Crash in readline_internal_teardown()

[Bernie Innocenti]

Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' 
-DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-unknown-li»
uname output: Linux xyzzy.cam.corp.google.com 3.13.0-30-generic 
#55-Ubuntu SMP Fri Jul 4 21:40:53 UTC 2014 x86_64 x86_64 x8»
Machine Type: x86_64-unknown-linux-gnu

Bash Version: 4.3
Patch Level: 18
Release Status: release

Description:

A similar crash has already been reported in Launchpad:
  https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1294669

My bash binary contains patches 9 through 11 which supposedly fixed 
this, but I'm still getting occasional crashes with a binary built off 
git head:

malloc: unknown:0: assertion botched
free: called with unallocated block argument
last command: ll webserver/sffe/config/sffe_config.proto
Aborting...
Program received signal SIGABRT, Aborted.
0x00007ffff761df79 in __GI_raise (sig=sig@entry=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:56
56      ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007ffff761df79 in __GI_raise (sig=sig@entry=6) at 
../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007ffff7621388 in __GI_abort () at abort.c:89
#2 0x000000000044051f in programming_error ()
#3 0x00000000004b3bff in internal_free.isra ()
#4 0x00000000004ae1ac in _rl_revert_all_lines ()
#5 0x0000000000495035 in readline_internal_teardown ()
#6 0x0000000000495f56 in readline ()
#7 0x000000000042158a in yy_readline_get ()
#8 0x0000000000423716 in shell_getc ()
#9 0x00000000004265f2 in read_token.constprop ()
#10 0x0000000000429bd4 in yyparse ()
#11 0x0000000000420e9b in parse_command ()
#12 0x0000000000420f6c in read_command ()
#13 0x0000000000421169 in reader_loop ()
#14 0x000000000041f749 in main ()
(gdb)

I'm now running a binary built with -g under gdb to obtain a better 
stack trace.


Repeat-By:
Hard to reproduce. The crashes happen just before returning to the 
prompt, but it's not deterministic. I strongly suspect heap corruption.

--
 _ // Bernie Innocenti
 \X/  http://codewiz.org