Re: SIGSEGV -- redisplay bug

[Alex Schroeder]

It happened again -- and I did not recompile with GLYPH_DEBUG, yet.

If you are interested in this, read on.  I did not find anything.  I
am just speculating about what it could.  Perhaps it triggers
somebody's memory of something...  :)

I am not CCing Gerd, because I remember from some other mail (possibly
somebody quoting him) that he was not going to debug any redisplay
bugs.





Anyway, same thing as last time: area seems way too big:

Program received signal SIGSEGV, Segmentation fault.
0x0805040d in increment_row_positions (row=0x92c9dc0, delta=1, delta_bytes=1) 
at dispnew.c:1188
1188          if (BUFFERP (row->glyphs[area][i].object)
(gdb) p area
$1 = 4159280

This time I did not use any wide characters (no Japanese), but I had
just activated auto-image-file-mode and looked at three pictures.  So
perhaps that is something -- although I use smilies.el from Gnus
regularly (could be that this is only in Gnus CVS).

(gdb) p i
$2 = 83

I cannot explain this...  Here is the piece of code in dispnew.c:

void
increment_row_positions (row, delta, delta_bytes)
     struct glyph_row *row;
     int delta, delta_bytes;
{
  int area, i;

  /* Increment start and end positions.  */
  MATRIX_ROW_START_CHARPOS (row) += delta;
  MATRIX_ROW_START_BYTEPOS (row) += delta_bytes;
  MATRIX_ROW_END_CHARPOS (row) += delta;
  MATRIX_ROW_END_BYTEPOS (row) += delta_bytes;

  /* Increment positions in glyphs.  */
  for (area = 0; area < LAST_AREA; ++area)
    for (i = 0; i < row->used[area]; ++i)
      if (BUFFERP (row->glyphs[area][i].object)
          && row->glyphs[area][i].charpos > 0)
        row->glyphs[area][i].charpos += delta;

So area starts at 0.  LAST_AREA is 3, I think, because of this piece
in dispextern.h:

enum glyph_row_area
{
  LEFT_MARGIN_AREA,
  TEXT_AREA,
  RIGHT_MARGIN_AREA,
  LAST_AREA
};

Hm...

Perhaps, if at some lower i, an entry of row->glyphs satisfies the
test

      if (BUFFERP (row->glyphs[area][i].object)
          && row->glyphs[area][i].charpos > 0)

and yet it does not have a row->glyphs[area][i].charpos.  A corrupt
glyph, in other words. Then
 
        row->glyphs[area][i].charpos += delta;

could corrupt the row->glyphs array.

Any ideas?


Without really understanding redisplay, I stumbled across the
following comment in dispextern.h:

/* Glyphs.

   Be extra careful when changing this structure!  Esp. make sure that
   functions producing glyphs, like x_append_glyph, fill ALL of the
   glyph structure, and that GLYPH_EQUAL_P compares all
   display-relevant members of glyphs (not to imply that these are the
   only things to check when you add a member).  */


Alex.