Segmentation fault in S_do_trans_count

[p5pRT]

Migrated from rt.perl.org#126613 (status was 'resolved')

Searchable as RT126613$

[p5pRT]

From @dcollinsn

Greetings Porters,

I have compiled bleadperl with the afl-gcc compiler using​:

./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -des
AFL_HARDEN=1 make && make test

And then fuzzed the resulting binary using​:

AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @​@​

After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers a segmentation fault. The testcase is the file​:

/(?{s0})|(?{s0​:})/|s|||eg|y|||

**GDB**

(gdb) run
Starting program​: /usr/local/perl-afl/bin/perl -e /\(\?\{s0\}\)\|\(\?\{s0​:\}\)/\|s\|\|\|eg\|y\|\|\|
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x0000000000bf1604 in S_do_trans_count (sv=0x11a6030) at doop.c​:114
114 if (tbl[*s++] >= 0)
(gdb) bt
#0 0x0000000000bf1604 in S_do_trans_count (sv=0x11a6030) at doop.c​:114
#1 Perl_do_trans (sv=sv@​entry=0x11a6030) at doop.c​:645
#2 0x0000000000a30510 in Perl_pp_trans () at pp.c​:765
#3 0x00000000007bdf7f in Perl_runops_debug () at dump.c​:2224
#4 0x0000000000527fc1 in S_run_body (oldscope=1) at perl.c​:2459
#5 perl_run (my_perl=<optimized out>) at perl.c​:2382
#6 0x0000000000428b18 in main (argc=3, argv=0x7fffffffe338, env=0x7fffffffe358) at perlmain.c​:116
(gdb) info locals
len = 18527264
s = <optimized out>
send = 0x2356a20 <error​: Cannot access memory at address 0x2356a20>
matches = <optimized out>
tbl = 0x11c8630

**VALGRIND**

==61036== Memcheck, a memory error detector
==61036== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==61036== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==61036== Command​: ../bin/perl -e /(?{s0})|(?{s0​:})/|s|||eg|y|||
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF115F​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF115F​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad0 is 0 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1394​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1394​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad1 is 1 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF13E4​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF13E4​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad2 is 2 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1434​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1434​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad3 is 3 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1484​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1484​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad4 is 4 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF14D4​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF14D4​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad5 is 5 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1524​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1524​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad6 is 6 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1578​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1578​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad7 is 7 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1604​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1604​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad8 is 8 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1609​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1609​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ad9 is 9 bytes inside a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1611​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1611​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ada is 0 bytes after a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1615​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1615​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82adb is 1 bytes after a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1625​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1625​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82adc is 2 bytes after a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1630​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1630​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82add is 3 bytes after a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF163A​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF163A​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82ade is 4 bytes after a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036== Invalid read of size 1
==61036== at 0xBF1646​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1646​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Address 0x5f82adf is 5 bytes after a block of size 10 free'd
==61036== at 0x4C28D29​: free (vg_replace_malloc.c​:530)
==61036== by 0x91B1BC​: Perl_sv_clear (sv.c​:6610)
==61036== by 0x91CBF7​: Perl_sv_free2 (sv.c​:6885)
==61036== by 0xAD70D4​: S_SvREFCNT_dec_NN (inline.h​:177)
==61036== by 0xAD70D4​: Perl_free_tmps (scope.c​:182)
==61036== by 0x8B03A4​: Perl_pp_nextstate (pp_hot.c​:52)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0xC85589​: S_regmatch (regexec.c​:6309)
==61036== by 0xC85589​: S_regtry (regexec.c​:3518)
==61036== by 0xCE7451​: Perl_regexec_flags (regexec.c​:3388)
==61036== by 0xB128FE​: Perl_pp_substcont (pp_ctl.c​:224)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== Block was alloc'd at
==61036== at 0x4C27C0F​: malloc (vg_replace_malloc.c​:299)
==61036== by 0x7CD6D8​: Perl_safesysmalloc (util.c​:153)
==61036== by 0x96A4A7​: Perl_sv_grow (sv.c​:1628)
==61036== by 0x995A73​: Perl_sv_setpvn (sv.c​:4853)
==61036== by 0x997992​: Perl_newSVpvn_flags (sv.c​:9089)
==61036== by 0x8E1514​: Perl_pp_subst (pp_hot.c​:3007)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036==
==61036==
==61036== Process terminating with default action of signal 11 (SIGSEGV)
==61036== Access not within mapped region at address 0x6350000
==61036== at 0xBF1604​: S_do_trans_count (doop.c​:114)
==61036== by 0xBF1604​: Perl_do_trans (doop.c​:645)
==61036== by 0xA3050F​: Perl_pp_trans (pp.c​:765)
==61036== by 0x7BDF7E​: Perl_runops_debug (dump.c​:2224)
==61036== by 0x527FC0​: S_run_body (perl.c​:2459)
==61036== by 0x527FC0​: perl_run (perl.c​:2382)
==61036== by 0x428B17​: main (perlmain.c​:116)
==61036== If you believe this happened as a result of a stack
==61036== overflow in your program's main thread (unlikely but
==61036== possible), you can try to increase the size of the
==61036== main thread stack using the --main-stacksize= flag.
==61036== The main thread stack size used in this run was 8388608.
==61036==
==61036== HEAP SUMMARY​:
==61036== in use at exit​: 131,731 bytes in 656 blocks
==61036== total heap usage​: 818 allocs, 162 frees, 151,761 bytes allocated
==61036==
==61036== LEAK SUMMARY​:
==61036== definitely lost​: 320 bytes in 1 blocks
==61036== indirectly lost​: 2,599 bytes in 38 blocks
==61036== possibly lost​: 0 bytes in 0 blocks
==61036== still reachable​: 128,812 bytes in 617 blocks
==61036== suppressed​: 0 bytes in 0 blocks
==61036== Rerun with --leak-check=full to see details of leaked memory
==61036==
==61036== For counts of detected and suppressed errors, rerun with​: -v
==61036== ERROR SUMMARY​: 3986737 errors from 16 contexts (suppressed​: 0 from 0)
Segmentation fault

