Coredump when assigning a glob to a thread-shared array

[p5pRT]

Migrated from rt.perl.org#119719 (status was 'open')

Searchable as RT119719$

[p5pRT]

From @eserte

This is a bug report for perl from slaven@​rezic.de,
generated with the help of perlbug 1.39 running under perl 5.18.1.

---

The following script segfaults​:

#!/usr/bin/perl -w

use strict;
use threads;
use threads​::shared;

my @​foo :shared;
push @​foo, *STDOUT;

__END__

I reproduced the problem on a FreeBSD 9.0 system with
perl 5.18.1 (this one), same system with 5.16.1, and
on a Debian/squeeze box with system perl.

Actually I don't expect that anything useful happens here, it
just shouldn't segfault.

Regards,
  Slaven

---

---

Flags​:
  category=library
  severity=low
  module=threads​::shared

---

Site configuration information for perl 5.18.1​:

Configured by eserte at Mon Aug 19 07​:57​:03 CEST 2013.

Summary of my perl5 (revision 5 version 18 subversion 1) configuration​:
 
  Platform​:
  osname=freebsd, osvers=9.0-release, archname=amd64-freebsd-thread-multi
  uname='freebsd cvrsnica.herceg.de 9.0-release freebsd 9.0-release #0​: tue jan 3 07​:46​:30 utc 2012 root@​farrell.cse.buffalo.edu​:usrobjusrsrcsysgeneric amd64 '
  config_args='-D usethreads=define -D useshrplib=true -Dprefix=/usr/perl5.18.1t -Dprefix=/usr/perl5.18.1t -Dusemymalloc=n -D cc=ccache cc -Dgccansipedantic -de'
  hint=recommended, useposix=true, d_sigaction=define
  useithreads=define, usemultiplicity=define
  useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
  use64bitint=define, use64bitall=define, uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='ccache cc', ccflags ='-DHAS_FPSETMASK -DHAS_FLOATINGPOINT_H -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include',
  optimize='-O2 -pipe',
  cppflags='-DHAS_FPSETMASK -DHAS_FLOATINGPOINT_H -fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include'
  ccversion='', gccversion='4.2.1 20070831 patched [FreeBSD]', gccosandvers=''
  intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
  ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
  alignbytes=8, prototype=define
  Linker and Libraries​:
  ld='ccache cc', ldflags ='-pthread -Wl,-E -fstack-protector -L/usr/local/lib'
  libpth=/usr/lib /usr/local/lib
  libs=-lgdbm -lm -lcrypt
  perllibs=-lm -lcrypt
  libc=, so=so, useshrplib=true, libperl=libperl.so
  gnulibc_version=''
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags=' -Wl,-R/usr/perl5.18.1t/lib/5.18.1/amd64-freebsd-thread-multi/CORE'
  cccdlflags='-DPIC -fPIC', lddlflags='-shared -L/usr/local/lib -fstack-protector'

Locally applied patches​:
 

---

@​INC for perl 5.18.1​:
  /usr/perl5.18.1t/lib/site_perl/5.18.1/amd64-freebsd-thread-multi
  /usr/perl5.18.1t/lib/site_perl/5.18.1
  /usr/perl5.18.1t/lib/5.18.1/amd64-freebsd-thread-multi
  /usr/perl5.18.1t/lib/5.18.1
  .

---

Environment for perl 5.18.1​:
  HOME=/home/e/eserte
  LANG (unset)
  LANGUAGE (unset)
  LC_ALL=de_DE.UTF-8
  LD_LIBRARY_PATH (unset)
  LOGDIR (unset)
  PATH=/usr/local/bin​:/usr/X11R6/bin​:/usr/X11/bin​:/usr/bin​:/bin​:/usr/local/sbin​:/usr/sbin​:/sbin​:/home/e/eserte/bin/freebsd9.0​:/home/e/eserte/bin/sh​:/home/e/eserte/bin​:/usr/games​:/home/e/eserte/devel
  PERLDOC=-MPod​::Perldoc​::ToTextOverstrike
  PERL_BADLANG (unset)
  PERL_HTML_DISPLAY_CLASS=HTML​::Display​::Mozilla
  SHELL=/usr/local/bin/zsh

[p5pRT]

From @nwc10

On Wed, Sep 11, 2013 at 10​:08​:34AM -0700, slaven@​rezic.de wrote​:

I reproduced the problem on a FreeBSD 9.0 system with
perl 5.18.1 (this one), same system with 5.16.1, and
on a Debian/squeeze box with system perl.

Actually I don't expect that anything useful happens here, it
just shouldn't segfault.

Agree that it certainly shouldn't SEGV. Possibly it should croak with
a diagnostic that it can't assign it.

