segmentation fault resizing frame

[Robert Mecklenburg]

I did a fresh cvs checkout and build on 7/22/04 8:00am MDT.  Later
that afternoon I was resizing a frame by dragging the top border
(decreasing the size).  When I let go of the mouse button I got a
segmentation fault.

Mandrake 10
AMD XP 3200+
KDE 3.2

Program received signal SIGSEGV, Segmentation fault.
Fcons (car=172569645, cdr=138493973) at alloc.c:2371
2371          cons_free_list = *(struct Lisp_Cons **)&cons_free_list->cdr;
(gdb) where
#0  Fcons (car=172569645, cdr=138493973) at alloc.c:2371
#1  0x081720f1 in Flist (nargs=17, args=0xbfffd680) at alloc.c:2448
#2  0x0819275b in Fmapcar (function=143730905, sequence=172570437) at fns.c:3051
#3  0x08189180 in Ffuncall (nargs=3, args=0xbfffd770) at eval.c:2736
#4  0x081b4639 in Fbyte_code (bytestr=143745419, vector=143747828, maxdepth=72) 
at bytecode.c:689
#5  0x08189510 in funcall_lambda (fun=143748020, nargs=0, 
arg_vector=0xbfffd8a8) at eval.c:2912
#6  0x08188ff3 in Ffuncall (nargs=1, args=0xbfffd8a4) at eval.c:2782
#7  0x081b4639 in Fbyte_code (bytestr=143786907, vector=143792076, maxdepth=48) 
at bytecode.c:689
#8  0x0818871a in Feval (form=143782733) at eval.c:2090
#9  0x08187307 in Fcondition_case (args=172570461) at eval.c:1282
#10 0x081b3dff in Fbyte_code (bytestr=143786891, vector=143792220, maxdepth=24) 
at bytecode.c:870
#11 0x08189510 in funcall_lambda (fun=143792356, nargs=0, 
arg_vector=0xbfffdc8c) at eval.c:2912
#12 0x08188ff3 in Ffuncall (nargs=1, args=0xbfffdc88) at eval.c:2782
#13 0x08188b01 in run_hook_with_args (nargs=1, args=0xbfffdc88, 
cond=to_completion) at eval.c:2393
#14 0x081889ea in Frun_hooks (nargs=1, args=0xbfffdd34) at eval.c:2261
#15 0x081891ae in Ffuncall (nargs=2, args=0xbfffdd30) at eval.c:2706
#16 0x08188d98 in call1 (fn=138578777, arg1=138691873) at eval.c:2519
#17 0x081267e7 in safe_run_hooks_1 (hook=138494017) at keyboard.c:2030
#18 0x0818741d in internal_condition_case (bfun=0x81267d0 <safe_run_hooks_1>, 
handlers=138494017,
    hfun=0x81267f0 <safe_run_hooks_error>) at eval.c:1335
#19 0x0812687f in safe_run_hooks (hook=138691873) at keyboard.c:2058
#20 0x0809e44a in update_menu_bar (f=0x860d4d0, save_match_data=0) at 
xdisp.c:8223
#21 0x0809e1da in prepare_menu_bars () at xdisp.c:8115
#22 0x080a0551 in redisplay_internal (preserve_echo_area=1) at xdisp.c:9781
#23 0x081baf8e in wait_reading_process_input (time_limit=0, microsecs=0, 
read_kbd=-8, do_display=1) at process.c:4284
#24 0x08129209 in kbd_buffer_get_event (kbp=0xbfffe7fc, 
used_mouse_menu=0xbfffea18) at keyboard.c:3905
#25 0x08127844 in read_char (commandflag=1, nmaps=2, maps=0xbfffe9e0, 
prev_event=138493969, used_mouse_menu=0xbfffea18)
    at keyboard.c:2846
#26 0x0812ed41 in read_key_sequence (keybuf=0xbfffeb40, bufsize=30, 
prompt=138493969, dont_downcase_last=0,
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:8823
#27 0x08124d97 in command_loop_1 () at keyboard.c:1525
#28 0x0818741d in internal_condition_case (bfun=0x8124bf0 <command_loop_1>, 
handlers=138554897,
    hfun=0x81246f0 <cmd_error>) at eval.c:1335
#29 0x08124a1b in command_loop_2 () at keyboard.c:1306
#30 0x08186f5a in internal_catch (tag=138548905, func=0x8124a00 
<command_loop_2>, arg=138493969) at eval.c:1096
#31 0x081249d7 in command_loop () at keyboard.c:1285
#32 0x08124422 in recursive_edit_1 () at keyboard.c:978
#33 0x0812456f in Frecursive_edit () at keyboard.c:1039
#34 0x08122caf in main (argc=3, argv=0xbffff154) at emacs.c:1687
(gdb) p car
$1 = 172569645
(gdb) pr
("/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/lib/user/Group.java" . 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/lib/user/Group.java")
(gdb) p cdr
$2 = 138493973
(gdb) pr
(("/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/wsrserver/WsrServer.java"
 . 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/wsrserver/WsrServer.java")
 
