From @ikegami

Created by @ikegami

When using return type AV* in XS, the typemap wraps the array in a
reference, but leaves the refcount too high.

-----BEGIN CODE-----
use strict;
use warnings;

use Devel​::Peek qw( Dump );

use Inline C => <<'__EOI__';

AV* f() {
  return newAV();
}

__EOI__

Dump(f());
-----END CODE-----

-----BEGIN OUTPUT-----

perl -MInline=FORCE,NOISY,NOCLEAN a.pl
...
SV = IV(0x7bbf18) at 0x7bbf1c
  REFCNT = 1
  FLAGS = (TEMP,ROK)
  RV = 0x7bc05c
  SV = PVAV(0x7bcec8) at 0x7bc05c
  REFCNT = 2 <--- XXX
  FLAGS = ()
  ARRAY = 0x0
  FILL = -1
  MAX = -1
  ARYLEN = 0x0
  FLAGS = (REAL)
-----END OUTPUT-----

Making the av mortal doesn't help. The typemap entry in question (from
blead)​:

T_AVREF
  STMT_START {
  SV* const xsub_tmp_sv = $arg;
  SvGETMAGIC(xsub_tmp_sv);
  if (SvROK(xsub_tmp_sv) && SvTYPE(SvRV(xsub_tmp_sv)) == SVt_PVAV){
  $var = (AV*)SvRV(xsub_tmp_sv);
  }
  else{
  Perl_croak(aTHX_ \"%s​: %s is not an ARRAY reference\",
  ${$ALIAS?\q[GvNAME(CvGV(cv))]​:\qq[\"$pname\"]},
  \"$var\");
  }
  } STMT_END

I don't know how to fix this.

The typemap for HV* (T_HVREF), CV* (T_CVREF) and the unused T_SVREF typemap
appear to suffer from the same problem.

- Eric

Flags:
    category=core
    severity=low

Site configuration information for perl 5.14.0:

Configured by eric at Fri Jun 10 15:56:22 EDT 2011.

Summary of my perl5 (revision 5 version 14 subversion 0) configuration:

  Platform:
    osname=linux, osvers=2.6.32-5-686, archname=i686-linux-thread-multi
    uname='linux fmdev10 2.6.32-5-686 #1 smp tue mar 8 21:36:00 utc 2011
i686 gnulinux '
    config_args='-de -Dprefix=/home/eric/usr/perlbrew/perls/perl-5.14.0t
-Dusethreads'
    hint=recommended, useposix=true, d_sigaction=define
    useithreads=define, usemultiplicity=define
    useperlio=define, d_sfio=undef, uselargefiles=define, usesocks=undef
    use64bitint=undef, use64bitall=undef, uselongdouble=undef
    usemymalloc=n, bincompat5005=undef
  Compiler:
    cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe
-fstack-protector -I/usr/local/include -D_LARGEFILE_SOURCE
-D_FILE_OFFSET_BITS=64',
    optimize='-O2',
    cppflags='-D_REENTRANT -D_GNU_SOURCE -fno-strict-aliasing -pipe
-fstack-protector -I/usr/local/include'
    ccversion='', gccversion='4.4.5', gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t',
lseeksize=8
    alignbytes=4, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -fstack-protector -L/usr/local/lib'
    libpth=/usr/local/lib /lib/../lib /usr/lib/../lib /lib /usr/lib /lib64
/usr/lib64
    libs=-lnsl -ldb -ldl -lm -lcrypt -lutil -lpthread -lc
    perllibs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
    libc=/lib/libc-2.11.2.so, so=so, useshrplib=false, libperl=libperl.a
    gnulibc_version='2.11.2'
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E'
    cccdlflags='-fPIC', lddlflags='-shared -O2 -L/usr/local/lib
-fstack-protector'

Locally applied patches:



@INC for perl 5.14.0:

/home/eric/usr/perlbrew/perls/perl-5.14.0t/lib/site_perl/5.14.0/i686-linux-thread-multi
    /home/eric/usr/perlbrew/perls/perl-5.14.0t/lib/site_perl/5.14.0

/home/eric/usr/perlbrew/perls/perl-5.14.0t/lib/5.14.0/i686-linux-thread-multi
    /home/eric/usr/perlbrew/perls/perl-5.14.0t/lib/5.14.0
    .


Environment for perl 5.14.0:
    HOME=/home/eric
    LANG=en_US.UTF-8
    LANGUAGE=
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)

PATH=/home/eric/usr/perlbrew/bin:/home/eric/usr/perlbrew/perls/perl-5.14.0t/bin:.:/home/eric/bin:/usr/local/bin:/usr/bin:/bin:/usr/games
    PERLBREW_HOME=/home/eric/.perlbrew

PERLBREW_PATH=/home/eric/usr/perlbrew/bin:/home/eric/usr/perlbrew/perls/perl-5.14.0t/bin
    PERLBREW_PERL=perl-5.14.0t
    PERLBREW_ROOT=/home/eric/usr/perlbrew
    PERLBREW_VERSION=0.25
    PERL_BADLANG (unset)
    SHELL=/bin/bash

From @tonycoz

On Thu, Sep 08, 2011 at 04​:17​:52PM -0700, Eric Brine wrote​:

When using return type AV* in XS, the typemap wraps the array in a
reference, but leaves the refcount too high.

This is documented in perlxs​:

This is quite useful as it usually improves readability. While
this works fine for an C<SV *>, it's unfortunately not as easy
to have C<AV *> or C<HV *> as a return value. You I<should> be
able to write​:

  AV *
  array()
  CODE​:
  RETVAL = newAV();
  /* do something with RETVAL */
  OUTPUT​:
  RETVAL

But due to an unfixable bug (fixing it would break lots of existing
CPAN modules) in the typemap file, the reference count of the C<AV *>
is not properly decremented. Thus, the above XSUB would leak memory
whenever it is being called. The same problem exists for C<HV *>.

The RT System itself - Status changed from 'new' to 'open'

From @ikegami

On Thu Sep 08 16​:57​:13 2011, tonyc wrote​:

On Thu, Sep 08, 2011 at 04​:17​:52PM -0700, Eric Brine wrote​:

When using return type AV* in XS, the typemap wraps the array in a
reference, but leaves the refcount too high.

This is documented in perlxs​:

This is quite useful as it usually improves readability. While
this works fine for an C<SV *>, it's unfortunately not as easy
to have C<AV *> or C<HV *> as a return value. You I<should> be
able to write​:

AV *
array()
CODE​:
RETVAL = newAV();
/* do something with RETVAL */
OUTPUT​:
RETVAL

But due to an unfixable bug (fixing it would break lots of existing
CPAN modules) in the typemap file, the reference count of the C<AV *>
is not properly decremented. Thus, the above XSUB would leak memory
whenever it is being called. The same problem exists for C<HV *>.

Thanks. Closing ticket.

@ikegami - Status changed from 'open' to 'rejected'

From @cpansprout

I don’t know whether the status of this ticket should change, but see
<http​://perl5.git.perl.org/perl.git/commitdiff/b64f48ffd8>, which
provides alternate, fixed, types.

(Just in case you are reading this some time in the future.)