zsh 4.3.4 crashes in prompt-related code under Mac OS X

zsh 4.3.4 crashes in prompt-related code under Mac OS X

[Vincent Lefevre]

zsh 4.3.4 sometimes crashes in prompt-related code under Mac OS X.
Each time, this happens when I did a "ssh <some machine>" and the
ssh connection is (automatically) closed. Note in case this is
important: "ssh" is a zsh function here.

Here's crash information (with backtrace):

Date/Time:      2007-08-24 19:57:42.979 +0200
OS Version:     10.4.10 (Build 8R218)
Report Version: 4

Command: zsh
Path:    /opt/local/bin/zsh
Parent:  iTerm [329]

Version: ??? (???)

PID:    860
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000008

Thread 0 Crashed:
0   libSystem.B.dylib   0x90006328 free + 72
1   zsh                 0x00071640 preprompt + 224
2   zsh                 0x0002ac30 loop + 160
3   zsh                 0x0002dc5c zsh_main + 636
4   zsh                 0x0000209c _start + 760
5   zsh                 0x00001da0 start + 48


Date/Time:      2007-08-24 19:57:58.318 +0200
OS Version:     10.4.10 (Build 8R218)
Report Version: 4

Command: zsh
Path:    /opt/local/bin/zsh
Parent:  iTerm [329]

Version: ??? (???)

PID:    920
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   zsh         0x0006e890 wcs_nicechar + 848
1   zsh         0x0005ab0c stradd + 236
2   zsh         0x0005c78c putpromptchar + 3340
3   zsh         0x0005d44c promptexpand + 316
4   zsh         0x000096fc bin_print + 860
5   zsh         0x00002ce4 execbuiltin + 1588
6   zsh         0x00018014 execcmd + 9812
7   zsh         0x00018618 execpline2 + 408
8   zsh         0x00018a60 execpline + 576
9   zsh         0x000196b8 execlist + 808
10  zsh         0x00019bf8 execcursh + 184
11  zsh         0x00017b40 execcmd + 8576
12  zsh         0x00018618 execpline2 + 408
13  zsh         0x00018a60 execpline + 576
14  zsh         0x000196b8 execlist + 808
15  zsh         0x00019c64 execode + 68
16  zsh         0x00019d88 runshfunc + 264
17  zsh         0x0001a14c doshfunc + 892
18  zsh         0x00069bbc callhookfunc + 124
19  zsh         0x00071688 preprompt + 296
20  zsh         0x0002ac30 loop + 160
21  zsh         0x0002dc5c zsh_main + 636
22  zsh         0x0000209c _start + 760
23  zsh         0x00001da0 start + 48


Date/Time:      2007-08-24 19:59:12.824 +0200
OS Version:     10.4.10 (Build 8R218)
Report Version: 4

Command: zsh
Path:    /opt/local/bin/zsh
Parent:  iTerm [329]

Version: ??? (???)

PID:    980
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000008

Thread 0 Crashed:
0   libSystem.B.dylib   0x90006328 free + 72
1   zsh                 0x00071640 preprompt + 224
2   zsh                 0x0002ac30 loop + 160
3   zsh                 0x0002dc5c zsh_main + 636
4   zsh                 0x0000209c _start + 760
5   zsh                 0x00001da0 start + 48


Date/Time:      2007-08-29 17:01:28.197 +0200
OS Version:     10.4.10 (Build 8R218)
Report Version: 4

Command: zsh
Path:    /opt/local/bin/zsh
Parent:  iTerm [25726]

Version: ??? (???)

