bug#17771: 24.3.91; SIGSEGV in cleanup_vector

[Stephen Berman <stephen.berman@gmx.net>]

On Fri, 13 Jun 2014 16:58:32 +0300 Eli Zaretskii <eliz@gnu.org> wrote:

>> > IOW, the font driver is NULL.
>> 
>> Could that be due to my typing `C-g'?
>
> It evidently is.  My current theory is that the font driver was not
> fully set up, before Emacs got interrupted by C-g.
>
>> If I don't do that, the file does get displayed.  But `C-g'
>> shouldn't make Emacs crash.  Do you see what the problem is, or can
>> I provide further information?
>
> The immediate problem is clearly that we dereference a NULL pointer.
>
> I installed a trivial workaround for that in r117235 on the emacs-24
> branch.  The diffs are below.  Can you try this and see if the problem
> is solved?  It's possible that the real problem is somewhere else, in
> which case you will probably see it when you apply the patch.

With the patch, Emacs still crashes with the same recipe, but the first
frame of backtrace is different (looks like not in Emacs):

Program received signal SIGSEGV, Segmentation fault.
0x0000000000c260b2 in ?? ()
(gdb) bt full
#0  0x0000000000c260b2 in ?? ()
No symbol table info available.
#1  0x00000000005aa580 in cleanup_vector (vector=0x3dd52c8)
    at ../../../../bzr/emacs/emacs-24/src/alloc.c:2935
        drv = 0x3dd5130
#2  0x00000000005aa686 in sweep_vectors ()
    at ../../../../bzr/emacs/emacs-24/src/alloc.c:2974
        total_bytes = 140737488344592
        free_this_block = false
        nbytes = 1048
        block = 0x3dd4680
        bprev = 0xbf1060
        lv = 0x6282a3 <balance_intervals+31>
        lvprev = 0xbf2070
        vector = 0x3dd52c8
        next = 0x3dd52c8
#3  0x00000000005b0141 in gc_sweep () at ../../../../bzr/emacs/emacs-24/src/alloc.c:6721
No locals.
#4  0x00000000005ae1ac in Fgarbage_collect ()
    at ../../../../bzr/emacs/emacs-24/src/alloc.c:5650
        nextb = 0x0
        stack_top_variable = 0 '\000'
        i = 1619
        message_p = true
        count = 3
        start = {tv_sec = 1402668198, tv_nsec = 144021215}
        retval = 12738738
        tot_before = 0
#5  0x00000000005374b1 in maybe_gc () at ../../../../bzr/emacs/emacs-24/src/lisp.h:4564
No locals.
#6  0x00000000005cda00 in Ffuncall (nargs=4, args=0x7fffffffd970)
    at ../../../../bzr/emacs/emacs-24/src/eval.c:2766
        fun = 5936534
        original_fun = 140737488345376
        funcar = 12765552
        numargs = 3
        lisp_numargs = 9258817
---Type <return> to continue, or q <return> to quit---
        val = 140737488345424
        internal_args = 0xc260b2
        i = 9258817
#7  0x00000000005cd6f2 in call3 (fn=12786194, arg1=20004262, arg2=9258817, arg3=12738738)
    at ../../../../bzr/emacs/emacs-24/src/eval.c:2645
        ret_ungc_val = 140737488345600
        gcpro1 = {next = 0x7fffffffd9b0, var = 0x53738f <build_string+42>, nvars = 4}
        args = {12786194, 20004262, 9258817, 12738738}
#8  0x000000000053ccef in cmd_error_internal (data=20004262, context=0x7fffffffda00 "")
    at ../../../../bzr/emacs/emacs-24/src/keyboard.c:1085
No locals.
#9  0x000000000053cc13 in cmd_error (data=20004262)
    at ../../../../bzr/emacs/emacs-24/src/keyboard.c:1054
        old_level = 12738738
        old_length = 12738738
        macroerror = "\000`\302\000\000\000\000\000F_|\001\000\000\000\000\002\000\000\000\000\000\000\000\262`\302\000\000\000\000\000\000\000\000\000\002", '\000' <repeats 11 times>, <incomplete sequence \332>
#10 0x00000000005caba1 in internal_condition_case (bfun=0x53d1ab <command_loop_1>, 
    handlers=12790306, hfun=0x53cabd <cmd_error>)
    at ../../../../bzr/emacs/emacs-24/src/eval.c:1351
        val = 20004262
        val = 5492514
        c = 0x13d5810
#11 0x000000000053cf05 in command_loop_2 (ignore=12738738)
    at ../../../../bzr/emacs/emacs-24/src/keyboard.c:1177
        val = 0
#12 0x00000000005ca3bb in internal_catch (tag=12786242, func=0x53cedf <command_loop_2>, 
    arg=12738738) at ../../../../bzr/emacs/emacs-24/src/eval.c:1118
        val = 12738738
        c = 0x13d5630
#13 0x000000000053ceb3 in command_loop ()
    at ../../../../bzr/emacs/emacs-24/src/keyboard.c:1156
No locals.
#14 0x000000000053c6b8 in recursive_edit_1 ()
    at ../../../../bzr/emacs/emacs-24/src/keyboard.c:777
        count = 1
---Type <return> to continue, or q <return> to quit---
        val = 12738738
#15 0x000000000053c825 in Frecursive_edit ()
    at ../../../../bzr/emacs/emacs-24/src/keyboard.c:848
        count = 0
        buffer = 12738738
#16 0x000000000053a857 in main (argc=2, argv=0x7fffffffdd98)
    at ../../../../bzr/emacs/emacs-24/src/emacs.c:1646
        dummy = 140737354130592
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = true
        dumping = false
        skip_args = 0
        rlim = {rlim_cur = 8720000, rlim_max = 18446744073709551615}
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x7ffff7ffe148 ""
        original_pwd = 0x0