30 files changed, 427 insertions, 279 deletions
diff --git a/shell/Config.src b/shell/Config.src
index 5efbf9995..5b3fe08f3 100644
--- a/shell/Config.src
+++ b/shell/Config.src
@@ -166,9 +166,10 @@ config FEATURE_SH_HISTFILESIZE
        default y
        depends on SHELL_ASH || SHELL_HUSH
        help
-        This option makes busybox shells to use $HISTFILESIZE variable
+        This option makes busybox shells to use $HISTSIZE and
-        to set shell history size. Note that its max value is capped
+        $HISTFILESIZE variables to set shell history size.
-        by "History size" setting in library tuning section.
+        Note that its max value is capped by "History size" setting
+        in library tuning section.
 config FEATURE_SH_EMBEDDED_SCRIPTS
        bool "Embed scripts in the binary"
diff --git a/shell/ash.c b/shell/ash.c
index 99fbf6053..605215e41 100644
--- a/shell/ash.c
+++ b/shell/ash.c
@@ -461,7 +461,7 @@ static void forkshell_print(FILE *fp0, struct forkshell *fs, const char **notes)
 /* ============ Shell options */
-/* If you add/change options hare, update --help text too */
+/* If you add/change options here, update --help text too */
 static const char *const optletters_optnames[] ALIGN_PTR = {
        "e"   "errexit",
        "f"   "noglob",
@@ -1822,7 +1822,6 @@ struct stackmark {
        size_t stacknleft;
 };
 struct globals_memstack {
        struct stack_block *g_stackp; // = &stackbase;
        char *g_stacknxt; // = stackbase.space;
@@ -1845,7 +1844,6 @@ extern struct globals_memstack *BB_GLOBAL_CONST ash_ptr_to_globals_memstack;
        sstrend = stackbase.space + MINSIZE; \
 } while (0)
 #define stackblock()     ((void *)g_stacknxt)
 #define stackblocksize() g_stacknleft
@@ -2362,7 +2360,6 @@ struct localvar {
 # define VIMPORT        0x400   /* variable was imported from environment */
 #endif
 /* Need to be before varinit_data[] */
 #if ENABLE_LOCALE_SUPPORT
 static void FAST_FUNC
@@ -3582,7 +3579,6 @@ pwdcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 /* ============ ... */
 #define IBUFSIZ (ENABLE_FEATURE_EDITING ? CONFIG_FEATURE_EDITING_MAX_LEN : 1024)
 /* Syntax classes */
@@ -3989,13 +3985,11 @@ struct alias {
        int flag;
 };
 static struct alias **atab; // [ATABSIZE];
 #define INIT_G_alias() do { \
        atab = xzalloc(ATABSIZE * sizeof(atab[0])); \
 } while (0)
 static struct alias **
 __lookupalias(const char *name)
 {
@@ -4177,7 +4171,6 @@ unaliascmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 #endif /* ASH_ALIAS */
 /* Mode argument to forkshell.  Don't change FORK_FG or FORK_BG. */
 #define FORK_FG    0
 #define FORK_BG    1
@@ -4275,7 +4268,7 @@ signal_handler(int signo)
                        return;
        }
 #if ENABLE_FEATURE_EDITING
-        bb_got_signal = signo; /* for read_line_input: "we got a signal" */
+        bb_got_signal = signo; /* for read_line_input / read builtin: "we got a signal" */
 #endif
        gotsig[signo - 1] = 1;
        pending_sig = signo;
@@ -6194,7 +6187,6 @@ stoppedjobs(void)
 }
 #endif
 /*
 * Code for dealing with input/output redirection.
 */
@@ -9904,7 +9896,6 @@ commandcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
 }
 #endif
 /*static int funcblocksize;     // size of structures in function */
 /*static int funcstringsize;    // size of strings in node */
 static void *funcblock;         /* block to allocate function from */
@@ -11920,7 +11911,6 @@ goodname(const char *p)
        return endofname(p)[0] == '\0';
 }
 /*
 * Search for a command.  This is called before we fork so that the
 * location of the command will be available in the parent as well as
@@ -14773,7 +14763,6 @@ parseheredoc(void)
        }
 }
 static const char *
 expandstr(const char *ps, int syntax_type)
 {
@@ -15403,7 +15392,6 @@ find_command(char *name, struct cmdentry *entry, int act, const char *path)
        entry->u = cmdp->param;
 }
 /*
 * The trap builtin.
 */
@@ -15821,6 +15809,11 @@ readcmd(int argc UNUSED_PARAM, char **argv UNUSED_PARAM)
                if (pending_sig == 0)
                        goto again;
        }
+        if ((uintptr_t)r == 2) /* -t SEC timeout? */
+                /* bash: "The exit status is greater than 128 if the timeout is exceeded." */
+                /* The actual value observed with bash 5.2.15: */
+                return 128 + SIGALRM;
 #else /* ENABLE_PLATFORM_MINGW32 */
        if ((uintptr_t)r == 2) {
                /* Timeout, return 128 + SIGALRM */
@@ -15973,8 +15966,25 @@ exitshell(void)
        char *p;
 #if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
-        save_history(line_input_state); /* may be NULL */
+        if (line_input_state) {
+                const char *hp;
+# if ENABLE_FEATURE_SH_HISTFILESIZE
+// in bash:
+// HISTFILESIZE controls the on-disk history file size (in lines, 0=no history):
+// "When this variable is assigned a value, the history file is truncated, if necessary"
+// but we do it only at exit, not on assignment:
+                /* Use HISTFILESIZE to limit file size */
+                hp = lookupvar("HISTFILESIZE");
+                if (hp)
+                        line_input_state->max_history = size_from_HISTFILESIZE(hp);
+# endif
+                /* HISTFILE: "If unset, the command history is not saved when a shell exits." */
+                hp = lookupvar("HISTFILE");
+                line_input_state->hist_file = hp;
+                save_history(line_input_state); /* no-op if hist_file is NULL or "" */
+        }
 #endif
        savestatus = exitstatus;
        TRACE(("pid %d, exitshell(%d)\n", getpid(), savestatus));
        if (setjmp(loc.loc))
@@ -16148,7 +16158,6 @@ init(void)
        }
 }
 //usage:#define ash_trivial_usage
 //usage:        "[-il] [-|+Cabefmnuvx] [-|+o OPT]... [-c 'SCRIPT' [ARG0 ARGS] | FILE ARGS | -s ARGS]"
 ////////        comes from ^^^^^^^^^^optletters
@@ -16478,7 +16487,12 @@ int ash_main(int argc UNUSED_PARAM, char **argv)
                        if (hp)
                                line_input_state->hist_file = xstrdup(hp);
 # if ENABLE_FEATURE_SH_HISTFILESIZE
-                        hp = lookupvar("HISTFILESIZE");
+                        hp = lookupvar("HISTSIZE");
+                        /* Using HISTFILESIZE above to limit max_history would be WRONG:
+                         * users may set HISTFILESIZE=0 in their profile scripts
+                         * to prevent _saving_ of history files, but still want to have
+                         * non-zero history limit for in-memory list.
