# New Ticket Created by Brian Carpenter # Please include the string: [perl #123954] # in the subject line of all future correspondence about this issue. # <URL: https://rt.perl.org/Ticket/Display.html?id=123954 > I couldn't stay away. Built v5.21.10 (v5.21.9-43-g2c3f32a) with the following command line: /Configure -des -Dusedevel -DDEBUGGING -Dcc=afl-gcc -Doptimize=-O2\ -g && AFL_HARDEN=1 make -j12 test-prep Bug found with AFL (http://lcamtuf.coredump.cx/afl) Valgrind: perl: pp_ctl.c:318: Perl_pp_substcont: Assertion `((sv)->sv_flags & 0x00000400)' failed. ==12237== ==12237== Process terminating with default action of signal 6 (SIGABRT): dumping core ==12237== at 0x5B55165: raise (raise.c:64) ==12237== by 0x5B583DF: abort (abort.c:92) ==12237== by 0x5B4E310: __assert_fail (assert.c:81) ==12237== by 0xB30ED4: Perl_pp_substcont (pp_ctl.c:318) ==12237== by 0x7CD89E: Perl_runops_debug (dump.c:2237) ==12237== by 0x53B808: perl_run (perl.c:2427) ==12237== by 0x42B1C7: main (perlmain.c:116) GDB: gdb-peda$ file ~/perl/perl gdb-peda$ set args test01-min gdb-peda$ r [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". perl: pp_ctl.c:318: Perl_pp_substcont: Assertion `((sv)->sv_flags & 0x00000400)' failed. Program received signal SIGABRT, Aborted. [----------------------------------registers-----------------------------------] RAX: 0x0 RBX: 0x7fffffffe63b --> 0x736574006c726570 ('perl') RCX: 0xffffffffffffffff RDX: 0x6 RSI: 0xbed4 RDI: 0xbed4 RBP: 0x7ffff6ea9a07 --> 0x257325732500203a (': ') RSP: 0x7fffffffdf18 --> 0x7ffff6d923e0 (<*__GI_abort+384>: mov rdx,QWORD PTR fs:0x10) RIP: 0x7ffff6d8f165 (<*__GI_raise+53>: cmp rax,0xfffffffffffff000) R8 : 0x7ffff7fdd700 (0x00007ffff7fdd700) R9 : 0x2d29767328286020 (' `((sv)-') R10: 0x8 R11: 0x206 R12: 0xef9f73 ("((sv)->sv_flags & 0x00000400)") R13: 0xf6e8f0 ("Perl_pp_substcont") R14: 0x7ffff6ea9a07 --> 0x257325732500203a (': ') R15: 0x13e EFLAGS: 0x206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow) [-------------------------------------code-------------------------------------] 0x7ffff6d8f15b <*__GI_raise+43>: movsxd rdi,eax 0x7ffff6d8f15e <*__GI_raise+46>: mov eax,0xea 0x7ffff6d8f163 <*__GI_raise+51>: syscall => 0x7ffff6d8f165 <*__GI_raise+53>: cmp rax,0xfffffffffffff000 0x7ffff6d8f16b <*__GI_raise+59>: ja 0x7ffff6d8f182 <*__GI_raise+82> 0x7ffff6d8f16d <*__GI_raise+61>: repz ret 0x7ffff6d8f16f <*__GI_raise+63>: nop 0x7ffff6d8f170 <*__GI_raise+64>: test eax,eax [------------------------------------stack-------------------------------------] 0000| 0x7fffffffdf18 --> 0x7ffff6d923e0 (<*__GI_abort+384>: mov rdx,QWORD PTR fs:0x10) 0008| 0x7fffffffdf20 --> 0xef9f73 ("((sv)->sv_flags & 0x00000400)") 0016| 0x7fffffffdf28 --> 0x7ffff6eab9c1 --> 0x706c6568007325 ('%s') 0024| 0x7fffffffdf30 --> 0x7fffffffdf50 --> 0x3000000018 0032| 0x7fffffffdf38 --> 0x13e 0040| 0x7fffffffdf40 --> 0x7fffffffe040 --> 0x7fffffffe63b --> 0x736574006c726570 ('perl') 0048| 0x7fffffffdf48 --> 0x7ffff6dc3fe6 (<__fxprintf+310>: lea rsp,[rbp-0x20]) 0056| 0x7fffffffdf50 --> 0x3000000018 [------------------------------------------------------------------------------] Legend: code, data, rodata, value Stopped reason: SIGABRT 0x00007ffff6d8f165 in *__GI_raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64 64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory. Test case that causes this failure is 22 bytes, here's a hexdump: 0000000 7730 6968 656c 7320 2f2f 6863 2872 5f24 0000010 2b2b 2f29 6567 0000016Thread Previous