[perl #133906] Assertion failure in Perl_regexec_flags(regexec.c:3806)

FWIW, it doesn't need any funny characters, it reproduces just fine with eg:
% ./miniperl -e 's{ x | (?{ s{}{x} }) }{}gx'
miniperl: regexec.c:3806: Perl_regexec_flags: Assertion `prog->intflags & 0x00000100' failed.
Aborted (core dumped)
% 

Without //g, we hit a different assert:
% ./miniperl -e 's{ x | (?{ s{}{x} }) }{}x'
miniperl: pp_hot.c:4283: Perl_pp_subst: Assertion `(((targ)->sv_flags & (0x00200000|0x00400000|0x00800000)) && Perl_mg_find(targ,'V'))' failed.
Aborted (core dumped)
% 

The inner subst needs an empty match:
% ./miniperl -e 's{ x | (?{ s{(?=)}{x} }) }{}gx'
% 

The target SV needs to require upgrade to string:
% ./miniperl -e '$x = ""; $x =~ s{ x | (?{ s{}{x} }) }{}gx'
% ./miniperl -e '$x = 0; $x =~ s{ x | (?{ s{}{x} }) }{}gx'
miniperl: regexec.c:3806: Perl_regexec_flags: Assertion `prog->intflags & 0x00000100' failed.
Aborted (core dumped)
% 

I _think_ we're hitting the inner subst, finding a match, then deciding "oops, needed to upgrade the target, let's do that and try again". I'm not quite sure why we do that, but it's possible that *both* substs are remembering the need to do that, and then tripping over each other.

It's all confusing me mightily; I'll try to dig some more tomorrow, but hope that the details above might trigger a thought in someone.

Hugo

---
via perlbug:  queue: perl5 status: new
https://rt.perl.org/Ticket/Display.html?id=133906

• [perl #133906] Assertion failure in Perl_regexec_flags(regexec.c:3806) by Hugo van der Sanden via RT
• Re: [perl #133906] Assertion failure in Perl_regexec_flags(regexec.c:3806) by Tony Cook