Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Perl 5.10 regression bug in match and substitution evaluation in list context #9284

Closed
p5pRT opened this issue Apr 9, 2008 · 13 comments
Closed

Comments

@p5pRT
Copy link

p5pRT commented Apr 9, 2008

Migrated from rt.perl.org#52658 (status was 'resolved')

Searchable as RT52658$

@p5pRT
Copy link
Author

p5pRT commented Apr 9, 2008

From wolf-dietrich.moeller@nsn.com

Hi,
The following bug showed up on transition from perl 5.8 to perl 5.10.

On evaluation of a list of a match and a substitution the assigned results depend on the fact if within the the second list element the substitution has the 'e' = evaluate flag or not.

The list assigned to @​te should contain as first element the catch from the match. This is done correctly in older perl versions, and when the substitution in the 2nd element does not contain the evaluate flag.

In perl 5.10 together with the evaluate flag on the substitution, the list does no longer contain the catch of the match (first element), but the number of substutions in the substitution (second element), which should only be used as condition for the comparison '> 1'.
This is shown by the test program below.

Test program​:
# test program to show bug in Perl 5.10
# no bug in Perl 5.6 and 5.8
use strict;
my (@​te,$reg);
############ substitution without 'evaluate'
$reg ='../xxx/';
@​te = ($reg=m^(/?(?​:\.\./)*)~,$reg=s/(x)/b/g >1?'##'​:'++');
print "without bug​: (0)=$te[0] (1)=$te[1] reg=$reg\n";
#################### substitution with 'evaluate'
$reg ='../xxx/';
@​te = ($reg=m^(/?(?​:\.\./)*)
,$reg=~s/(x)/'b'/eg >1?'##'​:'++');
print "with bug​: (0)=$te[0] (1)=$te[1] reg=$reg\n";

The result in 5.8 is (i.e. the bug is not there)​:
D​:\Daten\Temp>test4.pl
without bug​: (0)=../ (1)=## reg=../bbb/
with bug​: (0)=../ (1)=## reg=../bbb/

While 5.10 results in (i.e. with bug)​:
D​:\Daten\Temp>test4.pl
without bug​: (0)=../ (1)=## reg=../bbb/
with bug​: (0)=3 (1)=## reg=../bbb/

Thanks
Wolf

PS.
Sorry I did not use the recommended tools for version reporting, as nowadays I only have access to Windows environment with ActiveState Perl windows binary. But​:
!!! I reported the bug to ActiveState last summer, and they did not handle it (still not even reviewed)!!!
As I assume the bug is not a problem of the Windows port, but of the basic perl as provided by perl.org, I decided to report it also here.

The bug version history to my knowledge​:
- The bug was not existent in Perl 5.6 (on Unix) a few years ago (yes, the program exists that long).
- The bug did not exist in ActiveState until 5.8.8 Build 820. (Actually the bug crept in with the last Build 5.8.8.822, but ActiveState wrote, that they included there some new modules, maybe from 5.10 also).
- The bug exists in ActiveState 5.10.0.1001 and stays in 5.10.0.1002.


Dr. Wolf-Dietrich Moeller
COO RTP PT SWT SW Asset Prot & ProdSec SDE
D-81541 München, Mch M, Tel. +49 89 636-53391, Fax -75166
mailto​:wolf-dietrich.moeller@​nsn.com

Nokia Siemens Networks GmbH & Co. KG
Sitz der Gesellschaft​: München / Registered office​: Munich
Registergericht​: München / Commercial registry​: Munich, HRA 88537
WEEE-Reg.-Nr.​: DE 52984304

Persönlich haftende Gesellschafterin / General Partner​: Nokia Siemens Networks Management GmbH
Geschäftsleitung / Board of Directors​: Lydia Sommer, Olaf Horsthemke
Vorsitzender des Aufsichtsrats / Chairman of supervisory board​: Lauri Kivinen
Sitz der Gesellschaft​: München / Registered office​: Munich
Registergericht​: München / Commercial registry​: Munich, HRB 163416

@p5pRT
Copy link
Author

p5pRT commented Apr 9, 2008

From @nwc10

On Wed, Apr 09, 2008 at 06​:03​:03AM -0700, Wolf-Dietrich Moeller wrote​:

In perl 5.10 together with the evaluate flag on the substitution, the list does no longer contain the catch of the match (first element), but the number of substutions in the substitution (second element), which should only be used as condition for the comparison '> 1'.
This is shown by the test program below.

