Re: [Bug-readline] SIGSEGV in _rl_dispatch_callback()

[rosslagerwall]

On Mon, Mar 10, 2014 at 11:17:38AM -0400, Chet Ramey wrote:
> On 3/9/14 5:44 PM, address@hidden wrote:
> > Hi,
> > 
> > (I'm not subscribed so I could not reply to the last message)
> > 
> > I could reproduce the issue by pressing delete twice in
> > examples/rl-callbacktest.  After debugging the issue, I found that when
> > the first delete is pressed, at some point at readline.c:747, r is -1 so
> > it fails to call the RL_UNSETSTATE line.  After comparing with rl-6.2, I
> > found the cause of the problem to be in readline.c:
> >  rl_dispatching = 1;
> >  RL_SETSTATE(RL_STATE_DISPATCHING);
> > -(*map[key].function)(rl_numeric_arg * rl_arg_sign, key);
> > +r = (*func) (rl_numeric_arg * rl_arg_sign, key);
> >  RL_UNSETSTATE(RL_STATE_DISPATCHING);
> >  rl_dispatching = 0;
> > 
> > The dispatcher calls rl_delete() which calls rl_ding() and returns -1
> > which gets stored as r and hence causes RL_STATE_MULTIKEY not to be set.
> > In rl-6.2, rl_delete() also returns -1 but r is not stored so it
> > doesn't fail.
> > 
> > I'm not sure as to the solution or why the change was made but it seems
> > to be the cause of the problem.
> 
> Thanks; this is a great piece of debugging.  You pointed me to the right
> place, and I was finally able to reproduce it on a convenient platform.
> 
> The problem is that the code uses -1 to mean two different things, but the
> second use is only significant when the dispatch code notes that it has
> read, or is reading, a multiple-key sequence.  That suggests the solution
> to the DEL issue, which I've attached as a patch.  I will continue to look
> at the previous-history/next-history issue.
> 
> Please let me know whether it fixes the various other problems on various
> platforms.
> 

Thanks for the patch, it seems to fix the issues I was having (based on
a short amount of testing).  Out of interest, what was different about
your platform that caused the issue not to show up?

Thanks
-- 
Ross Lagerwall