Re: emacs crashed on windows-xp

[Eli Zaretskii]

> Cc: address@hidden
> From: Zhang Wei <address@hidden>
> Date: Wed, 11 Oct 2006 17:06:19 +0800
> 
> I test my .emacs line by line and find out this problem is caused by
> this line:
> 
> (setq frame-title-format (list "%f (%l,%c) ---- @" system-name))

Now I can reproduce this, thanks.  It's some problem in redisplay; I
cannot test on GNU/Linux right now, but I think it would be a good
idea to see if it crashes there as well.

I ran Emacs under a debugger, and what I see when it crashes is shown
below.  From what I see, it looks like display_count_lines relies on
the assumption that `cursor' starts with a value that is smaller than
ceiling_addr, which in this case is false.  I didn't have enough time
to poke around and see if these conclusions are 100% correct nor why
the above assumption doesn't hold.


D:\usr\emacs\src>gdb ../bin/emacs.exe
GNU gdb 6.3
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and
you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i686-pc-mingw32"...
Environment variable "DISPLAY" not defined.
Environment variable "TERM" not defined.
Breakpoint 1 at 0x113355d: file w32fns.c, line 9037.
Breakpoint 2 at 0x1095b4b: file sysdep.c, line 1395.
(gdb) r -Q
Starting program: D:\usr\emacs\src/../bin/emacs.exe -Q

Program received signal SIGSEGV, Segmentation fault.
0x010277fb in display_count_lines (start=0, start_byte=219119,
    limit_byte=219220, count=216065, byte_pos_ptr=0x82ed5c) at
    xdisp.c:18011
18011                   while (*cursor != '\n' && ++cursor != ceiling_addr)
(gdb) l
18006               {
18007                 if (selective_display)
18008                   while (*cursor != '\n' && *cursor != 015 && ++cursor != 
ceiling_addr)
18009                     ;
18010                 else
18011                   while (*cursor != '\n' && ++cursor != ceiling_addr)
18012                     ;
18013
18014                 if (cursor != ceiling_addr)
18015                   {
(gdb) p cursor
$1 = (unsigned char *) 0x1d4f000 <Address 0x1d4f000 out of bounds>
(gdb) p selective_display
$2 = 0
(gdb) p start_byte
$3 = 219119
(gdb) p current_buffer ->text->beg
$4 = (
    unsigned char *) 0x1ceeeb0 "This is ./../info/elisp, produced by makeinfo 
version 4.8 from\n./elisp.texi.\n\nINFO-DIR-SECTION 
Emacs\nSTART-INFO-DIR-ENTRY\n* Elisp: (elisp).       The Emacs Lisp Reference 
Manual.\nEND-INFO-DIR-ENTRY\n\n"...
(gdb) p current_buffer ->text
$5 = (struct buffer_text *) 0x1b0d208
(gdb) p *current_buffer ->text
$6 = {
  beg = 0x1ceeeb0 "This is ./../info/elisp, produced by makeinfo
  version 4.8 from\n./elisp.texi.\n\nINFO-DIR-SECTION 
Emacs\nSTART-INFO-DIR-ENTRY\n*Elisp: (elisp).       The Emacs Lisp Reference 
Manual.\nEND-INFO-DIR-ENTRY\n\n"...,
  gpt = 297267,
  z = 297267,
  gpt_byte = 297267,
  z_byte = 297267,
  gap_size = 2000,
  modiff = 13442,
  chars_modiff = 9842,
  save_modiff = 13442,
  overlay_modiff = 1,
  beg_unchanged = 1371,
  end_unchanged = 245448,
  unchanged_modified = 12798,
  overlay_unchanged_modified = 1,
  intervals = 0x1c31038,
  markers = 0x1c02508
}
(gdb) p ceiling_addr
$7 = (
    unsigned char *) 0x1cfb947 "\037\nFile: elisp,  Node:
    Introduction,  Next: Lisp Data Types,  Prev: Top,  Up: Top\n\n1 
Introduction\n", '*'<repeats 14 times>, "\n\nMost of the GNU Emacs text editor 
is written in theprogramming\nlanguage called Emacs L"...
