Hey Chet,
thanks for answering.
Did you build bash with `make valgrind'? The bash malloc and wrapper functions
seriously confuse valgrind.
No, I didn't. Could be a false positive then.
However, I was able to reproduce the crash (by luck) while my bash was attached
to a debugger. The stacktrace I got during the crash indicates, that it
happened while adding the command to the bash history:
user@linux64c:~$ ls $PKG
free(): invalid next size (fast)
Program received signal SIGABRT, Aborted.
__pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6,
no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
44 ./nptl/pthread_kill.c: No such file or directory.
(gdb) bt
#0 __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6,
no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1 0x00007ffff7e1ff4f in __pthread_kill_internal (signo=6, threadid=<optimized
out>)
at ./nptl/pthread_kill.c:78
#2 0x00007ffff7dd0fb2 in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
#3 0x00007ffff7dbb472 in __GI_abort () at ./stdlib/abort.c:79
#4 0x00007ffff7e1442f in __libc_message (action=action@entry=do_abort,
fmt=fmt@entry=0x7ffff7f2f459 "%s\n") at ../sysdeps/posix/libc_fatal.c:156
#5 0x00007ffff7e2986a in malloc_printerr (
str=str@entry=0x7ffff7f320c8 "free(): invalid next size (fast)")
at ./malloc/malloc.c:5660
#6 0x00007ffff7e2b6da in _int_free (av=0x7ffff7f68c60 <main_arena>,
p=0x5555556c2b20,
have_lock=have_lock@entry=0) at ./malloc/malloc.c:4518
#7 0x00007ffff7e2df4f in __GI___libc_free (mem=<optimized out>)
at ./malloc/malloc.c:3385
#8 0x000055555563d030 in add_history ()
#9 0x00005555555df114 in bash_add_history ()
#10 0x00005555555df4a0 in check_add_history ()
#11 0x00005555555df55f in maybe_add_history ()
#12 0x00005555555df63f in pre_process_line ()
#13 0x0000555555589e2b in ?? ()
#14 0x000055555558bf5b in ?? ()
#15 0x00005555555900bb in yyparse ()
#16 0x00005555555865b6 in parse_command ()
#17 0x0000555555586744 in read_command ()
#18 0x00005555555868f6 in reader_loop ()
#19 0x00005555555853d9 in main ()
(gdb)
