bug#6621: Emacs crash when trying to report emacs crash

bug#6621: Emacs crash when trying to report emacs crash

[Yair F]

[-- Attachment #1: Type: text/plain, Size: 3876 bytes --]

I appologies for not sending a proper report as emacs crashes when
trying to make a report through report-emacs-bug
If you need more information, please let me know.
As I'm not too well versed in gdb, please specify exact gdb commands
you want me to run.

OS: Kubuntu 9.10
Emacs trunk bzr revision 100805
configured with:
CFLAGS="-g -Wdeclaration-after-statement -Wno-pointer-sign
-DENABLE_CHECKING=1 -DSITELOAD_PURESIZE_EXTRA=20000 -fno-crossjumping"
./configure --with-libotf --with-m17n_flt --with-xft --enable-asserts

First crash:
When trying to report with report-emacs-bug, emacs crash with the
following output:
gtkutil.c:3885: Emacs fatal error: assertion failed:
STRINGP((((((((enum Lisp_Type) (((unsigned int)
(((f->tool_bar_items)))) & ((((int) 1) << 3) - 1))) ==
Lisp_Vectorlike)) || suppress_checking ? (void) 0 : die (("assertion
failed: " "VECTORLIKEP((f->tool_bar_items))"), "gtkutil.c", 3885)),
0),(struct Lisp_Vector *) ((int) (((f->tool_bar_items)) & ~((((int) 1)
<< 3) - 1))))->contents[i * TOOL_BAR_ITEM_NSLOTS +
(TOOL_BAR_ITEM_LABEL)])
Fatal error (6)Aborted

2nd crash: When trying to load the file el-artsi.txt (Attached) emacs crash.
Attached in gdb stack trace:

(gdb) run -Q ../el-artsi.txt
Starting program: /home/yair/emacs/src/emacs/trunk/src/emacs -Q ../el-artsi.txt
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0x08178e07 in char_table_ref (table=150273685, c=4195671) at chartab.c:200
200           if (SUB_CHAR_TABLE_P (val))
(gdb) bt
#0  0x08178e07 in char_table_ref (table=150273685, c=4195671) at chartab.c:200
#1  0x08126331 in encode_char (charset=0x8857610, c=4195671) at charset.c:1779
#2  0x083ca76b in xfont_has_char (font=150273117, c=4195671) at xfont.c:949
#3  0x08332a6b in font_has_char (f=0x89f5280, font=150273117,
c=4195671) at font.c:3085
#4  0x081d4123 in fontset_find_font (fontset=147152525, c=4195671,
face=0x8c86308, id=-1, fallback=1) at fontset.c:649
#5  0x081d529d in fontset_font (fontset=147323613, c=4195671,
face=0x8c86308, id=-1) at fontset.c:767
#6  0x081d62e6 in face_for_char (f=0x89f5280, face=0x8c86308,
c=4195671, pos=150, object=142115250) at fontset.c:952
#7  0x0809c519 in get_next_display_element (it=0xbfffc338) at xdisp.c:6051
#8  0x080c48c1 in display_line (it=0xbfffc338) at xdisp.c:17400
#9  0x080bb04d in try_window (window=144659461, pos=..., flags=1) at
xdisp.c:14589
#10 0x080b9478 in redisplay_window (window=144659461,
just_this_one_p=0) at xdisp.c:14205
#11 0x080b22ad in redisplay_window_0 (window=144659461) at xdisp.c:12470
#12 0x08307583 in internal_condition_case_1 (bfun=0x80b227a
<redisplay_window_0>, arg=144659461, handlers=142097134,
hfun=0x80b2259 <redisplay_window_error>) at eval.c:1508
#13 0x080b2240 in redisplay_windows (window=144659461) at xdisp.c:12450
#14 0x080afe2f in redisplay_internal (preserve_echo_area=0) at xdisp.c:12028
#15 0x080acac9 in redisplay () at xdisp.c:11267
#16 0x0823d4a3 in read_char (commandflag=1, nmaps=2, maps=0xbfffea50,
prev_event=142115250, used_mouse_menu=0xbfffeba4, end_time=0x0) at
keyboard.c:2544
#17 0x08250b21 in read_key_sequence (keybuf=0xbfffec5c, bufsize=30,
prompt=142115250, dont_downcase_last=0, can_return_switch_frame=1,
fix_current_buffer=1) at keyboard.c:9329
#18 0x0823a996 in command_loop_1 () at keyboard.c:1618
#19 0x0830747b in internal_condition_case (bfun=0x823a0ed
<command_loop_1>, handlers=142145978, hfun=0x82397fa <cmd_error>) at
eval.c:1463
#20 0x08239cf0 in command_loop_2 (ignore=142115250) at keyboard.c:1341
#21 0x08306eb5 in internal_catch (tag=142144098, func=0x8239ccc
<command_loop_2>, arg=142115250) at eval.c:1207
#22 0x08239caa in command_loop () at keyboard.c:1320
#23 0x08238f02 in recursive_edit_1 () at keyboard.c:943
#24 0x0823941e in Frecursive_edit () at keyboard.c:1005
#25 0x08237083 in main (argc=3, argv=0xbffff3b4) at emacs.c:1778

