[perl #129770] null ptr deref, segfault Perl_mess_sv (util.c:1534)

# New Ticket Created by  Brian Carpenter 
# Please include the string:  [perl #129770]
# in the subject line of all future correspondence about this issue. 
# <URL: https://rt.perl.org/Ticket/Display.html?id=129770 >


Triggered in Perl v5.25.6 (v5.25.5-42-g850e14d).

./perl -e '0,$^=0==0,0==0,$0=S$^$^D=S'
Scalar found where operator expected at -e line 1, near "$^$^D"
        (Missing operator before $^D?)
allocating op at 61500000fc48, slab 61500000fa80 at (eval 1) line 1.
allocating op at 61500000fc08, slab 61500000fa80 at (eval 1) line 1.
allocating op at 61500000fba8, slab 61500000fa80 at (eval 1) line 1.
allocating op at 61500000fb60, slab 61500000fa80 at (eval 1) line 1.
allocating op at 61500000fb20, slab 61500000fa80 at (eval 1) line 1.
free op at 61500000fb20, recorded in slab 61500000fa80 at (eval 1) line 1.
ASAN:SIGSEGV
=================================================================
==10990==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000021
(pc 0x000000800b1f bp 0x7ffe86a4ba70 sp 0x7ffe86a4b9c0 T0)
    #0 0x800b1e in Perl_mess_sv /root/perl/util.c:1534:6
    #1 0x80011b in Perl_vmess /root/perl/util.c:1587:12
    #2 0x80011b in Perl_mess /root/perl/util.c:1417
    #3 0x4e0385 in Perl_Slab_Free /root/perl/op.c:442:5
    #4 0x4e20cd in Perl_op_free /root/perl/op.c:855:9
    #5 0x4e1d15 in Perl_op_free /root/perl/op.c:837:21
    #6 0xa2b5ef in Perl_leave_scope /root/perl/scope.c:1109:6
    #7 0xa5e405 in S_pop_eval_context_maybe_croak /root/perl/pp_ctl.c:1605:5
    #8 0xa5dac4 in Perl_die_unwind /root/perl/pp_ctl.c:1733:13
    #9 0x8027af in Perl_vcroak /root/perl/util.c:1817:5
    #10 0x80269c in Perl_die /root/perl/util.c:1748:5
    #11 0xa7e172 in S_require_file /root/perl/pp_ctl.c:4062:7
    #12 0xa7e172 in Perl_pp_require /root/perl/pp_ctl.c:4138
    #13 0x7f4473 in Perl_runops_debug /root/perl/dump.c:2239:23
    #14 0x5a7dd8 in Perl_eval_sv /root/perl/perl.c:2968:2
    #15 0x5aa188 in Perl_require_pv /root/perl/perl.c:3071:5
    #16 0x5c1aa6 in Perl_gv_fetchmethod_pvn_flags /root/perl/gv.c:1103:7
    #17 0x5c09d6 in Perl_gv_fetchmethod_sv_flags /root/perl/gv.c:996:12
    #18 0x8e5b29 in Perl_pp_method_named /root/perl/pp_hot.c:4298:10
    #19 0x7f4473 in Perl_runops_debug /root/perl/dump.c:2239:23
    #20 0x5a11d6 in S_run_body /root/perl/perl.c:2526:2
    #21 0x5a11d6 in perl_run /root/perl/perl.c:2449
    #22 0x4de5fd in main /root/perl/perlmain.c:123:9
    #23 0x7f4346b0ab44 in __libc_start_main
/build/glibc-daoqzt/glibc-2.19/csu/libc-start.c:287
    #24 0x4de26c in _start (/root/perl/perl+0x4de26c)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /root/perl/util.c:1534 Perl_mess_sv
==10990==ABORTING

• [perl #129770] null ptr deref, segfault Perl_mess_sv (util.c:1534) by Brian Carpenter