Bug#826563: perl: Apparent regression in TryCatch with stable update

[Dominic Hargreaves]

On Mon, Jun 06, 2016 at 04:15:30PM +0300, Niko Tyni wrote:
> On Mon, Jun 06, 2016 at 02:36:10PM +0200, Guillem Jover wrote:
> > Package: perl
> > Version: 5.20.2-3+deb8u5
> > Severity: serious
> > Control: affects -1 libtrycatch-perl
> 
> > We've noticed some code using the TryCatch module (libtrycatch-perl
> > package) that stopped working after the stable update. Setting as
> > serious as this looks like a regression for code that used to work,
> > and for which I don't see anything supposedly wrong with it (?), which
> > follows the documented pattern. Here's a small reproducer showing the
> > problem:
> 
> Thanks for the report. The libtrycatch-perl test suite fails now,
> as does the one in libdevel-declare-perl.
> 
> The issue seems to be in libdevel-declare-perl:
>  https://rt.perl.org/Public/Bug/Display.html?id=123865
> 
> I've tested that applying the patch there to libdevel-declare-perl makes
> your test script work again, and makes the libtrycatch-perl test suite
> pass again too.

Thanks Niko for analysis. The sequence of events went like this:

1) a commit (which fixed a segfault, but broke compatibility) was
   committed to the upstream development branch
2) upstream testing detected the issue in Devel::Declare, and a new
   version was released to CPAN fixing the problem.
3) the fix was backported to maint-5.20, and in the process of that
   backporting, the knowledge that there was a known issue was lost.

The general feeling on IRC was that point release updates should indeed
avoid breaking old versions of libraries on CPAN, and that a known
issue should have been included in the perldelta. This will be added
to the release managers guide in future.

In hindsight, it's obvious that Debian's testing of this update wasn't
sufficient either. Such breaking changes in perl stable updates are,
I believe, exceedingly rare, but equally we had not attempted a wholesale,
or near-wholesale update in Debian stable before, and the breakage
wasn't reported in any real-world testing using the stable update
installed from source. In future, we should perform similar automated
testing against jessie-proposed-updates as we do in experimental when
a new major version of perl is introduced.

My plan is:

1) submit a new version of libdevel-declare-perl for immediate
   inclusion in stable-updates.
2) kick off a test rebuild of packages using perl to catch any issues
   in this update (at least those which we can catch by package builds
   and test suites).
3) document this in the perl maintenance notes on the wiki for future
   reference

I should be able to do at least the first two of these this evening.

Thanks and apologies.
Dominic.