But this should be enough to reproduce it: \starttext \input "\string|echo -n bla" \stoptext

Breaks here too, using pdftex 1.40.0, context 2006.12.27, Ubuntu i386: *** glibc detected *** pdfetex: free(): invalid next size (fast): 0x082d42f0 *** Running texexec with --verbose says what the pdftex command that texexec runs is, and this is the minimal version of it: pdfetex -fmt=cont-en b.tex where b.tex is Peter's minimal (3-line) file above. Strangely, "pdftex -etex -ini c.tex", where c.tex is b.tex with "\input cont-en" as the first line, did not crash. I rebuilt pdf(e)tex make sure not to strip the binaries, and ran it with debugging libraries and valgrind, like so: LD_LIBRARY_PATH=/usr/lib/debug: valgrind pdfetex -fmt=cont-en b.tex and the output is included below. Here is the chunk from it, where the problem is first detected by valgrind: ==27710== Invalid write of size 1 ==27710== at 0x4022756: strcpy (mc_replace_strmem.c:271) ==27710== by 0x80A774D: open_in_or_pipe (pdftexextra.c:1354) ==27710== by 0x8078857: startinput (pdftex1.c:4870) ==27710== by 0x806C3A8: expand (pdftex0.c:11501) ==27710== by 0x80786CB: getxtoken (pdftex1.c:24) ==27710== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27710== by 0x8059B10: mainbody (pdftexini.c:5664) ==27710== by 0x80A90A6: main (pdftexextra.c:349) -Sanjoy `Not all those who wander are lost.' (J.R.R. Tolkien) ========================== valgrind run ================================== ==27710== Memcheck, a memory error detector. ==27710== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al. ==27710== Using LibVEX rev 1606, a library for dynamic binary translation. ==27710== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP. ==27710== Using valgrind-3.2.0-Debian, a dynamic binary instrumentation framework. ==27710== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al. ==27710== For more details, rerun with: -v ==27710== This is pdfTeX, Version 3.141592-1.40.0 (Web2C 7.5.6) \write18 enabled. entering extended mode (./b.tex ConTeXt ver: 2006.12.27 11:34 MK II fmt: 2007.1.4 int: english/english language : language en is active system : cont-new loaded (/usr/share/texmf/tex/context/base/cont-new.tex systems : beware: some patches loaded from cont-new.tex (/usr/share/texmf/tex/context/base/cont-new.mkii)) system : cont-old loaded (/usr/share/texmf/tex/context/base/cont-old.tex loading : Context Old Macros ) system : cont-fil loaded (/usr/share/texmf/tex/context/base/cont-fil.tex loading : Context File Synonyms ) system : cont-sys.rme loaded (/usr/share/texmf/tex/context/user/cont-sys.rme (/usr/share/texmf/tex/context/base/type-exa.tex) (/usr/share/texmf/tex/context/base/type-syn.tex) (/usr/share/texmf/tex/context/base/type-enc.tex) (/usr/share/texmf/tex/context/base/type-siz.tex) (/usr/share/texmf/tex/context/base/type-map.tex) (/usr/share/texmf/tex/context/base/type-spe.tex) (/usr/share/texmf/tex/context/base/type-akb.tex)) bodyfont : 12pt rm is loaded language : patterns en->ec:ec->1->2:3 uk->ec:ec->2->2:3 de->texnansi:tex nansi->3->2:3 de->ec:ec->4->2:3 fr->texnansi:texnansi->5->2:3 fr->ec:ec->6->2:3 es->ec:ec->7->2:3 pt->texnansi:texnansi->8->2:3 pt->ec:ec->9->2:3 it->texnansi :texnansi->10->2:3 it->ec:ec->11->2:3 nl->texnansi:texnansi->12->2:3 nl->ec:ec-

