Crash in reverse-menu-complete with menu-selection

Crash in reverse-menu-complete with menu-selection

[Mikael Magnusson]

% zsh -f
% autoload compinit
% compinit -D
% zmodload zsh/complist
% bindkey '^F' menu-select
% bindkey '^B' reverse-menu-complete
% ls <ctrl-f><enter><ctrl-f><ctrl-b>

(btw, I just realized after a couple of years if you do 'alias %=' in
the zsh -f you can paste things like these more easily).

Reproduced on 4.3.2 (32bit), 4.3.6 and current cvs.

I'm posting this in the hope that the crash might be obvious to
someone, if not, I can dig around myself for a while and see if I can
turn anything up.

Program received signal SIGSEGV, Segmentation fault.
0x00007fc96a4b5f92 in memcpy () from /lib/libc.so.6
(gdb) bt
#0  0x00007fc96a4b5f92 in memcpy () from /lib/libc.so.6
#1  0x00007fc969bfba5a in setlastline () at zle_utils.c:1139
#2  0x00007fc969bf20a7 in docomplete (lst=0) at zle_tricky.c:608
#3  0x00007fc969bf142e in menucomplete (args=0x7fc969e0e928) at zle_tricky.c:247
#4  0x00007fc969bf17b6 in reversemenucomplete (args=0x7fc969e0e928) at
zle_tricky.c:349
#5  0x00007fc968f516cc in domenuselect (dummy=0x0, dat=0x0) at complist.c:3220
#6  0x00007fc968f51f39 in menuselect (args=0x7fc969e0e928) at complist.c:3383
#7  0x00007fc969be017d in execzlefunc (func=0xac28c0,
args=0x7fc969e0e928, set_bindk=0)
    at zle_main.c:1333
#8  0x00007fc969bdf524 in zlecore () at zle_main.c:1058
#9  0x00007fc969bdfc91 in zleread (lp=0x6c1998, rp=0x0, flags=3, context=0)
    at zle_main.c:1227
#10 0x00007fc969be1fdd in zle_main_entry (cmd=1, ap=0x7fff182fd710) at
zle_main.c:1889
#11 0x0000000000444a62 in zleentry (cmd=1) at init.c:1354
#12 0x00000000004454bb in inputline () at input.c:281
#13 0x0000000000445332 in ingetc () at input.c:217
#14 0x000000000043b02a in ihgetc () at hist.c:279
#15 0x000000000044d46c in gettok () at lex.c:694
#16 0x000000000044cc51 in zshlex () at lex.c:381
#17 0x000000000046a0fb in parse_event () at parse.c:451
#18 0x0000000000441e01 in loop (toplevel=1, justonce=0) at init.c:132
#19 0x0000000000444f31 in zsh_main (argc=2, argv=0x7fff182fdad8) at init.c:1508
#20 0x0000000000410634 in main (argc=2, argv=0x7fff182fdad8) at ./main.c:93
(gdb) bt full
#0  0x00007fc96a4b5f92 in memcpy () from /lib/libc.so.6
No symbol table info available.
#1  0x00007fc969bfba5a in setlastline () at zle_utils.c:1139
No locals.
#2  0x00007fc969bf20a7 in docomplete (lst=0) at zle_tricky.c:608
        active = 1
        s = 0x7fc969bbe000 "\177ELF\002\001\001"
        ol = 0x7fc96b082452 "H\211\303d\213\004%\030"
        olst = 0
        chl = 0
        ne = 0
        ocs = 1760837632
        ret = 0
        dat = {0, 0}
#3  0x00007fc969bf142e in menucomplete (args=0x7fc969e0e928) at zle_tricky.c:247
No locals.
#4  0x00007fc969bf17b6 in reversemenucomplete (args=0x7fc969e0e928) at
zle_tricky.c:349
No locals.
#5  0x00007fc968f516cc in domenuselect (dummy=0x0, dat=0x0) at complist.c:3220