[-- Attachment #2: el-artsi.txt --]
[-- Type: text/plain, Size: 5748 bytes --]

אל ארצי
מילים: רחל בלובשטיין 
לֹא שַׁרְתִּי לָךְ אַרְצִי,
וְלֹא פֵּאַרְתִּי שְׁמֵךְ
בַּעֲלִילוֹת גְּבוּרָה
בִּשְׁלַל קְרָבוֹת.
רַק עֵץ יָדַי נָטְעוּ
חוֹפֵי יַרְדֵּן שׁוֹקְטִים,
רַק שְׁבִיל כָּבְשׁוּ רַגְלַי
עַל פְּנֵי שָׂדוֹת.

אָכֵן דַּלָּה מְאוֹד,
יָדַעְתִּי זֹאת, הָאֵם,
אָכֵן דַּלָּה מְאוֹד
מִנְחַת בִּתֵּךְ.
רַק קוֹל תְּרוּעַת הַגִּיל
בְּיוֹם יִגַּהּ הָאוֹר,
רַק בְּכִי בַּמִּסְתָּרִים
עֲלֵי עָנְיֵךְ.

שיר ערש לאלישבע
מילים: מרים ילן־שטקליס

הַבֻּבָּה שֶׁלִּי גְּדוֹלָה,
שֵׁם יָפֶה קָרָאתִי לָהּ,
לָהּ קָרָאתִי אֱלִישֶׁבַע.
לוּלִי לוּלִי...

בֻּבָּתִי צְרִיכָה לִישֹׁן,
כָּךְ אָמַר לִי הַשָּׁעוֹן.
הוּא אָמַר לִי: כְּבָר וָרֶבַע!
לוּלִי לוּלִי...

נוּמִי, נוּמִי, בֻּבָּתִי,
אֱלִישֶׁבַע, אַתְּ בִּתִּי,
נוּמִי, נוּמִי, נוּמִי...
לוּלִי לוּלִי...

גַּם אֲנִי אֶשְׁכַּב לִישֹׁן...
טִיק-טיִק-טַק אוֹמֵר שָׁעוֹן...
וּמָחָר, מָחָר תָּקוּמִי!
לוּלִי לוּלִי...

היורה
מילים: יחיאל היילפרין

גֶּשֶׁם, גֶּשֶׁם, מִשָּׁמַיִם
קוֹל הֲמוֹן טִפּוֹת הַמַּיִם
טִיף-טִיף-טַף! טִיף-טִיף-טַף!
מַחֲאוּ כַּף אֶל כַּף!

טִיף-טַף, טִיף-טַף
טִיף-טִיף-טַף, טִיף-טִיף-טַף
מַחֲאוּ כַּף אֶל כַּף!

לַהַב אֵשׁ חוֹצֶה שָׁמַיִם
מְעַוֵּר אֶת הָעֵינַיִם
בְּרִיק-בְּרִיק-בְּרַק! בְּרִיק-בְּרִיק-בְּרַק!
זֶה הִבְרִיק הַבָּרָק!

בְּרִיק-בְּרַק, בְּרִיק-בְּרַק
בְּרִיק-בְּרִיק-בְּרַק! בְּרִיק-בְּרִיק-בְּרַק!
זֶה הִבְרִיק הַבָּרָק!

קוֹל אַדִּיר מִן הַשָּׁמַיִם
מַחֲרִישׁ אֶת הָאָזְנַיִם!
רַם-רְעַם! רַם-רְעַם!
זֶה הָרַעַם יִרְעַם!

