ｓｕｂ ＮＥＧＡＴＩＶＥ＿ＩＮＤＩＣＥＳ； + ＄ｔｉｅｄ［－１］ = crash

This code in av.c, when trying to find $NEGATIVE_INDICES, was doing a
direct stash element lookup--instead of going through the normal GV
functions--and then expecting the returned value to be a GV.

‘sub NEGATIVE_INDICES’ creates a stash element that is a PV, not a GV,
so it’s easy to make things crash.

1 files changed, 2 insertions, 1 deletions

diff --git a/av.c b/av.c
index 3473d08e6e..2a8ccf0de6 100644
--- a/av.c
+++ b/av.c
@@ -201,7 +201,8 @@ S_adjust_index(pTHX_ AV *av, const MAGIC *mg, SSize_t *keyp)
 	    SV * const * const negative_indices_glob =
 		hv_fetchs(SvSTASH(SvRV(ref)), NEGATIVE_INDICES_VAR, 0);
 
-	    if (negative_indices_glob && SvTRUE(GvSV(*negative_indices_glob)))
+	    if (negative_indices_glob && isGV(*negative_indices_glob)
+	     && SvTRUE(GvSV(*negative_indices_glob)))
 		adjust_index = 0;
 	}
     }