Perl 5.42 segfault during compilation

[bbrtj]

Description

The following code causes Segmentation fault during compilation on 5.42. It works on 5.40.

use v5.40;

package Test {
	use v5.40;

	sub new ($class, @arr)
	{
		return bless {arr => \@arr}, $class;
	}

	my sub test ($self)
	{
		for my ($i, $val) (indexed $self->{arr}->@*) {
			return $val;
		}
	}

	sub test_public ($self)
	{
		return test($self);
		# return $self->&test;
	}
}

print Test->new(2, 3, 4, 5)->test_public;

Steps to Reproduce

From testing the above program, it seems it only segfaults with these conditions:

• perl 5.42.0
• my sub
• n-at-a-time for loop
• indexed builtin

if any of those is not met, segfault does not occur.

Expected behavior

Code is valid perl, so it should work fine. It definetly should not segfault.

Perl configuration

Summary of my perl5 (revision 5 version 42 subversion 0) configuration:

  Platform:
    osname=linux
    osvers=5.15.161
    archname=x86_64-linux
    uname='linux thinkpad.local 5.15.161 #1 smp preempt sun jun 16 15:55:06 cdt 2024 x86_64 intel(r) core(tm) i7-8650u cpu @ 1.90ghz genuineintel gnulinux '
    config_args='-de -Dprefix=/home/bartosz/perl5/perlbrew/perls/perl-5.42.0 -Duseshrplib -Aeval:scriptdir=/home/bartosz/perl5/perlbrew/perls/perl-5.42.0/bin'
    hint=recommended
    useposix=true
    d_sigaction=define
    useithreads=undef
    usemultiplicity=undef
    use64bitint=define
    use64bitall=define
    uselongdouble=undef
    usemymalloc=n
    default_inc_excludes_dot=define
  Compiler:
    cc='cc'
    ccflags ='-fwrapv -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 -D_FORTIFY_SOURCE=2'
    optimize='-O2'
    cppflags='-fwrapv -fno-strict-aliasing -pipe -fstack-protector-strong -I/usr/local/include'
    ccversion=''
    gccversion='11.2.0'
    gccosandvers=''
    intsize=4
    longsize=8
    ptrsize=8
    doublesize=8
    byteorder=12345678
    doublekind=3
    d_longlong=define
    longlongsize=8
    d_longdbl=define
    longdblsize=16
    longdblkind=3
    ivtype='long'
    ivsize=8
    nvtype='double'
    nvsize=8
    Off_t='off_t'
    lseeksize=8
    alignbytes=8
    prototype=define
  Linker and Libraries:
    ld='cc'
    ldflags =' -fstack-protector-strong -L/usr/local/lib'
    libpth=/usr/local/lib /usr/lib /lib64 /usr/lib64 /lib /usr/local/lib64
    libs=-lpthread -lgdbm -ldb -ldl -lm -lcrypt -lutil -lc
    perllibs=-lpthread -ldl -lm -lcrypt -lutil -lc
    libc=libc-2.33.so
    so=so
    useshrplib=true
    libperl=libperl.so
    gnulibc_version='2.33'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs
    dlext=so
    d_dlsymun=undef
    ccdlflags='-Wl,-E -Wl,-rpath,/home/bartosz/perl5/perlbrew/perls/perl-5.42.0/lib/5.42.0/x86_64-linux/CORE'
    cccdlflags='-fPIC'
    lddlflags='-shared -O2 -L/usr/local/lib -fstack-protector-strong'


