In perl.git, the branch smoke-me/davem/unwind2 has been created
<http://perl5.git.perl.org/perl.git/commitdiff/f053056b5ed9f9a4beb9a5f6a008c9f64eaab0c9?hp=0000000000000000000000000000000000000000>
at f053056b5ed9f9a4beb9a5f6a008c9f64eaab0c9 (commit)
- Log -----------------------------------------------------------------
commit f053056b5ed9f9a4beb9a5f6a008c9f64eaab0c9
Author: David Mitchell <[email protected]>
Date: Fri May 8 14:46:01 2015 +0100
RT #124156: death during unwinding causes crash
v5.19.3-139-g2537512 changed POPSUB and POPFORMAT so that they also
unwind the relevant portion of the scope stack. This (sensible) change
means that during exception handling, contexts and savestack frames are
popped in lock-step, rather than all the contexts being popped followed by
all the savestack contents.
However, LEAVE_SCOPE() is now called by POPSUB/FORMAT, which can trigger
destructors, tied method calls etc, which themselves may croak. The new
unwinding will see the old sub context still on the context stack and call
POPSUB on it again, leading to double frees etc.
At this late stage in code freeze, the least invasive change is to
use an unused bit in cx->blk_u16 to indicate that POPSUB has already
been called on this context frame.
Sometime later, this whole area of code really needs a thorough overhaul.
The main issue is that if cxstack_ix-- is done too early, then calling
destructors etc can overwrite the current context frame while we're still
using using it; if cxstack_ix-- is done too late, then that stack frame
can end up getting unwound twice.
-----------------------------------------------------------------------
--
Perl5 Master Repository