+                         */
                        line_input_state->max_history = size_from_HISTFILESIZE(hp);
 # endif
                }
diff --git a/shell/ash_test/ash-read/read_ifs2.right b/shell/ash_test/ash-read/read_ifs2.right
new file mode 100644
index 000000000..797137dae
--- /dev/null
+++ b/shell/ash_test/ash-read/read_ifs2.right
@@ -0,0 +1,9 @@
+|X|Y:Z:|
+|X|Y:Z|
+|X|Y|
+|X|Y|
+|X||
+|X||
+|||
+Whitespace should be trimmed too:
+|X|Y|
diff --git a/shell/ash_test/ash-read/read_ifs2.tests b/shell/ash_test/ash-read/read_ifs2.tests
new file mode 100755
index 000000000..f01a68978
--- /dev/null
+++ b/shell/ash_test/ash-read/read_ifs2.tests
@@ -0,0 +1,9 @@
+echo "X:Y:Z:" | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y:Z"  | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y:"   | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:Y"    | (IFS=": " read x y; echo "|$x|$y|")
+echo "X:"     | (IFS=": " read x y; echo "|$x|$y|")
+echo "X"      | (IFS=": " read x y; echo "|$x|$y|")
+echo ""       | (IFS=": " read x y; echo "|$x|$y|")
+echo Whitespace should be trimmed too:
+echo "X:Y  : " | (IFS=": " read x y; echo "|$x|$y|")
diff --git a/shell/ash_test/ash-read/read_t.right b/shell/ash_test/ash-read/read_t.right
index 04126cbe6..3eedae275 100644
--- a/shell/ash_test/ash-read/read_t.right
+++ b/shell/ash_test/ash-read/read_t.right
@@ -1,4 +1,4 @@
-><
+>te:142<
-><
+>:142<
->test<
+>test:0<
->test<
+>test:0<
diff --git a/shell/ash_test/ash-read/read_t.tests b/shell/ash_test/ash-read/read_t.tests
index d65f1aeaa..9fbeec517 100755
--- a/shell/ash_test/ash-read/read_t.tests
+++ b/shell/ash_test/ash-read/read_t.tests
@@ -1,10 +1,10 @@
-# bash 3.2 outputs:
+# bash 5.2 outputs:
-# ><
+# >te:142<
-{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply<")
+{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply:$?<")
-# ><
+# >:142<
-{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply<")
+{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply:$?<")
-# >test<
+# >test:0<
-{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply<")
+{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply:$?<")
-# >test<
+# >test:0<
-{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply<")
+{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply:$?<")
diff --git a/shell/ash_test/printenv.c b/shell/ash_test/printenv.c
index c86308d3b..f0f41984d 100644
--- a/shell/ash_test/printenv.c
+++ b/shell/ash_test/printenv.c
@@ -31,9 +31,7 @@
 extern char **environ;
 int
-main (argc, argv)
+main (int argc, char **argv)
-     int argc;
-     char **argv;
 {
  register char **envp, *eval;
  int len;
diff --git a/shell/ash_test/recho.c b/shell/ash_test/recho.c
index 42a5feafd..7e96b14cc 100644
--- a/shell/ash_test/recho.c
+++ b/shell/ash_test/recho.c
@@ -27,7 +27,7 @@
 #include <stdio.h>
 #include <stdlib.h>
-void strprint();
+void strprint(char *);
 int main(int argc, char **argv)
 {
diff --git a/shell/hush.c b/shell/hush.c
index 4a97293cc..09ab6ebc0 100644
--- a/shell/hush.c
+++ b/shell/hush.c
@@ -392,6 +392,8 @@
 /* Build knobs */
 #define LEAK_HUNTING 0
+#define LEAK_PRINTF(...) fdprintf(__VA_ARGS__)
+//#define LEAK_PRINTF(...) do { if (ptr_to_globals && G.root_pid == getpid()) fdprintf(__VA_ARGS__); } while (0)
 #define BUILD_AS_NOMMU 0
 /* Enable/disable sanity checks. Ok to enable in production,
 * only adds a bit of bloat. Set to >1 to get non-production level verbosity.
@@ -930,6 +932,12 @@ struct globals {
 # define G_flag_return_in_progress 0
 #endif
        smallint exiting; /* used to prevent EXIT trap recursion */
+#if !BB_MMU
+        smallint reexeced_on_NOMMU;
+# define G_reexeced_on_NOMMU (G.reexeced_on_NOMMU)
+#else
+# define G_reexeced_on_NOMMU 0
+#endif
        /* These support $? */
        smalluint last_exitcode;
        smalluint expand_exitcode;
@@ -1352,30 +1360,67 @@ static void debug_print_strings(const char *prefix, char **vv)
 static void *xxmalloc(int lineno, size_t size)
 {
        void *ptr = xmalloc((size + 0xff) & ~0xff);
-        fdprintf(2, "line %d: malloc %p\n", lineno, ptr);
+        LEAK_PRINTF(2, "line %d: malloc %p\n", lineno, ptr);
+        return ptr;
+}
+static void *xxzalloc(int lineno, size_t size)
+{
+        void *ptr = xzalloc((size + 0xff) & ~0xff);
+        LEAK_PRINTF(2, "line %d: zalloc %p\n", lineno, ptr);
        return ptr;
 }
 static void *xxrealloc(int lineno, void *ptr, size_t size)
 {
+        char *p = ptr;
        ptr = xrealloc(ptr, (size + 0xff) & ~0xff);
-        fdprintf(2, "line %d: realloc %p\n", lineno, ptr);
+        if (p != ptr)
+                LEAK_PRINTF(2, "line %d: realloc %p\n", lineno, ptr);
+        return ptr;
+}
+static void *xxrealloc_getcwd_or_warn(int lineno, char *ptr)
+{
+        char *p = ptr;
+        ptr = xrealloc_getcwd_or_warn(ptr);
+        if (p != ptr)
+                LEAK_PRINTF(2, "line %d: xrealloc_getcwd_or_warn %p\n", lineno, ptr);
        return ptr;
 }
 static char *xxstrdup(int lineno, const char *str)
 {
        char *ptr = xstrdup(str);
-        fdprintf(2, "line %d: strdup %p\n", lineno, ptr);
+        LEAK_PRINTF(2, "line %d: strdup %p\n", lineno, ptr);
+        return ptr;
+}
+static char *xxstrndup(int lineno, const char *str, size_t n)
+{
+        char *ptr = xstrndup(str, n);
+        LEAK_PRINTF(2, "line %d: strndup %p\n", lineno, ptr);
+        return ptr;
+}
+static char *xxasprintf(int lineno, const char *f, ...)
+{
+        char *ptr;
+        va_list args;
+        va_start(args, f);
+        if (vasprintf(&ptr, f, args) < 0)
+                bb_die_memory_exhausted();
+        va_end(args);
+        LEAK_PRINTF(2, "line %d: xasprintf %p\n", lineno, ptr);
        return ptr;
 }
 static void xxfree(void *ptr)
 {
-        fdprintf(2, "free %p\n", ptr);
+        LEAK_PRINTF(2, "free %p\n", ptr);
        free(ptr);
 }
-# define xmalloc(s)     xxmalloc(__LINE__, s)
+# define xmalloc(s)        xxmalloc(__LINE__, s)
-# define xrealloc(p, s) xxrealloc(__LINE__, p, s)
+# define xzalloc(s)        xxzalloc(__LINE__, s)
-# define xstrdup(s)     xxstrdup(__LINE__, s)
+# define xrealloc(p, s)    xxrealloc(__LINE__, p, s)
-# define free(p)        xxfree(p)
+# define xrealloc_getcwd_or_warn(p) xxrealloc_getcwd_or_warn(__LINE__, p)
+# define xstrdup(s)        xxstrdup(__LINE__, s)
+# define xstrndup(s, n)    xxstrndup(__LINE__, s, n)
+# define xasprintf(f, ...) xxasprintf(__LINE__, f, __VA_ARGS__)
+# define free(p)           xxfree(p)
 #endif
 /*
@@ -1929,7 +1974,7 @@ static void restore_G_args(save_arg_t *sv, char **argv)
 * "trap - SIGxxx":
 *    if sig is in special_sig_mask, set handler back to:
 *        record_pending_signo, or to IGN if it's a tty stop signal
- *    if sig is in fatal_sig_mask, set handler back to sigexit.
