BUG: coredump with menu-select and LIST_PACKED

BUG: coredump with menu-select and LIST_PACKED

[Alexandre Duret-Lutz]

I made zsh-3.1.6-bart-7 coredump with the following :

~ % zsh -f                                                             19:47 #3
venus% mkdir empty
venus% cd empty
venus% zmodload complist
venus% touch {1..15} xxxxxxxxxxxxxxx
venus% bindkey "^[m" menu-select
venus% setopt listpacked
venus% foo <TAB>
1      11     13     15     3     5     7     9                 
10     12     14     2      4     6     8     xxxxxxxxxxxxxxx   
venus% foo <M-m>
zsh: segmentation fault (core dumped)  zsh -f

(<M-m> should be typed right after <TAB>)

I could reproduce this on Linux and Solaris.

-- 
Alexandre Duret-Lutz

Re: BUG: coredump with menu-select and LIST_PACKED

[Bart Schaefer]

On Oct 25,  8:06pm, Alexandre Duret-Lutz wrote:
} Subject: BUG: coredump with menu-select and LIST_PACKED
}
} venus% setopt listpacked
} venus% foo <TAB>
} 1      11     13     15     3     5     7     9                 
} 10     12     14     2      4     6     8     xxxxxxxxxxxxxxx   
} venus% foo <M-m>
} zsh: segmentation fault (core dumped)  zsh -f

Looks like the `amatches' global is garbage.  Here's a stack trace (this is
after patches 8412 and 8413).


#0  0x4013c377 in clprintm (g=0x80d8168, mp=0x80c2b00, mc=0, ml=0, lastc=0, 
    width=135800832, path=0x80d1ab0 "./1", buf=0xbffff0d8)
    at ../../../zsh-3.1.6/Src/Zle/complist.c:390
#1  0x40120b4a in printlist (over=1, printm=0x4013c104 <clprintm>)
    at ../../../zsh-3.1.6/Src/Zle/zle_tricky.c:9772
#2  0x4013c85d in complistmatches (dummy=0x4012d000, dat=0xbffff1cc)
    at ../../../zsh-3.1.6/Src/Zle/complist.c:487
#3  0x8080e02 in runhookdef (h=0x4012d000, d=0xbffff1cc)
    at ../../zsh-3.1.6/Src/module.c:1516
#4  0x4011dc27 in listmatches ()
    at ../../../zsh-3.1.6/Src/Zle/zle_tricky.c:9229
#5  0x40101cfd in zrefresh () at ../../../zsh-3.1.6/Src/Zle/zle_refresh.c:602
#6  0x4013cb5f in domenuselect (dummy=0x0, dat=0x0)
    at ../../../zsh-3.1.6/Src/Zle/complist.c:566
#7  0x4013ddb8 in menuselect (args=0x4012cf90)
    at ../../../zsh-3.1.6/Src/Zle/complist.c:884
#8  0x400fab48 in execzlefunc (func=0x811b968, args=0x4012cf90)
    at ../../../zsh-3.1.6/Src/Zle/zle_main.c:630
#9  0x400fa59f in zleread (lp=0x80e9320 "%m<%h> ", rp=0x0, flags=3)
    at ../../../zsh-3.1.6/Src/Zle/zle_main.c:547
#10 0x8070cd6 in inputline () at ../../zsh-3.1.6/Src/input.c:265
#11 0x8070bc9 in ingetc () at ../../zsh-3.1.6/Src/input.c:210
#12 0x806abd4 in ihgetc () at ../../zsh-3.1.6/Src/hist.c:242
#13 0x8075a13 in gettok () at ../../zsh-3.1.6/Src/lex.c:545
#14 0x8075291 in yylex () at ../../zsh-3.1.6/Src/lex.c:308
#15 0x80881d0 in parse_event () at ../../zsh-3.1.6/Src/parse.c:105
#16 0x806eae2 in loop (toplevel=1, justonce=0)
    at ../../zsh-3.1.6/Src/init.c:113
#17 0x8050649 in main (argc=1, argv=0xbffff498)
    at ../../zsh-3.1.6/Src/main.c:89

-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts              http://www.brasslantern.com

Re: BUG: coredump with menu-select and LIST_PACKED

[Sven Wischnowsky]

Bart Schaefer wrote:

> On Oct 25,  8:06pm, Alexandre Duret-Lutz wrote:
> } Subject: BUG: coredump with menu-select and LIST_PACKED
> }
> } venus% setopt listpacked
> } venus% foo <TAB>
> } 1      11     13     15     3     5     7     9                 
> } 10     12     14     2      4     6     8     xxxxxxxxxxxxxxx   
> } venus% foo <M-m>
> } zsh: segmentation fault (core dumped)  zsh -f
> 
> Looks like the `amatches' global is garbage.  Here's a stack trace (this is
> after patches 8412 and 8413).
> 
> #0  0x4013c377 in clprintm (g=0x80d8168, mp=0x80c2b00, mc=0, ml=0, lastc=0, 
>     width=135800832, path=0x80d1ab0 "./1", buf=0xbffff0d8)
>     at ../../../zsh-3.1.6/Src/Zle/complist.c:390

Hm. I can't reproduce this bug and my line complist.c:390 doesn't
access `amatches'.

So I have to ask: can someone tell me how to reproduce this with a
`zsh -f'?


Bye
 Sven


--
Sven Wischnowsky                         wischnow@informatik.hu-berlin.de

Re: BUG: coredump with menu-select and LIST_PACKED

[Bart Schaefer]

On Oct 26, 11:17am, Sven Wischnowsky wrote:
} Subject: Re: BUG: coredump with menu-select and LIST_PACKED
}
} Bart Schaefer wrote:
} 
} > On Oct 25,  8:06pm, Alexandre Duret-Lutz wrote:
} > } Subject: BUG: coredump with menu-select and LIST_PACKED
} > }
} > } venus% setopt listpacked
} > } venus% foo <TAB>
} > } 1      11     13     15     3     5     7     9                 
} > } 10     12     14     2      4     6     8     xxxxxxxxxxxxxxx   
} > } venus% foo <M-m>
} > } zsh: segmentation fault (core dumped)  zsh -f
} > 
} > Looks like the `amatches' global is garbage.  Here's a stack trace (this is
} > after patches 8412 and 8413).
} > 
} > #0  0x4013c377 in clprintm (g=0x80d8168, mp=0x80c2b00, mc=0, ml=0, lastc=0, 
} >     width=135800832, path=0x80d1ab0 "./1", buf=0xbffff0d8)
} >     at ../../../zsh-3.1.6/Src/Zle/complist.c:390
} 
} Hm. I can't reproduce this bug and my line complist.c:390 doesn't
} access `amatches'.

It does, but very indirectly.  That line is (was, before your huge patch;
I don't know yet now):

	    for (i = (width ? width : mcols); i--; ) {
390		mtab[mx + mm + i] = mp;
		mgtab[mx + mm + i] = g;
	    }

The value of `i' comes from `width' which comes a few call frames up from
`amatches->width', which is trash (a huge number).

} So I have to ask: can someone tell me how to reproduce this with a
} `zsh -f'?

The instructions that Alexandre gave were exactly what I did to produce
the stack trace.

-- 
Bart Schaefer                                 Brass Lantern Enterprises
http://www.well.com/user/barts              http://www.brasslantern.com