bug#502: 23.0.60; Occasional crash when viewing SVG files

[Markus Triska]

After viewing several SVG files and switching between image and text
representations, Emacs crashed with the following backtrace. I cannot
yet reproduce it reliably, but it is already the second time I see it.

GNU gdb 6.3.50-20050815 (Apple version gdb-573) (Fri Oct 20 15:50:43 GMT 2006)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-apple-darwin"...Reading symbols for shared 
libraries .................................... done

DISPLAY = :0.0
TERM = xterm-color
Breakpoint 1 at 0x9010d3db
Breakpoint 2 at 0xee786: file sysdep.c, line 1297.
(gdb) r
Starting program: /Users/mt/emacs/src/emacs 
Reading symbols for shared libraries 
....................................................................+++..+.++.+..++.+.++++++++++++.++++.....+++
 done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0253dfff
0x0016a3ad in char_quoted (charpos=1, bytepos=39051263) at syntax.c:301
301       DEC_BOTH (charpos, bytepos);
(gdb) bt
#0  0x0016a3ad in char_quoted (charpos=1, bytepos=39051263) at syntax.c:301
#1  0x001752ae in scan_lists (from=60, count=-1, depth=1, sexpflag=1) at 
syntax.c:2666
#2  0x00144ac4 in Ffuncall (nargs=3, args=0xbfffe2e4) at eval.c:3052
#3  0x0017dc57 in Fbyte_code (bytestr=67092811, vector=34997316, maxdepth=4) at 
bytecode.c:678
#4  0x00143f72 in Feval (form=40043877) at eval.c:2383
#5  0x0014655b in internal_lisp_condition_case (var=58721289, 
bodyform=40043877, handlers=40043757) at eval.c:1456
#6  0x0017cb8d in Fbyte_code (bytestr=67083099, vector=34997380, maxdepth=5) at 
bytecode.c:868
#7  0x001443a7 in funcall_lambda (fun=34997668, nargs=0, arg_vector=0xbfffe768) 
at eval.c:3229
#8  0x0014488a in Ffuncall (nargs=1, args=0xbfffe764) at eval.c:3099
#9  0x001460c7 in Fapply (nargs=2, args=0xbfffe764) at eval.c:2471
#10 0x00144a2f in Ffuncall (nargs=3, args=0xbfffe760) at eval.c:3023
#11 0x0017dc57 in Fbyte_code (bytestr=2391731, vector=2391756, maxdepth=4) at 
bytecode.c:678
#12 0x00143f72 in Feval (form=2391717) at eval.c:2383
#13 0x0014655b in internal_lisp_condition_case (var=58721289, bodyform=2391717, 
handlers=2391789) at eval.c:1456
#14 0x0017cb8d in Fbyte_code (bytestr=2391587, vector=2391604, maxdepth=5) at 
bytecode.c:868
#15 0x001443a7 in funcall_lambda (fun=2391548, nargs=1, arg_vector=0xbfffeb24) 
at eval.c:3229
#16 0x0014488a in Ffuncall (nargs=2, args=0xbfffeb20) at eval.c:3099
#17 0x00145c9f in call1 (fn=58751297, arg1=34997732) at eval.c:2827
#18 0x000d6ff4 in timer_check (do_it_now=1) at keyboard.c:4656
#19 0x000d71a3 in readable_events (flags=1) at keyboard.c:3646
#20 0x000ddcd7 in get_input_pending (addr=0x3220c0, flags=1) at keyboard.c:6950
#21 0x000dddf7 in detect_input_pending_run_timers (do_display=1) at 
keyboard.c:10620
#22 0x00187347 in wait_reading_process_output (time_limit=90, microsecs=0, 
read_kbd=-1, do_display=1, wait_for_cell=58721289, wait_proc=0x0, 
just_wait_proc=0) at process.c:4977
#23 0x0000c35a in sit_for (timeout=720, reading=1, do_display=1) at 
dispnew.c:6619
#24 0x000dfbcf in read_char (commandflag=1, nmaps=5, maps=0xbffff1c0, 
prev_event=58721289, used_mouse_menu=0xbffff2c8, end_time=0x0) at 
keyboard.c:2930
#25 0x000e16d2 in read_key_sequence (keybuf=0xbffff388, bufsize=30, 
prompt=58721289, dont_downcase_last=0, can_return_switch_frame=1, 
fix_current_buffer=1) at keyboard.c:9429
#26 0x000e3a9c in command_loop_1 () at keyboard.c:1651
#27 0x00142c1c in internal_condition_case (bfun=0xe387e <command_loop_1>, 
