Assertion failure in Perl_pp_sort/S_POPMARK

[p5pRT]

Migrated from rt.perl.org#133883 (status was 'new')

Searchable as RT133883$

[p5pRT]

From @dur-randir

Created by @dur-randir

While fuzzing perl v5.29.8-21-gde59f38ed9 built with afl and run
under libdislocator, I found the following program

\(sort {0} 0, 0 .. "r")

to cause an assertion failure​:

perl​: ./inline.h​:172​: I32 S_POPMARK()​: Assertion `(PL_markstack_ptr >
PL_markstack) || !"MARK underflow"' failed.

GDB stack trace is following​:

#0 __GI_raise (sig=sig@​entry=6) at ../sysdeps/unix/sysv/linux/raise.c​:50
#1 0x00007ffff7c25535 in __GI_abort () at abort.c​:79
#2 0x00007ffff7c2540f in __assert_fail_base (fmt=0x7ffff7d87ee0
"%s%s%s​:%u​: %s%sAssertion `%s' failed.\n%n",
  assertion=0x555555af4448 "(PL_markstack_ptr > PL_markstack) ||
!\"MARK underflow\"", file=0x555555af43f0 "inline.h", line=172,
function=<optimized out>)
  at assert.c​:92
#3 0x00007ffff7c330f2 in __GI___assert_fail (assertion=0x555555af4448
"(PL_markstack_ptr > PL_markstack) || !\"MARK underflow\"",
  file=0x555555af43f0 "inline.h", line=172, function=0x555555af4b88
<__PRETTY_FUNCTION__.17049> "S_POPMARK") at assert.c​:101
#4 0x00005555559030bf in S_POPMARK () at inline.h​:172
#5 0x00005555559049fd in Perl_pp_sort () at pp_sort.c​:798
#6 0x00005555556f692d in Perl_runops_debug () at dump.c​:2537
#7 0x0000555555907adb in S_sortcv (a=0x555555b4b0b0,
b=0x555555b40e60) at pp_sort.c​:1132
#8 0x0000555555903b3b in dynprep (list1=0x555555b4a298,
list2=0x7fffffffc5a0, nmemb=2, cmp=0x555555907718 <S_sortcv>) at
pp_sort.c​:197
#9 0x0000555555903fde in Perl_sortsv_flags (base=0x555555b4a298,
nmemb=2, cmp=0x555555907718 <S_sortcv>, flags=0) at pp_sort.c​:388
#10 0x0000555555906daa in Perl_pp_sort () at pp_sort.c​:1014
#11 0x00005555556f692d in Perl_runops_debug () at dump.c​:2537
#12 0x0000555555907adb in S_sortcv (a=0x555555b4b0b0,
b=0x555555b26728) at pp_sort.c​:1132
#13 0x0000555555903b3b in dynprep (list1=0x555555b28da8,
list2=0x7fffffffd530, nmemb=2, cmp=0x555555907718 <S_sortcv>) at
pp_sort.c​:197
#14 0x0000555555903fde in Perl_sortsv_flags (base=0x555555b28da8,
nmemb=2, cmp=0x555555907718 <S_sortcv>, flags=0) at pp_sort.c​:388
#15 0x0000555555906daa in Perl_pp_sort () at pp_sort.c​:1014
#16 0x00005555556f692d in Perl_runops_debug () at dump.c​:2537
#17 0x00005555555da124 in S_run_body (oldscope=1) at perl.c​:2692
#18 0x00005555555d96a2 in perl_run (my_perl=0x555555b24260) at perl.c​:2615
#19 0x000055555558e12e in main (argc=3, argv=0x7fffffffe1c8,
env=0x7fffffffe1e8) at perlmain.c​:127

This is a regression between 5.24 and 5.26, bisect points to

commit b369834
Author​: Zefram <zefram@​fysh.org>
Date​: Fri Jan 27 03​:55​:46 2017 +0000

  fix range op under aborted constant folding

Perl Info

Flags:
    category=core
    severity=medium

Site configuration information for perl 5.29.9:

Configured by dur-randir at Wed Feb 27 14:51:01 MSK 2019.

Summary of my perl5 (revision 5 version 29 subversion 9) configuration:
  Commit id: c1e47bad34ce1d9c84ed57c9b8978bcbd5a02e98
  Platform:
    osname=darwin
    osvers=13.4.0
    archname=darwin-thread-multi-2level
    uname='darwin isengard.local 13.4.0 darwin kernel version 13.4.0:
mon jan 11 18:17:34 pst 2016; root:xnu-2422.115.15~1release_x86_64
x86_64 '
    config_args='-de -Dusedevel -DDEBUGGING -Dusethreads'
    hint=recommended
    useposix=true
    d_sigaction=define
    useithreads=define
    usemultiplicity=define
    use64bitint=define
    use64bitall=define
    uselongdouble=undef
    usemymalloc=n
    default_inc_excludes_dot=define
    bincompat5005=undef
  Compiler:
    cc='cc'
    ccflags ='-fno-common -DPERL_DARWIN -mmacosx-version-min=10.9
-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector
-I/usr/local/include -DPERL_USE_SAFE_PUTENV'
    optimize='-O3 -g'
    cppflags='-fno-common -DPERL_DARWIN -mmacosx-version-min=10.9
-DDEBUGGING -fno-strict-aliasing -pipe -fstack-protector
-I/usr/local/include'
    ccversion=''
    gccversion='4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.56)'
    gccosandvers=''
    intsize=4
    longsize=8
    ptrsize=8
    doublesize=8
    byteorder=12345678
    doublekind=3
    d_longlong=define
    longlongsize=8
    d_longdbl=define
    longdblsize=16
    longdblkind=3
    ivtype='long'
    ivsize=8
    nvtype='double'
    nvsize=8
    Off_t='off_t'
    lseeksize=8
    alignbytes=8
    prototype=define
  Linker and Libraries:
    ld='cc'
    ldflags =' -mmacosx-version-min=10.9 -fstack-protector -L/usr/local/lib'
    libpth=/usr/local/lib
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/../lib/clang/6.0/lib
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib
/usr/lib
    libs=-lpthread -lgdbm -ldbm -ldl -lm -lutil -lc
    perllibs=-lpthread -ldl -lm -lutil -lc
    libc=
    so=dylib
    useshrplib=false
    libperl=libperl.a
    gnulibc_version=''
  Dynamic Linking:
    dlsrc=dl_dlopen.xs
    dlext=bundle
    d_dlsymun=undef
    ccdlflags=' '
    cccdlflags=' '
    lddlflags=' -mmacosx-version-min=10.9 -bundle -undefined
dynamic_lookup -L/usr/local/lib -fstack-protector'