("/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/wsrserver/WsrServer.java.new"
 . 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/wsrserver/WsrServer.java.new"))
(gdb) p cons_free_list
$3 = (struct Lisp_Cons *) 0x11081e99
(gdb) p *cons_free_list
Cannot access memory at address 0x11081e99
(gdb) up
#1  0x081720f1 in Flist (nargs=17, args=0xbfffd680) at alloc.c:2448
2448          val = Fcons (args[nargs], val);
(gdb) p val
Variable "val" is not available.
(gdb) p args
$4 = (int *) 0xbfffd680
(gdb) p address@hidden
No symbol "aargs" in current context.
(gdb) p address@hidden
$5 = {172570021, 172569989, 172569877, 172569861, 172569837, 172569805, 
172569797, 172569749, 172569741, 172569709,
  172569701, 172569693, 172569685, 172569677, 172569669, 172569661, 172569653}
(gdb) p/x address@hidden
$6 = {0xa4935a5, 0xa493585, 0xa493515, 0xa493505, 0xa4934ed, 0xa4934cd, 
0xa4934c5, 0xa493495, 0xa49348d, 0xa49346d,
  0xa493465, 0xa49345d, 0xa493455, 0xa49344d, 0xa493445, 0xa49343d, 0xa493435}
(gdb) set $i = 0
(gdb) p *args[$i++]
$7 = 1929985652
(gdb)
$8 = 1091188607
(gdb) p/x *args[0]
$9 = 0x73093e74
(gdb) p/x **args[0]
Cannot access memory at address 0x73093e74
(gdb) p/x args[0]
$10 = 0xa4935a5
(gdb) pr
("/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/test/AllTests.java" . 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/test/AllTests.java")
(gdb) p/x args[1]
$11 = 0xa493585
(gdb) pr
("/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/lib/util/test/PropertySetTest.java"
 . 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/lib/util/test/PropertySetTest.java")
(gdb) p/x args[2]
$12 = 0xa493515
(gdb) pr
("/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/common/ResourceManager.java"
 . 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/common/ResourceManager.java")
(gdb) p/x args[3]
$13 = 0xa493505
(gdb) pr
("/proc/cpuinfo" . "/proc/cpuinfo")
(gdb) p/x args[4]
$14 = 0xa4934ed
(gdb) pr
("/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/user/GroupManager.java"
 . 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/user/GroupManager.java")

I then attempted to print "fun" from stack frame 5 and got a
(seemingly) infinite stream of byte codes.  After interrupting the
print I tried:

#5  Fcons (car=172569645, cdr=138493973) at alloc.c:2371
2371       cons_free_list = *(struct Lisp_Cons **)&cons_free_list->cdr;
Current language:  auto; currently c
(gdb) up
#6  0x081720f1 in Flist (nargs=17, args=0xbfffd680) at alloc.c:2448
2448       val = Fcons (args[nargs], val);
(gdb) up
#7  0x0819275b in Fmapcar (function=143730905, sequence=172570437) at fns.c:3051
3051   ret = Flist (leni, args);
(gdb) up
#8  0x08189180 in Ffuncall (nargs=3, args=0xbfffd770) at eval.c:2736
2736    val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1],
(gdb) up
#9  0x081b4639 in Fbyte_code (bytestr=143745419, vector=143747828, maxdepth=72) 
at bytecode.c:689
689      TOP = Ffuncall (op + 1, &TOP);
(gdb) down
#8  0x08189180 in Ffuncall (nargs=3, args=0xbfffd770) at eval.c:2736
2736    val = (*XSUBR (fun)->function) (internal_args[0], internal_args[1],
(gdb) p args[0]
$16 = 138584041
(gdb) pr
mapcar
(gdb) args[1]
Undefined command: "args".  Try "help".
(gdb) p args[1]
$17 = 143730905
(gdb) pr
recentf-make-default-menu-element
(gdb) p args[2]
$18 = 172570437
(gdb) pr
("/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/test/AllTests.java" 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/lib/util/test/PropertySetTest.java"
 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/common/ResourceManager.java"
 "/proc/cpuinfo" 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/user/GroupManager.java"
 
"/home/mecklen/work/trunk/wsr/test/com/realmsys/testtool/FileTreeBuilderTest.java"
 "/home/mecklen/work/trunk/wsr/test/com/realmsys/testtool/FileTreeBuilder.java" 
"/home/mecklen/work/trunk/wsr/test/com/realmsys/wsr/lib/user/DeviceTest.java" 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/device/DeviceManager.java"
 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/user/UserManager.java"
 "/home/mecklen/work/trunk/wsr/common.mk" 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/device/test/DeviceManagerTest.java"
 "/home/mecklen/work/trunk/wsr/TAGS" "/home/mecklen/work/trunk/wsr/Makefile" 
"/home/mecklen/work/trunk/ws!
 r/src/com/realmsys/wsr/lib/user/Device.java" 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/lib/util/MacAddress.java" 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/lib/user/User.java" 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/lib/user/Group.java" 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/wsrserver/WsrServer.java"
 
"/home/mecklen/work/trunk/wsr/src/com/realmsys/wsr/server/wsrserver/WsrServer.java.new")


In GNU Emacs 21.3.50.1 (i686-pc-linux-gnu, GTK+ Version 2.2.4)
 of 2004-07-22 on oops.realmsys.com
configured using `configure '--with-x11' '--with-x-toolkit=gtk''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: en_US
  value of $LC_CTYPE: en_US
  value of $LC_MESSAGES: en_US
  value of $LC_MONETARY: en_US
  value of $LC_NUMERIC: en_US
  value of $LC_TIME: en_US
  value of $LANG: en_US
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Major mode: WorkLog

Minor modes in effect:
  show-paren-mode: t
  auto-image-file-mode: t
  recentf-mode: t
  auto-compression-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-p C-p C-p C-p C-p C-p C-SPC C-n C-n C-n C-n C-n C-n 
C-w C-x C-s C-a C-x o C-x o <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <menu-bar> <help-menu> 
<report-emacs-bug>

Recent messages:
cause of the error in your initialization file.  Start Emacs with
the `--debug-init' option to view a complete error backtrace.

Starting the BeanShell. Please wait...
Loading semantic-el...done
Loading jit-lock...done
Mark set [3 times]
Loading mule-util...done
Wrote /home/mecklen/.worklog
Loading emacsbug...done


-- 
Robert