Re: 22.0.50 SEGFAULT

[JD Smith]

On Fri, 15 Jul 2005 10:45:17 +0200, Kim F. Storm wrote:

> JD Smith <address@hidden> writes:
> 
>> I'm still getting SEGFAULTS in the most recent CVS build, relating to
>> increment_row_positions.  I had previously reported this was fixed in
>> 22.0.50, but had not tested adequately.  It is an intermittent SEGFAULT,
>> usually triggered by a key comand that causes window redisplay.  This
>> is:
>>
>> GNU Emacs 22.0.50.3 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars) of
>> 2005-07-14 on turtle.as.arizona.edu
>>
>> (gdb) run
>> Starting program: /usr/local/bin/emacs -geometry 80x40+0+0 Detaching
>> after fork from child process 24951.
>>
>> Program received signal SIGSEGV, Segmentation fault. 0x08050c4f in
>> increment_row_positions (row=0x8b865c8, delta=-1, delta_bytes=4)
>>     at dispnew.c:1190
>> 1190          if (BUFFERP (row->glyphs[area][i].object)
> 
> BUFFERP(...) also examines the size of the glyph object, i.e. it accesses
> something like this:
> 
>         XVECTOR(row->glyphs[area][i].object)->size
> 
> So it seems that the glyph object (after stripping off bits and pieces)
> points to void memory -- which should not happen.
> 
> The question is what object should have been there (if any)... What was
> displayed in the window where this happened?
> 
> Next time this happens, pls. print the information from the following gdb
> commands:
> 
>   p *row
>   p i
>   p area
>   p row->glyphs[area][i]
>   p row->glyphs[area][i+1]
>   p row->glyphs[area][i-1]  (if i > 0)
>   prow
> 
>   up
>   p start
> 
>   up
>   p first_unchanged_at_end_vpos
>   p dvpos
>   p dy
>   p *w
>   pwin

Well, you would know that as soon as I posted this, the frequency of
these SEGFAULT's would drop from the normal one per day, to one per
week.  After a week or so of stability, I just had this same one again
with 22.0.50.

Below is the debugging info you requested.  The only universal
condition I've noted is the display of a breakpoint glyph character in
the margin, which always seems to be present when I get the fault
(although I use these breakpoint glyphs without trouble 99% of the
time).  The cursor is not necessarily on the line containing this
glyph when the segfault occurs, but it's always there (and, I am
reasonably sure, always visible in the frame).

I will leave gdb running over the weekend, so if there is any other
useful information I could provide from this SEGFAULT'd session, let
me know.

Thanks,

JD


Program received signal SIGSEGV, Segmentation fault.
0x08050c4f in increment_row_positions (row=0x8973018, delta=31, delta_bytes=4)
    at dispnew.c:1190
1190          if (BUFFERP (row->glyphs[area][i].object)
(gdb) p *row
$1 = {
  glyphs = {0x88d7710, 0x88d7850, 0x88dac10, 0x88dac10},
  used = {0, 79, 0},
  x = 0,
  y = 1260,
  pixel_width = 790,
  ascent = 12,
  height = 15,
  phys_ascent = 12,
  phys_height = 15,
  visible_height = -30,
  extra_line_spacing = 0,
  hash = 57989411,
  start = {
    pos = {
      charpos = 2504,
      bytepos = 2504
    },
    overlay_string_index = -1,
    string_pos = {
      charpos = -1,
      bytepos = -1
    },
---Type <return> to continue, or q <return> to quit---
    dpvec_index = -1
  },
  end = {
    pos = {
      charpos = 2583,
      bytepos = 2583
    },
    overlay_string_index = -1,
    string_pos = {
      charpos = -1,
      bytepos = -1
    },
    dpvec_index = -1
  },
  overlay_arrow_bitmap = 0,
  left_user_fringe_bitmap = 0,
  right_user_fringe_bitmap = 0,
  left_fringe_bitmap = 0,
  right_fringe_bitmap = 0,
  left_user_fringe_face_id = 0,
  right_user_fringe_face_id = 0,
  left_fringe_face_id = 0,
  right_fringe_face_id = 0,
---Type <return> to continue, or q <return> to quit---
  redraw_fringe_bitmaps_p = 0,
  enabled_p = 0,
  truncated_on_left_p = 0,
  truncated_on_right_p = 0,
  continued_p = 0,
  displays_text_p = 1,
  ends_at_zv_p = 0,
  fill_line_p = 0,
  indicate_empty_line_p = 0,
  contains_overlapping_glyphs_p = 0,
  full_width_p = 0,
  mode_line_p = 0,
  overlapped_p = 0,
  ends_in_middle_of_char_p = 0,
  starts_in_middle_of_char_p = 0,
  overlapping_p = 0,
  mouse_face_p = 0,
  ends_in_newline_from_string_p = 0,
  exact_window_width_line_p = 0,
  cursor_in_fringe_p = 0,
  ends_in_ellipsis_p = 0,
  indicate_bob_p = 0,
  indicate_top_line_p = 0,
---Type <return> to continue, or q <return> to quit---
  indicate_eob_p = 0,
  indicate_bottom_line_p = 0,
  continuation_lines_width = 0
}
(gdb) p i
$2 = 4
(gdb) p area
$3 = 1
(gdb) p row->glyphs[area][i]
$4 = {
  charpos = 2518,
  object = 145085668,
  pixel_width = 10,
  ascent = 12,
  descent = 3,
  voffset = 0,
  type = 0,
  multibyte_p = 1,
  left_box_line_p = 0,
  right_box_line_p = 0,
  overlaps_vertically_p = 0,
  padding_p = 0,
  glyph_not_available_p = 0,
  face_id = 0,
  font_type = 0,
  slice = {
    x = 0,
    y = 0,
    width = 0,
    height = 0
  },
  u = {
---Type <return> to continue, or q <return> to quit---
    ch = 51,
    cmp_id = 51,
    img_id = 51,
    stretch = {
      height = 51,
      ascent = 0
    },
    val = 51
  }
}
(gdb) p row->glyphs[area][i+1]
$5 = {
  charpos = 2519,
  object = 145085668,
  pixel_width = 10,
  ascent = 12,
  descent = 3,
  voffset = 0,
  type = 0,
  multibyte_p = 1,
  left_box_line_p = 0,
  right_box_line_p = 0,
  overlaps_vertically_p = 0,
  padding_p = 0,
  glyph_not_available_p = 0,
  face_id = 0,
  font_type = 0,
  slice = {
    x = 0,
    y = 0,
    width = 0,
    height = 0
  },
  u = {
---Type <return> to continue, or q <return> to quit---
    ch = 44,
    cmp_id = 44,
    img_id = 44,
    stretch = {
      height = 44,
      ascent = 0
    },
    val = 44
  }
}
(gdb) p row->glyphs[area][i-1]
$6 = {
  charpos = 2517,
  object = 145085668,
  pixel_width = 10,
  ascent = 12,
  descent = 3,
  voffset = 0,
  type = 0,
  multibyte_p = 1,
  left_box_line_p = 0,
  right_box_line_p = 0,
  overlaps_vertically_p = 0,
  padding_p = 0,
  glyph_not_available_p = 0,
  face_id = 0,
  font_type = 0,
  slice = {
    x = 0,
    y = 0,
    width = 0,
    height = 0
  },
  u = {
---Type <return> to continue, or q <return> to quit---
    ch = 48,
    cmp_id = 48,
    img_id = 48,
    stretch = {
      height = 48,
      ascent = 0
    },
    val = 48
  }
}