רַם-רַם, רַם-רַם!
רַם-רְעַם! רַם-רְעַם!
זֶה הָרַעַם יִרְעַם!

גֶּשֶׁם, רַעַם, בְּרַק שָׁמַיִם!
מַחֲאוּ בַּכַּפַּיִם!
יִיר-יִירֶה! יִיר-יִירֶה!
בָּרוּךְ הוּא הַיּוֹרֶה!

יִיר-יִיר, יִיר-יִיר!
יִיר-יִירֶה! יִיר-יִירֶה!
בָּרוּךְ הוּא הַיּוֹרֶה!


מי יבנה בית
	

מילים: לוין קיפניס
לחן: נחום נרדי
שנת כתיבה: תרפ"ט

מִי יִבְנֶה יִבְנֶה בַּיִת בְּתֵל אָבִיב?
מִי יִבְנֶה יִבְנֶה בַּיִת בְּתֵל אָבִיב?
אֲנַחְנוּ הַחֲלוּצִים
נִבְנֶה אֶת תֵּל אָבִיב
הָבוּ חֹמֶר וּלְבֵנִים
וְנִבְנֶה אֶת תֵּל אָבִיב!

מִי יִטַּע יִטַּע כֶּרֶם בְּרִאשׁוֹן?
מִי יִטַּע יִטַּע כֶּרֶם בְּרִאשׁוֹן?
אֲנַחְנוּ הַחֲלוּצִים
נִטַּע אֶת רִאשׁוֹן
הָבוּ לָנוּ גְּפָנִים
וְנִטַּע אֶת רִאשׁוֹן!

מִי יִזְרַע יִזְרַע שָׂדֶה בְּתֵל חַי?
מִי יִזְרַע יִזְרַע שָׂדֶה בְּתֵל חַי?
אֲנַחְנוּ הַחֲלוּצִים
נִזְרַע אֶת תֵּל חַי
הָבוּ לָנוּ זֶרְעוֹנִים
וְנִזְרַע אֶת תֵּל חַי!

מִי יִשְׁתֹּל יִשְׁתֹּל פַּרְדֵּס בִּרְחוֹבוֹת?
מִי יִשְׁתֹּל יִשְׁתֹּל פַּרְדֵּס בִּרְחוֹבוֹת?
אֲנַחְנוּ הַחֲלוּצִים
נִשְׁתֹּל אֶת רְחוֹבוֹת
הָבוּ לָנוּ שְׁתִילִים
וְנִשְׁתֹּל אֶת רְחוֹבוֹת!

מי יבנה בית
מילים: לוין קיפניס

מִי יִבְנֶה יִבְנֶה בַּיִת בְּתֵל אָבִיב?
מִי יִבְנֶה יִבְנֶה בַּיִת בְּתֵל אָבִיב?
אֲנַחְנוּ הַחֲלוּצִים
נִבְנֶה אֶת תֵּל אָבִיב
הָבוּ חֹמֶר וּלְבֵנִים
וְנִבְנֶה אֶת תֵּל אָבִיב!

מִי יִטַּע יִטַּע כֶּרֶם בְּרִאשׁוֹן?
מִי יִטַּע יִטַּע כֶּרֶם בְּרִאשׁוֹן?
אֲנַחְנוּ הַחֲלוּצִים
נִטַּע אֶת רִאשׁוֹן
הָבוּ לָנוּ גְּפָנִים
וְנִטַּע אֶת רִאשׁוֹן!

מִי יִזְרַע יִזְרַע שָׂדֶה בְּתֵל חַי?
מִי יִזְרַע יִזְרַע שָׂדֶה בְּתֵל חַי?
אֲנַחְנוּ הַחֲלוּצִים
נִזְרַע אֶת תֵּל חַי
הָבוּ לָנוּ זֶרְעוֹנִים
וְנִזְרַע אֶת תֵּל חַי!

