Chet Ramey: > > Running the bash 4.4 regression test suite on OpenBSD/amd64, I noticed > > a crash in the redir tests. Specifically, running redir10.sub with > > bash 4.4 causes it to die with a bus error most of the time. > > Thanks for the report. I can't reproduce this,
Here's the backtrace: #0 0x00000d78f3634009 in find_pipeline (pid=11813, alive_only=1, jobp=0x7f7fffff61b4) at jobs.c:1481 #1 0x00000d78f36340f5 in find_process (pid=11813, alive_only=1, jobp=0x7f7fffff61b4) at jobs.c:1506 #2 0x00000d78f3637c53 in waitchld (wpid=-1, block=0) at jobs.c:3531 #3 0x00000d78f363795c in sigchld_handler (sig=20) at jobs.c:3411 #4 <signal handler called> #5 0x00000d7b431cc78b in ofree (argpool=0xd7be5448350, p=0xd7b4d731360) at /usr/src/lib/libc/stdlib/malloc.c:1085 #6 0x00000d7b431ccc8b in free (ptr=0xd7b0d3aa3e0) at /usr/src/lib/libc/stdlib/malloc.c:1416 #7 0x00000d78f3633a97 in discard_pipeline (chain=0xd7b0d3aa3e0) at jobs.c:1232 #8 0x00000d78f364a3c5 in process_substitute (string=0xd7afbf56490 "echo x", open_for_read_in_child=0) at subst.c:5812 * In process_substitute(), discard_pipeline(last_procsub_child) is called. * discard_pipeline() frees last_procsub_child. * free() is interrupted by a signal. * The signal handler eventually calls find_pipeline(), which accesses the just-freed memory last_procsub_child points to. -- Christian "naddy" Weisgerber na...@mips.inka.de