I think it's related to the optimization described in No garbage collection for my-variables (not sure though).

The linked post refers to the effect of the padsv (my $) operator. Neither padsv nor the underlying code (SAVECLEARSV) is involved here. Any resemblance is coincidental.

In fact, I don't think there's any reuse of allocated memory involved. I think a new memory block just happens to be allocated at the same location as a previously allocated memory block. (Upd: That's indeed what happens, as show in Re^5: Reference of constants and literals )

For example, the following code continually allocates memory blocks at the same two locations. This is not related to my since we're forcing my to continually reallocate SVs by keeping the refcount greater than 1. There is no reuse of allocated memory at all.

>perl -le"sub f{ \my $x } print f() for 1..10;"
SCALAR(0x236d40)
SCALAR(0x236014)
SCALAR(0x236d40)
SCALAR(0x236014)
SCALAR(0x236d40)
SCALAR(0x236014)
SCALAR(0x236d40)
SCALAR(0x236014)
SCALAR(0x236d40)
SCALAR(0x236014)
[download]

For example, the following code continually allocates memory blocks at the same two locations. This is not related to my since we're forcing my to continually reallocate SVs by keeping the refcount greater than 1. There is no reuse of allocated memory at all.

perl -le"sub f{ \my $x } print f() for 1..10;"
[download]

What refcount is kept greater than 1? After the print, the result of f() is no longer reference to. Hence the ref to $x goes out of scope, and since nothing is refering to $x, that one goes out of scope as well. Here's a slight variation that shows this:

sub DESTROY {say "DESTROYED"}
sub f{ bless \my $x } say f() for 1..10;
__END__
main=SCALAR(0x9721530)
DESTROYED
main=SCALAR(0x9704c30)
DESTROYED
main=SCALAR(0x9721530)
DESTROYED
main=SCALAR(0x9704c30)
DESTROYED
main=SCALAR(0x9721530)
DESTROYED
main=SCALAR(0x9704c30)
DESTROYED
main=SCALAR(0x9721530)
DESTROYED
main=SCALAR(0x9704c30)
DESTROYED
main=SCALAR(0x9721530)
DESTROYED
main=SCALAR(0x9704c30)
DESTROYED
[download]

OTOH, if you do keep the refcount above 0, no address is reused:

my @a;
sub f{ push @a, \my $x; $a[-1] } say f() for 1..10;
__END__
SCALAR(0x9c34108)
SCALAR(0x9c33c1c)
SCALAR(0x9c41f8c)
SCALAR(0x9c33f50)
SCALAR(0x9c341a8)
SCALAR(0x9c34180)
SCALAR(0x9c33f00)
SCALAR(0x9c50534)
SCALAR(0x9c5050c)
SCALAR(0x9c504e4)
[download]

What refcount is kept greater than 1?

This is what happens to scalar lexicals on scope exit:

848: ptr = (void*)&PL_curpad[SSPOPLONG];
849: sv = *(SV**)ptr;
850: 
858: /* Can clear pad variable in place? */
859: if (SvREFCNT(sv) <= 1 && !SvOBJECT(sv)) {
860:     /*
861:      * if a my variable that was made readonly is going out of
862:      * scope, we want to remove the readonlyness so that it can
863:      * go out of scope quietly
864:      */
865:     if (SvPADMY(sv) && !SvFAKE(sv))
866:         SvREADONLY_off(sv);
867: 
868:     if (SvTHINKFIRST(sv))
869:         sv_force_normal_flags(sv, SV_IMMEDIATE_UNREF);
870:     if (SvMAGICAL(sv))
871:         mg_free(sv);
872: 
885:    SvOK_off(sv);
888:     SvPADSTALE_on(sv); /* mark as no longer live */
889: }
890: else {    /* Someone has a claim on this, so abandon it. */
891:     const U32 padflags = SvFLAGS(sv) & (SVs_PADMY|SVs_PADTMP);
895:     *(SV**)ptr = newSV(0);
897:     SvREFCNT_dec(sv);    /* Cast current value to the winds. */
898:     /* preserve pad nature, but also mark as not live
899:      * for any closure capturing */
900:     SvFLAGS(*(SV**)ptr) |= padflags | SVs_PADSTALE;
901: }
[download]

(Lifted from Perl_leave_scope in scope.c in perl.git.)

Note line 895. It allocates a new value for $x. Lexicals are allocated on scope exit, not on scope entry. That means $x's refcount at scope exit is what's meaningful. Its refcount is not checked on scope entry or when my is executed.

And $x's refcount at scope exit is 2. It is referenced by both the f's pad and the reference.

>perl -MDevel::Peek -le"sub f{ my $rv = \my $x; Dump($x); $rv } print 
+f() for 1..5"
SV = NULL(0x0) at 0x235fcc
  REFCNT = 2
  FLAGS = (PADBUSY,PADMY)
SCALAR(0x235fcc)
SV = NULL(0x0) at 0x236038
  REFCNT = 2
  FLAGS = (PADBUSY,PADMY)
SCALAR(0x236038)
SV = NULL(0x0) at 0x235fcc
  REFCNT = 2
  FLAGS = (PADBUSY,PADMY)
SCALAR(0x235fcc)
SV = NULL(0x0) at 0x236038
  REFCNT = 2
  FLAGS = (PADBUSY,PADMY)
SCALAR(0x236038)
SV = NULL(0x0) at 0x235fcc
  REFCNT = 2
  FLAGS = (PADBUSY,PADMY)
SCALAR(0x235fcc)
[download]

Your bless doesn't prove anything since the presence of an object forces a reallocation. See line 859.

Update: Added code from scope.c

( Ignore this post. It's subjective and/or unclear, and it doesn't add anything to the conversation. )

and since nothing is refering to $x, that one goes out of scope as well.

There is never a time when there's nothing referring to $x. f's pad refers to $x even when f is not being executed.