From: olson@mcs.anl.gov (Bob Olson)
Subject: Perl bug? Crash in reference to $' after re match
Organization: Math & Computer Science Divison, ANL
Date: Fri, 11 Sep 1992 16:55:09 GMT

Another strange perl crash for y'all. This is on a NeXT running OS
3.0PR2.  The crash also shows up on NeXT OS2.1, an IBM RS/6K running
AIX 3.2, and on the SGI running IRIX 4.0.4. On a sun4 running 4.1.1,
we get no crash but the while loop aborts strangely. (i.e. if I insert
the statement

	    print "Got '$a'\n";

after the assignment to $a, a run looks like:

	(dalek) % perl ~/PCN/CF/v0.4/CF/explode
	Got'
)

The code:
--------------------------------------------------
#!/usr/local/bin/perl

$_ = "    abcdeggh;\n";


$var = "abcdeg";
while (/\b($var)/g)
{
    $a = $';
}
--------------------------------------------------

If the string that matches (abcdeg above) is shortened, there is no
crash. If the reference to $' is removed, there is no crash. If the \b
or parens or /g in the regexp match are removed, there is no crash.

The run:
--------------------------------------------------
(locke) % perl explode
Out of memory!
--------------------------------------------------
(locke) % perl -v 

This is perl, version 4.0

$RCSfile: perl.c,v $$Revision: 4.0.1.7 $$Date: 92/06/08 14:50:39 $
Patch level: 35

Copyright (c) 1989, 1990, 1991, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 4.0 source kit.
--------------------------------------------------

And the gdb session. We crash because we are passing -2 down to the
str_grow routine, who interprets it as an unsigned integer of value
4294967295. 

--------------------------------------------------
Current directory is /mcs/source/Perl/perl-4.035/next-3.0/
Reading symbol data from perl...done.
Reading symbol data from /usr/shlib/libsys_s.B.shlib...done.
(gdb) b exit
Breakpoint 1 at 0x5052fd8
(gdb) r explode
Starting program: /mcs/source/Perl/perl-4.035/next-3.0/perl explode
Out of memory!

Breakpoint 1, 0x5052fd8 in exit ()
(gdb) where
#0  0x5052fd8 in exit ()
#1  0x3798e in safemalloc (size=4294967295) at util.c:123
#2  0x2c520 in str_grow (str=0xd7c80, newlen=-1) at str.c:129
#3  0x2c958 in str_nset (str=0xd7c80, ptr=0xd5efe "gh;\n", len=4294967294) at str.c:330
#4  0x29e10 in stab_str (str=0xd7bfc) at stab.c:140
#5  0x1a17e in eval (arg=0xd7d00, gimme=0, sp=1) at eval.c:241
#6  0x540e in cmd_exec (cmdparm=0xd7d44, gimme=0, sp=-1) at cmd.c:654
#7  0x5ae6 in cmd_exec (cmdparm=0xd57e8, gimme=0, sp=-1) at cmd.c:890
#8  0x25720 in main (argc=0, argv=0x3fffed0, env=0x3fffed4) at perl.c:890
(gdb) frame 2
#2  0x2c520 in str_grow (str=0xd7c80, newlen=-1) at str.c:129
(gdb) list
124	    }
125	    if (newlen > str->str_len) {		/* need more room? */
126	        if (str->str_len)
127		    Renew(s,newlen,char);
128	        else
129		    New(703,s,newlen,char);
130		str->str_ptr = s;
131	        str->str_len = newlen;
132	    }
133	    return s;
(gdb) up
#3  0x2c958 in str_nset (str=0xd7c80, ptr=0xd5efe "gh;\n", len=4294967294) at str.c:330
(gdb) up
#4  0x29e10 in stab_str (str=0xd7bfc) at stab.c:140
(gdb) list
135		break;
136	    case '\'':
137		if (curspat) {
138		    if (curspat->spat_regexp &&
139		      (s = curspat->spat_regexp->endp[0]) ) {
140			str_nset(stab_val(stab),s, curspat->spat_regexp->subend - s);
141		    }
142		    else
143			str_nset(stab_val(stab),"",0);
144		}
(gdb) p curspat->spat_regexp->subend - s
$1 = 0xd5efc "eggh;\n"
(gdb) p s
$2 = 0xd5efe "gh;\n"
(gdb) p curspat->spat_regexp->subend - s
$3 = -2
--
   Bob Olson   -*-   olson@mcs.anl.gov   -*-   Argonne National Laboratory
     "You can't win a game of chess with an action figure!" --bob&dave
Newsgroups: comp.lang.perl