ports/73404: shells/ksh93 - notify option + output redirected to nonexistent file cause crash w/ segfault

[parv at pair.com]

>Number:         73404
>Category:       ports
>Synopsis:       shells/ksh93 - notify option + output redirected to nonexistent file cause crash w/ segfault
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Tue Nov 02 06:40:26 GMT 2004
>Closed-Date:
>Last-Modified:
>Originator:     parv
>Release:        FreeBSD 4.10-RELEASE-p3 i386
>Organization:
>Environment:
System: FreeBSD moo.holy.cow 4.10-RELEASE-p3


Some of the compiler flags:
  CPUTYPE=i686
  COPTFLAGS= -O -pipe
  CFLAGS= -O -pipe -g


Ksh93 version:
  shells/ksh93/Makefile: 1.37 2004/03/18 02:07:14
         ${.sh.version}: Version M 1993-12-28 p


>Description:

(It does not make any difference if ksh93 was built as static or
dynamic linked as both versions crash.  Core below is for the static
version. I have sent a similar message to David Korn, dgk at
research.att.com)

I started ksh93 in bash 3.0_4 and ksh93 keep crashing; ksh also
crashed in /bin/sh (so the parent shell should not be of much
importance).

I narrowed it down to the following necessary conditions ...

  - 2d time ksh is started in bash; on the very first run
    everything seems to be normal.  (After starting ksh93, ~/.profile
    is sourced.)

  - $ENV refers to  a file which contains "set -o notify"; setting
    ENV to the contents of the file does not cause crash.

  - Output is redirected to a nonexistent file AND in the background

  - ksh93 is replaced via "exec $0"


Below are the 2 files to create the crash environment...

  ~/.profile ...
    ENV="${HOME}/.kshrc-segfault"
    export ENV

    > initially-nonexistent-file &
    exec $0


  ~/.kshrc-segfault ...
    set -o notify


...and (gdb) backtrace...

  warning: core file may not match specified executable file.
  Core was generated by `ksh93'.
  Program terminated with signal 11, Segmentation fault.
  #0  job_unlink (pw=0x0) at /work/ports/misc/ports/shells/ksh93/work/src/cmd/ksh93/sh/jobs.c:1438
  1438			job.pwlist = pw->p_nxtjob;
  (gdb) bt
  #0  job_unlink (pw=0x0) at /work/ports/misc/ports/shells/ksh93/work/src/cmd/ksh93/sh/jobs.c:1438
  #1  0x8053e49 in job_unpost (pwtop=0xbfbfecf0, notify=1)
      at /work/ports/misc/ports/shells/ksh93/work/src/cmd/ksh93/sh/jobs.c:1397
  #2  0x8052643 in job_waitsafe (sig=20) at /work/ports/misc/ports/shells/ksh93/work/src/cmd/ksh93/sh/jobs.c:328
  #3  0xbfbfffac in ?? ()
  #4  0x804a1fe in ed_read (context=0x8162048, fd=0, buff=0x816fe60 "", size=4096, reedit=0)
      at /work/ports/misc/ports/shells/ksh93/work/src/cmd/ksh93/edit/edit.c:755
  #5  0x805159c in slowread (iop=0x814d1e0, buff=0x816fe60, size=4096, handle=0x8163960)
      at /work/ports/misc/ports/shells/ksh93/work/src/cmd/ksh93/sh/io.c:1113
  #6  0x80c1443 in sfrd ()
  #7  0x80bdb94 in _sffilbuf (f=0x814d1e0, n=-1)
      at /work/ports/misc/ports/shells/ksh93/work/src/lib/libast/sfio/sffilbuf.c:108
  #8  0x80c1c3f in sfreserve (f=0x814d1e0, size=0, type=0)
      at /work/ports/misc/ports/shells/ksh93/work/src/lib/libast/sfio/sfreserve.c:117
  #9  0x80491d3 in exfile ()
  #10 0x8048c26 in sh_main ()
  #11 0x804820c in main (argc=1, argv=0xbfbff3f0)
      at /work/ports/misc/ports/shells/ksh93/work/src/cmd/ksh93/sh/pmain.c:33


>How-To-Repeat:

See above.

>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: