segfault in read_process_output() during vc-diff

[Tim Van Holder]

I was committing a set of changes using vc-directory, and v-= caused
the emacs window to disappear.  Re-ran from the commandline, crash was
reproducible as a segfault.  Re-ran under debugger; emacs opens the diff
window just fine, then a SIGSEGV gets flagged in bcopy(), called at line
5144 of process.c. I have been unable to reproduce the crash on anything
other than this single file - all other files can be compared using
vc-diff just fine.

xbacktrace produces no output

bt full output:

#0  0x40895af0 in bcopy () from /lib/libc.so.6
No symbol table info available.
#1  0x081864d4 in read_process_output (proc=143372852, channel=<value optimized 
out>) at /home/tim/gnu/src/emacs/src/process.c:5144
        odeactivate = 137457249
        text = 142872947
        outer_running_asynch_code = 0
        waiting = -1
        nbytes = <value optimized out>
        outstream = 137502441
        old = (struct buffer *) 0x88fb2b8
        p = (struct Lisp_Process *) 0x88bb230
        opoint = <value optimized out>
        coding = (struct coding_system *) 0x88fb4c0
        carryover = -1316
#2  0x08186fd1 in status_notify (deleting_process=0x0) at 
/home/tim/gnu/src/emacs/src/process.c:6673
        symbol = -1073755192
        p = (struct Lisp_Process *) 0x88bb230
        proc = 143372852
        buffer = 141303252
        tail = 143398469
        msg = 137457249
#3  0x0818b623 in wait_reading_process_output (time_limit=30, microsecs=0, 
read_kbd=-1, do_display=1, wait_for_cell=137457249,
    wait_proc=0x0, just_wait_proc=0) at 
/home/tim/gnu/src/emacs/src/process.c:4433
        p = <value optimized out>
        timeout_reduced_for_timers = 1
        channel = <value optimized out>
        nfds = 1
        Available = {
  fds_bits = {0 <repeats 32 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = <value optimized out>
        no_avail = 0
        xerrno = 0
        proc = <value optimized out>
        timeout = {
  tv_sec = 0,
  tv_usec = 0
}
        end_time = {
  tv_sec = 1162904382,
  tv_usec = 390963
}
        wait_channel = -1
        got_some_input = 1
#4  0x08055a76 in sit_for (timeout=240, reading=1, do_display=1) at 
/home/tim/gnu/src/emacs/src/dispnew.c:6539
        sec = 30
        usec = 0
#5  0x080ff1a6 in read_char (commandflag=1, nmaps=2, maps=0xbfffd130, 
prev_event=137457249, used_mouse_menu=0xbfffd1d8,
    end_time=0x0) at /home/tim/gnu/src/emacs/src/keyboard.c:2878
        tem0 = <value optimized out>
        delay_level = 30
        buffer_size = <value optimized out>
        c = 137457249
        local_getcjmp = {{
    __jmpbuf = {0, 140418600, 0, -1073753880, -1073754400, 135259140},
    __mask_was_saved = 0,
    __saved_mask = {
      __val = {3221213152, 0, 8, 3221213212, 143635132, 3221213432, 135606992, 
137501457, 8, 143635132, 0, 0, 0, 0, 0, 0, 0, 0, 0,
        8, 143635132, 3221213336, 135903736, 143635128, 0, 0, 0, 0, 0, 0, 1, 
137744121}
    }
  }}
        save_jump = {{
    __jmpbuf = {0, 0, 0, 0, 0, 0},
    __mask_was_saved = 0,
    __saved_mask = {
      __val = {0 <repeats 32 times>}
    }
  }}
        key_already_recorded = 0
        tem = <value optimized out>
        save = <value optimized out>
        previous_echo_area_message = 137457249
        also_record = 137457249
        reread = 0
        polling_stopped_here = <value optimized out>
#6  0x08101042 in read_key_sequence (keybuf=0xbfffd284, bufsize=30, 
prompt=137457249, dont_downcase_last=0,
    can_return_switch_frame=1, fix_current_buffer=1) at 
/home/tim/gnu/src/emacs/src/keyboard.c:8969
        interrupted_kboard = (KBOARD *) 0x85e9e28
        key = 143635132
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 137457249
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 2
        nmaps_allocated = 2
        defs = (Lisp_Object * volatile) 0xbfffd110
        submaps = (Lisp_Object * volatile) 0xbfffd130
        orig_local_map = 143410325
        orig_keymap = 137457249
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 137444693,
  map = 137444693,
  start = 0,
  end = 0
}
        keytran = {
  parent = 138247413,
  map = 138247413,
  start = 0,
  end = 0
}
