zsh malloc bug

zsh malloc bug

[Dave Yost]

Hi.

Z% echo $ZSH_VERSION 
4.1.1
Z% uname -a 
Darwin ip2 7.4.0 Darwin Kernel Version 7.4.0: Wed May 12 16:58:24 PDT 2004; root:xnu/xnu-517.7.7.obj~7/RELEASE_PPC  Power Macintosh powerpc

I ran the script below and 1 second later hit ^C, eliciting this output:

Z% ./bug
^Cint
*** malloc[21559]: Deallocation of a pointer not malloced: 0x10f3c0; This could be a double free(), or free() called with the middle of an allocated block; Try setting environment variable MallocHelp to see tools to help debug
Z% 

Here's the script

==============
#!/bin/zsh

TRAPEXIT() {
	echo exit
}

TRAPINT() {
	echo int
	exit
}

sleep 5
# Now type control-c

# or wait til here for a bus error
while true
do
	sleep 1
done
==============

I have a slightly more complicated script that elicits two malloc debug printouts.  I'll send it to whoever fixes this.

See also: my email with the subject "zsh needs try-finally".

Dave

Re: zsh malloc bug

[Peter Stephenson]

Dave Yost wrote:
> Z% echo $ZSH_VERSION 
> 4.1.1
> Z% uname -a 
> Darwin ip2 7.4.0 Darwin Kernel Version 7.4.0: Wed May 12 16:58:24 PDT 2004; r
> oot:xnu/xnu-517.7.7.obj~7/RELEASE_PPC  Power Macintosh powerpc

Thanks for the report... could you try 4.2.0?  Traps have changed in
various ways and this doesn't happen after a short test on my latest
code.

pws


**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.

www.mimesweeper.com
**********************************************************************

Re: zsh malloc bug

[Dave Yost]

At 10:32 AM +0100 2004-06-02, Peter Stephenson wrote:
>Dave Yost wrote:
>> Z% echo $ZSH_VERSION
>> 4.1.1
>> Z% uname -a
>> Darwin ip2 7.4.0 Darwin Kernel Version 7.4.0: Wed May 12 16:58:24 PDT 2004; r
>> oot:xnu/xnu-517.7.7.obj~7/RELEASE_PPC  Power Macintosh powerpc
>
>Thanks for the report... could you try 4.2.0?  Traps have changed in
>various ways and this doesn't happen after a short test on my latest
>code.

zsh 4.2.0 hangs on my cygwin system when I try some of these scenarios.

BTW, the TRAPxxx documentation should be more explicit about whether trapping the event prevents exit and what happens if you exit explicitly from within the trap.

Thanks

Dave

==============================
#!/bin/zsh

reason=

TRAPINT() {
	#echo int
	reason=int
	exit 100
}

TRAPZERR() {
	#echo zerr
	reason=zerr
	exit 101 # is this necessary?
}

TRAPEXIT() {
	echo exit $reason
	# exit?
}

sleep $1

# Try ^C here sometimes.

echo after sleep

set -e

cp

echo after command

Re: zsh malloc bug

[Peter Stephenson]

Dave Yost wrote:
> zsh 4.2.0 hangs on my cygwin system when I try some of these scenarios.

I couldn't get this to happen on Solaris 8 or Fedora Core 1.  I would be
a bit suspicious about Cygwin, since they had to jump through lots of
hoops to make it look like a UNIX environment.

> BTW, the TRAPxxx documentation should be more explicit about whether trapping
>  the event prevents exit

Yes, it should say how the return status is handled and apparently it
doesn't.  That's a big omission.

> and what happens if you exit explicitly from within the trap.

I'm not quite sure what this means, since if you exit explicitly with
the trap it exits, but the recent behaviour is not to run exit traps at
that point.

Index: Doc/Zsh/func.yo
===================================================================
RCS file: /cvsroot/zsh/zsh/Doc/Zsh/func.yo,v
retrieving revision 1.7
diff -u -r1.7 func.yo
--- Doc/Zsh/func.yo	10 Jul 2001 08:59:18 -0000	1.7
+++ Doc/Zsh/func.yo	8 Jun 2004 13:17:22 -0000
@@ -193,6 +193,24 @@
 
