psuedohash Out of memory!

[p5pRT]

Migrated from rt.perl.org#8058 (status was 'resolved')

Searchable as RT8058$

[p5pRT]

From [email protected]

Created by [email protected]

perl5.00503, perl5.6.1, and a not so old bleadperl all get very!
excited! when! you! do! this!

  Test-Differences$ perl -e '$s = [ { Handler => bless {}, "Foo" } ]; $s->{Handler} = 1;'
  Out of memory!

Perl Info

This perlbug was built using Perl 5.00503 - Mon Jul 31 22:48:49 PDT 2000
It is being executed now by  Perl 5.006001 - Tue Apr 17 13:56:59 EDT 2001.

Site configuration information for perl 5.006001:

Configured by barries at Tue Apr 17 13:56:59 EDT 2001.

Summary of my perl5 (revision 5.0 version 6 subversion 1) configuration:
  Platform:
    osname=linux, osvers=2.2.14-va.5.1, archname=i686-linux
    uname='linux sizzle 2.2.14-va.5.1 #1 tue sep 12 18:08:18 pdt 2000 i686 unknown '
    config_args='-d'
    hint=recommended, useposix=true, d_sigaction=define
    usethreads=undef use5005threads=undef useithreads=undef usemultiplicity=undef
    useperlio=undef d_sfio=undef uselargefiles=define usesocks=undef
    use64bitint=undef use64bitall=undef uselongdouble=undef
  Compiler:
    cc='cc', ccflags ='-fno-strict-aliasing -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
    optimize='-O2',
    cppflags='-fno-strict-aliasing -I/usr/local/include'
    ccversion='', gccversion='egcs-2.91.66 19990314/Linux (egcs-1.1.2 release)', gccosandvers=''
    intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
    d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
    ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
    alignbytes=4, usemymalloc=n, prototype=define
  Linker and Libraries:
    ld='cc', ldflags =' -L/usr/local/lib'
    libpth=/usr/local/lib /lib /usr/lib
    libs=-lnsl -lndbm -lgdbm -ldb -ldl -lm -lc -lposix -lcrypt -lutil
    perllibs=-lnsl -ldl -lm -lc -lposix -lcrypt -lutil
    libc=/lib/libc-2.1.3.so, so=so, useshrplib=false, libperl=libperl.a
  Dynamic Linking:
    dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-rdynamic'
    cccdlflags='-fpic', lddlflags='-shared -L/usr/local/lib'

Locally applied patches:
    


@INC for perl 5.006001:
    /home/barries/src/XML-SAX-PHB/lib
    /usr/local/lib/perl5/5.6.1/i686-linux
    /usr/local/lib/perl5/5.6.1
    /usr/local/lib/perl5/site_perl/5.6.1/i686-linux
    /usr/local/lib/perl5/site_perl/5.6.1
    /usr/local/lib/perl5/site_perl
    .


Environment for perl 5.006001:
    HOME=/home/barries
    LANG (unset)
    LANGUAGE (unset)
    LD_LIBRARY_PATH (unset)
    LOGDIR (unset)
    PATH=/usr/local/bin:/bin:/usr/bin:/usr/X11R6/bin:~/bin:/sbin:/usr/sbin:/home/barries/bin:/usr/contrib/bin/:~/bin:/sbin:/usr/sbin:~/bin:/sbin:/usr/sbin:~/bin:/sbin:/usr/sbin:~/bin:/sbin:/usr/sbin
    PERL5LIB=/home/barries/src/XML-SAX-PHB/lib
    PERL_BADLANG (unset)
    SHELL=/bin/bash

[p5pRT]

From [Unknown Contact. See original ticket]

On Dec 13, barries@​sizzle.whoville.com said​:

perl5.00503, perl5.6.1, and a not so old bleadperl all get very!
excited! when! you! do! this!

Test-Differences$ perl -e '$s = [ { Handler => bless {}, "Foo" } ]; $s->{Handler} = 1;'
Out of memory!

Probably because (0 + {}) is a VERY large number.

--
Jeff "japhy" Pinyan japhy@​pobox.com http​://www.pobox.com/~japhy/
RPI Acacia brother #734 http​://www.perlmonks.org/ http​://www.cpan.org/
** Look for "Regular Expressions in Perl" published by Manning, in 2002 **
<stu> what does y/// stand for? <tenderpuss> why, yansliterate of course.

[p5pRT]

From @schwern

On Thu, Dec 13, 2001 at 11​:49​:10AM -0500, barries@​sizzle.whoville.com wrote​:

perl5.00503, perl5.6.1, and a not so old bleadperl all get very!
excited! when! you! do! this!

    Test\-Differences$ perl \-e '$s = \[ \{ Handler => bless \{\}\, "Foo" \} \]; $s\->\{Handler\} = 1;'
    Out of memory\!