+ *    if sig is in fatal_sig_mask, set handler back to restore_ttypgrp_and_killsig_or__exit.
 *    else: set handler back to SIG_DFL
 * "trap 'cmd' SIGxxx":
 *    set handler to record_pending_signo.
@@ -1973,7 +2018,7 @@ static void record_pending_signo(int sig)
         || (G_traps && G_traps[SIGCHLD] && G_traps[SIGCHLD][0])
         /* ^^^ if SIGCHLD, interrupt line reading only if it has a trap */
        ) {
-                bb_got_signal = sig; /* for read_line_input: "we got a signal" */
+                bb_got_signal = sig; /* for read_line_input / read builtin: "we got a signal" */
        }
 #endif
 #if ENABLE_HUSH_FAST
@@ -2002,19 +2047,6 @@ static sighandler_t install_sighandler(int sig, sighandler_t handler)
        return old_sa.sa_handler;
 }
-static void hush_exit(int exitcode) NORETURN;
-static void restore_ttypgrp_and__exit(void) NORETURN;
-static void restore_ttypgrp_and__exit(void)
-{
-        /* xfunc has failed! die die die */
-        /* no EXIT traps, this is an escape hatch! */
-        G.exiting = 1;
-        hush_exit(xfunc_error_retval);
-}
-#if ENABLE_HUSH_JOB
 /* Needed only on some libc:
 * It was observed that on exit(), fgetc'ed buffered data
 * gets "unwound" via lseek(fd, -NUM, SEEK_CUR).
@@ -2028,26 +2060,20 @@ static void restore_ttypgrp_and__exit(void)
 * and in `cmd` handling.
 * If set as die_func(), this makes xfunc_die() exit via _exit(), not exit():
 */
-static void fflush_and__exit(void) NORETURN;
+static NORETURN void fflush_and__exit(void)
-static void fflush_and__exit(void)
 {
        fflush_all();
        _exit(xfunc_error_retval);
 }
-/* After [v]fork, in child: do not restore tty pgrp on xfunc death */
+#if ENABLE_HUSH_JOB
-# define disable_restore_tty_pgrp_on_exit() (die_func = fflush_and__exit)
-/* After [v]fork, in parent: restore tty pgrp on xfunc death */
-# define enable_restore_tty_pgrp_on_exit()  (die_func = restore_ttypgrp_and__exit)
 /* Restores tty foreground process group, and exits.
 * May be called as signal handler for fatal signal
 * (will resend signal to itself, producing correct exit state)
 * or called directly with -EXITCODE.
 * We also call it if xfunc is exiting.
 */
-static void sigexit(int sig) NORETURN;
+static NORETURN void restore_ttypgrp_and_killsig_or__exit(int sig)
-static void sigexit(int sig)
 {
        /* Careful: we can end up here after [v]fork. Do not restore
         * tty pgrp then, only top-level shell process does that */
@@ -2065,6 +2091,19 @@ static void sigexit(int sig)
        kill_myself_with_sig(sig); /* does not return */
 }
+static NORETURN void fflush_restore_ttypgrp_and__exit(void)
+{
+        /* xfunc has failed! die die die */
+        fflush_all();
+        restore_ttypgrp_and_killsig_or__exit(- xfunc_error_retval);
+}
+/* After [v]fork, in child: do not restore tty pgrp on xfunc death */
+# define disable_restore_tty_pgrp_on_exit() (die_func = fflush_and__exit)
+/* After [v]fork, in parent: restore tty pgrp on xfunc death */
+# define enable_restore_tty_pgrp_on_exit()  (die_func = fflush_restore_ttypgrp_and__exit)
 #else
 # define disable_restore_tty_pgrp_on_exit() ((void)0)
@@ -2081,7 +2120,7 @@ static sighandler_t pick_sighandler(unsigned sig)
 #if ENABLE_HUSH_JOB
                /* is sig fatal? */
                if (G_fatal_sig_mask & sigmask)
-                        handler = sigexit;
+                        handler = restore_ttypgrp_and_killsig_or__exit;
                else
 #endif
                /* sig has special handling? */
@@ -2099,11 +2138,33 @@ static sighandler_t pick_sighandler(unsigned sig)
        return handler;
 }
-/* Restores tty foreground process group, and exits. */
+static const char* FAST_FUNC get_local_var_value(const char *name);
-static void hush_exit(int exitcode)
+/* Self-explanatory.
+ * Restores tty foreground process group too.
+ */
+static NORETURN void save_history_run_exit_trap_and_exit(int exitcode)
 {
 #if ENABLE_FEATURE_EDITING_SAVE_ON_EXIT
-        save_history(G.line_input_state); /* may be NULL */
+        if (G.line_input_state
+         && getpid() == G.root_pid /* exits in subshells do not save history */
+        ) {
+                const char *hp;
+# if ENABLE_FEATURE_SH_HISTFILESIZE
+// in bash:
+// HISTFILESIZE controls the on-disk history file size (in lines, 0=no history):
+// "When this variable is assigned a value, the history file is truncated, if necessary"
+// but we do it only at exit, not on every assignment:
+                /* Use HISTFILESIZE to limit file size */
+                hp = get_local_var_value("HISTFILESIZE");
+                if (hp)
+                        G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
+# endif
+                /* HISTFILE: "If unset, the command history is not saved when a shell exits." */
+                hp = get_local_var_value("HISTFILE");
+                G.line_input_state->hist_file = hp;
+                save_history(G.line_input_state); /* no-op if hist_file is NULL or "" */
+        }
 #endif
        fflush_all();
@@ -2137,7 +2198,7 @@ static void hush_exit(int exitcode)
        fflush_all();
 #if ENABLE_HUSH_JOB
-        sigexit(- (exitcode & 0xff));
+        restore_ttypgrp_and_killsig_or__exit(- (exitcode & 0xff));
 #else
        _exit(exitcode);
 #endif
@@ -2222,7 +2283,7 @@ static int check_and_run_traps(void)
                                }
                        }
                        /* this restores tty pgrp, then kills us with SIGHUP */
-                        sigexit(SIGHUP);
+                        restore_ttypgrp_and_killsig_or__exit(SIGHUP);
                }
 #endif
 #if ENABLE_HUSH_FAST
@@ -4607,6 +4668,11 @@ static int fetch_heredocs(o_string *as_string, struct pipe *pi, int heredoc_cnt,
                                        redir->rd_type = REDIRECT_HEREDOC2;
                                        /* redir->rd_dup is (ab)used to indicate <<- */
+                                        if (!redir->rd_filename) {
+                                                /* examples: "echo <<", "echo <<<", "echo <<>" */
+                                                syntax_error("missing here document terminator");
+                                                return -1;
+                                        }
                                        p = fetch_till_str(as_string, input,
                                                        redir->rd_filename, redir->rd_dup);
                                        if (!p) {
@@ -7366,11 +7432,6 @@ static void switch_off_special_sigs(unsigned mask)
 }
 #if BB_MMU
-/* never called */
-void re_execute_shell(char ***to_free, const char *s,
-                char *g_argv0, char **g_argv,
-                char **builtin_argv) NORETURN;
 static void reset_traps_to_defaults(void)
 {
        /* This function is always called in a child shell
@@ -7420,10 +7481,8 @@ static void reset_traps_to_defaults(void)
 #else /* !BB_MMU */
-static void re_execute_shell(char ***to_free, const char *s,
+static NORETURN void re_execute_shell(
-                char *g_argv0, char **g_argv,
+                char * *volatile * to_free, const char *s,
-                char **builtin_argv) NORETURN;
-static void re_execute_shell(char ***to_free, const char *s,
                char *g_argv0, char **g_argv,
                char **builtin_argv)
 {
@@ -7653,7 +7712,13 @@ static int generate_stream_from_string(const char *s, pid_t *pid_p)
        pid_t pid;
        int channel[2];
 # if !BB_MMU
-        char **to_free = NULL;
+        /* _volatile_ pointer to "char*".
