Bug#503832: panic: attempt to copy freed scalar NOT FIXED
Hi Raphael, On Fri, Oct 16, 2009 at 11:35:38AM +0200, Raphael Hertzog wrote: Ok, Dieter released 2.8.25 and I just uploaded an updated package to Debian. Do you still have the same problem with that version ? Cheers, -- Raphaël Hertzog Sorry for the delay, I wasn't keen on trying this on my production system. I've installed the latest on a test system (seems to be 2.8.27-1, testing and unstable) and it still exhibits the problem. I don't believe this is a problem in sql-ledger directly, as that seems to be written in pure perl. I suspect a bug in DBI or some other binary being used. .. further, having set DBI_PUREPERL=2 in /etc/apache2/envvars it didn't solve the problem either, so I guess that rules out DBI's binary implementation. -- Richard Mawson Mawson IT Services signature.asc Description: Digital signature
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
Hello, On Wed, 22 Apr 2009, Richard Mawson wrote: I attach the patch used if you want to try separately (without installing the package). I'm afraid this does not fix the problem, the same symptom exists with the patch applied. Ok, Dieter released 2.8.25 and I just uploaded an updated package to Debian. Do you still have the same problem with that version ? Cheers, -- Raphaël Hertzog -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
On Fri, Apr 24, 2009 at 11:17:55AM +0200, Raphael Hertzog wrote: On Thu, 23 Apr 2009, Richard Mawson wrote: 1530 IS-invoice_details(\%myconfig, \%$form); This looks wrong, what happens if you use: S-invoice_details(\%myconfig, $form); $form is a ref %$form is the hash behind the ref \%$form is a new ref of the hash behind the $form ref I agree - this does look wrong, but whether invoice_details is operating on the original ref to form ($form) or a new ref to the same form (\%$form), it should be the same form being operated on. I did in fact change it to exactly* what you suggest and it made no difference to the errors I saw. (* typo s/S/IS/ accepted) I'm not sure that the errors seen should ever be possible to provoke - even with maliciously crafted perl.. I'm getting the feeling this is a bug in the perl binary, but I don't really know. -- Richard Mawson Mawson IT Services signature.asc Description: Digital signature
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
On Thu, 23 Apr 2009, Richard Mawson wrote: 1530 IS-invoice_details(\%myconfig, \%$form); This looks wrong, what happens if you use: S-invoice_details(\%myconfig, $form); $form is a ref %$form is the hash behind the ref \%$form is a new ref of the hash behind the $form ref Cheers, -- Raphaël Hertzog Contribuez à Debian et gagnez un cahier de l'admin Debian Lenny : http://www.ouaza.com/wp/2009/03/02/contribuer-a-debian-gagner-un-livre/ -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
found 503832 2.8.24-1 thanks On Wed, 22 Apr 2009, Richard Mawson wrote: I'm afraid this does not fix the problem, the same symptom exists with the patch applied. :-( I wonder why Dieter sent me a modified version of Form.pm then. Anyway, bug reopened. It's a pity I can't reproduce it on my sql-ledger installation. I wonder if it's template specific. Cheers, -- Raphaël Hertzog Contribuez à Debian et gagnez un cahier de l'admin Debian Lenny : http://www.ouaza.com/wp/2009/03/02/contribuer-a-debian-gagner-un-livre/ -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
On Thu, Apr 23, 2009 at 08:11:20AM +0200, Raphael Hertzog wrote:
It's a pity I can't reproduce it on my sql-ledger installation. I wonder
if it's template specific.
I believe you need to have at least 3 items on an invoice for the bug to show
up, I usually have
4 or 5. I couldn't say if it is template specific, but I suspect the corruption
occurs before the
template is applied to the data (from my brief investigation where I printed
out the elements of
the corrupt array).
Are you trying a recreate with:
a/ pdf invoice
b/ = 3 line items
c/ does the template contain \textbf{Pos} \textbf{Number}
\textbf{Description} \textbf{Delivery Date} \textbf{Qt'y}
?
--
Richard Mawson
Mawson IT Services
signature.asc
Description: Digital signature
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
On Thu, 23 Apr 2009, Richard Mawson wrote:
On Thu, Apr 23, 2009 at 08:11:20AM +0200, Raphael Hertzog wrote:
It's a pity I can't reproduce it on my sql-ledger installation. I wonder
if it's template specific.
Are you trying a recreate with:
a/ pdf invoice
yes (or postscript rather, but it also uses the .tex template)
b/ = 3 line items
yes
c/ does the template contain \textbf{Pos} \textbf{Number}
\textbf{Description} \textbf{Delivery Date} \textbf{Qt'y}
no, i have something similar but translated but why would this be relevant?
