Bug 1437124

After checking several different coredumps, with several different
stack traces, and following code/data, I "guessed" something appeared
strange with the io_save variable in sh_eval().
  I reported it at
http://ast-users.research.att.narkive.com/4m9wdyJU/static-variable-in-sh-eval

  User was provided with a test package changing the variable to not be
static. Crash happened again, but now, after 10 coredumps, all have
the same backtrace, and crash at the same point when releasing io_save,
but it is not really a bug in the trest patch because the crash is not
repeatable.

(gdb) frame 3
#3  0x00000000004600ad in sh_eval (iop=0x7f5c8effdcd0, 
    mode=<value optimized out>)
    at /usr/src/debug/ksh-20120801/src/cmd/ksh93/sh/xec.c:643
643			sfclose(io_save);
(gdb) info local
t = <value optimized out>
shp = 0x76e400
saveslp = 0x0
jmpval = 12
pp = 0x7f5c8effc320
buffp = 0x7f5c8effc430
io_save = 0x7f5c8effdcd0
traceon = 0
lineno = 0
binscript = 0
comsub = 0 '\000'
(gdb) info arg
iop = 0x7f5c8effdcd0
mode = <value optimized out>

what happened was that it left the loop due to a siglongjmp of
value SH_JMPSCRIPT (12).

  The mode variable is 0:

(gdb) frame 4
#4  0x000000000046dea1 in b_eval (argc=2, argv=<value optimized out>, context=<value optimized out>) at /usr/src/debug/ksh-20120801/src/cmd/ksh93/bltins/misc.c:202
202			sh_eval(sh_sfeval(argv),0);

so, in the chunk:

                t = (Shnode_t*)sh_parse(shp,iop,(mode&(SH_READEVAL|SH_FUNEVAL))?mode&SH_FUNEVAL:SH_NL);
                if(!(mode&SH_FUNEVAL) || !sfreserve(iop,0,0))
                {
                        if(!(mode&SH_READEVAL))
                                sfclose(iop);
                        io_save = 0;
                        mode &= ~SH_FUNEVAL;
                }

it must have siglongjmp'ed from sh_parse, and because of that, the
change of io_save from static to a local variable should not have
made a difference, but the crash is is due to sfclose(io_save);
and apparently a corrupted disc value at:

#0  0x0000000000018000 in ?? ()
#1  0x00000000004d5497 in sfraise (f=0x7f5c8effdcd0, type=4, data=0x0)
    at /usr/src/debug/ksh-20120801/src/lib/libast/sfio/sfraise.c:90

checking source...

83		for(disc = f->disc; disc; )
84		{	next = disc->disc;
85			if(type == SF_FINAL)
86				f->disc = next;
87	
88			if(disc->exceptf)
89			{	SFOPEN(f,0);
90				if((rv = (*disc->exceptf)(f,type,data,disc)) != 0 )
91					SFMTXRETURN(f, rv);
92				SFLOCK(f,0);
93			}
94	
95			if((disc = next) )
96			{	/* make sure that "next" hasn't been popped */
97				for(d = f->disc; d; d = d->disc)
98					if(d == disc)
99						break;
100				if(!d)
101					disc = f->disc;
102			}
103		}

first bad value is very deep the linked list:

(gdb) p f->disc->disc->disc->disc->disc->disc->disc->disc->disc->disc->disc->disc->disc->disc->disc->disc->disc
$20 = (Sfdisc_t *) 0x40