segfault if nameref set on local variable

[Dan Douglas]

Another one to do with namerefs. :-)

Looks like it's when the target of the ref is local to the same scope.

$ gdb -q -ex 'run -c "function f { typeset x; typeset -n x; x=y; }; f"' ./bash
Reading symbols from ./bash...done.
Starting program: /home/smorg/doc/programs/bash/bash -c "function f { typeset 
x; typeset -n x; x=y; }; f"
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?

Program received signal SIGSEGV, Segmentation fault.
strlen () at ../sysdeps/x86_64/strlen.S:106
106             movdqu  (%rax), %xmm12
(gdb) bt
#0  strlen () at ../sysdeps/x86_64/strlen.S:106
#1  0x00000000004b4842 in mbschr (s=0x0, c=91) at mbschr.c:60
#2  0x0000000000473a35 in valid_array_reference (name=0x0) at arrayfunc.c:826
#3  0x0000000000441fae in bind_variable_internal (name=0x72c538 "x", 
value=0x72c498 "y", table=0x73d9e8, hflags=0, aflags=0)
    at variables.c:2533
#4  0x00000000004424d0 in bind_variable (name=0x72c558 "x", value=0x72c498 "y", 
flags=0) at variables.c:2662
#5  0x0000000000458139 in do_assignment_internal (word=0x73dca8, expand=1) at 
subst.c:2866
#6  0x0000000000458247 in do_word_assignment (word=0x73dca8, flags=0) at 
subst.c:2906
#7  0x000000000046651c in expand_word_list_internal (list=0x739fe8, eflags=31) 
at subst.c:9623
#8  0x0000000000465aaa in expand_words (list=0x739fe8) at subst.c:9234
#9  0x000000000043bc80 in execute_simple_command (simple_command=0x73d2c8, 
pipe_in=-1, pipe_out=-1, async=0, fds_to_close=0x73c948)
    at execute_cmd.c:3991
#10 0x0000000000435f9f in execute_command_internal (command=0x73d288, 
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
    at execute_cmd.c:787
#11 0x0000000000438f08 in execute_connection (command=0x73d088, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
    at execute_cmd.c:2487
#12 0x00000000004362f5 in execute_command_internal (command=0x73d088, 
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
    at execute_cmd.c:945
#13 0x00000000004362cb in execute_command_internal (command=0x73d048, 
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
    at execute_cmd.c:937
#14 0x000000000043ced9 in execute_function (var=0x739928, words=0x739e48, 
flags=0, fds_to_close=0x73c948, async=0, subshell=0)
    at execute_cmd.c:4530
#15 0x000000000043d3b6 in execute_builtin_or_function (words=0x739e48, 
builtin=0x0, var=0x739928, redirects=0x0, fds_to_close=0x73c948,
    flags=0) at execute_cmd.c:4760
#16 0x000000000043c22f in execute_simple_command (simple_command=0x73ca48, 
pipe_in=-1, pipe_out=-1, async=0, fds_to_close=0x73c948)
    at execute_cmd.c:4161
#17 0x0000000000435f9f in execute_command_internal (command=0x73ca08, 
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
    at execute_cmd.c:787
#18 0x0000000000438f08 in execute_connection (command=0x73cac8, asynchronous=0, 
pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
    at execute_cmd.c:2487
#19 0x00000000004362f5 in execute_command_internal (command=0x73cac8, 
asynchronous=0, pipe_in=-1, pipe_out=-1, fds_to_close=0x73c948)
    at execute_cmd.c:945
#20 0x0000000000490145 in parse_and_execute (string=0x73bd08 "function f { 
typeset x; typeset -n x; x=y; }; f",
    from_file=0x4dcc50 "-c", flags=4) at evalstring.c:367
#21 0x000000000041f6ee in run_one_command (command=0x7fffffffd5fe "function f { 
typeset x; typeset -n x; x=y; }; f") at shell.c:1339
#22 0x000000000041e9e0 in main (argc=3, argv=0x7fffffffd108, 
env=0x7fffffffd128) at shell.c:694
-- 
Dan Douglas