Characteristics of this binary (from libperl):
  Compile-time options:
    HAS_LONG_DOUBLE
    HAS_STRTOLD
    HAS_TIMES
    PERLIO_LAYERS
    PERL_COPY_ON_WRITE
    PERL_DONT_CREATE_GVSV
    PERL_HASH_FUNC_SIPHASH13
    PERL_HASH_USE_SBOX32
    PERL_MALLOC_WRAP
    PERL_OP_PARENT
    PERL_PRESERVE_IVUV
    PERL_USE_SAFE_PUTENV
    USE_64_BIT_ALL
    USE_64_BIT_INT
    USE_LARGE_FILES
    USE_LOCALE
    USE_LOCALE_COLLATE
    USE_LOCALE_CTYPE
    USE_LOCALE_NUMERIC
    USE_LOCALE_TIME
    USE_PERLIO
    USE_PERL_ATOF
  Built under linux
  Compiled at Jul  4 2025 15:22:25
  %ENV:
    PERLBREW_HOME="/home/bartosz/.perlbrew"
    PERLBREW_MANPATH="/home/bartosz/perl5/perlbrew/perls/perl-5.42.0/man"
    PERLBREW_PATH="/home/bartosz/perl5/perlbrew/bin:/home/bartosz/perl5/perlbrew/perls/perl-5.42.0/bin"
    PERLBREW_PERL="perl-5.42.0"
    PERLBREW_ROOT="/home/bartosz/perl5/perlbrew"
    PERLBREW_SHELLRC_VERSION="1.01"
    PERLBREW_VERSION="1.01"
  @INC:
    /home/bartosz/perl5/perlbrew/perls/perl-5.42.0/lib/site_perl/5.42.0/x86_64-linux
    /home/bartosz/perl5/perlbrew/perls/perl-5.42.0/lib/site_perl/5.42.0
    /home/bartosz/perl5/perlbrew/perls/perl-5.42.0/lib/5.42.0/x86_64-linux
    /home/bartosz/perl5/perlbrew/perls/perl-5.42.0/lib/5.42.0

[bbrtj]

This is the most minimal case I could make that segfaults:

use v5.40;

my sub test ($self, @arr)
{
	for my ($i, $val) (indexed @arr) {}
}

[akhuettel]

I can confirm the segfault with 5.42.0; here is a backtrace from the core dump:

#0  0x00007f33192383d6 in S_op_is_cv_xsub (xsub=<optimized out>, o=<optimized out>) at op.c:9676
#1  S_op_is_call_to_cv_xsub (xsub=<optimized out>, o=0x5654f4d68ff0) at op.c:9690
#2  Perl_newFOROP (flags=flags@entry=0, sv=0x0, expr=0x5654f4d68ff0, block=0x5654f4d68fc0, cont=0x0) at op.c:9834
#3  0x00007f33192aebee in Perl_yyparse (gramtype=gramtype@entry=258) at /tmp/portage/dev-lang/perl-5.42.0/work/perl-5.42.0/perly.y:530
#4  0x00007f331924f73e in S_parse_body (env=0x0, xsinit=0x5654bc4043f0 <xs_init>) at perl.c:2691
#5  perl_parse (my_perl=<optimized out>, xsinit=xsinit@entry=0x5654bc4043f0 <xs_init>, argc=<optimized out>, argv=<optimized out>, env=env@entry=0x0) at perl.c:1933
#6  0x00005654bc40424e in main (argc=<optimized out>, argv=<optimized out>, env=<optimized out>) at perlmain.c:106

[mauke]

With a DEBUGGING perl:

perl: op.c:9669: S_op_is_cv_xsub: Assertion `cv && SvTYPE(cv) == SVt_PVCV' failed.

