bug#7740: Crash calling substring on a menu string in post-command-hook (w32)

[Lennart Borgman]

A new crash, related to menu handling. It occurs in post-command-hook
while grabbing a substring from a string returned by tmm (or a
slightly modified version of it).

I notice that so far most of the crashes I have seen earlier has been
related to the system. I wonder if this one is it too in some way.
(Could the menu strings have been changed in some ways by the system
calls?)

I can't find much information. Below is the backtrace and the few
variable I know how to get. (The library menuacc is in the repository
for nXhtml. I see no reason to copy part of the code here.)

My patched version:

GNU Emacs 24.0.50.1 (i386-mingw-nt5.1.2600) from trunk 2010-10-19 on
LENNART-69DE564 (patched)


(gdb) p i
$1 = (INTERVAL) 0x55bb290
(gdb) p old_diff
$2 = 48345856
(gdb) p new_diff
$3 = 67373824
(gdb)


Program received signal SIGSEGV, Segmentation fault.
0x011ddddd in balance_an_interval (i=0x55bb290) at intervals.c:410
410           old_diff = LEFT_TOTAL_LENGTH (i) - RIGHT_TOTAL_LENGTH (i);
(gdb) bt
#0  0x011ddddd in balance_an_interval (i=0x55bb290) at intervals.c:410
#1  0x011de39a in balance_possible_root_interval (interval=0x55bb290)
    at intervals.c:454
#2  0x011de5b7 in find_interval (tree=0x55bb290, position=0)
    at intervals.c:639
#3  0x01193b4f in validate_interval_range (object=68189697, begin=0x82c9c0,
    end=0x82c9c4, force=0) at textprop.c:183
#4  0x01197687 in copy_text_properties (start=0, end=12, src=68189697, pos=0,
    dest=63578305, prop=45488154) at textprop.c:1830
#5  0x010459af in Fsubstring (string=68189697, from=0, to=12) at fns.c:1189
#6  0x0102058e in Feval (form=48161934) at eval.c:2358
#7  0x010204b1 in Feval (form=48161918) at eval.c:2337
#8  0x0101d20b in Fand (args=48161974) at eval.c:319
#9  0x01020299 in Feval (form=48161862) at eval.c:2297
#10 0x0101d247 in Fif (args=63290438) at eval.c:341
#11 0x01020299 in Feval (form=63290430) at eval.c:2297
#12 0x0102081b in Feval (form=48161854) at eval.c:2410
#13 0x0101d33d in Fprogn (args=48162078) at eval.c:395
#14 0x01020299 in Feval (form=48161846) at eval.c:2297
#15 0x0101d26a in Fif (args=48161838) at eval.c:345
#16 0x01020299 in Feval (form=48161814) at eval.c:2297
#17 0x0101d33d in Fprogn (args=62617958) at eval.c:395
#18 0x01020299 in Feval (form=63290790) at eval.c:2297
#19 0x0101d26a in Fif (args=63290774) at eval.c:345
#20 0x01020299 in Feval (form=63290766) at eval.c:2297
#21 0x0102081b in Feval (form=48163518) at eval.c:2410
#22 0x0101d33d in Fprogn (args=48161150) at eval.c:395
#23 0x0101e526 in Flet (args=48163510) at eval.c:1052
#24 0x01020299 in Feval (form=48163390) at eval.c:2297
#25 0x0101d33d in Fprogn (args=63527430) at eval.c:395
#26 0x01021d38 in funcall_lambda (fun=63527382, nargs=1, arg_vector=0x82d93c)
    at eval.c:3167
#27 0x01021863 in Ffuncall (nargs=2, args=0x82d938) at eval.c:3047
#28 0x010210c9 in call1 (fn=63527382, arg1=46608126) at eval.c:2789
#29 0x01048a07 in mapcar1 (leni=13, vals=0x0, fn=63527382, seq=63715758)
    at fns.c:2356
#30 0x01048dad in Fmapc (function=63527382, sequence=63715758) at fns.c:2445
#31 0x0102055e in Feval (form=48163326) at eval.c:2355
#32 0x0101d33d in Fprogn (args=63528414) at eval.c:395
#33 0x0101e600 in Fwhile (args=63528398) at eval.c:1074
#34 0x01020299 in Feval (form=63528094) at eval.c:2297
#35 0x0101d33d in Fprogn (args=63528086) at eval.c:395
#36 0x0101e526 in Flet (args=63527902) at eval.c:1052
#37 0x01020299 in Feval (form=63527734) at eval.c:2297
#38 0x0101d33d in Fprogn (args=63527526) at eval.c:395
#39 0x0101e89e in internal_catch (tag=56118802, func=0x101d314 <Fprogn>,
    arg=63527526) at eval.c:1204
#40 0x0101e809 in Fcatch (args=63527478) at eval.c:1175
#41 0x01020299 in Feval (form=63527470) at eval.c:2297
#42 0x010204b1 in Feval (form=63527438) at eval.c:2337
#43 0x0102081b in Feval (form=63527534) at eval.c:2410
#44 0x0102081b in Feval (form=48163262) at eval.c:2410
#45 0x0101d33d in Fprogn (args=63836654) at eval.c:395
#46 0x0101e600 in Fwhile (args=63835942) at eval.c:1074
