5.005_63 `Out of memory' on trivial program with @+ and @-

[p5pRT]

Migrated from rt.perl.org#2050 (status was 'resolved')

Searchable as RT2050$

[p5pRT]

From @mjdominus

Here is fish.pl​:

================================================================

"fish" =~ /fish/;
print @​-;

When I run this, I get​:

================================================================
Out of memory!

If I change @​- to $#-​:

================================================================
135391488

Perl Info

Site configuration information for perl 5.00563:

Configured by mjd at Thu Dec 23 22:24:45 EST 1999.

Summary of my perl5 (revision 5.0 version 5 subversion 63) configuration:
  Platform:
    osname=linux, osvers=2.2.12, archname=i586-linux
    uname='linux plover 2.2.12 #10 mon nov 1 17:02:09 est 1999 i586 unknown '
    config_args='-des'
    hint=previous, useposix=true, d_sigaction=define
    usethreads=undef useperlio=undef d_sfio=undef
    use64bits=undef usemultiplicity=undef
  Compiler:
    cc='cc', optimize='-g', gccversion=egcs-2.90.29 980515 (egcs-1.0.3 release)
    cppflags='-Dbool=char -DHAS_BOOL -I/usr/local/include'
    ccflags ='-Dbool=char -DHAS_BOOL -I/usr/local/include'
    stdchar='char', d_stdstdio=define, usevfork=false
    intsize=4, longsize=4, ptrsize=4, doublesize=8
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    alignbytes=4, usemymalloc=n, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /shlib /lib /usr/lib
    libs=-lndbm -lgdbm -ldbm -ldb -ldl -lm -lc
    libc=/lib/libc-2.0.7.so, so=so, useshrplib=false, libperl=libperl.a
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic'
    cccdlflags='-fpic', lddlflags='-shared -L/usr/local/lib'

Locally applied patches:
    


@INC for perl 5.00563:
    lib
    /usr/local/lib/perl5/5.00563/i586-linux
    /usr/local/lib/perl5/5.00563
    /usr/local/lib/site_perl/5.00562/i586-linux
    /usr/local/lib/site_perl
    .


Environment for perl 5.00563:
    HOME=/home/mjd
    LANG (unset)
    LANGUAGE (unset)
    LD_LIBRARY_PATH=/lib:/usr/lib:/usr/X11R6/lib
    LOGDIR (unset)
    PATH=/home/mjd/bin:/usr/local/bin:/bin:/usr/bin:/usr/X11/bin:/usr/games:/sbin:/usr/sbin:/usr/local/bin/X11:/usr/local/bin/mh:/data/mysql/bin:/home/mjd/TPI/bin:/usr/local/mysql/bin
    PERL_BADLANG (unset)
    SHELL=/bin/bash

[p5pRT]

From [Unknown Contact. See original ticket]

mjd@​plover.com writes​:

"fish" =~ /fish/;
print @​-;

Out of memory!

If I change @​- to $#-​:

================================================================
135391488

I have usemymalloc=n now, but it does not help me reproduce your
problem. I get "0" in both cases.

Ilya

[p5pRT]

From @gsar

On Thu, 27 Jan 2000 15​:37​:06 EST, Ilya Zakharevich wrote​:

mjd@​plover.com writes​:

"fish" =~ /fish/;
print @​-;

Out of memory!
[...]
I have usemymalloc=n now, but it does not help me reproduce your
problem. I get "0" in both cases.

  % gdb ./perl
  (gdb) run -we '"fish" =~ /fish/; print @​-;'
  Starting program​: /l2/src/p5p_repo_view/perlmulti/./perl -we '"fish" =~ /fish/; print @​-;'
  Out of memory!

