In perl.git, the branch smoke-me/rjbs/refcnt-fix-124181 has been created
<http://perl5.git.perl.org/perl.git/commitdiff/f1d93e1c7673af18a9382e5aed4e12591dc3b749?hp=0000000000000000000000000000000000000000>
at f1d93e1c7673af18a9382e5aed4e12591dc3b749 (commit)
- Log -----------------------------------------------------------------
commit f1d93e1c7673af18a9382e5aed4e12591dc3b749
Author: Daniel Dragan <[email protected]>
Date: Sat May 9 23:46:11 2015 -0400
fix #124181 double free/refcnt problems in IO types in typemap
commit 50e5165b96 "stop T_IN/OUT/INOUT/STDIO typemaps leaking" changed
newRV to newRV_noinc, but the GV * returned by newGVgen() is owned by the
package tree, like the SV * returned by get_sv(). Now when the RV to GV is
freed on mortal stack, the GV * in the package tree is freed, and now there
is a freed GV * in the package tree, if you turn on "PERL_DESTRUCT_LEVEL=2"
(and perhaps DEBUGGING is needed too), the package tree is destroyed SV *
by SV *, and perl will eventually warn with
"Attempt to free unreferenced scalar" which a very bad panic type warning.
Also fix the problem, that if this OUTPUT: type is being used for an
incoming arg, not the outgoing RETVAL arg, you can't assign a new SV*
ontop of the old one, that only works for perl stack return args, so
replace "$arg = &PL_sv_undef;" with "sv_setsv($arg, &PL_sv_undef);" if its
not RETVAL, this way OUTPUT on incoming args also works if it goes down the
error path. For efficiency, in a RETVAL siutation, let the undef original
SV* in $arg which is typically obtained from sv_newmortal() by xsubpp pass
through if we error out.
Also for efficiency, if it is RETVAL (which is more common) dont do the
sv_setsv/SvREFCNT_dec_NN stuff (2 function calls), just mortalize
(1 function call) the ex-temp RV and arrange for the RV to wind up on
perl stack.
Also, the GV * already knows what HV * stash it belongs to, so avoid the
stash lookup done by gv_stashpv() and just use GvSTASH which are simple
pointer derefs.
M lib/ExtUtils/typemap
commit 3cec943106065dbf16d172b0d14125b53590979e
Author: Daniel Dragan <[email protected]>
Date: Sun May 10 11:36:05 2015 -0400
add test that fails for #124181 to Typemap.t
These tests will either fail with harness, and randomly SEGV for
me, which is intentional since they are testing memory
corruption.
M ext/XS-Typemap/Typemap.pm
M ext/XS-Typemap/Typemap.xs
M ext/XS-Typemap/t/Typemap.t
-----------------------------------------------------------------------
--
Perl5 Master Repository