#47 0x01020299 in Feval (form=63835918) at eval.c:2297
#48 0x0101d33d in Fprogn (args=63835630) at eval.c:395
#49 0x0101e526 in Flet (args=63835622) at eval.c:1052
#50 0x01020299 in Feval (form=63729254) at eval.c:2297
#51 0x0101d33d in Fprogn (args=62617102) at eval.c:395
#52 0x0101e89e in internal_catch (tag=56118802, func=0x101d314 <Fprogn>,
    arg=62617102) at eval.c:1204
#53 0x0101e809 in Fcatch (args=63462958) at eval.c:1175
#54 0x01020299 in Feval (form=63462934) at eval.c:2297
#55 0x010204b1 in Feval (form=63462486) at eval.c:2337
#56 0x0102081b in Feval (form=63729030) at eval.c:2410
#57 0x0102081b in Feval (form=48163190) at eval.c:2410
#58 0x0101d33d in Fprogn (args=48161198) at eval.c:395
#59 0x0101e526 in Flet (args=48163126) at eval.c:1052
#60 0x01020299 in Feval (form=48162942) at eval.c:2297
#61 0x0101d33d in Fprogn (args=48161206) at eval.c:395
#62 0x01020299 in Feval (form=48162934) at eval.c:2297
#63 0x0101d33d in Fprogn (args=48161214) at eval.c:395
#64 0x01021d38 in funcall_lambda (fun=48161222, nargs=1, arg_vector=0x82f0c0)
    at eval.c:3167
#65 0x01021a4e in apply_lambda (fun=48161222, args=48161286, eval_flag=1)
    at eval.c:3100
#66 0x01020845 in Feval (form=48161278) at eval.c:2412
#67 0x0101d33d in Fprogn (args=48161294) at eval.c:395
#68 0x01021d38 in funcall_lambda (fun=48161534, nargs=1, arg_vector=0x82f300)
    at eval.c:3167
#69 0x01021a4e in apply_lambda (fun=48161534, args=48159886, eval_flag=1)
    at eval.c:3100
#70 0x01020845 in Feval (form=48159878) at eval.c:2412
#71 0x0101d33d in Fprogn (args=48159894) at eval.c:395
#72 0x0101e526 in Flet (args=48159806) at eval.c:1052
#73 0x01020299 in Feval (form=48161758) at eval.c:2297
#74 0x0101eca3 in internal_lisp_condition_case (var=45733034,
    bodyform=48161758, handlers=48159966) at eval.c:1407
#75 0x0101eac5 in Fcondition_case (args=48161750) at eval.c:1349
#76 0x01020299 in Feval (form=48161742) at eval.c:2297
#77 0x0101d33d in Fprogn (args=48159974) at eval.c:395
#78 0x01021d38 in funcall_lambda (fun=48159982, nargs=0, arg_vector=0x82fa38)
    at eval.c:3167
#79 0x01021863 in Ffuncall (nargs=1, args=0x82fa34) at eval.c:3047
#80 0x01020f02 in run_hook_with_args (nargs=1, args=0x82fa34,
    cond=to_completion) at eval.c:2679
#81 0x01020c95 in Frun_hooks (nargs=1, args=0x82faec) at eval.c:2542
#82 0x010214c1 in Ffuncall (nargs=2, args=0x82fae8) at eval.c:2971
#83 0x010210c9 in call1 (fn=45644402, arg1=45533738) at eval.c:2789
#84 0x01005b86 in safe_run_hooks_1 () at keyboard.c:2020
#85 0x0101edad in internal_condition_case (bfun=0x1005b53 <safe_run_hooks_1>,
    handlers=45488178, hfun=0x1005b8e <safe_run_hooks_error>) at eval.c:1460
#86 0x01005c26 in safe_run_hooks (hook=45533738) at keyboard.c:2046
#87 0x01004f02 in command_loop_1 () at keyboard.c:1743
#88 0x0101edad in internal_condition_case (bfun=0x10047e9 <command_loop_1>,
    handlers=45541738, hfun=0x10041de <cmd_error>) at eval.c:1460
#89 0x0100454e in command_loop_2 (ignore=45488154) at keyboard.c:1327
#90 0x0101e89e in internal_catch (tag=45539858,
    func=0x100452b <command_loop_2>, arg=45488154) at eval.c:1204
#91 0x01004506 in command_loop () at keyboard.c:1306
#92 0x01003dfa in recursive_edit_1 () at keyboard.c:929
#93 0x01003f5e in Frecursive_edit () at keyboard.c:991
#94 0x0100266f in main (argc=1, argv=0xa941b0) at emacs.c:1721

Lisp Backtrace:
"substring" (0x82ca60)
"string=" (0x82cc00)
"and" (0x82cd50)
"if" (0x82cea0)
"when" (0x82cfb0)
"progn" (0x82d100)
"if" (0x82d250)
"progn" (0x82d3a0)
"if" (0x82d4f0)
"when" (0x82d600)
"let" (0x82d7f0)
0x3c959d6 Lisp type 6
"mapc" (0x82da70)
"while" (0x82dcb0)
"let" (0x82dea0)
"catch" (0x82e0b0)
"cl-block-wrapper" (0x82e1c0)
"block" (0x82e2d0)
"dolist" (0x82e3e0)
"while" (0x82e590)
"let" (0x82e780)
"catch" (0x82e990)
"cl-block-wrapper" (0x82eaa0)
"block" (0x82ebb0)
"dolist" (0x82ecc0)
"let" (0x82eec0)
"progn" (0x82f010)
"menuacc-add-accel-1" (0x82f0c0)
"menuacc-add-accel" (0x82f300)
"let" (0x82f680)
"condition-case" (0x82f880)
"menuacc-add-accel-from-post-command-hook" (0x82fa38)
"run-hooks" (0x82faec)
(gdb)