Re: Bug#439425: Random, but fairly regular, zsh segfaults

Re: Bug#439425: Random, but fairly regular, zsh segfaults

[Clint Adams]

On Fri, Aug 24, 2007 at 05:40:26PM -0700, Robin Lee Powell wrote:
> zsh does the following to me fairly regularily; this seems different
> to me than the other segfault bug reports.  It seems to do it
> slightly more often in my root shells.  It seems to motly occur when
> I'm typing ahead (due to engaging in complicated history searching
> or whatever during machine slowdowns).
> 
> I'm not sure how to get further data on this; it's pretty random.
> I'd be happy to work with the maintainer or upstream people, but
> note that I'm AFK from 28 Aug 2007 to 11 Sep 2007.

What are your history-related options?  What are the values of $HISTSIZE
and $SAVEHIST ?

> root@chain.digitalkingdom.org> *** glibc detected *** -su: munmap_chunk(): invalid pointer: 0x0000000000710c70 ***       /etc/exim4
> ======= Backtrace: =========
> /lib/libc.so.6(cfree+0x1b6)[0x2b66d38806b6]
> /usr/lib/zsh/4.3.4/zsh/zle.so[0x2b66d439aeb0]
> /usr/lib/zsh/4.3.4/zsh/zle.so(vihistorysearchbackward+0x6f)[0x2b66d439be9f]
> /usr/lib/zsh/4.3.4/zsh/zle.so(execzlefunc+0xd8)[0x2b66d43a1438]
> /usr/lib/zsh/4.3.4/zsh/zle.so(zlecore+0xed)[0x2b66d43a1a9d]
> /usr/lib/zsh/4.3.4/zsh/zle.so(zleread+0x41b)[0x2b66d43a20db]
> -su(ingetc+0x120)[0x43d080]
> -su[0x437f1a]
> -su(gettok+0x1b)[0x445a5b]
> -su(yylex+0x18)[0x446258]
> -su(parse_event+0x27)[0x461867]
> -su(loop+0x58)[0x43baa8]
> -su(zsh_main+0x1dc)[0x43c80c]
> /lib/libc.so.6(__libc_start_main+0xf4)[0x2b66d3828b44]
> -su[0x40f5b9]
> ======= Memory map: ========
> 00400000-00492000 r-xp 00000000 07:00 6246972                            /bin/zsh4
> 00691000-00697000 rw-p 00091000 07:00 6246972                            /bin/zsh4
> 00697000-00732000 rw-p 00697000 00:00 0                                  [heap]
> 2b66d2cf2000-2b66d2d0f000 r-xp 00000000 07:00 2965513                    /lib/ld-2.6.1.so
> 2b66d2d0f000-2b66d2d16000 rw-p 2b66d2d0f000 00:00 0
> 2b66d2f0e000-2b66d2f10000 rw-p 0001c000 07:00 2965513                    /lib/ld-2.6.1.so
> 2b66d2f10000-2b66d2f12000 r-xp 00000000 07:00 2965522                    /lib/libdl-2.6.1.so
> 2b66d2f12000-2b66d3112000 ---p 00002000 07:00 2965522                    /lib/libdl-2.6.1.so
> 2b66d3112000-2b66d3114000 rw-p 00002000 07:00 2965522                    /lib/libdl-2.6.1.so
> 2b66d3114000-2b66d3129000 r-xp 00000000 07:00 2965514                    /lib/libnsl-2.6.1.so