 If a function of this form is defined and null,
 the shell and processes spawned by it will ignore tt(SIG)var(NAL).
+
+The return value from the function is handled specially.  If it is
+zero, the signal is assumed to have been handled, and execution continues
+normally.  Otherwise, the normal effect of the signal is produced;
+if this causes execution to terminate, the status returned to the shell is
+the status returned from the function.
+
+Programs terminated by uncaught signals typically return the status 128
+plus the signal number.  Hence the following causes the handler for
+tt(SIGINT) to print a message, then mimic the usual effect of the signal.
+
+example(TRAPINT() {
+  print "Caught SIGINT, aborting."
+  return $(( 128 + $1 ))
+})
+
+The functions tt(TRAPZERR), tt(TRAPDEBUG) and tt(TRAPEXIT) are never
+executed inside other traps.
 )
 findex(TRAPDEBUG)
 item(tt(TRAPDEBUG))(

-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR Ltd., Science Park, Milton Road,
Cambridge, CB4 0WH, UK                          Tel: +44 (0)1223 692070


**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.

www.mimesweeper.com
**********************************************************************

RANDOMSMALL <range> [ <seed> ]

[Dave Yost]

Zsh's RANDOM function is deficient.  I propose a new builtin a la the lesson learned in the Java world.

http://java.sun.com/docs/books/effective/excursion-random.html

Dave

Re: RANDOMSMALL <range> [ <seed> ]

[Peter Stephenson]

> Zsh's RANDOM function is deficient.

It's limited by POSIX, though I haven't checked how much.  Look at the
math function rand48 in the zsh/mathfunc package --- search zshmodules.

-- 
Peter Stephenson <pws@pwstephenson.fsnet.co.uk>
Work: pws@csr.com
Web: http://www.pwstephenson.fsnet.co.uk

PATCH: Re: RANDOMSMALL <range> [ <seed> ]

[Peter Stephenson]

Peter Stephenson wrote:
> Look at the math function rand48 in the zsh/mathfunc package.

Ooops, this turns out to be badly broken when used with a seed
parameter.  After the second time you always get the same number.
Not actually all that random.

Index: Src/Modules/mathfunc.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/Modules/mathfunc.c,v
retrieving revision 1.4
diff -u -r1.4 mathfunc.c
--- Src/Modules/mathfunc.c	2 Jun 2004 22:15:00 -0000	1.4
+++ Src/Modules/mathfunc.c	8 Jun 2004 21:42:14 -0000
@@ -500,7 +500,7 @@
 		     * to each unsigned short.
 		     */
 		    for (i = 0; i < 3 && !do_init; i++) {
-			unsigned short *seedptr = seedbuf + i;
+			unsigned short *seedptr = seedbufptr + i;
 			*seedptr = 0;
 			for (j = 0; j < 4; j++) {
 			    if (*seedstr >= '0' && *seedstr <= '9')

-- 
Peter Stephenson <pws@pwstephenson.fsnet.co.uk>
Work: pws@csr.com
Web: http://www.pwstephenson.fsnet.co.uk

Re: RANDOMSMALL <range> [ <seed> ]

[Larry Bakst]

I would suggest Mersenne Twister for all random numbers which is located here:

http://www.math.sci.hiroshima-u.ac.jp/%7Em-mat/MT/emt.html

leb


>Zsh's RANDOM function is deficient.  I propose a new builtin a la the lesson learned in the Java world.
>
>http://java.sun.com/docs/books/effective/excursion-random.html
>
>Dave


-- 
Lawrence E. Bakst
pleb@iridescent.org

Re: zsh malloc bug

[Dave Yost]

At 2:20 PM +0100 2004-06-08, Peter Stephenson wrote:
>Dave Yost wrote:
>> zsh 4.2.0 hangs on my cygwin system when I try some of these scenarios.
>
>I couldn't get this to happen on Solaris 8 or Fedora Core 1.  I would be
>a bit suspicious about Cygwin, since they had to jump through lots of
>hoops to make it look like a UNIX environment.

It happens on Mac OS X.

>
>> BTW, the TRAPxxx documentation should be more explicit about whether trapping
>>  the event prevents exit
>
>Yes, it should say how the return status is handled and apparently it
>doesn't.  That's a big omission.

Not anymore!  Thanks for updating the doc and for sending the update along.

Dave

============== revised source
==============================
#!/bin/zsh

TRAPINT() {
	echo Interrupted
	exit 2
}

TRAPZERR() {
	reason=$?
	echo Failed command.
	exit $reason
}

TRAPEXIT() {
	echo exited normally
}

sleep $1

# Try ^C here sometimes.

echo after sleep

set -e

cp

echo after command