**PERL -V**

dcollins@​nightshade64​:/usr/local/perl-afl$ ./bin/perl -V
Summary of my perl5 (revision 5 version 23 subversion 5) configuration​:
  Commit id​: 7195e5d
  Platform​:
  osname=linux, osvers=3.16.0-4-amd64, archname=x86_64-linux-ld
  uname='linux nightshade64 3.16.0-4-amd64 #1 smp debian 3.16.7-ckt11-1+deb8u4 (2015-09-19) x86_64 gnulinux '
  config_args='-Dusedevel -Dprefix=/usr/local/perl-afl -Dcc=ccache afl-gcc -Duselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -DDEBUGGING -DPERL_POISON -des'
  hint=recommended, useposix=true, d_sigaction=define
  useithreads=undef, usemultiplicity=undef
  use64bitint=define, use64bitall=define, uselongdouble=define
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='ccache afl-gcc', ccflags ='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
  optimize='-g',
  cppflags='-fwrapv -DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include'
  ccversion='', gccversion='5.2.0', gccosandvers=''
  intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678, doublekind=3
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16, longdblkind=3
  ivtype='long', ivsize=8, nvtype='long double', nvsize=16, Off_t='off_t', lseeksize=8
  alignbytes=16, prototype=define
  Linker and Libraries​:
  ld='ccache afl-gcc', ldflags =' -fstack-protector-strong -L/usr/local/lib'
  libpth=/usr/local/lib /usr/local/lib/gcc/x86_64-unknown-linux-gnu/5.2.0/include-fixed /usr/include/x86_64-linux-gnu /usr/lib /lib/x86_64-linux-gnu /lib/../lib /usr/lib/x86_64-linux-gnu /usr/lib/../lib /lib
  libs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
  perllibs=-lpthread -lnsl -ldl -lm -lcrypt -lutil -lc
  libc=libc-2.19.so, so=so, useshrplib=false, libperl=libperl.a
  gnulibc_version='2.19'
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
  cccdlflags='-fPIC', lddlflags='-shared -g -L/usr/local/lib -fstack-protector-strong'

Characteristics of this binary (from libperl)​:
  Compile-time options​: DEBUGGING HAS_TIMES PERLIO_LAYERS PERL_COPY_ON_WRITE
  PERL_DONT_CREATE_GVSV
  PERL_HASH_FUNC_ONE_AT_A_TIME_HARD PERL_MALLOC_WRAP
  PERL_PRESERVE_IVUV PERL_USE_DEVEL USE_64_BIT_ALL
  USE_64_BIT_INT USE_LARGE_FILES USE_LOCALE
  USE_LOCALE_COLLATE USE_LOCALE_CTYPE
  USE_LOCALE_NUMERIC USE_LOCALE_TIME USE_LONG_DOUBLE
  USE_PERLIO USE_PERL_ATOF
  Built under linux
  Compiled at Oct 22 2015 15​:44​:40
  @​INC​:
  /usr/local/perl-afl/lib/site_perl/5.23.5/x86_64-linux-ld
  /usr/local/perl-afl/lib/site_perl/5.23.5
  /usr/local/perl-afl/lib/5.23.5/x86_64-linux-ld
  /usr/local/perl-afl/lib/5.23.5
  /usr/local/perl-afl/lib/site_perl/5.23.4
  /usr/local/perl-afl/lib/site_perl
  .

