clprintm called with ml too large (9/9) / BUG: invalid position / SIGABRT

[Daniel Shahaf <d.s@xxxxxxxxxxxxxxxxxx>]

tl;dr: Got a BUG message and a SIGABRT interactively; not yet bisected
to a 'zsh -f' reproducer.

The following is run in my normal interactive shell, not in a minimal environment.

     1	% zshdev-download-by-x-seq 485<TAB><TAB>
     2	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1727: clprintm called with ml too large (9/9)
     3	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1762: BUG: invalid position
     4	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1762: BUG: invalid position
     5	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1762: BUG: invalid position
     6	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1762: BUG: invalid position
     7	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1762: BUG: invalid positionits
     8	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1762: BUG: invalid positiont when that would fail
     9	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1762: BUG: invalid position
     ⋮	[snip 203 repetitions]
   213	2: /home/daniel/src/zsh/./Src/Zle/complist.c:1762: BUG: invalid position
   214	2: /home/daniezshdev-download-by-x-seq 48574
   215	> X-Seqs
   216	48574  —  docs patches for precmd hooks and $?, and vcs_info
   217	 [PATCH 1/8] docs: Minor markup tweak
   218	 [PATCH 2/8] docs: Fix example rendering in the man page output
   219	 [PATCH 3/8] docs: Fix rendering in the
   220	  …28  —  Re: [PATCH] Improve vcs_info example for ahead/behind git commits
   221	 [PATCH 1/2] vcs_info git docs: ahead/behind commits: Don't run  rev-list when that would fail
   222	 [PATCH 2/2] vcs_info git docs: a
   223	  …59  —  Re: [RFC][PATCH] `newuser` prompt theme:2021-04-14 08:45

(The custom completion function is included at the end.)

At that point, if I type ^C I get:

    malloc(): corrupted top size
    zsh: abort      zsh

Backtrace:

    * thread #1, name = 'zsh', stop reason = signal SIGSTOP                                                                                                                                                               * frame #0: 0x00007ffff7cde461 libc.so.6`__GI___libc_read(fd=10, buf=0x00007fffffff7a83, nbytes=1) at read.c:26
        frame #1: 0x00000000005753ed zsh`raw_getbyte(do_keytmout=0, cptr="", full=1) at zle_main.c:849
        frame #2: 0x00000000005746d6 zsh`getbyte(do_keytmout=0, timeout=0x0000000000000000, full=1) at zle_main.c:884
        frame #3: 0x000000000057334d zsh`getkeybuf(w=0) at zle_keymap.c:1676
        frame #4: 0x0000000000573046 zsh`getkeymapcmd(km=0x00000000006274c0, funcp=0x00007fffffff7b60, strp=0x00007fffffff7b48) at zle_keymap.c:1587
        frame #5: 0x00000000005734b4 zsh`getkeycmd at zle_keymap.c:1705
        frame #6: 0x000000000054d723 zsh`domenuselect(dummy=0x00000000005e8b38, dat=0x00007fffffff8358) at complist.c:2614
        frame #7: 0x0000000000491386 zsh`runhookdef(h=0x00000000005e8b38, d=0x00007fffffff8358) at module.c:1001
        frame #8: 0x0000000000530761 zsh`after_complete(dummy=0x00000000005ef218, dat=0x00007fffffff846c) at compcore.c:518
        frame #9: 0x0000000000491401 zsh`runhookdef(h=0x00000000005ef218, d=0x00007fffffff846c) at module.c:1007
        frame #10: 0x000000000058dd2f zsh`docomplete(lst=0) at zle_tricky.c:878
        frame #11: 0x000000000058e086 zsh`expandorcomplete(args=0x00000000005fe9b0) at zle_tricky.c:314
        frame #12: 0x000000000058cb27 zsh`completecall(args=0x00007ffff6d2f320) at zle_tricky.c:207
        frame #13: 0x0000000000575acc zsh`execzlefunc(func=0x00000000007307e0, args=0x00007ffff6d2f320, set_bindk=0, set_lbindk=0) at zle_main.c:1468
        frame #14: 0x000000000058c4a3 zsh`bin_zle_call(name="zle", args=0x00007ffff6d2f320, ops=0x00007fffffff8a38, func='\0') at zle_thingy.c:806
        frame #15: 0x000000000058aaf2 zsh`bin_zle(name="zle", args=0x00007ffff6d2f310, ops=0x00007fffffff8a38, func=0) at zle_thingy.c:388
        frame #16: 0x00000000004216e1 zsh`execbuiltin(args=0x00007ffff6d2f278, assigns=0x0000000000000000, bn=0x00000000005ef350) at builtin.c:507
        frame #17: 0x0000000000451b1d zsh`execcmd_exec(state=0x00007fffffffa700, eparams=0x00007fffffff96c8, input=0, output=0, how=2, last1=2, close_if_forked=-1) at exec.c:4138
        frame #18: 0x000000000044cde2 zsh`execpline2(state=0x00007fffffffa700, pcode=195, how=2, input=0, output=0, last1=0) at exec.c:1954
        frame #19: 0x0000000000444981 zsh`execpline(state=0x00007fffffffa700, slcode=5154, how=2, last1=0) at exec.c:1684
        frame #20: 0x0000000000443836 zsh`execlist(state=0x00007fffffffa700, dont_change_job=1, exiting=0) at exec.c:1448
        frame #21: 0x000000000044314e zsh`execode(p=0x0000000000715680, dont_change_job=1, exiting=0, context="shfunc") at exec.c:1218
        frame #22: 0x000000000044ab6d zsh`runshfunc(prog=0x0000000000715680, wrap=0x0000000000000000, name="_zsh_highlight_call_widget") at exec.c:6060
        frame #23: 0x000000000044a302 zsh`doshfunc(shfunc=0x0000000000654340, doshargs=0x00007ffff6d33348, noreturnval=0) at exec.c:5910
        frame #24: 0x000000000044c4ff zsh`execshfunc(shf=0x0000000000654340, args=0x00007ffff6d33348) at exec.c:5479
        frame #25: 0x000000000045136d zsh`execcmd_exec(state=0x00007fffffffcc30, eparams=0x00007fffffffbbf8, input=0, output=0, how=18, last1=2, close_if_forked=-1) at exec.c:4009
        frame #26: 0x000000000044cde2 zsh`execpline2(state=0x00007fffffffcc30, pcode=67, how=18, input=0, output=0, last1=0) at exec.c:1954
        frame #27: 0x0000000000444981 zsh`execpline(state=0x00007fffffffcc30, slcode=6146, how=18, last1=0) at exec.c:1684
        frame #28: 0x00000000004437e3 zsh`execlist(state=0x00007fffffffcc30, dont_change_job=1, exiting=0) at exec.c:1439
        frame #29: 0x000000000044314e zsh`execode(p=0x0000000000730810, dont_change_job=1, exiting=0, context="shfunc") at exec.c:1218
        frame #30: 0x000000000044ab6d zsh`runshfunc(prog=0x0000000000730810, wrap=0x0000000000000000, name="_zsh_highlight_widget_orig-s0.0000040000-r20820-expand-or-complete") at exec.c:6060
        frame #31: 0x000000000044a302 zsh`doshfunc(shfunc=0x0000000000730850, doshargs=0x0000000000000000, noreturnval=1) at exec.c:5910
        frame #32: 0x0000000000575f93 zsh`execzlefunc(func=0x00000000005e99c0, args=0x00000000005fe9b0, set_bindk=0, set_lbindk=0) at zle_main.c:1524
        frame #33: 0x00000000005763db zsh`zlecore at zle_main.c:1145
        frame #34: 0x0000000000576e0f zsh`zleread(lp=0x00000000005ffa38, rp=0x00000000005ff978, flags=3, context=0, init="zle-line-init", finish="zle-line-finish") at zle_main.c:1352
        frame #35: 0x0000000000577de3 zsh`zle_main_entry(cmd=1, ap=0x00007fffffffdd40) at zle_main.c:2125
        frame #36: 0x0000000000474c46 zsh`zleentry(cmd=1) at init.c:1634
        frame #37: 0x00000000004765ad zsh`inputline at input.c:295
        frame #38: 0x000000000047619d zsh`ingetc at input.c:228
        frame #39: 0x00000000004669ed zsh`ihgetc at hist.c:408
        frame #40: 0x0000000000480e02 zsh`gettok at lex.c:622
        frame #41: 0x0000000000480b8f zsh`zshlex at lex.c:275
        frame #42: 0x00000000004ab271 zsh`parse_event(endtok=37) at parse.c:615
        frame #43: 0x000000000046fe2e zsh`loop(toplevel=1, justonce=0) at init.c:150
        frame #44: 0x0000000000475203 zsh`zsh_main(argc=1, argv=0x00007fffffffe4e8) at init.c:1797
        frame #45: 0x0000000000420712 zsh`main(argc=1, argv=0x00007fffffffe4e8) at main.c:93

