easily repeatable crash w/ /quote / /substitute

tf dump file

Logged In: YES
user_id=1664717
Originator: NO

I was unable to reproduce this on FreeBSD 5.4 or linux 2.6.7 (although given that it was an internal error, the OS is likely not relevant). Since the debugging dump contained lp=1, I tried on a server with prompts, both unterminated and terminated with GA. More information is needed.

I have set this to low priority because the command as described is useless: /substitute is meaningful only when called from a trigger, for example
/def -t* foo = /quote -S /substitute `/echo test
(but that invocation did not reproduce the bug either).

Logged In: NO

i'm the submitter.

it happened on an lpmud based on cdlib.

it's based on *something* in my .tfrc, because it doesn't happen when i use tf -f.

I recompiled tf with debugging symbols kept in to see if i could repeat this, but I could not, so I'm going to chalk it up to some system oddity.

Logged In: YES
user_id=5650
Originator: NO

I was able to reproduce this problem (should also work with "/eval /substitute -ag", and then sending some lines, for example), and did some digging: the error occurs, when substitute function is called from outside a trigger. As expected, it replaces the input buffer with substituted text/attributes, but when called outside of a trigger macro, the input buffer gets erraneously free'd twice (or so I believe, the code is not very easy to understand in all parts.)

Of course the situation is rather unlikely to occur, because substitute shouldn't normally be called from non-trigger macros.

In any case, I'll see if I can figure out what exactly happens in the code and fix this myself, though it might be better if the author fixes it himself; fixes made by people who don't understand the code might not be very well thought out. ;)

(One possible fix I see would be to improve how "substitute" function detects that it's not being called from a trigger.)

Logged In: YES
user_id=5650
Originator: NO

Oh, and a related, maybe slightly more informative dump:

http://low.fi/~ccr/tf.dump.2828.txt

(I didn't see any way to attach files to the comments.)