Test program​:
# test program to show bug in Perl 5.10
# no bug in Perl 5.6 and 5.8
use strict;
my (@​te,$reg);
############ substitution without 'evaluate'
$reg ='../xxx/';
@​te = ($reg=m^(/?(?​:\.\./)*)~,$reg=s/(x)/b/g >1?'##'​:'++');
print "without bug​: (0)=$te[0] (1)=$te[1] reg=$reg\n";
#################### substitution with 'evaluate'
$reg ='../xxx/';
@​te = ($reg=m^(/?(?​:\.\./)*)
,$reg=~s/(x)/'b'/eg >1?'##'​:'++');
print "with bug​: (0)=$te[0] (1)=$te[1] reg=$reg\n";

The result in 5.8 is (i.e. the bug is not there)​:
D​:\Daten\Temp>test4.pl
without bug​: (0)=../ (1)=## reg=../bbb/
with bug​: (0)=../ (1)=## reg=../bbb/

While 5.10 results in (i.e. with bug)​:
D​:\Daten\Temp>test4.pl
without bug​: (0)=../ (1)=## reg=../bbb/
with bug​: (0)=3 (1)=## reg=../bbb/

Thanks for the test case. I can confirm that the different behaviour is still
present in the development version of perl.

Unfortunately, I've also found that it's in 5.8.9-to-be, so it's currently
a regression. Not good - thanks for spotting this.

Andreas, are you able to work out what change to blead introduced this?

Nicholas Clark

@p5pRT
Copy link
Author

p5pRT commented Apr 9, 2008

The RT System itself - Status changed from 'new' to 'open'

@p5pRT
Copy link
Author

p5pRT commented Apr 10, 2008

From @andk

On Wed, 9 Apr 2008 17​:43​:16 +0100, Nicholas Clark <nick@​ccl4.org> said​:

  > Andreas, are you able to work out what change to blead introduced this?

Delicious testcase. It finds not one but rather two changes. First
change is here​:

----Output of .../pDfmfu6/perl-5.9.2@​26332/bin/perl----
without bug​: (0)=../ (1)=## reg=../bbb/
with bug​: (0)=../ (1)=## reg=../bbb/

----EOF ($?='0')----
----Output of .../p2wiBJt/perl-5.9.2@​26334/bin/perl----
without bug​: (0)=../ (1)=## reg=../bbb/
with bug​: (0)= (1)=## reg=../bbb/

----EOF ($?='0')----

Change 26334 by rgs@​stencil on 2005/12/12 16​:03​:00

  A suggestion by Yamashina Hio to speed up substitutions
  with right-hand side expressions by freeing temporaries.
  See :
 
  Subject​: s///ge; consumes PL_tmps_stack in its loop
  From​: YAMASHINA Hio <hio@​hio.jp>
  Date​: Tue, 30 Aug 2005 17​:17​:23 +0900
  Message-Id​: <20050830160113.9716.HIO@​ymir.co.jp>

Affected files ...

... //depot/perl/pp_ctl.c#496 edit

And the second was this one​:

----Output of .../pNJPWnJ/perl-5.9.3@​28253/bin/perl----
without bug​: (0)=../ (1)=## reg=../bbb/
with bug​: (0)= (1)=## reg=../bbb/

----EOF ($?='0')----
----Output of .../pEPCYWT/perl-5.9.3@​28254/bin/perl----
without bug​: (0)=../ (1)=## reg=../bbb/
with bug​: (0)=3 (1)=## reg=../bbb/

----EOF ($?='0')----

Change 28254 by davem@​davem-splatty on 2006/05/20 14​:30​:50

  eval { s/$foo/die/e } leaked a scalar

Affected files ...

