From @andk

git bisect​:

  commit 8985fe9
  Author​: David Mitchell <davem@​iabyn.com>
  Date​: Thu Dec 30 10​:32​:44 2010 +0000

  Better handling of magic methods freeing the SV

example fail report​:

  http​://www.cpantesters.org/cpan/report/3b1e668c-5f54-11e0-b0a4-0c9942987c1d

perl -V​:

  Summary of my perl5 (revision 5 version 13 subversion 8) configuration​:
  Commit id​: 8985fe9
  Platform​:
  osname=linux, osvers=2.6.32-5-amd64, archname=x86_64-linux
  uname='linux k81 2.6.32-5-amd64 #1 smp wed jan 12 03​:40​:32 utc 2011 x86_64 gnulinux '
  config_args='-Dprefix=/home/src/perl/repoperls/installed-perls/perl/v5.13.8-66-g8985fe9 -Dinstallusrbinperl=n -Uversiononly -Dusedevel -des -Ui_db -Uuseithreads -Uuselongdouble -DDEBUGGING=-g'
  hint=recommended, useposix=true, d_sigaction=define
  useithreads=undef, usemultiplicity=undef
  useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
  use64bitint=define, use64bitall=define, uselongdouble=undef
  usemymalloc=n, bincompat5005=undef
  Compiler​:
  cc='cc', ccflags ='-fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
  optimize='-O2 -g',
  cppflags='-fno-strict-aliasing -pipe -fstack-protector -I/usr/local/include'
  ccversion='', gccversion='4.5.2', gccosandvers=''
  intsize=4, longsize=8, ptrsize=8, doublesize=8, byteorder=12345678
  d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=16
  ivtype='long', ivsize=8, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
  alignbytes=8, prototype=define
  Linker and Libraries​:
  ld='cc', ldflags =' -fstack-protector -L/usr/local/lib'
  libpth=/usr/local/lib /lib /usr/lib /lib64 /usr/lib64
  libs=-lnsl -lgdbm -ldb -ldl -lm -lcrypt -lutil -lc -lgdbm_compat
  perllibs=-lnsl -ldl -lm -lcrypt -lutil -lc
  libc=/lib/libc-2.11.2.so, so=so, useshrplib=false, libperl=libperl.a
  gnulibc_version='2.11.2'
  Dynamic Linking​:
  dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
  cccdlflags='-fPIC', lddlflags='-shared -O2 -g -L/usr/local/lib -fstack-protector'

  Characteristics of this binary (from libperl)​:
  Compile-time options​: PERL_DONT_CREATE_GVSV PERL_MALLOC_WRAP PERL_USE_DEVEL
  USE_64_BIT_ALL USE_64_BIT_INT USE_LARGE_FILES
  USE_PERLIO USE_PERL_ATOF
  Built under linux
  Compiled at Apr 5 2011 10​:25​:12
  @​INC​:
  /home/src/perl/repoperls/installed-perls/perl/v5.13.8-66-g8985fe9/lib/site_perl/5.13.8/x86_64-linux
  /home/src/perl/repoperls/installed-perls/perl/v5.13.8-66-g8985fe9/lib/site_perl/5.13.8
  /home/src/perl/repoperls/installed-perls/perl/v5.13.8-66-g8985fe9/lib/5.13.8/x86_64-linux
  /home/src/perl/repoperls/installed-perls/perl/v5.13.8-66-g8985fe9/lib/5.13.8
  .

--
andreas

From @andk

Sorry, forgot to provide a gdb stacktrace​:

Program terminated with signal 11, Segmentation fault.
#0 S_mg_findext_flags (sv=0x3980058, type=<value optimized out>) at mg.c​:416

