bug#1650: 23.0.60; raw-text-dos memory corruption

bug#1650: 23.0.60; raw-text-dos memory corruption

[Chong Yidong]

> emacs -Q
>
>   ;; dictd is running on port 2628
>   (let* ((coding-system-for-read 'raw-text-dos)
>          (coding-system-for-write 'raw-text-dos)
>          (proc (open-network-stream "foo" "foo" "localhost" 2628)))
>     ;; The crash goes away if the next line is uncommented
>     ;; (sit-for .1)
>     (process-send-string proc "define * \"vice\"\r\n"))
>
> => Crash (backtrace below)

I can't reproduce this.  Do you still see the bug with latest CVS?

bug#1650: 23.0.60; raw-text-dos memory corruption

[Johan =?UTF-8?Q?Bockg=C3=A5rd]

Chong Yidong <cyd@stupidchicken.com> writes:

>> emacs -Q
>>
>>   ;; dictd is running on port 2628
>>   (let* ((coding-system-for-read 'raw-text-dos)
>>          (coding-system-for-write 'raw-text-dos)
>>          (proc (open-network-stream "foo" "foo" "localhost" 2628)))
>>     ;; The crash goes away if the next line is uncommented
>>     ;; (sit-for .1)
>>     (process-send-string proc "define * \"vice\"\r\n"))
>>
>> => Crash (backtrace below)
>
> I can't reproduce this.  Do you still see the bug with latest CVS?

Yes.

Note that a similar crash was reported in the following message:

Subject: core dump in malloc
http://lists.gnu.org/archive/html/emacs-devel/2009-02/msg00449.html

bug#1650: 23.0.60; raw-text-dos memory corruption

[Chong Yidong]

> emacs -Q
>
>   ;; dictd is running on port 2628
>   (let* ((coding-system-for-read 'raw-text-dos)
>          (coding-system-for-write 'raw-text-dos)
>          (proc (open-network-stream "foo" "foo" "localhost" 2628)))
>     ;; The crash goes away if the next line is uncommented
>     ;; (sit-for .1)
>     (process-send-string proc "define * \"vice\"\r\n"))
>
> => Crash (backtrace below)

I haven't been able to reproduce this.  Can anyone on this list
reproduce this?  If so, please try to debug it.

bug#1650: 23.0.60; raw-text-dos memory corruption

[Johan =?UTF-8?Q?Bockg=C3=A5rd]

Chong Yidong <cyd@stupidchicken.com> writes:

> I haven't been able to reproduce this. Can anyone on this list
> reproduce this? If so, please try to debug it.

Ok, I've found a rather minimal recipe.


Start one Emacs and evaluate the following:

    (make-network-process
     :name "foo" :server t
     :host "localhost" :service 8888
     :sentinel (lambda (proc stat)
                 (when (string-match "^open from" stat)
                   (process-send-string proc (make-string 5000 ?\r)))))

Start a second Emacs and run this:

    (let* ((coding-system-for-read 'raw-text-dos))
      (open-network-stream "foo" "foo" "localhost" 8888))

bug#1650: 23.0.60; raw-text-dos memory corruption

[Andreas Schwab]

I've checked in a fix.

Andreas.

-- 
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

bug#1650: 23.0.60; raw-text-dos memory corruption

[Johan =?UTF-8?Q?Bockg=C3=A5rd]

GNU Emacs 23.0.60.12 (x86_64-unknown-linux-gnu, GTK+ Version 2.14.4) of
2008-12-20

emacs -Q

  ;; dictd is running on port 2628
  (let* ((coding-system-for-read 'raw-text-dos)
         (coding-system-for-write 'raw-text-dos)
         (proc (open-network-stream "foo" "foo" "localhost" 2628)))
    ;; The crash goes away if the next line is uncommented
    ;; (sit-for .1)
    (process-send-string proc "define * \"vice\"\r\n"))

=> Crash (backtrace below)

I can reproduce the crash on Emacs versions after 2008-03-25, whereas I
don't see the problem on versions before 2008-03-02. Intermediate
versions don't crash, but instead hang and consume all memory.


2008-03-25  Stefan Monnier  <monnier@iro.umontreal.ca>

        [...]

	* process.h (struct Lisp_Process): Remove filter_multibyte.
	* process.c (QCfilter_multibyte): Remove.
	(setup_process_coding_systems): Don't use filter_multibyte.
	(Fstart_process, Fmake_network_process): Don't set filter_multibyte.
	(read_process_output): Don't adjust multibyteness to filter_multibyte.
	(Fset_process_filter_multibyte): Change the coding-system to
	approximate the previous behavior.
	(Fprocess_filter_multibyte_p): Get the multibyteness straight from the
	coding-system.

	* coding.c (decode_coding_object): When not decoding into a buffer,
	obey the coding system's preference of (uni|multi)byte.


2008-03-02  Kenichi Handa  <handa@m17n.org>

	* coding.c (decode_coding_utf_8): When eol-type of CODING is
	`dos', don't decode '\r' if that is the last in the source.
	(decode_coding_utf_16, decode_coding_emacs_mule)
	(decode_coding_iso_2022, decode_coding_sjis, decode_coding_big5)
	(decode_coding_raw_text, decode_coding_charset): Likewise.
	(produce_chars): Don't decode EOL here.  Use EMACS_INT.