@INC for perl 5.29.9:
    lib
    /usr/local/lib/perl5/site_perl/5.29.9/darwin-thread-multi-2level
    /usr/local/lib/perl5/site_perl/5.29.9
    /usr/local/lib/perl5/5.29.9/darwin-thread-multi-2level
    /usr/local/lib/perl5/5.29.9


Environment for perl 5.29.9:
    DYLD_LIBRARY_PATH (unset)
    HOME=/Users/dur-randir
    LANG=en_US.UTF-8
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/Users/dur-randir/perlbrew/bin:/Users/dur-randir/perlbrew/perls/perl-5.22.1/bin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/texbin
    PERLBREW_HOME=/Users/dur-randir/.perlbrew
    PERLBREW_MANPATH=/Users/dur-randir/perlbrew/perls/perl-5.22.1/man
    PERLBREW_PATH=/Users/dur-randir/perlbrew/bin:/Users/dur-randir/perlbrew/perls/perl-5.22.1/bin
    PERLBREW_PERL=perl-5.22.1
    PERLBREW_ROOT=/Users/dur-randir/perlbrew
    PERLBREW_SHELLRC_VERSION=0.84
    PERLBREW_VERSION=0.84
    PERL_BADLANG (unset)
    SHELL=/usr/local/bin/zsh

[tonycoz]

Simplifies to:

$ ./perl -Ilib  -e '\sort{0}0=>(O..0);'
perl: inline.h:393: Perl_POPMARK: Assertion `(PL_markstack_ptr > PL_markstack) || !"MARK underflow"' failed.
Aborted

This looks like a bad op tree.

To find the entry op for the comparison code for sort BLOCK ... pp_sort looks for the op_next of the second child of the sort op.

The second child in both cases below is op numbered 10 (a null op), but the op_next for that null op is the range op for the bad case and a SVOP deep in the comparison coded for the good case.

For the bad case this means execution of the selected comparison code re-enters pp_sort leading to a mark stack underflow.

$ ./perl -Dt -e '\sort{ 1+$b <=> 1+$a }(O..2);'
(-e:1)  range
(-e:1)  const(PV("O"\0))
(-e:1)  flip
(-e:1)  const(IV(2))
(-e:1)  flop

EXECUTING...

(-e:0)  enter
(-e:0)  nextstate
(-e:1)  pushmark
(-e:1)  pushmark
(-e:1)  range
(-e:1)  const(PVNV("O"\0))
(-e:1)  flip
(-e:1)  const(IV(2))
(-e:1)  flop
(-e:1)  null
(-e:1)  sort
(-e:1)  range
(-e:1)  const(PVNV("O"\0))
(-e:1)  flip
(-e:1)  const(IV(2))
(-e:1)  flop
(-e:1)  null
(-e:1)  sort
(-e:1)  range
(-e:1)  const(PVNV("O"\0))
(-e:1)  flip
(-e:1)  const(IV(2))
(-e:1)  flop
(-e:1)  null
(-e:1)  sort
perl: inline.h:389: Perl_POPMARK: Assertion `(PL_markstack_ptr > PL_markstack) || !"MARK underflow"' failed.
Aborted

$ ./perl -Dx -e '\sort{ 1+$b <=> 1+$a }(O..2);'
     
