New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SIGSEGV in S_regmatch with S_study_chunk: Assertion `!frame' failed. #15306
Comments
From @dcollinsnGreetings Porters, I have compiled bleadperl with the afl-gcc compiler using: ./Configure -Dusedevel -Dprefix='/usr/local/perl-afl' -Dcc='ccache afl-gcc' -Uuselongdouble -Duse64bitall -Doptimize=-g -Uversiononly -Uman1dir -Uman3dir -Dusequadmath -des And then fuzzed the resulting binary using: AFL_NO_VAR_CHECK=1 afl-fuzz -i in -o out bin/perl @@ After reducing testcases using `afl-tmin` and performing additional minimization by hand, I have located the following testcase that triggers a segmentation fault in the perl interpreter. The testcase is the 17-character file: /()()/~~/\X*(?0)/ On normal builds, this crashes with a segmentation fault. On debug builds, this throws an assert failure that I cannot find an existing bug report for dcollins@nightshade64:/usr/local/perl-afl/out$ ~/perl/perl -e "/()()/ Debugging tool output is below. **GDB** dcollins@nightshade64:/usr/local/perl-afl/out$ gdb --args Program received signal SIGSEGV, Segmentation fault. dcollins@nightshade64:/usr/local/perl-afl/out$ gdb --args Program received signal SIGABRT, Aborted. **VALGRIND** dcollins@nightshade64:/usr/local/perl-afl/out$ valgrind ~/perl/perl -e "/()()/ **PERL -V** dcollins@nightshade64:~/perl$ ./perl -Ilib -V Characteristics of this binary (from libperl): |
From @hvdsThe failure case can be simplified to: A bisect leads to: I don't understand this, but stepping through just after that commit at regcomp.c:4669: .. where the latter expression is what the previous code would have evaluated for the GOSTART case. As a result, before that commit we recurse onto the STAR node rather than the WHILEM. Yves, could you take a look? Hugo |
The RT System itself - Status changed from 'new' to 'open' |
From @demerphqOn 8 May 2016 at 20:32, Hugo van der Sanden via RT
I am not really sure I follow you there actually. This assert fires
Fix pushed as branch yves/fix_128085. I don't have time right now to sort out a proper test. If you want to Yves -- |
From @hvdsOn Sun May 08 23:58:38 2016, demerphq wrote:
I'm saying that the bisected commit d5a00e4, in combining GOSUB and GOSTART, has changed the "start" target we recurse to for the former GOSTART case (now GOSUB(0)).
Ah ok; that has been the case since you added the framing stuff in 2006 (8aa23a4) and I had assumed this was genuinely asserting that we are not expected to hit a WHILEM when recursing (faithfully preserved in S_rck_whilem() in the hv/study_chunk branch). Are you saying that's the _only_ problem here, and the change of start target for GOSTART is fine? Hugo |
From @demerphqOn 9 May 2016 at 10:28, Hugo van der Sanden via RT
Thanks.
No. You have identified another issue which really needs to be fixed. Yves -- |
@iabyn - Status changed from 'open' to 'resolved' |
Migrated from rt.perl.org#128085 (status was 'resolved')
Searchable as RT128085$
The text was updated successfully, but these errors were encountered: