Branch: refs/heads/blead
  Home:   https://github.com/Perl/perl5
  Commit: b790ed71bdb9ac73a66f9dc2639f19950391ed45
      
https://github.com/Perl/perl5/commit/b790ed71bdb9ac73a66f9dc2639f19950391ed45
  Author: David Mitchell <[email protected]>
  Date:   2020-01-02 (Thu, 02 Jan 2020)

  Changed paths:
    M ext/B/t/b.t
    M lib/B/Deparse.t
    M op.c

  Log Message:
  -----------
  OP_MULTIDEREF: avoid trailing null aux byte

GH #17301

The aux array in an OP_MULTIDEREF op consists of an action word
containing as many actions as will fit shifted together, followed by
words containing the arguments for those actions. Then another action
word, and so on. The code in S_maybe_multideref() which creates those
ops was reserving a new slot in the aux array for a new action word when
the old one became full. If it then turned out that no  more actions
were needed, this extra slot was harmlessly filled with a zero.

However it turns out that the B::UNOP_AUX::aux_list() introspection
method would, under those circumstances, claim to have returned one
more SV on the stack than it actually had, leading to SEGVs etc.

I could have fixed aux_list() directly to cope with an extra null word,
but instead I did the more general fix of ensuring that
S_maybe_multideref() never adds an extra null word in the first place.

The test added to ext/B/t/b.t fails before this commit; the new test
in lib/B/Deparse.t doesn't, but was added for completeness.

Reply via email to