emacs crash

[Werner LEMBERG]

[CVS 2003-09-29]

Below is a backtrace of an Emacs crash which hasn't happened during
garbage collection.  I still have this Emacs process so I can execute
your commands if necessary.  IIRC, the segfault happened while
scrolling new Email (with various character sets) in Mew.

Of the variables shown under #0, `faces' and `char2b' are invalid
pointers (besides `s' and `first_s', of course).


    Werner


======================================================================

Program received signal SIGSEGV, Segmentation fault.
0x08078bd3 in draw_glyphs (w=0x8f5e638, x=157, row=0x8e44590, area=TEXT_AREA, 
    start=0, end=62, hl=DRAW_NORMAL_TEXT, overlaps_p=0) at xdisp.c:17461
17461     BUILD_GLYPH_STRINGS (i, end, head, tail, hl, x, last_x);
(gdb) bt full
#0  0x08078bd3 in draw_glyphs (w=0x8f5e638, x=157, row=0x8e44590, 
    area=TEXT_AREA, start=0, end=62, hl=DRAW_NORMAL_TEXT, overlaps_p=0)
    at xdisp.c:17461
        c = 2747
        this_face_id = 150339144
        cmp_id = 2747
        face_id = 150339144
        base_face = (struct face *) 0x8ad25e0
        char2b = (XChar2b *) 0x3fffe154
        cmp = (struct composition *) 0x8f5fe80
        glyph_len = 1073741826
        faces = (struct face **) 0x3fffe144
        first_s = (struct glyph_string *) 0x0
        n = 0
        head = (struct glyph_string *) 0xbfffe664
        tail = (struct glyph_string *) 0xbfffe1d4
        s = (struct glyph_string *) 0xabb
        last_x = 973
        x_reached = 149177744
        i = 12
        j = -1073748396
        f = (struct frame *) 0x8640de8
#1  0x0807d00e in x_write_glyphs (start=0x8ff58f0, len=62) at xdisp.c:18503
        start = (struct glyph *) 0x8f5fe48
        x = 149177744
#2  0x08053fa5 in update_text_area (w=0x8f5e638, vpos=0) at dispnew.c:4270
        current_row = (struct glyph_row *) 0x8f589f8
        desired_row = (struct glyph_row *) 0x8e44590
        changed_p = 0
#3  0x080543e6 in update_window_line (w=0x8f5e638, vpos=0, 
    mouse_face_overwritten_p=0xbfffe938) at dispnew.c:4494
        w = (struct window *) 0x8f5e638
        mouse_face_overwritten_p = (int *) 0x0
        current_row = (struct glyph_row *) 0x8f589f8
        desired_row = (struct glyph_row *) 0x8e44590
        changed_p = 0
#4  0x08053d2b in update_window (w=0x8f5e638, force_p=0) at dispnew.c:4150
        vpos = 0
        i = 150339144
        end = (struct glyph_row *) 0x8e45980
        mode_line_row = (struct glyph_row *) 0x8f5fe80
        header_line_row = (struct glyph_row *) 0x0
        changed_p = 1
        mouse_face_overwritten_p = 0
        row = (struct glyph_row *) 0x8e44590
        yb = 504
        n_updated = 1
        desired_matrix = (struct glyph_matrix *) 0x8c2abe0
        paused_p = 0
        preempt_count = 9
#5  0x08053793 in update_window_tree (w=0x8f94f40, force_p=0) at dispnew.c:3885
        w = (struct window *) 0x8f5e638
        force_p = 0
        paused_p = 0
#6  0x08053778 in update_window_tree (w=0x8f97a88, force_p=0) at dispnew.c:3883
        w = (struct window *) 0x8f97a88
        force_p = 0
        paused_p = 0
#7  0x08053691 in update_frame (f=0x8640de8, force_p=0, inhibit_hairy_id_p=0)
    at dispnew.c:3822
        f = (struct frame *) 0x8640de8
        inhibit_hairy_id_p = 0
        paused_p = 140818216
        root_window = (struct window *) 0x8f97a88
#8  0x0806cdba in redisplay_internal (preserve_echo_area=0) at xdisp.c:10050
        f = (struct frame *) 0x8640de8
        tail = 150339144
        frame = 150339144
        i = 1
        updated = (struct frame **) 0xbfffe9f4
        n = 0
        size = 50
        w = (struct window *) 0x8f94f40
        f = (struct frame *) 0x8f5fe80
        pause = 0
        must_finish = 1
        tlbufpos = {charpos = 64537, bytepos = 64644}
        tlendpos = {charpos = 6428, bytepos = 6508}
        number_of_visible_frames = 1
        count = 2
        polling_stopped_here = 1
        consider_all_windows_p = 1
#9  0x0806bcd0 in redisplay () at xdisp.c:9448
No locals.
#10 0x080e1375 in read_char (commandflag=1, nmaps=2, maps=0xbffff0f4, 
    prev_event=675054316, used_mouse_menu=0xbffff148) at keyboard.c:2495
        c = 675054316
        count = 0
        local_getcjmp = {{__jmpbuf = {0, 0, 138441496, -1471787984, 675428364, 
      135432523}, __mask_was_saved = 138441496, __saved_mask = {__val = {
        3221221484, 3221221484, 135432701, 675428364, 675054316, 675054316, 0, 
        1212183320, 675428364, 675428364, 135457263, 140715040, 2288198688, 
        3221221532, 135432844, 675428364, 1212183320, 64537, 135748393, 2, 0, 
        516296, 675054316, 3221221332, 64537, 3221221612, 135195085, 
        675404660, 0, 0, 135743368, 2}}}}
        save_jump = {{__jmpbuf = {135740232, -1460667568, 675147572, 1, 
