From @dur-randir

Created by @dur-randir

While fuzzing perl v5.29.9-63-g2496d8f3f7 built with afl and run
under libdislocator, I found the following program

use utf8;q!Ȧिम한글💣΢ყაოსაა!=~/(?li)\b{wb}\B(*COMMIT)0/

to cause an assertion failure

perl​: regexec.c​:6480​: ssize_t S_regmatch(regmatch_info *, char *,
regnode *)​: Assertion `(( (U8*)(reginfo->strend)) >
(S_reghop3((U8*)locinput, -1, (U8*)(reginfo->strbeg))))' failed.

GDB stack trace is following

#0 __GI_raise (sig=sig@​entry=6) at ../sysdeps/unix/sysv/linux/raise.c​:50
#1 0x00007ffff7c25535 in __GI_abort () at abort.c​:79
#2 0x00007ffff7c2540f in __assert_fail_base (fmt=0x7ffff7d87ee0
"%s%s%s​:%u​: %s%sAssertion `%s' failed.\n%n",
  assertion=0x555555aecc80 "(((U8*)(reginfo->strend)) >
(S_reghop3((U8*)locinput, -1, (U8*)(reginfo->strbeg))))",
file=0x555555ae31a8 "regexec.c",
  line=6480, function=<optimized out>) at assert.c​:92
#3 0x00007ffff7c330f2 in __GI___assert_fail (
  assertion=0x555555aecc80 "(((U8*)(reginfo->strend)) >
(S_reghop3((U8*)locinput, -1, (U8*)(reginfo->strbeg))))",
file=0x555555ae31a8 "regexec.c",
  line=6480, function=0x555555af5f10 <__PRETTY_FUNCTION__.19772>
"S_regmatch") at assert.c​:101
#4 0x00005555558b752c in S_regmatch (reginfo=0x7fffffffdcd0,
startpos=0x555555b7b757 "", prog=0x555555b84a3c) at regexec.c​:6478
#5 0x00005555558ae7d3 in S_regtry (reginfo=0x7fffffffdcd0,
startposp=0x7fffffffd7d8) at regexec.c​:3961
#6 0x00005555558a5fe8 in S_find_byclass (prog=0x555555b7d680,
c=0x555555b84a3c, s=0x555555b7b757 "", strend=0x555555b7b756 "",
reginfo=0x7fffffffdcd0)
  at regexec.c​:2714
#7 0x00005555558ad83e in Perl_regexec_flags (rx=0x555555b74e58,
stringarg=0x555555b7b730 "Ȧिम한글💣\316\242ყაოსაა",
  strend=0x555555b7b756 "", strbeg=0x555555b7b730
"Ȧिम한글💣\316\242ყაოსაა", minend=0, sv=0x555555b74e40, data=0x0,
flags=97)
  at regexec.c​:3706
#8 0x0000555555769db7 in Perl_pp_match () at pp_hot.c​:3018
#9 0x000055555570ba97 in Perl_runops_debug () at dump.c​:2537
#10 0x00005555555ed560 in S_run_body (oldscope=1) at perl.c​:2716
#11 0x00005555555ecade in perl_run (my_perl=0x555555b4e260) at perl.c​:2639
#12 0x00005555555a114e in main (argc=3, argv=0x7fffffffe1b8,
env=0x7fffffffe1d8) at perlmain.c​:127

This assertion was added by the following commit, which indeed exposed some bugs

commit 7a20706
Author​: Karl Williamson <khw@​cpan.org>
Date​: Wed Nov 30 09​:53​:17 2016 -0700

  Convert core (except toke.c) to use isFOO_utf8_safe()

  The previous commit added this feature; now this commit uses it in core.
  toke.c is deferred to the next commit to aid in possible future
  bisecting, because some of the changes there seem somewhat more likely
  to expose bugs.

Flags:
    category=core
    severity=medium

Site configuration information for perl 5.29.9:

Configured by dur-randir at Wed Feb 27 14:51:01 MSK 2019.

