develooper Front page | perl.perl5.porters | Postings from July 2005

[perl #16220] malloc segfault with 5.6.1, deleting foreach() loopers

From:
Steve Peters via RT
Date:
July 13, 2005 08:10
Subject:
[perl #16220] malloc segfault with 5.6.1, deleting foreach() loopers
Message ID:
rt-3.0.11-16220-117198.13.0540072270584@perl.org
> [kwilliams - Wed Aug 14 21:35:12 2002]:
> 
> Yo,
> 
> The program below causes a segfault, or in some cases merely an 
> "Attempt to free unreferenced scalar", in 5.6.1 on Mac OS X (and 
> Chip has duplicated it on Debian, I believe).
> 
> ======================================
> #!/usr/bin/perl
> 
> my %hash = map {$_,{}} (1..100);
> 
> foreach my $value (values %hash) {
>    delete_badly(\%hash, $value);
> }
> 
> sub delete_badly {
>    my ($hash, $value) = @_;
>    delete $hash->{1};
> }
> ======================================
> [pe-242:~/bin/test] ken% perl hashbug.pl
> *** malloc[9812]: Deallocation of a pointer not malloced: 
> 0x10b9c; This could be a double free(), or free() called with 
> the middle of an allocated block; Try setting environment 
> variable MallocHelp to see tools to help debug
> ======================================
> 
> 
> It seems that a value from the temporary foreach() list is 
> getting destroyed, then the foreach() reaches that value and bad 
> things happen.  Chip thought that one solution might be to use 
> refcounts on foreach() lists.
> 
>   -Ken

This problem does not occur in recent versions due to the following change.

Change 19316 by rgs@rgs-home on 2003/04/23 19:11:01

	A new fatal error :
	Subject: [PATCH] Perl_croak("Use of freed value in iteration")
	From: Dave Mitchell <davem@fdgroup.com>
	Date: Mon, 21 Apr 2003 13:19:50 +0100
	Message-ID: <20030421121950.GB18189@fdgroup.com>
	Message-ID: <20030421125433.GC18189@fdgroup.com>

This ticket discuesses whether this change should go into the 5.6-maint
branch.  From my testing, the coredump still occurs in Perl-5.6.2.  I'll
let the people with the commit privledges decide whether this should go
into the 5.6-maint branch or whether this ticket can be closed as is.  



nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About