Obscure utf8/"panic: malloc" bug (II)

[kj]

OK, I've reduced to a small script the code necessary to trigger
the bug mentioned in the subject line. Unfortunately, this is very
much of a heisenbug. I found that even changes that should not
affect the program (such adding a blank line or a comment to the
source, or changing the names of variables) would cause the bug to
manifest itself differently, and sometimes even disappear.

Here's the script:

# bug.pl

use strict;
use warnings FATAL => 'all';

use XML::Simple;
use DBI;

my $config = XMLin( <<'EOXML',
<?xml version="1.0"?>
<!DOCTYPE Foo> <Foo> <Bar instanceName="test" /> </Foo>
EOXML
keyattr => []
);

my $h = $config->{ Bar };
my $dbname = $h->{ instanceName };

eval {
DBI->connect(
"dbi:mysql:database=$dbname;host=localhost;port=3306",
'anonymous',
'',
{ InactiveDestroy => 1 }
);
};
my $error = $@;

for my $mod_file ( sort keys %INC ) {
my ( $package, $version ) = ( $mod_file, '???' );
if ( $mod_file =~ s/\.pm$// ) {
( $package = $mod_file ) =~ s#[/\\]#::#g;
$version = eval( '$' . $package . '::VERSION' ) || '???';
}
print "$package $version\n";
}

print "\n$error\n" if $error;

__END__


Supposing one calls the script bug.pl, and one runs it under the
debugger like this

% perl -d bug.pl

Loading DB routines from perl5db.pl version 1.28
Editor support available.

Enter h or `h h' for help, or `man perldebug' for more help.

main:bug.pl:8): my $config = XMLin( <<'EOXML',
main:bug.pl:9): <?xml version="1.0"?>
main:bug.pl:10): <!DOCTYPE Foo> <Foo> <Bar instanceName="test" /> </Foo>
main:bug.pl:11): EOXML
main:bug.pl:12): keyattr => []
main:bug.pl:13): );
DB<1> c

....the script will print the versions of the modules listed in %INC,
and then will print the value that $@ had right after the eval.
On my system, when all the planets are properly aligned, this value is

panic: malloc at /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/DBD/mysql.pm line 49.

Below I give the full output of the script, plus the outputs of
perl -V, uname -ar, and cat ~/.perldb.

kj

% perl -d bug.pl

Loading DB routines from perl5db.pl version 1.28
Editor support available.

Enter h or `h h' for help, or `man perldebug' for more help.

main:bug.pl:8): my $config = XMLin( <<'EOXML',
main:bug.pl:9): <?xml version="1.0"?>
main:bug.pl:10): <!DOCTYPE Foo> <Foo> <Bar instanceName="test" /> </Foo>
main:bug.pl:11): EOXML
main:bug.pl:12): keyattr => []
main:bug.pl:13): );
DB<1> c
/home/jones/.perldb ???
AutoLoader 5.60
Carp 1.03
Carp::Heavy ???
Config ???
DBD::mysql 3.0002
DBI 1.50
DynaLoader 1.05
Exporter 5.58
Exporter::Heavy 5.58
File::Basename 2.73
File::Spec 3.16
File::Spec::Unix 1.5
IO 1.21
IO::Handle 1.24
List::Util 1.14
Scalar::Util 1.14
SelectSaver 1.00
SelfLoader 1.0904
Symbol 1.05
Term::Cap 1.09
Term::ReadKey 2.30
Term::ReadLine 1.01
Term::ReadLine:erl 0.99
Term::ReadLine::readline ???
XML::NamespaceSupport 1.09
XML:arser 2.34
XML:arser::Expat 2.34
XML::SAX 0.13
XML::SAX::Base 1.04
XML::SAX::Exception 1.01
XML::SAX::Expat 0.37
XML::SAX:arserFactory 1.01
XML::Simple 2.14
XSLoader 0.02
attributes 0.06
base 2.06
constant 1.04
overload 1.02
perl5db.pl ???
re 0.04
strict 1.03
unicore/Canonical.pl ???
unicore/Exact.pl ???
unicore/PVA.pl ???
unicore/To/Fold.pl ???
unicore/lib/gc_sc/SpacePer.pl ???
unicore/lib/gc_sc/Word.pl ???
utf8 1.04
utf8_heavy.pl ???
vars 1.01
warnings 1.03
warnings::register 1.00

panic: malloc at /usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi/DBD/mysql.pm

