Bug report: segfault when function and alias names collide

Bug report: segfault when function and alias names collide

[Ben Hoskings]

[-- Attachment #1: Type: text/plain, Size: 5065 bytes --]

Hi all,

Just accidentally defined a function with the same name as an alias, which
caused a segfault. (I was replacing the alias with a function, and loading
the new function with '. ~/.zshrc', which caused both to be defined at
once.)

alias gls='glog -S'
gls() {
  query="$1"
  shift
  glog --pickaxe-regex "-S$query" "$@"
}

This command segfaulted zsh:

$ gls content_for

The crash report is below.

I'm running zsh 4.3.10 (i386-apple-darwin10.3.0), built via homebrew on OS X
10.6.4.

Hope that's useful.

Cheers
Ben Hoskings

---

Process:         zsh [53012]
Path:            /usr/local/Cellar/zsh/4.3.10/bin/zsh
Identifier:      zsh
Version:         ??? (???)
Code Type:       X86-64 (Native)
Parent Process:  ??? [53011]

Date/Time:       2010-07-13 10:13:17.281 +1000
OS Version:      Mac OS X 10.6.4 (10F569)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_PROTECTION_FAILURE at 0x00007fff5f3fdca0
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   zsh                            0x0000000100014fa4 findcmd + 1124
1   zsh                            0x00000001000194f5 findcmd + 18869
2   zsh                            0x00000001000198ec findcmd + 19884
3   zsh                            0x000000010001a9a7 execlist + 1863
4   zsh                            0x000000010001b0d7 runshfunc + 231
5   zsh                            0x000000010001b595 doshfunc + 1157
6   zsh                            0x000000010001b872 doshfunc + 1890
7   zsh                            0x0000000100017ee8 findcmd + 13224
[ snip ]
498 zsh                            0x00000001000194f5 findcmd + 18869
499 zsh                            0x00000001000198ec findcmd + 19884
500 zsh                            0x000000010001a9a7 execlist + 1863
501 zsh                            0x000000010001b0d7 runshfunc + 231
502 zsh                            0x000000010001b595 doshfunc + 1157
503 zsh                            0x000000010001b872 doshfunc + 1890
504 zsh                            0x0000000100017ee8 findcmd + 13224
505 zsh                            0x00000001000194f5 findcmd + 18869
506 zsh                            0x00000001000198ec findcmd + 19884
507 zsh                            0x000000010001a9a7 execlist + 1863
508 zsh                            0x000000010001b0d7 runshfunc + 231
509 zsh                            0x000000010001b595 doshfunc + 1157
510 zsh                            0x000000010001b872 doshfunc + 1890
511 zsh                            0x0000000100017ee8 findcmd + 13224

Thread 0 crashed with X86 Thread State (64-bit):
  rax: 0x00000001000a15e0  rbx: 0x0000000000000000  rcx: 0x0000000000000002
 rdx: 0x0000000000000000
  rdi: 0x00007fff5f401110  rsi: 0x0000000000000000  rbp: 0x00007fff5f400f40
 rsp: 0x00007fff5f3fdbf0
   r8: 0x0000000000000002   r9: 0x0000000000000000  r10: 0x0000000000000000
 r11: 0x0000000000000000
  r12: 0x00007fff5f401110  r13: 0x0000000000000002  r14: 0x0000000000000002
 r15: 0x0000000000000000
  rip: 0x0000000100014fa4  rfl: 0x0000000000010206  cr2: 0x00007fff5f3fdca0

