Re: crashes using history

[Daniel J S. <dan...@ie...>]

Daniel J Sebald wrote:

> That or you found another bug.  I didn't touch anything with the malloc() command or the ! form of history.  Only the portion that displays the code, write_history_n().  The command sequence above should not make a call to write_history_n().
> 
> Give me a couple hours to see if there is another bug here.  I have tried your command sequence and can reproduce something similar.

I have a feeling that this bug resides in command.c.  There is quite a problem here.  I get a little more information than what Ethan did:

Terminal type set to 'x11'
gnuplot> history !re
  Executing:
        replot
         ^
         no previous plot

gnuplot> history !re
                  ^
         recurrency forbidden

gnuplot> history !re
Segmentation fault


That "recurrecy forbidden" is the tip off.  Here is the questionable hunk of code in command.c (not help.c):

	    /* execute the command "name" */
	    char *copy_name = gp_strdup(name);
	    save_input_line = gp_input_line;
	    save_c_token = c_token;
	    save_input_line_len = gp_input_line_len;
	    flag = 1;
	    gp_input_line = copy_name;
	    printf("  Executing:\n\t%s\n",name);
bad>	    do_line();
	    free(copy_name);
	    gp_input_line = save_input_line;
	    c_token = save_c_token;
	    gp_input_line_len = save_input_line_len;
	    num_tokens = scanner(&gp_input_line, &gp_input_line_len);
	    flag = 0;

It is of the variety that I've never liked, where some variables are temporarily saved, change, do something, then change them back.

OK, so the program searches through the history and finds a command that matches.  It comes to the above code, grabs some memory, rearranges some variables, then reaches that line of code I marked as "bad".  But look at the "replot" command above, it calls an internal_error() in all likelihood, in which case the program never returns from "do_line()", copy_name is never freed, *gp_input_line* is pointing to a bogus, less than 1024 character string (could be a problem), and flag never gets set to zero (hence the "recurrency forbidden" message I'm getting.

There is a considerable bug.  How do we go about fixing that?

Dan