I hacked the thread-id into deb.c/Perl_vdeb() so that perl -Dt also prints thread-id. The crashes seem to occur when one thread does a POPBLOCK/LEAVE as a sort finishes inside the for(). I further noticed that when I change:

      for my $k (sort mycmp @list) {}
[download]

to simply:

      sort mycmp @list;
[download]

the crashes go away. Edited perl -Dtlsv output follows:

4440: (p5-5A.pl:7)    gvsv(main::a)
4440: (p5-5A.pl:7)    length
4440: (p5-5A.pl:7)    ncmp
4440: (p5-5A.pl:7)    leavesub
4440: (p5-5A.pl:7)    nextstate
4440: (p5-5A.pl:7)    gvsv(main::b)
4440: (p5-5A.pl:7)    length
4440: (p5-5A.pl:7)    gvsv(main::a)
4440: (p5-5A.pl:7)    length
9432: (p5-5A.pl:7)    length
9432: (p5-5A.pl:7)    ncmp
9432: (p5-5A.pl:7)    leavesub
9432: (p5-5A.pl:7)    nextstate
9432: (p5-5A.pl:7)    gvsv(main::b)
9432: (p5-5A.pl:7)    length
9432: (p5-5A.pl:7)    gvsv(main::a)
9432: (p5-5A.pl:7)    length
9432: (p5-5A.pl:7)    ncmp
4440: (p5-5A.pl:7)    ncmp
4440: (p5-5A.pl:7)    leavesub
4440: (p5-5A.pl:7)    nextstate
4440: (p5-5A.pl:7)    gvsv(main::b)
4440: (p5-5A.pl:7)    length
4440: (p5-5A.pl:7)    gvsv(main::a)
4440: (p5-5A.pl:7)    length
4440: (p5-5A.pl:7)    ncmp

*** tid=4440 crashed around here ***

9432: (p5-5A.pl:7)    leavesub
9432: (p5-5A.pl:19)    POPBLOCK scope 7 at ..\pp_sort.c:1579
9432: (p5-5A.pl:19)    LEAVE scope 7 at ..\pp_sort.c:1627
9432: (p5-5A.pl:19)    enteriter
9432: (p5-5A.pl:19)    ENTER scope 7 at ..\pp_ctl.c:1666
9432: (p5-5A.pl:19)    ENTER scope 8 at ..\pp_ctl.c:1697
9432: (p5-5A.pl:19)    iter
9432: (p5-5A.pl:19)    and
(tid=9432 continues on)
[download]