Bug#871562: perl-base: Perl binary crashes with SIGSEGV when used for SVN access in "git svn" tests

Alex Riesen alexander.riesen at cetitec.com
Wed Aug 9 09:16:03 UTC 2017


Package: perl-base
Version: 5.24.1-3+deb9u1
Severity: normal

Dear Maintainer,

when I run the test suite (Git (the VCS, master branch), the perl binary
sometimes crashes in one of its tests. I used the commands below to reproduce
the problem (just let it run, it'll crash eventually):

$ git clone git://git.kernel.org/pub/scm/git/git.git && cd git
$ make USE_LIBPCRE2=YesPlease   (requires curl-dev and openssl-dev, I think...)
$ cd t (the test suite)
$ ulimit -c unlimited
$ rm -rf 'trash directory.t9128-git-svn-cmd-branch'
$ while ./t9128-git-svn-cmd-branch.sh -d -i
do
  echo; echo
  rm -rf 'trash directory.t9128-git-svn-cmd-branch'
done
...
not ok 3 - git svn branch tests
#	
#		git svn branch a &&
#		base=$(git rev-parse HEAD:) &&
#		test $base = $(git rev-parse remotes/origin/a:) &&
#		git svn branch -m "created branch b blah" b &&
#		test $base = $(git rev-parse remotes/origin/b:) &&
#		test_must_fail git branch -m "no branchname" &&
#		git svn branch -n c &&
#		test_must_fail git rev-parse remotes/origin/c &&
#		test_must_fail git svn branch a &&
#		git svn branch -t tag1 &&
#		test $base = $(git rev-parse remotes/origin/tags/tag1:) &&
#		git svn branch --tag tag2 &&
#		test $base = $(git rev-parse remotes/origin/tags/tag2:) &&
#		git svn tag tag3 &&
#		test $base = $(git rev-parse remotes/origin/tags/tag3:) &&
#		git svn tag -m "created tag4 foo" tag4 &&
#		test $base = $(git rev-parse remotes/origin/tags/tag4:) &&
#		test_must_fail git svn tag -m "no tagname" &&
#		git svn tag -n tag5 &&
#		test_must_fail git rev-parse remotes/origin/tags/tag5 &&
#		test_must_fail git svn tag tag1
#	
$ gdb /usr/bin/perl './trash directory.t9128-git-svn-cmd-branch/core'
...
(gdb) bt full
#0  0x000000b2ce983b10 in Perl_sv_clear (my_perl=my_perl at entry=0xb2cefdf010, orig_sv=orig_sv at entry=0xb2d00807e8) at sv.c:6582
        stash = <optimized out>
        type = 9
        sv_type_details = <optimized out>
        iter_sv = 0x0
        next_sv = 0x0
        sv = 0xb2d00807e8
        hash_index = 0
#1  0x000000b2ce983da0 in Perl_sv_free2 (my_perl=my_perl at entry=0xb2cefdf010, sv=sv at entry=0xb2d00807e8, rc=<optimized out>) at sv.c:6954
No locals.
#2  0x000000b2ce8fd8a5 in S_SvREFCNT_dec (sv=0xb2d00807e8, my_perl=0xb2cefdf010) at inline.h:166
        rc = <optimized out>
#3  Perl_gp_free (my_perl=my_perl at entry=0xb2cefdf010, gv=gv at entry=0xb2d0080938) at gv.c:2568
        file_hek = <optimized out>
        hv = <optimized out>
        io = 0xb2d00807e8
        form = 0x0
        sv = <optimized out>
        cv = 0x0
        av = 0x0
        gp = <optimized out>
        attempts = 100
#4  0x000000b2ce983b74 in Perl_sv_clear (my_perl=my_perl at entry=0xb2cefdf010, orig_sv=orig_sv at entry=0xb2d00e92c0) at sv.c:6585
        stash = <optimized out>
        type = 9
        sv_type_details = <optimized out>
        iter_sv = 0x0
        next_sv = 0x0
        sv = 0xb2d0080938
        hash_index = 0
#5  0x000000b2ce983da0 in Perl_sv_free2 (my_perl=my_perl at entry=0xb2cefdf010, sv=0xb2d00e92c0, rc=<optimized out>) at sv.c:6954
No locals.
#6  0x000000b2ce972ad2 in S_SvREFCNT_dec (sv=<optimized out>, my_perl=0xb2cefdf010) at inline.h:166
        rc = <optimized out>
#7  S_hv_delete_common (hash=<optimized out>, d_flags=68, k_flags=<optimized out>, klen=<optimized out>, key=<optimized out>, keysv=<optimized out>, hv=0xb2cefdf010, my_perl=0xb2d007db68) at hv.c:1279
        xhv = <optimized out>
        first_entry = <optimized out>
        stash = <optimized out>
        entry = 0xb2d00e4828
        keysv_hek = <optimized out>
        mro_changes = <optimized out>
        sv = <optimized out>
        oentry = 0xb2d007db68
        is_utf8 = false
        masked_flags = <optimized out>
        gv = <optimized out>
#8  Perl_hv_common (my_perl=my_perl at entry=0xb2cefdf010, hv=hv at entry=0xb2cfff4e10, keysv=<optimized out>, key=<optimized out>, key at entry=0x0, klen=<optimized out>, klen at entry=0, flags=<optimized out>, flags at entry=0, action=68, val=0x0, hash=<optimized out>) at hv.c:397
        xhv = <optimized out>
        entry = <optimized out>
        oentry = <optimized out>
        sv = <optimized out>
        is_utf8 = false
        masked_flags = <optimized out>
        return_svp = 0
        keysv_hek = 0x0
#9  0x000000b2ce9aca1f in Perl_pp_delete (my_perl=0xb2cefdf010) at pp.c:5061