1    leave LISTOP(0x55dd9714aaa8) ===> [0x0]
     PARENT ===> [0x0]
     TARG = 1
     FLAGS = (VOID,KIDS,PARENS,SLABBED)
     PRIVATE = (REFC)
     REFCNT = 1
     |   
2    +--enter OP(0x55dd9714c920) ===> 3 [nextstate 0x55dd9714aae8]
     |   FLAGS = (VOID,SLABBED,MORESIB)
     |   
3    +--nextstate COP(0x55dd9714aae8) ===> 4 [pushmark 0x55dd9714abc0]
     |   FLAGS = (VOID,SLABBED,MORESIB)
     |   LINE = 1
     |   PACKAGE = "main"
     |   SEQ = 4294967246
     |   
5    +--refgen UNOP(0x55dd9714ab48) ===> 1 [leave 0x55dd9714aaa8]
         FLAGS = (VOID,KIDS,SLABBED)
         PRIVATE = (0x1)
         |   
6        +--null (ex-list) UNOP(0x55dd9714ab80) ===> 5 [refgen 0x55dd9714ab48]
             FLAGS = (LIST,KIDS,REF,MOD,SLABBED)
             |   
4            +--pushmark OP(0x55dd9714abc0) ===> 7 [pushmark 0x55dd9714a730]
             |   FLAGS = (SCALAR,REF,MOD,SLABBED,MORESIB)
             |   
8            +--sort LISTOP(0x55dd9714abf0) ===> 6 [null 0x55dd9714ab80]
                 FLAGS = (LIST,KIDS,REF,MOD,STACKED,SPECIAL,SLABBED)
                 |   
7                +--pushmark OP(0x55dd9714a730) ===> 9 [range 0x55dd9714acd8]
                 |   FLAGS = (SCALAR,SLABBED,MORESIB)
                 |   
10               +--null UNOP(0x55dd9714ac30) ===> 9 [range 0x55dd9714acd8]
                 |   FLAGS = (SCALAR,KIDS,SLABBED,MORESIB)
                 |   PRIVATE = (0x1)
                 |   |   
11               |   +--scope LISTOP(0x55dd9714adc0) ===> [0x0]
                 |       FLAGS = (SCALAR,KIDS,SLABBED)
                 |       |   
12               |       +--null (ex-nextstate) COP(0x55dd9714ae00) ===> 13 [const 0x55dd9714a8f8]
                 |       |   FLAGS = (VOID,SLABBED,MORESIB)
                 |       |   LINE = 1
                 |       |   PACKAGE = "main"
                 |       |   SEQ = 4294967247
                 |       |   
14               |       +--ncmp BINOP(0x55dd9714ae60) ===> 11 [scope 0x55dd9714adc0]
                 |           TARG = 3
                 |           FLAGS = (SCALAR,KIDS,SLABBED)
                 |           PRIVATE = (0x2)
                 |           |   
15               |           +--add BINOP(0x55dd9714a848) ===> 16 [const 0x55dd9714a810]
                 |           |   TARG = 1
                 |           |   FLAGS = (SCALAR,KIDS,SLABBED,MORESIB)
                 |           |   PRIVATE = (0x2)
                 |           |   |   
13               |           |   +--const SVOP(0x55dd9714a8f8) ===> 17 [gv 0x55dd9714a8c0]
                 |           |   |   FLAGS = (SCALAR,SLABBED,MORESIB)
                 |           |   |   OP_SV = IV(1) (0x55dd971410b8)
                 |           |   |   
18               |           |   +--rv2sv UNOP(0x55dd9714a888) ===> 15 [add 0x55dd9714a848]
                 |           |       FLAGS = (SCALAR,KIDS,SLABBED)
                 |           |       PRIVATE = (0x1)
                 |           |       |   
17               |           |       +--gv SVOP(0x55dd9714a8c0) ===> 18 [rv2sv 0x55dd9714a888]
                 |           |           FLAGS = (SCALAR,SLABBED)
                 |           |           GV = main::b (0x55dd971410e8)
                 |           |   
19               |           +--add BINOP(0x55dd9714a760) ===> 14 [ncmp 0x55dd9714ae60]
                 |               TARG = 2
                 |               FLAGS = (SCALAR,KIDS,SLABBED)
                 |               PRIVATE = (0x2)
                 |               |   
16               |               +--const SVOP(0x55dd9714a810) ===> 20 [gv 0x55dd9714a7d8]
                 |               |   FLAGS = (SCALAR,SLABBED,MORESIB)
                 |               |   OP_SV = IV(1) (0x55dd97141118)
                 |               |   
21               |               +--rv2sv UNOP(0x55dd9714a7a0) ===> 19 [add 0x55dd9714a760]
                 |                   FLAGS = (SCALAR,KIDS,SLABBED)
                 |                   PRIVATE = (0x1)
                 |                   |   
20               |                   +--gv SVOP(0x55dd9714a7d8) ===> 21 [rv2sv 0x55dd9714a7a0]
                 |                       FLAGS = (SCALAR,SLABBED)
                 |                       GV = main::a (0x55dd97141148)
                 |   
22               +--null UNOP(0x55dd9714ac68) ===> 8 [sort 0x55dd9714abf0]
                     FLAGS = (LIST,KIDS,PARENS,MOD,SLABBED)
                     PRIVATE = (0x1)
                     |   
23                   +--flop UNOP(0x55dd9714aca0) ===> 22 [null 0x55dd9714ac68]
                         FLAGS = (LIST,KIDS,MOD,SLABBED)
                         PRIVATE = (LINENUM)
                         |   
24                       +--flip UNOP(0x55dd9714ad50) ===> 22 [null 0x55dd9714ac68]
                             TARG = 5
                             FLAGS = (LIST,KIDS,SLABBED)
                             PRIVATE = (LINENUM)
                             |   
9                            +--range LOGOP(0x55dd9714acd8) ===> 25 [const 0x55dd9714ad88]
                                 TARG = 4
                                 FLAGS = (LIST,KIDS,SLABBED)
                                 PRIVATE = (0x1)
                                 OTHER ===> 26 [const 0x55dd9714ad18]
                                 |   
25                               +--const SVOP(0x55dd9714ad88) ===> 24 [flip 0x55dd9714ad50]
                                 |   FLAGS = (SCALAR,SLABBED,MORESIB)
                                 |   PRIVATE = (BARE)
                                 |   OP_SV = PVNV("O"\0) (0x55dd9714aeb8)
                                 |   
26                               +--const SVOP(0x55dd9714ad18) ===> 23 [flop 0x55dd9714aca0]
                                     FLAGS = (SCALAR,SLABBED)
                                     OP_SV = IV(2) (0x55dd9714aed0)

EXECUTING...

perl: inline.h:389: Perl_POPMARK: Assertion `(PL_markstack_ptr > PL_markstack) || !"MARK underflow"' failed.
Aborted

with a literal list:

$ ./perl -Dx -e '\sort{ 1+$b <=> 1+$a }(0,1,2);'
     