+         * Or else compiler can peek from inside re_execute_shell()
+         * and see that this pointer is a local var (i.e. not globally visible),
+         * and decide to optimize out the store to it. Yes,
+         * it was seen in the wild.
+         */
+        char * *volatile to_free = NULL;
 # endif
        xpipe(channel);
@@ -7800,7 +7865,7 @@ static void setup_heredoc(struct redir_struct *redir)
        const char *heredoc = redir->rd_filename;
        char *expanded;
 #if !BB_MMU
-        char **to_free;
+        char * *volatile to_free;
 #endif
        expanded = NULL;
@@ -8275,7 +8340,7 @@ static const struct built_in_command *find_builtin(const char *name)
        return find_builtin_helper(name, bltins2, &bltins2[ARRAY_SIZE(bltins2)]);
 }
-#if ENABLE_HUSH_JOB && ENABLE_FEATURE_TAB_COMPLETION
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_TAB_COMPLETION
 static const char * FAST_FUNC hush_command_name(int i)
 {
        if (/*i >= 0 && */ i < ARRAY_SIZE(bltins1)) {
@@ -8441,10 +8506,8 @@ static void unset_func(const char *name)
 #define exec_function(to_free, funcp, argv) \
        exec_function(funcp, argv)
 # endif
-static void exec_function(char ***to_free,
+static NORETURN void exec_function(
-                const struct function *funcp,
+                char * *volatile *to_free,
-                char **argv) NORETURN;
-static void exec_function(char ***to_free,
                const struct function *funcp,
                char **argv)
 {
@@ -8540,10 +8603,8 @@ static int run_function(const struct function *funcp, char **argv)
 #define exec_builtin(to_free, x, argv) \
        exec_builtin(to_free, argv)
 #endif
-static void exec_builtin(char ***to_free,
+static NORETURN void exec_builtin(
-                const struct built_in_command *x,
+                char * *volatile *to_free,
-                char **argv) NORETURN;
-static void exec_builtin(char ***to_free,
                const struct built_in_command *x,
                char **argv)
 {
@@ -8566,8 +8627,7 @@ static void exec_builtin(char ***to_free,
 #endif
 }
-static void execvp_or_die(char **argv) NORETURN;
+static NORETURN void execvp_or_die(char **argv)
-static void execvp_or_die(char **argv)
 {
        int e;
        debug_printf_exec("execing '%s'\n", argv[0]);
@@ -8688,10 +8748,8 @@ static void if_command_vV_print_and_exit(char opt_vV, char *cmd, const char *exp
 * The at_exit handlers apparently confuse the calling process,
 * in particular stdin handling. Not sure why? -- because of vfork! (vda)
 */
-static void pseudo_exec_argv(nommu_save_t *nommu_save,
+static NORETURN NOINLINE void pseudo_exec_argv(
-                char **argv, int assignment_cnt,
+                volatile nommu_save_t *nommu_save,
-                char **argv_expanded) NORETURN;
-static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
                char **argv, int assignment_cnt,
                char **argv_expanded)
 {
@@ -8717,7 +8775,8 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
 #if BB_MMU
        G.shadowed_vars_pp = NULL; /* "don't save, free them instead" */
 #else
-        G.shadowed_vars_pp = &nommu_save->old_vars;
+        /* cast away volatility */
+        G.shadowed_vars_pp = (struct variable **)&nommu_save->old_vars;
        G.var_nest_level++;
 #endif
        set_vars_and_save_old(new_env);
@@ -8844,10 +8903,8 @@ static NOINLINE void pseudo_exec_argv(nommu_save_t *nommu_save,
 /* Called after [v]fork() in run_pipe
 */
-static void pseudo_exec(nommu_save_t *nommu_save,
+static NORETURN void pseudo_exec(
-                struct command *command,
+                volatile nommu_save_t *nommu_save,
-                char **argv_expanded) NORETURN;
-static void pseudo_exec(nommu_save_t *nommu_save,
                struct command *command,
                char **argv_expanded)
 {
@@ -9732,8 +9789,7 @@ static NOINLINE int run_pipe(struct pipe *pi)
                        /* Stores to nommu_save list of env vars putenv'ed
                         * (NOMMU, on MMU we don't need that) */
-                        /* cast away volatility... */
+                        pseudo_exec(&nommu_save, command, argv_expanded);
-                        pseudo_exec((nommu_save_t*) &nommu_save, command, argv_expanded);
                        /* pseudo_exec() does not return */
                }
@@ -10121,7 +10177,7 @@ static int run_list(struct pipe *pi)
                if (rcode != 0 && G.o_opt[OPT_O_ERREXIT]) {
                        debug_printf_exec("ERREXIT:1 errexit_depth:%d\n", G.errexit_depth);
                        if (G.errexit_depth == 0)
-                                hush_exit(rcode);
+                                save_history_run_exit_trap_and_exit(rcode);
                }
                G.errexit_depth = sv_errexit_depth;
@@ -10195,6 +10251,53 @@ static int run_and_free_list(struct pipe *pi)
 /*
 * Initialization and main
 */
+#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING
+static void init_line_editing(void)
+{
+        G.line_input_state = new_line_input_t(FOR_SHELL);
+# if ENABLE_FEATURE_TAB_COMPLETION
+        G.line_input_state->get_exe_name = hush_command_name;
+# endif
+# if EDITING_HAS_sh_get_var
+        G.line_input_state->sh_get_var = get_local_var_value;
+# endif
+# if ENABLE_HUSH_SAVEHISTORY && MAX_HISTORY > 0
+        {
+                const char *hp = get_local_var_value("HISTFILE");
+                if (!hp) {
+                        hp = get_local_var_value("HOME");
+                        if (hp) {
+                                hp = concat_path_file(hp, ".hush_history");
+                                /* Make HISTFILE set on exit (else history won't be saved) */
+                                set_local_var_from_halves("HISTFILE", hp);
+                        }
+                } else {
+                        hp = xstrdup(hp);
+                }
+                if (hp) {
+                        G.line_input_state->hist_file = hp;
+                }
+#  if ENABLE_FEATURE_SH_HISTFILESIZE
+                hp = get_local_var_value("HISTSIZE");
+                /* Using HISTFILESIZE above to limit max_history would be WRONG:
+                 * users may set HISTFILESIZE=0 in their profile scripts
+                 * to prevent _saving_ of history files, but still want to have
+                 * non-zero history limit for in-memory list.
