[bug] busyloop upon $=var with NULs when $IFS contains both NUL and a byte > 0x7f

[Stephane Chazelas <stephane@xxxxxxxxxxxx>]

$ LC_ALL=C zsh -c 'IFS=é$IFS; echo $=IFS'
^C

(busy loop had to be interrupted with ^C).

Call trace:

(gdb) bt
#0  0x00005555556249ad in mb_metacharlenconv (s=0x555555675185 "\203 ", wcp=0x7fffffffc760) at utils.c:5541
#1  0x0000555555622791 in itype_end (ptr=0x555555675185 "\203 ", itype=32, once=1) at utils.c:4332
#2  0x000055555562121e in wordcount (s=0x555555675185 "\203 ", sep=0x0, mul=-1) at utils.c:3835
#3  0x0000555555620b29 in spacesplit (s=0x555555675180 "\303\251 \t\n\203 ", allownull=0, heap=1, quote=0) at utils.c:3650
#4  0x0000555555621495 in sepsplit (s=0x555555675180 "\303\251 \t\n\203 ", sep=0x0, allownull=0, heap=1) at utils.c:3908
#5  0x0000555555612f55 in paramsubst (l=0x7ffff7fbf560, n=0x7ffff7fbf590, str=0x7fffffffce00, qt=0, pf_flags=0, ret_flags=0x7fffffffcfcc) at subst.c:3660
#6  0x000055555560bb37 in stringsubst (list=0x7ffff7fbf560, node=0x7ffff7fbf590, pf_flags=0, ret_flags=0x7fffffffcfcc, asssub=0) at subst.c:322
#7  0x000055555560abbc in prefork (list=0x7ffff7fbf560, flags=0, ret_flags=0x7fffffffcfcc) at subst.c:142
#8  0x0000555555595cfd in execcmd_exec (state=0x7fffffffd940, eparams=0x7fffffffd540, input=0, output=0, how=18, last1=1, close_if_forked=-1) at exec.c:3232
#9  0x0000555555592757 in execpline2 (state=0x7fffffffd940, pcode=131, how=18, input=0, output=0, last1=1) at exec.c:1966
#10 0x0000555555590f30 in execpline (state=0x7fffffffd940, slcode=4098, how=18, last1=1) at exec.c:1691
#11 0x000055555559009a in execlist (state=0x7fffffffd940, dont_change_job=0, exiting=1) at exec.c:1444
#12 0x000055555558f735 in execode (p=0x7ffff7fbf448, dont_change_job=0, exiting=1, context=0x55555562e108 "cmdarg") at exec.c:1221
#13 0x000055555558f60c in execstring (s=0x7fffffffdedc "IFS=\303\251$IFS; echo $=IFS", dont_change_job=0, exiting=1, context=0x55555562e108 "cmdarg")
    at exec.c:1187
#14 0x00005555555ba5f9 in init_misc (cmd=0x7fffffffdedc "IFS=\303\251$IFS; echo $=IFS", zsh_name=0x7fffffffded5 "zsh") at init.c:1389
#15 0x00005555555bbd2d in zsh_main (argc=3, argv=0x7fffffffdb58) at init.c:1780
#16 0x000055555556ad29 in main (argc=3, argv=0x7fffffffdb58) at ./main.c:93


With +o multibyte, no busy loop, but splitting doesn't work properly:

$ LC_ALL=C zsh +o multibyte -c 'IFS=é$IFS; printf "<%q>\n" $=IFS'
<$'\303'$'\251'>
<''>

That's triggered when IFS contains both NUL and a byte over 0x7f
(in any order) and when the variable to split contains NUL.

In UTF-8 locales, that's triggered when IFS contains NUL and
bytes or byte sequences not forming parts of valid characters.

"read" doesn't seem to be affected:

$ print 'foo\0bar' | LC_ALL=C zsh -c 'IFS=é$IFS read -rA a; typeset a'
a=( foo bar )

(that's on Debian GNU/Linux amd64 with zsh git HEAD)

-- 
Stephane