Re: Probabilistic crash on zsh 5.9 on x86_64

[Peter Stephenson <p.w.stephenson@xxxxxxxxxxxx>]

> On 13/04/2023 17:40 Jun. T <takimoto-j@xxxxxxxxxxxxxxxxx> wrote:
> 
>  
> > 2023/04/13 23:03、Peter Stephenson <p.w.stephenson@xxxxxxxxxxxx>のメール:
> > 
> > Have a look at this --- it simply marks the prog in the shell function as
> > in use earlier and unmarks it later, so the shenanigans within to do
> > with traps all come out in the wash.  So, in theory, there's not much
> > to go wrong.  But let me know...
> 
> > +    marked_prog = shfunc->funcdef;
> > +    useeprog(marked_prog);
> (snip)
> > +    freeeprog(marked_prog);
> 
> Even with this, shfunc is still freed, although shfunc->funcdef is not freed.
> But doshfunc() continues to use shfunc, at lines 5854, 5954, 5957, etc.
> If it doesn't crash, it means the freed memory is not yet used by others.
> But I think this is unsafe, and valgrind gives lots of warnings.

OK, so the starttrapscope() just above that point is pulling the rug out
from under the function's feet.  We've looked up the TRAPEXIT function and
now that function's just been undefined.

So some better save / restore for the shell function is probably needed.

pws