handlers=58760929, hfun=0xdc6d9 <cmd_error>) at eval.c:1511
#28 0x000d5830 in command_loop_2 () at keyboard.c:1367
#29 0x0014286e in internal_catch (tag=58757001, func=0xd57ec <command_loop_2>, 
arg=58721289) at eval.c:1247
#30 0x000d55d2 in command_loop () at keyboard.c:1346
#31 0x000d568b in recursive_edit_1 () at keyboard.c:955
#32 0x000d57d3 in Frecursive_edit () at keyboard.c:1017
#33 0x000d4813 in main (argc=1, argv=0xbffff7b8) at emacs.c:1762

Lisp Backtrace:
"scan-sexps" (0xbfffe2e8)
"byte-code" (0xbfffe3d4)
"show-paren-function" (0xbfffe768)
"apply" (0xbfffe764)
"byte-code" (0xbfffe854)
"timer-event-handler" (0xbfffeb24)
(gdb) bt full
#0  0x0016a3ad in char_quoted (charpos=1, bytepos=39051263) at syntax.c:301
        p = (unsigned char *) 0x253dfff <Address 0x253dfff out of bounds>
        beg = 1
        quoted = 0
#1  0x001752ae in scan_lists (from=60, count=-1, depth=1, sexpflag=1) at 
syntax.c:2666
        val = 39051264
        stop = 1
        c = 60
        c1 = 3307680
        stringterm = 34
        quoted = 0
        mathexit = 0
        code = Sclose
        temp_code = 39051264
        min_depth = 0
        comstyle = 0
        comnested = 0
        temp_pos = 60
        last_good = 38
        found = 39051264
        from_byte = 1
        out_bytepos = 1536514
        out_charpos = 87
        dummy = 87
        multibyte_symbol_p = 0
#2  0x00144ac4 in Ffuncall (nargs=3, args=0xbfffe2e4) at eval.c:3052
        fun = -1073749272
        original_fun = 3068784
        funcar = 39051263
        numargs = 2
        val = 49090256
        backtrace = {
  next = 0xbfffe3f4, 
  function = 0xbfffe2e4, 
  args = 0xbfffe2e8, 
  nargs = 2, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbfffe2e8
        i = 39051263
        args = (Lisp_Object *) 0x2ed370
#3  0x0017dc57 in Fbyte_code (bytestr=67092811, vector=34997316, maxdepth=4) at 
bytecode.c:678
        op = 39051264
        vectorp = (Lisp_Object *) 0x2160448
        stack = {
  pc = 0x591a186 "=\207", 
  top = 0xbfffe2ec, 
  bottom = 0xbfffe2e0, 
  byte_string = 67092811, 
  byte_string_start = 0x591a180 "`\302\b\t[\"=\207", 
  constants = 34997316, 
  next = 0xbfffe584
}
        result = 49090256
        bytestr = 39051263
#4  0x00143f72 in Feval (form=40043877) at eval.c:2383
        numargs = 39051263
        argvals = {67092811, 34997316, 32, 2387403, 37, 58721289, 1323343, 
339607552}
        args_left = 58721289
        i = 3
        fun = 49090256
        val = 49090256
        original_fun = 58832137
        original_args = 40043869
        funcar = 39051263
        backtrace = {
  next = 0xbfffe64c, 
  function = 0xbfffe40c, 
  args = 0xbfffe3d4, 
  nargs = 3, 
  evalargs = 1 '\001', 
  debug_on_exit = 0 '\0'
}
        form = 58721289
#5  0x0014655b in internal_lisp_condition_case (var=58721289, 
bodyform=40043877, handlers=40043757) at eval.c:1456
        val = 39051263
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbfffe8c8, 
  gcpro = 0x0, 
  jmp = {895, 49090256, 8096, 1336252, -1073748872, 1273953, 93429718, 
58721289, -1073748760, -1073748944, 458783, 662, 1336418, 1245207, 31, 31, 
3014656, 1245239}, 
  backlist = 0xbfffe64c, 
  handlerlist = 0xbfffe93c, 
  lisp_eval_depth = 4, 
  pdlcount = 15, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0xbfffe584
}
        h = {
  handler = 40043757, 
  var = 58721289, 
  chosen_clause = 93429702, 
  tag = 0xbfffe448, 
  next = 0xbfffe93c
}