The bleadperl error throws some light on it.
Out of memory during "large" request for 2147487744 bytes, total sbrk() is 74468 bytes at -e line 1.

That $s->{Handler} = 1 translates to​:

  $s->[$s->[0]{Handler}];

which is​:

  $s->[bless {}, "Foo"]

which is something like​:

  $s->[270104932]

which doesn't cause an error. But this does​:

  $s->[270104932] = 1;

so does this

  $#s = 270104932;

So it must be that pseudo-hash fetch is doing an av_extend.

Breakpoint 1, Perl_av_extend (av=0x10199080, key=27010493) at av.c​:60
60 if ((mg = SvTIED_mg((SV*)av, PERL_MAGIC_tied))) {
(gdb) bt
#0 Perl_av_extend (av=0x10199080, key=27010493) at av.c​:60
#1 0x100a142c in Perl_av_store (av=0x10199080, key=27010493, val=0x101992a8)
  at av.c​:271
#2 0x100a10e0 in Perl_av_fetch (av=0x10199080, key=27010493, lval=1)
  at av.c​:204
#3 0x100a4878 in Perl_avhv_fetch_ent (av=0x10199080, keysv=0x10199230,
  lval=1, hash=1105802825) at av.c​:884
#4 0x100ad064 in Perl_pp_helem () at pp_hot.c​:1653
#5 0x10088ddc in Perl_runops_debug () at dump.c​:1391
#6 0x10018dc8 in S_run_body (oldscope=1) at perl.c​:1595
#7 0x100187a0 in perl_run (my_perl=0x10198808) at perl.c​:1516
#8 0x10014090 in main (argc=3, argv=0x7ffffb54, env=0x7ffffb64)
  at perlmain.c​:76
#9 0x0fdd8a30 in __libc_start_main () from /lib/libc.so.6

no, av_fetch is calling av_store which is then extending. That can't
be right. Anyone want to explain the logic of that?

  if (key > AvFILLp(av)) {
  if (!lval)
  return 0;
  sv = NEWSV(5,0);
  return av_store(av,key,sv);
  }

--

Michael G. Schwern <schwern@​pobox.com> http​://www.pobox.com/~schwern/
Perl Quality Assurance <perl-qa@​perl.org> Kwalitee Is Job One
Ooops, fatal mutation in the test script.

[p5pRT]

From [Unknown Contact. See original ticket]

--- Michael G Schwern <schwern@​pobox.com> wrote​:

no, av_fetch is calling av_store which is then extending.
That can't
be right. Anyone want to explain the logic of that?

if \(key > AvFILLp\(av\)\) \{
    if \(\!lval\)
        return 0;
    sv = NEWSV\(5\,0\);
    return av\_store\(av\,key\,sv\);
\}

It most certainly is right. av_fetch was called with lval =
TRUE, denoting that this fetch _must_ return an lvalue.
Since there isn't one already at that position in the
array, av_fetch creates a new SV, stores it in the array,
and returns it.

-- BKS

__________________________________________________
Do You Yahoo!?
Check out Yahoo! Shopping and Yahoo! Auctions for all of
your unique holiday gifts! Buy at http​://shopping.yahoo.com
or bid at http​://auctions.yahoo.com

[p5pRT]

From @schwern

The code does the equivalent of​:

  $s->[bless {}] = 1;

and a reference numerifies to a Very Large Number. So its​:

  $s->[27010493] = 1; # for example

which causes Perl to try to allocate a huge array.

--

Michael G. Schwern <schwern@​pobox.com> http​://www.pobox.com/~schwern/
Perl Quality Assurance <perl-qa@​perl.org> Kwalitee Is Job One
Pancakes is the better part of valor.
  http​://www.goats.com/archive/971202.html

[p5pRT]

From @schwern

On Thu, Dec 13, 2001 at 10​:11​:26AM -0800, Benjamin Stuhl wrote​:

--- Michael G Schwern <schwern@​pobox.com> wrote​:

no, av_fetch is calling av_store which is then extending.
That can't
be right. Anyone want to explain the logic of that?

if \(key > AvFILLp\(av\)\) \{
    if \(\!lval\)
        return 0;
    sv = NEWSV\(5\,0\);
    return av\_store\(av\,key\,sv\);
\}

It most certainly is right. av_fetch was called with lval =
TRUE, denoting that this fetch _must_ return an lvalue.
Since there isn't one already at that position in the
array, av_fetch creates a new SV, stores it in the array,
and returns it.

Makes sense. Closed the bug as 'not a bug'

--

Michael G. Schwern <schwern@​pobox.com> http​://www.pobox.com/~schwern/
Perl Quality Assurance <perl-qa@​perl.org> Kwalitee Is Job One
Me? A robot? That's rediculous! For one thing, that doesn't compute at all!