reproduces with ksh-20120801-17.fc20.x86_64 as well

+++ This bug was initially created as a clone of Bug #1105138 +++

Description of problem:

When leaving function which was unset in the meantime ksh segfaults on the line:

/usr/src/debug/ksh-20120801/src/cmd/ksh93/sh/xec.c:3573		np->nvalue.rp->running  -= 2;

because np->nvalue.rp is cleared to 0x0 via _nv_unset upon unset.

Version-Release number of selected component (if applicable):

ksh-20120801-10.el6_5.6.x86_64

How reproducible:

Always

Steps to Reproduce:
1. create a script test.sh:
#!/bin/ksh

function ftest {
        ftest2
}


function ftest2 {
        unset -f ftest
}

ftest


2. run the script

Actual results:

Segmentation fault (core dumped)

Expected results:

No coredump

Additional info:

I'm not sure what is the right approach or if the behavior is defined in any standard. E.g. bash, zsh (and ksh-20100621 too, hence the Regression keyword) proceed with the unset -f even in current function and finishes the function without any error. However ksh-20120801 refuses to unset function from itself, thanks to test in _nv_unset (name.c)

2494		if(is_afunction(np) && np->nvalue.ip)
2495		{
2496			register struct slnod *slp = (struct slnod*)(np->nvenv);
2497			if(shp->st.real_fun == np->nvalue.rp)                      <-- this equals
2498			{
2499				np->nvalue.rp->running |= 1;
2500				return;
2501			}

See reproducer script:

function ftest {
	type ftest
	unset -f ftest
	type ftest
}

type ftest
ftest
type ftest

So either ksh should insist on refusing unsetting function even in nested case (test np->nvalue.rp->running in _nv_unset ?) or test existence of np->nvalue.rp->running at the end of sh_funct?