A build with assertions (which I have handy) shows that it's failing like
this​:

perl​: sv.c​:3740​: S_glob_assign_glob​: Assertion `((((_gvgp)->sv_flags & (0x00004000|0x00008000)) == 0x00008000) && (((svtype)((_gvgp)->sv_flags & 0xff)) == SVt_PVGV || ((svtype)((_gvgp)->sv_flags & 0xff)) == SVt_PVLV))' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff6dbb1b5 in *__GI_raise (sig=<value optimized out>)
  at ../nptl/sysdeps/unix/sysv/linux/raise.c​:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c​: No such file or directory.
  in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) up
#1 0x00007ffff6dbdfc0 in *__GI_abort () at abort.c​:92
92 abort.c​: No such file or directory.
  in abort.c
(gdb)
#2 0x00007ffff6db4301 in *__GI___assert_fail (
  assertion=0x7b7110 "((((_gvgp)->sv_flags & (0x00004000|0x00008000)) == 0x00008000) && (((svtype)((_gvgp)->sv_flags & 0xff)) == SVt_PVGV || ((svtype)((_gvgp)->sv_flags & 0xff)) == SVt_PVLV))", file=<value optimized out>, line=3740,
  function=0x7d42d0 "S_glob_assign_glob") at assert.c​:81
81 assert.c​: No such file or directory.
  in assert.c
(gdb) up
#3 0x00000000005cd6c7 in S_glob_assign_glob (my_perl=0xb2c2b0, dstr=0xb2eed8,
  sstr=0xa45078, dtype=9) at sv.c​:3740
3740 !mro_changes && GvGP(MUTABLE_GV(dstr)) && GvCVu((const GV *)dstr)
(gdb) call Perl_sv_dump(my_perl, _gvgp)
SV = PVGV(0xb477b8) at 0xb2eed8
  REFCNT = 1
  FLAGS = ()
  IV = 0
  NV = 0
  PV = 0
(gdb) where
#0 0x00007ffff6dbb1b5 in *__GI_raise (sig=<value optimized out>)
  at ../nptl/sysdeps/unix/sysv/linux/raise.c​:64
#1 0x00007ffff6dbdfc0 in *__GI_abort () at abort.c​:92
#2 0x00007ffff6db4301 in *__GI___assert_fail (
  assertion=0x7b7110 "((((_gvgp)->sv_flags & (0x00004000|0x00008000)) == 0x00008000) && (((svtype)((_gvgp)->sv_flags & 0xff)) == SVt_PVGV || ((svtype)((_gvgp)->sv_flags & 0xff)) == SVt_PVLV))", file=<value optimized out>, line=3740,
  function=0x7d42d0 "S_glob_assign_glob") at assert.c​:81
#3 0x00000000005cd6c7 in S_glob_assign_glob (my_perl=0xb2c2b0, dstr=0xb2eed8,
  sstr=0xa45078, dtype=9) at sv.c​:3740
#4 0x00000000005d65bb in Perl_sv_setsv_flags (my_perl=0xb2c2b0,
  dstr=0xb2eed8, sstr=0xa45078, flags=0) at sv.c​:4171
#5 0x00007ffff674c02d in sharedsv_scalar_store (my_perl=0xb2c2b0,
  sv=0xa45078, ssv=0xb2eed8) at shared.xs​:792
#6 0x00007ffff67521f8 in XS_threads__shared__tie_PUSH (my_perl=0xa24010,
  cv=0xb09910) at shared.xs​:1289
#7 0x00000000005b2e79 in Perl_pp_entersub (my_perl=0xa24010) at pp_hot.c​:2761
#8 0x0000000000548977 in Perl_runops_debug (my_perl=0xa24010) at dump.c​:2264
#9 0x000000000045e22a in Perl_call_sv (my_perl=0xa24010, sv=0xa26dd0,
  flags=4102) at perl.c​:2799
#10 0x0000000000644246 in Perl_pp_push (my_perl=0xa24010) at pp.c​:5120
#11 0x0000000000548977 in Perl_runops_debug (my_perl=0xa24010) at dump.c​:2264
#12 0x000000000045ce6d in S_run_body (my_perl=0xa24010, oldscope=1)
  at perl.c​:2500
#13 0x000000000045c2d2 in perl_run (my_perl=0xa24010) at perl.c​:2416
#14 0x000000000041dca5 in main (argc=3, argv=0x7fffffffea58,
  env=0x7fffffffea78) at perlmain.c​:112

I don't have time to look at this further in the near future, but I hope that
the above might give someone an idea.

Nicholas Clark

[p5pRT]

The RT System itself - Status changed from 'new' to 'open'

[michal-josef-spacek]

The issue has the ticket in Fedora: https://bugzilla.redhat.com/show_bug.cgi?id=1007199