        _p = <optimized out>
        sv = <optimized out>
        mark = 0xb2cf00fed8
        origmark = 0
        hv = 0xb2cfff4e10
        hvtype = <optimized out>
        sp = 0xb2cf00fee0
        gimme = 1 '\001'
        discard = 4
#10 0x000000b2ce976916 in Perl_runops_standard (my_perl=0xb2cefdf010) at run.c:41
        op = <optimized out>
#11 0x000000b2ce8f4aee in Perl_call_sv (my_perl=my_perl at entry=0xb2cefdf010, sv=0xb2cf546fd0, flags=flags at entry=45) at perl.c:2812
        myop = {
          op_next = 0x0, 
          op_sibling = 0x0, 
          op_ppaddr = 0x0, 
          op_targ = 0, 
          op_type = 0, 
          op_opt = 0, 
          op_slabbed = 0, 
          op_savefree = 0, 
          op_static = 0, 
          op_folded = 0, 
          op_moresib = 0, 
          op_spare = 0, 
          op_flags = 65 'A', 
          op_private = 0 '\000', 
          op_first = 0x0, 
          op_other = 0x7fffe7a15bf0
        }
        method_op = {
          op_next = 0x7fffe7a15c78, 
          op_sibling = 0x0, 
          op_ppaddr = 0x0, 
          op_targ = 6475432755568752640, 
          op_type = 0, 
          op_opt = 0, 
          op_slabbed = 0, 
          op_savefree = 0, 
          op_static = 0, 
          op_folded = 0, 
          op_moresib = 0, 
          op_spare = 0, 
          op_flags = 0 '\000', 
          op_private = 0 '\000', 
          op_u = {
            op_first = 0xb2cf5470a8, 
            op_meth_sv = 0xb2cf5470a8
          }, 
          op_rclass_targ = 767976927248
        }
        oldmark = 0
        retval = 0
        oldcatch = <optimized out>
        ret = <optimized out>
        oldop = 0xb2cff23668
        cur_env = {
          je_prev = 0xb2cefdf390, 
          je_buf = {{
              __jmpbuf = {767976927248, -559631050163250190, 767982596048, 1, 767976927248, 767976927248, -559631050173735950, 477831098733272050}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {767992182000, 767976927248, 8, 767992182000, 0, 140692364836233, 767992736640, 767969944821, 767976927248, 767976927552, 767976927600, 6475432755568752640, 767976927576, 767979441864, 767993794064, 767994788600}
              }
            }}, 
          je_ret = 0, 
          je_mustcatch = false, 
          je_old_delaymagic = 0
        }
#12 0x000000b2ce983055 in S_curse (my_perl=my_perl at entry=0xb2cefdf010, sv=sv at entry=0xb2cfff4e10, check_refcnt=check_refcnt at entry=true) at sv.c:6853
        destructor = <optimized out>
        meta = <optimized out>
        sp = <optimized out>
        stash = <optimized out>
#13 0x000000b2ce983a60 in Perl_sv_clear (my_perl=my_perl at entry=0xb2cefdf010, orig_sv=orig_sv at entry=0xb2cfff4e10) at sv.c:6457
        stash = <optimized out>
        type = 12
        sv_type_details = <optimized out>
        iter_sv = 0x0
        next_sv = 0x0
        sv = 0xb2cfff4e10
        hash_index = 0
#14 0x000000b2ce983da0 in Perl_sv_free2 (my_perl=0xb2cefdf010, sv=0xb2cfff4e10, rc=<optimized out>) at sv.c:6954
No locals.
#15 0x000000b2ce981eab in S_visit (my_perl=my_perl at entry=0xb2cefdf010, f=f at entry=0xb2ce983fc0 <do_clean_objs>, flags=flags at entry=2048, mask=mask at entry=2048) at sv.c:476
        svend = 0xb2cf0477d0
        sv = 0xb2cf047440
        sva = 0xb2cf0467e0
        visited = 1512
#16 0x000000b2ce984156 in Perl_sv_clean_objs (my_perl=my_perl at entry=0xb2cefdf010) at sv.c:627
        olddef = <optimized out>
        olderr = <optimized out>
#17 0x000000b2ce8f76e8 in perl_destruct (my_perl=0xb2cefdf010) at perl.c:816
        destruct_level = 0 '\000'
        hv = <optimized out>
        i = <optimized out>
#18 0x000000b2ce8d5905 in main (argc=<optimized out>, argv=<optimized out>, env=<optimized out>) at perlmain.c:127
        exitstatus = <optimized out>
        i = <optimized out>
(*gdb) print *((GV *)sv)
$1 = {
  sv_any = 0xb2d00f53d0, 
  sv_refcnt = 0, 
  sv_flags = 32777, 
  sv_u = {
    svu_pv = 0x0, 
    svu_iv = 0, 
    svu_uv = 0, 
    svu_nv = 0, 
    svu_rv = 0x0, 
    svu_rx = 0x0, 
    svu_array = 0x0, 
    svu_hash = 0x0, 
    svu_gp = 0x0, 
    svu_fp = 0x0
  }
}
(gdb) l
6577			SvREFCNT_dec(LvTARG(sv));
6578		    if (isREGEXP(sv)) goto freeregexp;
6579	            /* FALLTHROUGH */
6580		case SVt_PVGV:
6581		    if (isGV_with_GP(sv)) {
6582			if(GvCVu((const GV *)sv) && (stash = GvSTASH(MUTABLE_GV(sv))) <---
6583			   && HvENAME_get(stash))
6584			    mro_method_changed_in(stash);
6585			gp_free(MUTABLE_GV(sv));
6586			if (GvNAME_HEK(sv))
(gdb) q