Program received signal SIGABRT, Aborted.
__pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
warning: 44     ./nptl/pthread_kill.c: No such file or directory
(gdb) bt
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3  0x00007ffff7c4527e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4  0x00007ffff7c288ff in __GI_abort () at ./stdlib/abort.c:79
#5  0x00007ffff7c2881b in __assert_fail_base (fmt=0x7ffff7dd01e8 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x55555583ac16 "cv && SvTYPE(cv) == SVt_PVCV", file=file@entry=0x55555583f20a "op.c", 
    line=line@entry=9669, function=function@entry=0x555555894d80 <__PRETTY_FUNCTION__.122> "S_op_is_cv_xsub") at ./assert/assert.c:96
#6  0x00007ffff7c3b517 in __assert_fail (assertion=assertion@entry=0x55555583ac16 "cv && SvTYPE(cv) == SVt_PVCV", file=file@entry=0x55555583f20a "op.c", line=line@entry=9669, 
    function=function@entry=0x555555894d80 <__PRETTY_FUNCTION__.122> "S_op_is_cv_xsub") at ./assert/assert.c:105
#7  0x00005555555b608c in S_op_is_cv_xsub (xsub=<optimized out>, o=<optimized out>, my_perl=0x555555a772a0) at /home/mauke/perl5/perlbrew/build/perl-5.42.0-DEBUGGING/perl-5.42.0/op.c:9669
#8  S_op_is_call_to_cv_xsub (xsub=<optimized out>, o=0x555555ac1ef0, my_perl=0x555555a772a0) at /home/mauke/perl5/perlbrew/build/perl-5.42.0-DEBUGGING/perl-5.42.0/op.c:9690
#9  Perl_newFOROP (my_perl=0x555555a772a0, flags=0, sv=0x0, expr=0x555555ac1ef0, block=0x555555ac1ec0, cont=0x0) at /home/mauke/perl5/perlbrew/build/perl-5.42.0-DEBUGGING/perl-5.42.0/op.c:9834
#10 0x00005555556643ff in Perl_yyparse (my_perl=0x555555a772a0, gramtype=<optimized out>) at /home/mauke/perl5/perlbrew/build/perl-5.42.0-DEBUGGING/perl-5.42.0/perly.y:530
#11 0x00005555555dae1c in S_parse_body (xsinit=0x55555559e850 <xs_init>, env=0x0, my_perl=0x555555a772a0) at /home/mauke/perl5/perlbrew/build/perl-5.42.0-DEBUGGING/perl-5.42.0/perl.c:2691
#12 perl_parse (my_perl=0x555555a772a0, xsinit=0x55555559e850 <xs_init>, argc=<optimized out>, argv=<optimized out>, env=0x0) at /home/mauke/perl5/perlbrew/build/perl-5.42.0-DEBUGGING/perl-5.42.0/perl.c:1933
#13 0x000055555559e65d in main (argc=<optimized out>, argv=<optimized out>, env=<optimized out>) at /home/mauke/perl5/perlbrew/build/perl-5.42.0-DEBUGGING/perl-5.42.0/perlmain.c:106

(gdb) frame 7
#7  0x00005555555b608c in S_op_is_cv_xsub (xsub=<optimized out>, o=<optimized out>, my_perl=0x555555a772a0) at /home/mauke/perl5/perlbrew/build/perl-5.42.0-DEBUGGING/perl-5.42.0/op.c:9669
9669                assert(cv && SvTYPE(cv) == SVt_PVCV);

(gdb) p *cv
$2 = {sv_any = 0x0, sv_refcnt = 1, sv_flags = 0, sv_u = {svu_pv = 0x0, svu_iv = 0, svu_uv = 0, svu_rv = 0x0, svu_array = 0x0, svu_hash = 0x0, svu_gp = 0x0, svu_fp = 0x0}}

[jkeenan]

Bisection with the following invocation:

$ perl Porting/bisect.pl \
--start=v5.40.0 \
--end=v5.42.0 \
--target=miniperl \
--crash \
-- ./miniperl -Ilib $P5P_DIR/gh-23405-segfault.pl

... where the test program is:

$ cat gh-23405-segfault.pl
use v5.40;

my sub test ($self, @arr)
{
	for my ($i, $val) (indexed @arr) {}
}

... points to a8394b4 as the breaking commit:

a8394b4e8cb3545141487cc9f17c08f312ec635c is the first bad commit
commit a8394b4e8cb3545141487cc9f17c08f312ec635c
Author: Paul "LeoNerd" Evans <leonerd@leonerd.org.uk>
Date:   Wed Oct 2 17:34:57 2024 +0100
Commit:     Paul Evans <leonerd@leonerd.org.uk>
CommitDate: Wed Nov 6 23:21:06 2024 +0000

    Optimise foreach on a list from builtin::indexed @array into two lexicals
    
    Rather than generating an entire temporary list that is twice as big as
    the original array, instead set a flag on the `OP_ITER` that tells it to
    set one of the iteration variables to the current array index and use
    the same `CXt_LOOP_ARY` optimisation that regular foreach over an array
    would use.

@leonerd, can you take a look? Thanks.