Segfault on Perl_do_join

[Kentaro Horio]

While array.join on a template, we got segfault on Text::Xslate-v3.5.6 (or other versions).
In our case there are array of just 123 items.

• env

$ perl -v

This is perl 5, version 24, subversion 1 (v5.24.1) built for x86_64-linux
...

$ perl -MText::Xslate\ 9999999
Text::Xslate version 9999999 required--this is only version v3.5.6.
BEGIN failed--compilation aborted.

reproduction scenario

• xslate.pl

use Text::Xslate;

my $tx = Text::Xslate->new(
    syntax => 'TTerse',
    cache => 1,
);

my $len = $ARGV[0];
my $c = $len;
my @array = ('a');
while ($c > 0) {
    push @array, 'a';
    $c--;
};

my %vars = (
    num => $len,
    array => \@array,
);
print $tx->render('hello.tt', \%vars);

• hello.tt

[% num %]: Hello, [% array.join(' ') %] world!

• run

$ perl -Mlocal::lib=./myextlib xslate.pl 122
122: Hello, a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a a world!
$ perl -Mlocal::lib=./myextlib xslate.pl 123
セグメンテーション違反です (コアダンプ)

• backtrace

(gdb) bt
#0  0x00000000006ace6d in Perl_do_join (sv=0x1b0b388, delim=0x1b0a860, mark=0x184cf50, sp=0x18e6bd8) at doop.c:669
#1  0x00007f80014b45a1 in tx_bm_array_join (st=0x7fffe6087010, retval=0x1b0b388, method=0x18e5830, mark=0x184cb78) at src/xslate_methods.xs:117
#2  0x00007f80014b6a92 in tx_methodcall	(st=0x7fffe6087010, method=0x18e5830) at src/xslate_methods.xs:477
#3  0x00007f80014a4e9d in TXCODE_methodcall_s (txst=0x7fffe6087010) at src/xslate_opcode.inc:677
#4  0x00007f800149af54 in tx_runops (st=0x7fffe6087010)	at src/xslate_ops.h:565
#5  0x00007f80014aad3c in tx_execute (base=0x1a85950, output=0x1acc3e0,	hv=0x1a49e70) at lib/Text/Xslate.xs:963
#6  0x00007f80014b015c in XS_Text__Xslate__Engine_render (cv=0x186bba8)	at lib/Text/Xslate.xs:1645
#7  0x00000000005be532 in Perl_pp_entersub () at pp_hot.c:3987
#8  0x00000000005578cb in Perl_runops_debug () at dump.c:2239
#9  0x00000000004609ff in S_run_body (oldscope=1) at perl.c:2483
#10 0x000000000046009a in perl_run (my_perl=0x1848010) at perl.c:2406
#11 0x000000000041ed0c in main (argc=4,	argv=0x7fffe6087818, env=0x7fffe6087840) at perlmain.c:116