+                 */
+// in bash, runtime history size is controlled by HISTSIZE (0=no history),
+// HISTFILESIZE controls on-disk history file size (in lines, 0=no history):
+                G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
+// HISTFILESIZE: "The shell sets the default value to the value of HISTSIZE after reading any startup files."
+// HISTSIZE: "The shell sets the default value to 500 after reading any startup files."
+// (meaning: if the value wasn't set after startup files, the default value is set as described above)
+#  endif
+        }
+# endif
+}
+#else
+# define init_line_editing() ((void)0)
+#endif
 static void install_sighandlers(unsigned mask)
 {
        sighandler_t old_handler;
@@ -10333,7 +10436,6 @@ static int set_mode(int state, char mode, const char *o_opt)
 int hush_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
 int hush_main(int argc, char **argv)
 {
-        pid_t cached_getpid;
        enum {
                OPT_login = (1 << 0),
        };
@@ -10346,6 +10448,11 @@ int hush_main(int argc, char **argv)
        struct variable *shell_ver;
        INIT_G();
+#if ENABLE_HUSH_JOB
+        die_func = fflush_restore_ttypgrp_and__exit;
+#else
+        die_func = fflush_and__exit;
+#endif
        if (EXIT_SUCCESS != 0) /* if EXIT_SUCCESS == 0, it is already done */
                G.last_exitcode = EXIT_SUCCESS;
 #if !BB_MMU
@@ -10361,9 +10468,6 @@ int hush_main(int argc, char **argv)
                _exit(0);
        }
        G.argv0_for_re_execing = argv[0];
-        if (G.argv0_for_re_execing[0] == '-')
-                /* reexeced hush should never be a login shell */
-                G.argv0_for_re_execing++;
 #endif
 #if ENABLE_HUSH_TRAP
 # if ENABLE_HUSH_FUNCTIONS
@@ -10376,9 +10480,8 @@ int hush_main(int argc, char **argv)
        G.count_SIGCHLD++; /* ensure it is != G.handled_SIGCHLD */
 #endif
-        cached_getpid = getpid();   /* for tcsetpgrp() during init */
+        G.root_pid = getpid();   /* for $PID  (NOMMU can override via -$HEXPID:HEXPPID:...) */
-        G.root_pid = cached_getpid; /* for $PID  (NOMMU can override via -$HEXPID:HEXPPID:...) */
+        G.root_ppid = getppid(); /* for $PPID (NOMMU can override) */
-        G.root_ppid = getppid();    /* for $PPID (NOMMU can override) */
        /* Deal with HUSH_VERSION */
        debug_printf_env("unsetenv '%s'\n", "HUSH_VERSION");
@@ -10427,7 +10530,7 @@ int hush_main(int argc, char **argv)
        if (!get_local_var_value("PATH"))
                set_local_var_from_halves("PATH", bb_default_root_path);
-        /* PS1/PS2 are set later, if we determine that we are interactive */
+        /* PS1/PS2/HISTFILE are set later, if we determine that we are interactive */
        /* bash also exports SHLVL and _,
         * and sets (but doesn't export) the following variables:
@@ -10449,7 +10552,6 @@ int hush_main(int argc, char **argv)
         * BASH_SOURCE=()
         * DIRSTACK=()
         * PIPESTATUS=([0]="0")
-         * HISTFILE=/<xxx>/.bash_history
         * HISTFILESIZE=500
         * HISTSIZE=500
         * MAILCHECK=60
@@ -10462,27 +10564,24 @@ int hush_main(int argc, char **argv)
         * PS4='+ '
         */
+        /* Shell is non-interactive at first. We need to call
+         * install_special_sighandlers() if we are going to execute "sh <script>",
+         * "sh -c <cmds>" or login shell's /etc/profile and friends.
+         * If we later decide that we are interactive, we run
+         * install_special_sighandlers() in order to intercept more signals.
+         */
+        install_special_sighandlers();
 #if NUM_SCRIPTS > 0
        if (argc < 0) {
                char *script = get_script_content(-argc - 1);
                G.global_argv = argv;
                G.global_argc = string_array_len(argv);
-                //install_special_sighandlers(); - needed?
                parse_and_run_string(script);
                goto final_return;
        }
 #endif
-        /* Initialize some more globals to non-zero values */
-        die_func = restore_ttypgrp_and__exit;
-        /* Shell is non-interactive at first. We need to call
-         * install_special_sighandlers() if we are going to execute "sh <script>",
-         * "sh -c <cmds>" or login shell's /etc/profile and friends.
-         * If we later decide that we are interactive, we run install_special_sighandlers()
-         * in order to intercept (more) signals.
-         */
        /* Parse options */
        /* http://www.opengroup.org/onlinepubs/9699919799/utilities/sh.html */
        flags = (argv[0] && argv[0][0] == '-') ? OPT_login : 0;
@@ -10546,6 +10645,7 @@ int hush_main(int argc, char **argv)
                case '$': {
                        unsigned long long empty_trap_mask;
+                        G.reexeced_on_NOMMU = 1;
                        G.root_pid = bb_strtou(optarg, &optarg, 16);
                        optarg++;
                        G.root_ppid = bb_strtou(optarg, &optarg, 16);
@@ -10559,7 +10659,6 @@ int hush_main(int argc, char **argv)
                        empty_trap_mask = bb_strtoull(optarg, &optarg, 16);
                        if (empty_trap_mask != 0) {
                                IF_HUSH_TRAP(int sig;)
-                                install_special_sighandlers();
 # if ENABLE_HUSH_TRAP
                                G_traps = xzalloc(sizeof(G_traps[0]) * NSIG);
                                for (sig = 1; sig < NSIG; sig++) {
@@ -10625,7 +10724,9 @@ int hush_main(int argc, char **argv)
        G.global_argv[0] = argv[0];
        /* If we are login shell... */
-        if (flags & OPT_login) {
+        if (!G_reexeced_on_NOMMU /* reexeced hush should never be a login shell */
+         && (flags & OPT_login)
+        ) {
                const char *hp = NULL;
                HFILE *input;
@@ -10633,7 +10734,6 @@ int hush_main(int argc, char **argv)
                input = hfopen("/etc/profile");
 run_profile:
                if (input != NULL) {
-                        install_special_sighandlers();
                        parse_and_run_file(input);
                        hfclose(input);
                }
@@ -10670,8 +10770,6 @@ int hush_main(int argc, char **argv)
                 */
                char *script;
-                install_special_sighandlers();
                G.global_argc--;
                G.global_argv++;
 #if !BB_MMU
@@ -10722,7 +10820,6 @@ int hush_main(int argc, char **argv)
                        bb_simple_perror_msg_and_die(G.global_argv[0]);
                }
                xfunc_error_retval = 1;
-                install_special_sighandlers();
                parse_and_run_file(input);
 #if ENABLE_FEATURE_CLEAN_UP
                hfclose(input);
@@ -10738,126 +10835,86 @@ int hush_main(int argc, char **argv)
        /* A shell is interactive if the '-i' flag was given,
         * or if all of the following conditions are met:
-         *    no -c command
+         *    not -c 'CMD'
-         *    no arguments remaining or the -s flag given
+         *    not running a script (no arguments remaining, or -s flag given)
         *    standard input is a terminal
         *    standard output is a terminal
         * Refer to Posix.2, the description of the 'sh' utility.