> 2b66d3129000-2b66d3329000 ---p 00015000 07:00 2965514                    /lib/libnsl-2.6.1.so
> 2b66d3329000-2b66d332b000 rw-p 00015000 07:00 2965514                    /lib/libnsl-2.6.1.so
> 2b66d332b000-2b66d332d000 rw-p 2b66d332b000 00:00 0
> 2b66d332d000-2b66d337b000 r-xp 00000000 07:00 11571957                   /lib/libncurses.so.5.6
> 2b66d337b000-2b66d357a000 ---p 0004e000 07:00 11571957                   /lib/libncurses.so.5.6
> 2b66d357a000-2b66d3589000 rw-p 0004d000 07:00 11571957                   /lib/libncurses.so.5.6
> 2b66d3589000-2b66d3609000 r-xp 00000000 07:00 2965526                    /lib/libm-2.6.1.so
> 2b66d3609000-2b66d3808000 ---p 00080000 07:00 2965526                    /lib/libm-2.6.1.so
> 2b66d3808000-2b66d380a000 rw-p 0007f000 07:00 2965526                    /lib/libm-2.6.1.so
> 2b66d380a000-2b66d380b000 rw-p 2b66d380a000 00:00 0
> 2b66d380b000-2b66d3958000 r-xp 00000000 07:00 2965518                    /lib/libc-2.6.1.so
> 2b66d3958000-2b66d3b58000 ---p 0014d000 07:00 2965518                    /lib/libc-2.6.1.so
> 2b66d3b58000-2b66d3b5b000 r--p 0014d000 07:00 2965518                    /lib/libc-2.6.1.so
> 2b66d3b5b000-2b66d3b5d000 rw-p 00150000 07:00 2965518                    /lib/libc-2.6.1.so
> 2b66d3b5d000-2b66d3b63000 rw-p 2b66d3b5d000 00:00 0
> 2b66d3b63000-2b66d3b6a000 r-xp 00000000 07:00 2965519                    /lib/libnss_compat-2.6.1.so
> 2b66d3b6a000-2b66d3d6a000 ---p 00007000 07:00 2965519                    /lib/libnss_compat-2.6.1.so
> 2b66d3d6a000-2b66d3d6c000 rw-p 00007000 07:00 2965519                    /lib/libnss_compat-2.6.1.so
> 2b66d3d6c000-2b66d3d76000 r-xp 00000000 07:00 2965512                    /lib/libnss_nis-2.6.1.so
> 2b66d3d76000-2b66d3f75000 ---p 0000a000 07:00 2965512                    /lib/libnss_nis-2.6.1.so
> 2b66d3f75000-2b66d3f77000 rw-p 00009000 07:00 2965512                    /lib/libnss_nis-2.6.1.so
> 2b66d3f77000-2b66d3f81000 r-xp 00000000 07:00 2965527                    /lib/libnss_files-2.6.1.so
> 2b66d3f81000-2b66d4180000 ---p 0000a000 07:00 2965527                    /lib/libnss_files-2.6.1.so
> 2b66d4180000-2b66d4182000 rw-p 00009000 07:00 2965527                    /lib/libnss_files-2.6.1.so
> 2b66d4183000-2b66d4185000 r-xp 00000000 07:00 13058896                   /usr/lib/zsh/4.3.4/zsh/terminfo.so
> 2b66d4185000-2b66d4384000 ---p 00002000 07:00 13058896                   /usr/lib/zsh/4.3.4/zsh/terminfo.so
> 2b66d4384000-2b66d4385000 rw-p 00001000 07:00 13058896                   /usr/lib/zsh/4.3.4/zsh/terminfo.so
> 2b66d4385000-2b66d43be000 r-x%