(gdb) p cursor
$8 = (unsigned char *) 0x1d4f000 <Address 0x1d4f000 out of bounds>
(gdb) p base
$9 = (
    unsigned char *) 0x1d2469e "File: elisp,  Node: Lists,  Next:
    Sequences Arrays Vectors,  Prev: Strings and Characters,  Up: 
Top\n\n5Lists\n*******\n\nA \"list\" represents a sequence of zero or more 
elements (which maybe\nany Lisp obj"...
(gdb) p limit_byte
$10 = 219220
(gdb) bt full
#0  0x010277fb in display_count_lines (start=0, start_byte=219119,
    limit_byte=219220, count=216065, byte_pos_ptr=0x82ed5c) at    xdisp.c:18011
        cursor = (unsigned char *) 0x1d4f000 <Address 0x1d4f000 out of bounds>
        base = (
    unsigned char *) 0x1d2469e "File: elisp,  Node: Lists,  Next: Sequences 
Arrays Vectors,  Prev: Strings and Characters,  Up: Top\n\n5    
Lists\n*******\n\nA \"list\" represents a sequence of zero or more elements 
(which may    be\nany Lisp obj"...
        ceiling = 0
        ceiling_addr = (
    unsigned char *) 0x1cfb947 "\037\nFile: elisp,  Node: Introduction,  Next: 
Lisp Data Types,  Prev: Top,  Up: Top\n\n1 Introduction\n", '*' <repeats 14 
times>, "\n\nMost of the GNU Emacs text editor is written in the 
programming\nlanguage called Emacs L"...
        orig_count = 219220
        selective_display = 0
#1  0x01028586 in display_mode_element (it=0x82ee60, depth=2,
    field_width=0,
    precision=-1, elt=28835299, props=23771137, risky=0) at
    xdisp.c:17769
        startpos = 219220
        startpos_byte = 219220
        line = 1
        topline = 50718
        junk = 17964708
        linepos = 30390599
        linepos_byte = 0
        nlines = 30338736
        height = 39
        obj = 30390599
        f = (struct frame *) 0x1
        decode_mode_spec_buf = 0x1b0f000 '-' <repeats 200 times>...
        w = (struct window *) 0x18d7e00
        c = 30338736
        multibyte = 0
        charpos = 5
        percent_position = 1
        last_offset = 26050048
        c = 71 'G'
        offset = 6
        n = 2
        field = 0
        prec = -3
        literal = 0
#2  0x010282fd in display_mode_element (it=0x82ee60, depth=1,
    field_width=-1,
    precision=-1, elt=28993005, props=23771137, risky=0) at
    xdisp.c:17101
        limit = 49
        car = 49
        tem = 30338736
        n = 0
        field = 29234240
        prec = 25013248
        literal = 0
#3  0x0102d309 in prepare_menu_bars () at xdisp.c:8994
        tail = 30732288
        fmt = 28993005
        title_start = 0
        len = 3
        title = 0x0
        it = {
  window = 26050052,
  w = 0x18d7e00,
  f = 0x17dac00,
  method = GET_FROM_BUFFER,
  stop_charpos = 0,
  end_charpos = 0,
  s = 0x0,
  string_nchars = 0,
  region_beg_charpos = -1,
  region_end_charpos = -1,
  redisplay_end_trigger_charpos = 0,
  multibyte_p = 1,
  header_line_p = 1,
  string_from_display_prop_p = 0,
  ellipsis_p = 0,
  dp = 0x18a4000,
  dpvec = 0x0,
  dpend = 0x0,
  dpvec_char_len = 0,
  dpvec_face_id = 0,
  saved_face_id = 0,
  ctl_chars = {0 <repeats 16 times>},
  start = {
    pos = {
      charpos = 0,
      bytepos = 0
    },
    overlay_string_index = 0,
    string_pos = {
      charpos = 0,
      bytepos = 0
    },
    dpvec_index = 0
  },
  current = {
    pos = {
      charpos = 0,
      bytepos = 0
    },
    overlay_string_index = -1,
    string_pos = {
      charpos = -1,
      bytepos = -1
    },
    dpvec_index = -1
  },
  overlay_strings = {0 <repeats 16 times>},
  n_overlay_strings = 0,
  string = 23771137,
  stack = {{