... //depot/perl/pp_ctl.c#568 edit
... //depot/perl/pp_hot.c#469 edit

Enjoy,
--
andreas

@p5pRT
Copy link
Author

p5pRT commented Apr 15, 2008

From @rgs

On 10/04/2008, Andreas J. Koenig
<andreas.koenig.7os6VVqR@​franz.ak.mind.de> > Change 26334 by
rgs@​stencil on 2005/12/12 16​:03​:00

    A suggestion by Yamashina Hio to speed up substitutions
    with right\-hand side expressions by freeing temporaries\.
    See :

    Subject&#8203;: s///ge; consumes PL\_tmps\_stack in its loop
    From&#8203;: YAMASHINA Hio \<hio@&#8203;hio\.jp>
    Date&#8203;: Tue\, 30 Aug 2005 17&#8203;:17&#8203;:23 \+0900
    Message\-Id&#8203;: \<20050830160113\.9716\.HIO@&#8203;ymir\.co\.jp>

I've now reverted this optimisation and added a regression test based
on the bug report.

@p5pRT
Copy link
Author

p5pRT commented Apr 15, 2008

@rgs - Status changed from 'open' to 'resolved'

@p5pRT p5pRT closed this as completed Apr 15, 2008
@p5pRT
Copy link
Author

p5pRT commented Jul 5, 2008

From andris@hpl.hp.com

It appears that there's a bug in Perl v5.10.0 that is only
exposed by the Tie-CPHash module. Since the module is pure
Perl, the module's author and I agree that this is a corner
case defect in Perl itself. The same set of circumstances
runs just fine using Perl 5.8.8 futher lending credence that
the problem is with version 5.10.0.

The problem is that a regex operation fails when trying to
manipulate the value of a CPHash'ed hash when running v5.10.0.

Here is the output of the demonstration script which is
attached at the end of this message​:

Regards,
Andris Kalnozols
HP Laboratories


  HP-UX


usno# perl-bug

The "%Names" hash is *not* tied to the "Tie-CPHash" module.

Incrementing the numeric value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = 1
After​: $Names{'ntp-1.2.3.4'} = 2

Contatenating '2' to the value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = '1'
After​: $Names{'ntp-1.2.3.4'} = '12'

Using regex to remove `ntp2-pa' from the value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = 'ntp-2 ntp2 ntp-pa ntp-2-pa ntp2-pa '
After​: $Names{'ntp-1.2.3.4'} = 'ntp-2 ntp2 ntp-pa ntp-2-pa '

.......................................................................

usno# perl-bug show

Executing `tie %Names, "Tie​::CPHash";'.

Incrementing the numeric value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = 1
After​: $Names{'ntp-1.2.3.4'} = 2

Contatenating '2' to the value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = '1'
After​: $Names{'ntp-1.2.3.4'} = '12'

*DEFECT*
Using regex to remove `ntp2-pa' from the value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = 'ntp-2 ntp2 ntp-pa ntp-2-pa ntp2-pa '
After​: $Names{'ntp-1.2.3.4'} = 'ntp-2 ntp2 ntp-pa ntp-2-pa ntp2-pa '

.......................................................................

