This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
panic after cow-to-stash assignment
authorFather Chrysostomos <sprout@cpan.org>
Tue, 29 Nov 2011 02:31:55 +0000 (18:31 -0800)
committerFather Chrysostomos <sprout@cpan.org>
Tue, 29 Nov 2011 04:41:03 +0000 (20:41 -0800)
commitf9509170c89f15affdd1afdeff1c5fcbc00c51a3
tree3d1bc6764f2868b291e653c7d318bb674510598e
parent3c7be43ff115659a3b88a71696bf4228733c9bca
panic after cow-to-stash assignment

This type of thing isn’t officially supported, but perl shouldn’t be
freeing unallocated memory (the 9th octet of a freed HEK) as a result:

    $::{whatever} = __PACKAGE__;
    *{"whatever"};

A string stored in the symbol table like that is actually a subroutine
stub.  ‘sub foo($)’ is stored as '$' in the "foo" slot to save space.

gv_init_pvn (formerly known as gv_init) checks SvPOK first thing,
assuming, if it is set, that it can reuse SvPVX as the CV’s prototype,
without reallocating or copying it.  That works most of the time.

For COW strings (such as those returned by __PACKAGE__), SvPVX points
to the hek_key field (the 9th octet) of a shared HEK.  When the CV is
freed, it ends up trying to do Safefree(that_hek + 8) effectively,
which is bad.
gv.c
t/op/gv.t