Re: Crash caused by insert-file-contents, both trunk (bzr 111532) and 24.2.92 affected

[Eli Zaretskii]

> Date: Tue, 15 Jan 2013 21:37:44 +0400
> From: Dmitry Antipov <address@hidden>
> 
> On 24.2.92, (insert-file-contents "/dev/kmsg") ==>
> 
> #0  0x000000377da0eebb in raise () from /lib64/libpthread.so.0
> #1  0x0000000000546905 in terminate_due_to_signal (sig=11, 
> backtrace_limit=40) at emacs.c:344
> #2  0x000000000056b5f5 in handle_fatal_signal (sig=11) at sysdep.c:1638
> #3  0x000000000056b5ca in deliver_thread_signal (sig=11, handler=0x56b5db 
> <handle_fatal_signal>) at sysdep.c:1614
> #4  0x000000000056b62b in deliver_fatal_thread_signal (sig=11) at 
> sysdep.c:1650
> #5  <signal handler called>
> #6  0x0000000000650791 in remove_properties (plist=10701014, list=12882466, 
> i=0x0, object=12909269) at textprop.c:439
> #7  0x00000000006535ec in Fremove_text_properties (start=768, end=343928, 
> properties=10701014, object=12909269) at textprop.c:1488

That seems to be an entirely different crash.  It happened as part of
signaling an error:

> #46 0x00000000005e486e in Fsignal (error_symbol=12934146, data=20028822) at 
> eval.c:1527
> #47 0x00000000005e4986 in xsignal (error_symbol=12934146, data=20028822) at 
> eval.c:1562
> #48 0x00000000005e49db in xsignal1 (error_symbol=12934146, arg=41969025) at 
> eval.c:1577
> #49 0x00000000005e4fbc in verror (m=0x6ad708 "IO error reading %s: %s", 
> ap=0x7fff035aa348) at eval.c:1776
> #50 0x00000000005e505b in error (m=0x6ad708 "IO error reading %s: %s") at 
> eval.c:1788
> #51 0x0000000000591898 in Finsert_file_contents (filename=41974721, 
> visit=12882466, beg=12882466, end=12882466, replace=12882466)
>      at fileio.c:4188

> (but ./src/emacs -Q /dev/kmsg ==> empty buffer and "File exists, but cannot 
> be read" message).
> 
> For trunk with --enable-checking, (insert-file-contents "/dev/kmsg") ==>
> 
> /home/dima/work/stuff/emacs/trunk/src/intervals.c:675: Emacs fatal error: 
> assertion failed: relative_position <= TOTAL_LENGTH (tree)
> Fatal error 6: Aborted
> 
> #0  0x000000377da0eebb in raise () from /lib64/libpthread.so.0
> #1  0x0000000000525d38 in terminate_due_to_signal (address@hidden, 
> address@hidden)
>      at /home/dima/work/stuff/emacs/trunk/src/emacs.c:342
> #2  0x0000000000594cb4 in die (msg=<optimized out>, file=<optimized out>, 
> line=<optimized out>)
>      at /home/dima/work/stuff/emacs/trunk/src/alloc.c:6558
> #3  0x0000000000616e66 in find_interval (tree=0x0, position=252) at 
> /home/dima/work/stuff/emacs/trunk/src/intervals.c:675
> #4  0x000000000061d6a1 in Ftext_properties_at (position=..., object=...) at 
> /home/dima/work/stuff/emacs/trunk/src/textprop.c:555
> #5  0x000000000061d7ac in Fget_text_property (position=..., address@hidden, 
> prop=..., address@hidden, object=...,
>      address@hidden) at /home/dima/work/stuff/emacs/trunk/src/textprop.c:575
> #6  0x000000000061da78 in get_char_property_and_overlay (position=..., 
> prop=..., object=..., address@hidden)
>      at /home/dima/work/stuff/emacs/trunk/src/textprop.c:641
> #7  0x000000000061de8b in Fget_char_property (position=..., address@hidden, 
> prop=..., object=..., address@hidden)

Again, looks like a crash related to intervals, after signaling an error:

> #40 0x00000000005b64a9 in xsignal (error_symbol=..., address@hidden, data=...)
>      at /home/dima/work/stuff/emacs/trunk/src/eval.c:1466
> #41 0x00000000005b6dc7 in xsignal1 (error_symbol=..., arg=..., 
> address@hidden) at /home/dima/work/stuff/emacs/trunk/src/eval.c:1481
> #42 0x00000000005b6e39 in verror (m=<optimized out>, address@hidden) at 
> /home/dima/work/stuff/emacs/trunk/src/eval.c:1680
> #43 0x00000000005b6ecc in error (address@hidden "IO error reading %s: %s") at 
> /home/dima/work/stuff/emacs/trunk/src/eval.c:1692
> #44 0x00000000005684c3 in Finsert_file_contents (filename=..., visit=..., 
> beg=..., end=..., replace=...)
>      at /home/dima/work/stuff/emacs/trunk/src/fileio.c:4329

> I also saw crashes with heap corruption messages from glibc malloc.

Maybe we have some memory corruption problem which happens when we try
reading devices.

> I can save /dev/kmsg to a file and then do insert-file-contents from that 
> file -
> it works just fine, both with trunk and 24.2.92.

So the problem likely is triggered by non-regular files.