usno# perl -V
Summary of my perl5 (revision 5 version 10 subversion 0) configuration​:
  Platform​:
  osname=hpux, osvers=11.31, archname=IA64.ARCHREV_0-thread-multi
  uname='hp-ux usno b.11.31 u ia64 3696645879 unlimited-user license '
  config_args='-der'
  hint=previous, useposix=true, d_sigaction=define
  useithreads=define, usemultiplicity=define
  useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
  use64bitint=undef, use64bitall=undef, uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='cc', ccflags ='-D_POSIX_C_SOURCE=199506L -D_REENTRANT -Ae -z -D_XOPEN_SOURCE_EXTENDED -Wl,+mergeseg -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
  optimize='+O0 -g +check=bounds​:all +check=globals +check=malloc +check=stack +Olit=all +DSnative',
  cppflags='-Aa -D__STDC_EXT__ -D_HPUX_SOURCE -D_POSIX_C_SOURCE=199506L -D_REENTRANT -Ae -z -D_XOPEN_SOURCE_EXTENDED -Wl,+mergeseg -I/usr/local/include -D_POSIX_C_SOURCE=199506L -D_REENTRANT -Ae -z -D_XOPEN_SOURCE_EXTENDED -Wl,+mergeseg -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64'
  ccversion='B3910B', gccversion='', gccosandvers=''
  intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=4321
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
  ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
  alignbytes=8, prototype=define
  Linker and Libraries​:
  ld='/usr/bin/ld', ldflags ='-L/usr/local/lib/hpux32 -L/opt/langtools/lib/hpux32 -L/usr/lib/hpux32'
  libpth=/usr/local/lib/hpux32 /usr/lib/hpux32 /usr/ccs/lib/hpux32 /opt/langtools/lib/hpux32
  libs=-lnsl -lnm -lndbm -ldb -ldl -lm -lsec -lpthread -lrtc_aux -lrtc
  perllibs=-lnsl -lnm -ldl -lm -lsec -lpthread -lrtc_aux -lrtc
  libc=/usr/lib/hpux32/libc.so, so=so, useshrplib=false, libperl=libperl.a
  gnulibc_version=''
  Dynamic Linking​:
  dlsrc=dl_hpux.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E -Wl,-B,deferred '
  cccdlflags=' ', lddlflags='-b +mergeseg -L/usr/local/lib/hpux32 -L/opt/langtools/lib/hpux32 -lrtc_aux -lrtc -L/usr/lib/hpux32'

Characteristics of this binary (from libperl)​:
  Compile-time options​: MULTIPLICITY PERL_DONT_CREATE_GVSV
  PERL_IMPLICIT_CONTEXT PERL_MALLOC_WRAP USE_ITHREADS
  USE_LARGE_FILES USE_PERLIO USE_REENTRANT_API
  Built under hpux
  Compiled at Jul 2 2008 09​:43​:13
  @​INC​:
  /usr/local/perl/lib/5.10.0
  /usr/local/perl/lib/site_perl/5.10.0
  /usr/local/lib/site_perl
  .

  NOTE​: Despite using the instrumentation features of HP's ANSI-C
  compiler to build in various checks for bounds violations
  (array and pointer), stack corruption, malloc, etc., the
  HP-UX version of Perl did not abort as it did under Linux.

  I will recompile using Perl's malloc to see aany useful
  diagnostics can be generated on the HP-UX platform.


  Linux (Debian)


masterns# ./perl-bug

The "%Names" hash is *not* tied to the "Tie-CPHash" module.

Incrementing the numeric value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = 1
After​: $Names{'ntp-1.2.3.4'} = 2

Contatenating '2' to the value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = '1'
After​: $Names{'ntp-1.2.3.4'} = '12'

Using regex to remove `ntp2-pa' from the value of `$Names{'ntp-1.2.3.4'}'...
Before​: $Names{'ntp-1.2.3.4'} = 'ntp-2 ntp2 ntp-pa ntp-2-pa ntp2-pa '
After​: $Names{'ntp-1.2.3.4'} = 'ntp-2 ntp2 ntp-pa ntp-2-pa '

.......................................................................

masterns# ./perl-bug show

Executing `tie %Names, "Tie​::CPHash";'.