1    leave LISTOP(0x556beecd4da8) ===> [0x0]
     PARENT ===> [0x0]
     TARG = 1
     FLAGS = (VOID,KIDS,PARENS,SLABBED)
     PRIVATE = (REFC)
     REFCNT = 1
     |   
2    +--enter OP(0x556beecd4d78) ===> 3 [nextstate 0x556beecd4de8]
     |   FLAGS = (VOID,SLABBED,MORESIB)
     |   
3    +--nextstate COP(0x556beecd4de8) ===> 4 [pushmark 0x556beecd4ec0]
     |   FLAGS = (VOID,SLABBED,MORESIB)
     |   LINE = 1
     |   PACKAGE = "main"
     |   SEQ = 4294967246
     |   
5    +--refgen UNOP(0x556beecd4e48) ===> 1 [leave 0x556beecd4da8]
         FLAGS = (VOID,KIDS,SLABBED)
         PRIVATE = (0x1)
         |   
6        +--null (ex-list) UNOP(0x556beecd4e80) ===> 5 [refgen 0x556beecd4e48]
             FLAGS = (LIST,KIDS,REF,MOD,SLABBED)
             |   
4            +--pushmark OP(0x556beecd4ec0) ===> 7 [pushmark 0x556beecd4980]
             |   FLAGS = (SCALAR,REF,MOD,SLABBED,MORESIB)
             |   
8            +--sort LISTOP(0x556beecd4f60) ===> 5 [refgen 0x556beecd4e48]
                 FLAGS = (LIST,KIDS,REF,MOD,STACKED,SPECIAL,SLABBED)
                 |   
7                +--pushmark OP(0x556beecd4980) ===> 9 [const 0x556beecd4fd8]
                 |   FLAGS = (SCALAR,SLABBED,MORESIB)
                 |   
10               +--null UNOP(0x556beecd4ef0) ===> 11 [const 0x556beecd4b48]
                 |   FLAGS = (SCALAR,KIDS,SLABBED,MORESIB)
                 |   PRIVATE = (0x1)
                 |   |   
12               |   +--scope LISTOP(0x556beecd5010) ===> [0x0]
                 |       FLAGS = (SCALAR,KIDS,SLABBED)
                 |       |   
13               |       +--null (ex-nextstate) COP(0x556beecd5050) ===> 11 [const 0x556beecd4b48]
                 |       |   FLAGS = (VOID,SLABBED,MORESIB)
                 |       |   LINE = 1
                 |       |   PACKAGE = "main"
                 |       |   SEQ = 4294967247
                 |       |   
14               |       +--ncmp BINOP(0x556beecd50b0) ===> [0x0]
                 |           TARG = 3
                 |           FLAGS = (SCALAR,KIDS,SLABBED)
                 |           PRIVATE = (0x2)
                 |           |   
15               |           +--add BINOP(0x556beecd4a98) ===> 16 [const 0x556beecd4a60]
                 |           |   TARG = 1
                 |           |   FLAGS = (SCALAR,KIDS,SLABBED,MORESIB)
                 |           |   PRIVATE = (0x2)
                 |           |   |   
11               |           |   +--const SVOP(0x556beecd4b48) ===> 17 [gvsv 0x556beecd4b10]
                 |           |   |   FLAGS = (SCALAR,SLABBED,MORESIB)
                 |           |   |   OP_SV = IV(1) (0x556beeccb038)
                 |           |   |   
18               |           |   +--null (ex-rv2sv) UNOP(0x556beecd4ad8) ===> 15 [add 0x556beecd4a98]
                 |           |       FLAGS = (SCALAR,KIDS,SLABBED)
                 |           |       PRIVATE = (0x1)
                 |           |       |   
17               |           |       +--gvsv SVOP(0x556beecd4b10) ===> 15 [add 0x556beecd4a98]
                 |           |           FLAGS = (SCALAR,SLABBED)
                 |           |           GV = main::b (0x556beeccb068)
                 |           |   
19               |           +--add BINOP(0x556beecd49b0) ===> 14 [ncmp 0x556beecd50b0]
                 |               TARG = 2
                 |               FLAGS = (SCALAR,KIDS,SLABBED)
                 |               PRIVATE = (0x2)
                 |               |   
16               |               +--const SVOP(0x556beecd4a60) ===> 20 [gvsv 0x556beecd4a28]
                 |               |   FLAGS = (SCALAR,SLABBED,MORESIB)
                 |               |   OP_SV = IV(1) (0x556beeccb098)
                 |               |   
21               |               +--null (ex-rv2sv) UNOP(0x556beecd49f0) ===> 19 [add 0x556beecd49b0]
                 |                   FLAGS = (SCALAR,KIDS,SLABBED)
                 |                   PRIVATE = (0x1)
                 |                   |   
20               |                   +--gvsv SVOP(0x556beecd4a28) ===> 19 [add 0x556beecd49b0]
                 |                       FLAGS = (SCALAR,SLABBED)
                 |                       GV = main::a (0x556beeccb0c8)
                 |   
9                +--const SVOP(0x556beecd4fd8) ===> 22 [const 0x556beecd4fa0]
                 |   FLAGS = (SCALAR,MOD,SLABBED,MORESIB)
                 |   OP_SV = IV(0) (0x556beecd5108)
                 |   
22               +--const SVOP(0x556beecd4fa0) ===> 23 [const 0x556beecd4f28]
                 |   FLAGS = (SCALAR,MOD,SLABBED,MORESIB)
                 |   OP_SV = IV(1) (0x556beecd5120)
                 |   
23               +--const SVOP(0x556beecd4f28) ===> 8 [sort 0x556beecd4f60]
                     FLAGS = (SCALAR,MOD,SLABBED)
                     OP_SV = IV(2) (0x556beecd5138)

EXECUTING...

[bulk88]

I ran into (repro) this SEGV just now. Not sure why, but it is a real bug. It was a WIP branch whose last blead commit is

09a0707
Hide function prototyes from unauthorized callers

TODO: {
    local $::TODO = 'GH 16865';
    fresh_perl('\(sort { 0 } 0, 0 .. "a")', { stderr => 'devnull' });
    is($?, 0, "No assertion failure; GH 16865");
}

SEGV was a write to addr 0x5D5D5D5D5D833258. ]]]]]�2X is the addr in ascii BE notation.

SEGV line was

perl5/pp_hot.c

Line 6094 in 939314c

*++to_sp = newsv;

                    EXTEND_MORTAL(nargs);
                    tmps_basep = PL_tmps_stack + old_base;
                    TAINT_NOT;	/* Each item is independent */
                }


#ifdef PERL_RC_STACK
                from_sp[-1] = NULL;
                SvREFCNT_dec_NN(sv);
                assert(!to_sp[1]);
                *++to_sp = newsv;
                SvREFCNT_inc_simple_void_NN(newsv);
#else
                *++to_sp = newsv; <<<<<<<<<<< HERE
#endif

            }
        } while (--nargs)

.text:00000001800D28E4                 add     r13, 8
.text:00000001800D28E8                 mov     r9d, 80000h
.text:00000001800D28EE                 mov     [r13+0], r14 ////// r13 is 0x5D5D5D5D5D833258

I don't trust this VS GUI popup message. The fault addr is not 0xFFFFFFFFFFFFFFFF but 0x5D5D5D5D5D833258.

Unhandled exception thrown: read access violation.
**to_sp** was 0xFFFFFFFFFFFFFFFF.