Re: Bug#439425: Random, but fairly regular, zsh segfaults

[Peter Stephenson]

Clint Adams wrote:
> On Fri, Aug 24, 2007 at 05:40:26PM -0700, Robin Lee Powell wrote:
> > zsh does the following to me fairly regularily; this seems different
> > to me than the other segfault bug reports.  It seems to do it
> > slightly more often in my root shells.  It seems to motly occur when
> > I'm typing ahead (due to engaging in complicated history searching
> > or whatever during machine slowdowns).
> > 
> > I'm not sure how to get further data on this; it's pretty random.
> > I'd be happy to work with the maintainer or upstream people, but
> > note that I'm AFK from 28 Aug 2007 to 11 Sep 2007.
> 
> What are your history-related options?  What are the values of $HISTSIZE
> and $SAVEHIST ?

It would be good to get a backtrace with full debugging information
(configure with --enable-zsh-debug; it shouldn't make any difference to
normal use), also to know how you're invoking the history search
mechanism (there are lots of ways in).

Thanks.
-- 
Peter Stephenson <p.w.stephenson@ntlworld.com>
Web page now at http://homepage.ntlworld.com/p.w.stephenson/

Re: Bug#439425: Random, but fairly regular, zsh segfaults

[Robin Lee Powell]

On Sat, Aug 25, 2007 at 06:50:12PM +0100, Peter Stephenson wrote:
> Clint Adams wrote:
> > On Fri, Aug 24, 2007 at 05:40:26PM -0700, Robin Lee Powell
> > wrote:
> > > zsh does the following to me fairly regularily; this seems
> > > different to me than the other segfault bug reports.  It seems
> > > to do it slightly more often in my root shells.  It seems to
> > > motly occur when I'm typing ahead (due to engaging in
> > > complicated history searching or whatever during machine
> > > slowdowns).
> > > 
> > > I'm not sure how to get further data on this; it's pretty
> > > random. I'd be happy to work with the maintainer or upstream
> > > people, but note that I'm AFK from 28 Aug 2007 to 11 Sep 2007.
> > 
> > What are your history-related options?  What are the values of
> > $HISTSIZE and $SAVEHIST ?
> 
> It would be good to get a backtrace with full debugging
> information (configure with --enable-zsh-debug; it shouldn't make
> any difference to normal use), also to know how you're invoking
> the history search mechanism (there are lots of ways in).

Recompiling zsh will have to wait until I'm back from Japan; sorry.
I use "bindkey -v", and the most common ways I get to the history
are ESC-k and ESC-/

-Robin

-- 
http://www.digitalkingdom.org/~rlpowell/ *** http://www.lojban.org/
Reason #237 To Learn Lojban: "Homonyms: Their Grate!"
Proud Supporter of the Singularity Institute - http://singinst.org/

Re: Bug#439425: Random, but fairly regular, zsh segfaults

[Clint Adams]

On Sat, Aug 25, 2007 at 10:54:22AM -0700, Robin Lee Powell wrote:
> Recompiling zsh will have to wait until I'm back from Japan; sorry.
> I use "bindkey -v", and the most common ways I get to the history
> are ESC-k and ESC-/

In your case you can just install the zsh-dbg package and make sure that
you're generating core files.

Re: Bug#439425: Random, but fairly regular, zsh segfaults

[Robin Lee Powell]

On Sun, Aug 26, 2007 at 08:11:37PM -0400, Clint Adams wrote:
> On Sat, Aug 25, 2007 at 10:54:22AM -0700, Robin Lee Powell wrote:
> > Recompiling zsh will have to wait until I'm back from Japan;
> > sorry. I use "bindkey -v", and the most common ways I get to the
> > history are ESC-k and ESC-/
> 
> In your case you can just install the zsh-dbg package and make
> sure that you're generating core files.

Done.  I'll let you know what I get when it happens again (likely
after I get back in 2 weeks).

-Robin

-- 
http://www.digitalkingdom.org/~rlpowell/ *** http://www.lojban.org/
Reason #237 To Learn Lojban: "Homonyms: Their Grate!"
Proud Supporter of the Singularity Institute - http://singinst.org/

Re: Bug#439425: Random, but fairly regular, zsh segfaults

[Robin Lee Powell]

On Sat, Aug 25, 2007 at 10:51:12AM -0400, Clint Adams wrote:
> On Fri, Aug 24, 2007 at 05:40:26PM -0700, Robin Lee Powell wrote:
> > zsh does the following to me fairly regularily; this seems different
> > to me than the other segfault bug reports.  It seems to do it
> > slightly more often in my root shells.  It seems to motly occur when
> > I'm typing ahead (due to engaging in complicated history searching
> > or whatever during machine slowdowns).
> > 
> > I'm not sure how to get further data on this; it's pretty random.
> > I'd be happy to work with the maintainer or upstream people, but
> > note that I'm AFK from 28 Aug 2007 to 11 Sep 2007.
> 
> What are your history-related options?  What are the values of $HISTSIZE
> and $SAVEHIST ?

rlpowell@chain.digitalkingdom.org> set | grep -a -i hist
'*'=(notify set 'history=100' 'savehist=100')
@=(notify set 'history=100' 'savehist=100')
HISTCHARS='!^#'
HISTCMD=6
HISTSIZE=30000
SAVEHIST=0
argv=(notify set 'history=100' 'savehist=100')
histchars='!^#'
history
historywords

Come to think of it, I may want to change SAVEHIST.  I suspect my
grotesquely large HISTSIZE is relevant, though.

