Discussion:
Request for voting for 5.20.3
Steve Hay
2015-07-25 11:30:19 UTC
Permalink
Apologies for running a little late on this. The release schedule advertises 5.20.3 for July, but it's clearly not going to make that now. However, I hope to have it done in August, and 5.22.1 should hopefully still be on schedule in September.

To that end I have spent some time over the last week looking through all the commits since 5.20.2 and have drawn up a list of possible cherry-picks:

http://perl5.git.perl.org/perl.git/blob/refs/heads/maint-5.20-votes:/Porting/cherry-pick-votes-maint-5.20.xml

(I have done a dry-run of cherry-picking them and they are all pickable, albeit with some minor conflict resolution in some of them. I have already rejected commits that required anything non-trivial to adapt to maint-5.20's source code.)

In line with the updates to perlpolicy following the release of 5.20.2 there are not as many commits listed this time, particularly in the documentation area, so I hope they won't be too much of a burden for people to look through. I would be very grateful if some committers could spare a little time to cast their votes one way or the other.

Note that there are a lot of fixes for crashing bugs that were found by 'fuzzing' with AFL (http://lcamtuf.coredump.cx/afl/). Is it fair to say that most of these are pretty obscure corner cases that real users would be unlikely to encounter in practice? If so then perhaps we should axe them from the voting list to reduce the number of commits being pulled into maint-5.20? (I have listed them separately from other fixes to make this easier if required.)

Another two (db5cc3ee5b and #123554) could also potentially get the chop since they caused concerns and accordingly didn't make it into 5.20.2. Has anything changed to make them suitable for 5.20.3?
h***@crypt.org
2015-07-26 11:38:23 UTC
Permalink
Steve Hay <***@verosoftware.com> wrote:
:Note that there are a lot of fixes for crashing bugs that were found by 'fuzzing' with AFL (http://lcamtuf.coredump.cx/afl/). Is it fair to say that most of these are pretty obscure corner cases that real users would be unlikely to encounter in practice? If so then perhaps we should axe them from the voting list to reduce the number of commits being pulled into maint-5.20? (I have listed them separately from other fixes to make this easier if required.)

It's fair to say that some are obscure, I don't think we can assume they
all are.

Looking at the ones I fixed:

a53bfdae [perl #123759] always count on OPpTRANS_IDENTICAL
doesn't seem that obscure to me
fc1bb3f2 [perl #123874] fix argument underflow for pack()
doesn't seem that obscure to me
8a6d8ec6 [perl #123755] including unknown char in error requires care
a bit obscure
7082c440 regcomp can read past end of string after parsing flags
a bit obscure (but a very simple fix)
87ebf1e3 [perl #123816] fix stat stacking
quite obscure
d0bec203 [perl #123870] fixup trie runtime debug output
quite obscure

Hugo
Aaron Crane
2015-08-09 17:04:03 UTC
Permalink
Post by Steve Hay
http://perl5.git.perl.org/perl.git/blob/refs/heads/maint-5.20-votes:/Porting/cherry-pick-votes-maint-5.20.xml
I would be very grateful if some committers could spare a little time to cast their votes one way or the other.
Thanks, Steve. I've pushed some votes.
Post by Steve Hay
Note that there are a lot of fixes for crashing bugs that were found by 'fuzzing' with AFL (http://lcamtuf.coredump.cx/afl/). Is it fair to say that most of these are pretty obscure corner cases that real users would be unlikely to encounter in practice? If so then perhaps we should axe them from the voting list to reduce the number of commits being pulled into maint-5.20? (I have listed them separately from other fixes to make this easier if required.)
I haven't yet looked at any commits in that section; I hope to get
back to them soon.
Post by Steve Hay
Another two (db5cc3ee5b and #123554) could also potentially get the chop since they caused concerns and accordingly didn't make it into 5.20.2. Has anything changed to make them suitable for 5.20.3?
FC says in the votes file that he's not entirely happy about applying
db5cc to maint; since he wrote it, that sounds to me like it should
definitely trigger the "if in doubt, leave it out" part of maint
policy.
--
Aaron Crane ** http://aaroncrane.co.uk/
Steve Hay via perl5-porters
2015-08-12 08:37:33 UTC
Permalink
Post by Steve Hay
Apologies for running a little late on this. The release schedule advertises 5.20.3 for July, but it's clearly not going to make that now. However, I hope to have it done in August, and 5.22.1 should hopefully still be on schedule in September.
http://perl5.git.perl.org/perl.git/blob/refs/heads/maint-5.20-votes:/Porting/cherry-pick-votes-maint-5.20.xml
Thanks to those who have voted so far.

Aside from the long list of AFL-found crash fixes we are down to only
five remaining crash fixes:

[perl #123711] Fix crash with 0-5x-l{0}
[perl #123712] Fix /$a[/ parsing
[perl #123712] Don't check sub_inwhat
[perl #124156] death during unwinding causes crash
[perl #123398)] don't fatalize warnings during unwinding

There are also two build/installation fixes, one regression fix and
one documentation update -- an agreeably short list for anyone
considering voting?...

I would also appreciate advice on whether 0fa70a06a9 is safe to apply
since although the code changes cherry-pick without conflict there is
a conflict in a comment in regexec.c referring to MBOL: The comment
refers to BOL in maint-5.20, but that was eliminated from blead by
d3d47aac53, hence blead now mentions MBOL instead. Are the code
changes good for maint-5.20?

No blocker tickets remain, so unless there is a sudden rush of
enthusiasm for getting the AFL-found fixes in then I would like to
draw a line under this soon and maybe get RC1 out in the next week or
two.

Loading...