        fdat = 0x0
        lastsearch = 0x0
        p = 0xb29f30
        pg = 0xb33510
        cmd = 0x7fc969e0b9c0
        do_last_key = 0
        u = 0x0
        i = 1
        acc = 0
        wishcol = 0
        setwish = 0
        oe = 0
        wasnext = 0
        space = 31
        lbeg = 0
        step = 1
        wrap = 32767
        pl = 1
        broken = 0
        first = 0
        nolist = 0
        mode = 0
        modecs = 12
        modell = 12
        modelen = 8
        wasmeta = 0
        s = 0x0
        status =
"\000}Ej\311\177\000\000\200\342\244\000\000\000\000\000k\354\245\000\000\000\000\000l\354\245",
'\000' <repeats 13 times>,
"\033\315Kj\311\177\000\000\000\000\000\000\377\177\000\000\001\000\000\000\000\000\000\000\320\332/\030\377\177\000\000u\205\bk\311\177\000\000\277\322/\030\377\177\000\000\000\322/\030\377\177\000\000\000\000\000\000\000\000\000\000\001\000\000\000\004",
'\000' <repeats 11 times>, "H\322/\030\377\177\000"
        modeline = 0x7fc96b286508 "ls alt-home/"
#6  0x00007fc968f51f39 in menuselect (args=0x7fc969e0e928) at complist.c:3383
        d = 0
#7  0x00007fc969be017d in execzlefunc (func=0xac28c0,
args=0x7fc969e0e928, set_bindk=0)
    at zle_main.c:1333
        wflags = 645
        r = 0
        ret = 0
        remetafy = 0
        w = 0xae08a0
        save_bindk = 0xac28c0
#8  0x00007fc969bdf524 in zlecore () at zle_main.c:1058
No locals.
#9  0x00007fc969bdfc91 in zleread (lp=0x6c1998, rp=0x0, flags=3, context=0)
    at zle_main.c:1227
        s = 0x0
        old_errno = 4
        tmout = 0
        initthingy = 0x0
#10 0x00007fc969be1fdd in zle_main_entry (cmd=1, ap=0x7fff182fd710) at
zle_main.c:1889
        lp = 0x6c1998
        rp = 0x0
        flags = 3
        context = 0
#11 0x0000000000444a62 in zleentry (cmd=1) at init.c:1354
        ret = 0x0
        ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area =
0x7fff182fd810,
            reg_save_area = 0x7fff182fd750}}
#12 0x00000000004454bb in inputline () at input.c:281
        flags = 3
        ingetcline = 0x0
        ingetcpmptl = 0x6c1998
        ingetcpmptr = 0x0
        context = 0
#13 0x0000000000445332 in ingetc () at input.c:217
        lastc = 0
#14 0x000000000043b02a in ihgetc () at hist.c:279
        c = 0
#15 0x000000000044d46c in gettok () at lex.c:694
        c = 0
        d = 0
        peekfd = -1
        peek = 0
#16 0x000000000044cc51 in zshlex () at lex.c:381
No locals.
#17 0x000000000046a0fb in parse_event () at parse.c:451
No locals.
#18 0x0000000000441e01 in loop (toplevel=1, justonce=0) at init.c:132
        prog = 0x7fc96b2865e0
        err = 0
        non_empty = 1
#19 0x0000000000444f31 in zsh_main (argc=2, argv=0x7fff182fdad8) at init.c:1508
        t = 0x7fff182fdae8
        runscript = 0x0
        t0 = 158
#20 0x0000000000410634 in main (argc=2, argv=0x7fff182fdad8) at ./main.c:93
No locals.
(gdb)


