bug#16164: 24.3.50; Segmentation fault at malloc.c:4615

[Nicolas Richard]

Dmitry Antipov <dmantipov@yandex.ru> writes:
> Can you try a recipe from http://debbugs.gnu.org/cgi/bugreport.cgi?bug=16165?
> I'm suspecting a heap corruption and even have a test case.

It indeed crashes reliably, and I got a bt similar to the one i posted
(i.e. same place in the source -- this is all my ignorant eyes can see),
so I guess it is a duplicate ?

Program received signal SIGSEGV, Segmentation fault.
0x0809019e in display_line (it=0xbfff8df8) at xdisp.c:20044
20044               row->glyphs[TEXT_AREA]->charpos = CHARPOS (it->position);
(gdb) bt
#0  0x0809019e in display_line (it=0xbfff8df8) at xdisp.c:20044
#1  0x0809779f in try_window (window=144481317, pos=..., flags=1) at 
xdisp.c:16505
#2  0x080b10af in redisplay_window (window=144481317, just_this_one_p=false) at 
xdisp.c:16022
#3  0x080b6034 in redisplay_window_0 (window=144481317) at xdisp.c:14023
#4  0x081d484f in internal_condition_case_1 (bfun=0x80b6010 
<redisplay_window_0>, arg=144481317, handlers=139675806, hfun=0x806f200 
<redisplay_window_error>) at eval.c:1368
#5  0x08075822 in redisplay_windows (window=144481317) at xdisp.c:14003
#6  0x080757f1 in redisplay_windows (window=144481021) at xdisp.c:13997
#7  0x08098870 in redisplay_internal () at xdisp.c:13602
#8  0x08099aec in redisplay_preserve_echo_area (from_where=2) at xdisp.c:13856
#9  0x0805cf20 in Fredisplay (force=139695042) at dispnew.c:5829
#10 Fredisplay (force=139695042) at dispnew.c:5815
#11 0x081d5b57 in eval_sub (form=141962142) at eval.c:2175
#12 0x081d5f26 in Fprogn (body=<optimized out>) at eval.c:458
#13 0x081d990c in Flet (args=141945526) at eval.c:966
#14 0x081d5921 in eval_sub (form=141946006) at eval.c:2123
#15 0x081d5f26 in Fprogn (body=<optimized out>) at eval.c:458
#16 0x081d9220 in Fwhile (args=141946022) at eval.c:988
#17 0x081d5921 in eval_sub (form=141946038) at eval.c:2123
#18 0x081d5f26 in Fprogn (body=<optimized out>) at eval.c:458
#19 0x081d990c in Flet (args=141946054) at eval.c:966
#20 0x081d5921 in eval_sub (form=141946566) at eval.c:2123
#21 0x081d5f26 in Fprogn (body=<optimized out>) at eval.c:458
#22 0x081d6284 in funcall_lambda (fun=141961870, nargs=0, 
arg_vector=0xbfffe1f4) at eval.c:3032
#23 0x081d6527 in Ffuncall (nargs=1, args=0xbfffe1f0) at eval.c:2866
#24 0x081d6c8c in apply1 (fn=144432570, arg=139695042) at eval.c:2571
#25 0x081d1d77 in Fcall_interactively (function=144432570, 
record_flag=139695042, keys=139703885) at callint.c:378
#26 0x081d6868 in Ffuncall (nargs=4, args=0xbfffe31c) at eval.c:2812
#27 0x0821463f in exec_byte_code (bytestr=0, vector=66, maxdepth=52, 
args_template=4100, nargs=-1073749208, args=0x4) at bytecode.c:919
#28 0x081d6253 in funcall_lambda (fun=137698885, nargs=1, 
arg_vector=0xbfffe500) at eval.c:2973
#29 0x081d6527 in Ffuncall (nargs=2, args=0xbfffe4fc) at eval.c:2866
#30 0x0821463f in exec_byte_code (bytestr=0, vector=66, maxdepth=92, 
args_template=1028, nargs=-1073748736, args=0x2) at bytecode.c:919
#31 0x081d6253 in funcall_lambda (fun=137535085, nargs=1, 
arg_vector=0xbfffe6a8) at eval.c:2973
#32 0x081d6527 in Ffuncall (nargs=2, args=0xbfffe6a4) at eval.c:2866
#33 0x0821463f in exec_byte_code (bytestr=0, vector=66, maxdepth=68, 
args_template=0, nargs=-1073748312, args=0x2) at bytecode.c:919
#34 0x081d6253 in funcall_lambda (fun=137522285, nargs=0, 
arg_vector=0xbfffe87c) at eval.c:2973
#35 0x081d6527 in Ffuncall (nargs=1, args=0xbfffe878) at eval.c:2866
#36 0x0821463f in exec_byte_code (bytestr=0, vector=66, maxdepth=48, 
args_template=0, nargs=-1073747852, args=0x1) at bytecode.c:919
#37 0x081d6253 in funcall_lambda (fun=137520509, nargs=0, 
arg_vector=0xbfffe9e0) at eval.c:2973
#38 0x081d52fa in apply_lambda (fun=137520509, args=<optimized out>) at 
eval.c:2914
#39 0x081d555c in eval_sub (form=141365566) at eval.c:2250
#40 0x081d8424 in Feval (form=141365566, lexical=139695042) at eval.c:1993
#41 0x08155cd9 in top_level_2 () at keyboard.c:1179
#42 0x081d4748 in internal_condition_case (bfun=0x8155cc0 <top_level_2>, 
handlers=139728074, hfun=0x8158ce0 <cmd_error>) at eval.c:1344
#43 0x08157545 in top_level_1 (ignore=139695042) at keyboard.c:1187
#44 0x081d466b in internal_catch (tag=139726122, func=0x81574e0 <top_level_1>, 
arg=139695042) at eval.c:1108
#45 0x0815882c in command_loop () at keyboard.c:1148
#46 recursive_edit_1 () at keyboard.c:777
#47 0x08158b20 in Frecursive_edit () at keyboard.c:841
#48 0x08057992 in main (argc=<optimized out>, argv=0xbfffecd4) at emacs.c:1634

Lisp Backtrace:
"redisplay_internal (C function)" (0x8527670)
"redisplay" (0xbfffdd9c)
"let" (0xbfffdedc)
"while" (0xbfffdfac)
"let" (0xbfffe0cc)
"window-test" (0xbfffe1f4)
"call-interactively" (0xbfffe320)
"command-execute" (0xbfffe500)
"command-line-1" (0xbfffe6a8)
"command-line" (0xbfffe87c)
"normal-top-level" (0xbfffe9e0)
(gdb) 


--
Nico.