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0,
          c = 0,
          len = 0,
          cmp_id = 0,
          cmp_len = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      space_width = 0,
      font_height = 0,
      voffset = 0
    }, {
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0,
          c = 0,
          len = 0,
          cmp_id = 0,
          cmp_len = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      space_width = 0,
      font_height = 0,
      voffset = 0
    }, {
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0,
          c = 0,
          len = 0,
          cmp_id = 0,
          cmp_len = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      space_width = 0,
      font_height = 0,
      voffset = 0
    }, {
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0,
          c = 0,
          len = 0,
          cmp_id = 0,
          cmp_len = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      space_width = 0,
      font_height = 0,
      voffset = 0
    }},
  sp = 0,
  selective_display_ellipsis_p = 1,
  ctl_arrow_p = 1,
  selective = 0,
  what = IT_CHARACTER,
  face_id = 0,
  face_box_p = 0,
  start_of_box_run_p = 0,
  end_of_box_run_p = 0,
  overlay_strings_at_end_processed_p = 0,
  ignore_overlay_strings_at_pos_p = 0,
  glyph_not_available_p = 0,
  starts_in_middle_of_char_p = 0,
  face_before_selective_p = 0,
  constrain_row_ascent_descent_p = 0,
  base_face_id = 0,
  c = 0,
  len = 0,
  cmp_id = 0,
  cmp_len = 0,
  char_to_display = 0,
  image_id = 0,
  slice = {
    x = 23771137,
    y = 23771137,
    width = 23771137,
    height = 23771137
  },
  space_width = 23771137,
  voffset = 0,
  font_height = 23771137,
  object = 0,
  position = {
    charpos = 0,
    bytepos = 0
  },
  truncate_lines_p = 0,
  tab_width = 8,
  truncation_pixel_width = 0,
  continuation_pixel_width = 0,
  first_visible_x = 0,
  last_visible_x = 640,
  last_visible_y = 608,
  extra_line_spacing = 0,
  max_extra_line_spacing = 0,
  override_ascent = -1,
  override_descent = 0,
  override_boff = 0,
  glyph_row = 0x0,
  area = TEXT_AREA,
  nglyphs = 0,
  pixel_width = 0,
  ascent = 0,
  descent = 0,
  max_ascent = 0,
  max_descent = 0,
  phys_ascent = 0,
  phys_descent = 0,
  max_phys_ascent = 0,
  max_phys_descent = 0,
  current_x = 0,
  continuation_lines_width = 0,
  current_y = 16,
  first_vpos = 0,
  vpos = 0,
  hpos = 0,
  left_user_fringe_bitmap = 0,
  right_user_fringe_bitmap = 0,
  left_user_fringe_face_id = 0,
  right_user_fringe_face_id = 0
}
        tail = 25942093
        frame = 0
        gcpro1 = {
  next = 0x1b08800,
  var = 0x0,
  nvars = 5
}
        gcpro2 = {
  next = 0x1,
  var = 0x18d7e00,
  nvars = 8581620
}
        f = (struct frame *) 0x17dac00
        tooltip_frame = 23771137
#4  0x0102e0ab in redisplay_internal (preserve_echo_area=0) at
    xdisp.c:10938
        w = (struct window *) 0x18d7e00
        f = (struct frame *) 0x16ab801
        pause = 0
        must_finish = 0
        tlbufpos = {
  charpos = 8,
  bytepos = 8
}
        tlendpos = {
  charpos = 8,
  bytepos = 8
}
        number_of_visible_frames = 1
        polling_stopped_here = 0
        consider_all_windows_p = 8
#5  0x010593b7 in read_char (commandflag=1, nmaps=3, maps=0x82fb40,
    prev_event=23771137, used_mouse_menu=0x82fb88, end_time=0x0)
    at keyboard.c:2631
        c = 23771137
        count = 23771137
        jmpcount = 23771137
        local_getcjmp = {28365316, 13072, 13072, 17595057, 28365312,