Debugged program terminated. Use q to quit or R to restart,
use O inhibit_exit to avoid stopping after program termination,
h q, h R or h O to get additional info.
DB<1> q
% perl -V
Summary of my perl5 (revision 5 version 8 subversion 6) configuration:
Platform:
osname=linux, osvers=2.6.9, archname=i586-linux-thread-multi
uname='linux g226 2.6.9 #1 smp tue jun 28 14:58:56 utc 2005 i686 i686 i386 gnulinux '
config_args='-ds -e -Dprefix=/usr -Dvendorprefix=/usr -Dinstallusrbinperl -Dusethreads -Di_db -Di_dbm -Di_ndbm -Di_gdbm -Duseshrplib=true -Doptimize=-O2 -march=i586 -mcpu=i686 -fmessage-length=0 -Wall -g -Wall -pipe'
hint=recommended, useposix=true, d_sigaction=define
usethreads=define use5005threads=undef useithreads=define usemultiplicity=define
useperlio=define d_sfio=undef uselargefiles=define usesocks=undef
use64bitint=undef use64bitall=undef uselongdouble=undef
usemymalloc=n, bincompat5005=undef
Compiler:
cc='cc', ccflags ='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64',
optimize='-O2 -march=i586 -mcpu=i686 -fmessage-length=0 -Wall -g -Wall -pipe',
cppflags='-D_REENTRANT -D_GNU_SOURCE -DTHREADS_HAVE_PIDS -DDEBUGGING -fno-strict-aliasing -pipe'
ccversion='', gccversion='3.3.5 20050117 (prerelease) (SUSE Linux)', gccosandvers=''
intsize=4, longsize=4, ptrsize=4, doublesize=8, byteorder=1234
d_longlong=define, longlongsize=8, d_longdbl=define, longdblsize=12
ivtype='long', ivsize=4, nvtype='double', nvsize=8, Off_t='off_t', lseeksize=8
alignbytes=4, prototype=define
Linker and Libraries:
ld='cc', ldflags =''
libpth=/lib /usr/lib /usr/local/lib
libs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
perllibs=-lnsl -ldl -lm -lcrypt -lutil -lpthread -lc
libc=, so=so, useshrplib=true, libperl=libperl.so
gnulibc_version='2.3.4'
Dynamic Linking:
dlsrc=dl_dlopen.xs, dlext=so, d_dlsymun=undef, ccdlflags='-Wl,-E -Wl,-rpath,/usr/lib/perl5/5.8.6/i586-linux-thread-multi/CORE'
cccdlflags='-fPIC', lddlflags='-shared'


Characteristics of this binary (from libperl):
Compile-time options: DEBUGGING MULTIPLICITY USE_ITHREADS USE_LARGE_FILES PERL_IMPLICIT_CONTEXT
Locally applied patches:
SPRINTF0 - fixes for sprintf formatting issues - CVE-2005-3962
Built under linux
Compiled at Dec 17 2005 03:23:29
%ENV:
PERL5LIB="/home/jones/local/lib/perl5"
PERL_RL="Perl"
@INC:
/home/jones/local/lib/perl5/5.8.6/i586-linux-thread-multi
/home/jones/local/lib/perl5/5.8.6
/home/jones/local/lib/perl5/i586-linux-thread-multi
/home/jones/local/lib/perl5
/usr/lib/perl5/5.8.6/i586-linux-thread-multi
/usr/lib/perl5/5.8.6
/usr/lib/perl5/site_perl/5.8.6/i586-linux-thread-multi
/usr/lib/perl5/site_perl/5.8.6
/usr/lib/perl5/site_perl
/usr/lib/perl5/vendor_perl/5.8.6/i586-linux-thread-multi
/usr/lib/perl5/vendor_perl/5.8.6
/usr/lib/perl5/vendor_perl