-Robin

Re: Bug#426161: zsh: crashes in reverse_menu

[Clint Adams]

On Sat, May 26, 2007 at 10:54:26PM +0200, Jörg Sommer wrote:
> Hi,
> 
> after typing “vared CF” I've called “reverse-menu-complete” with M-x and
> zsh crashes. This also happens in zsh-beta 4.3.4-dev-0+20070516-1 and is
> not #416970.
> 
> % gdb zsh
> <0,2416>(iBook):~% vared CF 
> Program received signal SIGSEGV, Segmentation fault.
> 0x0fbc87d8 in reverse_menu (dummy=0xfc3be40, dummy2=0x0)
>     at ../../../Src/Zle/compresult.c:1231
> 1231    ../../../Src/Zle/compresult.c: No such file or directory.
>         in ../../../Src/Zle/compresult.c
> (gdb) bt
> #0  0x0fbc87d8 in reverse_menu (dummy=0xfc3be40, dummy2=0x0)
>     at ../../../Src/Zle/compresult.c:1231
> #1  0x1004a4c8 in runhookdef ()
> #2  0x0fc19e2c in reversemenucomplete (args=<value optimized out>)
>     at ../../../Src/Zle/zle_tricky.c:357
> #3  0x0fc13738 in completecall (args=<value optimized out>)
>     at ../../../Src/Zle/zle_tricky.c:208
> #4  0x0fc04eec in execzlefunc (func=0xfc39804, args=0xfc3be40, 
>     set_bindk=269896152) at ../../../Src/Zle/zle_main.c:1254
> #5  0x0fc0510c in zlecore () at ../../../Src/Zle/zle_main.c:1019
> #6  0x0fc057e4 in zleread (lp=<value optimized out>, rp=<value optimized out>, 
>     flags=<value optimized out>, context=<value optimized out>)
>     at ../../../Src/Zle/zle_main.c:1174
> #7  0x100394b4 in ingetc ()
> #8  0x10034264 in ?? ()
> #9  0x10041b7c in gettok ()
> #10 0x100425e4 in yylex ()
> #11 0x10060c08 in parse_event ()
> #12 0x10037a94 in loop ()
> #13 0x1003883c in zsh_main ()
> #14 0x1000b8b0 in main ()

This is because reverse_menu() is trying to dereference minfo.group
which is NULL.

Re: Bug#426161: zsh: crashes in reverse_menu

[Peter Stephenson]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 986 bytes --]

Clint Adams wrote:
> On Sat, May 26, 2007 at 10:54:26PM +0200, Jörg Sommer wrote:
> > Hi,
> > 
> > after typing “vared CF” I've called “reverse-menu-complete” with M-x and
> > zsh crashes. This also happens in zsh-beta 4.3.4-dev-0+20070516-1 and is
> > not #416970.
> 
> This is because reverse_menu() is trying to dereference minfo.group
> which is NULL.

I suspect that means we shouldn't do that.

Index: Src/Zle/compresult.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/Zle/compresult.c,v
retrieving revision 1.70
diff -u -r1.70 compresult.c
--- Src/Zle/compresult.c	30 Oct 2006 14:13:39 -0000	1.70
+++ Src/Zle/compresult.c	28 May 2007 12:29:55 -0000
@@ -1227,6 +1227,9 @@
 {
     int was_meta;
 
+    if (minfo.cur == NULL)
+	return 1;
+
     do {
 	if (minfo.cur == (minfo.group)->matches) {
 	    do {

-- 
Peter Stephenson <p.w.stephenson@ntlworld.com>
Web page now at http://homepage.ntlworld.com/p.w.stephenson/

release whinging

[Clint Adams]

It's been over a year since 4.3.2, and the diff is well over a meg.
A 4.3.3 release would make things easier.

Re: release whinging

[Peter Stephenson]

Clint Adams wrote:
> It's been over a year since 4.3.2, and the diff is well over a meg.
> A 4.3.3 release would make things easier.

Yes, I don't think the remaining completion tweaks are going to come
along immediately, since I keep putting them off, so I'll do this some
time.

pws