crash: free invalid next size (fast)

crash: free invalid next size (fast)

[Johan Ström]

Hi,

today noticed that several of my terminals crashed and closed when 
writing `git <tab>` or `ls <tab>`. Managed to capture one such crash on 
video before terminal closed, and it printed "free invalid next size 
(fast)".

 From coredumpctl:

            PID: 843836 (zsh)
            UID: 1000 (johan)
            GID: 1001 (johan)
         Signal: 6 (ABRT)
      Timestamp: Tue 2022-03-15 08:30:03 CET (10min ago)
   Command Line: /usr/bin/zsh
     Executable: /usr/bin/zsh
  Control Group: /user.slice/user-1000.slice/session-1.scope
           Unit: session-1.scope
          Slice: user-1000.slice
        Session: 1
      Owner UID: 1000 (johan)
        Boot ID: 0d395e288d454f299469959632c8080a
     Machine ID: 321bfe907bef49b9a7b0d61fc2ee69c7
       Hostname: johan-amd
        Storage: 
/var/lib/systemd/coredump/core.zsh.1000.0d395e288d454f299469959632c8080a.843836.1647329403000000.zst 
(present)
      Disk Size: 527.7K
        Message: Process 843836 (zsh) of user 1000 dumped core.

                 Module linux-vdso.so.1 with build-id 
2f0b6fabb476bcc334f291e50364511afda88a31
                 Module computil.so with build-id 
f0893e4d73f81c9998e397f2e929c232f5a9f744
                 Module rlimits.so with build-id 
20663780de7a882ac790cf84a751c360846b3a5e
                 Module stat.so with build-id 
da1132260e12b24966c7c00b663c0ae57938f2ee
                 Module parameter.so with build-id 
2538dfbe08e43494407c7a571814d850372390e8
                 Module zutil.so with build-id 
ab6e10296c75aea4d8b9a1ff3ca462537c3bf53e
                 Module complete.so with build-id 
2574a83c1ff166c5b421ba99b7ce86680e96490c
                 Module zle.so with build-id 
b775b6da8502c5d43a488f1a83512e3e992ea5fb
                 Module ld-linux-x86-64.so.2 with build-id 
c09c6f50f6bcec73c64a0b4be77eadb8f7202410
                 Module libc.so.6 with build-id 
85766e9d8458b16e9c7ce6e07c712c02b8471dbc
                 Module libm.so.6 with build-id 
596b63a006a4386dcab30912d2b54a7a61827b07
                 Module libncursesw.so.6 with build-id 
1f873ddb2c32ab39d0b7d8646d03680ffe99de7c
                 Module libdl.so.2 with build-id 
bb9bd2657bfba9f60bd34d2050cc63a7eb024bc4
                 Module libcap.so.2 with build-id 
eb6dae97527fc89dbb0d5bb581a15acd02ae9f56
                 Module zsh with build-id 
b15fffaf722293c62cc1c599621d6016c52f710e
                 Stack trace of thread 843836:
                 #0  0x00007f36842e534c __pthread_kill_implementation 
(libc.so.6 + 0x8f34c)
                 #1  0x00007f36842984b8 raise (libc.so.6 + 0x424b8)
                 #2  0x00007f3684282534 abort (libc.so.6 + 0x2c534)
                 #3  0x00007f36842d9397 __libc_message (libc.so.6 + 0x83397)
                 #4  0x00007f36842ef33c malloc_printerr (libc.so.6 + 
0x9933c)
                 #5  0x00007f36842f104d _int_free (libc.so.6 + 0x9b04d)
                 #6  0x00007f36842f3be3 free (libc.so.6 + 0x9dbe3)
                 #7  0x00007f36839ffa7f unmetafy_line (zle.so + 0x33a7f)
                 #8  0x00007f3683a0427a n/a (zle.so + 0x3827a)
                 #9  0x00007f36839fcc34 completecall (zle.so + 0x30c34)
                 #10 0x00007f36839ea74b execzlefunc (zle.so + 0x1e74b)
                 #11 0x00007f36839ec83c zlecore (zle.so + 0x2083c)
                 #12 0x00007f36839ed587 zleread (zle.so + 0x21587)
                 #13 0x000055850ef988a3 zleentry (zsh + 0x6b8a3)
                 #14 0x000055850ef991ad ingetc (zsh + 0x6c1ad)
                 #15 0x000055850ef8ba94 n/a (zsh + 0x5ea94)
                 #16 0x000055850efa74cf n/a (zsh + 0x7a4cf)
                 #17 0x000055850efcbf88 parse_event (zsh + 0x9ef88)
                 #18 0x000055850ef91c4e loop (zsh + 0x64c4e)
                 #19 0x000055850ef9aa35 zsh_main (zsh + 0x6da35)
                 #20 0x000055850ef440ee main (zsh + 0x170ee)
                 #21 0x00007f3684283310 __libc_start_call_main 
(libc.so.6 + 0x2d310)
                 #22 0x00007f36842833c1 __libc_start_main@@GLIBC_2.34 
(libc.so.6 + 0x2d3c1)
                 #23 0x000055850ef4411e _start (zsh + 0x1711e)
                 ELF object binary architecture: AMD x86-64
Refusing to dump core to tty (use shell redirection or specify --output).

These terminals have been running for ~5 days.
On newly opened terminals, tab completion works fine.

OS: Arch Linux 5.16.13-arch1-1
Package: zsh 5.8.1-1

Have had 5.8-1 on this machine since July, never had any issues. 5.8.1-1 
installed on 16 Feb.


zshrc completion-related stuff:


# The following lines were added by compinstall
zstyle ':completion:*' completer _expand _complete _correct _approximate
zstyle ':completion:*' max-errors 1
zstyle :compinstall filename '/home/johan/.zshrc'

autoload -Uz compinit
compinit
# End of lines added by compinstall

# Enable proper expansion of ..<tab>
zstyle ':completion:*' special-dirs true

setopt HIST_IGNORE_DUPS
setopt HIST_FIND_NO_DUPS


The rest are mostly exports.

Not subscriber to list, so please CC in reply.

Thanks for zsh!

Johan