Re: segfault in read_process_output() during vc-diff

[Tim Van Holder]

On 11/10/06, Kenichi Handa <address@hidden> wrote:
> In article <address@hidden>, "Tim Van Holder" <address@hidden> writes:
> [...]
> > p->decoding_carryover and p->encoding_carryover are both 0.
>
> > I added some printfs ro read_process_output, in case they're of any help:
> [...]
> > ** (coding.c:6365) decode_coding_string() set coding->consumed to 0
> > ** (coding.c:6384) decode_coding_string() set coding->consumed to 2374
> > + decode_coding_string() on a 1058-byte unibyte string set
> > coding->consumed to 2374
> > + set carryover = nbytes - coding->consumed = 1058 - 2374 = -1316
>
> > So it seems that decode_coding_string() arrives at an overly large
> > coding->consumed when
> > adding shrinked_bytes.
>
> As decode_coding_string has not been changed for years, it's
> very surprising that it contains such a bug.  Could you try
> the same operation while setting break point as this?
>
> (gdb) br coding.c:6273
> (gdb) cond NN to_byte==1058    <- NN is the index number of the break point
>
> This stops execution at this line
>
>   if (require_decoding && coding->type != coding_type_ccl)

This initially didn't work, turns out the current date/time is
involved somewhere, and today's the 10th, so it's 1 byte more :D

> only when to_byte is 1058 (that should be the case that a
> bug happens in decode_coding_string).  When stopped, please
> execute the code one line by one by `n' command while
> checking the values of coding->consumed and shrinked_bytes.

It seems that something VERY strange is going on - if I single-step,
the bcopy segfault
gets reported at semi-random places (i.e. not at the bcopy call site).
For example:

Breakpoint 3, decode_coding_string (str=143504059, coding=0x88361c0,
nocopy=0) at /home/tim/gnu/src/emacs/src/coding.c:6273
6273      if (require_decoding && coding->type != coding_type_ccl)
(gdb) p to_byte
$7 = 1059
(gdb) p coding->consumed
$8 = 4096
(gdb) p shrinked_bytes
$9 = 0
(gdb) next

Program received signal SIGSEGV, Segmentation fault.
0x40895af0 in bcopy () from /lib/libc.so.6

Could threading stuff be involved somehow? I only see a single thread
creation at startup,
but this does point in that direction.

In any case, I added a bunch of printfs instead, starting at line
6273. These yield:
(coding.c:6274) to_byte=1059 coding->consumed=4096 shrinked_bytes=0
(coding.c:6276) to_byte=1059 coding->consumed=4096 shrinked_bytes=0
(coding.c:6279) to_byte=1059 coding->consumed=4096 shrinked_bytes=2375
(coding.c:6308) to_byte=1059 coding->consumed=0 shrinked_bytes=2375
(coding.c:6365) to_byte=1059 coding->consumed=0 shrinked_bytes=2375
(coding.c:6383) to_byte=1059 coding->consumed=0 shrinked_bytes=2375
(coding.c:6384) to_byte=1059 coding->consumed=2375 shrinked_bytes=2375