         */
-#if ENABLE_HUSH_JOB
+#if ENABLE_HUSH_INTERACTIVE
-        if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
+        if (!G_reexeced_on_NOMMU
-                G_saved_tty_pgrp = tcgetpgrp(STDIN_FILENO);
+         && isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)
-                debug_printf("saved_tty_pgrp:%d\n", G_saved_tty_pgrp);
+        ) {
-                if (G_saved_tty_pgrp < 0)
+                /* Try to dup stdin to high fd#, >= 255 */
-                        G_saved_tty_pgrp = 0;
-                /* try to dup stdin to high fd#, >= 255 */
                G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, 254);
                if (G_interactive_fd < 0) {
-                        /* try to dup to any fd */
+                        /* Try to dup to any fd */
                        G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, -1);
-                        if (G_interactive_fd < 0) {
+                        if (G_interactive_fd < 0)
-                                /* give up */
+                                /* Give up */
                                G_interactive_fd = 0;
-                                G_saved_tty_pgrp = 0;
-                        }
                }
-        }
+                debug_printf("interactive_fd:%d\n", G_interactive_fd);
-        debug_printf("interactive_fd:%d\n", G_interactive_fd);
+                if (G_interactive_fd) {
-        if (G_interactive_fd) {
+// TODO? bash:
-                if (G_saved_tty_pgrp) {
+// if interactive but not a login shell, sources ~/.bashrc
-                        /* If we were run as 'hush &', sleep until we are
+// (--norc turns this off, --rcfile <file> overrides)
-                         * in the foreground (tty pgrp == our pgrp).
+# if ENABLE_HUSH_JOB
-                         * If we get started under a job aware app (like bash),
+                        /* Can we do job control? */
-                         * make sure we are now in charge so we don't fight over
+                        G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
-                         * who gets the foreground */
+                        debug_printf("saved_tty_pgrp:%d\n", G_saved_tty_pgrp);
-                        while (1) {
+                        if (G_saved_tty_pgrp < 0)
-                                pid_t shell_pgrp = getpgrp();
+                                G_saved_tty_pgrp = 0; /* no */
-                                G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
+                        if (G_saved_tty_pgrp) {
-                                if (G_saved_tty_pgrp == shell_pgrp)
+                                /* If we were run as 'hush &', sleep until we are
-                                        break;
+                                 * in the foreground (tty pgrp == our pgrp).
-                                /* send TTIN to ourself (should stop us) */
+                                 * If we get started under a job aware app (like bash),
-                                kill(- shell_pgrp, SIGTTIN);
+                                 * make sure we are now in charge so we don't fight over
+                                 * who gets the foreground */
+                                while (1) {
+                                        pid_t shell_pgrp = getpgrp();
+                                        if (G_saved_tty_pgrp == shell_pgrp) {
+/* Often both pgrps here are set to our pid - but not always!
+ * Example: sh -c 'echo $$; hush; echo FIN'
+ * Here, the parent shell is not interactive, so it does NOT set up
+ * a separate process group for its children, and we (hush) initially
+ * run in parent's process group (until we set up our own a few lines down).
+ */
+                                                //bb_error_msg("process groups tty:%d hush:%d", G_saved_tty_pgrp, shell_pgrp);
+                                                break;
+                                        }
+                                        /* Send TTIN to ourself (should stop us) */
+                                        kill(- shell_pgrp, SIGTTIN);
+                                        G_saved_tty_pgrp = tcgetpgrp(G_interactive_fd);
+                                }
                        }
-                }
-                /* Install more signal handlers */
-                install_special_sighandlers();
-                if (G_saved_tty_pgrp) {
-                        /* Set other signals to restore saved_tty_pgrp */
-                        install_fatal_sighandlers();
-                        /* Put ourselves in our own process group
-                         * (bash, too, does this only if ctty is available) */
-                        bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
-                        /* Grab control of the terminal */
-                        tcsetpgrp(G_interactive_fd, cached_getpid);
-                }
-                enable_restore_tty_pgrp_on_exit();
-# if ENABLE_FEATURE_EDITING
-                G.line_input_state = new_line_input_t(FOR_SHELL);
-#  if ENABLE_FEATURE_TAB_COMPLETION
-                G.line_input_state->get_exe_name = hush_command_name;
-#  endif
-#  if EDITING_HAS_sh_get_var
-                G.line_input_state->sh_get_var = get_local_var_value;
-#  endif
 # endif
-# if ENABLE_HUSH_SAVEHISTORY && MAX_HISTORY > 0
+                        /* Install more signal handlers */
-                {
+                        install_special_sighandlers();
-                        const char *hp = get_local_var_value("HISTFILE");
+# if ENABLE_HUSH_JOB
-                        if (!hp) {
+                        if (G_saved_tty_pgrp) {
-                                hp = get_local_var_value("HOME");
+                                /* Set fatal signals to restore saved_tty_pgrp */
-                                if (hp)
+                                install_fatal_sighandlers();
-                                        hp = concat_path_file(hp, ".hush_history");
+                                /* (The if() is an optimization: can avoid two redundant syscalls) */
-                        } else {
+                                if (G_saved_tty_pgrp != G.root_pid) {
-                                hp = xstrdup(hp);
+                                        /* Put ourselves in our own process group
-                        }
+                                         * (bash, too, does this only if ctty is available) */
-                        if (hp) {
+                                        bb_setpgrp(); /* is the same as setpgid(our_pid, our_pid); */
-                                G.line_input_state->hist_file = hp;
+                                        /* Grab control of the terminal */
-                                //set_local_var(xasprintf("HISTFILE=%s", ...));
+                                        tcsetpgrp(G_interactive_fd, G.root_pid);
+                                }
                        }
-#  if ENABLE_FEATURE_SH_HISTFILESIZE
-                        hp = get_local_var_value("HISTFILESIZE");
-                        G.line_input_state->max_history = size_from_HISTFILESIZE(hp);
-#  endif
-                }
 # endif
-        } else {
+# if ENABLE_FEATURE_EDITING_FANCY_PROMPT
-                install_special_sighandlers();
+                        /* Set (but not export) PS1/2 unless already set */
-        }
+                        if (!get_local_var_value("PS1"))
-#elif ENABLE_HUSH_INTERACTIVE
+                                set_local_var_from_halves("PS1", "\\w \\$ ");
-        /* No job control compiled in, only prompt/line editing */
+                        if (!get_local_var_value("PS2"))
-        if (isatty(STDIN_FILENO) && isatty(STDOUT_FILENO)) {
