Bug in built-in 'test' under cont $CONTEXT

Bug in built-in 'test' under cont $CONTEXT

[Takahiro SUZUKI]

Hi all,

I found a bug in builtin test command under $CONTEXT=="cont".

Using builtin test command via zle widget when zsh is pending for "for",
the shell fails with segmentation fault. This does not occur when using
/usr/bin/test instead, so I guess it is a problem of zsh.

REPRO:
% zsh -f
myhost% source zshrc_segv

myhost% for i in;    [test2 called]
for> do    [test2 called]
for> echo    [test2 called]
for> done    [test2 called]

myhost% for i in;    [test1 called]
for> do    [test1 called]
for> echo    [test1 called]
zsh: segmentation fault  zsh -f


% cat zshrc_segv
function test1 {
  # calling in $CONTEXT=cont will crash zsh
  echo -n '    [test1 called]'
  test -n ""
}
function test2 {
  # but this won't
  echo -n '    [test2 called]'
  /usr/bin/test -n ""
}
zle -N test1
zle -N test2
bindkey '^T' test1
bindkey '^[t' test2


VERSION: (ubuntu server 8.04 x86)
zsh 4.3.4 (i686-pc-linux-gnu)


--
Takahiro Suzuki

Re: Bug in built-in 'test' under cont $CONTEXT

[Mikael Magnusson]

2009/7/1 Takahiro SUZUKI <takahiro.suzuki.ja@gmail.com>:
> Hi all,
>
> I found a bug in builtin test command under $CONTEXT=="cont".
>
> Using builtin test command via zle widget when zsh is pending for "for",
> the shell fails with segmentation fault. This does not occur when using
> /usr/bin/test instead, so I guess it is a problem of zsh.
>
> REPRO:
> % zsh -f
> myhost% source zshrc_segv
>
> myhost% for i in;    [test2 called]
> for> do    [test2 called]
> for> echo    [test2 called]
> for> done    [test2 called]
>
> myhost% for i in;    [test1 called]
> for> do    [test1 called]
> for> echo    [test1 called]
> zsh: segmentation fault  zsh -f
>
>
> % cat zshrc_segv
> function test1 {
>  # calling in $CONTEXT=cont will crash zsh
>  echo -n '    [test1 called]'
>  test -n ""
> }
> function test2 {
>  # but this won't
>  echo -n '    [test2 called]'
>  /usr/bin/test -n ""
> }
> zle -N test1
> zle -N test2
> bindkey '^T' test1
> bindkey '^[t' test2
>
>
> VERSION: (ubuntu server 8.04 x86)
> zsh 4.3.4 (i686-pc-linux-gnu)

Here's just a quick backtrace with no particular analysis:
(gdb) print ecused
$9 = 3
(gdb) print eclen
$10 = 256
(gdb) bt
#0  0x080aa1fb in ecadd (c=0) at parse.c:289
#1  0x080aab96 in par_list (complex=0x7783f6f0) at parse.c:606
#2  0x080ab930 in par_for (complex=0x7783f6f0) at parse.c:996
#3  0x080ab2b1 in par_cmd (complex=0x7783f6f0) at parse.c:798
#4  0x080aaf5c in par_pline (complex=0x7783f6f0) at parse.c:728
#5  0x080aaf0c in par_sublist2 (complex=0x7783f6f0) at parse.c:709
#6  0x080aad76 in par_sublist (complex=0x7783f728) at parse.c:664
#7  0x080aa7cf in par_event () at parse.c:477
#8  0x080aa746 in parse_event () at parse.c:454
#9  0x08084472 in loop (toplevel=1, justonce=0) at init.c:131
#10 0x080871eb in zsh_main (argc=2, argv=0x7783f874) at init.c:1409
#11 0x080553c6 in main (argc=Cannot access memory at address 0xffffffff
) at ./main.c:93


-- 
Mikael Magnusson

Re: Bug in built-in 'test' under cont $CONTEXT

[Peter Stephenson]

On Wed, 01 Jul 2009 07:06:09 +0900
Takahiro SUZUKI <takahiro.suzuki.ja@gmail.com> wrote:
> I found a bug in builtin test command under $CONTEXT=="cont".
> 
> Using builtin test command via zle widget when zsh is pending for "for",
> the shell fails with segmentation fault. This does not occur when using
> /usr/bin/test instead, so I guess it is a problem of zsh.

Thanks, this made it very quick to work out what was going on.

Index: Src/builtin.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/builtin.c,v
retrieving revision 1.227
diff -u -r1.227 builtin.c
--- Src/builtin.c	20 May 2009 09:53:22 -0000	1.227
+++ Src/builtin.c	1 Jul 2009 08:57:30 -0000
@@ -5812,12 +5812,14 @@
 	}
     }
 
+    lexsave();
     testargs = argv;
     tok = NULLTOK;
     condlex = testlex;
     testlex();
     prog = parse_cond();
     condlex = zshlex;
+    lexrestore();
 
     if (errflag) {
 	errflag = 0;


-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR PLC, Churchill House, Cambridge Business Park, Cowley Road
Cambridge, CB4 0WZ, UK                          Tel: +44 (0)1223 692070