This is a live mirror of the Perl 5 development currently hosted at https://github.com/perl/perl5
[perl #131085] Crash with sub-in-stash
authorFather Chrysostomos <sprout@cpan.org>
Fri, 7 Apr 2017 21:08:02 +0000 (14:08 -0700)
committerFather Chrysostomos <sprout@cpan.org>
Thu, 1 Jun 2017 13:34:59 +0000 (06:34 -0700)
$ perl -e '$::{"A"} = sub {}; \&{"A"}'
Segmentation fault (core dumped)

The code that vivifies a typeglob out of a code ref assumed that the
CV had a name hek, which is always the case when perl itself puts the
code ref there (via ‘sub A{}’), but is not necessarily the case if
someone is insinuating other stuff into the stash.

gv.c
t/op/gv.t

diff --git a/gv.c b/gv.c
index d32a9c5..315ec49 100644 (file)
--- a/gv.c
+++ b/gv.c
@@ -421,7 +421,7 @@ Perl_gv_init_pvn(pTHX_ GV *gv, HV *stash, const char *name, STRLEN len, U32 flag
        /* Not actually a constant.  Just a regular sub.  */
        CV * const cv = (CV *)has_constant;
        GvCV_set(gv,cv);
-       if (CvSTASH(cv) == stash && (
+       if (CvNAMED(cv) && CvSTASH(cv) == stash && (
               CvNAME_HEK(cv) == GvNAME_HEK(gv)
            || (  HEK_LEN(CvNAME_HEK(cv)) == HEK_LEN(GvNAME_HEK(gv))
               && HEK_FLAGS(CvNAME_HEK(cv)) != HEK_FLAGS(GvNAME_HEK(gv))
index 8d5e7dc..4fe6b00 100644 (file)
--- a/t/op/gv.t
+++ b/t/op/gv.t
@@ -1187,6 +1187,10 @@ package GV_DOWNGRADE {
     ::like "$GV_DOWNGRADE::{FOO}", qr/SCALAR/, "gv_downgrade: post";
 }
 
+# [perl #131085] This used to crash; no ok() necessary.
+$::{"A131085"} = sub {}; \&{"A131085"};
+
+
 __END__
 Perl
 Rules