE;
+        need = slen + 1 - ulen + tculen;
     }
     else { /* Non-zero length, non-UTF-8,  Need to consider locale and if
            * latin1 is treated as caseless.  Note that a locale takes
            * precedence */ 
+       ulen = 1;       /* Original character is 1 byte */
        tculen = 1;     /* Most characters will require one byte, but this will
                         * need to be overridden for the tricky ones */
        need = slen + 1;
@@ -3646,44 +3548,42 @@ PP(pp_ucfirst)
                                         * native function does */
        }
        else { /* is ucfirst non-UTF-8, not in locale, and cased latin1 */
-           *tmpbuf = toUPPER_LATIN1_MOD(*s);
-
-           /* tmpbuf now has the correct title case for all latin1 characters
-            * except for the several ones that have tricky handling.  All
-            * of these are mapped by the MOD to the letter below. */
-           if (*tmpbuf == LATIN_SMALL_LETTER_Y_WITH_DIAERESIS) {
-
-               /* The length is going to change, with all three of these, so
-                * can't replace just the first character */
-               inplace = FALSE;
-
-               /* We use the original to distinguish between these tricky
-                * cases */
-               if (*s == LATIN_SMALL_LETTER_SHARP_S) {
-                   /* Two character title case 'Ss', but can remain non-UTF-8 */
-                   need = slen + 2;
-                   *tmpbuf = 'S';
-                   *(tmpbuf + 1) = 's';   /* Assert: length(tmpbuf) >= 2 */
-                   tculen = 2;
+           UV title_ord = _to_upper_title_latin1(*s, tmpbuf, &tculen, 's');
+           if (tculen > 1) {
+               assert(tculen == 2);
+
+                /* If the result is an upper Latin1-range character, it can
+                 * still be represented in one byte, which is its ordinal */
+               if (UTF8_IS_DOWNGRADEABLE_START(*tmpbuf)) {
+                   *tmpbuf = (U8) title_ord;
+                   tculen = 1;
                }
                else {
-
-                   /* The other two tricky ones have their title case outside
-                    * latin1.  It is the same as their upper case. */
-                   doing_utf8 = TRUE;
-                   STORE_NON_LATIN1_UC(tmpbuf, *s);
-
-                   /* The UTF-8 and UTF-EBCDIC lengths of both these characters
-                    * and their upper cases is 2. */
-                   tculen = ulen = 2;
-
-                   /* The entire result will have to be in UTF-8.  Assume worst
-                    * case sizing in conversion. (all latin1 characters occupy
-                    * at most two bytes in utf8) */
-                   convert_source_to_utf8 = TRUE;
-                   need = slen * 2 + 1;
+                    /* Otherwise it became more than one ASCII character (in
+                     * the case of LATIN_SMALL_LETTER_SHARP_S) or changed to
+                     * beyond Latin1, so the number of bytes changed, so can't
+                     * replace just the first character in place. */
+                   inplace = FALSE;
+
+                   /* If the result won't fit in a byte, the entire result will
+                    * have to be in UTF-8.  Assume worst case sizing in
+                    * conversion. (all latin1 characters occupy at most two bytes
+                    * in utf8) */
+                   if (title_ord > 255) {
+                       doing_utf8 = TRUE;
+                       convert_source_to_utf8 = TRUE;
+                       need = slen * 2 + 1;
+
+                        /* The (converted) UTF-8 and UTF-EBCDIC lengths of all
+                         * (both) characters whose title case is above 255 is
+                         * 2. */
+                       ulen = 2;
+                   }
+                    else { /* LATIN_SMALL_LETTER_SHARP_S expands by 1 byte */
+                       need = slen + 1 + 1;
+                   }
                }
-           } /* End of is one of the three special chars */
+           }
        } /* End of use Unicode (Latin1) semantics */
     } /* End of changing the case of the first character */
 
