[perl #93320] localising @DB::args leads to coredump

This script, from the RT ticket, crashes:

#!/usr/bin/perl
sub cl{
    package DB;
    @DB::args = ();
    return caller(shift);
}

sub f{
    local @DB::args;
    my @z = cl($_) for (1..3);
}

f(1,2,3); f(1,2,3);
__END__

PL_dbargs is not refcounted, and it’s not set until pp_caller first
tries to write to it.  If that happens when @DB::args is localised,
then the array will be freed on scope exit, leaving PL_dbargs pointing
to a freed SV.

This crash can be reproduced more simply this way:

sub {
  package DB;
  ()=caller(0);
  undef *DB::args;
  ()=caller(0);
}->();

So, basically, pp_caller has to re-fetch PL_dbargs from the %DB::
stash each time it sets it.  It cannot rely on the cached value.

(So now I’m wondering whether we even need PL_dbargs.)

1 files changed, 1 insertions, 2 deletions

diff --git a/pp_ctl.c b/pp_ctl.c
index dc1b055681..a239f103ce 100644
--- a/pp_ctl.c
+++ b/pp_ctl.c
@@ -1957,8 +1957,7 @@ PP(pp_caller)
 	AV * const ary = cx->blk_sub.argarray;
 	const int off = AvARRAY(ary) - AvALLOC(ary);
 
-	if (!PL_dbargs || AvREAL(PL_dbargs))
-	    Perl_init_dbargs(aTHX);
+	Perl_init_dbargs(aTHX);
 
 	if (AvMAX(PL_dbargs) < AvFILLp(ary) + off)
 	    av_extend(PL_dbargs, AvFILLp(ary) + off);