13->2:3 cz->il2:il2->14->2:3 cz->ec:ec->15->2:3 sk->il2:il2->16->2:3 sk->ec:ec ->17->2:3 pl->pl0:pl0->18->2:3 pl->ec:ec->19->2:3 pl->qx:qx->20->2:3 loaded specials : tex,postscript,rokicki loaded systems : no b.top systems : system commands are enabled (/usr/share/texmf/tex/context/base/sort-def.tex) (/usr/share/texmf/tex/context/base/sort-lan.tex)==27710== Invalid write of size 1 ==27710== at 0x4022756: strcpy (mc_replace_strmem.c:271) ==27710== by 0x80A774D: open_in_or_pipe (pdftexextra.c:1354) ==27710== by 0x8078857: startinput (pdftex1.c:4870) ==27710== by 0x806C3A8: expand (pdftex0.c:11501) ==27710== by 0x80786CB: getxtoken (pdftex1.c:24) ==27710== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27710== by 0x8059B10: mainbody (pdftexini.c:5664) ==27710== by 0x80A90A6: main (pdftexextra.c:349) ==27710== Address 0x567459C is 0 bytes after a block of size 12 alloc'd ==27710== at 0x4021396: malloc (vg_replace_malloc.c:149) ==27710== by 0x813748C: xmalloc (xmalloc.c:28) ==27710== by 0x80A7737: open_in_or_pipe (pdftexextra.c:1353) ==27710== by 0x8078857: startinput (pdftex1.c:4870) ==27710== by 0x806C3A8: expand (pdftex0.c:11501) ==27710== by 0x80786CB: getxtoken (pdftex1.c:24) ==27710== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27710== by 0x8059B10: mainbody (pdftexini.c:5664) ==27710== by 0x80A90A6: main (pdftexextra.c:349) ==27711== ==27711== Syscall param execve(argv[i]) points to unaddressable byte(s) ==27711== at 0x40D39AA: execve (execve.c:60) ==27711== by 0x409F869: popen@@GLIBC_2.1 (iopopen.c:231) ==27711== by 0x80A7760: open_in_or_pipe (pdftexextra.c:1360) ==27711== by 0x8078857: startinput (pdftex1.c:4870) ==27711== by 0x806C3A8: expand (pdftex0.c:11501) ==27711== by 0x80786CB: getxtoken (pdftex1.c:24) ==27711== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27711== by 0x8059B10: mainbody (pdftexini.c:5664) ==27711== by 0x80A90A6: main (pdftexextra.c:349) ==27711== Address 0x567459C is 0 bytes after a block of size 12 alloc'd ==27711== at 0x4021396: malloc (vg_replace_malloc.c:149) ==27711== by 0x813748C: xmalloc (xmalloc.c:28) ==27711== by 0x80A7737: open_in_or_pipe (pdftexextra.c:1353) ==27711== by 0x8078857: startinput (pdftex1.c:4870) ==27711== by 0x806C3A8: expand (pdftex0.c:11501) ==27711== by 0x80786CB: getxtoken (pdftex1.c:24) ==27711== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27711== by 0x8059B10: mainbody (pdftexini.c:5664) ==27711== by 0x80A90A6: main (pdftexextra.c:349)

systems : begin file b at line 1 () fonts : resetting map file list fonts : using map file: texnansi-public-lm fonts : using map file: original-base fonts : using map file: ec-public-lm fonts : using map file: ec-base fonts : using map file: lm-ec fonts : using map file: 8r-base fonts : using map file: t5-base fonts : using map file: original-ams-base fonts : using map file: original-ams-euler fonts : using map file: original-public-lm [1.1] systems : end file b at line 3 system : cont-err loaded (/usr/share/texmf/tex/context/base/cont-err.tex systems : no file 'cont-sys.tex', using 'cont-sys.rme' instead ) ) Output written on b.dvi (1 page, 380 bytes). Transcript written on b.log. ==27710== ==27710== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 13 from 1) ==27710== malloc/free: in use at exit: 18,557,273 bytes in 21,762 blocks. ==27710== malloc/free: 