Core dump in 3.0.3-test5

Core dump in 3.0.3-test5

[Bart Schaefer]

zagzig<1> mv zsh-3.0.3-test5 !#:^-tmp
zsh: no such event: 1
zagzig<2> mv zsh-3.0.3-test5 !#:^-tmp
mv zsh-3.0.3-test5 zsh-3.0.3-test5 tmp
zsh: segmentation fault (core dumped)  ./zsh

(gdb) where
#0  0x80748a1 in taddstr (s=0xe1944 <Address 0xe1944 out of bounds>)
    at ../../zsh-3.0.3-test5/Src/text.c:61
#1  0x80753f9 in taddlist (l=0x80e1814) at ../../zsh-3.0.3-test5/Src/text.c:510
#2  0x80752d2 in getsimptext (cmd=0x80e17f4)
    at ../../zsh-3.0.3-test5/Src/text.c:446
#3  0x8074c66 in gettext2 (n=0x80e17f4) at ../../zsh-3.0.3-test5/Src/text.c:203
#4  0x8074a6e in getjobtext (n=0x80e17f4)
    at ../../zsh-3.0.3-test5/Src/text.c:134
#5  0x8054f2f in execpline2 (pline=0x80e1c88, how=2, input=0, output=0, 
    last1=0) at ../../zsh-3.0.3-test5/Src/exec.c:799
#6  0x8054a9a in execpline (l=0x80e17e0, how=2, last1=0)
    at ../../zsh-3.0.3-test5/Src/exec.c:647
#7  0x805479c in execlist (list=0x80e1c98, dont_change_job=0, exiting=0)
    at ../../zsh-3.0.3-test5/Src/exec.c:527
#8  0x8061758 in loop (toplevel=1) at ../../zsh-3.0.3-test5/Src/init.c:128
#9  0x8061627 in main (argc=1, argv=0xbffffc0c)
    at ../../zsh-3.0.3-test5/Src/init.c:77
#10 0x80480eb in _start ()

-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts        http://www.nbn.com/people/lantern

Re: Core dump in 3.0.3-test5

[Zoltan Hidvegi]

> zagzig<1> mv zsh-3.0.3-test5 !#:^-tmp
> zsh: no such event: 1
> zagzig<2> mv zsh-3.0.3-test5 !#:^-tmp
> mv zsh-3.0.3-test5 zsh-3.0.3-test5 tmp
> zsh: segmentation fault (core dumped)  ./zsh

Fix is below.  You may not like this fix:

% echo foo !:^-bar
zsh: no such word in event

Some explanation.  When !:^-bar is expanded, there is still only `echo foo'
stored in the history. ^- selects everything from the first argument except
the last one, which means 1-0 range in this case, which is invalid.  And
the new behaviour is tcsh compatible.  Before this patch zsh corrupted
memory on all !:a-b substitution when `b' was less than `a'.  The real fix
is the first hunk, the second hunk is just a cosmetic optimisation change.

Zoltan


*** Src/hist.c	1997/05/11 06:42:21	3.1.2.4
--- Src/hist.c	1997/05/12 07:48:55
***************
*** 1153,1163 ****
  char *
  getargs(Histent elist, int arg1, int arg2)
  {
-     char *ret;
      short *words = elist->words;
      int pos1, nwords = elist->nwords;
  
!     if (arg1 >= nwords || arg2 >= nwords) {
  	/* remember, argN is indexed from 0, nwords is total no. of words */
  	inerrflush();
  	zerr("no such word in event", NULL, 0);
--- 1153,1162 ----
  char *
  getargs(Histent elist, int arg1, int arg2)
  {
      short *words = elist->words;
      int pos1, nwords = elist->nwords;
  
!     if (arg2 < arg1 || arg1 >= nwords || arg2 >= nwords) {
  	/* remember, argN is indexed from 0, nwords is total no. of words */
  	inerrflush();
  	zerr("no such word in event", NULL, 0);
***************
*** 1165,1174 ****
      }
  
      pos1 = words[2*arg1];
!     ret = dupstring(elist->text + pos1);
!     ret[words[2*arg2+1] - pos1] = '\0';
!     
!     return ret;
  }
  
