Regression in ash (crashing)

[Leonid Lisovskiy]

> On Wed, Dec 12, 2012 at 02:02:00PM -0500, Rich Felker wrote:
...
> I don't think valgrind is going to be a big help because the invalid
> alloc/free logic seems to be not at the system malloc level but ash's
> stack allocator. Is there any way to get ash to just use malloc/free
> for everything so valgrind can detect the invalid usage pattern?

Have you turn on --track-origins=yes  --leak-check=yes valgrind options ?

My test case on x86 produces following result:

==7770== 1 errors in context 1 of 1:
==7770== Conditional jump or move depends on uninitialised value(s)
==7770==    at 0x423F9B: expredir (ash.c:8679)
==7770==    by 0x426656: evalcommand (ash.c:9273)
==7770==    by 0x4246B8: evaltree (ash.c:8462)
==7770==    by 0x426234: evalfun (ash.c:8882)
==7770==    by 0x426947: evalcommand (ash.c:9443)
==7770==    by 0x4246B8: evaltree (ash.c:8462)
==7770==    by 0x425756: cmdloop (ash.c:12196)
==7770==    by 0x426C78: ash_main (ash.c:13262)
==7770==    by 0x406F28: run_applet_no_and_exit (appletlib.c:755)
==7770==    by 0x406F4E: run_applet_and_exit (appletlib.c:762)
==7770==    by 0x407178: main (appletlib.c:819)
==7770==  Uninitialised value was created by a heap allocation
==7770==    at 0x4C27B3D: malloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==7770==    by 0x40790D: xmalloc (xfuncs_printf.c:47)
==7770==    by 0x41CD80: copyfunc (ash.c:8262)
==7770==    by 0x41DDDE: defun (ash.c:8280)
==7770==    by 0x424712: evaltree (ash.c:8481)
==7770==    by 0x425756: cmdloop (ash.c:12196)
==7770==    by 0x426C78: ash_main (ash.c:13262)
==7770==    by 0x406F28: run_applet_no_and_exit (appletlib.c:755)
==7770==    by 0x406F4E: run_applet_and_exit (appletlib.c:762)
==7770==    by 0x407178: main (appletlib.c:819)

it points to malloc call inside copyfunc() instead of real root of
problem - copynode(), but:

1) it shows broken pointer nfile.expfname (ash.c:8679)

2) the rest can be easily drill-down with custom debug calls TRACE or ash_msg.


Leonid