-- 
Mikael Magnusson

Re: Crash in reverse-menu-complete with menu-selection

[Bart Schaefer]

On Aug 24,  3:48pm, Mikael Magnusson wrote:
} Subject: Crash in reverse-menu-complete with menu-selection
}
} % zsh -f
} % autoload compinit
} % compinit -D
} % zmodload zsh/complist
} % bindkey '^F' menu-select
} % bindkey '^B' reverse-menu-complete
} % ls <ctrl-f><enter><ctrl-f><ctrl-b>
} 
} Reproduced on 4.3.2 (32bit), 4.3.6 and current cvs.

I can't reproduce, but when I hit that first ctrl-f I still get nothing,
as reported in the earlier thread about menu-select crashing.

I suspect this is still the same menu-select bug, just leaving some
corrupted memory as a land mine for reverse-menu-complete to step on.
If you add before bindkey

  zmodload zsh/compctl

does the crash go away?

Re: Crash in reverse-menu-complete with menu-selection

[Mikael Magnusson]

On 24 August 2010 17:16, Bart Schaefer <schaefer@brasslantern.com> wrote:
> On Aug 24,  3:48pm, Mikael Magnusson wrote:
> } Subject: Crash in reverse-menu-complete with menu-selection
> }
> } % zsh -f
> } % autoload compinit
> } % compinit -D
> } % zmodload zsh/complist
> } % bindkey '^F' menu-select
> } % bindkey '^B' reverse-menu-complete
> } % ls <ctrl-f><enter><ctrl-f><ctrl-b>
> }
> } Reproduced on 4.3.2 (32bit), 4.3.6 and current cvs.
>
> I can't reproduce, but when I hit that first ctrl-f I still get nothing,
> as reported in the earlier thread about menu-select crashing.

Which one?

> I suspect this is still the same menu-select bug, just leaving some
> corrupted memory as a land mine for reverse-menu-complete to step on.
> If you add before bindkey
>
>  zmodload zsh/compctl
>
> does the crash go away?

No. It's odd that you can't reproduce, the three versions are on
different machines and everything.

-- 
Mikael Magnusson

Re: Crash in reverse-menu-complete with menu-selection

[Bart Schaefer]

On Aug 24,  5:23pm, Mikael Magnusson wrote:
}
} > I can't reproduce, but when I hit that first ctrl-f I still get nothing,
} > as reported in the earlier thread about menu-select crashing.
} 
} Which one?

Starts with workers/28150, here:
http://www.zsh.org/mla/workers/2010/msg00599.html
Get's interesting 28158, here:
http://www.zsh.org/mla/workers/2010/msg00607.html

Re: Crash in reverse-menu-complete with menu-selection

[Mikael Magnusson]

On 24 August 2010 18:49, Bart Schaefer <schaefer@brasslantern.com> wrote:
> On Aug 24,  5:23pm, Mikael Magnusson wrote:
> }
> } > I can't reproduce, but when I hit that first ctrl-f I still get nothing,
> } > as reported in the earlier thread about menu-select crashing.
> }
> } Which one?
>
> Starts with workers/28150, here:
> http://www.zsh.org/mla/workers/2010/msg00599.html
> Get's interesting 28158, here:
> http://www.zsh.org/mla/workers/2010/msg00607.html

Compiling with --enable-zsh-debug prints zle_utils.c:1153: line
metafied which means... something? It looks like one of zleline and
zlemetaline is always NULL, and at this point the wrong one is.

Hmm... this fixes it (ie, this specific case) but I have absolutely no
idea which of these functions expect the line to be metafied and
unmetafied, and who is doing it wrong.

diff --git a/Src/Zle/complist.c b/Src/Zle/complist.c
index bac072e..37ccc7b 100644
--- a/Src/Zle/complist.c
+++ b/Src/Zle/complist.c
@@ -3217,7 +3217,9 @@ domenuselect(Hookdef dummy, Chdata dat)
                   !strcmp(cmd->nam, "reverse-menu-complete")) {
             mode = 0;
            comprecursive = 1;
+            unmetafy_line();
            reversemenucomplete(zlenoargs);
+            metafy_line();
            mselect = (*(minfo.cur))->gnum;
            setwish = 1;

-- 
Mikael Magnusson

Re: Crash in reverse-menu-complete with menu-selection

[Peter Stephenson]

On Tue, 24 Aug 2010 19:38:21 +0200
> Hmm... this fixes it (ie, this specific case) but I have absolutely no
> idea which of these functions expect the line to be metafied and
> unmetafied, and who is doing it wrong.
> 
> diff --git a/Src/Zle/complist.c b/Src/Zle/complist.c
> index bac072e..37ccc7b 100644
> --- a/Src/Zle/complist.c
> +++ b/Src/Zle/complist.c
> @@ -3217,7 +3217,9 @@ domenuselect(Hookdef dummy, Chdata dat)
>                    !strcmp(cmd->nam, "reverse-menu-complete")) {
>              mode = 0;
>             comprecursive = 1;
> +            unmetafy_line();
>             reversemenucomplete(zlenoargs);
> +            metafy_line();
>             mselect = (*(minfo.cur))->gnum;
>             setwish = 1;

Thanks.  This looks right.  The guts of completion have the line
metafied because they deal with null-terminated strings from the main
shell.  The main entry point to reversemenucomplete() from Zle would
have it unmetafied because Zle deals in indvidual characters /
codepoints (the debug check happens further in when it hits
domenucomplete()).  The boundary between the two is incredibly tortuous.

-- 
Peter Stephenson <p.w.stephenson@ntlworld.com>
Web page now at http://homepage.ntlworld.com/p.w.stephenson/