Yes, this is certainly a bug. Here is what's happening:
Update: This diagnosis is mistaken — see below.
- The way $foo++ is implemented is that the value of $foo is copied to a temporary SV (the op's targ), the original value is then incremented; and finally the top element of the stack is pointed at the targ.
- In this example, the second time FETCH is called, the targ gets overwritten with the new value. But there's already a pointer to it on the stack.
I guess one solution would be to use a temporary mortal instead of the targ.