  Breakpoint 1, Perl_my_exit (my_perl=0x8169f70, status=1) at perl.c​:3244
  Source file is more recent than executable.
  3244 switch (status) {
  (gdb) bt
  #0 Perl_my_exit (my_perl=0x8169f70, status=1) at perl.c​:3244
  #1 0x80b5d3e in Perl_safesysmalloc (size=1073741808) at util.c​:106
  #2 0x80c8343 in Perl_av_extend (my_perl=0x8169f70, av=0x816a940, key=135701757)
  at av.c​:119
  #3 0x8105f07 in Perl_stack_grow (my_perl=0x8169f70, sp=0x816c168, p=0x816c168,
  n=135701629) at scope.c​:62
  #4 0x80ce4bd in Perl_pp_rv2av (my_perl=0x8169f70) at pp_hot.c​:504
  #5 0x80cb7fc in Perl_runops_debug (my_perl=0x8169f70) at run.c​:56
  #6 0x805d87c in S_run_body (my_perl=0x8169f70, args=0xbffff92c) at perl.c​:1236
  #7 0x8105e6f in Perl_vdefault_protect (my_perl=0x8169f70, pcur_env=0xbffff940,
  excpt=0xbffff9f0, body=0x805d670 <S_run_body>, args=0xbffff908) , pcur_env=0xbffff940,
  excpt=0xbffff9f0, body=0x805d670 <S_run_body>) at scope.c​:26
  #9 0x805d317 in perl_run (my_perl=0x8169f70) at perl.c​:1169
  #10 0x8059820 in main (argc=3, argv=0xbffffa24, env=0xbffffa34) at perlmain.c​:53
  (gdb) up
  at scope.c​:45
  #8 0x8105d45 in Perl_default_protect (my_perl=0x8169f70
  (gdb) up
  #2 0x80c8343 in Perl_av_extend (my_perl=0x8169f70, av=0x816a940, key=135701757)
  at av.c​:119
  119 New(2,ary, newmax+1, SV*);
  (gdb) p newmax
  $2 = 268435451
  (gdb) up
  #3 0x8105f07 in Perl_stack_grow (my_perl=0x8169f70, sp=0x816c168, p=0x816c168,
  n=135701629) at scope.c​:62
  62 av_extend(PL_curstack, (p - PL_stack_base) + (n) + 128);
  (gdb) up
  #4 0x80ce4bd in Perl_pp_rv2av (my_perl=0x8169f70) at pp_hot.c​:504
  504 EXTEND(SP, maxarg);
  (gdb) l
  499 }
  500
  501 if (GIMME == G_ARRAY) {
  502 I32 maxarg = AvFILL(av) + 1;
  503 (void)POPs; /* XXXX May be optimized away? */
  504 EXTEND(SP, maxarg);
  505 if (SvRMAGICAL(av)) {
  506 U32 i;
  507 for (i=0; i < maxarg; i++) {
  508 SV **svp = av_fetch(av, i, FALSE);
  (gdb) p maxarg
  $3 = 135701629
  (gdb) p av
  $4 = (AV *) 0x81754f0
  (gdb) p Perl_sv_dump(my_perl,av)
  SV = PVAV(0x816bf24) at 0x81754f0
  REFCNT = 1
  FLAGS = (RMG)
  IV = 0
  NV = 0
  MAGIC = 0x8176148
  MG_VIRTUAL = 0x81692dc
  MG_TYPE = 'D'
  ARRAY = 0x0
  FILL = -1
  MAX = -1
  ARYLEN = 0x0
  FLAGS = (REAL)
  $5 = void

I think av_fill() doesn't know about 'D' magic, as don't many other
functions in av.c.

Sarathy
gsar@​ActiveState.com

[p5pRT]

From [Unknown Contact. See original ticket]

On Thu, Jan 27, 2000 at 01​:03​:56PM -0800, Gurusamy Sarathy wrote​:

On Thu, 27 Jan 2000 15​:37​:06 EST, Ilya Zakharevich wrote​:

mjd@​plover.com writes​:

"fish" =~ /fish/;
print @​-;

Out of memory!