מִי יִשְׁתֹּל יִשְׁתֹּל פַּרְדֵּס בִּרְחוֹבוֹת?
מִי יִשְׁתֹּל יִשְׁתֹּל פַּרְדֵּס בִּרְחוֹבוֹת?
אֲנַחְנוּ הַחֲלוּצִים
נִשְׁתֹּל אֶת רְחוֹבוֹת
הָבוּ לָנוּ שְׁתִילִים
וְנִשְׁתֹּל אֶת רְחוֹבוֹת!

bug#6621: Emacs crash when trying to report emacs crash

[Eli Zaretskii]

> Date: Tue, 13 Jul 2010 00:55:20 +0300
> From: Yair F <yair.f.lists@gmail.com>
> Cc: 
> 
> 2nd crash: When trying to load the file el-artsi.txt (Attached) emacs crash.
> Attached in gdb stack trace:
> 
> (gdb) run -Q ../el-artsi.txt
> Starting program: /home/yair/emacs/src/emacs/trunk/src/emacs -Q ../el-artsi.txt
> [Thread debugging using libthread_db enabled]
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x08178e07 in char_table_ref (table=150273685, c=4195671) at chartab.c:200
> 200           if (SUB_CHAR_TABLE_P (val))

I cannot reproduce this on MS-Windows, with today's trunk.  According
to the command line above, this is without bidi reordering, right?

> (gdb) bt
> #0  0x08178e07 in char_table_ref (table=150273685, c=4195671) at chartab.c:200
> #1  0x08126331 in encode_char (charset=0x8857610, c=4195671) at charset.c:1779
> #2  0x083ca76b in xfont_has_char (font=150273117, c=4195671) at xfont.c:949
> #3  0x08332a6b in font_has_char (f=0x89f5280, font=150273117,
> c=4195671) at font.c:3085
> #4  0x081d4123 in fontset_find_font (fontset=147152525, c=4195671,
> face=0x8c86308, id=-1, fallback=1) at fontset.c:649
> #5  0x081d529d in fontset_font (fontset=147323613, c=4195671,
> face=0x8c86308, id=-1) at fontset.c:767
> #6  0x081d62e6 in face_for_char (f=0x89f5280, face=0x8c86308,
> c=4195671, pos=150, object=142115250) at fontset.c:952

c=4195671 (#x400557) is a strange value for a character.  And the
character at buffer position 150 is HET, codepoint #x5d7.

> #7  0x0809c519 in get_next_display_element (it=0xbfffc338) at xdisp.c:6051

Could you please go to frame #7 and display the content of `it'?  To
this end, start GDB from the src directory, or type "source
src/.gdbinit", and then type these commands:

  (gdb) frame 7
  (gdb) pit

Then show what GDB prints in response.

Thanks.

bug#6621: Emacs crash when trying to report emacs crash

[Yair F]

On Tue, Jul 13, 2010 at 3:17 PM, Eli Zaretskii <eliz@gnu.org> wrote:
> I cannot reproduce this on MS-Windows, with today's trunk.  According
> to the command line above, this is without bidi reordering, right?
Still occurs with revision 100809.

Bidi is not enabled, nor specific font loading.


>
> c=4195671 (#x400557) is a strange value for a character.  And the
> character at buffer position 150 is HET, codepoint #x5d7.
Yes.

>
>> #7  0x0809c519 in get_next_display_element (it=0xbfffc338) at xdisp.c:6051
>
> Could you please go to frame #7 and display the content of `it'?  To
> this end, start GDB from the src directory, or type "source
> src/.gdbinit", and then type these commands:
>
>  (gdb) frame 7
>  (gdb) pit
>
> Then show what GDB prints in response.

(gdb) frame 7
#7  0x0809c519 in get_next_display_element (it=0xbfffc338) at xdisp.c:6051
6051              it->face_id = FACE_FOR_CHAR (it->f, face, it->c,
pos, it->string);
(gdb) pit
cur=150[276] pos=150[276] start=128[235] end=3160 stop=3160 face=13 MB
ch=[4195671,2]
vpos=6 hpos=15 y=102 lvy=561 x=98 vx=0-640 w=0 a+d=13+4=17 max=13+4=17
(gdb)

bug#6621: Emacs crash when trying to report emacs crash

[Eli Zaretskii]

> Date: Tue, 13 Jul 2010 19:15:33 +0300
> From: Yair F <yair.f.lists@gmail.com>
> Cc: 6621@debbugs.gnu.org
> 
> (gdb) frame 7
> #7  0x0809c519 in get_next_display_element (it=0xbfffc338) at xdisp.c:6051
> 6051              it->face_id = FACE_FOR_CHAR (it->f, face, it->c,
> pos, it->string);
> (gdb) pit
> cur=150[276] pos=150[276] start=128[235] end=3160 stop=3160 face=13 MB
> ch=[4195671,2]
> vpos=6 hpos=15 y=102 lvy=561 x=98 vx=0-640 w=0 a+d=13+4=17 max=13+4=17

