Bug 268866 - tcsh: Segmentation fault
Summary: tcsh: Segmentation fault
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 13.1-RELEASE
Hardware: amd64 Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords: crash, needs-qa
Depends on:
Blocks:
 
Reported: 2023-01-10 19:08 UTC by iron.udjin
Modified: 2024-01-18 04:23 UTC (History)
2 users (show)

See Also:


Attachments
coredump (135.67 KB, application/x-bzip)
2023-01-10 19:54 UTC, iron.udjin
no flags Details
tcshrc.txt (2.31 KB, text/plain)
2023-01-10 20:07 UTC, iron.udjin
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description iron.udjin 2023-01-10 19:08:40 UTC
OS: 13.1-RELEASE

1. start tcsh
2. run: !#:q
result: Segmentation fault (core dumped)

Tried on 13.1-STABLE - result is the same.
Comment 1 Li-Wen Hsu freebsd_committer freebsd_triage 2023-01-10 19:13:15 UTC
What does "run: !#:q" mean here? Can you provide more details about how to reproduce this?
Comment 2 iron.udjin 2023-01-10 19:18:42 UTC
(In reply to iron.udjin from comment #0)

I'm trying to setup xterm windows title change use following line in ~/.tcshrc:
alias postcmd 'if (-t 1 && "\!#:q" !~ "? ") printf "\033]2; ${HOST}: \!#:0:q\007"'

Tried to understand why it doesn't work. And found that after execute "!#:q" tcsh quits with segfault error.
Comment 3 iron.udjin 2023-01-10 19:20:17 UTC
(In reply to iron.udjin from comment #2)

I'm not fully understand what does this command do. But at least it should not lead to segfault.
Comment 4 iron.udjin 2023-01-10 19:27:43 UTC
(In reply to Li-Wen Hsu from comment #1)

To reproduce it simple run:
$ tcsh
$ !#:q
Segmentation fault (core dumped)
$
Comment 5 Li-Wen Hsu freebsd_committer freebsd_triage 2023-01-10 19:35:58 UTC
(In reply to iron.udjin from comment #4)

OK, this is what I tired after reading comment #0, but I cannot reproduce on my 13.1-RELEASE-p3 box.  I think we need to find a reliable way to reproduce it. Also, if you can obtain a core dump file, which would be very helpful.
Comment 6 iron.udjin 2023-01-10 19:54:06 UTC
Created attachment 239388 [details]
coredump
Comment 7 iron.udjin 2023-01-10 20:07:07 UTC
Created attachment 239389 [details]
tcshrc.txt

I found that it segfaults only with my config. ~/.tcshrc attached.
Comment 8 Tatsuki Makino 2023-01-11 04:15:09 UTC
12.4-STABLE amd64 is reproducible.

!# is history substitution. # is the current event.
:q is quote substituted words.

That is,
echo !#:q
will run
echo echo
.
echo !#:q foo
will run
echo echo foo
.

Core dumps are useless without debug builds :)
(lldb) bt
* thread #1, name = 'tcsh', stop reason = signal SIGSEGV
  * frame #0: 0x000000000022cf32 tcsh`___lldb_unnamed_symbol507 + 66
    frame #1: 0x000000000022c7a2 tcsh`___lldb_unnamed_symbol503 + 290
Comment 9 iron.udjin 2023-01-11 07:14:48 UTC
(In reply to Tatsuki Makino from comment #8)

> Core dumps are useless without debug builds :)

Cure dump was generated on 13.1-RELEASE-p3. Isn't it possible to use debug symbols from it? (sorry, I'm not so experienced in debug).
Comment 10 Tatsuki Makino 2023-01-11 21:28:12 UTC
(In reply to iron.udjin from comment #9)

Sorry, that doesn't mean it is completely useless.
What it means is something like how many people in the world can handle it :)

This is a backtrace in 12.4-STABLE.

(lldb) bt all
* thread #1, name = 'tcsh', stop reason = signal SIGSEGV
  * frame #0: 0x00000000002350d0 tcsh`hashhist(h0=0x00007fffffffded0) at sh.hist.c:381:24
    frame #1: 0x000000000023483b tcsh`enthist(event=-50000000, lp=0x00007fffffffded0, docopy=0, mflg=0, hlen=-1) at sh.hist.c:944:22
    frame #2: 0x000000000023c7a1 tcsh`dosub(sc=L'q', en=0x0000000000284238, global=1) at sh.lex.c:953:11
    frame #3: 0x000000000023c352 tcsh`getsub(en=0x0000000000284238) at sh.lex.c:880:11
    frame #4: 0x0000000000238823 tcsh`getexcl(sc=L'\0') at sh.lex.c:753:11
    frame #5: 0x000000000023a5fa tcsh`getC1(flag=3) at sh.lex.c:491:6
    frame #6: 0x0000000000238a13 tcsh`word(parsehtime=0) at sh.lex.c:307:17
    frame #7: 0x0000000000237b86 tcsh`lex(hp=0x0000000000284238) at sh.lex.c:183:14
    frame #8: 0x000000000021afb7 tcsh`process(catch=1) at sh.c:2071:12
    frame #9: 0x000000000021a14f tcsh`main(argc=0, argv=0x00007fffffffe468) at sh.c:1430:5
    frame #10: 0x0000000000217cc0 tcsh`_start + 256
Comment 11 iron.udjin 2023-01-12 15:38:19 UTC
(In reply to Tatsuki Makino from comment #10)

Please try to use the attached config file. Possibly you'll have a luck to hit crash under 13.1-RELEASE.
Comment 12 Tatsuki Makino 2023-01-13 07:14:05 UTC
(In reply to iron.udjin from comment #11)

I understood.
This was not reproduced by the root user in a clean jail environment for poudriere.

The following variable settings are relevant.

set histdup = erase
Comment 13 wilkinsonwilfrid 2024-01-18 02:04:58 UTC
MARKED AS SPAM