+                                set_local_var_from_halves("PS2", "> ");
-                G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, 254);
+# endif
-                if (G_interactive_fd < 0) {
+                        init_line_editing();
-                        /* try to dup to any fd */
-                        G_interactive_fd = dup_CLOEXEC(STDIN_FILENO, -1);
-                        if (G_interactive_fd < 0)
-                                /* give up */
-                                G_interactive_fd = 0;
-                }
-        }
-        install_special_sighandlers();
-#else
-        /* We have interactiveness code disabled */
-        install_special_sighandlers();
-#endif
-        /* bash:
-         * if interactive but not a login shell, sources ~/.bashrc
-         * (--norc turns this off, --rcfile <file> overrides)
-         */
-        if (G_interactive_fd) {
+# if !ENABLE_FEATURE_SH_EXTRA_QUIET
-#if ENABLE_HUSH_INTERACTIVE && ENABLE_FEATURE_EDITING_FANCY_PROMPT
-                /* Set (but not export) PS1/2 unless already set */
-                if (!get_local_var_value("PS1"))
-                        set_local_var_from_halves("PS1", "\\w \\$ ");
-                if (!get_local_var_value("PS2"))
-                        set_local_var_from_halves("PS2", "> ");
-#endif
-                if (!ENABLE_FEATURE_SH_EXTRA_QUIET) {
                        /* note: ash and hush share this string */
                        printf("\n\n%s %s\n"
                                IF_HUSH_HELP("Enter 'help' for a list of built-in commands.\n")
@@ -10865,13 +10922,15 @@ int hush_main(int argc, char **argv)
                                bb_banner,
                                "hush - the humble shell"
                        );
-                }
+# endif
-        }
+                } /* if become interactive */
+        } /* if on tty */
+#endif /* if INTERACTIVE is allowed by build config */
        parse_and_run_file(hfopen(NULL)); /* stdin */
 final_return:
-        hush_exit(G.last_exitcode);
+        save_history_run_exit_trap_and_exit(G.last_exitcode);
 }
 /*
@@ -11057,19 +11116,19 @@ static int FAST_FUNC builtin_exit(char **argv)
         * TODO: we can use G.exiting = -1 as indicator "last cmd was exit"
         */
-        /* note: EXIT trap is run by hush_exit */
+        /* note: EXIT trap is run by save_history_run_exit_trap_and_exit */
        argv = skip_dash_dash(argv);
        if (argv[0] == NULL) {
 #if ENABLE_HUSH_TRAP
                if (G.pre_trap_exitcode >= 0) /* "exit" in trap uses $? from before the trap */
-                        hush_exit(G.pre_trap_exitcode);
+                        save_history_run_exit_trap_and_exit(G.pre_trap_exitcode);
 #endif
-                hush_exit(G.last_exitcode);
+                save_history_run_exit_trap_and_exit(G.last_exitcode);
        }
        /* mimic bash: exit 123abc == exit 255 + error msg */
        xfunc_error_retval = 255;
        /* bash: exit -2 == exit 254, no error msg */
-        hush_exit(xatoi(argv[0]) & 0xff);
+        save_history_run_exit_trap_and_exit(xatoi(argv[0]) & 0xff);
 }
 #if ENABLE_HUSH_TYPE
@@ -11175,6 +11234,11 @@ static int FAST_FUNC builtin_read(char **argv)
                        goto again;
        }
+        if ((uintptr_t)r == 2) /* -t SEC timeout? */
+                /* bash: "The exit status is greater than 128 if the timeout is exceeded." */
+                /* The actual value observed with bash 5.2.15: */
+                return 128 + SIGALRM;
        if ((uintptr_t)r > 1) {
                bb_simple_error_msg(r);
                r = (char*)(uintptr_t)1;
diff --git a/shell/hush_leaktool.sh b/shell/hush_leaktool.sh
index ca35ec144..3edd3df61 100755
--- a/shell/hush_leaktool.sh
+++ b/shell/hush_leaktool.sh
@@ -7,7 +7,7 @@ freelist=`grep 'free 0x' "$output" | cut -d' ' -f2 | sort | uniq | xargs`
 grep -v free "$output" >"$output.leaked"
-i=8
+i=16
 list=
 for freed in $freelist; do
    list="$list -e $freed"
@@ -15,7 +15,7 @@ for freed in $freelist; do
    echo Dropping $list
    grep -F -v $list <"$output.leaked" >"$output.temp"
    mv "$output.temp" "$output.leaked"
-    i=8
+    i=16
    list=
 done
 if test "$list"; then
@@ -23,3 +23,17 @@ if test "$list"; then
    grep -F -v $list <"$output.leaked" >"$output.temp"
    mv "$output.temp" "$output.leaked"
 fi
+# All remaining allocations are on addresses which were never freed.
+# * Sort them by line, grouping together allocations which allocated the same address.
+#       A leaky allocation will give many different addresses (because it's never freed,
+#       the address can not be reused).
+# * Remove the address (field #4).
+# * Count the allocations per every unique source line and alloc type.
+# * Show largest counts on top.
+cat output.leaked \
+        | sort -u \
+        | cut -d' ' -f1-3 \
+        | uniq -c \
+        | sort -rn \
+>output.leaked.counted_uniq_alloc_address
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right
new file mode 100644
index 000000000..7af73557a
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.right
@@ -0,0 +1 @@
+hush: syntax error: missing here document terminator
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests
new file mode 100755
index 000000000..33ccde26b
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF1.tests
@@ -0,0 +1,2 @@
+echo <<
+echo Done:
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right
new file mode 100644
index 000000000..7af73557a
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.right
@@ -0,0 +1 @@
+hush: syntax error: missing here document terminator
diff --git a/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests
new file mode 100755
index 000000000..fcda11045
--- /dev/null
+++ b/shell/hush_test/hush-heredoc/heredoc_syntax_err_no_EOF2.tests
@@ -0,0 +1,2 @@
+echo << >
+echo Done:
diff --git a/shell/hush_test/hush-misc/sig_exitcode.tests b/shell/hush_test/hush-misc/sig_exitcode.tests
index 7879dc854..67b4500f4 100755
--- a/shell/hush_test/hush-misc/sig_exitcode.tests
+++ b/shell/hush_test/hush-misc/sig_exitcode.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 exec 2>&1
 $THIS_SH -c 'kill -9 $$'
diff --git a/shell/hush_test/hush-misc/wait1.tests b/shell/hush_test/hush-misc/wait1.tests
index f9cf6d48c..54120319b 100755
--- a/shell/hush_test/hush-misc/wait1.tests
+++ b/shell/hush_test/hush-misc/wait1.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 sleep 2 & sleep 1 & wait $!
 echo $?
 jobs
diff --git a/shell/hush_test/hush-misc/wait2.tests b/shell/hush_test/hush-misc/wait2.tests
index be20f95a5..60f382c9f 100755
--- a/shell/hush_test/hush-misc/wait2.tests
+++ b/shell/hush_test/hush-misc/wait2.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 sleep 3 & sleep 2 & sleep 1
 wait $!
 echo $?
diff --git a/shell/hush_test/hush-misc/wait3.tests b/shell/hush_test/hush-misc/wait3.tests
index ac541c3fc..aceed1126 100755
--- a/shell/hush_test/hush-misc/wait3.tests
+++ b/shell/hush_test/hush-misc/wait3.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 sleep 2 & (sleep 1;exit 3) & wait $!
 echo $?
 jobs
diff --git a/shell/hush_test/hush-misc/wait4.tests b/shell/hush_test/hush-misc/wait4.tests
index cc34059ac..c979a38b6 100755
--- a/shell/hush_test/hush-misc/wait4.tests
+++ b/shell/hush_test/hush-misc/wait4.tests
@@ -1,2 +1,5 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 sleep 1 | (sleep 1;exit 3) & wait %1
 echo Three:$?
diff --git a/shell/hush_test/hush-misc/wait5.tests b/shell/hush_test/hush-misc/wait5.tests
index 1b4762d89..e0ac8c251 100755
--- a/shell/hush_test/hush-misc/wait5.tests
+++ b/shell/hush_test/hush-misc/wait5.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 sleep 0 | (sleep 0;exit 3) &
 sleep 1
 echo Zero:$?
