[Bug-gnubg] SIGSEGV

[Paul Selick]

Hi,
  I am getting some XEvent related SIGSEGV from  gnubg-0.13.0.
(I'm running  Redhat Linux).
It's not easy to trace exactly because it appears to be related to windows
gaining and losing FOCUS.
I was running  eval  on 2 moves in the Annotation window, and had raised a
couple of other windows while this was going on.  (One was the main
gnubg game window and the other was outside the gnubg-application.)
I have reproduced it many times, but not systematically.
Using   gdb  I have obtained the following information:

The crash itself always occurs at positionid.c:209 when it tries to use
an "out-of-bounds" value of  pauch   .
This is in  PositionFromKey()  which is called from  ScoreMove()  which
is called from gtkchequer.c:362  in EvalMoves().
In the  for( ; ; )  loop on gtkchequer.c:360, I find that
pwMoves->selection  has become 0, resulting in invalid values of  pl->data
at line 362.
Using a  watchpoint  in gdb, I managed to get a  backtrace at the moment
pwMoves->selection  was changed to 0.  It looks like:

#0  0x40071afd in real_unselect_row () at eval.c:41
#1  0x400c8dc0 in gtk_marshal_NONE__INT_INT_POINTER () at eval.c:41
#2  0x400fb5f1 in gtk_signal_real_emit () at eval.c:41
#3  0x400f9525 in gtk_signal_emit () at eval.c:41
#4  0x40071ef8 in real_unselect_all () at eval.c:41
#5  0x400711ec in gtk_clist_unselect_all () at eval.c:41
#6  0x080e0139 in HintClearSelection (pw=0x867a900, pes=0x8621a7c,
    phd=0x86da758) at gtkchequer.c:698
#7  0x400c8aec in gtk_marshal_BOOL__POINTER () at eval.c:41
#8  0x400fc436 in gtk_handlers_run () at eval.c:41
#9  0x400fb76d in gtk_signal_real_emit () at eval.c:41
#10 0x400f9525 in gtk_signal_emit () at eval.c:41
#11 0x40133b89 in gtk_widget_event () at eval.c:41
#12 0x400c7b14 in gtk_main_do_event () at eval.c:41
#13 0x40178d7f in gdk_event_dispatch () at eval.c:41
#14 0x401ab773 in g_main_dispatch () at eval.c:41
#15 0x401abd39 in g_main_iterate () at eval.c:41
#16 0x401abe1e in g_main_iteration () at eval.c:41
#17 0x400c7594 in gtk_main_iteration () at eval.c:41
#18 0x080b8da9 in HandleXAction () at gtkgame.c:587
#19 0x08067391 in EvaluatePositionFull (anBoard=0xbfffd300,
    arOutput=0xbfffd2e0, pci=0xbfffd2a0, pec=0x81443c4, nPlies=3,
    pc=CLASS_CONTACT) at eval.c:2328
#20 0x0806771c in EvaluatePositionCache (anBoard=0xbfffd300,
    arOutput=0xbfffd2e0, pci=0xbfffd2a0, pecx=0x81443c4, nPlies=3,
    pc=CLASS_CONTACT) at eval.c:2460
#21 0x0806b9d6 in GeneralEvaluationEPlied (arOutput=0xbfffd2e0,
    anBoard=0xbfffd300, pci=0xbfffd2a0, pec=0x81443c4, nPlies=3) at
eval.c:5539
#22 0x0806834a in ScoreMove (pm=0x86d06a8, pci=0xbfffd400, pec=0x81443c4,
    nPlies=3) at eval.c:3038
#23 0x080df474 in EvalMoves (phd=0x86da758, pec=0x81443c4) at
gtkchequer.c:362
#24 0x400c8de1 in gtk_marshal_NONE__NONE () at eval.c:41
#25 0x400fc436 in gtk_handlers_run () at eval.c:41
#26 0x400fb76d in gtk_signal_real_emit () at eval.c:41
#27 0x400f9525 in gtk_signal_emit () at eval.c:41
#28 0x40060e2d in gtk_button_clicked () at eval.c:41
#29 0x400625ed in gtk_real_button_released () at eval.c:41
#30 0x400c8de1 in gtk_marshal_NONE__NONE () at eval.c:41
#31 0x400fb5f1 in gtk_signal_real_emit () at eval.c:41
#32 0x400f9525 in gtk_signal_emit () at eval.c:41
#33 0x40060d5d in gtk_button_released () at eval.c:41
#34 0x40061ed7 in gtk_button_button_release () at eval.c:41
#35 0x400c8aec in gtk_marshal_BOOL__POINTER () at eval.c:41
#36 0x400fb7ad in gtk_signal_real_emit () at eval.c:41
#37 0x400f9525 in gtk_signal_emit () at eval.c:41
#38 0x40133b89 in gtk_widget_event () at eval.c:41
#39 0x400c8a45 in gtk_propagate_event () at eval.c:41
#40 0x400c7a6f in gtk_main_do_event () at eval.c:41
#41 0x40178d7f in gdk_event_dispatch () at eval.c:41
#42 0x401ab773 in g_main_dispatch () at eval.c:41
#43 0x401abd39 in g_main_iterate () at eval.c:41
#44 0x401abeec in g_main_run () at eval.c:41
#45 0x400c7333 in gtk_main () at eval.c:41
#46 0x08063a06 in real_main (closure=0x0, argc=1, argv=0xbffff9e4)
    at gnubg.c:6597
#47 0x08063b8b in main (argc=1, argv=0xbffff9e4) at gnubg.c:6676
#48 0x40470507 in __libc_start_main (main=0x8063b78 <main>, argc=1,
    ubp_av=0xbffff9e4, init=0x805a568 <_init>, fini=0x80e90f0 <_fini>,
    rtld_fini=0x4000dc14 <_dl_fini>, stack_end=0xbffff9dc)
    at ../sysdeps/generic/libc-start.c:129


