p5pRT
commented
23 years ago From @jhi
Trying to add a couple of tests to op/pat unearthed a nasty bug that has been there at least since bleadperl@8531 (the oldest snapshot I had around)\, and it is also in 5.6.1-T2 :-( It is not in 5.7.0.
Here's a script that tickles the bug in Alpha (thanks for Inaba Hiroto for helping me out in cutting down the pat.t)
reset; if (0) { if ("" =~ //) { } }
and here's a script that tickles the bug in x86 Linux
$ENV{BAR} = 0; reset; if (0) { if ("" =~ //) { } }
Want mystery? Change the if (0) to if (1) and the corruption seems to go away. This makes the bug smell like a compile time problem\, and Third Degree log (shown soon) says the same.
Since the bug seems to be some sort of a memory corruption (accessing already freed memory on)\, it is unlikely to show the same symptoms everywhere. If you use debugging\, the problem might go away. Trying to cut down the script proved to be a rather elusive sport. Just in case my Linux is different from your Linux\, here's the script that "worked" for Inaba Hiroto:
$ENV{BAR} = 0; reset; if (0) { if ("\x00" !~ /[0]/) { #foobarbazfoobarbaz } }
Here's the stack trace for Alpha Tru64 (x86 Linux shows the same stack trace):
GDB is free software and you are welcome to distribute copies of it under certain conditions; type "show copying" to see the conditions. There is absolutely no warranty for GDB; type "show warranty" for details. GDB 4.16 (alpha-dec-osf4.0)\, Copyright 1996 Free Software Foundation\, Inc... Core was generated by `perl'. Program terminated with signal 11\, Segmentation fault. Reading symbols from /tmp/jhi/perl/libperl.so...done. Reading symbols from /usr/shlib/libm.so...done. Reading symbols from /usr/shlib/libiconv.so...done. Reading symbols from /usr/shlib/libc.so...done. Reading symbols from /usr/lib/nls/loc//fi_FI.ISO8859-1...done. #0 Perl_sv_reset (s=0x3ffffff1d40 ""\, stash=0x1400024b0) at sv.c:5797 5797 pm->op_pmdynflags &= ~PMdf_USED; (gdb) where #0 Perl_sv_reset (s=0x3ffffff1d40 ""\, stash=0x1400024b0) at sv.c:5797 #1 0x3ffbffac378 in Perl_pp_reset () at pp_ctl.c:1715 #2 0x3ffbff607c0 in Perl_runops_debug () at run.c:53 #3 0x3ffbfeeb084 in S_run_body (oldscope=1) at perl.c:1458 #4 0x3ffbfeead14 in perl_run (my_perl=0x140002280) at perl.c:1380 #5 0x120001f44 in main (argc=2\, argv=0x11ffff448\, env=0x11ffff460) at perlmain.c:52 (gdb) p *pm Cannot access memory at address 0x2. (gdb) list 5792 if (!stash) 5793 return; 5794 5795 if (!*s) { /* reset ?? searches */ 5796 for (pm = HvPMROOT(stash); pm; pm = pm->op_pmnext) { 5797 pm->op_pmdynflags &= ~PMdf_USED; 5798 } 5799 return; 5800 } 5801 (gdb)
Here's are the suspicious looking Third Degree log entries from running the script show to "work" for Alpha. It seems that something frees the PMOP but sv_reset() expects ito be there\, KABOOM ensues.
---------------------------------------------------------------- rih -- 8 -- sv.c: 5797: reading invalid heap at byte 92 of 96-byte block Perl_sv_reset libperl.so\, sv.c\, line 5797 Perl_pp_reset libperl.so\, pp_ctl.c\, line 1715 Perl_runops_debug libperl.so\, run.c\, line 53 S_run_body libperl.so\, perl.c\, line 1458 perl_run libperl.so\, perl.c\, line 1380 main perl\, perlmain.c\, line 52 __start perl
This block at address 0x1400279f0 was allocated at: malloc libc.so Perl_safemalloc libperl.so\, util.c\, line 87 Perl_newPMOP libperl.so\, op.c\, line 2905 S_scan_pat libperl.so\, toke.c\, line 6160 Perl_yylex libperl.so\, toke.c\, line 3594 Perl_yyparse libperl.so\, perly.c\, line 1432 S_parse_body libperl.so\, perl.c\, line 1304 perl_parse libperl.so\, perl.c\, line 886 main perl\, perlmain.c\, line 50 __start perl
This block was freed at: free libc.so Perl_safefree libperl.so\, util.c\, line 160 Perl_op_free libperl.so\, op.c\, line 758 Perl_op_free libperl.so\, op.c\, line 739 Perl_op_free libperl.so\, op.c\, line 739 Perl_op_free libperl.so\, op.c\, line 739 S_new_logop libperl.so\, op.c\, line 3673 Perl_newLOGOP libperl.so\, op.c\, line 3634 Perl_newCONDOP libperl.so\, op.c\, line 3756 Perl_yyparse libperl.so\, perly.c\, line 1563 S_parse_body libperl.so\, perl.c\, line 1304 perl_parse libperl.so\, perl.c\, line 886 main perl\, perlmain.c\, line 50 __start perl
---------------------------------------------------------------- rih -- 9 -- sv.c: 5796: reading invalid heap at byte 72 of 96-byte block Perl_sv_reset libperl.so\, sv.c\, line 5796 Perl_pp_reset libperl.so\, pp_ctl.c\, line 1715 Perl_runops_debug libperl.so\, run.c\, line 53 S_run_body libperl.so\, perl.c\, line 1458 perl_run libperl.so\, perl.c\, line 1380 main perl\, perlmain.c\, line 52 __start perl
This block at address 0x1400279f0 was allocated at: malloc libc.so Perl_safemalloc libperl.so\, util.c\, line 87 Perl_newPMOP libperl.so\, op.c\, line 2905 S_scan_pat libperl.so\, toke.c\, line 6160 Perl_yylex libperl.so\, toke.c\, line 3594 Perl_yyparse libperl.so\, perly.c\, line 1432 S_parse_body libperl.so\, perl.c\, line 1304 perl_parse libperl.so\, perl.c\, line 886 main perl\, perlmain.c\, line 50 __start perl
This block was freed at: free libc.so Perl_safefree libperl.so\, util.c\, line 160 Perl_op_free libperl.so\, op.c\, line 758 Perl_op_free libperl.so\, op.c\, line 739 Perl_op_free libperl.so\, op.c\, line 739 Perl_op_free libperl.so\, op.c\, line 739 S_new_logop libperl.so\, op.c\, line 3673 Perl_newLOGOP libperl.so\, op.c\, line 3634 Perl_newCONDOP libperl.so\, op.c\, line 3756 Perl_yyparse libperl.so\, perly.c\, line 1563 S_parse_body libperl.so\, perl.c\, line 1304 perl_parse libperl.so\, perl.c\, line 886 main perl\, perlmain.c\, line 50 __start perl
Migrated from rt.perl.org#5935 (status was 'resolved')
Searchable as RT5935$