Incrementing the value of `$Names{'ntp-1.2.3.4'}'
Before​: $Names{'ntp-1.2.3.4'} = 1
After​: $Names{'ntp-1.2.3.4'} = 2

Contatenating '2' to the value of `$Names{'ntp-1.2.3.4'}'
Before​: $Names{'ntp-1.2.3.4'} = '1'
After​: $Names{'ntp-1.2.3.4'} = '12'

*DEFECT*
Removing `ntp2-pa' from the value of `$Names{'ntp-1.2.3.4'}'
Before​: $Names{'ntp-1.2.3.4'} = 'ntp-2 ntp2 ntp-pa ntp-2-pa ntp2-pa '
*** glibc detected *** /usr/bin/perl​: double free or corruption (fasttop)​: 0x081a7568 ***
======= Backtrace​: =========
/lib/i686/cmov/libc.so.6[0xb7e888f5]
/lib/i686/cmov/libc.so.6(cfree+0x90)[0xb7e8c360]
/usr/bin/perl(Perl_pp_substcont+0x3bf)[0x80f019f]
/usr/bin/perl(Perl_runops_standard+0x19)[0x80b17f9]
/usr/bin/perl(perl_run+0x2e0)[0x80ac620]
/usr/bin/perl(main+0xed)[0x8063ddd]
/lib/i686/cmov/libc.so.6(__libc_start_main+0xe0)[0xb7e33450]
/usr/bin/perl[0x8063c51]
======= Memory map​: ========
08048000-08179000 r-xp 00000000 68​:03 3842900 /usr/bin/perl
08179000-0817b000 rw-p 00130000 68​:03 3842900 /usr/bin/perl
0817b000-081de000 rw-p 0817b000 00​:00 0 [heap]
b7c00000-b7c21000 rw-p b7c00000 00​:00 0
b7c21000-b7d00000 ---p b7c21000 00​:00 0
b7ddc000-b7de8000 r-xp 00000000 68​:03 2469173 /lib/libgcc_s.so.1
b7de8000-b7de9000 rw-p 0000b000 68​:03 2469173 /lib/libgcc_s.so.1
b7de9000-b7deb000 rw-p b7de9000 00​:00 0
b7deb000-b7df4000 r-xp 00000000 68​:03 2469367 /lib/i686/cmov/libcrypt-2.7.so
b7df4000-b7df6000 rw-p 00008000 68​:03 2469367 /lib/i686/cmov/libcrypt-2.7.so
b7df6000-b7e1d000 rw-p b7df6000 00​:00 0
b7e1d000-b7f65000 r-xp 00000000 68​:03 2469362 /lib/i686/cmov/libc-2.7.so
b7f65000-b7f66000 r--p 00148000 68​:03 2469362 /lib/i686/cmov/libc-2.7.so
b7f66000-b7f68000 rw-p 00149000 68​:03 2469362 /lib/i686/cmov/libc-2.7.so
b7f68000-b7f6b000 rw-p b7f68000 00​:00 0
b7f6b000-b7f7f000 r-xp 00000000 68​:03 2469388 /lib/i686/cmov/libpthread-2.7.so
b7f7f000-b7f81000 rw-p 00013000 68​:03 2469388 /lib/i686/cmov/libpthread-2.7.so
b7f81000-b7f83000 rw-p b7f81000 00​:00 0
b7f83000-b7fa6000 r-xp 00000000 68​:03 2469370 /lib/i686/cmov/libm-2.7.so
b7fa6000-b7fa8000 rw-p 00023000 68​:03 2469370 /lib/i686/cmov/libm-2.7.so
b7fa8000-b7faa000 r-xp 00000000 68​:03 2469369 /lib/i686/cmov/libdl-2.7.so
b7faa000-b7fac000 rw-p 00001000 68​:03 2469369 /lib/i686/cmov/libdl-2.7.so
b7fac000-b7fad000 rw-p b7fac000 00​:00 0
b7fbd000-b7fbe000 rw-p b7fbd000 00​:00 0
b7fbe000-b7fd8000 r-xp 00000000 68​:03 2469171 /lib/ld-2.7.so
b7fd8000-b7fda000 rw-p 00019000 68​:03 2469171 /lib/ld-2.7.so
bfc00000-bfc15000 rw-p bffeb000 00​:00 0 [stack]
ffffe000-fffff000 r-xp 00000000 00​:00 0 [vdso]
Aborted
masterns# echo $?
134

.......................................................................