@@ -3748,6 +3648,11 @@ PP(pp_ucfirst)
            Copy(tmpbuf, d, tculen, U8);
            SvCUR_set(dest, need - 1);
        }
+
+       if (tainted) {
+           TAINT;
+           SvTAINTED_on(dest);
+       }
     }
     else {  /* Neither source nor dest are in or need to be UTF-8 */
        if (slen) {
@@ -3853,6 +3758,7 @@ PP(pp_uc)
     if (DO_UTF8(source)) {
        const U8 *const send = s + len;
        U8 tmpbuf[UTF8_MAXBYTES+1];
+       bool tainted = FALSE;
 
        /* All occurrences of these are to be moved to follow any other marks.
         * This is context-dependent.  We may not be passed enough context to
@@ -3867,70 +3773,60 @@ PP(pp_uc)
        bool in_iota_subscript = FALSE;
 
        while (s < send) {
+           STRLEN u;
+           STRLEN ulen;
+           UV uv;
            if (in_iota_subscript && ! is_utf8_mark(s)) {
+
                /* A non-mark.  Time to output the iota subscript */
 #define GREEK_CAPITAL_LETTER_IOTA 0x0399
 #define COMBINING_GREEK_YPOGEGRAMMENI 0x0345
 
                CAT_UNI_TO_UTF8_TWO_BYTE(d, GREEK_CAPITAL_LETTER_IOTA);
                in_iota_subscript = FALSE;
-           }
-
-           /* If the UTF-8 character is invariant, then it is in the range
-            * known by the standard macro; result is only one byte long */
-           if (UTF8_IS_INVARIANT(*s)) {
-               *d++ = toUPPER(*s);
-               s++;
-           }
-           else if (UTF8_IS_DOWNGRADEABLE_START(*s)) {
-
-               /* Likewise, if it fits in a byte, its case change is in our
-                * table */
-               U8 orig = TWO_BYTE_UTF8_TO_UNI(*s, *(s+1));
-               U8 upper = toUPPER_LATIN1_MOD(orig);
-               CAT_TWO_BYTE_UNI_UPPER_MOD(d, orig, upper);
-               s += 2;
-           }
-           else {
-
-               /* Otherwise, need the general UTF-8 case.  Get the changed
-                * case value and copy it to the output buffer */
+            }
 
-               const STRLEN u = UTF8SKIP(s);
-               STRLEN ulen;
+            /* Then handle the current character.  Get the changed case value
+             * and copy it to the output buffer */
 