PID:    26140
Thread: 0

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x00000000

Thread 0 Crashed:
0   zsh         0x0006e890 wcs_nicechar + 848
1   zsh         0x0005ab0c stradd + 236
2   zsh         0x0005c78c putpromptchar + 3340
3   zsh         0x0005d44c promptexpand + 316
4   zsh         0x000096fc bin_print + 860
5   zsh         0x00002ce4 execbuiltin + 1588
6   zsh         0x00018014 execcmd + 9812
7   zsh         0x00018618 execpline2 + 408
8   zsh         0x00018a60 execpline + 576
9   zsh         0x000196b8 execlist + 808
10  zsh         0x00019bf8 execcursh + 184
11  zsh         0x00017b40 execcmd + 8576
12  zsh         0x00018618 execpline2 + 408
13  zsh         0x00018a60 execpline + 576
14  zsh         0x000196b8 execlist + 808
15  zsh         0x00019c64 execode + 68
16  zsh         0x00019d88 runshfunc + 264
17  zsh         0x0001a14c doshfunc + 892
18  zsh         0x00069bbc callhookfunc + 124
19  zsh         0x00071688 preprompt + 296
20  zsh         0x0002ac30 loop + 160
21  zsh         0x0002dc5c zsh_main + 636
22  zsh         0x0000209c _start + 760
23  zsh         0x00001da0 start + 48

-- 
Vincent Lefèvre <vincent@vinc17.org> - Web: <http://www.vinc17.org/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.org/blog/>
Work: CR INRIA - computer arithmetic / Arenaire project (LIP, ENS-Lyon)

Re: zsh 4.3.4 crashes in prompt-related code under Mac OS X

[Peter Stephenson]

On Thu, 30 Aug 2007 10:57:11 +0200
Vincent Lefevre <vincent@vinc17.org> wrote:
> zsh 4.3.4 sometimes crashes in prompt-related code under Mac OS X.

Is it possible to get this with debugging code with line numbers?
(Generally speaking, without some fairly detailed debugging information
"sometimes crashes" reports tend to do little other than spread
despondency, although, to be fair, it's possible the desponency doesn't
spread further than me.)  If the crash is where it appears to be, I think
I'm eventually going to want to see the values of the arguments to
wcs_nicechar(), and the static variables buf, bufalloc and newalloc and the
automatic variable "s" inside wcs_nicechar().  (Or, obviously, a reliable way
of reproducing it.)

It may simply be a miscalculation of NICECHAR_MAX, in which case I've added
an extra debugging test.

Thanks
pws

Index: Src/utils.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/utils.c,v
retrieving revision 1.165
diff -u -r1.165 utils.c
--- Src/utils.c	20 Aug 2007 21:22:19 -0000	1.165
+++ Src/utils.c	30 Aug 2007 14:42:52 -0000
@@ -552,8 +552,12 @@
     if (swidep)
 	*swidep = s;
     for (mbptr = mbstr; ret; s++, mbptr++, ret--) {
+	DPUTS(s >= buf + NICECHAR_MAX,
+	      "BUG: buffer too small in wcs_nicechar");
 	if (imeta(*mbptr)) {
 	    *s++ = Meta;
+	    DPUTS(s >= buf + NICECHAR_MAX,
+		  "BUG: buffer too small for metafied char in wcs_nicechar");
 	    *s = *mbptr ^ 32;
 	} else {
 	    *s = *mbptr;


.

Re: zsh 4.3.4 crashes in prompt-related code under Mac OS X

[Vincent Lefevre]

On 2007-08-30 16:12:27 +0100, Peter Stephenson wrote:
> On Thu, 30 Aug 2007 10:57:11 +0200
> Vincent Lefevre <vincent@vinc17.org> wrote:
> > zsh 4.3.4 sometimes crashes in prompt-related code under Mac OS X.
> 
> Is it possible to get this with debugging code with line numbers?

I recompiled zsh with --enable-zsh-debug and the attached patch, but
it crashed again at the same place, without any debugging information.
Again, this happened after a ssh that lasted several days, but this
time, I closed the connection with Ctrl-D.