masterns# perl -V
Summary of my perl5 (revision 5 version 10 subversion 0) configuration​:
  Platform​:
  osname=linux, osvers=2.6.25.7, archname=i486-linux-gnu-thread-multi
  uname='linux ninsei 2.6.25.7 #1 smp preempt fri jun 20 14​:17​:13 pdt 2008 i686 gnulinux '
  config_args='-Dusethreads -Duselargefiles -Dccflags=-DDEBIAN -Dcccdlflags=-fPIC -Darchname=i486-linux-gnu -Dprefix=/usr -Dprivlib=/usr/share/perl/5.10 -Darchlib=/usr/lib/perl/5.10 -Dvendorprefix=/usr -Dvendorlib=/usr/share/perl5 -Dvendorarch=/usr/lib/perl5 -Dsiteprefix=/usr/local -Dsitelib=/usr/local/share/perl/5.10.0 -Dsitearch=/usr/local/lib/perl/5.10.0 -Dman1dir=/usr/share/man/man1 -Dman3dir=/usr/share/man/man3 -Dsiteman1dir=/usr/local/man/man1 -Dsiteman3dir=/usr/local/man/man3 -Dman1ext=1 -Dman3ext=3perl -Dpager=/usr/bin/sensible-pager -Uafs -Ud_csh -Ud_ualarm -Uusesfio -Uusenm -DDEBUGGING=-g -Doptimize=-O2 -Duseshrplib -Dlibperl=libperl.so.5.10.0 -Dd_dosuid -des'
  hint=recommended, useposix=true, d_sigaction=define
  useithreads=define, usemultiplicity=define
  useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
  use64bitint=undef, use64bitall=undef, uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
  optimize='-O2 -g',
  cppflags='-D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fno-strict-aliasing -pipe -I/usr/local/include'
  ccversion='', gccversion='4.3.1', gccosandvers=''
  intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
  ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
  alignbytes=4, prototype=define
  Linker and Libraries​:
  ld='cc', ldflags =' -L/usr/local/lib'
  libpth=/usr/local/lib /lib /usr/lib /usr/lib64
  libs=-lgdbm -lgdbm_compat -ldb -ldl -lm -lpthread -lc -lcrypt
  perllibs=-ldl -lm -lpthread -lc -lcrypt
  libc=/lib/libc-2.7.so, so=so, useshrplib=true, libperl=libperl.so.5.10.0
  gnulibc_version='2.7'
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
  cccdlflags='-fPIC', lddlflags='-shared -O2 -g -L/usr/local/lib'

Characteristics of this binary (from libperl)​:
  Compile-time options​: MULTIPLICITY PERL_DONT_CREATE_GVSV
  PERL_IMPLICIT_CONTEXT PERL_MALLOC_WRAP USE_ITHREADS
  USE_LARGE_FILES USE_PERLIO USE_REENTRANT_API
  Built under linux
  Compiled at Jun 21 2008 21​:09​:08
  @​INC​:
  /etc/perl
  /usr/local/lib/perl/5.10.0
  /usr/local/share/perl/5.10.0
  /usr/lib/perl5
  /usr/share/perl5
  /usr/lib/perl/5.10
  /usr/share/perl/5.10
  /usr/local/lib/site_perl
  .

***********************************************************************

#!/usr/bin/perl -w
#

use strict;
use Tie​::CPHash;

my ($name, %Names);

if (@​ARGV) {
  #
  # Any command-line argument(s) will cause the "%Names"
  # hash to be tied to the Tie-CPHash module.
  #
  print "\nExecuting `tie %Names, \"Tie​::CPHash\";'.\n\n";
  tie %Names, "Tie​::CPHash";
} else {
  print "\n", 'The "%Names" hash is *not* tied ',
  'to the "Tie-CPHash" module.', "\n\n";
}

# Initialize the "%Names" hash with a numeric value.
#
$Names{'ntp-1.2.3.4'} = 1;

# Modify the value of the hash to demonstrate that
# numeric data are not affected by the bug.
#
print "Incrementing the numeric value of `\$Names\{'ntp-1.2.3.4'\}'...\n";
print "Before​: \$Names\{'ntp-1.2.3.4'\} = ",
  $Names{'ntp-1.2.3.4'}, "\n";