Binary Images:
       0x100000000 -        0x100096ff7 +zsh ??? (???)
<FB91D33A-8970-3D19-A99D-206E3E79F866> /usr/local/bin/zsh
       0x1000b0000 -        0x1000b4fff +libgdbm.3.dylib 4.0.0
(compatibility 4.0.0) <A74D1801-78FB-58F6-82ED-52060F84B8C0>
/usr/local/Cellar/gdbm/1.8.3/lib/libgdbm.3.dylib
       0x1000f3000 -        0x1000f7ff7 +zutil.so ??? (???)
<A12BD67B-1216-1B02-6011-05E64E564BDC>
/usr/local/Cellar/zsh/4.3.10/lib/zsh/zutil.so
       0x100300000 -        0x100330fff +zle.so ??? (???)
<114EFB0E-BA18-AC14-6C44-07EE2B651A27>
/usr/local/Cellar/zsh/4.3.10/lib/zsh/zle.so
       0x100345000 -        0x100361ff7 +complete.so ??? (???)
<BD62A4B7-E05A-5B56-FFF3-2338CE0A708D>
/usr/local/Cellar/zsh/4.3.10/lib/zsh/complete.so
       0x10036a000 -        0x100370ff7 +parameter.so ??? (???)
<FE276977-5B8B-00A3-29D0-BB89F02B8FF6>
/usr/local/Cellar/zsh/4.3.10/lib/zsh/parameter.so
       0x100398000 -        0x1003a4ff7 +computil.so ??? (???)
<1D159FAC-DC8D-07B1-CDCF-92EDB887F10B>
/usr/local/Cellar/zsh/4.3.10/lib/zsh/computil.so
    0x7fff5fc00000 -     0x7fff5fc3bdef  dyld 132.1 (???)
<B536F2F1-9DF1-3B6C-1C2C-9075EA219A06> /usr/lib/dyld
    0x7fff841ce000 -     0x7fff842c6ff7  libiconv.2.dylib 7.0.0
(compatibility 7.0.0) <7E4ADB5A-CC77-DCFD-3E54-2F35A2C8D95A>
/usr/lib/libiconv.2.dylib
    0x7fff85e84000 -     0x7fff85e88ff7  libmathCommon.A.dylib 315.0.0
(compatibility 1.0.0) <95718673-FEEE-B6ED-B127-BCDBDB60D4E5>
/usr/lib/system/libmathCommon.A.dylib
    0x7fff88a05000 -     0x7fff88bc5fef  libSystem.B.dylib 125.2.0
(compatibility 1.0.0) <95E02DD0-ADEA-745B-E7FA-ABA064E4658C>
/usr/lib/libSystem.B.dylib
    0x7fff88efa000 -     0x7fff88f39fef  libncurses.5.4.dylib 5.4.0
(compatibility 5.4.0) <E1F34D53-3D62-78C0-CAD8-8AD22C110A9E>
/usr/lib/libncurses.5.4.dylib
    0x7fffffe00000 -     0x7fffffe01fff  libSystem.B.dylib ??? (???)
<95E02DD0-ADEA-745B-E7FA-ABA064E4658C> /usr/lib/libSystem.B.dylib

Re: Bug report: segfault when function and alias names collide

[Peter Stephenson]

On Tue, 13 Jul 2010 10:34:11 +1000
Ben Hoskings <ben@hoskings.net> wrote:
> Just accidentally defined a function with the same name as an alias,
> which caused a segfault. (I was replacing the alias with a function,
> and loading the new function with '. ~/.zshrc', which caused both to
> be defined at once.)
> 
> alias gls='glog -S'
> gls() {
>   query="$1"
>   shift
>   glog --pickaxe-regex "-S$query" "$@"
> }
> 
> This command segfaulted zsh:
> 
> $ gls content_for

Yes, you've created an infinite recursion.  The shell has a limit on its
recursion depth so on some systems you would get

glog:3: maximum nested function level reached

which would tell you something is screwy without crashing.  However, the
limit is a bit hit and miss.  If we reduce it we get reports that
it's too low, etc.

To avoid it, you can either define the alias after the function, or to be
safer if you know you're defining both you can quote the name of the
function, or simply use the other form of function definition:

alias gls='glog -S'
function gls {
  query="$1"
  shift
  glog --pickaxe-regex "-S$query" "$@"
}

That still defines gls as a function but the "gls" at this point isn't
expanded as an alias.

(I don't know of any good reason why it's necessary to expand aliases at
that point, beyond the fact that that's how the parser works---words in
command position are always expanded and making exceptions is tricky.)

-- 
Peter Stephenson <pws@csr.com>            Software Engineer
Tel: +44 (0)1223 692070                   Cambridge Silicon Radio Limited
Churchill House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, UK


Member of the CSR plc group of companies. CSR plc registered in England and Wales, registered number 4187346, registered office Churchill House, Cambridge Business Park, Cowley Road, Cambridge, CB4 0WZ, United Kingdom