  /**/
--- 1164,1170 ----
      }
  
      pos1 = words[2*arg1];
!     return dupstrpfx(elist->text + pos1, words[2*arg2+1] - pos1);
  }
  
  /**/

Re: Core dump in 3.0.3-test5

[Peter Stephenson]

Zoltan Hidvegi wrote:
> > zagzig<1> mv zsh-3.0.3-test5 !#:^-tmp
> > zsh: no such event: 1
> > zagzig<2> mv zsh-3.0.3-test5 !#:^-tmp
> > mv zsh-3.0.3-test5 zsh-3.0.3-test5 tmp
> > zsh: segmentation fault (core dumped)  ./zsh
> 
> Fix is below.  You may not like this fix:

There's another aspect to this, at least in 3.1.x after the latest
history reorganisation.  They symptom is that you get the previous
line instead of the current one with any !# in completion.  The short
story is that I made non-interactive history expansions as in
completion too different from the interactive sort.  The following
simplification will fix things up.  It makes the counting of curhist
more logical, too.

*** Src/hist.c.has	Fri May  9 11:29:08 1997
--- Src/hist.c	Mon May 12 10:36:29 1997
***************
*** 44,50 ****
  #define HA_ACTIVE	(1<<0)	/* History mechanism is active */
  #define HA_NOSTORE	(1<<1)	/* Don't store the line when finished */
  #define HA_JUNKED	(1<<2)	/* Last history line was already junked */
- #define HA_NOINC	(1<<3)	/* Don't store, curhist not incremented */
  
  extern int cs, ll;
  
--- 44,49 ----
***************
*** 567,579 ****
      curhistent = gethistent(curhist);
      if (!curhistent->ftim)
  	curhistent->ftim = time(NULL);
      if (interact && isset(SHINSTDIN) && !strin) {
  	attachtty(mypgrp);
- 	defev = curhist;
- 	histactive = HA_ACTIVE;
- 	curhist++;
      } else
! 	histactive = HA_NOINC;
  }
  
  /* compare current line with history entry using only text in words */
--- 566,578 ----
      curhistent = gethistent(curhist);
      if (!curhistent->ftim)
  	curhistent->ftim = time(NULL);
+     defev = curhist;
+     histactive = HA_ACTIVE;
+     curhist++;
      if (interact && isset(SHINSTDIN) && !strin) {
  	attachtty(mypgrp);
      } else
! 	histactive |= HA_NOSTORE;
  }
  
  /* compare current line with history entry using only text in words */
***************
*** 638,649 ****
      int flag, save = 1;
  
      DPUTS(!chline, "BUG: chline is NULL in hend()");
!     if (histactive & (HA_NOSTORE|HA_NOINC)) {
  	zfree(chline, hlinesz);
  	zfree(chwords, chwordlen*sizeof(short));
  	chline = NULL;
! 	if (!(histactive & HA_NOINC))
! 	    curhist--;
  	histactive = 0;
  	return 1;
      }
--- 637,647 ----
      int flag, save = 1;
  
      DPUTS(!chline, "BUG: chline is NULL in hend()");
!     if (histactive & HA_NOSTORE) {
  	zfree(chline, hlinesz);
  	zfree(chwords, chwordlen*sizeof(short));
  	chline = NULL;
! 	curhist--;
  	histactive = 0;
  	return 1;
      }
***************
*** 762,771 ****
  	chwordpos--;	/* make sure we're on a word start, not end */
      /* If we're expanding an alias, we should overwrite the expansion
       * in the history.
-      * If we're in a string, we don't need the full history line
-      * and can overwrite also.
       */
!     if (((inbufflags & INP_ALIAS) || strin) && !(inbufflags & INP_HIST))
  	hwgetword = chwordpos;
      else
  	hwgetword = -1;
--- 760,767 ----
  	chwordpos--;	/* make sure we're on a word start, not end */
      /* If we're expanding an alias, we should overwrite the expansion
       * in the history.
       */
!     if ((inbufflags & INP_ALIAS) && !(inbufflags & INP_HIST))
  	hwgetword = chwordpos;
      else
  	hwgetword = -1;