#6  0x0017cb8d in Fbyte_code (bytestr=67083099, vector=34997380, maxdepth=5) at 
bytecode.c:868
        handlers = 39051264
        body = 39051263
        op = 39051264
        vectorp = (Lisp_Object *) 0x2160488
        stack = {
  pc = 0x5919fd6 "\204S", 
  top = 0xbfffe500, 
  bottom = 0xbfffe500, 
  byte_string = 67083099, 
  byte_string_start = 0x5919f88 "\b\203\265\001`\306\307`S!!\310=\203\024", 
  constants = 34997380, 
  next = 0xbfffe7d4
}
        result = 49090256
        bytestr = 39051263
#7  0x001443a7 in funcall_lambda (fun=34997668, nargs=0, arg_vector=0xbfffe768) 
at eval.c:3229
        val = 39051264
        syms_left = 34997664
        next = 34997664
        i = 0
        optional = -1073748392
        rest = 1254869
#8  0x0014488a in Ffuncall (nargs=1, args=0xbfffe764) at eval.c:3099
        fun = 34997668
        original_fun = 93610545
        funcar = 39051263
        numargs = 0
        val = 49090256
        backtrace = {
  next = 0xbfffe71c, 
  function = 0xbfffe764, 
  args = 0xbfffe768, 
  nargs = 0, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x21605a4
        i = 39051263
        args = (Lisp_Object *) 0x5946231
#9  0x001460c7 in Fapply (nargs=2, args=0xbfffe764) at eval.c:2471
        i = 2683843
        numargs = 39051264
        spread_arg = 58721289
        funcall_args = (Lisp_Object *) 0x0
        fun = 93610545
#10 0x00144a2f in Ffuncall (nargs=3, args=0xbfffe760) at eval.c:3023
        fun = 3063172
        original_fun = -1073748124
        funcar = 39051263
        numargs = 2
        val = 49090256
        backtrace = {
  next = 0xbfffe874, 
  function = 0xbfffe760, 
  args = 0xbfffe764, 
  nargs = 2, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x2ebd84
        i = 39051263
        args = (Lisp_Object *) 0xbfffe764
#11 0x0017dc57 in Fbyte_code (bytestr=2391731, vector=2391756, maxdepth=4) at 
bytecode.c:678
        op = 39051264
        vectorp = (Lisp_Object *) 0x247ed0
        stack = {
  pc = 0x28f126 "\207", 
  top = 0xbfffe768, 
  bottom = 0xbfffe760, 
  byte_string = 2391731, 
  byte_string_start = 0x28f11e "\301\b\302H\b\303H\"\207", 
  constants = 2391756, 
  next = 0xbfffea04
}
        result = 49090256
        bytestr = 39051263
#12 0x00143f72 in Feval (form=2391717) at eval.c:2383
        numargs = 39051263
        argvals = {2391731, 2391756, 32, 34752944, 31, 0, 1323343, 0}
        args_left = 58721289
        i = 3
        fun = 49090256
        val = 49090256
        original_fun = 58832137
        original_args = 2391725
        funcar = 39051263
        backtrace = {
  next = 0xbfffeacc, 
  function = 0xbfffe88c, 
  args = 0xbfffe854, 
  nargs = 3, 
  evalargs = 1 '\001', 
  debug_on_exit = 0 '\0'
}
        form = 58721289
#13 0x0014655b in internal_lisp_condition_case (var=58721289, bodyform=2391717, 
handlers=2391789) at eval.c:1456
        val = 39051263
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbffff438, 
  gcpro = 0x0, 
  jmp = {895, 0, 8096, 1336252, -1073747672, 1328852, 2683286, 58721289, 
-1073747608, -1073747792, 34734111, 658, 1336418, 1245207, -1877934049, 
-1073807329, 0, 1310775}, 
  backlist = 0xbfffeacc, 
  handlerlist = 0xbffff4ac, 
  lisp_eval_depth = 1, 
  pdlcount = 8, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0xbfffea04
}
        h = {
  handler = 2391789, 
  var = 58721289, 
  chosen_clause = -1073747580, 
  tag = 0xbfffe8c8, 
  next = 0xbffff4ac
}
#14 0x0017cb8d in Fbyte_code (bytestr=2391587, vector=2391604, maxdepth=5) at 