*** glibc detected *** /home/bojohan/vc/emacs/src/emacs: malloc(): memory corruption: 0x00000000022f83e0 ***
======= Backtrace: =========
/lib/libc.so.6[0x7f4f73ed2cff]
/lib/libc.so.6(__libc_malloc+0x98)[0x7f4f73ed4538]
/home/bojohan/vc/emacs/src/emacs[0x5497ce]
[...]

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7f4f78df7770 (LWP 7357)]
0x00007f4f73e88fd5 in raise () from /lib/libc.so.6
(gdb) bt
#0  0x00007f4f73e88fd5 in raise () from /lib/libc.so.6
#1  0x00007f4f73e8ab43 in abort () from /lib/libc.so.6
#2  0x00007f4f73ec9fa8 in ?? () from /lib/libc.so.6
#3  0x00007f4f73ed2cff in ?? () from /lib/libc.so.6
#4  0x00007f4f73ed4538 in malloc () from /lib/libc.so.6
#5  0x00000000005497ce in lisp_malloc (nbytes=7357, type=7357) at alloc.c:861
#6  0x000000000054a09a in allocate_string_data (s=0xdc7510, nchars=8136, 
    nbytes=8136) at alloc.c:1991
#7  0x000000000054ab90 in make_uninit_multibyte_string (nchars=8136, 
    nbytes=8136) at alloc.c:2508
#8  0x000000000054ac87 in make_uninit_string (length=7357) at alloc.c:2486
#9  0x00000000005587fd in make_buffer_string_both (start=1, start_byte=1, 
    end=8137, end_byte=<value optimized out>, props=1) at editfns.c:2420
#10 0x0000000000481c35 in decode_coding_object (coding=0xab4800, 
    src_object=11030241, from=0, from_byte=0, to=<value optimized out>, 
    to_byte=<value optimized out>, dst_object=11030337) at coding.c:7307
#11 0x000000000059bc8e in read_process_output (proc=16927316, channel=153)
    at process.c:5409
#12 0x000000000059f4f1 in wait_reading_process_output (time_limit=30, 
    microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=11030241, 
    wait_proc=0x0, just_wait_proc=0) at process.c:4987
#13 0x0000000000415645 in sit_for (timeout=240, reading=1, do_display=1)
    at dispnew.c:6637
#14 0x00000000004f9f75 in read_char (commandflag=1, nmaps=2, 
    maps=0x7fff80e2ecc0, prev_event=11030241, used_mouse_menu=0x7fff80e2edd4, 
    end_time=0x0) at keyboard.c:2892
#15 0x00000000004fb8dd in read_key_sequence (keybuf=0x7fff80e2ee60, 
    bufsize=30, prompt=11030241, dont_downcase_last=0, 
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9343
#16 0x00000000004fd73a in command_loop_1 () at keyboard.c:1621
#17 0x00000000005608cf in internal_condition_case (
    bfun=0x4fd520 <command_loop_1>, handlers=11117457, 
    hfun=0x4f5dd0 <cmd_error>) at eval.c:1511
#18 0x00000000004f524e in command_loop_2 () at keyboard.c:1338
#19 0x00000000005609e7 in internal_catch (tag=<value optimized out>, 
    func=0x4f5230 <command_loop_2>, arg=11030241) at eval.c:1247
#20 0x00000000004f5c10 in command_loop () at keyboard.c:1317
#21 0x00000000004f601c in recursive_edit_1 () at keyboard.c:942
#22 0x00000000004f6194 in Frecursive_edit () at keyboard.c:1004
#23 0x00000000004eb057 in main (argc=2, argv=0x7fff80e2f678) at emacs.c:1786

bug#1650: 23.0.60; raw-text-dos memory corruption

[Jason Rumney]

Johan Bockgård wrote:
> I can reproduce the crash on Emacs versions after 2008-03-25, whereas I
> don't see the problem on versions before 2008-03-02. Intermediate
> versions don't crash, but instead hang and consume all memory.
>   

This seems to be the same as bug #1035, which you reported in September, 
and which I fixed yesterday.

> 2008-03-02  Kenichi Handa  <handa@m17n.org>
>
> 	* coding.c (decode_coding_utf_8): When eol-type of CODING is
> 	`dos', don't decode '\r' if that is the last in the source.
> 	(decode_coding_utf_16, decode_coding_emacs_mule)
> 	(decode_coding_iso_2022, decode_coding_sjis, decode_coding_big5)
> 	(decode_coding_raw_text, decode_coding_charset): Likewise.
> 	(produce_chars): Don't decode EOL here.  Use EMACS_INT.
>   

bug#1650: 23.0.60; raw-text-dos memory corruption

[Johan =?UTF-8?Q?Bockg=C3=A5rd]

Jason Rumney <jasonr@f2s.com> writes:

> Johan Bockgård wrote:
>> I can reproduce the crash on Emacs versions after 2008-03-25, whereas I
>> don't see the problem on versions before 2008-03-02. Intermediate
>> versions don't crash, but instead hang and consume all memory.
>>   
>
> This seems to be the same as bug #1035, which you reported in
> September, and which I fixed yesterday.

I thought so too; that's why I haven't reported this one earlier. But it
isn't--it still crashes in the same way even after your change (which I
did notice).

-- 
Johan Bockgård