Bug#754901: libapache2-mod-perl2: breaks with gcc-4.9

[Niko Tyni]

On Mon, Aug 04, 2014 at 12:13:42PM +0300, Niko Tyni wrote:
> On Tue, Jul 15, 2014 at 11:31:52PM +0200, Matthias Klose wrote:
> > Am 15.07.2014 20:48, schrieb Niko Tyni:
> > > Package: libapache2-mod-perl2
> > > Version: 2.0.8+httpd24-r1449661-6
> > > Severity: important
> > > X-Debbugs-Cc: gcc-4.9 at packages.debian.org
> > > Tags: help
> > > 
> > > As seen in #754308, the libapache2-mod-perl2 build segfaults in the
> > > test suite when built with gcc 4.9. We have worked around that in
> > > 2.0.8+httpd24-r1449661-7 by building with 4.8, but that's not a long
> > > term solution.
> > > 
> > > Cc'ing the gcc maintainers. Should building with gcc-4.8 be considered
> > > release critical for jessie?
> > 
> > I would prefer, if you could check with 4.9 and lowered optimization options
> > first, -O1 or -O0 (or -O2 if the package builds with -O3).  If this succeeds, we
> > need to find out if it's undefined source code, or a bug in the compiler.
> 
> It works at -O0, modulo #756989 (which happens with gcc-4.8 too
> but confused me into thinking this was more than just an optimizer
> regression.)
> 
> Haven't bisected the offending source file yet.

It's src/modules/perl/modperl_env.c, and I've narrowed it down to
modperl_env_table_populate().

This is in line with the crash backtrace:

  #0  0x00007f7198333513 in Perl_sv_magic (my_perl=0x7f719d559f60, sv=0x7f719bd984c6 <__GI_getenv+22>, obj=0x0, 
      how=116, name=0x0, namlen=0) at sv.c:5414
  #1  0x00007f7198622772 in modperl_env_table_populate (my_perl=0x7f719d559f60, 
      table=0x7f719bd984c6 <__GI_getenv+22>) at modperl_env.c:132
  #2  0x00007f7198622f6a in modperl_env_configure_server (my_perl=my_perl at entry=0x7f719d559f60, 
      p=p at entry=0x7f719cc01028, s=s at entry=0x7f719cbd2ec8) at modperl_env.c:239
  #3  0x00007f7198611260 in modperl_boot (my_perl=0x7f719d559f60, data=<optimized out>) at mod_perl.c:104
  #4  0x00007f7198355be9 in Perl_leave_scope (my_perl=0x7f719d559f60, base=-1680243514) at scope.c:1097
  #5  0x00007f7198356685 in Perl_pop_scope (my_perl=my_perl at entry=0x7f719d559f60) at scope.c:110
  #6  0x00007f71982b808c in S_parse_body (xsinit=0x7f7198611210 <modperl_xs_init>, env=0x0, 
      my_perl=<optimized out>) at perl.c:2333
  #7  perl_parse (my_perl=my_perl at entry=0x7f719d559f60, xsinit=xsinit at entry=0x7f7198611210 <modperl_xs_init>, 
      argc=<optimized out>, argv=argv at entry=0x7f719caba578, env=env at entry=0x0) at perl.c:1626
  #8  0x00007f7198611920 in modperl_startup (s=s at entry=0x7f719cbd2ec8, p=p at entry=0x7f719cc01028) at mod_perl.c:255
  #9  0x00007f71986118b0 in modperl_startup (s=s at entry=0x7f719cbd2ec8, p=p at entry=0x7f719cc01028) at mod_perl.c:207
  #10 0x00007f7198611ca5 in modperl_init (base_server=base_server at entry=0x7f719cbd2ec8, p=p at entry=0x7f719cc01028)
      at mod_perl.c:458
  #11 0x00007f7198611dfb in modperl_hook_init (pconf=0x7f719cc01028, plog=<optimized out>, ptemp=<optimized out>, 
      s=0x7f719cbd2ec8) at mod_perl.c:631
  #12 0x00007f7198616532 in modperl_cmd_load_module (parms=0x7fff20dad130, mconfig=0x7f719cbb44a0, 
      arg=0x7f719cb78a48 "TestDirective::perlloadmodule7") at modperl_cmd.c:690
  #13 0x00007f719cc641ae in ?? ()
  #14 0x00007f719cc6687f in ap_walk_config ()
  #15 0x00007f719cc67a1d in ap_process_config_tree ()
  #16 0x00007f719cc44e4d in main ()
  
Line 132 is 
        MP_ENV_HV_STORE_TABLE_ENTRY(hv, elts[i]);
which expands to
        (void)( { I32 klen = strlen(elts[i].key); SV **svp = ((SV**) Perl_hv_common_key_len(my_perl, (hv),(elts[i].key),(klen),((0)) ? (0x20 | 0x10) : 0x20,((void *)0),0)); if (svp) { Perl_sv_setpv(my_perl, *svp,elts[i].val); } else { SV *sv = Perl_newSVpv(my_perl, elts[i].val,0); (void)((SV**) Perl_hv_common_key_len(my_perl, (hv),(elts[i].key),(klen),(0x04|0x20),(sv),((0)))); Perl_sv_magic(my_perl, sv,(SV *)((void *)0),'e',elts[i].key,klen); svp = &sv; } if (0) modperl_trace(__func__, "$ENV{%s} = \"%s\";", elts[i].key, elts[i].val); (void)({ if(((my_perl->Itainting))){Perl_sv_magic(my_perl, (*svp),((void *)0),'t',((void *)0),0);} }); } );;

The crashing Perl_sv_magic() call is the later one (how==116=='t').

I'm now working on a standalone test case but it's not very easy.
Any help is appreciated.
-- 
Niko Tyni   ntyni at debian.org