pp_subst: SV_COW_DROP_PV can leave the sv as the owner of the PV

This was causing leaks in a slightly different version of
sv_setsv_cow(), I wasn't able to make it leak in the current
version, but this may save someone else's sanity in the future,
alas for my own.

The rr tool was handy in tracking this down.

Author: tonycoz

pp_hot.c

@@ -5586,11 +5586,15 @@ PP(pp_subst)
                only for us to throw it away here during the substitution.  */
             if (SvIsCOW(TARG)) {
                 sv_force_normal_flags(TARG, SV_COW_DROP_PV);
-            } else
-#endif
-            {
-                SvPV_free(TARG);
             }
+#endif
+            /* If TARG is COW and is the last owner of the buffer
+               COW_DROP_PV will remove the COW, leaving TARG as the
+               owner, so we may still need to free the PV even if this
+               was COW.
+            */
+            SvPV_free(TARG);
+
             SvPV_set(TARG, SvPVX(dstr));
             SvCUR_set(TARG, SvCUR(dstr));
             SvLEN_set(TARG, SvLEN(dstr));