If I understand correctly, the crash occurs here in preprompt():

        /* The PROMPT_SP heuristic will move the prompt down to a new line
         * if there was any dangling output on the line (assuming the terminal
         * has automatic margins, but we try even if hasam isn't set). */
        char *str;
        int percents = opts[PROMPTPERCENT];
        opts[PROMPTPERCENT] = 1;
        str = promptexpand("%B%S%#%s%b", 0, NULL, NULL);
        opts[PROMPTPERCENT] = percents;
        fprintf(shout, "%s%*s\r", str, (int)columns - 1 - !hasxn, "");
        free(str);
        ^^^^

-- 
Vincent Lefèvre <vincent@vinc17.org> - Web: <http://www.vinc17.org/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.org/blog/>
Work: CR INRIA - computer arithmetic / Arenaire project (LIP, ENS-Lyon)

Re: zsh 4.3.4 crashes in prompt-related code under Mac OS X

[Peter Stephenson]

Vincent Lefevre wrote:
> If I understand correctly, the crash occurs here in preprompt():
> 
>         /* The PROMPT_SP heuristic will move the prompt down to a new line
>          * if there was any dangling output on the line (assuming the termina
> l
>          * has automatic margins, but we try even if hasam isn't set). */
>         char *str;
>         int percents = opts[PROMPTPERCENT];
>         opts[PROMPTPERCENT] = 1;
>         str = promptexpand("%B%S%#%s%b", 0, NULL, NULL);
>         opts[PROMPTPERCENT] = percents;
>         fprintf(shout, "%s%*s\r", str, (int)columns - 1 - !hasxn, "");
>         free(str);
>         ^^^^

Thanks for looking...

The obvious cause is some allocation error in promptexpand().  However,
I can't see any sign of it.  We allocate 256 bytes initially, which is
bound to be enough for the string being expanded there.  (I see one
thing that worried me a bit that I've fixed but I don't think that can
possibly be related.)

The only other possibility I can see locally is that (columns - 1 -
!hasxn) is returning a negative width that's having a bad effect, but
it should simply change the effect of the alignment.

Or maybe "shout" has got into some unusable state.  I suppose it's not
unreasonable to test it's not NULL, although it's rather paranoid.

Otherwise it's presumably a knock-on effect from some other part of the
code.

Index: Src/prompt.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/prompt.c,v
retrieving revision 1.42
diff -u -r1.42 prompt.c
--- Src/prompt.c	21 Sep 2006 16:36:53 -0000	1.42
+++ Src/prompt.c	22 Oct 2007 10:09:40 -0000
@@ -181,10 +181,10 @@
     bp1 = NULL;
     truncwidth = 0;
     putpromptchar(1, '\0');
-    addbufspc(1);
+    addbufspc(2);
     if(dontcount)
 	*bp++ = Outpar;
-    *bp = 0;
+    *bp = '\0';
     if (!ns) {
 	/* If zero, Inpar, Outpar and Nularg should be removed. */
 	for (bp = buf; *bp; ) {
Index: Src/utils.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/utils.c,v
retrieving revision 1.167
diff -u -r1.167 utils.c
--- Src/utils.c	5 Sep 2007 16:16:17 -0000	1.167
+++ Src/utils.c	22 Oct 2007 10:09:41 -0000
@@ -1160,7 +1160,7 @@
     int period = getiparam("PERIOD");
     int mailcheck = getiparam("MAILCHECK");
 
-    if (isset(PROMPTSP) && isset(PROMPTCR) && !use_exit_printed) {
+    if (isset(PROMPTSP) && isset(PROMPTCR) && !use_exit_printed && shout) {
 	/* The PROMPT_SP heuristic will move the prompt down to a new line
 	 * if there was any dangling output on the line (assuming the terminal
 	 * has automatic margins, but we try even if hasam isn't set).
@@ -1284,7 +1284,7 @@
 		checkmailpath(arr);
 		popheap();
 	    }
-	} else {
+	} else if (shout) {
 	    if (st.st_size && st.st_atime <= st.st_mtime &&
 		st.st_mtime > lastmailcheck) {
 		if (!u) {
@@ -2302,7 +2302,7 @@
 	if (ask) {
 	    if (noquery(0)) {
 		x = 'n';
-	    } else {
+	    } else if (shout) {
 		char *pptbuf;
 		pptbuf = promptexpand(sprompt, 0, best, guess);
 		zputs(pptbuf, shout);


