修复crash

Signed-off-by: wuminjie <wuminjie2@h-partners.com>

eval.c

@@ -1300,7 +1300,7 @@ varsub(Expand *xp, const char *sp, const char *word,
 			if (sc & 2) {
 				stype = 0;
 				XPinit(wv, 32);
-				vp = global(arrayname(sp));
+				vp = arraybase(sp);
 				do {
 					if (vp->flag & ISSET)
 						XPput(wv, shf_smprintf(Tf_lu,
@@ -1347,7 +1347,7 @@ varsub(Expand *xp, const char *sp, const char *word,
 		case ORD('#'):
 			  switch (sc & 3) {
 			case 3:
-				vp = global(arrayname(sp));
+				vp = arraybase(sp);
 				if (vp->flag & (ISSET|ARRAY))
 					zero_ok = true;
 				sc = 0;
@@ -1458,7 +1458,7 @@ varsub(Expand *xp, const char *sp, const char *word,
 		/* do what we can */
 		if (sc & 2) {
 			XPinit(wv, 32);
-			vp = global(arrayname(sp));
+			vp = arraybase(sp);
 			do {
 				if (vp->flag & ISSET)
 					XPput(wv, str_val(vp));

lex.c

@@ -1487,6 +1487,8 @@ set_prompt(int to, Source *s)
 			Area *saved_atemp;
 			int saved_lineno;
 
+			saved_atemp = ATEMP;
+			newenv(E_ERRH);
 			ps1 = str_val(global("PS1"));
 			shf = shf_sopen(NULL, strlen(ps1) * 2,
 			    SHF_WR | SHF_DYNAMIC, NULL);
@@ -1500,8 +1502,6 @@ set_prompt(int to, Source *s)
 			saved_lineno = current_lineno;
 			if (s)
 				current_lineno = s->line + 1;
-			saved_atemp = ATEMP;
-			newenv(E_ERRH);
 			if (kshsetjmp(e->jbuf)) {
 				prompt = safe_prompt;
 				/*
@@ -1516,6 +1516,7 @@ set_prompt(int to, Source *s)
 				strdupx(prompt, cp, saved_atemp);
 			}
 			current_lineno = saved_lineno;
+			/* frees everything in post-newenv ATEMP */
 			quitenv(NULL);
 		}
 		break;

main.c

@@ -1198,6 +1198,7 @@ reclaim(void)
 	 */
 	if (source && source->areap == &e->area)
 		source = NULL;
+	retrace_info = NULL;
 	afreeall(&e->area);
 }
 

misc.c

@@ -2392,6 +2392,7 @@ chvt(const Getopt *go)
 			errorf(Tf_sD_s_s, "chvt", Tcant_open, dv);
 		}
 	}
+	afree(cp, ATEMP);
 	if (go->optarg[0] != '!') {
 		switch (fork()) {
 		case -1:

sh.h

@@ -2755,7 +2755,7 @@ struct tbl *arraysearch(struct tbl *, uint32_t);
 char **makenv(void);
 void change_winsz(void);
 size_t array_ref_len(const char *) MKSH_A_PURE;
-char *arrayname(const char *);
+struct tbl *arraybase(const char*);
 mksh_uari_t set_array(const char *, bool, const char **);
 uint32_t hash(const void *) MKSH_A_PURE;
 uint32_t chvt_rndsetup(const void *, size_t) MKSH_A_PURE;

tree.c

@@ -43,8 +43,12 @@ static bool ptree_hashere;
 static struct shf ptree_heredoc;
 #define ptree_outhere(shf) do {					\
 	if (ptree_hashere) {					\
-		shf_puts(shf_sclose(&ptree_heredoc), (shf));	\
+		char *ptree_thehere;				\
+								\
+		ptree_thehere = shf_sclose(&ptree_heredoc);	\
+		shf_puts(ptree_thehere, (shf));			\
 		shf_putc('\n', (shf));				\
+		afree(ptree_thehere, ATEMP)			\
 		ptree_hashere = false;				\
 		/*prevent_semicolon = true;*/			\
 	}							\

var.c

@@ -938,7 +938,7 @@ vtypeset(int *ep, const char *var, uint32_t set, uint32_t clr,
 
 	set &= ~(LOCAL|LOCAL_COPY);
 
-	vpbase = (vp->flag & ARRAY) ? global(arrayname(tvar)) : vp;
+	vpbase = (vp->flag & ARRAY) ? arraybase(tvar) : vp;
 
 	/*
 	 * only allow export and readonly flag to be set; AT&T ksh
@@ -1610,19 +1610,22 @@ array_ref_len(const char *cp)
 }
 
 /*
- * Make a copy of the base of an array name
+ * same effect as global(copy of the base of an array name)
  */
-char *
-arrayname(const char *str)
+struct tbl *
+arraybase(const char *str)
 {
 	const char *p;
-	char *rv;
+	char *s;
+	struct tbl *rv;
 
 	if (!(p = cstrchr(str, '[')))
 		/* Shouldn't happen, but why worry? */
-		strdupx(rv, str, ATEMP);
+		strdupx(s, str, ATEMP);
 	else
-		strndupx(rv, str, p - str, ATEMP);
+		strndupx(s, str, p - str, ATEMP);
+	rv = global(s);
+	afree(s, ATEMP);
 
 	return (rv);
 }