Re: plperl crashes backend

The following function:

create function text_to_words(text)
returns setof text as $_$
my %stopwords = ( 'i' => 'i','me' => 'me','my' => 'my','myself' => 'myself','we' => 'we','our' => 'our','ours' => 'ours','ourselves' => 'ourselves','you' => 'you','your' => 'your','yours' => 'yours','yourself' => 'yourself','yourselves' => 'yourselves','he' => 'he','him' => 'him','his' => 'his','himself' => 'himself','she' => 'she','her' => 'her','hers' => 'hers','herself' => 'herself','it' => 'it','its' => 'its','itself' => 'itself','they' => 'they','them' => 'them','their' => 'their','theirs' => 'theirs','themselves' => 'themselves','what' => 'what','which' => 'which','who' => 'who','whom' => 'whom','this' => 'this','that' => 'that','these' => 'these','those' => 'those','am' => 'am','is' => 'is','are' => 'are','was' => 'was','were' => 'were','be' => 'be','been' => 'been','being' => 'being','have' => 'have','has' => 'has','had' => 'had','having' => 'having','do' => 'do','does' => 'does','did' => 'did','doing' => 'doing','a' => 'a','an' => 'an','the' => 'the','and' => 'and','but' => 'but','if' => 'if','or' => 'or','because' => 'because','as' => 'as','until' => 'until','while' => 'while','of' => 'of','at' => 'at','by' => 'by','for' => 'for','with' => 'with','about' => 'about','against' => 'against','between' => 'between','into' => 'into','through' => 'through','during' => 'during','before' => 'before','after' => 'after','above' => 'above','below' => 'below','to' => 'to','from' => 'from','up' => 'up','down' => 'down','in' => 'in','out' => 'out','on' => 'on','off' => 'off','over' => 'over','under' => 'under','again' => 'again','further' => 'further','then' => 'then','once' => 'once','here' => 'here','there' => 'there','when' => 'when','where' => 'where','why' => 'why','how' => 'how','all' => 'all','any' => 'any','both' => 'both','each' => 'each','few' => 'few','more' => 'more','most' => 'most','other' => 'other','some' => 'some','such' => 'such','no' => 'no','nor' => 'nor','not' => 'not','only' => 'only','own' => 'own','same' => 'same','so' => 'so','than' => 'than','too' => 'too','very' => 'very','s' => 's','t' => 't','can' => 'can','will' => 'will','just' => 'just','don' => 'don','should' => 'should','now' => 'now' );
my $textstring = $_[0];
$textstring =~ s/[\`\`\~\!\(at)\#\$\%\^\&\*\(\)\_\+\-\=\{\}\[\]\\\|\:\;\"\"\'\'\<\>\,\.\?\/]+/ /gi; my @words = split /\ /,$textstring;
my $res = [];

foreach my $word (@words) {
$word =~ s/([A-Z])/lc($1)/ge;
if($word ne $stopwords{$word} && $word ne '') {
push @$res,$word;
}
}
return $res;
$_$ language plperl immutable strict;

creashes the backend, UNLESS it's executed in the same session where it was created.

Kind regards,

John

On Wed, Nov 17, 2004 at 02:49:15PM +1100, John Hansen wrote:

> The following function:
[snip]
> creashes the backend, UNLESS it's executed in the same session where it was created.

I can reproduce this crash on the following platform:

Solaris 9
PostgreSQL 8.0.0beta4 (CVS)
Perl 5.8.5
gcc 3.4.2

I can NOT reproduce the crash on the following platform:

FreeBSD 4.10-STABLE
PostgreSQL 8.0.0beta4 (CVS - same copy of source as above)
Perl 5.8.6-RC1
gcc 2.95.4

The server log on the Solaris box shows this when it crashes
(signal 10 is SIGBUS):

Can't return outside a subroutine at (eval 4) line 13.
LOG: server process (PID 25681) was terminated by signal 10

Adding a few elog lines to the function shows that it's crashing
at the "return $res;" line. One of my gdb sessions showed the
following, although haven't been able to get this same output again:

Program received signal SIGSEGV, Segmentation fault.
0xfec8c1e4 in Perl_av_fetch () from /usr/local/lib/libperl.so
(gdb) bt
#0 0xfec8c1e4 in Perl_av_fetch () from /usr/local/lib/libperl.so
#1 0xfec689f4 in S_pad_findlex () from /usr/local/lib/libperl.so
#2 0xfec68968 in Perl_pad_findmy () from /usr/local/lib/libperl.so

--
Michael Fuhr
http://www.fuhr.org/~mfuhr/

I've come up with a simpler test case:

CREATE OR REPLACE FUNCTION foo(INTEGER) RETURNS INTEGER AS $$
my @a = 1..$_[0];
elog INFO, "array has $_[0] elements";
return $_[0];
$$ LANGUAGE plperl;

Here's the Solaris 9 failure mode:

test=> select foo(131); -- works consistently
INFO: array has 131 elements
foo
-----
131
(1 row)

test=> select foo(132); -- fails consistently
INFO: array has 132 elements
server closed the connection unexpectedly

This test also fails on FreeBSD 4.10, but at a higher resource usage
than on Solaris:

test=> select foo(260); -- works consistently
INFO: array has 260 elements
foo
-----
260
(1 row)

test=> select foo(261); -- fails consistently
INFO: array has 261 elements
server closed the connection unexpectedly

It looks like some resource is being exhausted that has a higher
setting on my FreeBSD box than on my Solaris box. Interestingly,
the elog output shows that the crash doesn't happen until the
function returns. Here's the gdb output from Solaris:

% sudo -u postgres gdb /usr/local/pgsql/bin/postgres
...
(gdb) run -D/usr/local/pgsql/data test
...
PostgreSQL stand-alone backend 8.0.0beta4
backend> select foo(132);
1: foo (typeid = 23, len = 4, typmod = -1, byval = t)
----

Program received signal SIGSEGV, Segmentation fault.
0xfecc3378 in Perl_pop_return () from /usr/local/lib/libperl.so
(gdb) bt
#0 0xfecc3378 in Perl_pop_return () from /usr/local/lib/libperl.so
#1 0xfec295f8 in Perl_call_sv () from /usr/local/lib/libperl.so
#2 0xfeda413c in plperl_call_perl_func (desc=0xffbff178, fcinfo=0x0) at plperl.c:810

--
Michael Fuhr
http://www.fuhr.org/~mfuhr/

John Hansen <john(at)geeknet(dot)com(dot)au> writes:
> The following function:
> ...
> creashes the backend, UNLESS it's executed in the same session where it was created.

Got it ...

RCS file: /cvsroot/pgsql/src/pl/plperl/plperl.c,v
***************
*** 659,665 ****
--- 655,664 ----
int count;

if (trusted && !plperl_safe_init_done)
+ {
plperl_safe_init();
+ SPAGAIN;
+ }

ENTER;
SAVETMPS;
***************

Man, that was painful to find.

regards, tom lane

On Thu, Nov 18, 2004 at 04:37:42PM -0500, Tom Lane wrote:

> Got it ...

Excellent -- I get no crashes with the test cases. Thanks.

--
Michael Fuhr
http://www.fuhr.org/~mfuhr/