-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR PLC, Churchill House, Cambridge Business Park, Cowley Road
Cambridge, CB4 0WZ, UK                          Tel: +44 (0)1223 692070

Re: zsh 4.3.4 crashes in prompt-related code under Mac OS X

[Vincent Lefevre]

On 2007-10-22 11:10:55 +0100, Peter Stephenson wrote:
> Or maybe "shout" has got into some unusable state.  I suppose it's not
> unreasonable to test it's not NULL, although it's rather paranoid.

I don't know what is "shout", but I recall that the bug occurs only
after some command (ssh, called via a zsh wrapper function) has run
for several days. So, the environment had the time to change...

I've reinstalled zsh with the patch.

> --- Src/utils.c	5 Sep 2007 16:16:17 -0000	1.167
> +++ Src/utils.c	22 Oct 2007 10:09:41 -0000
> @@ -1160,7 +1160,7 @@
>      int period = getiparam("PERIOD");
>      int mailcheck = getiparam("MAILCHECK");
>  
> -    if (isset(PROMPTSP) && isset(PROMPTCR) && !use_exit_printed) {
> +    if (isset(PROMPTSP) && isset(PROMPTCR) && !use_exit_printed && shout) {

zsh 4.3.4 doesn't have !use_exit_printed, so I modified the above
lines in the following way:

-    if (isset(PROMPTSP) && isset(PROMPTCR)) {
+    if (isset(PROMPTSP) && isset(PROMPTCR) && !use_exit_printed && shout) {

-- 
Vincent Lefèvre <vincent@vinc17.org> - Web: <http://www.vinc17.org/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.org/blog/>
Work: CR INRIA - computer arithmetic / Arenaire project (LIP, ENS-Lyon)

Re: zsh 4.3.4 crashes in prompt-related code under Mac OS X

[Peter Stephenson]

Vincent Lefevre wrote:
> On 2007-10-22 11:10:55 +0100, Peter Stephenson wrote:
> > Or maybe "shout" has got into some unusable state.  I suppose it's not
> > unreasonable to test it's not NULL, although it's rather paranoid.
> 
> I don't know what is "shout", but I recall that the bug occurs only
> after some command (ssh, called via a zsh wrapper function) has run
> for several days. So, the environment had the time to change...

"shout" is the file used by the shell for interactive I/O.  It can't be
NULL globally since nothing interactive would work, but I'm wondering if
the prompt is being set up in a funny state in this case.

> I've reinstalled zsh with the patch.

I don't have that much hope, but it's worth trying.

> zsh 4.3.4 doesn't have !use_exit_printed, so I modified the above
> lines in the following way:

Should be fine.

-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR PLC, Churchill House, Cambridge Business Park, Cowley Road
Cambridge, CB4 0WZ, UK                          Tel: +44 (0)1223 692070

Re: zsh 4.3.4 crashes in prompt-related code under Mac OS X

[Vincent Lefevre]

On 2007-10-23 13:54:16 +0200, Vincent Lefevre wrote:
> I've reinstalled zsh with the patch.

and I still got the same crash.

-- 
Vincent Lefèvre <vincent@vinc17.org> - Web: <http://www.vinc17.org/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.org/blog/>
Work: CR INRIA - computer arithmetic / Arenaire project (LIP, ENS-Lyon)

Re: zsh 4.3.4 crashes in prompt-related code under Mac OS X

[Peter Stephenson]

Vincent Lefevre wrote:
> On 2007-10-23 13:54:16 +0200, Vincent Lefevre wrote:
> > I've reinstalled zsh with the patch.
> 
> and I still got the same crash.

I'm now at the stage where I won't be able to do anything more without a
detailed debugging trace with symbols.

pws