    23771137,
  8583896, 1, 1, 297266, 8583896, 23771137, 28365316, 28365312,
    24549152,
  17323362}
        save_jump = {23771137, 102, 8583832, 16831993, 1, 8583840,
    23820361,
  1, 23771137, 23834841, 8583848, 23771137, 23923385, 23754957,
    8583880,
  23771137}
        key_already_recorded = 0
        tem = 25013248
        save = 23771137
        previous_echo_area_message = 23771137
        also_record = 23771137
        reread = 0
        gcpro1 = {
  next = 0x18b0000,
  var = 0x0,
  nvars = 8583816
}
        gcpro2 = {
  next = 0x16ab801,
  var = 0x16bb0d9,
  nvars = 28365316
}
        polling_stopped_here = 0
#6  0x0105aa58 in read_key_sequence (keybuf=0x82fcb0, bufsize=30,
    prompt=23771137, dont_downcase_last=0, can_return_switch_frame=1,
    fix_current_buffer=1) at keyboard.c:8956
        key = 23754957
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 23771137
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 3
        nmaps_allocated = 3
        defs = (Lisp_Object * volatile) 0x82fb20
        submaps = (Lisp_Object * volatile) 0x82fb40
        orig_local_map = 25916205
        orig_keymap = 23771137
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 23755125,
  map = 23755125,
  start = 0,
  end = 0
}
        keytran = {
  parent = 24730637,
  map = 24730637,
  start = 0,
  end = 0
}
        delayed_switch_frame = 23771137
        original_uppercase = 1
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x1b0d200
        fake_prefixed_keys = 23771137
        gcpro1 = {
  next = 0x1b0d200,
  var = 0x662,
  nvars = 8584184
}
#7  0x0105c22f in command_loop_1 () at keyboard.c:1601
        cmd = 220062
        lose = 220062
        nonundocount = 0
        keybuf = {936, 840, 0, 8584740, 12, 0, 2, 12, 0, 2, 8661360,
    0,
  8584772, 0, 0, 0, 0, 0, 0, 0, 0, 8584364, 8584192, 0, 0, 0, 0, 0, 0,
    0}
        i = 1
        prev_modiff = 12798
        prev_buffer = (struct buffer *) 0x1b0d200
        already_adjusted = 0
#8  0x0100a2f7 in internal_condition_case (bfun=0x105c09e
    <command_loop_1>,
    handlers=23835321, hfun=0x1056238 <cmd_error>) at eval.c:1477
        val = 0
        c = {
  tag = 23771137,
  val = 23771137,
  next = 0x82fe30,
  gcpro = 0x0,
  jmp = {8584696, 0, 19644835, 1, 8584524, 16818852, 8585184, 0,
    8584760, 4,
    8584648, 8584772, 0, 0, 8584952, 17391167},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
  handler = 23835321,
  var = 23771137,
  chosen_clause = 2,
  tag = 0x82fd80,
  next = 0x0
}
#9  0x010505f6 in command_loop_2 () at keyboard.c:1326
        val = 0
#10 0x0100a22c in internal_catch (tag=23829553,
    func=0x10505d3 <command_loop_2>, arg=23771137) at eval.c:1218
        c = {
  tag = 23829553,
  val = 23771137,
  next = 0x0,
  gcpro = 0x0,
  jmp = {8584872, 0, 19644835, 1, 8584732, 16818706, 8585184, 0,
    23991345,
    23990562, 23771137, 23809024, 0, 0, 0, 23771137},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 0,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        tag = 0
#11 0x01050443 in command_loop () at keyboard.c:1305
        val = 0
#12 0x010504d7 in recursive_edit_1 () at keyboard.c:1003
        val = 0
#13 0x010505bc in Frecursive_edit () at keyboard.c:1064
        buffer = 30338736
#14 0x01002a2a in main (argc=2, argv=0xa26cf8) at emacs.c:1794
        dummy = 0
        stack_bottom_variable = 119 'w'
        do_initial_setlocale = 1
        skip_args = 0
        no_loadup = 0
        junk = 0x0
(gdb) xbacktrace
(gdb)