ksh dumping core

[Dennis Fail]

Help,

   We recently obtained the ksh-88 source from the toolchest and installed
on our newtwork of Sun3's and sun4's running SunOS 4.0.3.  The problem
we have been having is that suddenly a window will die because it's
parent process ksh has dumped core.  The best that I can determine is that
when when someone is working at their Sun workstation with ksh as their
login shell and then rlogin's or physically gets up and goes to another
workstation, logs in, and does some work and then goes back to his
workstation and try to use his windows that he was working in, they will
dump core. This doesn't happen all the time, but with enough frequency
to be a problem.

   I've isolated the problem to be in the history function of ksh as the
following dbx dialog will tell, but I am at a loss of what to do about.
Is it a ksh bug, is it something wrong in the configuration.  All the users
HOME directorys are NFS mounted on every machine and they all use .sh_history
as the history file and I am suspecting that this sharing of the file
has something to do with it, but thats just an un-educated guess.

As a side note, we had had problems with the previous version of ksh
corrupting the history file after an rlogin, but it would never dump core.
When we tried to recall a line after a rlogin the shell would just beep
at you, doing a history command would display a list of numbers something
like this:  200     252      201     ...
To fix this we would do an 'exec ksh' and everything would be fine.

Here is the dbx dialog

dbx /bin/ksh core  
Reading symbolic information...
Read 14645 symbols
(dbx) where
hist_eof(), line 430 in "isda/fail/sun-src/ksh-i/src/sh/history.c"
exfile(), line 377 in "isda/fail/sun-src/ksh-i/src/sh/main.c"
main(c = 1, v = 0xefffc40, 0xefffc48), line 280 in "isda/fail/sun-src/ksh-i/src/sh/main.c"
(dbx) list
  430   	register off_t count = fp->fixcnt;
  431   	int skip = 0;
  432   	io_seek(fp->fixfd,count,SEEK_SET);
  433   #ifdef INT16
  434   	while((c=io_getc(fp->fixfd))!=EOF)
  435   	{
  436   #else
  437   	/* could use io_getc() but this is faster */
  438   	while(1)
  439   	{
(dbx) print fp
`history`hist_eof`fp = (nil)
(dbx) 

I guess the nil pointer is causing the cre dump, but I dont know why it is nil.

Any clues anybody.

Thanks

Dennis Fail
Rockwell Int.
{uunet | attctc}!fozzy!fail