Strange.  Looks like the iterator indeed loaded this value 4195671
somehow.  But it claims that the character took 2 bytes, which is
correct for HET, but incorrect for such large values.  Perhaps
Handa-san will have ideas.

bug#6621: Emacs crash when trying to report emacs crash

[Yair F]

On Tue, Jul 13, 2010 at 8:57 PM, Eli Zaretskii <eliz@gnu.org> wrote:
>> Date: Tue, 13 Jul 2010 19:15:33 +0300
>> From: Yair F <yair.f.lists@gmail.com>
>> Cc: 6621@debbugs.gnu.org
>>
>> (gdb) frame 7
>> #7  0x0809c519 in get_next_display_element (it=0xbfffc338) at xdisp.c:6051
>> 6051              it->face_id = FACE_FOR_CHAR (it->f, face, it->c,
>> pos, it->string);
>> (gdb) pit
>> cur=150[276] pos=150[276] start=128[235] end=3160 stop=3160 face=13 MB
>> ch=[4195671,2]
>> vpos=6 hpos=15 y=102 lvy=561 x=98 vx=0-640 w=0 a+d=13+4=17 max=13+4=17
>
> Strange.  Looks like the iterator indeed loaded this value 4195671
> somehow.  But it claims that the character took 2 bytes, which is
> correct for HET, but incorrect for such large values.  Perhaps
> Handa-san will have ideas.
>

I found a shorter way to reproduce the problem :
1. start with emacs -Q
2. create a buffer
3. paste the first 7 lines from the file *without the newline*
4. while at EOB press enter
Emacs is now at a strange state: the cursor does not go to a new line
as expected,
 but C-x= reports column=0. going back to point 149 make the cursor invisible

Pressing return again crashes emacs with the flowing trace:
Breakpoint 1, abort () at emacs.c:430
430       kill (getpid (), SIGABRT);
(gdb) bt
#1  0x0809cd6b in set_iterator_to_next (it=0xbfffdee4, reseat_p=1) at
xdisp.c:6254
#2  0x0809ced6 in set_iterator_to_next (it=0xbfffdee4, reseat_p=1) at
xdisp.c:6301
#3  0x080c5db2 in display_line (it=0xbfffdee4) at xdisp.c:17764
#4  0x080af796 in redisplay_internal (preserve_echo_area=0) at xdisp.c:11855
#5  0x080acac9 in redisplay () at xdisp.c:11267
#6  0x0823d4bb in read_char (commandflag=1, nmaps=2, maps=0xbfffea70,
prev_event=142115250, used_mouse_menu=0xbfffebc4, end_time=0x0) at
keyboard.c:2544
#7  0x08250b39 in read_key_sequence (keybuf=0xbfffec7c, bufsize=30,
prompt=142115250, dont_downcase_last=0, can_return_switch_frame=1,
fix_current_buffer=1) at keyboard.c:9326
#8  0x0823a9ae in command_loop_1 () at keyboard.c:1618
#9  0x08307493 in internal_condition_case (bfun=0x823a105
<command_loop_1>, handlers=142145978, hfun=0x8239812 <cmd_error>) at
eval.c:1463
#10 0x08239d08 in command_loop_2 (ignore=142115250) at keyboard.c:1341
#11 0x08306ecd in internal_catch (tag=142144098, func=0x8239ce4
<command_loop_2>, arg=142115250) at eval.c:1207
#12 0x08239cc2 in command_loop () at keyboard.c:1320
#13 0x08238f1a in recursive_edit_1 () at keyboard.c:943
#14 0x08239436 in Frecursive_edit () at keyboard.c:1005
#15 0x0823709b in main (argc=2, argv=0xbffff3d4) at emacs.c:1778

Pasting the buffer without the Dagesh (05BC) and then pressing retun
causes emacs to
react normally. I suspect some Dagesh-EOL interaction here.

bug#6621: Emacs crash when trying to report emacs crash

[Eli Zaretskii]

