Crash with bad pointer in fringe_bitmaps

[Juri Linkov]

Emacs crashed in draw_fringe_bitmap_1.  I hope this crash is
not related to possible memory corruption, and the debug session
below will help to find the bug.

In GNU Emacs 22.0.50 (i686-pc-linux-gnu) of 2005-03-01

Program received signal SIGSEGV, Segmentation fault.
draw_fringe_bitmap_1 (w=0xa67bff8, row=0x8f0b548, left_p=0, overlay=149992776,
    which=8224) at fringe.c:563
563       period = fb->period;
(gdb) bt
#0  draw_fringe_bitmap_1 (w=0xa67bff8, row=0x8f0b548, left_p=0,
    overlay=149992776, which=8224) at fringe.c:563
#1  0x080d825a in draw_fringe_bitmap (w=0xa67bff8, row=0x8f0b548, left_p=0)
    at fringe.c:699
#2  0x08080130 in notice_overwritten_cursor (w=0xa67bff8, area=TEXT_AREA,
    x0=0, x1=149992776, y0=0, y1=10) at xdisp.c:20250
#3  0x0807ba37 in draw_glyphs (w=0xa67bff8, x=339, row=0xab94760,
    area=TEXT_AREA, start=0, end=55, hl=DRAW_NORMAL_TEXT, overlaps_p=0)
    at xdisp.c:18572
#4  0x0807f6c3 in x_write_glyphs (start=0xa67bff8, len=55) at xdisp.c:19856
#5  0x08053b03 in update_text_area (w=0xa67bff8, vpos=0) at dispnew.c:4288
#6  0x0805406f in update_window_line (w=0xa67bff8, vpos=0,
    mouse_face_overwritten_p=0x10) at dispnew.c:4512
#7  0x0805376f in update_window (w=0xa67bff8, force_p=1) at dispnew.c:4154
#8  0x080532b9 in update_window_tree (w=0xa67bff8, force_p=0) at dispnew.c:3897
#9  0x08053267 in update_window_tree (w=0x8dce368, force_p=0) at dispnew.c:3893
#10 0x08053191 in update_frame (f=0x84f7690, force_p=0, inhibit_hairy_id_p=16)
    at dispnew.c:3829
#11 0x0806dbb5 in redisplay_internal (preserve_echo_area=0) at xdisp.c:10465
#12 0x0806cab2 in redisplay () at xdisp.c:9667
#13 0x080e7e45 in read_char (commandflag=1, nmaps=4, maps=0xbffff2bc,
    prev_event=137350425, used_mouse_menu=0xbffff2f8) at keyboard.c:2544
#14 0x080ee524 in read_key_sequence (keybuf=0xbffff420, bufsize=30,
    prompt=137350425, dont_downcase_last=0, can_return_switch_frame=1,
    fix_current_buffer=1) at keyboard.c:8803
#15 0x080e4d43 in command_loop_1 () at keyboard.c:1538
#16 0x08145e2e in internal_condition_case (bfun=0x80e4bb0 <command_loop_1>,
    handlers=137411417, hfun=0x80e46a0 <cmd_error>) at eval.c:1385
#17 0x080e49fe in command_loop_2 () at keyboard.c:1319
#18 0x0814596b in internal_catch (tag=16, func=0x80e49d0 <command_loop_2>,
    arg=137350425) at eval.c:1144
#19 0x080e49a3 in command_loop () at keyboard.c:1298
#20 0x080e4404 in recursive_edit_1 () at keyboard.c:991
#21 0x080e4541 in Frecursive_edit () at keyboard.c:1052
#22 0x080e2aad in main (argc=1, argv=0xbffffaa4) at emacs.c:1766
(gdb) p fb->period
Cannot access memory at address 0x10
(gdb) p fb
$1 = (struct fringe_bitmap *) 0x10
(gdb) p which
$2 = 8224
(gdb) p fringe_bitmaps[which]
$3 = (struct fringe_bitmap *) 0x10
(gdb) p fringe_bitmaps[8224]
$4 = (struct fringe_bitmap *) 0x10
(gdb) p fringe_bitmaps[8223]
$5 = (struct fringe_bitmap *) 0x8387380
(gdb) p fringe_bitmaps[8225]
$6 = (struct fringe_bitmap *) 0x826ea43
(gdb) i args
w = (struct window *) 0xa67bff8
row = (struct glyph_row *) 0x8f0b548
left_p = 0
overlay = 149992776
which = 8224
(gdb) p row->right_fringe_bitmap
$7 = 8224
(gdb) p row->left_fringe_bitmap
$8 = 8224

-- 
Juri Linkov
http://www.jurta.org/emacs/