Summary of my perl5 (revision 5 version 29 subversion 9) configuration:
  Commit id: c1e47bad34ce1d9c84ed57c9b8978bcbd5a02e98
  Platform:
    osname=darwin
    osvers=13.4.0
    archname=darwin-thread-multi-2level
    uname='darwin isengard.local 13.4.0 darwin kernel version 13.4.0:
mon jan 11 18:17:34 pst 2016; root:xnu-2422.115.15~1release_x86_64
x86_64 '
    config_args='-de -Dusedevel -DDEBUGGING -Dusethreads'
    hint=recommended
    useposix=true
    d_sigaction=define
    useithreads=define
    usemultiplicity=define
    use64bitint=define
    use64bitall=define
    uselongdouble=undef
    usemymalloc=n
    default_inc_excludes_dot=define
    bincompat5005=undef
  Compiler:
    cc='cc'
    ccflags ='-fno-common -DPERL_DARWIN -mmacosx-version-min=10.9
-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector
-I/usr/local/include -DPERL_USE_SAFE_PUTENV'
    optimize='-O3 -g'
    cppflags='-fno-common -DPERL_DARWIN -mmacosx-version-min=10.9
-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector
-I/usr/local/include'
    ccversion=''
    gccversion='4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.56)'
    gccosandvers=''
    intsize=4
    longsize=8
    ptrsize=8
    doublesize=8
    byteorder=12345678
    doublekind=3
    d_longlong=define
    longlongsize=8
    d_longdbl=define
    longdblsize=16
    longdblkind=3
    ivtype='long'
    ivsize=8
    nvtype='double'
    nvsize=8
    Off_t='off_t'
    lseeksize=8
    alignbytes=8
    prototype=define
  Linker and Libraries:
    ld='cc'
    ldflags =' -mmacosx-version-min=10.9 -fstack-protector -L/usr/local/lib'
    libpth=/usr/local/lib
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/6.0/lib
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib
/usr/lib
    libs=-lpthread -lgdbm -ldbm -ldl -lm -lutil -lc
    perllibs=-lpthread -ldl -lm -lutil -lc
    libc=
    so=dylib
    useshrplib=false
    libperl=libperl.a
    gnulibc_version=''
  Dynamic Linking:
    dlsrc=dl_dlopen.xs
    dlext=bundle
    d_dlsymun=undef
    ccdlflags=' '
    cccdlflags=' '
    lddlflags=' -mmacosx-version-min=10.9 -bundle -undefined
dynamic_lookup -L/usr/local/lib -fstack-protector'



@INC for perl 5.29.9:
    lib
    /usr/local/lib/perl5/site_perl/5.29.9/darwin-thread-multi-2level
    /usr/local/lib/perl5/site_perl/5.29.9
    /usr/local/lib/perl5/5.29.9/darwin-thread-multi-2level
    /usr/local/lib/perl5/5.29.9


Environment for perl 5.29.9:
    DYLD_LIBRARY_PATH (unset)
    HOME=/Users/dur-randir
    LANG=en_US.UTF-8
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/Users/dur-randir/perlbrew/bin:/Users/dur-randir/perlbrew/perls/perl-5.22.1/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/texbin
    PERLBREW_HOME=/Users/dur-randir/.perlbrew
    PERLBREW_MANPATH=/Users/dur-randir/perlbrew/perls/perl-5.22.1/man
    PERLBREW_PATH=/Users/dur-randir/perlbrew/bin:/Users/dur-randir/perlbrew/perls/perl-5.22.1/bin
    PERLBREW_PERL=perl-5.22.1
    PERLBREW_ROOT=/Users/dur-randir/perlbrew
    PERLBREW_SHELLRC_VERSION=0.84
    PERLBREW_VERSION=0.84
    PERL_BADLANG (unset)
    SHELL=/usr/local/bin/zsh

@khwilliamson - Status changed from 'new' to 'open'

From @khwilliamson

This should be fixed by
commit 8c9c272
Author​: Karl Williamson <khw@​cpan.org>
Date​: Mon Apr 15 15​:08​:05 2019 -0600

  PATCH​: [perl #134034] Assert fail in pattern match
 
  This turned out to be a general problem in regexec.c. The function
  regtry() can change the position we are looking at in the target string.
  In particular it can point to just past the end of the string. Prior
  to this commit, we were assuming that the returned string contained
  valid data in the returned position, and in many places we assumed that
  it was before the end. This commit fixes that in a bunch of places.
--
Karl Williamson

@khwilliamson - Status changed from 'open' to 'pending release'

From @khwilliamson

Thank you for filing this report. You have helped make Perl better.

With the release today of Perl 5.30.0, this and 160 other issues have been
resolved.

Perl 5.30.0 may be downloaded via​:
https://metacpan.org/release/XSAWYERX/perl-5.30.0

If you find that the problem persists, feel free to reopen this ticket.

@khwilliamson - Status changed from 'pending release' to 'resolved'