The macro GvCVu tries to resolve sv.sv_u.svu_gp to access gp_cvgen, which
fails on account svu_gp being NULL.

I had to recompile the perl package locally to get the details backtrace: I
failed to find the debug symbols of the perl package here:
deb http://debug.mirrors.debian.org/debian-debug/ stretch-debug main non-free contrib

The SIGSEGV happens with the binaries installed from the ftp.de.debian.olg all
the same, the backtrace looks similar:

    Program terminated with signal SIGSEGV, Segmentation fault.
    #0  0x000000868ee1f335 in Perl_PerlIO_error ()
    (gdb) bt
    #0  0x000000868ee1f335 in Perl_PerlIO_error ()
    #1  0x000000868edf8500 in Perl_io_close ()
    #2  0x000000868edf87ad in Perl_do_close ()
    #3  0x000000868ede51c7 in Perl_pp_close ()
    #4  0x000000868ed966c6 in Perl_runops_standard ()
    #5  0x000000868ed14aee in Perl_call_sv ()
    #6  0x000000868eda2e05 in ?? ()
    #7  0x000000868eda3810 in Perl_sv_clear ()
    #8  0x000000868eda3b50 in Perl_sv_free2 ()
    #9  0x000000868eda1c5b in ?? ()
    #10 0x000000868eda3f06 in Perl_sv_clean_objs ()
    #11 0x000000868ed176e8 in perl_destruct ()
    #12 0x000000868ecf5905 in main ()


Additional information (libsvn-perl):

  Origin: Debian:9.1/stable [amd64]
  Origin URI: http://ftp.de.debian.org/debian/pool/main/s/subversion/libsvn-perl_1.9.5-1_amd64.deb
  --\ Versions of libsvn-perl (3)
iiA  1.9.5-1

Additional information (libsvn1):

  Origin: Debian:9.1/stable [amd64]
  Origin URI: http://ftp.de.debian.org/debian/pool/main/s/subversion/libsvn1_1.9.5-1_amd64.deb
  --\ Versions of libsvn1 (3)
i A  1.9.5-1


-- System Information:
Debian Release: 9.1
  APT prefers stable-debug
  APT policy: (500, 'stable-debug'), (500, 'proposed-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.12.4 (SMP w/8 CPU cores; PREEMPT)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages perl-base depends on:
ii  dpkg   1.18.24
ii  libc6  2.24-11+deb9u1

perl-base recommends no packages.

Versions of packages perl-base suggests:
ii  perl  5.24.1-3+deb9u1

-- no debconf information

---
Diese E-Mail wurde von Avast Antivirus-Software auf Viren geprüft.
https://www.avast.com/antivirus




More information about the Perl-maintainers mailing list