Bigrat segfaults on irrational numbers

[p5pRT]

Migrated from rt.perl.org#73534 (status was 'resolved')

Searchable as RT73534$

[p5pRT]

From david@porkrind.org

Created by david@porkrind.org

$ perl -Mbigrat -e 'sqrt(2)'
Segmentation fault

This happens on 64 bit linux (debian) and Mac OS X (Snow Leopard). Both are
running the perl that came with the system. I also tested with the git
version of perl 5.11 on Mac OS X in Dec. 2009 and it had the same bug. I
have not tested on perlblead since then.

Perl Info

Flags:
    category=library
    severity=high
    module=bigrat

Site configuration information for perl 5.10.1:

Configured by Debian Project at Sun Feb  7 13:06:31 UTC 2010.

Summary of my perl5 (revision 5 version 10 subversion 1) configuration:
   
  Platform:
    osname=linux, osvers=2.6.32-trunk-amd64, archname=x86_64-linux-gnu-thread-multi
    uname='linux madeleine 2.6.32-trunk-amd64 #1 smp sun jan 10 22:40:40 utc 2010 x86_64 gnulinux '
    config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN -Dcccdlflags=-fPIC -Darchname=x86_64-linux-gnu -Dprefix=/usr -Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/lib/perl/5.10 -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5 -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl/5.10.1 -Dsitearch=/usr/local/lib/perl/5.10.1 -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio -Uusenm -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib -Dlibperl=libperl.so.5.10.1 -Dd_dosuid -des'
    hint=recommended, useposix=true, d_sigaction=define
    useithreads=define, usemultiplicity=define
    useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
    use64bitint=define, use64bitall=define, uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
    optimize='-O2 -g',
    cppflags='-D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include'
    ccversion='', gccversion='4.4.3', gccosandvers=''
    intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
    ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
    alignbytes=8, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -fstack-protector -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib /lib64 /usr/lib64
    libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt
    perllibs=-ldl -lm -lpthread -lc -lcrypt
    libc=/lib/libc-2.10.2.so, so=so, useshrplib=true, libperl=libperl.so.5.10.1
    gnulibc_version='2.10.2'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
    cccdlflags='-fPIC', lddlflags='-shared -O2 -g -L/usr/local/lib -fstack-protector'

