tmux server crash on 151014, bloody

lotheac commented 9 years ago

I was attempting to copy the entire scrollback buffer from tmux somewhere else, and using tmux 'copy mode' for this, but the whole tmux server crashed taking all my sessions with it.

Repro:

# this is probably not be necessary, but I have no idea how to move around in copy mode without it :)
echo 'set-window-option -g mode-keys vi' > ~/.tmux.conf
# start tmux
tmux

fill scrollback buffer. one character per line wasn't enough to crash it, but 20 is

yes $(python -c 'print "a"*20)

hit ^C after a while. once the scrollback buffer is full of lines, enter copy mode, move to the beginning of history, drop a marker there, move to the end of history and copy the selection by the following key combination:

^B [ g space G return

observe 'server lost' message and that all your tmux sessions died.

stack from the core:

core 'core' of 26626:   tmux
 fed43218 memcpy   (8047248, 8047218, 80471f0, 0, 7fffffff, feefe386) + 168
 fed9ce34 sprintf  (feefe386, 8047248, 81c4770, fee4d3c0) + 47
 feeda209 tparm    (810f6b0, 80ca40e, 81c4770, 0, 0, 0) + 1a8
 08099d06 tty_term_ptr2 (8110838, 86, 80ca40e, 81c4770, 8047424, 810eb6c) + 76
 0809a64b tty_putcode_ptr2 (810eb6c, 86, 80ca40e, 81c4770, a051, a050) + 3b
 0809b0bc tty_cmd_setselection (810eb6c, 8047424, 8047448, 0, 80e4758, 804740c) + 8c
 0809b022 tty_write (809b030, 8047424, 0, a04d, fee497e4, 8113bd8) + d2
 0808ce1d screen_write_setselection (8047498, 81ba718, a04d, 0, 1, 0) + 3d
 080a0f30 window_copy_copy_buffer (8113bd8, ffffffff, 81ba718, a04d, fee497e4, 0) + a0
 080a14f7 window_copy_copy_selection (8113bd8, ffffffff, 804751c, 80fca48, 8113bd8, d) + 37
 080a2ecd window_copy_key (8113bd8, 8111318, d, ffffffff, d, 0) + 46d
 0808e2af server_client_handle_key (80fead0, d, 81ae340, d, 8111060, 80475e0) + 1cf
 08098ec9 tty_keys_next (810eb6c, 1000, 8047608, 80b2891, 80cbde1, 80e12c8) + 259
 08099de8 tty_read_callback (8110f48, 810eb6c, 75636f66, 80e12c8) + 18
 080b71cf _bufferevent_run_readcb (8110f48, 1, 4000, 1, 80cc16a, 80f5ca0) + 4f
 080b87da bufferevent_readcb (9, 2, 8110f48, 809ab94, 8113bd8, 0) + 13a
 080ad249 event_base_loop (80f9cd0, 1, 0, 8047748, 80ae039) + 6b9
 080ae059 event_loop (1, 0, 0, 0, 8047748, 1) + 29
 08091074 server_loop (8091d20, 8047748, 0, 8091eb0, 0, 4) + 14
 0809178f server_start (4, 80f6840, 80f4ac0, 4, 80f9cd0, 80f9ce8) + 3af
 0806a7b3 client_connect (80f4ac0, 1, 80e275c, 80e2840, 4e455645, 4f4e5f54) + 1b3
 0806ac11 client_main (0, 8047e2c, 10000, 0, 1, 0) + 31
 080c1ba2 main     (1, 8047e28, 8047e30, feffb0a8, 8047e1c, 8068c52) + 472
 08068cb3 _start   (1, 8047ee4, 0, 8047ee9, 8047eed, 8047f01) + 83

This is on pkg://omnios/terminal/tmux@1.9.0-0.151014:20150402T192031Z, but happens on bloodytoo (1.9.0-0.151015:20150914T052043Z). I didn't check earlier releases.

lotheac commented 9 years ago

Does not happen on tmux 1.6 on ubuntu 12.04 nor on the tmux version shipped on OpenBSD -CURRENT (which doesn't seem to have -V to report the version)

lotheac commented 9 years ago

tmux 2.0 from yesterday's bloody build fares no better either. Building tmux against ncurses, however, removes the issue. I'll create a PR soonish...

omniti-labs / omnios-build

tmux server crash on 151014, bloody #67