Attempt to free unreferenced scalar (in 49 lines)

[p5pRT]

Migrated from rt.perl.org#1176 (status was 'resolved')

Searchable as RT1176$

[p5pRT]

From @nwc10

I've got this as short as possible. On Solaris the script attached causes

Attempt to free unreferenced scalar at crashit line 29\, \ chunk 3.

for perl5.00502\, or a coredump on 5.00503\, 5.00557\, 5.00558 and 5.00560. (gcc compiled)\, and 3 "attempt to free unreferenced scalar"s on 5.00560 (Sun CC v5\, 64 bit)

The coredump is in scope.c S_save_scalar_at called from Perl_save_aelem

at the line

SvMAGIC(sv) = SvMAGIC(osv);

which is because osv is an SV

{sv_any = 0x17ae78\, sv_refcnt = 2\, sv_flags = 255}

and has garbage in the xmg_magic pointer (0x200) which SEGVs when deferenced

I've used a watchpoint to track what happened to this SV at osv\, and last thing that's happened to it is that it's been freed at

#0 0xc3a90 in Perl_sv_free (sv=0x17ae60) at sv.c​:3170 #1 0xa7280 in Perl_av_clear (av=0x188350) at av.c​:352 #2 0xb5bc4 in Perl_pp_entersub () at pp_hot.c​:2377 #3 0xa995c in Perl_runops_debug () at run.c​:57 #4 0x295cc in S_run_body (args=0xffbefb60) at perl.c​:1070 #5 0xec9dc in Perl_vdefault_protect (excpt=0xffbefb78\,   body=0x29364 \<S_run_body>\, args=0xffbefaf8) at scope.c​:44 #6 0xec8e8 in Perl_default_protect (excpt=0xffbefb78\,   body=0x29364 \<S_run_body>) at scope.c​:25 #7 0x29024 in perl_run (my_perl=0x16e008) at perl.c​:1003 #8 0x26600 in main (argc=3\, argv=0xffbefc6c\, env=0xffbefc7c)   at miniperlmain.c​:53

The script is a paired down HTML (plus other stuff) parser\, and the bug goes away if I comment out two or more of the local statements.

I can probably work around the problem\, but it would be nice to blat the bug. IIRC getting shot of the the "Attempt to free unreferenced scalar" bug(s) is tricky because they are very hard to tie down.

I've just tried the script on BSDI and doesn't crash. Hmm. Maybe it's Solaris specific.

Nicholas Clark ------------------------------------------------------------------------------ #!/home/nick/perldev/bin/perl -w use strict;

sub tag {   # OK\, when we leave this scope we restore all these nesting things   local $_[3];   local $_[4];   local $_[5];   # Doing this as $_[1] to affect its pos()   $_[1] =~ m!\G(\!?\w+) # The tag itself   !gxc;  
  my ($argtext) = tag_args (\&tag_args\, @​_[1..5]\, ''); }

# input ($coderef\,$text\,$inpre\,$ifnest\,$varnest\,$tagnest) # return ($text\, $tag) sub tag_args {   while ($_[1] =~ m!([\<>]?)!gxc) {   return if ($1 eq '>')   } }

# input ($coderef\,$text\,$inpre\,$ifnest\,$varnest\,$tagnest\,$coderef) # return ($text\, $tag) sub parse_html {   while (pos ($_[1]) \< length $_[1]) {   if ($_[1] =~ /\G\</gc) {   # tag   my ($opentag\, $tag_type) = tag (\&parse_html\, @​_[1..$#_]);   } elsif ($_[1] =~ /\G([^\<]+)/gc) {   }   }   return ''; }

while (\) {   my $input = $_;   pos ($input) = 0;   my ($inpre\, $ifnest\, $varnest\, $tagnest);   () = parse_html (undef\, $input\, $inpre\, $ifnest\, $varnest\,$tagnest); }

__DATA__ \ \ \