more on crashes

more on crashes

[Bill Pemberton]

Ok, here's a way that makes pre5 crash on me every time -- just backspace
(or otherwise delete) 10 chars.  On the 10th backspace it seg faults....


-- 
Bill Pemberton                           wfp5p@virginia.edu
ITC/Unix Systems                         flash@virginia.edu
University of Virginia                   uunet!virginia!wfp5p

Re: more on crashes

[Vinnie Shelton]

wfp5p@tigger.itc.virginia.edu said:
> Ok, here's a way that makes pre5 crash on me every time -- just 
> backspace (or otherwise delete) 10 chars.  On the 10th backspace it 
> seg faults....

I don't see *anything* like this under either:

SunOS 4.1.3U1 compiled with gcc-2.7.2

Solaris 2.4/2.5 compiled with Sparcworks 4.1.

What's your platform/config?  setopts??  More info, please.

--vin

Re: more on crashes

[Bill Pemberton]

Vinnie Shelton writes:
> 
> 
> wfp5p@tigger.itc.virginia.edu said:
> > Ok, here's a way that makes pre5 crash on me every time -- just 
> > backspace (or otherwise delete) 10 chars.  On the 10th backspace it 
> > seg faults....
> 
> I don't see *anything* like this under either:
> 
> SunOS 4.1.3U1 compiled with gcc-2.7.2
> 
> Solaris 2.4/2.5 compiled with Sparcworks 4.1.
> 
> What's your platform/config?  setopts??  More info, please.
> 

In all cases I'm doing --enable-zsh-mem .

Compiled on AIX 4.2 it crashes right when I hit the backspace for the 10th
time.

Compiled on AIX 4.1.4 it doesn't reliably crash with 10 backspaces.  It
does, however, crash often.  Here's a trace:

Segmentation fault in unnamed block $b178 at line 593 in file "mem.c"
  593               m->free = sh->next;
  (dbx) t
  unnamed block $b178, line 593 in "mem.c"
  mem.malloc(size = 4), line 593 in "mem.c"
  zalloc(size = 1), line 329 in "mem.c"
  unnamed block $b409, line 121 in "zle_utils.c"
  cut(0x7, 0x1, 0x1), line 121 in "zle_utils.c"
  backkill(0x1, 0x1), line 66 in "zle_utils.c"
  vibackwarddeletechar(), line 657 in "zle_vi.c"
  unnamed block $b332, line 464 in "zle_main.c"
  unnamed block $b331, line 464 in "zle_main.c"
  unnamed block $b330, line 464 in "zle_main.c"
  zleread(0x20024f80, 0x0), line 464 in "zle_main.c"
  inputline(), line 264 in "input.c"
  ingetc(), line 220 in "input.c"
  hgetc(), line 109 in "hist.c"
  gettok(), line 372 in "lex.c"
  lex.yylex(), line 182 in "lex.c"
  parse_event(), line 59 in "parse.c"
  init.loop(toplevel = 1), line 115 in "init.c"
  main(argc = 1, argv = 0x2ff22a78), line 74 in "init.c"
  

Compiled on AIX 3.2.5 it crashes if I hit return after 10 backspaces.

segmentation violation in resetvideo at line 95 in file "zle_refresh.c"
   95               *nbuf[ln] = '\0';
   (dbx) t
   resetvideo(0x0), line 95 in "zle_refresh.c"
   refresh(0x1), line 230 in "zle_refresh.c"
   unnamed block $b465, line 428 in "zle_main.c"
   unnamed block $b464, line 428 in "zle_main.c"
   zleread(lp = warning: Unable to access address 0x200a57d0 from core
   (invalid char ptr (0x200a57d0)), rp = (nil)), line 428 in "zle_main.c"
   inputline(0x0), line 264 in "input.c"
   unnamed block $b224, line 220 in "input.c"
   ingetc(0x0), line 220 in "input.c"
   hgetc(0x0), line 109 in "hist.c"
   gettok(0x23), line 372 in "lex.c"
   yylex(0x1), line 182 in "lex.c"
   parse_event(0x86), line 59 in "parse.c"
   init.loop(toplevel = 1), line 115 in "init.c"
   main(argc = 1, argv = 0x2ff7fabc), line 74 in "init.c"
   
   

Compiled on SunOS 4.1.3, it doesn't crash but gives the error "attempt to
free more than allocated".

It also appears to have something to do with having vi mode set.  It appears
that I can backspace all I want with bindkey -e set, however, I can crashes
with bindkey -v set.....

-- 
Bill Pemberton                           wfp5p@virginia.edu
ITC/Unix Systems                         flash@virginia.edu
University of Virginia                   uunet!virginia!wfp5p

Re: more on crashes

[Zoltan Hidvegi]

> In all cases I'm doing --enable-zsh-mem .
> 
> Compiled on AIX 4.2 it crashes right when I hit the backspace for the 10th
> time.

Bill mailed me that bindkey -v was necessary for the crash.  I tried it and
after the 10th backpace zsh printed that someone tried to free more than
allocated.

Patch below.

Zoltan


--- Src/zle_utils.c	1996/07/28 19:50:55	2.11
+++ Src/zle_utils.c	1996/08/02 22:08:55
@@ -93,7 +93,7 @@
 	if ((vibuf[vibufspec].flags & CUTBUFFER_LINE) && !vilinerange)
 	    vibufappend = 0;
 	if (!vibufappend || !vibuf[vibufspec].buf) {
-	    zsfree(vibuf[vibufspec].buf);
+	    zfree(vibuf[vibufspec].buf, vibuf[vibufspec].len);
 	    vibuf[vibufspec].buf = (char *)zalloc(ct);
 	    memcpy(vibuf[vibufspec].buf, (char *) line + i, ct);
 	    vibuf[vibufspec].len = ct;
@@ -115,7 +115,7 @@
     } else {
 	/* Save in "1, shifting "1-"8 along to "2-"9 */
 	int n;
-	zsfree(vibuf[34].buf);
+	zfree(vibuf[34].buf, vibuf[34].len);
 	for(n=34; n>26; n--)
 	    vibuf[n] = vibuf[n-1];
 	vibuf[26].buf = (char *)zalloc(ct);