\#3  0x8105f07 in Perl\_stack\_grow \(my\_perl=0x8169f70\, sp=0x816c168\, p=0x816c168\, 
n=135701629\) at scope\.c​:62
\#4  0x80ce4bd in Perl\_pp\_rv2av \(my\_perl=0x8169f70\) at pp\_hot\.c​:504

504             EXTEND\(SP\, maxarg\);          
\(gdb\) l
499         \}
500
501         if \(GIMME == G\_ARRAY\) \{
502             I32 maxarg = AvFILL\(av\) \+ 1;
503             \(void\)POPs;                     /\* XXXX May be optimized away? \*/
504             EXTEND\(SP\, maxarg\);          
505             if \(SvRMAGICAL\(av\)\) \{
506                 U32 i; 
507                 for \(i=0; i \< maxarg; i\+\+\) \{
508                     SV \*\*svp = av\_fetch\(av\, i\, FALSE\);
\(gdb\) p maxarg
$3 = 135701629

I think av_fill() doesn't know about 'D' magic, as don't many other
functions in av.c.

Why should they know about particular magic-type letters? Why would
not they just use mg_len?

Ilya

[p5pRT]

From @gsar

On Thu, 27 Jan 2000 16​:11​:14 EST, Ilya Zakharevich wrote​:

I think av_fill() doesn't know about 'D' magic, as don't many other
functions in av.c.

Why should they know about particular magic-type letters? Why would
not they just use mg_len?

I should have said mg_size(), not av_fill(). mg_size() just returns
AvFILLp() if there's no vtbl->svt_len.

It's not clear why regular 'P' magic wasn't used for this. I'm beginning
to form a sense of forboding that this is just the beginning of all
manner of problems with 'D' magic. :-(

Sarathy
gsar@​ActiveState.com

[p5pRT]

From [Unknown Contact. See original ticket]

Gurusamy Sarathy writes​:

On Thu, 27 Jan 2000 16​:11​:14 EST, Ilya Zakharevich wrote​:

I think av_fill() doesn't know about 'D' magic, as don't many other
functions in av.c.

Why should they know about particular magic-type letters? Why would
not they just use mg_len?

I should have said mg_size(), not av_fill(). mg_size() just returns
AvFILLp() if there's no vtbl->svt_len.

But there is one​:

EXT MGVTBL PL_vtbl_regdata = {0, 0, MEMBER_TO_FPTR(Perl_magic_regdata_cnt), 0, 0};

#ifdef STRUCT_MGVTBL_DEFINITION
STRUCT_MGVTBL_DEFINITION;
#else
struct mgvtbl {
  int (CPERLscope(*svt_get)) (pTHX_ SV *sv, MAGIC* mg);
  int (CPERLscope(*svt_set)) (pTHX_ SV *sv, MAGIC* mg);
  U32 (CPERLscope(*svt_len)) (pTHX_ SV *sv, MAGIC* mg);
  int (CPERLscope(*svt_clear))(pTHX_ SV *sv, MAGIC* mg);
  int (CPERLscope(*svt_free)) (pTHX_ SV *sv, MAGIC* mg);
};
#endif

Ilya

[p5pRT]

From [Unknown Contact. See original ticket]

On Fri, Jan 28, 2000 at 09​:01​:53AM -0800, Gurusamy Sarathy wrote​:

It appears that rx->lastparen is uninitialized, and that's what magic_regdata_cnt()
returns.

Yes, the do-not-invoke-REx-engine optimization was not storing enough data.

Inline Patch

--- ./pp_hot.c~	Fri Dec 24 17:59:24 1999
+++ ./pp_hot.c	Sat Jan 29 01:39:40 2000
@@ -1045,6 +1045,7 @@ yup:					/* Confirmed by INTUIT */
 	rx->startp[0] = s - truebase;
 	rx->endp[0] = s - truebase + rx->minlen;
     }
+    rx->nparens = rx->lastparen = 0;	/* used by @- and @+ */
     LEAVE_SCOPE(oldsave);
     RETPUSHYES;