bytecode.c:868
        handlers = 39051264
        body = 39051263
        op = 39051264
        vectorp = (Lisp_Object *) 0x247e38
        stack = {
  pc = 0x28f196 "\210\016\026\205x", 
  top = 0xbfffe980, 
  bottom = 0xbfffe980, 
  byte_string = 2391587, 
  byte_string_start = 0x28f128 "\b\021\n\020\v\022\306\034\307\v!\203|", 
  constants = 2391604, 
  next = 0x0
}
        result = 49090256
        bytestr = 39051263
#15 0x001443a7 in funcall_lambda (fun=2391548, nargs=1, arg_vector=0xbfffeb24) 
at eval.c:3229
        val = 39051264
        syms_left = 2391544
        next = 2391544
        i = 1
        optional = 0
        rest = 0
#16 0x0014488a in Ffuncall (nargs=2, args=0xbfffeb20) at eval.c:3099
        fun = 2391548
        original_fun = 58751297
        funcar = 39051263
        numargs = 1
        val = 49090256
        backtrace = {
  next = 0x0, 
  function = 0xbfffeb20, 
  args = 0xbfffeb24, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x247dfc
        i = 39051263
        args = (Lisp_Object *) 0x3807941
#17 0x00145c9f in call1 (fn=58751297, arg1=34997732) at eval.c:2827
        ret_ungc_val = 39051264
#18 0x000d6ff4 in timer_check (do_it_now=1) at keyboard.c:4656
        old_deactivate_mark = 58721289
        vector = (Lisp_Object *) 0x21605e8
        timer = 49090256
        idle_timer = 3
        now = {
  tv_sec = 1214737498, 
  tv_usec = 44691
}
        timers = 58721289
        idle_timers = 40292237
        chosen_timer = 34997732
#19 0x000d71a3 in readable_events (flags=1) at keyboard.c:3646
        event = (struct input_event *) 0x253dfff
#20 0x000ddcd7 in get_input_pending (addr=0x3220c0, flags=1) at keyboard.c:6950
No locals.
#21 0x000dddf7 in detect_input_pending_run_timers (do_display=1) at 
keyboard.c:10620
        old_timers_run = 645
#22 0x00187347 in wait_reading_process_output (time_limit=90, microsecs=0, 
read_kbd=-1, do_display=1, wait_for_cell=58721289, wait_proc=0x0, 
just_wait_proc=0) at process.c:4977
        old_timers_run = 645
        old_buffer = (struct buffer *) 0x2ed0ed0
        old_window = 34896372
        leave = 1
        timeout_reduced_for_timers = 1
        channel = 31
        nfds = 0
        Available = {
  fds_bits = {0 <repeats 32 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = 0
        no_avail = 0
        xerrno = 65535
        proc = 1
        timeout = {
  tv_sec = 0, 
  tv_usec = 21768
}
        end_time = {
  tv_sec = 1214737587, 
  tv_usec = 924519
}
        wait_channel = -1
        got_some_input = 0
#23 0x0000c35a in sit_for (timeout=720, reading=1, do_display=1) at 
dispnew.c:6619
        sec = 90
        usec = 0
        do_display = 1
#24 0x000dfbcf in read_char (commandflag=1, nmaps=5, maps=0xbffff1c0, 
prev_event=58721289, used_mouse_menu=0xbffff2c8, end_time=0x0) at 
keyboard.c:2930
        tem0 = 30
        delay_level = 12
        buffer_size = 39051263
        c = 58721289
        count = 58721289
        jmpcount = 2
        local_getcjmp = {-1073806465, 1329290, 8096, 912217, -1073745608, 
1246001, 3289872, 3284528, -1073745560, -1073746032, 3276831, 662, 914156, 
1245207, 58982431, 58720287, 58720256, 55}
        save_jump = {0 <repeats 18 times>}
        key_already_recorded = 0
        tem = 39051264
        save = -1073745824
        previous_echo_area_message = 58721289
        also_record = 58721289
        reread = 0
        polling_stopped_here = 30
        orig_kboard = (struct kboard *) 0x2132f20
