(perl #130822) fix an AV leak in Perl_reg_named_buff_fetch

Originally noted as a scoping issue by Andy Lester.

regcomp.c

@@ -7894,21 +7894,18 @@ SV*
 Perl_reg_named_buff_fetch(pTHX_ REGEXP * const r, SV * const namesv,
 			  const U32 flags)
 {
-    AV *retarray = NULL;
     SV *ret;
     struct regexp *const rx = ReANY(r);
 
     PERL_ARGS_ASSERT_REG_NAMED_BUFF_FETCH;
 
-    if (flags & RXapif_ALL)
-        retarray=newAV();
-
     if (rx && RXp_PAREN_NAMES(rx)) {
         HE *he_str = hv_fetch_ent( RXp_PAREN_NAMES(rx), namesv, 0, 0 );
         if (he_str) {
             IV i;
             SV* sv_dat=HeVAL(he_str);
             I32 *nums=(I32*)SvPVX(sv_dat);
+            AV * const retarray = (flags & RXapif_ALL) ? newAV() : NULL;
             for ( i=0; i<SvIVX(sv_dat); i++ ) {
                 if ((I32)(rx->nparens) >= nums[i]
                     && rx->offs[nums[i]].start != -1

t/op/svleak.t

@@ -15,7 +15,7 @@ BEGIN {
 
 use Config;
 
-plan tests => 140;
+plan tests => 141;
 
 # run some code N times. If the number of SVs at the end of loop N is
 # greater than (N-1)*delta at the end of loop 1, we've got a leak
@@ -583,3 +583,13 @@ EOF
     }
     ::leak(2, 0, \&codeblocks, q{leaking embedded qr codeblocks});
 }
+
+{
+    # Perl_reg_named_buff_fetch() leaks an AV when called with an RE
+    # with no named captures
+    sub named {
+        "x" =~ /x/;
+        re::regname("foo", 1);
+    }
+    ::leak(2, 0, \&named, "Perl_reg_named_buff_fetch() on no-name RE");
+}