42,112 allocs, 20,350 frees, 19,883,984 bytes allocated. ==27710== For counts of detected errors, rerun with: -v ==27710== searching for pointers to 21,762 not-freed blocks. ==27710== checked 9,091,120 bytes. ==27710== ==27710== LEAK SUMMARY: ==27710== definitely lost: 21,505 bytes in 1,798 blocks. ==27710== possibly lost: 0 bytes in 0 blocks. ==27710== still reachable: 18,535,768 bytes in 19,964 blocks. ==27710== suppressed: 0 bytes in 0 blocks. ==27710== Use --leak-check=full to see details of leaked memory. ====================================================================== ========================== 2nd valgrind run ============================= [Here is the same run with "-v --leak-check=full" given to valgrind:] ==27935== Memcheck, a memory error detector. ==27935== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al. ==27935== Using LibVEX rev 1606, a library for dynamic binary translation. ==27935== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP. ==27935== Using valgrind-3.2.0-Debian, a dynamic binary instrumentation framework. ==27935== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al. ==27935== --27935-- Command line --27935-- pdfetex --27935-- -fmt=cont-en --27935-- b.tex --27935-- Startup, with flags: --27935-- --suppressions=/usr/lib/valgrind/debian-libc6-dbg.supp --27935-- -v --27935-- --leak-check=full --27935-- Contents of /proc/version: --27935-- Linux version 2.6.17-10-generic (root@terranova) (gcc version 4.1.2 20060928 (prerelease) (Ubuntu 4.1.1-13ubuntu5)) #2 SMP Tue Dec 5 22:28:26 UTC 2006 (Ubuntu 2.6.17-10.34-generic) --27935-- Arch and hwcaps: X86, x86-sse1-sse2 --27935-- Valgrind library directory: /usr/lib/valgrind --27935-- Reading syms from /lib/ld-2.4.so (0x4000000) --27935-- Reading debug info from /lib/ld-2.4.so... --27935-- ... CRC mismatch (computed 240DF4C3 wanted 96BFBE8D) --27935-- Reading debug info from /usr/lib/debug/lib/ld-2.4.so... --27935-- Reading syms from /usr/local/bin/pdfetex (0x8048000) --27935-- Reading syms from /usr/lib/valgrind/x86-linux/memcheck (0x38000000) --27935-- object doesn't have a dynamic symbol table --27935-- Reading suppressions file: /usr/lib/valgrind/debian-libc6-dbg.supp --27935-- Reading suppressions file: /usr/lib/valgrind/default.supp --27935-- REDIR: 0x4013F80 (index) redirected to 0x3802778B (vgPlain_x86_linux_REDIR_FOR_index) --27935-- Reading syms from /usr/lib/valgrind/x86-linux/vgpreload_core.so (0x401D000) --27935-- Reading syms from /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so (0x401F000) ==27935== WARNING: new redirection conflicts with existing -- ignoring it --27935-- new: 0x04013F80 (index ) R-> 0x04022080 index --27935-- REDIR: 0x4014150 (strlen) redirected to 0x4022130 (strlen) --27935-- Reading syms from /usr/lib/debug/libm-2.4.so (0x4024000) --27935-- Reading syms from /usr/lib/debug/libc-2.4.so (0x4049000) --27935-- REDIR: 0x40B2A20 (rindex) redirected to 0x4021F60 (rindex) --27935-- REDIR: 0x40B2670 (strlen) redirected to 0x4022110 (strlen) --27935-- REDIR: 0x40B2870 (strncmp) redirected to 0x4022170 (strncmp) --27935-- REDIR: 0x40AF910 (malloc) redirected to 0x4021311 (malloc) --27935-- REDIR: 0x40B2970 (strncpy) redirected to 0x40225E0 (strncpy) --27935-- REDIR: 0x40B2140 (strcpy) redirected to 0x4022720 (strcpy) --27935-- REDIR: 0x40B1D80 (strcat) redirected to 0x4022800 (strcat) --27935-- REDIR: 0x40AD680 (free) redirected to 0x4020F2B (free) --27935-- REDIR: 0x40B1F30 (index) redirected to 0x4022050 (index) --27935-- REDIR: 0x40B2720 (strnlen) redirected to 0x40220E0 (strnlen) --27935-- REDIR: 0x40B3B40 (memcpy) redirected to 0x4022BB0 (memcpy) --27935-- REDIR: 0x40AFD40 (realloc) redirected to 0x40213C0 (realloc) --27935-- REDIR: 0x40B20A0 (strcmp) redirected to 0x40221E0 (strcmp) --27935-- REDIR: 0x40B3640 (memset) redirected to 0x4022420 (memset) This is pdfTeX, Version 3.141592-1.40.0 (Web2C 7.5.6) \write18 enabled. entering extended mode (./b.tex--27935-- REDIR: 0x40B35A0 (memmove) redirected to 0x4022450 (memmove) ConTeXt ver: 2006.12.27 11:34 MK II fmt: 2007.1.4 int: english/english language : language en is active system : cont-new loaded (/usr/share/texmf/tex/context/base/cont-new.tex systems : beware: some patches loaded from cont-new.tex (/usr/share/texmf/tex/context/base/cont-new.mkii)) system : cont-old loaded (/usr/share/texmf/tex/context/base/cont-old.tex loading : Context Old Macros ) system : cont-fil loaded (/usr/share/texmf/tex/context/base/cont-fil.tex loading : Context File Synonyms ) system : cont-sys.rme loaded (/usr/share/texmf/tex/context/user/cont-sys.rme (/usr/share/texmf/tex/context/base/type-exa.tex) (/usr/share/texmf/tex/context/base/type-syn.tex) (/usr/share/texmf/tex/context/base/type-enc.tex) (/usr/share/texmf/tex/context/base/type-siz.tex) (/usr/share/texmf/tex/context/base/type-map.tex) (/usr/share/texmf/tex/context/base/type-spe.tex) (/usr/share/texmf/tex/context/base/type-akb.tex)) bodyfont : 12pt rm is loaded language : patterns en->ec:ec->1->2:3 uk->ec:ec->2->2:3 de->texnansi:tex nansi->3->2:3 de->ec:ec->4->2:3 fr->texnansi:texnansi->5->2:3 fr->ec:ec->6->2:3 es->ec:ec->7->2:3 pt->texnansi:texnansi->8->2:3 pt->ec:ec->9->2:3 it->texnansi :texnansi->10->2:3 it->ec:ec->11->2:3 nl->texnansi:texnansi->12->2:3 nl->ec:ec-

13->2:3 cz->il2:il2->14->2:3 cz->ec:ec->15->2:3 sk->il2:il2->16->2:3 sk->ec:ec ->17->2:3 pl->pl0:pl0->18->2:3 pl->ec:ec->19->2:3 pl->qx:qx->20->2:3 loaded specials : tex,postscript,rokicki loaded systems : no b.top systems : system commands are enabled (/usr/share/texmf/tex/context/base/sort-def.tex) (/usr/share/texmf/tex/context/base/sort-lan.tex)==27935== Invalid write of size 1 ==27935== at 0x4022756: strcpy (mc_replace_strmem.c:271) ==27935== by 0x80A774D: open_in_or_pipe (pdftexextra.c:1354) ==27935== by 0x8078857: startinput (pdftex1.c:4870) ==27935== by 0x806C3A8: expand (pdftex0.c:11501) ==27935== by 0x80786CB: getxtoken (pdftex1.c:24) ==27935== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27935== by 0x8059B10: mainbody (pdftexini.c:5664) ==27935== by 0x80A90A6: main (pdftexextra.c:349) ==27935== Address 0x567459C is 0 bytes after a block of size 12 alloc'd ==27935== at 0x4021396: malloc (vg_replace_malloc.c:149) ==27935== by 0x813748C: xmalloc (xmalloc.c:28) ==27935== by 0x80A7737: open_in_or_pipe (pdftexextra.c:1353) ==27935== by 0x8078857: startinput (pdftex1.c:4870) ==27935== by 0x806C3A8: expand (pdftex0.c:11501) ==27935== by 0x80786CB: getxtoken (pdftex1.c:24) ==27935== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27935== by 0x8059B10: mainbody (pdftexini.c:5664) ==27935== by 