As we see, in response to some signal, HintClearSelection()  has been
called on pwMoves, although I don't understand what has caused this.

At the time of the crash itself we see:
Program received signal SIGSEGV, Segmentation fault.
PositionFromKey (anBoard=0xbfffd300,
    pauch=0x2377b308 <Address 0x2377b308 out of bounds>) at
positionid.c:209
209         unsigned char cur = *a;

and backtrace shows
#0  PositionFromKey (anBoard=0xbfffd300,
    pauch=0x2377b308 <Address 0x2377b308 out of bounds>) at
positionid.c:209
#1  0x08068303 in ScoreMove (pm=0x2377b2e8, pci=0xbfffd400, pec=0x81443c4,
    nPlies=3) at eval.c:3030
#2  0x080df474 in EvalMoves (phd=0x86da758, pec=0x81443c4) at
gtkchequer.c:362
#3  0x400c8de1 in gtk_marshal_NONE__NONE () at eval.c:41
#4  0x400fc436 in gtk_handlers_run () at eval.c:41
#5  0x400fb76d in gtk_signal_real_emit () at eval.c:41
#6  0x400f9525 in gtk_signal_emit () at eval.c:41
#7  0x40060e2d in gtk_button_clicked () at eval.c:41
#8  0x400625ed in gtk_real_button_released () at eval.c:41
#9  0x400c8de1 in gtk_marshal_NONE__NONE () at eval.c:41
#10 0x400fb5f1 in gtk_signal_real_emit () at eval.c:41
#11 0x400f9525 in gtk_signal_emit () at eval.c:41
#12 0x40060d5d in gtk_button_released () at eval.c:41
#13 0x40061ed7 in gtk_button_button_release () at eval.c:41
#14 0x400c8aec in gtk_marshal_BOOL__POINTER () at eval.c:41
#15 0x400fb7ad in gtk_signal_real_emit () at eval.c:41
#16 0x400f9525 in gtk_signal_emit () at eval.c:41
#17 0x40133b89 in gtk_widget_event () at eval.c:41
#18 0x400c8a45 in gtk_propagate_event () at eval.c:41
#19 0x400c7a6f in gtk_main_do_event () at eval.c:41
#20 0x40178d7f in gdk_event_dispatch () at eval.c:41
#21 0x401ab773 in g_main_dispatch () at eval.c:41
#22 0x401abd39 in g_main_iterate () at eval.c:41
#23 0x401abeec in g_main_run () at eval.c:41
#24 0x400c7333 in gtk_main () at eval.c:41
#25 0x08063a06 in real_main (closure=0x0, argc=1, argv=0xbffff9e4)
    at gnubg.c:6597
#26 0x08063b8b in main (argc=1, argv=0xbffff9e4) at gnubg.c:6676
#27 0x40470507 in __libc_start_main (main=0x8063b78 <main>, argc=1,
    ubp_av=0xbffff9e4, init=0x805a568 <_init>, fini=0x80e90f0 <_fini>,
    rtld_fini=0x4000dc14 <_dl_fini>, stack_end=0xbffff9dc)
    at ../sysdeps/generic/libc-start.c:129