From @geeknik

Valgrind output:
Valgrind output

==24607== Invalid read of size 4
==24607== at 0x668818: Perl_yyparse (perly.c:523)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c1c is 172 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid read of size 2
==24607== at 0x668898: Perl_yyparse (perly.c:524)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c18 is 168 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid read of size 8
==24607== at 0x6688F0: Perl_yyparse (perly.c:524)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c10 is 160 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid read of size 8
==24607== at 0x668B90: Perl_yyparse (perly.c:532)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c20 is 176 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid read of size 2
==24607== at 0x668C6E: Perl_yyparse (perly.c:534)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8bf8 is 136 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid write of size 2
==24607== at 0x668F97: Perl_yyparse (perly.c:545)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c18 is 168 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid write of size 8
==24607== at 0x668FA3: Perl_yyparse (perly.c:546)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c10 is 160 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid read of size 2
==24607== at 0x668FEE: Perl_yyparse (inline.h:143)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c18 is 168 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid write of size 8
==24607== at 0x669036: Perl_yyparse (perly.c:547)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c20 is 176 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid write of size 8
==24607== at 0x66903A: Perl_yyparse (perly.c:550)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c28 is 184 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid write of size 4
==24607== at 0x669042: Perl_yyparse (perly.c:548)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c1c is 172 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid read of size 8
==24607== at 0x667C7A: Perl_yyparse (perly.c:408)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c10 is 160 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
==24607== Invalid read of size 8
==24607== at 0x668113: Perl_yyparse (perly.c:423)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607== Address 0x5ed8c20 is 176 bytes inside a block of size 6,400 free'd
==24607== at 0x4C27D4E: free (vg_replace_malloc.c:427)
==24607== by 0xB23A55: Perl_leave_scope (scope.c:1241)
==24607== by 0x65EC04: S_sublex_done (toke.c:2481)
==24607== by 0x603C30: Perl_yylex (toke.c:4547)
==24607== by 0x669684: Perl_yyparse (perly.c:322)
==24607== by 0x5399A4: S_parse_body (perl.c:2273)
==24607== by 0x541536: perl_parse (perl.c:1607)
==24607== by 0x42B63B: main (perlmain.c:114)
==24607==
perl: sv.c:6536: Perl_sv_clear: Assertion `((svtype)((sv)->sv_flags & 0xff)) != (svtype)0xff' failed.
Aborted

Segfault in Perl_yyparse with minimized test case from #123801 #14497

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions