Bug#723805: perl: Seg faults sometimes (presumably due to "use threads;")

Fri Sep 20 08:38:53 UTC 2013

On Fri, Sep 20, 2013 at 01:09:39AM +0200, Niels Thykier wrote:
> Package: perl
> Version: 5.18.1-3
> Severity: normal

> I am experiencing a regular segmentation faul in perl when running the
> Lintian test suite.  It appears to be our test runner that seg. faults
> and does so only at the "end".

Thanks for the report. I can reproduce this.

> The test runner uses "threads", which is probably why it is the only
> script in the Lintian code base that seems to make perl seg. fault.  Below
> is the output from gdb and a back trace.

> $ gdb --args perl t/runtests --dump-logs -k -j 8 t /tmp/lintian-tests deb-format-wrong-order

(Somebody is going to have to distill a smaller test case from this.
 Not sure when I have the time myself.)

FWIW valgrind and debugperl (from perl-debug) give pretty much the same
backtrace:

==30030== Memcheck, a memory error detector
==30030== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==30030== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==30030== Command: debugperl t/runtests --dump-logs -k -j 8 t /tmp/lintian-tests deb-format-wrong-order
==30030== 
Package tests (debs):
Running deb-format-wrong-order... building... testing... ok.
==30030== Invalid read of size 4
==30030==    at 0x4E3C6B: Perl_hv_common (hv.c:353)
==30030==    by 0x4E573E: Perl_hv_common_key_len (hv.c:335)
==30030==    by 0xA1C93E9: glob_ophook (Glob.xs:324)
==30030==    by 0x422A3C: Perl_op_free (op.c:716)
==30030==    by 0x422A5E: Perl_op_free (op.c:722)
==30030==    by 0x422A5E: Perl_op_free (op.c:722)
==30030==    by 0x485546: Perl_cv_undef (pad.c:363)
==30030==    by 0x5097B1: Perl_sv_clear (sv.c:6165)
==30030==    by 0x50A3EF: Perl_sv_free2 (sv.c:6583)
==30030==    by 0x54BD12: Perl_leave_scope (inline.h:73)
==30030==    by 0x44260F: perl_destruct (perl.c:562)
==30030==    by 0x41F462: main (perlmain.c:125)
==30030==  Address 0x8c77e04 is not stack'd, malloc'd or (recently) free'd
==30030== 
debugperl: hv.c:356: Perl_hv_common: Assertion `((svtype)((hv)->sv_flags & 0xff)) == SVt_PVHV' failed.
==30030== 
[...]

Core was generated by `debugperl t/runtests --dump-logs -k -j 8 t /tmp/lintian-tests deb-format-wrong-'.
Program terminated with signal 6, Aborted.
#0  0x00007f4eebae11e5 in __GI_raise (sig=sig at entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56  ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0  0x00007f4eebae11e5 in __GI_raise (sig=sig at entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007f4eebae4398 in __GI_abort () at abort.c:90
#2  0x00007f4eebada272 in __assert_fail_base (
    fmt=0x7f4eebc17900 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion at entry=0x628048 "((svtype)((hv)->sv_flags & 0xff)) == SVt_PVHV", 
    file=file at entry=0x627908 "hv.c", line=line at entry=356, 
    function=function at entry=0x628523 <__PRETTY_FUNCTION__.16270> "Perl_hv_common") at assert.c:92
#3  0x00007f4eebada322 in __GI___assert_fail (
    assertion=assertion at entry=0x628048 "((svtype)((hv)->sv_flags & 0xff)) == SVt_PVHV", 
    file=file at entry=0x627908 "hv.c", line=line at entry=356, 
    function=function at entry=0x628523 <__PRETTY_FUNCTION__.16270> "Perl_hv_common") at assert.c:101
#4  0x00000000004e56d6 in Perl_hv_common (my_perl=0x980010, hv=0x442ce20, keysv=keysv at entry=0x0, 
    key=key at entry=0x7fffafb0a468 "\020\327\021\001", klen=8, flags=<optimized out>, 
    action=action at entry=68, val=val at entry=0x0, hash=hash at entry=0) at hv.c:356
#5  0x00000000004e573f in Perl_hv_common_key_len (my_perl=my_perl at entry=0x980010, hv=<optimized out>, 
    key=key at entry=0x7fffafb0a468 "\020\327\021\001", klen_i32=klen_i32 at entry=8, action=action at entry=68, 
    val=val at entry=0x0, hash=hash at entry=0) at hv.c:335
#6  0x00007f4ee97df3ea in glob_ophook (my_perl=0x980010, o=0x111d710) at Glob.xs:324
#7  0x0000000000422a3d in Perl_op_free (my_perl=0x980010, o=0x111d710) at op.c:716
#8  0x0000000000422a5f in Perl_op_free (my_perl=0x980010, o=0x111d900) at op.c:722
#9  0x0000000000422a5f in Perl_op_free (my_perl=0x980010, o=0x111e3e0) at op.c:722
#10 0x0000000000485547 in Perl_cv_undef (my_perl=my_perl at entry=0x980010, cv=cv at entry=0x11180a0)
    at pad.c:363
#11 0x00000000005097b2 in Perl_sv_clear (my_perl=my_perl at entry=0x980010, orig_sv=orig_sv at entry=0x11180a0)
    at sv.c:6165
#12 0x000000000050a3f0 in Perl_sv_free2 (my_perl=my_perl at entry=0x980010, sv=sv at entry=0x11180a0, 
    rc=<optimized out>) at sv.c:6583
#13 0x000000000054bd13 in S_SvREFCNT_dec (sv=<optimized out>, my_perl=<optimized out>) at inline.h:73
#14 Perl_leave_scope (my_perl=0x980010, base=<optimized out>) at scope.c:1141
#15 0x000000000054cfd5 in Perl_pop_scope (my_perl=my_perl at entry=0x980010) at scope.c:110
#16 0x0000000000442610 in perl_destruct (my_perl=0x980010) at perl.c:562
---Type <return> to continue, or q <return> to quit---
#17 0x000000000041f463 in main (argc=9, argv=0x7fffafb0a918, env=0x7fffafb0a968) at perlmain.c:125

-- 
Niko Tyni   ntyni at debian.org