$ZSH_PATCHLEVEL is zsh-5.8-387-gdf899d3 (pre-TYPESET_TO_UNSET).

The trailing junk on lines 7-8 of the original transcript, also seen on
lines 18-19 thereof, is likely from the subject line of workers/48528
and from the subject line of the first patch attached to that message
(shown here without rfc822 unfolding):

    Subject: Re: [PATCH] Improve vcs_info example for ahead/behind git commits
    Subject: [PATCH 1/2] vcs_info git docs: ahead/behind commits: Don't run
     rev-list when that would fail
    Subject: [PATCH 2/2] vcs_info git docs: ahead/behind commits: Reduce the
     number of forks

The custom completion function is this:

    % which $_comps[zshdev-download-by-x-seq]
    _xseqs () {
            setopt localoptions extendedglob
            zmodload zsh/datetime
            local -a descs
            local i
            for i in *.xseq(Om)
            do
                    descs+=(${${${i:r}#*-}//:/\\:}:"$(<$i formail -c -x 'Subject:' -s)":"$(
          strftime -r -s REPLY '%a, %d %b %Y %H:%M:%S %z' "${"$(<$i formail -c -x 'Date:' -s)"# ##}" 2>/dev/null &&
            strftime '%Y-%m-%d %H:%M' $REPLY
        )") 
            done
            descs=("${(@Oa)descs}") 
            _describe -2 -V -t 'xseqs' 'X-Seqs' descs
    }
    # In English: For each workers-42.xseq rfc822 file, complete "42"
    # with description being that file's subject and date.

(Yes, the indentation of the «strftime» calls is unconventional.  That's
how «which» emitted them.)

In another case I got this at the end of the long list of "invalid
position" reports:

    zshdev-download-by-x-seq 485282: /home/daniel/src/zsh/./Src/Zle/complist.c:2491: BUG: mline < 0 after re-scanning mtab in domenuselect()

The bug reproduces in a 212x50 xterm but not in an 88x29 one.

Triggering _xseqs in 'zsh -f', with or without z-sy-h (which is evident
in the backtrace), is not sufficient to reproduce the bug.  ENOTIME to
do a brute force bisection of my dotfiles right now.  Hints, please?

Cheers,

Daniel

P.S.  Before you ask, zshdev-download-by-x-seq is a function that takes
a single integer argument and fetches that -workers@ message to a file
called «workers-${1}.xseq».  It looks in my personal archives first to
avoid hitting www.zsh.org if possible, which is why I haven't published it.