[p5pRT]

From @ap

* Dan Collins <perlbug-followup@​perl.org> [2015-11-11 04​:05]​:

/(?{s0})|(?{s0​:})/|s|||eg|y|||

This does not reproduce on 5.16.1.

The general form turns out to be

  /(?{ 'string' })|(?{ LABEL​: })/ | s///eg | y///

Removing the /e on the substitution causes it to throw an exception that
terminates the program before it crashes​:

  Can't coerce UNKNOWN to string in substitution (s///) at t.pl line 1.

Putting an eval{} around the substitution to prevent the exception from
terminating the program reveals that it goes on to crash just as before.
So this error message is likely pointing out (half of) the culprit.

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @khwilliamson

On 11/15/2015 09​:51 PM, Aristotle Pagaltzis wrote​:

* Dan Collins <perlbug-followup@​perl.org> [2015-11-11 04​:05]​:

/(?{s0})|(?{s0​:})/|s|||eg|y|||

This does not reproduce on 5.16.1.

The general form turns out to be

 /\(?\{ 'string' \}\)|\(?\{ LABEL​: \}\)/ | s///eg | y///

Removing the /e on the substitution causes it to throw an exception that
terminates the program before it crashes​:

 Can't coerce UNKNOWN to string in substitution \(s///\) at t\.pl line 1\.

Putting an eval{} around the substitution to prevent the exception from
terminating the program reveals that it goes on to crash just as before.
So this error message is likely pointing out (half of) the culprit.

I bisected this with this result​:
There are only 'skip'ped commits left to test.
The first bad commit could be any of​:
81ed78b
b0812ba
We cannot bisect more!
bisect run cannot continue any more
Died at ../blead/Porting/bisect.pl line 267.
That took 863 seconds.

The first commit is
commit 81ed78b
  Author​: David Mitchell <davem@​iabyn.com>
  Date​: Fri May 4 16​:34​:01 2012 +0100

  make calling of /(?{}) code blocks correct
  ....

The second is
  commit b0812ba
  Author​: David Mitchell <davem@​iabyn.com>
  Date​: Tue Jun 5 22​:29​:23 2012 +0100

  make perl build again on non-DEBUGGING builds

  The PL_block_type debugging-only array is now used indeirectly in
  ext/re/re-exec.c, which enables debugging even on non-debugging builds

[p5pRT]

@iabyn - Status changed from 'open' to 'resolved'

[p5pRT]

From @iabyn

On Sun, Nov 15, 2015 at 10​:29​:55PM -0700, Karl Williamson wrote​:

On 11/15/2015 09​:51 PM, Aristotle Pagaltzis wrote​:

* Dan Collins <perlbug-followup@​perl.org> [2015-11-11 04​:05]​:

/(?{s0})|(?{s0​:})/|s|||eg|y|||

This does not reproduce on 5.16.1.

The general form turns out to be

 /\(?\{ 'string' \}\)|\(?\{ LABEL​: \}\)/ | s///eg | y///

Removing the /e on the substitution causes it to throw an exception that
terminates the program before it crashes​:

 Can't coerce UNKNOWN to string in substitution \(s///\) at t\.pl line 1\.

Putting an eval{} around the substitution to prevent the exception from
terminating the program reveals that it goes on to crash just as before.
So this error message is likely pointing out (half of) the culprit.

I bisected this with this result​:
There are only 'skip'ped commits left to test.
The first bad commit could be any of​:
81ed78b
b0812ba
We cannot bisect more!
bisect run cannot continue any more
Died at ../blead/Porting/bisect.pl line 267.
That took 863 seconds.

The first commit is
commit 81ed78b
Author​: David Mitchell <davem@​iabyn.com>
Date​: Fri May 4 16​:34​:01 2012 +0100

 make calling of /\(?\{\}\) code blocks correct
 \.\.\.\.

The second is
commit b0812ba
Author​: David Mitchell <davem@​iabyn.com>
Date​: Tue Jun 5 22​:29​:23 2012 +0100

 make perl build again on non\-DEBUGGING builds

 The PL\_block\_type debugging\-only array is now used indeirectly in
 ext/re/re\-exec\.c\, which enables debugging even on non\-debugging builds

The problem appears to have gone away in 5.23.8, so I'll close this
ticket. The fix bisects to

commit 1dfbe6b
Author​: David Mitchell <davem@​iabyn.com>
Date​: Sat Jul 11 14​:42​:56 2015 +0100

  add old_tmpsfloor field to CXt_SUB context frame
 
  Rather than saving and restoring PL_tmps_floor on subroutine entry/exit
  by using SAVETMPS and the save stack, store the old value directly
  in the context struct and make PUSHSUB/POPSUB handle the saving and
  restoring.

--
Art is anything that has a label (especially if the label is "untitled 1")