illumos gate

A trivial reproducer is:

af@build:~$ typeset -u ENV
zsh: segmentation fault (core dumped)  ksh

Not being entirely happy with the fix in the mentioned commit, I looked into this.
Each environment variable (name/value pair) has a linked list of disciplines attached to it, and at the end of that list there is optionally a shell context pointer.

For example, if one looks at the EDITOR variable (some fields removed in the following for brevity)

> ::bp libshell.so.1`put_ed
> ::run
$
$ EDITOR=vim
> ::stack ! head -1
libshell.so.1`put_ed+0x14(e06208, e01c58, 0, dced90)
> e06208::print Namval_t
{
    nvname = 0xfffffbffeec40a0e "EDITOR" 
    nvfun = 0xdced90
    nvalue = 0
}
> e06208::print Namval_t nvfun | ::print Namfun_t
{
    disc = libshell.so.1`EDITOR_disc
    next = libshell.so.1`sh+0x710
}
> e06208::print Namval_t nvfun | ::print Namfun_t next | ::print Namfun_t disc
disc = 0

The trailing list element, the libshell.so.1`sh+0x710 does not have a disc.

The problem arises when a new discipline is pushed onto the stack, such as when using typeset -u to add an upper-case translation discipline.

$ typeset -u EDITOR
> e06208::print Namval_t
{
    nvname = 0xfffffbffeec40a0e "EDITOR" 
    nvfun = 0xdced90
    nvalue = 0xe0fdb0 "vim" 
}
> e06208::print Namval_t nvfun | ::print Namfun_t
{
    disc = libshell.so.1`EDITOR_disc
    next = 0xdc27a0
}
> e06208::print Namval_t nvfun | ::print Namfun_t next | ::print Namfun_t
{
    disc = libshell.so.1`TRANS_disc
    next = 0
}

The trailing shell context pointer has been lost. This turns out to be a bug in the nv_disc() function, described as:

/*
 * push, pop, clne, or reorder disciplines onto node <np>
 * mode can be one of
 *    NV_FIRST:  Move or push <fp> to top of the stack or delete top
 *    NV_LAST:   Move or push <fp> to bottom of stack or delete last
 *    NV_POP:    Delete <fp> from top of the stack
 *    NV_CLONE:  Replace fp with a copy created my malloc() and return it
 */
Namfun_t *nv_disc(register Namval_t *np, register Namfun_t* fp, int mode)

When called with NV_LAST, any trailing shell context pointer is dropped from the end of the list.

PR also opened upstream at https://github.com/ksh93/ksh/pull/276

I've tested that the original crashes no longer occur, and that the new tests added as part of this change pass successfully.
I've also had the patched ksh running on an OmniOS system for several weeks and noticed no problems running nightly builds etc.