0x80A90A6: main (pdftexextra.c:349) ==27936== ==27936== Syscall param execve(argv[i]) points to unaddressable byte(s) ==27936== at 0x40D39AA: execve (execve.c:60) ==27936== by 0x409F869: popen@@GLIBC_2.1 (iopopen.c:231) ==27936== by 0x80A7760: open_in_or_pipe (pdftexextra.c:1360) ==27936== by 0x8078857: startinput (pdftex1.c:4870) ==27936== by 0x806C3A8: expand (pdftex0.c:11501) ==27936== by 0x80786CB: getxtoken (pdftex1.c:24) ==27936== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27936== by 0x8059B10: mainbody (pdftexini.c:5664) ==27936== by 0x80A90A6: main (pdftexextra.c:349) ==27936== Address 0x567459C is 0 bytes after a block of size 12 alloc'd ==27936== at 0x4021396: malloc (vg_replace_malloc.c:149) ==27936== by 0x813748C: xmalloc (xmalloc.c:28) ==27936== by 0x80A7737: open_in_or_pipe (pdftexextra.c:1353) ==27936== by 0x8078857: startinput (pdftex1.c:4870) ==27936== by 0x806C3A8: expand (pdftex0.c:11501) ==27936== by 0x80786CB: getxtoken (pdftex1.c:24) ==27936== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27936== by 0x8059B10: mainbody (pdftexini.c:5664) ==27936== by 0x80A90A6: main (pdftexextra.c:349)

systems : begin file b at line 1 () fonts : resetting map file list fonts : using map file: texnansi-public-lm fonts : using map file: original-base fonts : using map file: ec-public-lm fonts : using map file: ec-base fonts : using map file: lm-ec fonts : using map file: 8r-base fonts : using map file: t5-base fonts : using map file: original-ams-base fonts : using map file: original-ams-euler fonts : using map file: original-public-lm [1.1] systems : end file b at line 3 system : cont-err loaded (/usr/share/texmf/tex/context/base/cont-err.tex systems : no file 'cont-sys.tex', using 'cont-sys.rme' instead ) ) Output written on b.dvi (1 page, 380 bytes). Transcript written on b.log. ==27935== ==27935== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 13 from 1) ==27935== ==27935== 1 errors in context 1 of 1: ==27935== Invalid write of size 1 ==27935== at 0x4022756: strcpy (mc_replace_strmem.c:271) ==27935== by 0x80A774D: open_in_or_pipe (pdftexextra.c:1354) ==27935== by 0x8078857: startinput (pdftex1.c:4870) ==27935== by 0x806C3A8: expand (pdftex0.c:11501) ==27935== by 0x80786CB: getxtoken (pdftex1.c:24) ==27935== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27935== by 0x8059B10: mainbody (pdftexini.c:5664) ==27935== by 0x80A90A6: main (pdftexextra.c:349) ==27935== Address 0x567459C is 0 bytes after a block of size 12 alloc'd ==27935== at 0x4021396: malloc (vg_replace_malloc.c:149) ==27935== by 0x813748C: xmalloc (xmalloc.c:28) ==27935== by 0x80A7737: open_in_or_pipe (pdftexextra.c:1353) ==27935== by 0x8078857: startinput (pdftex1.c:4870) ==27935== by 0x806C3A8: expand (pdftex0.c:11501) ==27935== by 0x80786CB: getxtoken (pdftex1.c:24) ==27935== by 0x80A4B88: maincontrol (pdftex3.c:5246) ==27935== by 0x8059B10: mainbody (pdftexini.c:5664) ==27935== by 0x80A90A6: main (pdftexextra.c:349) --27935-- --27935-- supp: 13 Fedora-Core-5-hack3-ld24 ==27935== ==27935== IN SUMMARY: 1 errors from 1 contexts (suppressed: 13 from 1) ==27935== ==27935== malloc/free: in use at exit: 18,557,273 bytes in 21,762 blocks. ==27935== malloc/free: 42,112 allocs, 20,350 frees, 19,883,984 bytes allocated. ==27935== ==27935== searching