> Date: Tue, 13 Jul 2010 21:29:20 +0300
> From: Yair F <yair.f.lists@gmail.com>
> Cc: Kenichi Handa <handa@m17n.org>, 6621@debbugs.gnu.org
> 
> On Tue, Jul 13, 2010 at 8:57 PM, Eli Zaretskii <eliz@gnu.org> wrote:
> >> Date: Tue, 13 Jul 2010 19:15:33 +0300
> >> From: Yair F <yair.f.lists@gmail.com>
> >> Cc: 6621@debbugs.gnu.org
> >>
> >> (gdb) frame 7
> >> #7  0x0809c519 in get_next_display_element (it=0xbfffc338) at xdisp.c:6051
> >> 6051              it->face_id = FACE_FOR_CHAR (it->f, face, it->c,
> >> pos, it->string);
> >> (gdb) pit
> >> cur=150[276] pos=150[276] start=128[235] end=3160 stop=3160 face=13 MB
> >> ch=[4195671,2]
> >> vpos=6 hpos=15 y=102 lvy=561 x=98 vx=0-640 w=0 a+d=13+4=17 max=13+4=17
> >
> > Strange.  Looks like the iterator indeed loaded this value 4195671
> > somehow.  But it claims that the character took 2 bytes, which is
> > correct for HET, but incorrect for such large values.  Perhaps
> > Handa-san will have ideas.
> >
> 
> I found a shorter way to reproduce the problem :
> 1. start with emacs -Q
> 2. create a buffer
> 3. paste the first 7 lines from the file *without the newline*
> 4. while at EOB press enter
> Emacs is now at a strange state: the cursor does not go to a new line
> as expected,
>  but C-x= reports column=0. going back to point 149 make the cursor invisible
> 
> Pressing return again crashes emacs with the flowing trace:
> Breakpoint 1, abort () at emacs.c:430
> 430       kill (getpid (), SIGABRT);
> (gdb) bt
> #1  0x0809cd6b in set_iterator_to_next (it=0xbfffdee4, reseat_p=1) at
> xdisp.c:6254

My Emacs is not compiled with -DENABLE_CHECKING, so the assert
triggered here is a no-op for me, and Emacs works for me just fine
with this recipe.

I will build with -DENABLE_CHECKING and try again, but until I
do, could you please show the output of the`pit' command in frame #1?

Also, in the same frame #1, what do these commands show:

  (gdb) pgrowx it->glyph_row
  (gdb) prowlims it->glyph_row
  (gdb) pmtxrows it->w->desired_matrix

Finally, does the problem persist if you turn off
auto-composition-mode before pasting the text?

bug#6621: Emacs crash when trying to report emacs crash

[Eli Zaretskii]

> Date: Wed, 14 Jul 2010 11:32:09 +0300
> From: Eli Zaretskii <eliz@gnu.org>
> Cc: 6621@debbugs.gnu.org
> 
> My Emacs is not compiled with -DENABLE_CHECKING, so the assert
> triggered here is a no-op for me, and Emacs works for me just fine
> with this recipe.
> 
> I will build with -DENABLE_CHECKING and try again

Bad news: I cannot trigger this crash even in Emacs compiled with
both -DENABLE_CHECKING and -DXASSERTS=1.  Even -fno-crossjumping
was thrown in for a good measure, and didn't help (not surprisingly).

Maybe this is somehow related to libotf or something.

Let's see what you find with the GDB commands I sent earlier.

bug#6621: Emacs crash when trying to report emacs crash

[Yair F]

[-- Attachment #1: Type: text/plain, Size: 4204 bytes --]

On Wed, Jul 14, 2010 at 11:32 AM, Eli Zaretskii <eliz@gnu.org> wrote:

> My Emacs is not compiled with -DENABLE_CHECKING, so the assert
> triggered here is a no-op for me, and Emacs works for me just fine
> with this recipe.
I have a slight suspicion that this relates to OTF/XFT font handling.
You build on Windows right?

>
> I will build with -DENABLE_CHECKING and try again, but until I
> do, could you please show the output of the`pit' command in frame #1?
>
> Also, in the same frame #1, what do these commands show:
>
>  (gdb) pgrowx it->glyph_row
>  (gdb) prowlims it->glyph_row
>  (gdb) pmtxrows it->w->desired_matrix
>
> Finally, does the problem persist if you turn off
> auto-composition-mode before pasting the text?
As expected, turning off auto-composition-mode prevents the crash.
See my lisp/language/hebrew.el attached.