      -1073745988, 135747853}, __mask_was_saved = 64536, __saved_mask = {
      __val = {3221221308, 135747862, 2834299728, 675147572, 0, 140715040, 0, 
        1, 3221221532, 135457649, 64536, 675147572, 2288198688, 135457649, 
        1215067860, 675260524, 2288198688, 135437987, 1215067860, 141495344, 
        142050320, 0, 1, 19, 3221221148, 135504025, 2826020352, 0, 8192, 0, 
        138441496, 2823179312}}}}
        key_already_recorded = 0
        tem = 0
        save = 0
        previous_echo_area_message = 675054316
        also_record = 675054316
        reread = 0
        gcpro1 = {next = 0x486c76d4, var = 0xffffffff, nvars = 140715040}
        gcpro2 = {next = 0x283c82ec, var = 0xbfffef7c, nvars = -1073746032}
        last_idle_start = {tv_sec = 675054316, tv_usec = 64536}
        polling_stopped_here = 0
#11 0x080e881f in read_key_sequence (keybuf=0xbffff254, bufsize=30, 
    prompt=675054316, dont_downcase_last=0, can_return_switch_frame=1, 
    fix_current_buffer=1) at keyboard.c:8825
        key = 209
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 675054316
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 2
        nmaps_allocated = 2
        defs = (int *) 0xbffff0e4
        submaps = (int *) 0xbffff0f4
        orig_local_map = -1469255984
        orig_keymap = 675054316
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {map = -1472400872, parent = -1472400872, start = 0, end = 0}
        keytran = {map = -1471723376, parent = -1471723376, start = 0, end = 0}
        delayed_switch_frame = 675054316
        original_uppercase = 0
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x8632420
        fake_prefixed_keys = 675054316
        gcpro1 = {next = 0x0, var = 0x0, nvars = -1073745492}
#12 0x080df764 in command_loop_1 () at keyboard.c:1504
        cmd = 2
        lose = 2
        nonundocount = 0
        keybuf = {32, 98, -1073745220, 135131396, -1459750176, -1073745272, 
  -1073745220, 135131319, 0, 1, -1073743836, 1077983524, 135701888, 
  -1073744896, 17, 1076885774, 177478308, 1073775649, -1073745104, 32, 
  -1073745020, 0, -1073745312, -1073745452, 0, 1073741824, -1073744964, 
  135494457, -1073745148, -1073744768}
        i = 2
        no_direct = 0
        prev_modiff = 6467
        prev_buffer = (struct buffer *) 0x8632420
        was_locked = 0
        already_adjusted = 0
#13 0x08137b8d in internal_condition_case (bfun=0x80df450 <command_loop_1>, 
    handlers=675148004, hfun=0x80df030 <cmd_error>) at eval.c:1333
        val = 150339144
        c = {tag = 675054316, val = 675054316, next = 0xbffff404, gcpro = 0x0, 
  jmp = {{__jmpbuf = {0, 1, -1073743836, -1073744964, -1073745212, 135494457}, 
      __mask_was_saved = 0, __saved_mask = {__val = {3221222348, 3221222100, 
          135494457, 0, 134530924, 335544320, 1076991992, 1076844252, 
          1074843024, 0 <repeats 16 times>, 3221222356, 1073787006, 
          1073827532, 1078006536, 1, 0, 0}}}}, backlist = 0x0, 
  handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2, 
  poll_suppress_count = 1, interrupt_input_blocked = 0, byte_stack = 0x0}
        h = {handler = 675148004, var = 675054316, chosen_clause = 675054364, 
  tag = 0xbffff2f4, next = 0x0}
#14 0x080df2fe in command_loop_2 () at keyboard.c:1292
        val = 0
#15 0x081376f5 in internal_catch (tag=675109268, 
    func=0x80df2e0 <command_loop_2>, arg=675054316) at eval.c:1094
        tag = 150339144
        c = {tag = 675109268, val = 675054316, next = 0x0, gcpro = 0x0, jmp = {
    {__jmpbuf = {0, 1, -1073743836, -1073744692, -1073744924, 135493346}, 
      __mask_was_saved = 0, __saved_mask = {__val = {3221222620, 3221222388, 
          135493346, 0, 3221222528, 3221222539, 0, 1077983524, 808465724, 
          3221222428, 1077248756, 5, 1077986688, 138389272, 138411460, 
          1212131096, 3221222204, 138209992, 675054316, 3221222588, 135434098, 
          675282372, 1212131096, 675054316, 138231648, 138411460, 675282372, 
          1212131096, 0, 138411460, 675282372, 137907392}}}}, backlist = 0x0, 
  handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2, 
  poll_suppress_count = 1, interrupt_input_blocked = 0, byte_stack = 0x0}
#16 0x080df2a3 in command_loop () at keyboard.c:1271
No locals.
#17 0x080deda4 in recursive_edit_1 () at keyboard.c:987
        count = 1
        val = 0
#18 0x080deee1 in Frecursive_edit () at keyboard.c:1043
        count = 0
        buffer = 0
#19 0x080ddc35 in main (argc=1, argv=0xbffff824) at emacs.c:1666
        dummy = 0
        stack_bottom_variable = 0 '\0'
        skip_args = 0
        rlim = {rlim_cur = 8388608, rlim_max = 18446744073709551615}
        no_loadup = 0
        junk = 0x0
#20 0x403087ee in __libc_start_main () from /lib/libc.so.6