#25 0x000e16d2 in read_key_sequence (keybuf=0xbffff388, bufsize=30, 
prompt=58721289, dont_downcase_last=0, can_return_switch_frame=1, 
fix_current_buffer=1) at keyboard.c:9429
        interrupted_kboard = (KBOARD *) 0x2132f20
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 58721289
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 5
        nmaps_allocated = 5
        defs = (Lisp_Object * volatile) 0xbffff190
        submaps = (Lisp_Object * volatile) 0xbffff1c0
        orig_local_map = 40292269
        orig_keymap = 58721289
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 40036973, 
  map = 40036973, 
  start = 0, 
  end = 0
}
        keytran = {
  parent = 33947517, 
  map = 33947517, 
  start = 0, 
  end = 0
}
        indec = {
  parent = 40036981, 
  map = 40036981, 
  start = 0, 
  end = 0
}
        shift_translated = 0
        delayed_switch_frame = 58721289
        original_uppercase = -1073745128
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x2ed0ed0
        fake_prefixed_keys = 58721289
#26 0x000e3a9c in command_loop_1 () at keyboard.c:1651
        cmd = 3284528
        lose = 3284528
        nonundocount = 0
        keybuf = {192, 48, 56, 58721289, -1073744872, 903096, 38425293, 
-1073744946, -1073744904, -1879037169, 92274892, 152, -1073744946, 58721289, 
100663439, 1, 43, -1879036413, 51396120, 58721337, 51385976, -1881082098, 
5625428, 0, -1073744900, -1073745088, 0, 3342336, 58721289, 67060025}
        i = 2
        prev_modiff = 428
        prev_buffer = (struct buffer *) 0x67171e0
        already_adjusted = 0
#27 0x00142c1c in internal_condition_case (bfun=0xe387e <command_loop_1>, 
handlers=58760929, hfun=0xdc6d9 <cmd_error>) at eval.c:1511
        val = 39051263
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbffff53c, 
  gcpro = 0x0, 
  jmp = {895, 17831856, 8096, 1321771, 58721289, 58721289, 3297712, 3284528, 
-1073744680, -1073744864, 31, 658, 1321920, 1507351, 3276831, 3276831, 
-1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 58760929, 
  var = 58721289, 
  chosen_clause = 58721337, 
  tag = 0xbffff438, 
  next = 0x0
}
#28 0x000d5830 in command_loop_2 () at keyboard.c:1367
        val = 39051264
#29 0x0014286e in internal_catch (tag=58757001, func=0xd57ec <command_loop_2>, 
arg=58721289) at eval.c:1247
        c = {
  tag = 58757001, 
  val = 58721289, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {895, 18, 8096, 1320914, 0, 20367, 3306688, 3284528, -1073744456, 
-1073744608, 58851359, 658, 1321057, 58851351, 58851359, 58720287, 51380224, 
55}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        tag = 39051264
#30 0x000d55d2 in command_loop () at keyboard.c:1346
        val = 39051264
#31 0x000d568b in recursive_edit_1 () at keyboard.c:955
        val = 0
#32 0x000d57d3 in Frecursive_edit () at keyboard.c:1017
        buffer = 58721289
#33 0x000d4813 in main (argc=1, argv=0xbffff7b8) at emacs.c:1762
        dummy = -1881117246
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67108864
}
        no_loadup = 0
        junk = 0x0

Lisp Backtrace:
"scan-sexps" (0xbfffe2e8)
"byte-code" (0xbfffe3d4)
"show-paren-function" (0xbfffe768)
"apply" (0xbfffe764)
"byte-code" (0xbfffe854)
"timer-event-handler" (0xbfffeb24)


In GNU Emacs 23.0.60.1 (i386-apple-darwin8.11.1, GTK+ Version 2.12.9)
 of 2008-06-29 on mt-computer.local
Windowing system distributor `The XFree86 Project, Inc', version 11.0.40400000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default-enable-multibyte-characters: t