zsh 4.0.4 core dump

zsh 4.0.4 core dump

[Paul Lew]

We have been using zsh 4.0.4 for a while and experiencing occasional
core dump for the past 6 months.  The behavior is if we left a zsh
session there overnight, the first carriage return will cause it to
core.

After build a debugged version, the gdb says:

Program terminated with signal 10, Bus Error.
#0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
    at builtin.c:3380
3380                    if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
(gdb) where
#0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
    at builtin.c:3380
#1  0x2ad98 in bin_dot (name=0x9e918 "", argv=0x0, ops=0xa7a90 "precmd", 
    func=0) at builtin.c:3365
#2  0x310d4 in cond_val (args=0x8, num=139192) at cond.c:396
(gdb) p t
$1 = (char **) 0x81000000
(gdb) p *t
Cannot access memory at address 0x81000000

The source around line 3380 of builtin.c looks like:

 3376      if (!*s || (ret && isset(PATHDIRS) && diddot < 2 && dotdot == 0)) {
 3377          pushheap();
 3378          /* search path for script */
 3379          for (t = path; *t; t++) {
 3380 --->         if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
 3381                  if (diddot)
 3382                      continue;
 3383                  diddot = 1;
 3384                  buf = dupstring(arg0);
 3385              } else
 3386                  buf = zhtricat(*t, "/", arg0);

Seems like our precmd triggered a bug.  Has this been reported at all?

Thanks in advance...

Re: zsh 4.0.4 core dump

[Peter Stephenson]

Paul Lew wrote:
> Program terminated with signal 10, Bus Error.
> #0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
>     at builtin.c:3380
> 3380                    if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
>
> Seems like our precmd triggered a bug.  Has this been reported at all?

Haven't seen this.  What does the precmd look like?  What was $path
supposed to be at this point?  In particular, could anything have been
manipulating $path?

-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR Ltd., Science Park, Milton Road,
Cambridge, CB4 0WH, UK                          Tel: +44 (0)1223 692070


**********************************************************************
The information transmitted is intended only for the person or
entity to which it is addressed and may contain confidential 
and/or privileged material. 
Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by 
persons or entities other than the intended recipient is 
prohibited.  
If you received this in error, please contact the sender and 
delete the material from any computer.
**********************************************************************

Re: zsh 4.0.4 core dump

[Paul Lew]

>>>>> "Peter" == Peter Stephenson <pws@csr.com> writes:

    Peter> Paul Lew wrote:
    >> Program terminated with signal 10, Bus Error.
    >> #0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
    >> at builtin.c:3380
    >> 3380                    if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
    >> 
    >> Seems like our precmd triggered a bug.  Has this been reported
    >> at all?

    Peter> Haven't seen this.  What does the precmd look like?

The precmd defined as:

# From: Andrew J Cosgriff <Andrew.Cosgriff@cc.monash.edu.au>
# Date: Thu, 10 Jul 1997 09:12:11 +1000
precmd () {
        if [[ -o interactive ]]; then
                # Get a list of suspended jobs to put in the command
                # line.  Have to use a temporary file because it is
                # the only way we can run the jobs builtin and set a
                # variable within the current shell - doing either of
                # these in a subshell defeats the purpose.  The jobs
                # command outputs to stderr.  Use the current hostname
                # and process ID to ensure that there is no problems
                # even if /tmp is mounted across filesystems.
                builtin jobs -r >&! /tmp/jobs$HOST$$
                if [[ -s /tmp/jobs$HOST$$ ]]; then
                        # There is at least one suspended job.  Glean
                        # the job numbers from the file.  Surround the
                        # text with the relevant description and
                        # proper number of spaces.
                        psvar[4]="`sed -n 's/^\[\([^]]*\)\].*$/\1 /p'
                        \
                         < /tmp/jobs$HOST$$ | tr -d '\012'`"
                else
                        # No jobs - we can skip the calls to sed and
                        # tr.
                        psvar[4]=""
                        fi
                /bin/rm /tmp/jobs$HOST$$
                jobs -s
                fi
        }

    Peter> What was $path supposed to be at this point?  In
    Peter> particular, could anything have been manipulating $path?

Our path is long:

     1  W .
     2  W /auto/insbu-cnstools/ar/bin
     3  W /auto/insbu-cnstools/ar/sh
     4  W /auto/insbu-cnstools/ar/perl
     5  W /auto/insbu-cnstools/bin
     6  W /auto/insbu-cnstools/sbin
     7  W /auto/cnsadpub/cns/bin
     8  W /auto/insbu-cnstools/apache/bin
     9  W /auto/insbu-cnstools/mysql/bin
    10    /nfs/csc/mib-release/bin
    11  W /auto/insbu-cnstools/java/bin
    12  W /auto/insbu-cnstools/jakarta-ant-1.4/bin
    13    /usr/cisco/bin
    14    /usr/local/bin
    15    /usr/local/sbin
    16    /usr/dt/bin
    17    /router/bin
    18    /usr/atria/bin
    19    /auto/ddts/ddtshome/bin
    20    /usr/openwin/bin
    21    /sbin
    22    /usr/sbin
    23    /usr/ccs/bin
    24    /usr/openwin/bin
    25    /usr/ucb
    26    /usr/bin
    27    /bin
    28    /etc
    29    /usr/games

The first 3 elements might be changing while the shell is running,
i.e., the entire directories were removed and repalced.  Any old
pointer to these file will not be valid.  However, this maybe the 2nd
problem we seen.  The first problem is zsh cored after long idling
time.  All the path elements above with /auto and /nfs are subject to
be dismounted by the automount daemon.

Re: zsh 4.0.4 core dump

[Paul Lew]

>>>>> "Peter" == Peter Stephenson <pws@csr.com> writes:

    >> Program terminated with signal 10, Bus Error.
    >> #0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
    >> at builtin.c:3380
    >> 3380                    if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
    >> 
    >> Seems like our precmd triggered a bug.  Has this been reported
    >> at all?

Is this one fixed in 4.0.5?  I saw bug 17517 but not sure if this
is the one.

BTW, how can I access the bug database?  Thanks.

Re: zsh 4.0.4 core dump

[Bart Schaefer]

On Aug 9, 10:23pm, Paul Lew wrote:
} Subject: Re: zsh 4.0.4 core dump
}
} >>>>> "Peter" == Peter Stephenson <pws@csr.com> writes:
} 
}     >> Program terminated with signal 10, Bus Error.
} 
} Is this one fixed in 4.0.5?

There wasn't any specific commit for this bug.  If I had to guess, I'd
say 16364 and 16351 are the most likely to have had any effect.  The
stack trace you sent gave me no clues at all.

} I saw bug 17517 but not sure if this is the one.

It's not, unless your process is crashing because it ran out of memory.

} BTW, how can I access the bug database?  Thanks.

There's a bug database under the zsh project on sourceforge, but we don't
really use it.  The numbers in the ChangeLog refer to the zsh-workers
article number in which the patch (or at least a description of the way
to fix the bug) appeared.  You can find those articles through the list
archive interface at <http://www.zsh.org/mla/>.

-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts              http://www.brasslantern.com

Zsh: http://www.zsh.org | PHPerl Project: http://phperl.sourceforge.net