From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <zsh-workers-return-17512-mason-zsh=primenet.com.au@sunsite.dk>
Received: (qmail 25384 invoked from network); 8 Aug 2002 01:15:44 -0000
Received: from sunsite.dk (130.225.247.90)
  by ns1.primenet.com.au with SMTP; 8 Aug 2002 01:15:44 -0000
Received: (qmail 12989 invoked by alias); 8 Aug 2002 01:15:32 -0000
Mailing-List: contact zsh-workers-help@sunsite.dk; run by ezmlm
Precedence: bulk
X-No-Archive: yes
X-Seq: 17512
Received: (qmail 12964 invoked from network); 8 Aug 2002 01:15:31 -0000
From: Paul Lew <paullew@cisco.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID: <15697.50711.359543.354374@paullew-ultra.cisco.com>
Date: Wed, 7 Aug 2002 18:15:03 -0700
To: zsh-workers@sunsite.dk
cc: Paul Lew <paullew@cisco.com>
Subject: zsh 4.0.4 core dump
X-Mailer: VM 7.07 under Emacs 21.2.1

We have been using zsh 4.0.4 for a while and experiencing occasional
core dump for the past 6 months.  The behavior is if we left a zsh
session there overnight, the first carriage return will cause it to
core.

After build a debugged version, the gdb says:

Program terminated with signal 10, Bus Error.
#0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
    at builtin.c:3380
3380                    if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
(gdb) where
#0  0x2af38 in bin_dot (name=0x0, argv=0x1, ops=0x39ce7 "", func=-4264968)
    at builtin.c:3380
#1  0x2ad98 in bin_dot (name=0x9e918 "", argv=0x0, ops=0xa7a90 "precmd", 
    func=0) at builtin.c:3365
#2  0x310d4 in cond_val (args=0x8, num=139192) at cond.c:396
(gdb) p t
$1 = (char **) 0x81000000
(gdb) p *t
Cannot access memory at address 0x81000000

The source around line 3380 of builtin.c looks like:

 3376      if (!*s || (ret && isset(PATHDIRS) && diddot < 2 && dotdot == 0)) {
 3377          pushheap();
 3378          /* search path for script */
 3379          for (t = path; *t; t++) {
 3380 --->         if (!(*t)[0] || ((*t)[0] == '.' && !(*t)[1])) {
 3381                  if (diddot)
 3382                      continue;
 3383                  diddot = 1;
 3384                  buf = dupstring(arg0);
 3385              } else
 3386                  buf = zhtricat(*t, "/", arg0);

Seems like our precmd triggered a bug.  Has this been reported at all?

Thanks in advance...