000007FE95DB2893 8B 45 00             mov         eax,dword ptr [rbp]  
  6077:                     old_base = tmps_basep - PL_tmps_stack;
000007FE95DB2896 48 C1 FF 03          sar         rdi,3  
  6078:                     SvGETMAGIC(sv);
000007FE95DB289A C1 E8 15             shr         eax,15h  
000007FE95DB289D A8 01                test        al,1  
000007FE95DB289F 74 0B                je          Perl_leave_adjust_stacks+1E8h (07FE95DB28ACh)  
000007FE95DB28A1 48 8B D6             mov         rdx,rsi  
000007FE95DB28A4 48 8B CB             mov         rcx,rbx  
000007FE95DB28A7 E8 D4 15 04 00       call        Perl_mg_get (07FE95DF3E80h)  
  6079:                     sv_setsv_flags(newsv, sv, SV_DO_COW_SVSETSV);
000007FE95DB28AC 41 B9 00 06 00 00    mov         r9d,600h  
000007FE95DB28B2 4C 8B C6             mov         r8,rsi  
000007FE95DB28B5 49 8B D6             mov         rdx,r14  
000007FE95DB28B8 48 8B CB             mov         rcx,rbx  
000007FE95DB28BB E8 4C E9 FA FF       call        Perl_sv_setsv_flags (07FE95D6120Ch)  
  6080:                     /* the mg_get or sv_setsv might have created new temps
  6081:                      * or realloced the tmps stack; regrow and reload */
  6082:                     EXTEND_MORTAL(nargs);
000007FE95DB28C0 48 8B 53 50          mov         rdx,qword ptr [rbx+50h]  
000007FE95DB28C4 49 03 D7             add         rdx,r15  
000007FE95DB28C7 48 3B 53 60          cmp         rdx,qword ptr [rbx+60h]  
000007FE95DB28CB 7C 08                jl          Perl_leave_adjust_stacks+211h (07FE95DB28D5h)  
000007FE95DB28CD 48 8B CB             mov         rcx,rbx  
000007FE95DB28D0 E8 67 3E 06 00       call        Perl_tmps_grow_p (07FE95E1673Ch)  
  6083:                     tmps_basep = PL_tmps_stack + old_base;
000007FE95DB28D5 48 8B 43 48          mov         rax,qword ptr [rbx+48h]  
  6084:                     TAINT_NOT;	/* Each item is independent */
000007FE95DB28D9 C6 83 B1 00 00 00 00 mov         byte ptr [rbx+0B1h],0  
000007FE95DB28E0 48 8D 3C F8          lea         rdi,[rax+rdi*8]  
  6085:                 }
  6086: 
  6087: 
  6088: #ifdef PERL_RC_STACK
  6089:                 from_sp[-1] = NULL;
  6090:                 SvREFCNT_dec_NN(sv);
  6091:                 assert(!to_sp[1]);
  6092:                 *++to_sp = newsv;
  6093:                 SvREFCNT_inc_simple_void_NN(newsv);
  6094: #else
  6095:                 *++to_sp = newsv;
000007FE95DB28E4 49 83 C5 08          add         r13,8  
000007FE95DB28E8 41 B9 00 00 08 00    mov         r9d,80000h  
000007FE95DB28EE 4D 89 75 00          mov         qword ptr [r13],r14  ////// r13 is 0x5D5D5D5D5D833258
000007FE95DB28F2 E9 A0 00 00 00       jmp         Perl_leave_adjust_stacks+2D3h (07FE95DB2997h)  

r14 is SV* newsv @ 0x48f278 which is a very boring SV*. SVt_NULL+mortal flag.

 | Name | Value | Type
-- | -- | -- | --
◢ | (SV*)0x48F278 | 0x000000000048f278 {sv_any=0x0000000000000000 sv_refcnt=0x00000001 sv_flags=0x00080000 ...} | sv *
  | sv_any | 0x0000000000000000 | void *
  | sv_refcnt | 0x00000001 | unsigned long
  | sv_flags | 0x00080000 | unsigned long
  | ▶ sv_u | {svu_pv=0x0000000000000000 <NULL> svu_iv=0x0000000000000000 svu_uv=0x0000000000000000 ...} | <unnamed-tag>

 	perl543.dll!Perl_leave_adjust_stacks(interpreter * my_perl, sv * * from_sp, sv * * to_sp, unsigned char gimme, int pass) Line 6095	C
>	perl543.dll!Perl_pp_leave(interpreter * my_perl) Line 2562	C
 	perl543.dll!Perl_runops_standard(interpreter * my_perl) Line 41	C
 	perl543.dll!S_sortcv(interpreter * my_perl, sv * const a, sv * const b) Line 1194	C
 	[Inline Frame] perl543.dll!dynprep(interpreter *) Line 184	C
 	[Inline Frame] perl543.dll!S_sortsv_flags_impl(interpreter *) Line 354	C
 	perl543.dll!Perl_sortsv_flags(interpreter * my_perl, sv * * base, unsigned __int64 nmemb, long(*)(interpreter *, sv * const, sv * const) cmp, unsigned long flags) Line 552	C
 	perl543.dll!Perl_pp_sort(interpreter * my_perl) Line 974	C
 	perl543.dll!Perl_runops_standard(interpreter * my_perl) Line 41	C
 	perl543.dll!S_sortcv(interpreter * my_perl, sv * const a, sv * const b) Line 1194	C
 	[Inline Frame] perl543.dll!dynprep(interpreter *) Line 184	C
 	[Inline Frame] perl543.dll!S_sortsv_flags_impl(interpreter *) Line 354	C
 	perl543.dll!Perl_sortsv_flags(interpreter * my_perl, sv * * base, unsigned __int64 nmemb, long(*)(interpreter *, sv * const, sv * const) cmp, unsigned long flags) Line 552	C
 	perl543.dll!Perl_pp_sort(interpreter * my_perl) Line 974	C
 	perl543.dll!Perl_runops_standard(interpreter * my_perl) Line 41	C
 	perl543.dll!S_sortcv(interpreter * my_perl, sv * const a, sv * const b) Line 1194	C
 	[Inline Frame] perl543.dll!dynprep(interpreter *) Line 184	C
 	[Inline Frame] perl543.dll!S_sortsv_flags_impl(interpreter *) Line 354	C
 	perl543.dll!Perl_sortsv_flags(interpreter * my_perl, sv * * base, unsigned __int64 nmemb, long(*)(interpreter *, sv * const, sv * const) cmp, unsigned long flags) Line 552	C
 	perl543.dll!Perl_pp_sort(interpreter * my_perl) Line 974	C
 	perl543.dll!Perl_runops_standard(interpreter * my_perl) Line 41	C
 	perl543.dll!S_sortcv(interpreter * my_perl, sv * const a, sv * const b) Line 1194	C
 	[Inline Frame] perl543.dll!dynprep(interpreter *) Line 184	C
 	[Inline Frame] perl543.dll!S_sortsv_flags_impl(interpreter *) Line 354	C
 	perl543.dll!Perl_sortsv_flags(interpreter * my_perl, sv * * base, unsigned __int64 nmemb, long(*)(interpreter *, sv * const, sv * const) cmp, unsigned long flags) Line 552	C
 	perl543.dll!Perl_pp_sort(interpreter * my_perl) Line 974	C
 	perl543.dll!Perl_runops_standard(interpreter * my_perl) Line 41	C
 	perl543.dll!S_run_body(interpreter * my_perl, long oldscope) Line 2886	C
 	perl543.dll!perl_run(interpreter * my_perl) Line 2799	C
 	perl543.dll!RunPerl(int argc, char * * argv, char * * env) Line 236	C++
 	[Inline Frame] perl.exe!invoke_main() Line 78	C++
 	perl.exe!__scrt_common_main_seh() Line 288	C++
 	kernel32.dll!BaseThreadInitThunk�()	Unknown
 	ntdll.dll!RtlUserThreadStart�()	Unknown