Locally applied patches:
    DEBPKG:debian/arm_thread_stress_timeout - http://bugs.debian.org/501970 Raise the timeout of ext/threads/shared/t/stress.t to accommodate slower build hosts
    DEBPKG:debian/cpan_config_path - Set location of CPAN::Config to /etc/perl as /usr may not be writable.
    DEBPKG:debian/cpan_definstalldirs - Provide a sensible INSTALLDIRS default for modules installed from CPAN.
    DEBPKG:debian/db_file_ver - http://bugs.debian.org/340047 Remove overly restrictive DB_File version check.
    DEBPKG:debian/doc_info - Replace generic man(1) instructions with Debian-specific information.
    DEBPKG:debian/enc2xs_inc - http://bugs.debian.org/290336 Tweak enc2xs to follow symlinks and ignore missing @INC directories.
    DEBPKG:debian/errno_ver - http://bugs.debian.org/343351 Remove Errno version check due to upgrade problems with long-running processes.
    DEBPKG:debian/extutils_hacks - Various debian-specific ExtUtils changes
    DEBPKG:debian/fakeroot - Postpone LD_LIBRARY_PATH evaluation to the binary targets.
    DEBPKG:debian/instmodsh_doc - Debian policy doesn't install .packlist files for core or vendor.
    DEBPKG:debian/ld_run_path - Remove standard libs from LD_RUN_PATH as per Debian policy.
    DEBPKG:debian/libnet_config_path - Set location of libnet.cfg to /etc/perl/Net as /usr may not be writable.
    DEBPKG:debian/m68k_thread_stress - http://bugs.debian.org/495826 Disable some threads tests on m68k for now due to missing TLS.
    DEBPKG:debian/mod_paths - Tweak @INC ordering for Debian
    DEBPKG:debian/module_build_man_extensions - http://bugs.debian.org/479460 Adjust Module::Build manual page extensions for the Debian Perl policy
    DEBPKG:debian/perl_synopsis - http://bugs.debian.org/278323 Rearrange perl.pod
    DEBPKG:debian/prune_libs - http://bugs.debian.org/128355 Prune the list of libraries wanted to what we actually need.
    DEBPKG:debian/use_gdbm - Explicitly link against -lgdbm_compat in ODBM_File/NDBM_File. 
    DEBPKG:fixes/assorted_docs - http://bugs.debian.org/443733 [384f06a] Math::BigInt::CalcEmu documentation grammar fix
    DEBPKG:fixes/net_smtp_docs - http://bugs.debian.org/100195 [rt.cpan.org #36038] Document the Net::SMTP 'Port' option
    DEBPKG:fixes/processPL - http://bugs.debian.org/357264 [rt.cpan.org #17224] Always use PERLRUNINST when building perl modules.
    DEBPKG:debian/perlivp - http://bugs.debian.org/510895 Make perlivp skip include directories in /usr/local
    DEBPKG:fixes/pod2man-index-backslash - http://bugs.debian.org/521256 Escape backslashes in .IX entries
    DEBPKG:debian/disable-zlib-bundling - Disable zlib bundling in Compress::Raw::Zlib
    DEBPKG:fixes/kfreebsd_cppsymbols - http://bugs.debian.org/533098 [3b910a0] Add gcc predefined macros to $Config{cppsymbols} on GNU/kFreeBSD.
    DEBPKG:debian/cpanplus_definstalldirs - http://bugs.debian.org/533707 Configure CPANPLUS to use the site directories by default.
    DEBPKG:debian/cpanplus_config_path - Save local versions of CPANPLUS::Config::System into /etc/perl.
    DEBPKG:fixes/kfreebsd-filecopy-pipes - http://bugs.debian.org/537555 [16f708c] Fix File::Copy::copy with pipes on GNU/kFreeBSD
    DEBPKG:fixes/anon-tmpfile-dir - http://bugs.debian.org/528544 [perl #66452] Honor TMPDIR when open()ing an anonymous temporary file
    DEBPKG:fixes/abstract-sockets - http://bugs.debian.org/329291 [89904c0] Add support for Abstract namespace sockets.
    DEBPKG:fixes/hurd_cppsymbols - http://bugs.debian.org/544307 [eeb92b7] Add gcc predefined macros to $Config{cppsymbols} on GNU/Hurd.
    DEBPKG:fixes/autodie-flock - http://bugs.debian.org/543731 Allow for flock returning EAGAIN instead of EWOULDBLOCK on linux/parisc
    DEBPKG:fixes/archive-tar-instance-error - http://bugs.debian.org/539355 [rt.cpan.org #48879] Separate Archive::Tar instance error strings from each other
    DEBPKG:fixes/positive-gpos - http://bugs.debian.org/545234 [perl #69056] [c584a96] Fix \\G crash on first match
    DEBPKG:debian/devel-ppport-ia64-optim - http://bugs.debian.org/548943 Work around an ICE on ia64
    DEBPKG:debian/dynaloader-config - http://bugs.debian.org/549170 Make DynaLoader work without Config_heavy.pl again
    DEBPKG:fixes/trie-logic-match - http://bugs.debian.org/552291 [perl #69973] [0abd0d7] Fix a DoS in Unicode processing [CVE-2009-3626]
    DEBPKG:fixes/hppa-thread-eagain - http://bugs.debian.org/554218 make the threads-shared test suite more robust, fixing failures on hppa
    DEBPKG:fixes/crash-on-undefined-destroy - http://bugs.debian.org/564074 [perl #71952] [1f15e67] Fix a NULL pointer dereference when looking for a DESTROY method
    DEBPKG:patchlevel - http://bugs.debian.org/567489 List packaged patches for 5.10.1-11 in patchlevel.h


@INC for perl 5.10.1:
    /etc/perl
    /usr/local/lib/perl/5.10.1
    /usr/local/share/perl/5.10.1
    /usr/lib/perl5
    /usr/share/perl5
    /usr/lib/perl/5.10
    /usr/share/perl/5.10
    /usr/local/lib/site_perl
    .