-- 
Peter Stephenson <pws@ifh.de>       Tel: +49 33762 77366
WWW:  http://www.ifh.de/~pws/       Fax: +49 33762 77413
Deutsches Elektronen-Synchrotron --- Institut fuer Hochenergiephysik Zeuthen
DESY-IfH, 15735 Zeuthen, Germany.

Oops (was Re: Core dump in 3.0.3-test5)

[Peter Stephenson]

Peter Stephenson (moi) wrote:
> There's another aspect to this, at least in 3.1.x after the latest
> history reorganisation.

I've just remembered why I needed HA_NOINC and it's still necessary.
Otherwise, when you do !!<TAB>, it thinks you want the line before
last.  Try _this_ more minimal (grammar??) patch instead.

*** Src/hist.c.has	Fri May  9 11:29:08 1997
--- Src/hist.c	Mon May 12 11:18:57 1997
***************
*** 567,579 ****
      curhistent = gethistent(curhist);
      if (!curhistent->ftim)
  	curhistent->ftim = time(NULL);
      if (interact && isset(SHINSTDIN) && !strin) {
  	attachtty(mypgrp);
  	defev = curhist;
- 	histactive = HA_ACTIVE;
  	curhist++;
      } else
! 	histactive = HA_NOINC;
  }
  
  /* compare current line with history entry using only text in words */
--- 567,579 ----
      curhistent = gethistent(curhist);
      if (!curhistent->ftim)
  	curhistent->ftim = time(NULL);
+     histactive = HA_ACTIVE;
      if (interact && isset(SHINSTDIN) && !strin) {
  	attachtty(mypgrp);
  	defev = curhist;
  	curhist++;
      } else
! 	histactive |= HA_NOINC;
  }
  
  /* compare current line with history entry using only text in words */
***************
*** 762,771 ****
  	chwordpos--;	/* make sure we're on a word start, not end */
      /* If we're expanding an alias, we should overwrite the expansion
       * in the history.
-      * If we're in a string, we don't need the full history line
-      * and can overwrite also.
       */
!     if (((inbufflags & INP_ALIAS) || strin) && !(inbufflags & INP_HIST))
  	hwgetword = chwordpos;
      else
  	hwgetword = -1;
--- 762,769 ----
  	chwordpos--;	/* make sure we're on a word start, not end */
      /* If we're expanding an alias, we should overwrite the expansion
       * in the history.
       */
!     if ((inbufflags & INP_ALIAS) && !(inbufflags & INP_HIST))
  	hwgetword = chwordpos;
      else
  	hwgetword = -1;

-- 
Peter Stephenson <pws@ifh.de>       Tel: +49 33762 77366
WWW:  http://www.ifh.de/~pws/       Fax: +49 33762 77413
Deutsches Elektronen-Synchrotron --- Institut fuer Hochenergiephysik Zeuthen
DESY-IfH, 15735 Zeuthen, Germany.

Re: Core dump in 3.0.3-test5

[Bart Schaefer]

On May 12,  4:02am, Zoltan Hidvegi wrote:
} Subject: Re: Core dump in 3.0.3-test5
}
} > zagzig<2> mv zsh-3.0.3-test5 !#:^-tmp
} > mv zsh-3.0.3-test5 zsh-3.0.3-test5 tmp
} > zsh: segmentation fault (core dumped)  ./zsh
} 
} Fix is below.  You may not like this fix:
} 
} % echo foo !:^-bar
} zsh: no such word in event

That's fine.  What I had meant to type was !{#:^}-tmp anyway.

-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts        http://www.nbn.com/people/lantern