for pointers to 21,762 not-freed blocks. ==27935== checked 9,091,104 bytes. ==27935== ==27935== ==27935== 158 (44 direct, 114 indirect) bytes in 5 blocks are definitely lost in loss record 1 of 5 ==27935== at 0x4021492: realloc (vg_replace_malloc.c:306) ==27935== by 0x81376EC: xrealloc (xrealloc.c:33) ==27935== by 0x81356A2: str_list_add (str-list.c:46) ==27935== by 0x8133549: hash_lookup (hash.c:186) ==27935== by 0x8137FCB: dir_links (dir.c:86) ==27935== by 0x813795A: do_subdir (elt-dirs.c:253) ==27935== by 0x8137A05: do_subdir (elt-dirs.c:295) ==27935== by 0x813788D: expand_elt (elt-dirs.c:334) ==27935== by 0x8137B14: kpse_element_dirs (elt-dirs.c:418) ==27935== by 0x813407B: search_list (pathsearch.c:493) ==27935== by 0x813441B: kpse_path_search_list (pathsearch.c:561) ==27935== by 0x81305D5: kpse_find_file (tex-file.c:841) ==27935== ==27935== ==27935== 21,347 (19,787 direct, 1,560 indirect) bytes in 1,600 blocks are definitely lost in loss record 4 of 5 ==27935== at 0x4021396: malloc (vg_replace_malloc.c:149) ==27935== by 0x813748C: xmalloc (xmalloc.c:28) ==27935== by 0x81313D2: concat3 (concat3.c:28) ==27935== by 0x8134C5D: kpse_set_program_name (progname.c:389) ==27935== by 0x80A837F: maininit (pdftexextra.c:201) ==27935== by 0x80A90A1: main (pdftexextra.c:346) ==27935== ==27935== LEAK SUMMARY: ==27935== definitely lost: 19,831 bytes in 1,605 blocks. ==27935== indirectly lost: 1,674 bytes in 193 blocks. ==27935== possibly lost: 0 bytes in 0 blocks. ==27935== still reachable: 18,535,768 bytes in 19,964 blocks. ==27935== suppressed: 0 bytes in 0 blocks. ==27935== Reachable blocks (those to which a pointer was found) are not shown. ==27935== To see them, rerun with: --show-reachable=yes --27935-- memcheck: sanity checks: 454 cheap, 19 expensive --27935-- memcheck: auxmaps: 0 auxmap entries (0k, 0M) in use --27935-- memcheck: auxmaps: 0 searches, 0 comparisons --27935-- memcheck: SMs: n_issued = 204 (3264k, 3M) --27935-- memcheck: SMs: n_deissued = 6 (96k, 0M) --27935-- memcheck: SMs: max_noaccess = 65535 (1048560k, 1023M) --27935-- memcheck: SMs: max_undefined = 204 (3264k, 3M) --27935-- memcheck: SMs: max_defined = 117 (1872k, 1M) --27935-- memcheck: SMs: max_non_DSM = 198 (3168k, 3M) --27935-- memcheck: max sec V bit nodes: 0 (0k, 0M) --27935-- memcheck: set_sec_vbits8 calls: 0 (new: 0, updates: 0) --27935-- memcheck: max shadow mem size: 3472k, 3M --27935-- translate: fast SP updates identified: 10,377 ( 87.4%) --27935-- translate: generic_known SP updates identified: 1,185 ( 9.9%) --27935-- translate: generic_unknown SP updates identified: 304 ( 2.5%) --27935-- tt/tc: 154,926 tt lookups requiring 156,703 probes --27935-- tt/tc: 154,926 fast-cache updates, 3 flushes --27935-- transtab: new 7,949 (207,505 -> 2,958,636; ratio 142:10) [0 scs] --27935-- transtab: dumped 0 (0 -> ??) --27935-- transtab: discarded 8 (193 -> ??) --27935-- scheduler: 45,449,867 jumps (bb entries). --27935-- scheduler: 454/209,039 major/minor sched events. --27935-- sanity: 455 cheap, 19 expensive checks. --27935-- exectx: 30,011 lists, 1,585 contexts (avg 0 per list) --27935-- exectx: 62,476 searches, 60,931 full compares (975 per 1000) --27935-- exectx: 43,135 cmp2, 30 cmp4, 0 cmpAll ======================================================================