Re: Crash on invalid cons_free_list

[Kim F. Storm]

Chong Yidong <address@hidden> writes:

> [I sent this to emacs-pretest-bug a few days ago, but it didn't seem
> to arrive.  I think my email system was flaking out at the time.]
>
> I installed VM to and played around with it trying to make the
> string_free_list/compact_small_strings crash happen.  I got a crash on
> an invalid cons_free_list; dunno if that's related.

It seems that most of the crashes triggered by VM are somehow related
to mapcar -- and in this case a mapcar called inside mapatoms.

Can you deduce what functions are run here, and see if they
do something special, e.g. intern new symbols or something
else which manipulates symbols, conses, or strings...


>
> Unfortunately, I have not been able to reproduce the crash.  I'll keep
> the gdb session up for the next day or so in case someone needs more
> information.  This Emacs was built about four days ago.
>
>
> Program received signal SIGSEGV, Segmentation fault.
> Fcons (car=137392193, cdr=137392193) at alloc.c:2696
> 2696          cons_free_list = *(struct Lisp_Cons **)&cons_free_list->cdr;
> (gdb) p cons_free_list
> $3 = (struct Lisp_Cons *) 0x41081b22
> (gdb) p cons_free_list->cdr
> Cannot access memory at address 0x41081b26
> (gdb) xbacktrace
> "mapcar"
> "vm-mapc"
> "vm-copy-local-variables"
> "vm-do-needed-mode-line-update"
> 0x897134c PVEC_COMPILED
> "mapatoms"
> "vm-update-summary-and-mode-line"
> "vm-decode-mime-message"
> "vm-show-current-message"
> "vm-scroll-forward"
> "call-interactively"
> "recursive-edit"
> "byte-code"
> "debug"
> "execute-extended-command"
> "call-interactively"
> (gdb) bt full
> #0  Fcons (car=137392193, cdr=137392193) at alloc.c:2696
>         val = 137392193
> #1  0x08134900 in Flist (nargs=1, args=0xbf983d80) at alloc.c:2784
>         val = 143785469
> #2  0x08155930 in Fmapcar (function=143785469, sequence=143784269)
>     at fns.c:3208
>         leni = 2
>         args = (int *) 0xbf983d80
>         ret = -1080541824
>         sa_must_free = 0
> #3  0x0814bf66 in Ffuncall (nargs=3, args=0xbf983e34) at eval.c:2865
>         fun = 137108664
>         funcar = 137392193
>         numargs = 2
>         lisp_numargs = 137392193
>         val = 137392193
>         backtrace = {
>           next = 0xbf983f10, 
>         function = 0xbf983e30, 
>           args = 0xbf983e34, 
>           nargs = 2, 
>           evalargs = 0 '\0', 
>           debug_on_exit = 0 '\0'
>        }
>        internal_args = (int *) 0xbf983e34
>        i = 137392193
>
>
> _______________________________________________
> Emacs-devel mailing list
> address@hidden
> http://lists.gnu.org/mailman/listinfo/emacs-devel
>
>

-- 
Kim F. Storm <address@hidden> http://www.cua.dk