$Names{'ntp-1.2.3.4'}++;

print " After​: \$Names\{'ntp-1.2.3.4'\} = ",
  $Names{'ntp-1.2.3.4'}, "\n\n";

# Initialize the "%Names" hash with a simple character value.
#
$Names{'ntp-1.2.3.4'} = '1';

# Modify the value of the hash to demonstrate that a simple
# string concatenation is not affected by the bug.
#
print "Contatenating '2' to the value of `\$Names\{'ntp-1.2.3.4'\}'...\n";
print "Before​: \$Names\{'ntp-1.2.3.4'\} = '",
  $Names{'ntp-1.2.3.4'}, "'\n";

$Names{'ntp-1.2.3.4'} .= '2';

print " After​: \$Names\{'ntp-1.2.3.4'\} = '",
  $Names{'ntp-1.2.3.4'}, "'\n\n";

# Initialize the "%Names" hash with the demonstration data.
#
$Names{'ntp-1.2.3.4'} = 'ntp-2 ntp2 ntp-pa ntp-2-pa ntp2-pa ';

# Modify the value of the hash with an RE to expose the perl defect.
#
print "*DEFECT*\n" if @​ARGV;
$name = 'ntp2-pa';
print "Using regex to remove `$name' from ",
  "the value of `\$Names\{'ntp-1.2.3.4'\}'...\n";
print "Before​: \$Names\{'ntp-1.2.3.4'\} = '",
  $Names{'ntp-1.2.3.4'}, "'\n";

$Names{'ntp-1.2.3.4'} =~ s/(^|\s)$name\s/$1/;

print " After​: \$Names\{'ntp-1.2.3.4'\} = '",
  $Names{'ntp-1.2.3.4'}, "'\n\n";

exit;

@p5pRT
Copy link
Author

p5pRT commented Jul 6, 2008

From perl@cjmweb.net

Here's a simpler test case that uses only core modules. It works fine
under 5.8.8, but crashes under 5.10.0 (on Linux, anyway). It should
print "ok\n".

#! /usr/bin/perl
use strict;
use warnings;
use Tie​::Hash ();

my %h;
tie(%h, 'Tie​::StdHash');

$h{key} = 'ntp-2 ntp2 ntp-pa ntp-2-pa ntp2-pa ';
$h{key} =~ s/(^|\s)ntp2-pa\s/$1/;

die "not ok​: <$h{key}>\n"
  unless $h{key} eq 'ntp-2 ntp2 ntp-pa ntp-2-pa ';

print "ok\n";

--
Chris Madsen perl@​cjmweb.net
  -------------------- http​://www.cjmweb.net --------------------

@p5pRT
Copy link
Author

p5pRT commented Jul 6, 2008

The RT System itself - Status changed from 'new' to 'open'

@p5pRT
Copy link
Author

p5pRT commented Jul 17, 2008

perl@cjmweb.net - Status changed from 'open' to 'new'

@p5pRT
Copy link
Author

p5pRT commented Jul 21, 2008

From perl@cjmweb.net

Has anybody had a chance to look at this regression in 5.10.0?
rt.perl.org classified it as low severity, but I'd say it's at least
medium if not high. It does not appear to be Linux specific. The
original example also mentioned HP-UX (although there it gives incorrect
results instead of crashing).

The original example was fairly complicated, but I boiled it down to a
simpler program here​:
http​://rt.perl.org/rt3/Ticket/Display.html?id=56610#txn-439780

It uses only core modules. If it does anything except print "ok" then
you've found a bug.

--
Chris Madsen perl@​cjmweb.net
  -------------------- http​://www.cjmweb.net --------------------

@p5pRT
Copy link
Author

p5pRT commented Jul 22, 2008

From @mhx

This was caused by change #26334, and has been fixed by reverting
that change with #33685.

Marcus

@p5pRT
Copy link
Author

p5pRT commented Jul 22, 2008

The RT System itself - Status changed from 'new' to 'open'

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant