Re: allocate_string_data memory corruption

[Eli Zaretskii]

> From: Chong Yidong <address@hidden>
> Date: Wed, 18 Jan 2006 11:57:02 -0500
> 
>     /* no crash here */
>     if (data->string != s || data->nbytes != nbytes) abort ();
> 
>     check_sblock (current_sblock);
> 
>     /* crash occured here */
>     if (data->string != s || data->nbytes != nbytes) abort ();
>     ...
>   }
> 
> 
> In this function, data->string is set to s, and nbytes is set to
> nbytes.  If check_sblock is a no-op, there should be no change.
> However, we get an abort on the second debugging check:
> 
>   #0  abort () at emacs.c:461

Are you in fact 110% sure the abort happens on the second debugging
check?  Can you tell how did you verify this?  (The line number shown
by GDB is not a reliable evidence.)

Was this code compiled without optimizations?  If not, recompile with
"-O0" and see if you get abort or crash in another place.

Btw, does the value of `data' itself change in any way?  You didn't
show its value at the offending line.

> There is clearly no assignment to any of the sdata structures in these
> functions.
> 
> Any ideas?

One idea is to put watchpoints on the relevant memory addresses and
see who hits them.  For maximum reliability, look at the machine
instruction whose address GDB shows when the watchpoint is hit, and
then disassemble around that address to see what source line(s) did
that.