PP(pp_leave)
{
    PERL_CONTEXT *cx;
    SV **oldsp;
    U8 gimme;

    cx = CX_CUR();
    assert(CxTYPE(cx) == CXt_BLOCK);

    if (PL_op->op_flags & OPf_SPECIAL)
        /* fake block should preserve $1 et al; e.g.  /(...)/ while ...; */
        cx->blk_oldpm = PL_curpm;

    oldsp = PL_stack_base + cx->blk_oldsp;
    gimme = cx->blk_gimme;

    if (gimme == G_VOID)
        rpp_popfree_to_NN(oldsp);
    else
        leave_adjust_stacks(oldsp, oldsp, gimme,
                                PL_op->op_private & OPpLVALUE ? 3 : 1); <<<<<<<< arg pass is 1 at SEGV point

    CX_LEAVE_SCOPE(cx);
    cx_popblock(cx);
    CX_POP(cx);

    return NORMAL;
}

  | pass | 0x00000001 | int

[bulk88]

◢ | cx | 0x00000000004bef30 {cx_u={cx_blk={blku_type=0xab '«' blku_gimme=0xab '«' blku_u16=0xabab ...} cx_subst=...} } | context *
  | ◢ cx_u | {cx_blk={blku_type=0xab '«' blku_gimme=0xab '«' blku_u16=0xabab ...} cx_subst={sbu_type=0xab '«' sbu_rflags=...} } | context::<unnamed-type-cx_u>
  | ▶ cx_blk | {blku_type=0xab '«' blku_gimme=0xab '«' blku_u16=0xabab ...} | block
  | ▶ cx_subst | {sbu_type=0xab '«' sbu_rflags=0xab '«' sbu_rxtainted=0xabab ...} | subst

0xabab,abab,abab,abab

0xabababab
32 bit: 0xabababab
64 bit: 0xabababab

The 0xabababab bit pattern is the bit pattern for the guard block after the memory is allocated using HeapAlloc(), LocalAlloc(LMEM_FIXED), GlobalAlloc(GMEM_FIXED) or CoTaskMemAlloc(). The guard region seems to be a minimum of 4 bytes, but can be much larger (I suspect it ends when the size of the allocated block plus the guard block reaches a particular size).

If you are seeing the 0xabababab bit pattern it means that you are reading memory after a memory block that has been allocated by HeapAlloc(), LocalAlloc(LMEM_FIXED), GlobalAlloc(GMEM_FIXED) or CoTaskMemAlloc().

0x00000000004BE7A8  006c006900460020   .F.i.l.
0x00000000004BE7B0  004d005c00730065  e.s.\.M.
0x00000000004BE7B8  006f007200630069  i.c.r.o.
0x00000000004BE7C0  00740066006f0073  s.o.f.t.
0x00000000004BE7C8  0073006900560020   .V.i.s.
0x00000000004BE7D0  0020006c00610075  u.a.l. .
0x00000000004BE7D8  0064007500740053  S.t.u.d.
0x00000000004BE7E0  0032005c006f0069  i.o.\.2.
0x00000000004BE7E8  005c003200320030  0.2.2.\.
0x00000000004BE7F0  006d006d006f0043  C.o.m.m.
0x00000000004BE7F8  00740069006e0075  u.n.i.t.
0x00000000004BE800  006f0043005c0079  y.\.C.o.
0x00000000004BE808  0800c9a87855187b  {.Ux¨É.. <<<< HeapAlloc header
0x00000000004BE810  00000000004bc960  `ÉK..... <<< WinPerl LL mem tracker
0x00000000004BE818  00000000004b5cf0  ð\K..... <<< WinPerl LL mem tracker
0x00000000004BE820  00000000004679f8  øyF..... <<< my_perl equivelent from WinPerl LL mem tracker
0x00000000004BE828  00000031abab0200  ..««1...
0x00000000004BE830  0000000000000000  ........
0x00000000004BE838  00000000004b4e68  hNK.....
0x00000000004BE840  0000000000000000  ........        
0x00000000004BE848  0000000000000001  ........
0x00000000004BE850  ffffffff00000004  ....ÿÿÿÿ
0x00000000004BE858  abababababababab  ««««««««
0x00000000004BE860  abababababababab  ««««««««
0x00000000004BE868  abababababababab  ««««««««
0x00000000004BE870  abababababababab  ««««««««
0x00000000004BE878  abababababababab  ««««««««
0x00000000004BE880  abababababababab  ««««««««
0x00000000004BE888  abababababababab  ««««««««
0x00000000004BE890  abababababababab  ««««««««
0x00000000004BE898  abababababababab  ««««««««
0x00000000004BE8A0  abababababababab  ««««««««
0x00000000004BE8A8  abababababababab  ««««««««
0x00000000004BE8B0  abababababababab  ««««««««
0x00000000004BE8B8  abababababababab  ««««««««
0x00000000004BE8C0  abababababababab  ««««««««
0x00000000004BE8C8  abababababababab  ««««««««
0x00000000004BE8D0  abababababababab  ««««««««
0x00000000004BE8D8  abababababababab  ««««««««
0x00000000004BE8E0  abababababababab  ««««««««
0x00000000004BE8E8  abababababababab  ««««««««
0x00000000004BE8F0  abababababababab  ««««««««
0x00000000004BE8F8  abababababababab  ««««««««
0x00000000004BE900  abababababababab  ««««««««
0x00000000004BE908  abababababababab  ««««««««
0x00000000004BE910  abababababababab  ««««««««
0x00000000004BE918  abababababababab  ««««««««
0x00000000004BE920  abababababababab  ««««««««
0x00000000004BE928  abababababababab  ««««««««
0x00000000004BE930  abababababababab  ««««««««
0x00000000004BE938  abababababababab  ««««««««
0x00000000004BE940  abababababababab  ««««««««
0x00000000004BE948  abababababababab  ««««««««
0x00000000004BE950  abababababababab  ««««««««
0x00000000004BE958  abababababababab  ««««««««
0x00000000004BE960  abababababababab  ««««««««
0x00000000004BE968  abababababababab  ««««««««
0x00000000004BE970  abababababababab  ««««««««
0x00000000004BE978  abababababababab  ««««««««
0x00000000004BE980  abababababababab  ««««««««
0x00000000004BE988  abababababababab  ««««««««
0x00000000004BE990  abababababababab  ««««««««
0x00000000004BE998  abababababababab  ««««««««
0x00000000004BE9A0  abababababababab  ««««««««
0x00000000004BE9A8  abababababababab  ««««««««
0x00000000004BE9B0  abababababababab  ««««««««
0x00000000004BE9B8  abababababababab  ««««««««
0x00000000004BE9C0  abababababababab  ««««««««
0x00000000004BE9C8  abababababababab  ««««««««
0x00000000004BE9D0  abababababababab  ««««««««
0x00000000004BE9D8  abababababababab  ««««««««
0x00000000004BE9E0  abababababababab  ««««««««
0x00000000004BE9E8  abababababababab  ««««««««
0x00000000004BE9F0  abababababababab  ««««««««
0x00000000004BE9F8  abababababababab  ««««««««
0x00000000004BEA00  abababababababab  ««««««««
0x00000000004BEA08  abababababababab  ««««««««
0x00000000004BEA10  abababababababab  ««««««««
0x00000000004BEA18  abababababababab  ««««««««
0x00000000004BEA20  abababababababab  ««««««««
0x00000000004BEA28  abababababababab  ««««««««
0x00000000004BEA30  abababababababab  ««««««««
0x00000000004BEA38  abababababababab  ««««««««
0x00000000004BEA40  abababababababab  ««««««««
0x00000000004BEA48  abababababababab  ««««««««
0x00000000004BEA50  abababababababab  ««««««««
0x00000000004BEA58  abababababababab  ««««««««
0x00000000004BEA60  abababababababab  ««««««««
0x00000000004BEA68  abababababababab  ««««««««
0x00000000004BEA70  abababababababab  ««««««««
0x00000000004BEA78  abababababababab  ««««««««
0x00000000004BEA80  abababababababab  ««««««««
0x00000000004BEA88  abababababababab  ««««««««
0x00000000004BEA90  abababababababab  ««««««««
0x00000000004BEA98  abababababababab  ««««««««
0x00000000004BEAA0  abababababababab  ««««««««
0x00000000004BEAA8  abababababababab  ««««««««
0x00000000004BEAB0  abababababababab  ««««««««
0x00000000004BEAB8  abababababababab  ««««««««
0x00000000004BEAC0  abababababababab  ««««««««
0x00000000004BEAC8  abababababababab  ««««««««
0x00000000004BEAD0  abababababababab  ««««««««
0x00000000004BEAD8  abababababababab  ««««««««
0x00000000004BEAE0  abababababababab  ««««««««
0x00000000004BEAE8  abababababababab  ««««««««
0x00000000004BEAF0  abababababababab  ««««««««
0x00000000004BEAF8  abababababababab  ««««««««
0x00000000004BEB00  abababababababab  ««««««««
0x00000000004BEB08  abababababababab  ««««««««
0x00000000004BEB10  abababababababab  ««««««««
0x00000000004BEB18  abababababababab  ««««««««
0x00000000004BEB20  abababababababab  ««««««««
0x00000000004BEB28  abababababababab  ««««««««
0x00000000004BEB30  abababababababab  ««««««««
0x00000000004BEB38  abababababababab  ««««««««
0x00000000004BEB40  abababababababab  ««««««««
0x00000000004BEB48  abababababababab  ««««««««
0x00000000004BEB50  abababababababab  ««««««««
0x00000000004BEB58  abababababababab  ««««««««
0x00000000004BEB60  abababababababab  ««««««««
0x00000000004BEB68  abababababababab  ««««««««
0x00000000004BEB70  abababababababab  ««««««««
0x00000000004BEB78  abababababababab  ««««««««
0x00000000004BEB80  abababababababab  ««««««««
0x00000000004BEB88  abababababababab  ««««««««
0x00000000004BEB90  abababababababab  ««««««««
0x00000000004BEB98  abababababababab  ««««««««
0x00000000004BEBA0  abababababababab  ««««««««
0x00000000004BEBA8  abababababababab  ««««««««
0x00000000004BEBB0  abababababababab  ««««««««
0x00000000004BEBB8  abababababababab  ««««««««
0x00000000004BEBC0  abababababababab  ««««««««
0x00000000004BEBC8  abababababababab  ««««««««
0x00000000004BEBD0  abababababababab  ««««««««
0x00000000004BEBD8  abababababababab  ««««««««
0x00000000004BEBE0  abababababababab  ««««««««
0x00000000004BEBE8  abababababababab  ««««««««
0x00000000004BEBF0  abababababababab  ««««««««
0x00000000004BEBF8  abababababababab  ««««««««
0x00000000004BEC00  abababababababab  ««««««««
0x00000000004BEC08  abababababababab  ««««««««
0x00000000004BEC10  abababababababab  ««««««««
0x00000000004BEC18  abababababababab  ««««««««
0x00000000004BEC20  abababababababab  ««««««««
0x00000000004BEC28  abababababababab  ««««««««
0x00000000004BEC30  abababababababab  ««««««««
0x00000000004BEC38  abababababababab  ««««««««
0x00000000004BEC40  abababababababab  ««««««««
0x00000000004BEC48  abababababababab  ««««««««
0x00000000004BEC50  abababababababab  ««««««««
0x00000000004BEC58  abababababababab  ««««««««
0x00000000004BEC60  abababababababab  ««««««««
0x00000000004BEC68  abababababababab  ««««««««
0x00000000004BEC70  abababababababab  ««««««««
0x00000000004BEC78  abababababababab  ««««««««
0x00000000004BEC80  abababababababab  ««««««««
0x00000000004BEC88  abababababababab  ««««««««
0x00000000004BEC90  abababababababab  ««««««««
0x00000000004BEC98  abababababababab  ««««««««
0x00000000004BECA0  abababababababab  ««««««««
0x00000000004BECA8  abababababababab  ««««««««
0x00000000004BECB0  abababababababab  ««««««««
0x00000000004BECB8  abababababababab  ««««««««
0x00000000004BECC0  abababababababab  ««««««««
0x00000000004BECC8  abababababababab  ««««««««
0x00000000004BECD0  abababababababab  ««««««««
0x00000000004BECD8  abababababababab  ««««««««
0x00000000004BECE0  abababababababab  ««««««««
0x00000000004BECE8  abababababababab  ««««««««
0x00000000004BECF0  abababababababab  ««««««««
0x00000000004BECF8  abababababababab  ««««««««
0x00000000004BED00  abababababababab  ««««««««
0x00000000004BED08  abababababababab  ««««««««
0x00000000004BED10  abababababababab  ««««««««
0x00000000004BED18  abababababababab  ««««««««
0x00000000004BED20  abababababababab  ««««««««
0x00000000004BED28  abababababababab  ««««««««
0x00000000004BED30  abababababababab  ««««««««
0x00000000004BED38  abababababababab  ««««««««
0x00000000004BED40  abababababababab  ««««««««
0x00000000004BED48  abababababababab  ««««««««
0x00000000004BED50  abababababababab  ««««««««
0x00000000004BED58  abababababababab  ««««««««
0x00000000004BED60  abababababababab  ««««««««
0x00000000004BED68  abababababababab  ««««««««
0x00000000004BED70  abababababababab  ««««««««
0x00000000004BED78  abababababababab  ««««««««
0x00000000004BED80  abababababababab  ««««««««
0x00000000004BED88  abababababababab  ««««««««
0x00000000004BED90  abababababababab  ««««««««
0x00000000004BED98  abababababababab  ««««««««
0x00000000004BEDA0  abababababababab  ««««««««
0x00000000004BEDA8  abababababababab  ««««««««
0x00000000004BEDB0  abababababababab  ««««««««
0x00000000004BEDB8  abababababababab  ««««««««
0x00000000004BEDC0  abababababababab  ««««««««
0x00000000004BEDC8  abababababababab  ««««««««
0x00000000004BEDD0  abababababababab  ««««««««
0x00000000004BEDD8  abababababababab  ««««««««
0x00000000004BEDE0  abababababababab  ««««««««
0x00000000004BEDE8  abababababababab  ««««««««
0x00000000004BEDF0  abababababababab  ««««««««
0x00000000004BEDF8  abababababababab  ««««««««
0x00000000004BEE00  abababababababab  ««««««««
0x00000000004BEE08  abababababababab  ««««««««
0x00000000004BEE10  abababababababab  ««««««««
0x00000000004BEE18  abababababababab  ««««««««
0x00000000004BEE20  abababababababab  ««««««««
0x00000000004BEE28  abababababababab  ««««««««
0x00000000004BEE30  abababababababab  ««««««««
0x00000000004BEE38  abababababababab  ««««««««
0x00000000004BEE40  abababababababab  ««««««««
0x00000000004BEE48  abababababababab  ««««««««
0x00000000004BEE50  abababababababab  ««««««««
0x00000000004BEE58  abababababababab  ««««««««
0x00000000004BEE60  abababababababab  ««««««««
0x00000000004BEE68  abababababababab  ««««««««
0x00000000004BEE70  abababababababab  ««««««««
0x00000000004BEE78  abababababababab  ««««««««
0x00000000004BEE80  abababababababab  ««««««««
0x00000000004BEE88  abababababababab  ««««««««
0x00000000004BEE90  abababababababab  ««««««««
0x00000000004BEE98  abababababababab  ««««««««
0x00000000004BEEA0  abababababababab  ««««««««
0x00000000004BEEA8  abababababababab  ««««««««
0x00000000004BEEB0  abababababababab  ««««««««
0x00000000004BEEB8  abababababababab  ««««««««
0x00000000004BEEC0  abababababababab  ««««««««
0x00000000004BEEC8  abababababababab  ««««««««
0x00000000004BEED0  abababababababab  ««««««««
0x00000000004BEED8  abababababababab  ««««««««
0x00000000004BEEE0  abababababababab  ««««««««
0x00000000004BEEE8  abababababababab  ««««««««
0x00000000004BEEF0  abababababababab  ««««««««
0x00000000004BEEF8  abababababababab  ««««««««
0x00000000004BEF00  abababababababab  ««««««««
0x00000000004BEF08  abababababababab  ««««««««
0x00000000004BEF10  abababababababab  ««««««««
0x00000000004BEF18  abababababababab  ««««««««
0x00000000004BEF20  abababababababab  ««««««««
0x00000000004BEF28  abababababababab  ««««««««
0x00000000004BEF30  abababababababab  ««««««««   <<<<<<< addr inside variable context * cx;
0x00000000004BEF38  abababababababab  ««««««««
0x00000000004BEF40  abababababababab  ««««««««
0x00000000004BEF48  abababababababab  ««««««««
0x00000000004BEF50  abababababababab  ««««««««
0x00000000004BEF58  abababababababab  ««««««««
0x00000000004BEF60  abababababababab  ««««««««
0x00000000004BEF68  abababababababab  ««««««««
0x00000000004BEF70  abababababababab  ««««««««
0x00000000004BEF78  0800cbdf7855187b  {.UxßË..   <<<<<< HeapAlloc header
0x00000000004BEF80  00000000004b5cf0  ð\K.....  <<< threaded WinPerl LL
0x00000000004BEF88  0000000002070040  @....... <<< threaded WinPerl LL
0x00000000004BEF90  00000000004679f8  øyF.....  <<< my_perl equivalent from WinPerl's  3 x void* LL mem tracker

