BUG: 3.1.5-pws-21: lfs

BUG: 3.1.5-pws-21: lfs

[Geoff Wing]

Heyla, with
% ./configure  --enable-zsh-debug --enable-zsh-mem --enable-zsh-mem-debug \
--enable-zsh-mem-warning --enable-zsh-secure-free --enable-zsh-hash-debug \
--enable-lfs --enable-dynamic

I get a near continuous spew out of:
	BUG: attempt to free storage at invalid address
Occurs even with ``zsh -f''
I can ^C it and eventually get a prompt, but everything I do gives some of
these errors.
ZSH_64_BIT_TYPE is defined properly.  Without --enable-lfs everything is
groovy.  Both compiled with egcs 1.1.2.  If nobody else sees anything like
that then I'll see if I can find out anything if I attach gdb to it and
determine whether it's our bug or just a funky egcs bug.

Regards,
-- 
Geoff Wing : <gcw@pobox.com>     Work URL: http://www.primenet.com.au/
Rxvt Stuff : <gcw@rxvt.org>      Ego URL : http://pobox.com/~gcw/
Zsh Stuff  : <gcw@zsh.org>       Phone   : (Australia) 0413 431 874

Re: BUG: 3.1.5-pws-21: lfs

[Peter Stephenson]

Geoff Wing wrote:
> Geoff Wing <mason@primenet.com.au> typed:
> :Heyla, with
> :% ./configure  --enable-zsh-debug --enable-zsh-mem --enable-zsh-mem-debug \
> :--enable-zsh-mem-warning --enable-zsh-secure-free --enable-zsh-hash-debug \
> :--enable-lfs --enable-dynamic
> :
> :I get a near continuous spew out of:
> :	BUG: attempt to free storage at invalid address
> 
> Occurs due to malloc() not aligning on M_ALIGN.

Any chance you could find out where in zsh's malloc() this is happening?
It's probably something like one of the structs m_hdr, m_shdr or heap not
having a size divisible by 8. I altered definitions of structures and sizes
to get this to work on one system (IRIX 6.2 with gcc), so there is some
compiler/system dependency here.

-- 
Peter Stephenson <pws@ibmth.df.unipi.it>       Tel: +39 050 844536
WWW:  http://www.ifh.de/~pws/
Dipartimento di Fisica, Via Buonarroti 2, 56127 Pisa, Italy

Re: BUG: 3.1.5-pws-21: lfs

[Geoff Wing]

Geoff Wing <mason@primenet.com.au> typed:
:Heyla, with
:% ./configure  --enable-zsh-debug --enable-zsh-mem --enable-zsh-mem-debug \
:--enable-zsh-mem-warning --enable-zsh-secure-free --enable-zsh-hash-debug \
:--enable-lfs --enable-dynamic
:
:I get a near continuous spew out of:
:	BUG: attempt to free storage at invalid address

Occurs due to malloc() not aligning on M_ALIGN.  malloc(3) on my system
says:
 "The allocated space is suitably aligned (after possible pointer coercion)
  for storage of any type of object."
It aligns on 32 bits not 64 bits (M_ALIGN size).

Regards,
-- 
Geoff Wing : <gcw@pobox.com>     Work URL: http://www.primenet.com.au/
Rxvt Stuff : <gcw@rxvt.org>      Ego URL : http://pobox.com/~gcw/
Zsh Stuff  : <gcw@zsh.org>       Phone   : (Australia) 0413 431 874

Re: BUG: 3.1.5-pws-21: lfs

[Geoff Wing]

Peter Stephenson <pws@ibmth.df.unipi.it> typed:
:Geoff Wing wrote:
:> :I get a near continuous spew out of:
:> :	BUG: attempt to free storage at invalid address
:> Occurs due to malloc() not aligning on M_ALIGN.
:Any chance you could find out where in zsh's malloc() this is happening?
:It's probably something like one of the structs m_hdr, m_shdr or heap not
:having a size divisible by 8. I altered definitions of structures and sizes
:to get this to work on one system (IRIX 6.2 with gcc), so there is some
:compiler/system dependency here.

I forgot we were using an internal malloc().  I just picked up the problem
from zalloc() and zcalloc().  I'll have a look through malloc() now and see
what I can stuff up^H^H^H^H^H^H^H^Hfix.

