Re: "crash: free invalid next size (fast)" on completion

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

(Following up to zsh-users so this thread doesn't appear abandoned;
further discussion should probably be directed to
zsh-workers@xxxxxxx.)

On Tue, Mar 22, 2022 at 12:41 AM Johan Ström <johan@xxxxxxxxxxx> wrote:
>
> last week (and now today again, on several terminals after being idle since Friday) I noticed that several of my terminals crashed and closed when writing `git <tab>` or `ls <tab>`. Managed to capture one such crash on video before terminal closed, and it printed "free invalid next size (fast)".
...
>                 Stack trace of thread 843836:
>                 #5  0x00007f36842f104d _int_free (libc.so.6 + 0x9b04d)
>                 #6  0x00007f36842f3be3 free (libc.so.6 + 0x9dbe3)
>                 #7  0x00007f36839ffa7f unmetafy_line (zle.so + 0x33a7f)
>                 #8  0x00007f3683a0427a n/a (zle.so + 0x3827a)
>                 #9  0x00007f36839fcc34 completecall (zle.so + 0x30c34)
>
> These terminals have been running for ~5 days.
> On newly opened terminals, tab completion works fine.
>
> Have had 5.8-1 on this machine since July, never had any issues. 5.8.1-1 installed on 16 Feb.

Hm.  There's nothing in the zsh code changes I see that would cause
this effect; an actually idle shell should have been sitting blocked
on read.  Is there any sort of periodic event that might be sending a
signal to those shells?

Do other completions crash, or only completions that involve file names?