-               const UV uv = toUPPER_utf8(s, tmpbuf, &ulen);
-               if (uv == GREEK_CAPITAL_LETTER_IOTA
-                   && utf8_to_uvchr(s, 0) == COMBINING_GREEK_YPOGEGRAMMENI)
-               {
-                   in_iota_subscript = TRUE;
-               }
-               else {
-                   if (ulen > u && (SvLEN(dest) < (min += ulen - u))) {
-                       /* If the eventually required minimum size outgrows
-                        * the available space, we need to grow. */
-                       const UV o = d - (U8*)SvPVX_const(dest);
-
-                       /* If someone uppercases one million U+03B0s we
-                        * SvGROW() one million times.  Or we could try
-                        * guessing how much to allocate without allocating too
-                        * much.  Such is life.  See corresponding comment in
-                        * lc code for another option */
-                       SvGROW(dest, min);
-                       d = (U8*)SvPVX(dest) + o;
-                   }
-                   Copy(tmpbuf, d, ulen, U8);
-                   d += ulen;
-               }
-               s += u;
-           }
+            u = UTF8SKIP(s);
+            uv = _to_utf8_upper_flags(s, tmpbuf, &ulen,
+                                     cBOOL(IN_LOCALE_RUNTIME), &tainted);
+            if (uv == GREEK_CAPITAL_LETTER_IOTA
+                && utf8_to_uvchr(s, 0) == COMBINING_GREEK_YPOGEGRAMMENI)
+            {
+                in_iota_subscript = TRUE;
+            }
+            else {
+                if (ulen > u && (SvLEN(dest) < (min += ulen - u))) {
+                    /* If the eventually required minimum size outgrows the
+                     * available space, we need to grow. */
+                    const UV o = d - (U8*)SvPVX_const(dest);
+
+                    /* If someone uppercases one million U+03B0s we SvGROW()
+                     * one million times.  Or we could try guessing how much to
+                     * allocate without allocating too much.  Such is life.
+                     * See corresponding comment in lc code for another option
+                     * */
+                    SvGROW(dest, min);
+                    d = (U8*)SvPVX(dest) + o;
+                }
+                Copy(tmpbuf, d, ulen, U8);
+                d += ulen;
+            }
+            s += u;
        }
        if (in_iota_subscript) {
            CAT_UNI_TO_UTF8_TWO_BYTE(d, GREEK_CAPITAL_LETTER_IOTA);
        }
        SvUTF8_on(dest);
        *d = '\0';
+
        SvCUR_set(dest, d - (U8*)SvPVX_const(dest));
+       if (tainted) {
+           TAINT;
+           SvTAINTED_on(dest);
+       }
     }
     else {     /* Not UTF-8 */
        if (len) {
@@ -3953,7 +3849,7 @@ PP(pp_uc)
            else {
                for (; s < send; d++, s++) {
                    *d = toUPPER_LATIN1_MOD(*s);
-                   if (*d != LATIN_SMALL_LETTER_Y_WITH_DIAERESIS) continue;
+                   if (LIKELY(*d != LATIN_SMALL_LETTER_Y_WITH_DIAERESIS)) continue;
 
                    /* The mainstream case is the tight loop above.  To avoid
                     * extra tests in that, all three characters that require
@@ -4014,23 +3910,13 @@ PP(pp_uc)
                                                (send -s) * 2 + 1);
                    d = (U8*)SvPVX(dest) + len;
 
-                   /* And append the current character's upper case in UTF-8 */
-                   CAT_NON_LATIN1_UC(d, *s);
-
                    /* Now process the remainder of the source, converting to
                     * upper and UTF-8.  If a resulting byte is invariant in
                     * UTF-8, output it as-is, otherwise convert to UTF-8 and
                     * append it to the output. */
-
-                   s++;
                    for (; s < send; s++) {
-                       U8 upper = toUPPER_LATIN1_MOD(*s);
-                       if UTF8_IS_INVARIANT(upper) {
-                           *d++ = upper;
-                       }
-                       else {
-                           CAT_TWO_BYTE_UNI_UPPER_MOD(d, *s, upper);
-                       }
+                       (void) _to_upper_title_latin1(*s, d, &len, 'S');
+                       d += len;
                    }
 
                    /* Here have processed the whole source; no need to continue
@@ -4109,62 +3995,47 @@ PP(pp_lc)
     if (DO_UTF8(source)) {
        const U8 *const send = s + len;
        U8 tmpbuf[UTF8_MAXBYTES_CASE+1];
+       bool tainted = FALSE;
 
        while (s < send) {
-           if (UTF8_IS_INVARIANT(*s)) {
-
-               /* Invariant characters use the standard mappings compiled in.
-                */
-               *d++ = toLOWER(*s);
-               s++;
-           }
-           else if (UTF8_IS_DOWNGRADEABLE_START(*s)) {
+           const STRLEN u = UTF8SKIP(s);
+           STRLEN ulen;
 
-               /* As do the ones in the Latin1 range */
-               U8 lower = toLOWER_LATIN1(TWO_BYTE_UTF8_TO_UNI(*s, *(s+1)));
-               CAT_UNI_TO_UTF8_TWO_BYTE(d, lower);
-               s += 2;
-           }
-           else {
-               /* Here, is utf8 not in Latin-1 range, have to go out and get
-                * the mappings from the tables. */
+           _to_utf8_lower_flags(s, tmpbuf, &ulen,
+                                cBOOL(IN_LOCALE_RUNTIME), &tainted);
 
