regcomp.c:6207: SV *S_concat_pat(RExC_state_t *const, SV *, SV **const, int, OP *, _Bool *, SV *): Assertion `oplist->op_type == OP_PADAV || oplist->op_type == OP_RV2AV' failed

[p5pRT]

Migrated from rt.perl.org#129880 (status was 'open')

Searchable as RT129880$

[p5pRT]

From @geeknik

Triggered in Perl v5.25.6 (v5.25.5-104-gaff2be5).

perl -e 'qr{(?{}){@​0{@​}}@​0}'

perl​: regcomp.c​:6207​: SV *S_concat_pat(RExC_state_t *const, SV *, SV
**const, int, OP *, _Bool *, SV *)​: Assertion `oplist->op_type == OP_PADAV
|| oplist->op_type == OP_RV2AV' failed.
Aborted

[p5pRT]

From @hvds

On Fri Oct 14 14​:42​:19 2016, brian.carpenter@​gmail.com wrote​:

Triggered in Perl v5.25.6 (v5.25.5-104-gaff2be5).

perl -e 'qr{(?{}){@​0{@​}}@​0}'

perl​: regcomp.c​:6207​: SV *S_concat_pat(RExC_state_t *const, SV *, SV
**const, int, OP *, _Bool *, SV *)​: Assertion `oplist->op_type == OP_PADAV
|| oplist->op_type == OP_RV2AV' failed.
Aborted

It appears to be sufficient to expand the assert as below; however I don't know if there's a bug elsewhere that's causing the OP_HSLICE to leak to us in this case - a valid case (such as qr{(?{}){@​x{@​y}}@​y}) has the hash slice expanded before it reaches concat_pat().

I'm guessing Dave would know.

Hugo
--- a/regcomp.c
+++ b/regcomp.c
@​@​ -6204,7 +6204,8 @​@​ S_concat_pat(pTHX_ RExC_state_t * const pRExC_state,

  if (oplist) {
  assert(oplist->op_type == OP_PADAV
- || oplist->op_type == OP_RV2AV);
+ || oplist->op_type == OP_RV2AV
+ || oplist->op_type == OP_HSLICE);
  oplist = OpSIBLING(oplist);
  }

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @dur-randir

On Sun, 16 Oct 2016 07​:09​:15 -0700, hv wrote​:

It appears to be sufficient to expand the assert as below; however I
don't know if there's a bug elsewhere that's causing the OP_HSLICE to
leak to us in this case - a valid case (such as qr{(?{}){@​x{@​y}}@​y})
has the hash slice expanded before it reaches concat_pat().

I'm guessing Dave would know.

Hugo
--- a/regcomp.c
+++ b/regcomp.c
@​@​ -6204,7 +6204,8 @​@​ S_concat_pat(pTHX_ RExC_state_t * const
pRExC_state,

if (oplist) {
assert(oplist->op_type == OP_PADAV
- || oplist->op_type == OP_RV2AV);
+ || oplist->op_type == OP_RV2AV
+ || oplist->op_type == OP_HSLICE);
oplist = OpSIBLING(oplist);
}

Here is another program that triggers the same assertion, but now with oplist->op_type == OP_CONST​:

qr!@​0{0,{}}(?{{}})@​$ !

[p5pRT]

From [Unknown Contact. See original ticket]

On Sun, 16 Oct 2016 07​:09​:15 -0700, hv wrote​:

It appears to be sufficient to expand the assert as below; however I
don't know if there's a bug elsewhere that's causing the OP_HSLICE to
leak to us in this case - a valid case (such as qr{(?{}){@​x{@​y}}@​y})
has the hash slice expanded before it reaches concat_pat().

I'm guessing Dave would know.

Hugo
--- a/regcomp.c
+++ b/regcomp.c
@​@​ -6204,7 +6204,8 @​@​ S_concat_pat(pTHX_ RExC_state_t * const
pRExC_state,

if (oplist) {
assert(oplist->op_type == OP_PADAV
- || oplist->op_type == OP_RV2AV);
+ || oplist->op_type == OP_RV2AV
+ || oplist->op_type == OP_HSLICE);
oplist = OpSIBLING(oplist);
}

Here is another program that triggers the same assertion, but now with oplist->op_type == OP_CONST​:

qr!@​0{0,{}}(?{{}})@​$ !

[p5pRT]

From @geeknik

perl -e 'qr/(?{})@​0{@​0}@​0/' also triggers this assertion failure in version
5.29.0-87-ga13f1de.

perl​: regcomp.c​:6404​: SV *S_concat_pat(RExC_state_t *const, SV *, SV
**const, int, OP *, _Bool *, SV *)​: Assertion `oplist->op_type == OP_PADAV
|| oplist->op_type == OP_RV2AV' failed.

On Sun, Oct 16, 2016 at 9​:09 AM, Hugo van der Sanden via RT <
perlbug-followup@​perl.org> wrote​:

On Fri Oct 14 14​:42​:19 2016, brian.carpenter@​gmail.com wrote​:

Triggered in Perl v5.25.6 (v5.25.5-104-gaff2be5).

perl -e 'qr{(?{}){@​0{@​}}@​0}'

perl​: regcomp.c​:6207​: SV *S_concat_pat(RExC_state_t *const, SV *, SV
**const, int, OP *, _Bool *, SV *)​: Assertion `oplist->op_type ==
OP_PADAV
|| oplist->op_type == OP_RV2AV' failed.
Aborted

It appears to be sufficient to expand the assert as below; however I don't
know if there's a bug elsewhere that's causing the OP_HSLICE to leak to us
in this case - a valid case (such as qr{(?{}){@​x{@​y}}@​y}) has the hash
slice expanded before it reaches concat_pat().

I'm guessing Dave would know.

Hugo
--- a/regcomp.c
+++ b/regcomp.c
@​@​ -6204,7 +6204,8 @​@​ S_concat_pat(pTHX_ RExC_state_t * const pRExC_state,

         if \(oplist\) \{
             assert\(oplist\->op\_type == OP\_PADAV

- || oplist->op_type == OP_RV2AV);
+ || oplist->op_type == OP_RV2AV
+ || oplist->op_type == OP_HSLICE);
oplist = OpSIBLING(oplist);
}

---
via perlbug​: queue​: perl5 status​: new
https://rt-archive.perl.org/perl5/Ticket/Display.html?id=129880