develooper Front page | perl.perl5.porters | Postings from July 2009

Re: [perl #66110] Perl debugger runs out of memory, hangs orsegfaults on XML::Parser::Lite

Thread Previous | Thread Next
From:
Bram
Date:
July 25, 2009 04:22
Subject:
Re: [perl #66110] Perl debugger runs out of memory, hangs orsegfaults on XML::Parser::Lite
Message ID:
20090725132221.gb4jm811c4wkg8s0@horde.wizbit.be
> Avar mailed p5p in   
> 51dd1af80807190107h30b8626ct6d4d0a825abe4b3b@mail.gmail.com
> http://www.xray.mpe.mpg.de/mailing-lists/perl5-porters/2008-07/msg00382.html
>
> perl 5.10 and blead will do various combinations of running of of
> memory, hanging or segfaulting when running on a program using
> XML::Parser::Lite, attached is a stripped down version of X::P::L
> which demonstrates the problem:
>
>
> Dave notes:
>
> possibly a 5.10.0 regression
>


Some more debugging (and trimming perl5db.pl to 19 lines) revealed the  
problem.

In perl5db.pl in sub sub:

http://perl5.git.perl.org/perl.git/blob/85bdf03b25729816eedfea55a7f2c32c4bb80fba:/lib/perl5db.pl
3650         if ($sub =~ /^threads::new$/ && $ENV{PERL5DB_THREADED}) {
3651                 print "creating new thread\n";
3652         }


The trimmed test case from some earlier debugging:

*c = sub {};
'' =~ m/(?{ c() })/;


What happens:
- c() is called inside a regex.
- DB::sub is called
- DB::sub starts a new regex

The end result is that a new regex is being executed inside a regex  
and the regex engine can't handle that.


This also means it is reproduciable without the debugger:

#!/usr/bin/perl -l

print $];
*c = sub { "foo" =~ m/bar/ };
sub parse_re {
   $_[0] =~ m{(?{ c() })};
}
parse_re();
__END__
5.011000
Segmentation fault


(Of course since it is a memory corruption it may not be reproducible  
on every system).


I'll submit a patch and a test case later today.


Best regards,

Bram




Thread Previous | Thread Next


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About