-               const STRLEN u = UTF8SKIP(s);
-               STRLEN ulen;
+           /* Here is where we would do context-sensitive actions.  See the
+            * commit message for this comment for why there isn't any */
 
-               toLOWER_utf8(s, tmpbuf, &ulen);
+           if (ulen > u && (SvLEN(dest) < (min += ulen - u))) {
 
-               /* Here is where we would do context-sensitive actions.  See
-                * the commit message for this comment for why there isn't any
-                */
+               /* If the eventually required minimum size outgrows the
+                * available space, we need to grow. */
+               const UV o = d - (U8*)SvPVX_const(dest);
 
-                   if (ulen > u && (SvLEN(dest) < (min += ulen - u))) {
-
-                       /* If the eventually required minimum size outgrows
-                        * the available space, we need to grow. */
-                       const UV o = d - (U8*)SvPVX_const(dest);
-
-                       /* If someone lowercases one million U+0130s we
-                        * SvGROW() one million times.  Or we could try
-                        * guessing how much to allocate without allocating too
-                        * much.  Such is life.  Another option would be to
-                        * grow an extra byte or two more each time we need to
-                        * grow, which would cut down the million to 500K, with
-                        * little waste */
-                       SvGROW(dest, min);
-                       d = (U8*)SvPVX(dest) + o;
-                   }
-
-               /* Copy the newly lowercased letter to the output buffer we're
-                * building */
-               Copy(tmpbuf, d, ulen, U8);
-               d += ulen;
-               s += u;
+               /* If someone lowercases one million U+0130s we SvGROW() one
+                * million times.  Or we could try guessing how much to
+                * allocate without allocating too much.  Such is life.
+                * Another option would be to grow an extra byte or two more
+                * each time we need to grow, which would cut down the million
+                * to 500K, with little waste */
+               SvGROW(dest, min);
+               d = (U8*)SvPVX(dest) + o;
            }
+
+           /* Copy the newly lowercased letter to the output buffer we're
+            * building */
+           Copy(tmpbuf, d, ulen, U8);
+           d += ulen;
+           s += u;
        }   /* End of looping through the source string */
        SvUTF8_on(dest);
        *d = '\0';
        SvCUR_set(dest, d - (U8*)SvPVX_const(dest));
+       if (tainted) {
+           TAINT;
+           SvTAINTED_on(dest);
+       }
     } else {   /* Not utf8 */
        if (len) {
            const U8 *const send = s + len;
@@ -5859,7 +5730,7 @@ PP(pp_coreargs)
     /* Reset the stack pointer.  Without this, we end up returning our own
        arguments in list context, in addition to the values we are supposed
        to return.  nextstate usually does this on sub entry, but we need
-       to run the next op with the callers hints, so we cannot have a
+       to run the next op with the caller's hints, so we cannot have a
        nextstate. */
     SP = PL_stack_base + cxstack[cxstack_ix].blk_oldsp;
 
@@ -5963,6 +5834,25 @@ PP(pp_coreargs)
     RETURN;
 }
 
+PP(pp_runcv)
+{
+    dSP;
+    CV *cv;
+    if (PL_op->op_private & OPpOFFBYONE) {
+       PERL_SI * const oldsi = PL_curstackinfo;
+       I32 const oldcxix = oldsi->si_cxix;
+       if (oldcxix) oldsi->si_cxix--;
+       else PL_curstackinfo = oldsi->si_prev;
+       cv = find_runcv(NULL);
+       PL_curstackinfo = oldsi;
+       oldsi->si_cxix = oldcxix;
+    }
+    else cv = find_runcv(NULL);
+    XPUSHs(CvUNIQUE(cv) ? &PL_sv_undef : sv_2mortal(newRV((SV *)cv)));
+    RETURN;
+}
+
+
 /*
  * Local variables:
  * c-indentation-style: bsd