Environment for perl 5.10.1:
    HOME=/home/david
    LANG=C
    LANGUAGE (unset)
    LD_LIBRARY_PATH=/usr/local/lib
    LOGDIR (unset)
    PATH=/home/david/bin:/usr/local/bin:/home/david/.gem/ruby/1.8/bin:/usr/lib/ccache:/sbin:/usr/sbin:/usr/bin:/bin:/usr/bin/X11:/usr/games
    PERL_BADLANG (unset)
    SHELL=/bin/bash

[p5pRT]

From @schwern

david@​porkrind.org (via RT) wrote​:

$ perl -Mbigrat -e 'sqrt(2)'
Segmentation fault

This happens on 64 bit linux (debian) and Mac OS X (Snow Leopard). Both are
running the perl that came with the system. I also tested with the git
version of perl 5.11 on Mac OS X in Dec. 2009 and it had the same bug. I
have not tested on perlblead since then.

Here's what 5.11.5 says​:

$ perl5.11.5 -Mbigrat -e 'sqrt(2)'
Assertion failed​: (av), function Perl_av_len, file av.c, line 775.
Abort trap (core dumped)

And the backtrace.

#0 0x92a30732 in kill$UNIX2003 ()
#1 0x92ac398d in raise ()
#2 0x92ad9a44 in abort ()
#3 0x92ac65ec in __assert_rtn ()
#4 0x0015a32f in oom_array_extend.17529 ()
#5 0x0043b477 in XS_Math__BigInt__FastCalc__copy ()
#6 0x0018133e in ?? ()
#7 0x001118e1 in S_regtry ()
#8 0x00065b42 in S_reg ()
#9 0x002316e4 in ?? ()
#10 0x001118e1 in S_regtry ()
#11 0x0000adea in Perl_newNULLLIST ()
#12 0x0000c8c0 in Perl_mod ()
#13 0x000ba3bd in perl_clone ()
#14 0x00036f4d in Perl_keyword ()
#15 0x00034d32 in Perl_keyword ()
#16 0x00002354 in ?? ()
#17 0x00002249 in ?? ()

--
185. My name is not a killing word.
  -- The 213 Things Skippy Is No Longer Allowed To Do In The U.S. Army
  http​://skippyslist.com/list/

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[p5pRT]

From @tonycoz

On Fri, Mar 12, 2010 at 09​:05​:59AM -0800, Michael G Schwern wrote​:

david@​porkrind.org (via RT) wrote​:

$ perl -Mbigrat -e 'sqrt(2)'
Segmentation fault

This happens on 64 bit linux (debian) and Mac OS X (Snow Leopard). Both are
running the perl that came with the system. I also tested with the git
version of perl 5.11 on Mac OS X in Dec. 2009 and it had the same bug. I
have not tested on perlblead since then.

Here's what 5.11.5 says​:

$ perl5.11.5 -Mbigrat -e 'sqrt(2)'
Assertion failed​: (av), function Perl_av_len, file av.c, line 775.
Abort trap (core dumped)

The problem seems to be that a Math​::BigInt object (from the value 2)
is being passed Math​::BigFloat​::bsqrt().

Line 2097 of Math​::BigFloat then attempts to copy the mantissa (_m)
but since $x isn't a Math​::BigFloat it passes undef to the _copy()
method.

So x at Math​::BigInt​::FastCalc line 117 is an undef SV, the SvRV()
call returns NULL, and av_len() segfaults or fails the assertion.

Tony

[p5pRT]

From @tonycoz

I believe this is a bug in bignum or Math-BigInt and I've reported it
upstream as​:

https://rt.cpan.org/Ticket/Display.html?id=55767

[p5pRT]

@iabyn - Status changed from 'open' to 'rejected'

[p5pRT]

From @cpansprout

Since blead is now upstream for Math​::BigInt, can we please re-open this ticket?

[p5pRT]

@rafl - Status changed from 'rejected' to 'open'

[p5pRT]

From @cpansprout

On Thu Mar 11 17​:00​:38 2010, david@​porkrind.org wrote​:

$ perl -Mbigrat -e 'sqrt(2)'
Segmentation fault

Fixed in 45029d2.

[p5pRT]

@cpansprout - Status changed from 'open' to 'resolved'