perl5/win32/vmem.h

Line 123 in 939314c

VMem *owner;

(const IPerlMem * *) my_perl->IMem |is 0x00000000004679b0

0x00000000004BEF98  00000048abab0200  ..««H... <<< (context *)my_perl->Icurstackinfo->si_cxstack is 0x00000000004bef98 

(stackinfo *)my_perl->Icurstackinfo is 0x00000000004b5d08
BE notation U64 0x000,00048,abab,0200 looks funny, what is the U16 value 0xabab doing here???
my_perl->Icurstackinfo->si_cxstack->cx_u.cx_blk.blku_u16 | 0xabab | unsigned short

0x00000000004BEFA0  0000000000000000  ........
0x00000000004BEFA8  00000000004b4e68  hNK.....
0x00000000004BEFB0  0000000000000000  ........
0x00000000004BEFB8  0000000000000002  ........
0x00000000004BEFC0  fffffffe00000005  ....þÿÿÿ
0x00000000004BEFC8  abababababababab  ««««««««

[bulk88]

0xabababab
32 bit: 0xabababab
64 bit: 0xabababab
The 0xabababab bit pattern is the bit pattern for the guard block after the memory is allocated using HeapAlloc(), LocalAlloc(LMEM_FIXED), GlobalAlloc(GMEM_FIXED) or CoTaskMemAlloc(). The guard region seems to be a minimum of 4 bytes, but can be much larger (I suspect it ends when the size of the allocated block plus the guard block reaches a particular size).
If you are seeing the 0xabababab bit pattern it means that you are reading memory after a memory block that has been allocated by HeapAlloc(), LocalAlloc(LMEM_FIXED), GlobalAlloc(GMEM_FIXED) or CoTaskMemAlloc().

Wrong, its a no -DDEBUGGIING Perl pattern not MS.

perl5/scope.c

Line 119 in 93fbcb7

PoisonNew(cxstack + old_max + 1, new_max - old_max, PERL_CONTEXT);