(gdb) prow
y=1260 x=0 pwid=790 a+d=12+3=15 phys=12+3=15 vis=-30  L=0 T=79 R=0
start=2504 end=2583 DISP

(gdb) up
#1  0x08050cce in increment_matrix_positions (matrix=0x8532e40, start=42,
    end=1819287592, delta=31, delta_bytes=31) at dispnew.c:929
929         increment_row_positions (matrix->rows + start, delta, delta_bytes);
(gdb) p start
$7 = 42

(gdb) up
#2  0x0806e3aa in try_window_id (w=0x85e69f8) at xdisp.c:14096
14096       increment_matrix_positions (current_matrix,
(gdb) p first_unchanged_at_end_vpos
$8 = 30
(gdb) p dvpos
$9 = 0
(gdb) p dy
$10 = 0
(gdb) p *w
$11 = {
  size = 1073745994,
  vec_next = 0x86e69e8,
  frame = 139915652,
  mini_p = 137306129,
  next = 139425388,
  prev = 137306129,
  hchild = 137306129,
  vchild = 137306129,
  parent = 137306129,
  left_col = 0,
  top_line = 48,
  total_lines = 664,
  total_cols = 672,
  buffer = 145085668,
  start = 140988298,
  pointm = 140988274,
  force_start = 137306129,
  optional_new_start = 137306129,
  hscroll = 0,
  min_hscroll = 0,
  use_time = 592400,
  sequence_number = 448,
---Type <return> to continue, or q <return> to quit---
  temslot = 8,
  last_modified = 25088,
  last_overlay_modified = 272,
  last_point = 6256,
  last_had_star = 137306129,
  vertical_scroll_bar = 156539572,
  left_margin_cols = 16,
  right_margin_cols = 137306129,
  left_fringe_width = 137306129,
  right_fringe_width = 137306129,
  fringes_outside_margins = 137306129,
  scroll_bar_width = 137306129,
  vertical_scroll_bar_type = 137306177,
  last_mark_x = 137306129,
  last_mark_y = 137306129,
  window_end_pos = 6928,
  window_end_vpos = 648,
  window_end_valid = 145085668,
  update_mode_line = 137306177,
  start_at_line_beg = 137306177,
  display_table = 137306129,
  dedicated = 137306129,
  base_line_number = 8,
---Type <return> to continue, or q <return> to quit---
  base_line_pos = 8,
  region_showing = 137306129,
  column_number_displayed = 137306129,
  redisplay_end_trigger = 137306129,
  too_small_ok = 137306177,
  orig_total_lines = 137306129,
  orig_top_line = 137306129,
  current_matrix = 0x8532e40,
  desired_matrix = 0x83aae78,
  nrows_scale_factor = 1,
  ncols_scale_factor = 1,
  last_cursor = {
    x = 50,
    y = 435,
    hpos = 5,
    vpos = 29
  },
  cursor = {
    x = 360,
    y = 435,
    hpos = 36,
    vpos = 29
  },
---Type <return> to continue, or q <return> to quit---
  phys_cursor = {
    x = 50,
    y = 435,
    hpos = 5,
    vpos = 29
  },
  phys_cursor_type = 0,
  phys_cursor_width = 10,
  phys_cursor_ascent = 12,
  phys_cursor_height = 15,
  phys_cursor_on_p = 1,
  cursor_off_p = 0,
  last_cursor_off_p = 0,
  must_be_updated_p = 0,
  pseudo_window_p = 0,
  vscroll = 0,
  window_end_bytepos = 866,
  frozen_window_start_p = 0,
  height_fixed_p = 0
}
(gdb) pwin
Window 56 fullspec_viz.pro
start=1 end:pos=866 vpos=81 vscroll=0
cursor: y=435 x=360 vpos=29 hpos=36  phys: y=435 x=50 vpos=29 hpos=5 ON blk=OFF
(gdb)