From @geeknik

While fuzzing Perl v5.24.0-RC1-2-gde1d2c7 with American Fuzzy Lop, I found that perl -e '$**=@​0=**=@​*=0' triggers Perl_sv_setnv​: Assertion `PL_valid_types_NV_set[((svtype)((sv)->sv_flags & 0xff)) & 0xf]' failed. Perl 5.14.2 returns $* is no longer supported at -e line 1.

From zefram@fysh.org

Brian Carpenter wrote​:

perl -e '$**=@​0=**=@​*=0' triggers Perl_sv_setnv​: Assertion `PL_valid_types_NV_set[((svtype)((sv)->sv_flags & 0xff)) & 0xf]' failed.

This reduces to

  perl -e '$z *= *z=0'

which looks like the nonsensical glob assignment is undermining the
scalar that is to be mutated. This only happens if the glob assignment
happens inside the rhs of a modifying assignment.

-zefram

The RT System itself - Status changed from 'new' to 'open'

From @geeknik

Just ran into this issue again while fuzzing v5.25.1-152-g81b22c1.

From [Unknown Contact. See original ticket]

Just ran into this issue again while fuzzing v5.25.1-152-g81b22c1.

From @geeknik

Ran into this again while fuzzing v5.25.5 (v5.25.4-5-g92d73bf).

From [Unknown Contact. See original ticket]

Ran into this again while fuzzing v5.25.5 (v5.25.4-5-g92d73bf).