Re: Crash of 4.2.0-dev-1

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

On Apr 11,  8:09am, Geoff Wing wrote:
} Subject: Re: Crash of 4.2.0-dev-1
}
} Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx> typed:
} : I presume of 4.2.0 also.  Reproduce as follows:
} :
} : (1) Create a file "kshtest" in a directory in fpath.  This file should NOT
} : define the function "kshtest"
} 
} Any specific kshtest example for us?

Hmm, I thought I'd reproduced this with a very simple example but I guess
there is one more thing necessary for it to happen reliably.  Here are
the first two steps again, corrected.

(1) Place the following in a file "kshtest" in a directory in fpath:

    print "Running kshtest"
    unfunction kshtest

(2) Run zsh -f and execute:

    setopt kshautoload
    autoload +X -k kshtest
    kshtest

} : (3) Observe the [correct] error:
} :
} : 	zsh: kshtest: function not defined by file
} 
} I don't understand why this is the correct error

Because files loaded with kshautoload have to contain the full function
definition, like so:

    kshtest() {
	print "Running kshtest"
	unfunction kshtest
    }

And the kshtest file as created in (1) does not do so.

} since you setopt kshautload

That's another critical bit in tripping the bug.  After "autoload +X -k"
of the "incorrect" kshtest file, the function kshtest is defined as:

    kshtest () {
        print "Running kshtest"
        unfunction kshtest
	kshtest "$@"
    }

Whereas zsh expects it to have been defined as:

    kshtest () {
	kshtest () {
	    print "Running kshtest"
	    unfunction kshtest
	}
	kshtest "$@"
    }

The extra layer of function wrapper plus the call with "$@" is added
by "autoload +X".

} Also, I haven't yet understood why it was run twice in my case (but
} I've been sick so maybe my brain isn't working properly yet).

Normally, the function redefines itself and then the new definition is
called.  When the file itself does not contain its own function wrapper,
it ends up calling itself -- but only once, because that call re-auto-
loads the file without the +X behavior.  When that happens after the
function has been "unfunction"d, something bad results.

(Normally zsh protects itself against functions that unfunction them-
selves, otherwise "compinit" wouldn't work properly.  Somehow having
kshautoload set is bypassing those defenses.)

} : (4) Memory is now corrupted.  At some point soon, usually but not always
} : during printing of the next prompt, the shell will crash in malloc().
} 
} I'm still going.  Haven't seen any memory problems yet.

The "unfunction" appears to be necessary.