warning​: Source file is more recent than executable.
416 if (mg->mg_type == type && (!flags || mg->mg_virtual == vtbl)) {
(gdb) bt
#0 S_mg_findext_flags (sv=0x3980058, type=<value optimized out>) at mg.c​:416
#1 Perl_mg_find (sv=0x3980058, type=<value optimized out>) at mg.c​:436
#2 0x0000000000488a0e in Perl_hv_placeholders_get (hv=<value optimized out>)
  at hv.c​:2855
#3 0x0000000000488b47 in Perl_hv_iternext_flags (hv=0x3980058,
  flags=<value optimized out>) at hv.c​:2465
#4 0x00007f7c9a45a647 in HUF_destroy_obj (index=<value optimized out>,
  trigger=<value optimized out>) at FieldHash.xs​:129
#5 0x00000000004826d2 in Perl_magic_setuvar (sv=<value optimized out>,
  mg=<value optimized out>) at mg.c​:2346
#6 0x000000000047f15b in Perl_mg_set (sv=0x397fd88) at mg.c​:292
#7 0x00000000004a7b0f in Perl_sv_kill_backrefs (sv=0x397fef0,
  av=<value optimized out>) at sv.c​:5671
#8 0x000000000048265d in Perl_magic_killbackrefs (sv=<value optimized out>,
  mg=<value optimized out>) at mg.c​:2323
#9 0x000000000047ec58 in S_mg_free_struct (sv=<value optimized out>,
  mg=<value optimized out>) at mg.c​:545
#10 0x000000000047f6be in Perl_mg_free (sv=0x397fef0) at mg.c​:575
#11 0x000000000049c6e7 in Perl_sv_clear (orig_sv=0x397d430) at sv.c​:6046
#12 0x000000000049cb06 in Perl_sv_free2 (sv=0x397d430) at sv.c​:6363
#13 0x00000000004bb960 in Perl_free_tmps () at scope.c​:167
#14 0x000000000048ec5d in Perl_pp_nextstate () at pp_hot.c​:54
#15 0x000000000048e663 in Perl_runops_standard () at run.c​:41
#16 0x000000000043b158 in S_run_body (my_perl=<value optimized out>)
  at perl.c​:2327
#17 perl_run (my_perl=<value optimized out>) at perl.c​:2250
#18 0x000000000042239c in main (argc=3, argv=0x7fff0ff40e78,
  env=0x7fff0ff40e98) at perlmain.c​:118
(gdb)

--
andreas

From @obra

Thanks. I've made this a release blocker.

The RT System itself - Status changed from 'new' to 'open'

From @iabyn

On Tue, Apr 05, 2011 at 01​:36​:25PM -0700, Andreas J. Koenig via RT wrote​:

git bisect​:
-----------

commit 8985fe9
Author​: David Mitchell <davem@​iabyn.com>
Date​: Thu Dec 30 10​:32​:44 2010 +0000

Better handling of magic methods freeing the SV

example fail report​:
--------------------

http​://www.cpantesters.org/cpan/report/3b1e668c-5f54-11e0-b0a4-0c9942987c1d

Fixed (probably) with the commit below.

The actual bug I found was in a dependency, Set​::Object, which had the
effect of triggering an edge case in perl introduced by the commit above.
My new commit fixes that edge case, which means the bug in Set​::Object is
less likely to upset perl. With this commit, I can successfully build
KiokuDB, so I assume its fixed. However, I never actually saw it fail,
because the Set​::Object dependency was failing, so I never got that far.

I've separately reported the Set​::Object to its author.

commit 150b625
Author​: David Mitchell <davem@​iabyn.com>
AuthorDate​: Wed Apr 6 23​:35​:14 2011 +0100
Commit​: David Mitchell <davem@​iabyn.com>
CommitDate​: Thu Apr 7 00​:18​:41 2011 +0100

  make mg_clear() et al behave when RC==0
 
  The functions S_save_magic() and S_restore_magic(), which are called by
  mg_get(), mg_set(), mg_length(), mg_size() and mg_clear(),
  are not robust when called with an SV whose reference count is zero.
  Basically, one of the actions of S_save_magic() is to temporarily
  increase the refcount of the SV, and then for S_restore_magic() to reduce
  it again at the end, so that if any of the magic functions called
  inbetween decrease the count, it won't be prematurely freed.
  However, if the count starts at zero, then bumping it up and bringing it
  back down to zero, triggers a spurious second freeing.
 
  So, if its zero, just skip the whole bumping thing.
 
  Now, we shouldn't really be calling these functions will a zero-refcount
  SV, but these things happen, and its best to be robust.
 
  In particular, this fixes RT #87860, which was ultimately triggered by a
  bug in Set​::Object 1.28 that managed to create an HV with null SvMAGIC
  field, but with the RMG flag set.
 
  When freeing that HV, sv_clear() skips doing mg_free() because SvMAGIC is
  null, whereas later it calls Perl_hv_undef_flags, which calls mg_clear()
  because it uses the test SvRMAGICAL(hv) (which is true).

M mg.c

--
O Unicef Clearasil!
Gibberish and Drivel!
  -- "Bored of the Rings"

@iabyn - Status changed from 'open' to 'resolved'