Segfault on "task <Tab><Tab>" with zsh 5.0.2

[Axel Beckert <abe@deuxchevaux.org>]

[-- Attachment #1: Type: text/plain, Size: 4078 bytes --]

Hi,

I managed to get my zsh 5.0.2 to segfault on entering "task " and then
pressing the tabulator key twice.

/usr/share/zsh/functions/Completion/Unix/_task comes from Debian's
task package (see
http://sources.debian.net/src/task/2.2.0-3/scripts/zsh/_task) and
there is a /usr/share/zsh/functions/Completion/Unix.zwc coming from
Debian's zsh (actually zsh-common) package. As part of the completion
is data output by task, i.e. based on my tasks, it may be necessary to
have one or more of my specfic tasks to reproduce the issue.

Actually with a virgin, i.e. empty task database it is not
reproducible as the completion errors out with
"_task_attributes:zregexparse:4: not enough regex arguments". Also
adding one simple task with "task add foo" does not suffice.

It also is not reproducible with the 5.0.2 zsh from the official
Debian package as currently in Debian Testing/Unstable (5.0.2-3 which
was compiled back in May 2013, probably with gcc 4.7) but it happened
with a 5.0.2 compiled about two weeks ago ([1] likely with gcc 4.8)
without ansi2knr as that one no more seems to exists in Debian
Unstable. (I can lookup the exact compiler versions if necessary.)

[1] http://jenkins.grml.org/view/Debian/job/zsh-binaries/lastSuccessfulBuild/architecture=amd64/
    http://jenkins.grml.org/view/Debian/job/zsh-binaries/lastSuccessfulBuild/architecture=amd64/consoleText

For some reason I expected that both, the earlier and the later
compiled 5.0.2 should both behave identically, but to my surprise only
one of them did segfault and the other seemed to work fine.

So it looks to me as if it depends on either ansi2knr being available
or on the compiler version used. Or maybe some libraries?

It happens with both, my grml-based zshrc as well as with "zsh -f" +
"autoload -Uz compinit" + "compinit"

Compressed (due to its size) backtrace of the following attached:

L1 % zsh -f
L2 % autoload -Uz compinit
L2 % compinit
L2 % task <Tab><Tab>
[1]    19105 segmentation fault (core dumped)  zsh -f
L1 %

First few lines of the backtrace:

Program received signal SIGSEGV, Segmentation fault.
freecvdef (d=0x100000001) at ../../../Src/Zle/computil.c:2799
2799    ../../../Src/Zle/computil.c: No such file or directory.
#0  freecvdef (d=0x100000001) at ../../../Src/Zle/computil.c:2799
#1  0x00007ffff599f8a4 in get_cvdef (args=<optimized out>, nam=<optimized out>) at ../../../Src/Zle/computil.c:2998
#2  bin_compvalues (nam=<optimized out>, args=<optimized out>, ops=<optimized out>, func=<optimized out>) at ../../../Src/Zle/computil.c:3347
#3  0x000000000041c8d6 in execbuiltin (args=args@entry=0x7ffff592c6b0, bn=bn@entry=0x7ffff5ba9520 <bintab+448>) at ../../Src/builtin.c:450
#4  0x000000000042a790 in execcmd (state=0x7ffffffeccf0, input=<optimized out>, output=<optimized out>, how=<optimized out>, last1=2) at ../../Src/exec.c:3259
#5  0x000000000042aced in execpline2 (state=0x7ffffffeccf0, pcode=3, pcode@entry=707, how=18, input=0, output=0, last1=1667588640, last1@entry=0) at ../../Src/exec.c:1677
#6  0x000000000042b214 in execpline (state=state@entry=0x7ffffffeccf0, slcode=<optimized out>, how=how@entry=18, last1=0) at ../../Src/exec.c:1462
#7  0x000000000042c5a2 in execlist (state=state@entry=0x7ffffffeccf0, dont_change_job=dont_change_job@entry=1, exiting=exiting@entry=0) at ../../Src/exec.c:1245
#8  0x000000000044c1c0 in execif (state=0x7ffffffeccf0, do_exec=0) at ../../Src/loop.c:500
#9  0x0000000000429caf in execcmd (state=0x7ffffffeccf0, input=<optimized out>, output=<optimized out>, how=<optimized out>, last1=2) at ../../Src/exec.c:3200
#10 0x000000000042aced in execpline2 (state=0x7ffffffeccf0, pcode=3, pcode@entry=707, how=18, input=0, output=0, last1=1667588640, last1@entry=0) at ../../Src/exec.c:1677

		Kind regards, Axel
-- 
/~\  Plain Text Ribbon Campaign                   | Axel Beckert
\ /  Say No to HTML in E-Mail and News            | abe@deuxchevaux.org  (Mail)
 X   See http://www.asciiribbon.org/              | abe@noone.org (Mail+Jabber)
/ \  I love long mails: http://email.is-not-s.ms/ | http://noone.org/abe/ (Web)

[-- Attachment #2: gdb.txt.xz --]
[-- Type: application/octet-stream, Size: 3516 bytes --]