Cheers,
--
Raphaël Hertzog
Contribuez à Debian et gagnez un cahier de l'admin Debian Lenny :
http://www.ouaza.com/wp/2009/03/02/contribuer-a-debian-gagner-un-livre/
--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
On Thu, Apr 23, 2009 at 12:25:41PM +0200, Raphael Hertzog wrote:
c/ does the template contain \textbf{Pos} \textbf{Number}
\textbf{Description} \textbf{Delivery Date} \textbf{Qt'y}
no, i have something similar but translated but why would this be relevant?
I'm sorry, I cut and pasted the wrong thing (..and that was taken from
debugging Form.pm rather than the
latex template), it was supposed to be:
%foreach number%
%runningnumber% %number% %description% %deliverydate%
%qty% %unit% %sellprice% %discountrate% %linetotal% \\
%end number%
I don't think it is relevant, but I believe it is in the processing of this
that the runningnumber
field gets expanded by format_line(), and it gets this expansion wrong. As
mentioned earlier, it seems to
expect the elements of this array (@{$self-{runningnumber}}) to be the numbers
(1..items), but it's
corrupt.
In fact, using Data::Dumper to print the contents of this to a file gives
similar results to the subject of
this bug, so its like elements of this array refers to something already
'free'd by perl.
Further, attempting to access these elements at the start of
Form::parse_template() shows the corruption
(so the latex has nothing to do with it).
The caller is bin/mozilla/io.pl:1733 - and I see the corruption occurs during
the call to IS-invoice_details
at io.pl:1530 by doing a binary chop.
This is not corrupt at the end of the invoice_details() sub, but is corrupt as
soon as we return to io.pl.
I've run out of time to look any further right now so I'll try to dig into it
further later.
--
Richard Mawson
Mawson IT Services
signature.asc
Description: Digital signature
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
On Thu, Apr 23, 2009 at 02:09:15PM +0100, Richard Mawson wrote:
The caller is bin/mozilla/io.pl:1733 - and I see the corruption occurs during
the call to IS-invoice_details
at io.pl:1530 by doing a binary chop.
This is not corrupt at the end of the invoice_details() sub, but is corrupt
as soon as we return to io.pl.
in io.pl, SL::IS is used to update $form with amongst other things
$form-{'taxrates'} and $form-{'runningnumber'}
here:
1529 if ($form-{vc} eq 'customer') {
1530 IS-invoice_details(\%myconfig, \%$form);
1531 } else {
Jumping into SL::IS::invoice_details() and looking at these structures just
before returning from the sub,
$form-{'runningnumber'} is fine:
$VAR1 = [
1,
2,
3,
4
];
but $form-{'taxrates'} is corrupt:
$VAR1 = [
2,
3,
4,
undef
];
(expecting this to be [15,15,15,15] )
and when we return from invoice_details(), both are corrupt - one having refs
to the first!:
'runningnumber' = [
1,
'$VAR1-{\'runningnumber\'}',
undef,
\$VAR1-{'taxbaseinclusive'}[0]
],
'taxrates' = [
${\$VAR1-{'runningnumber'}[1]},
${\$VAR1-{'runningnumber'}[2]},
\$VAR1-{'taxbaseinclusive'}[0],
\$VAR1-{'runningnumber'}[2]
],
I can't explain this.. and the corruption is not the same every time.. but
while investigating I have
seen errors such as:
Attempt to free unreferenced scalar: SV 0x88440c0, Perl interpreter: 0x817b008
at SL/IS.pm line 336.
Attempt to free unreferenced scalar: SV 0x8859378, Perl interpreter: 0x817b008
at SL/IS.pm line 336.
Attempt to free unreferenced scalar: SV 0x884a878, Perl interpreter: 0x817b008
at SL/IS.pm line 336.
Attempt to free unreferenced scalar: SV 0x8856350, Perl interpreter: 0x817b008
at SL/IS.pm line 388.
(IS.pm was modified for debug, so these are really lines 325 and 377
respectively in the unmodified code.)
Do we have a perl bug here?
--
Richard Mawson
Mawson IT Services
signature.asc
Description: Digital signature
Bug#503832: panic: attempt to copy freed scalar NOT FIXED
On Tue, Apr 21, 2009 at 10:02:52AM +0200, Raphael Hertzog wrote: Hello, it should be fixed with the version 2.8.24-1 that I will upload to sid (unstable) in a few minutes. Please tell me if the problem is fixed, if yes, I might try to get it fixed in stable as well. I attach the patch used if you want to try separately (without installing the package). Cheers, -- Raphaël Hertzog I'm afraid this does not fix the problem, the same symptom exists with the patch applied. I see that this patch does fix a 'warning' - that is that $i was redeclared at line 656 where it had been first declared in that scope at line 594, however $i was not (and is still not) used again in that scope. The patch doesn't actually solve any real problem as far as I can tell. --- Error! panic: attempt to copy freed scalar 8805188 to 8233ee8 at SL/Form.pm line 984. --- -- Richard Mawson Mawson IT Services signature.asc Description: Digital signature
