segmentation fault in menu selection

segmentation fault in menu selection

[Toma]

Hi!,
(please be aware of my rough english)

I have some examples which causes zsh to receive a SIGSEGV, all
related to the menu-select widget. I can reproduce them on zsh 4.3.1
or newer, including the latest CVS (zsh 4.2.6 works fine).

Note that lines that begin with : are commands run from the
mini-buffer, but i can bound them to keys and get the same result.

$ zsh -f
$ zmodload zsh/complist
$ bindkey -e
: menu-select
: reverse-menu-complete

or

$ zsh -f
$ zmodload zsh/complist
$ bindkey -e
: menu-select
Now repeat
: accept-and-infer-next-history

When configured with --enable-zsh-debug, zsh states:
zle_tricky.c:947: line metafied

or

$ zsh -f
$ zmodload zsh/complist
$ bindkey -e
$ autoload compinit; compinit
Put some completion prefix
$ cd /<Esc-x>
 : menu-select
Now repeat
: accept-and-infer-next-history
until `no matches' is shown
: undo

I can provide further information like backtraces or libc version if necessary.

PS: I'm posting after seeing
http://www.zsh.org/mla/workers/2006/msg00452.html, which had a very(?)
similar problem that actually got fixed. Though I'm sorry to bug you.
Toma.

Re: segmentation fault in menu selection

[Peter Stephenson]

Toma <tomushkin@gmail.com> wrote:
> I have some examples which causes zsh to receive a SIGSEGV, all
> related to the menu-select widget. I can reproduce them on zsh 4.3.1
> or newer, including the latest CVS (zsh 4.2.6 works fine).

Thanks for reporting these... as I was looking at a similar bug
I stopped by to look at these two.  They are yet another two different
varieties of the problem.  There may well be even more.

Index: Src/Zle/complist.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/Zle/complist.c,v
retrieving revision 1.96
diff -u -r1.96 complist.c
--- Src/Zle/complist.c	21 Sep 2006 16:36:53 -0000	1.96
+++ Src/Zle/complist.c	30 Oct 2006 14:03:18 -0000
@@ -2295,6 +2295,8 @@
     mlbeg = 0;
     molbeg = -42;
     for (;;) {
+	METACHECK();
+
     	mtab_been_reallocated = 0;
 	if (mline < 0) {
 	    int x, y;
Index: Src/Zle/compresult.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/Zle/compresult.c,v
retrieving revision 1.69
diff -u -r1.69 compresult.c
--- Src/Zle/compresult.c	30 Oct 2006 12:57:52 -0000	1.69
+++ Src/Zle/compresult.c	30 Oct 2006 14:03:18 -0000
@@ -1225,6 +1225,8 @@
 int
 reverse_menu(UNUSED(Hookdef dummy), UNUSED(void *dummy2))
 {
+    int was_meta;
+
     do {
 	if (minfo.cur == (minfo.group)->matches) {
 	    do {
@@ -1239,9 +1241,16 @@
 	     ((*minfo.cur)->flags & CMF_DUMMY) ||
 	     (((*minfo.cur)->flags & (CMF_NOLIST | CMF_MULT)) &&
 	      (!(*minfo.cur)->str || !*(*minfo.cur)->str)));
-    metafy_line();
+    /* May already be metafied if called from within a selection */
+    if (zlemetaline == NULL) {
+	metafy_line();
+	was_meta = 0;
+    }
+    else
+	was_meta = 1;
     do_single(*(minfo.cur));
-    unmetafy_line();
+    if (!was_meta)
+	unmetafy_line();
 
     return 0;
 }
Index: Src/Zle/zle_main.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/Zle/zle_main.c,v
retrieving revision 1.92
diff -u -r1.92 zle_main.c
--- Src/Zle/zle_main.c	23 Sep 2006 20:25:06 -0000	1.92
+++ Src/Zle/zle_main.c	30 Oct 2006 14:03:18 -0000
@@ -996,6 +996,7 @@
      * that explicitly.
      */
     while (!done && !errflag && !exit_pending) {
+	UNMETACHECK();
 
 	statusline = NULL;
 	vilinerange = 0;
Index: Src/Zle/zle_utils.c
===================================================================
RCS file: /cvsroot/zsh/zsh/Src/Zle/zle_utils.c,v
retrieving revision 1.40
diff -u -r1.40 zle_utils.c
--- Src/Zle/zle_utils.c	16 Oct 2006 01:09:22 -0000	1.40
+++ Src/Zle/zle_utils.c	30 Oct 2006 14:03:19 -0000
@@ -943,25 +943,25 @@
 	remetafy = 0;
 
     mkundoent();
-    if(!nextchanges)
-	return;
-    setlastline();
-    if(curchange->next) {
-	freechanges(curchange->next);
-	curchange->next = NULL;
-	free(curchange->del);
-	free(curchange->ins);
-	curchange->del = curchange->ins = NULL;
-	curchange->dell = curchange->insl = 0;
-    }
-    nextchanges->prev = curchange->prev;
-    if(curchange->prev)
-	curchange->prev->next = nextchanges;
-    else
-	changes = nextchanges;
-    curchange->prev = endnextchanges;
-    endnextchanges->next = curchange;
-    nextchanges = endnextchanges = NULL;
+    if(nextchanges) {
+	setlastline();
+	if(curchange->next) {
+	    freechanges(curchange->next);
+	    curchange->next = NULL;
+	    free(curchange->del);
+	    free(curchange->ins);
+	    curchange->del = curchange->ins = NULL;
+	    curchange->dell = curchange->insl = 0;
+	}
+	nextchanges->prev = curchange->prev;
+	if(curchange->prev)
+	    curchange->prev->next = nextchanges;
+	else
+	    changes = nextchanges;
+	curchange->prev = endnextchanges;
+	endnextchanges->next = curchange;
+	nextchanges = endnextchanges = NULL;
+    }
 
     if (remetafy)
 	metafy_line();




-- 
Peter Stephenson <pws@csr.com>                  Software Engineer
CSR PLC, Churchill House, Cambridge Business Park, Cowley Road
Cambridge, CB4 0WZ, UK                          Tel: +44 (0)1223 692070


To access the latest news from CSR copy this link into a web browser:  http://www.csr.com/email_sig.php