Regards,
-- 
Geoff Wing : <gcw@pobox.com>     Work URL: http://www.primenet.com.au/
Rxvt Stuff : <gcw@rxvt.org>      Ego URL : http://pobox.com/~gcw/
Zsh Stuff  : <gcw@zsh.org>       Phone   : (Australia) 0413 431 874

Re: BUG: 3.1.5-pws-21: lfs

[Geoff Wing]

Peter Stephenson <pws@ibmth.df.unipi.it> typed:
:Geoff Wing wrote:
:> :I get a near continuous spew out of:
:> :	BUG: attempt to free storage at invalid address
:> Occurs due to malloc() not aligning on M_ALIGN.
:Any chance you could find out where in zsh's malloc() this is happening?
:It's probably something like one of the structs m_hdr, m_shdr or heap not
:having a size divisible by 8. I altered definitions of structures and sizes
:to get this to work on one system (IRIX 6.2 with gcc), so there is some
:compiler/system dependency here.

Possibly something much simpler.

% size zsh
text    data    bss     dec     hex     filename
290784  16384   31524   338692  52b04   zsh

First time through malloc():
 (m = sbrk(4096)) @ mem.c:760  gives   m = 0x53b24

Yay.

Regards,
-- 
Geoff Wing : <gcw@pobox.com>     Work URL: http://www.primenet.com.au/
Rxvt Stuff : <gcw@rxvt.org>      Ego URL : http://pobox.com/~gcw/
Zsh Stuff  : <gcw@zsh.org>       Phone   : (Australia) 0413 431 874

PATCH: pws-21: Re: BUG: 3.1.5-pws-21: lfs

[Peter Stephenson]

Geoff Wing wrote:
> Peter Stephenson <pws@ibmth.df.unipi.it> typed:
> :Geoff Wing wrote:
> :> :I get a near continuous spew out of:
> :> :	BUG: attempt to free storage at invalid address
> 
> First time through malloc():
>  (m = sbrk(4096)) @ mem.c:760  gives   m = 0x53b24

Ahaahaaha.  See if this works.  It's probably got too many casts 'n' stuff
but I wanted it to be not too unsafe.  There are a few assumptions anyway,
but this time it looks like we're stuck with turning a pointer into an
integer.

--- Src/mem.c.sbrk	Wed Jun  9 16:18:04 1999
+++ Src/mem.c	Mon Jun 14 18:30:34 1999
@@ -777,6 +777,7 @@
 	for (mp = NULL, m = m_free; m && m->len < size; mp = m, m = m->next);
     }
     if (!m) {
+	long nal;
 	/* no matching free block was found, we have to request new
 	   memory from the system */
 	n = (size + M_HSIZE + M_ALLOC + m_pgsz - 1) & ~(m_pgsz - 1);
@@ -785,6 +786,14 @@
 	    DPUTS(1, "MEM: allocation error at sbrk.");
 	    unqueue_signals();
 	    return NULL;
+	}
+	if ((nal = ((long)(char *)m) & (M_ALIGN-1))) {
+	    if ((char *)sbrk(M_ALIGN - nal) == (char *)-1) {
+		DPUTS(1, "MEM: allocation error at sbrk.");
+		unqueue_signals();
+		return NULL;
+	    }
+	    m = (struct m_hdr *) ((char *)m + (M_ALIGN - nal));
 	}
 	/* set m_low, for the check in free() */
 	if (!m_low)

-- 
Peter Stephenson <pws@ibmth.df.unipi.it>       Tel: +39 050 844536
WWW:  http://www.ifh.de/~pws/
Dipartimento di Fisica, Via Buonarroti 2, 56127 Pisa, Italy

Re: PATCH: pws-21: Re: BUG: 3.1.5-pws-21: lfs

[Geoff Wing]

Peter Stephenson <pws@ibmth.df.unipi.it> typed:
:Geoff Wing wrote:
:> First time through malloc():
:>  (m = sbrk(4096)) @ mem.c:760  gives   m = 0x53b24
:Ahaahaaha.  See if this works.  It's probably got too many casts 'n' stuff
:but I wanted it to be not too unsafe.  There are a few assumptions anyway,
:but this time it looks like we're stuck with turning a pointer into an
:integer.

Seems to be working fine, thanks.  Am running it now, so I'll see what I
can come up with.  (And since I'm back on 3.1.* I'll see if that screen
display thing that was annoying me before (with excessive refreshing)
is still happening.)

Regards,
-- 
Geoff Wing : <gcw@pobox.com>     Work URL: http://www.primenet.com.au/
Rxvt Stuff : <gcw@rxvt.org>      Ego URL : http://pobox.com/~gcw/
Zsh Stuff  : <gcw@zsh.org>       Phone   : (Australia) 0413 431 874