        delayed_switch_frame = 137457249
        original_uppercase = 0
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x88fb2b8
        fake_prefixed_keys = 137457249
#7  0x08102af5 in command_loop_1 () at 
/home/tim/gnu/src/emacs/src/keyboard.c:1603
        cmd = <value optimized out>
        lose = <value optimized out>
        nonundocount = 0
        keybuf = {944, 488, 800, 137457249, 137688152, -1073753336, 135255141, 
137761725, -1073753398, 1082354744, -1073753336,
  1073772869, 1082379797, -1073753398, 0, 0, 134526920, 100708640, 134538368, 
0, -1073753368, -1073753520, 0, 1082327040,
  137457249, 139482529, 0, 137688168, 137688152, -1073753336}
        i = <value optimized out>
        prev_modiff = 9128
        prev_buffer = (struct buffer *) 0x886f528
        was_locked = 0
        already_adjusted = 0
#8  0x0815874b in internal_condition_case (bfun=0x8102960 <command_loop_1>, 
handlers=137501937, hfun=0x80fd370 <cmd_error>)
    at /home/tim/gnu/src/emacs/src/eval.c:1481
        val = <value optimized out>
        c = {
  tag = 137457249,
  val = 137457249,
  next = 0xbfffd430,
  gcpro = 0x0,
  jmp = {{
      __jmpbuf = {0, 137688168, 137688152, -1073753096, -1073753328, 135628531},
      __mask_was_saved = 0,
      __saved_mask = {
        __val = {16, 4294967295, 3221214192, 1073833208, 134538368, 110932256, 
16777216, 0 <repeats 19 times>, 1082354744,
          1081862696, 1073831924, 1073833208, 1, 3221214208}
      }
    }},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 1,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
  handler = 137501937,
  var = 137457249,
  chosen_clause = 137457297,
  tag = 0xbfffd31c,
  next = 0x0
}
#9  0x080fc74e in command_loop_2 () at 
/home/tim/gnu/src/emacs/src/keyboard.c:1326
        val = -1316
#10 0x0815880c in internal_catch (tag=137498145, func=0x80fc720 
<command_loop_2>, arg=137457249)
    at /home/tim/gnu/src/emacs/src/eval.c:1222
        c = {
  tag = 137498145,
  val = 137457249,
  next = 0x0,
  gcpro = 0x0,
  jmp = {{
      __jmpbuf = {0, 137688168, 137688152, -1073752840, -1073753056, 135628799},
      __mask_was_saved = 0,
      __saved_mask = {
        __val = {134523496, 8144949, 134537553, 225011984, 40, 1081862696, 
1082323848, 1082358728, 1082379992, 0, 0, 16765696,
          1084245604, 0, 1074387192, 135814576, 137641386, 137639744, 
137641384, 3221214424, 135573406, 137639745, 137641386,
          137457249, 137489112, 137457273, 2, 3221214440, 0, 137639745, 1, 
3221214488}
      }
    }},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 1,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
#11 0x080fd1be in command_loop () at /home/tim/gnu/src/emacs/src/keyboard.c:1305
No locals.
#12 0x080fd548 in recursive_edit_1 () at 
/home/tim/gnu/src/emacs/src/keyboard.c:1003
        val = <value optimized out>
#13 0x080fd636 in Frecursive_edit () at 
/home/tim/gnu/src/emacs/src/keyboard.c:1064
        buffer = <value optimized out>
#14 0x080f36f2 in main (argc=Cannot access memory at address 0x3fffa317
) at /home/tim/gnu/src/emacs/src/emacs.c:1794
        tz = 0x0
        dummy = -1073751848
        stack_bottom_variable = 8 '\b'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608,
  rlim_max = 18446744073709551615
}
        no_loadup = 0
        junk = 0x0


In GNU Emacs 22.0.90.1 (i686-pc-linux-gnu, GTK+ Version 2.8.20)
 of 2006-11-07 on leeloo
X server distributor `RealVNC Ltd', version 11.0.3370
configured using `configure '--with-gtk' '--with-xpm' '--with-jpeg' 
'--with-gif' '--with-tiff' '--with-png' '--with-x' '--with-kerberos' 
'--with-kerberos5''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  whitespace-global-mode: t
  show-paren-mode: t
  pc-selection-mode: t
  display-time-mode: t
  delete-selection-mode: t
  tooltip-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x r e p o r t - <tab> <return>

Recent messages:
Loading time...done
Loading pc-select...done
Loading paren...done
Loading whitespace...done
Loading advice...done
Loading /home/tim/.custom.el (source)...done
Loading /usr/local/share/emacs/site-lisp/nxml-mode-20041004/rng-auto.el 
(source)...done
Loading whitespace...done
Loading server...done
Loading emacsbug...done