develooper Front page | perl.perl5.porters | Postings from May 2016

[perl #128183] Assert fail in op.c without other symptoms:0=\my%u:e=0

Thread Previous
Dan Collins
May 18, 2016 23:59
[perl #128183] Assert fail in op.c without other symptoms:0=\my%u:e=0
Message ID:
# New Ticket Created by  Dan Collins 
# Please include the string:  [perl #128183]
# in the subject line of all future correspondence about this issue. 
# <URL: >

Greetings Porters,

I have compiled bleadperl with the afl-gcc compiler using:

./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Uuselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -Dusequadmath -des
AFL_HARDEN=1 make && make test

And then fuzzed the resulting binary using:

AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @@

After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers an assert fail in debugging builds of the perl interpreter. The testcase is the file below. On normal builds, this exits with the expected error. On debug builds, this returns an assert fail.

dcollins@nightshade64:~$ cat f3i1
dcollins@nightshade64:~$ od -c f3i1
0000000   0   =   \   m   y   %   u   :   e   =   0
dcollins@nightshade64:~$ ls -l f3i1
-rw-r----- 1 dcollins afl 11 May 18 17:01 f3i1
dcollins@nightshade64:~$ ./perl/perl f3i1
Can't modify reference to subroutine entry in list assignment at f3i1 line 1, at EOF
Execution of f3i1 aborted due to compilation errors.
dcollins@nightshade64:~$ ./perldebug/perl f3i1
perl: op.c:2758: S_lvref: Assertion `(kid->op_flags & 3) != 1' failed.

Debugging tool output is below. A git bisect was performed. Unfortunately, this requires attributes, so a miniperl build is not sufficient to test. Here is the result:

7664512eddd3e297d305684d8075fd977e4ef95c is the first bad commit
commit 7664512eddd3e297d305684d8075fd977e4ef95c
Author: Father Chrysostomos <>
Date:   Tue Sep 30 22:20:56 2014 -0700

    Make \( ?: ) assignment work

    When I first implemented list assignment to lvalue references, I
    thought I could simply modify the kids of the refgen op (\) in one
    spot.  But things like ?: make it necessary to do this recursively.
    So all that code for turning thingies into lvrefs has been moved into
    a separate function patterned after op_lvalue but handling only the
    lvref cases.

    (I thought about combining it with op_lvalue’s switch statement, but
    that would require ‘if(type == OP_LVREF) goto nomod;’ too many times,
    which would be harder to maintain.)

:100644 100644 2e163602eb33b1df99c98aeee9c803e79004f7db 9e4e8d9db15ae2e214420f67b2e6683c1611cf54 M      op.c
:040000 040000 8114515a860c7aebba1d4c401f7b2aa52d8abade f65b52fd5e71e1ae0d6c098770ae4d38f7a37208 M      t
bisect run success


dcollins@nightshade64:~$ gdb --args ./perldebug/perl f3i1
GNU gdb (GDB) 7.10
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
Find the GDB manual and other documentation resources online at:
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./perldebug/perl...done.
(gdb) run
Starting program: /home/dcollins/perldebug/perl f3i1
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/".
perl: op.c:2758: S_lvref: Assertion `(kid->op_flags & 3) != 1' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff6cf9478 in raise () from /lib/x86_64-linux-gnu/
(gdb) bt
#0  0x00007ffff6cf9478 in raise () from /lib/x86_64-linux-gnu/
#1  0x00007ffff6cfa8fa in abort () from /lib/x86_64-linux-gnu/
#2  0x00007ffff6cf23a7 in ?? () from /lib/x86_64-linux-gnu/
#3  0x00007ffff6cf2452 in __assert_fail ()
   from /lib/x86_64-linux-gnu/
#4  0x000000000042611e in S_lvref (o=0xabc4d8, type=38) at op.c:2758
#5  0x0000000000427556 in Perl_op_lvalue_flags (o=0xabc460, type=38, flags=0)
    at op.c:3123
#6  0x0000000000432c5a in Perl_newASSIGNOP (flags=64, left=0xabc460,
    optype=0, right=0xabc420) at op.c:6400
#7  0x00000000004d7161 in Perl_yyparse (gramtype=258) at perly.y:781
#8  0x0000000000461482 in S_parse_body (env=0x0, xsinit=0x41e9e9 <xs_init>)
    at perl.c:2365
#9  0x000000000045f8c8 in perl_parse (my_perl=0xa9a010,
    xsinit=0x41e9e9 <xs_init>, argc=2, argv=0x7fffffffe648, env=0x0)
    at perl.c:1681
#10 0x000000000041e948 in main (argc=2, argv=0x7fffffffe648,
    env=0x7fffffffe660) at perlmain.c:114
(gdb) f 4
#4  0x000000000042611e in S_lvref (o=0xabc4d8, type=38) at op.c:2758
2758                assert((kid->op_flags & OPf_WANT) != OPf_WANT_VOID);
(gdb) info locals
kid = 0xabc5a8
__PRETTY_FUNCTION__ = "S_lvref"
(gdb) l
2753                return;
2754            }
2755            /* FALLTHROUGH */
2756        case OP_LIST:
2757            for (kid = cLISTOPo->op_first; kid; kid = OpSIBLING(kid)) {
2758                assert((kid->op_flags & OPf_WANT) != OPf_WANT_VOID);
2759                S_lvref(aTHX_ kid, type);
2760            }
2761            return;
2762        case OP_STUB:
(gdb) q

**PERL -V**

dcollins@nightshade64:~$ perl/perl  -V
Summary of my perl5 (revision 5 version 25 subversion 1) configuration:
  Commit id: 9e17953912c0ab4f21dd642345727a44c388a0af
    osname=linux, osvers=4.5.0-2-amd64, archname=x86_64-linux-ld
    uname='linux nightshade64 4.5.0-2-amd64 #1 smp debian 4.5.3-2 (2016-05-08) x86_64 gnulinux '
    config_args='-Dusedevel -Dprefix=/usr/local/perl-afl -Dcc=ccache afl-gcc -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -DDEBUGGING -DDEBUG_LEAKING_SCALARS -des'
    hint=recommended, useposix=true, d_sigaction=define
    useithreads=undef, usemultiplicity=undef
    use64bitint=define, use64bitall=define, uselongdouble=define
    usemymalloc=n, bincompat5005=undef
    cc='ccache afl-gcc', ccflags ='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
    cppflags='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include'
    ccversion='', gccversion='6.1.0', gccosandvers=''
    intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678, doublekind=3
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16, longdblkind=3
    ivtype='long', ivsize=8, nvtype='long double', nvsize=16, Off_t='off_t', lseeksize=8
    alignbytes=16, prototype=define
  Linker and Libraries:
    ld='ccache afl-gcc', ldflags =' -fstack-protector-strong -L/usr/local/lib'
    libpth=/usr/local/lib /usr/local/lib/gcc/x86_64-pc-linux-gnu/6.1.0/include-fixed /usr/include/x86_64-linux-gnu /usr/lib /lib/x86_64-linux-gnu /lib/../lib /usr/lib/x86_64-linux-gnu /usr/lib/../lib /lib
    libs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
    perllibs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc, so=so, useshrplib=false, libperl=libperl.a
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
    cccdlflags='-fPIC', lddlflags='-shared -g -L/usr/local/lib -fstack-protector-strong'

Characteristics of this binary (from libperl):
                        USE_64_BIT_ALL USE_64_BIT_INT USE_LARGE_FILES
                        USE_PERLIO USE_PERL_ATOF
  Built under linux
  Compiled at May 17 2016 20:01:23

Thread Previous Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at | Group listing | About