diff --git a/shell/hush_test/hush-misc/wait6.tests b/shell/hush_test/hush-misc/wait6.tests
index c23713199..c09002ab0 100755
--- a/shell/hush_test/hush-misc/wait6.tests
+++ b/shell/hush_test/hush-misc/wait6.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 # In bash, "wait $!" extracts correct exitcode even if bg task has already exited
 # It prints 0, then 3:
 (sleep 0; exit 3) & sleep 1
diff --git a/shell/hush_test/hush-read/read_t.right b/shell/hush_test/hush-read/read_t.right
index 04126cbe6..3eedae275 100644
--- a/shell/hush_test/hush-read/read_t.right
+++ b/shell/hush_test/hush-read/read_t.right
@@ -1,4 +1,4 @@
-><
+>te:142<
-><
+>:142<
->test<
+>test:0<
->test<
+>test:0<
diff --git a/shell/hush_test/hush-read/read_t.tests b/shell/hush_test/hush-read/read_t.tests
index d65f1aeaa..9fbeec517 100755
--- a/shell/hush_test/hush-read/read_t.tests
+++ b/shell/hush_test/hush-read/read_t.tests
@@ -1,10 +1,10 @@
-# bash 3.2 outputs:
+# bash 5.2 outputs:
-# ><
+# >te:142<
-{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply<")
+{ echo -n 'te'; sleep 2; echo 'st'; }   | (read -t 1 reply; echo ">$reply:$?<")
-# ><
+# >:142<
-{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply<")
+{               sleep 2; echo 'test'; } | (read -t 1 reply; echo ">$reply:$?<")
-# >test<
+# >test:0<
-{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply<")
+{ echo -n 'te'; sleep 1; echo 'st'; }   | (read -t 2 reply; echo ">$reply:$?<")
-# >test<
+# >test:0<
-{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply<")
+{               sleep 1; echo 'test'; } | (read -t 2 reply; echo ">$reply:$?<")
diff --git a/shell/hush_test/hush-signals/catch.tests b/shell/hush_test/hush-signals/catch.tests
index d2a21d17e..4b1a08e8f 100755
--- a/shell/hush_test/hush-signals/catch.tests
+++ b/shell/hush_test/hush-signals/catch.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test ("User defined signal 2" text not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 # avoid ugly warnings about signals not being caught
 trap ":" USR1 USR2
diff --git a/shell/hush_test/hush-signals/signal1.tests b/shell/hush_test/hush-signals/signal1.tests
index 61943467a..c83fa1254 100755
--- a/shell/hush_test/hush-signals/signal1.tests
+++ b/shell/hush_test/hush-signals/signal1.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 trap "echo got signal" USR1
 for try in 1 2 3 4 5; do
diff --git a/shell/hush_test/hush-signals/signal8.tests b/shell/hush_test/hush-signals/signal8.tests
index 731af7477..cd5790164 100755
--- a/shell/hush_test/hush-signals/signal8.tests
+++ b/shell/hush_test/hush-signals/signal8.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 "$THIS_SH" -c '
 exit_func() {
    echo "Removing traps"
diff --git a/shell/hush_test/hush-signals/signal_read2.tests b/shell/hush_test/hush-signals/signal_read2.tests
index eab5b9b5b..11accd5ab 100755
--- a/shell/hush_test/hush-signals/signal_read2.tests
+++ b/shell/hush_test/hush-signals/signal_read2.tests
@@ -1,3 +1,6 @@
+# If job control is disabled, skip the test ("Hangup" not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 $THIS_SH -c '
 (sleep 1; kill -HUP $$) &
 while true; do
diff --git a/shell/hush_test/hush-signals/subshell.tests b/shell/hush_test/hush-signals/subshell.tests
index d877f2b82..856c922d3 100755
--- a/shell/hush_test/hush-signals/subshell.tests
+++ b/shell/hush_test/hush-signals/subshell.tests
@@ -1,5 +1,8 @@
 # Non-empty traps should be reset in subshell
+# If job control is disabled, skip the test ("Terminated" text not emitted)
+test "`type jobs`" = "jobs is a shell builtin" || exit 77
 # HUP is special in interactive shells
 trap '' HUP
 # QUIT is always special
diff --git a/shell/hush_test/run-all b/shell/hush_test/run-all
index 7345fee43..ff29ca0b1 100755
--- a/shell/hush_test/run-all
+++ b/shell/hush_test/run-all
@@ -67,9 +67,12 @@ do_test()
 #               echo Running test: "$x"
                echo -n "$1/$x:"
                (
-                        "$THIS_SH" "./$x" 2>&1 | \
+                        "$THIS_SH" "./$x" >"$name.xx" 2>&1
-                                grep -va "^hush: using fallback suid method$" >"$name.xx"
                        r=$?
+                        # filter !FEATURE_SUID_CONFIG_QUIET message
+                        sed -i \
+                                -e "/^hush: using fallback suid method$/d" \
+                                "$name.xx"
                        # filter C library differences
                        sed -i \
                                -e "/: invalid option /s:'::g" \
diff --git a/shell/shell_common.c b/shell/shell_common.c
index 2702ef98a..657f0df8f 100644
--- a/shell/shell_common.c
+++ b/shell/shell_common.c
@@ -55,7 +55,7 @@ const char* FAST_FUNC
 shell_builtin_read(struct builtin_read_params *params)
 {
        struct pollfd pfd[1];
-#define fd (pfd[0].fd) /* -u FD */
+#define fd (pfd->fd) /* -u FD */
        unsigned err;
        unsigned end_ms; /* -t TIMEOUT */
        int nchars; /* -n NUM */
@@ -144,7 +144,7 @@ shell_builtin_read(struct builtin_read_params *params)
                 * bash seems to ignore -p PROMPT for this use case.
                 */
                int r;
-                pfd[0].events = POLLIN;
+                pfd->events = POLLIN;
                r = poll(pfd, 1, /*timeout:*/ 0);
                /* Return 0 only if poll returns 1 ("one fd ready"), else return 1: */
                return (const char *)(uintptr_t)(r <= 0);
@@ -209,13 +209,8 @@ shell_builtin_read(struct builtin_read_params *params)
                         * 32-bit unix time wrapped (year 2038+).
                         */
                        if (timeout <= 0) { /* already late? */
-#if ENABLE_PLATFORM_MINGW32
                                retval = (const char *)(uintptr_t)2;
                                break;
-#else
-                                retval = (const char *)(uintptr_t)1;
-                                goto ret;
-#endif
                        }
                }
@@ -224,8 +219,8 @@ shell_builtin_read(struct builtin_read_params *params)
                 * regardless of SA_RESTART-ness of that signal!
                 */
                errno = 0;
-                pfd[0].events = POLLIN;
+                pfd->events = POLLIN;
-//TODO race with a signal arriving just before the poll!
 #if ENABLE_PLATFORM_MINGW32
                /* Don't poll if timeout is -1, it hurts performance.  The
                 * caution above about interrupts isn't relevant on Windows
@@ -233,15 +228,14 @@ shell_builtin_read(struct builtin_read_params *params)
                 */
                if (timeout >= 0)
 #endif
-                if (poll(pfd, 1, timeout) <= 0) {
+                /* test bb_got_signal, then poll(), atomically wrt signals */
-                        /* timed out, or EINTR */
+                if (check_got_signal_and_poll(pfd, timeout) <= 0) {
+                        /* timed out, or some error */
                        err = errno;
-#if ENABLE_PLATFORM_MINGW32
+                        if (!err) { /* timed out */
-                        if (!err) {
                                retval = (const char *)(uintptr_t)2;
                                break;
                        }
-#endif
                        retval = (const char *)(uintptr_t)1;
                        goto ret;
                }