>
(gdb) up
#1  0x0809cd6b in set_iterator_to_next (it=0xbfffdee4, reseat_p=1) at
xdisp.c:6254
6254              xassert (IT_BYTEPOS (*it) == CHAR_TO_BYTE (IT_CHARPOS (*it)));
(gdb) pit
cur=151[277] pos=150[276] start=128[235] end=151 stop=151 face=16 MB ch='@'
vpos=6 hpos=17 y=102 lvy=510 x=114 vx=0-640 w=8 a+d=13+4=17 max=13+4=17
(gdb) pgrowx it->glyph_row
TEXT: 17 glyphs
  0    0: COMP[47 (0..1)] pos=128 w=9 a+d=13+4 face=16 MB
  1    9: CHAR[0x5e7] pos=130 blev=0,btyp=UNDEF w=9 a+d=13+4 face=16 MB
  2   18: CHAR[ ] pos=131 blev=0,btyp=UNDEF w=8 a+d=13+4 MB
  3   26: COMP[49 (0..1)] pos=132 w=9 a+d=13+4 face=16 MB
  4   35: CHAR[0x5e5] pos=134 blev=0,btyp=UNDEF w=7 a+d=13+4 face=16 MB
  5   42: CHAR[ ] pos=135 blev=0,btyp=UNDEF w=8 a+d=13+4 MB
  6   50: COMP[51 (0..1)] pos=136 w=3 a+d=13+4 face=16 MB
  7   53: COMP[53 (0..1)] pos=138 w=8 a+d=13+4 face=16 MB
  8   61: CHAR[0x5d9] pos=140 blev=0,btyp=UNDEF w=3 a+d=13+4 face=16 MB
  9   64: CHAR[ ] pos=141 blev=0,btyp=UNDEF w=8 a+d=13+4 MB
 10   72: COMP[55 (0..1)] pos=142 w=6 a+d=13+4 face=16 MB
 11   78: COMP[57 (0..1)] pos=144 w=9 a+d=13+4 face=16 MB
 12   87: CHAR[0x5e2] pos=146 blev=0,btyp=UNDEF w=8 a+d=13+4 face=16 MB
 13   95: COMP[35 (0..0)] pos=147 w=3 a+d=13+4 face=16 MB
 14   98: COMP[35 (1..1)] pos=149 w=0 a+d=13+4 face=16 MB
 15   98: CHAR[^] pos=150 blev=0,btyp=UNDEF w=8 a+d=13+4 face=17 MB
 16  106: CHAR[@] pos=150 blev=0,btyp=UNDEF w=8 a+d=13+4 face=17 MB
(gdb) prowlims it->glyph_row
edges=(0,0),r2l=0,cont=0,trunc=(0,0),at_zv=0
(gdb) pmtxrows it->w->desired_matrix
0: edges=(1,9),r2l=0,cont=0,trunc=(0,0),at_zv=0
1: edges=(9,31),r2l=0,cont=0,trunc=(0,0),at_zv=0
2: edges=(31,59),r2l=0,cont=0,trunc=(0,0),at_zv=0
3: edges=(59,85),r2l=0,cont=0,trunc=(0,0),at_zv=0
4: edges=(85,108),r2l=0,cont=0,trunc=(0,0),at_zv=0
5: edges=(108,128),r2l=0,cont=0,trunc=(0,0),at_zv=0
6: edges=(0,0),r2l=0,cont=0,trunc=(0,0),at_zv=0
7: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
8: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
9: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
10: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
11: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
12: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
13: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
14: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
15: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
16: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
17: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
18: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
19: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
20: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
21: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
22: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
23: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
24: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
25: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
26: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
27: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
28: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
29: edges=(149,149),r2l=0,cont=0,trunc=(0,0),at_zv=1
30: edges=(192,192),r2l=0,cont=0,trunc=(0,0),at_zv=1
31: edges=(192,192),r2l=0,cont=0,trunc=(0,0),at_zv=1
32: edges=(192,192),r2l=0,cont=0,trunc=(0,0),at_zv=1

[-- Attachment #2: hebrew.el --]
[-- Type: text/x-emacs-lisp, Size: 11224 bytes --]

;;; hebrew.el --- support for Hebrew -*- coding: utf-8 -*-

;; Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
;;   Free Software Foundation, Inc.
;; Copyright (C) 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004,
;;   2005, 2006, 2007, 2008, 2009, 2010
;;   National Institute of Advanced Industrial Science and Technology (AIST)
;;   Registration Number H14PRO021

;; Copyright (C) 2003
;;   National Institute of Advanced Industrial Science and Technology (AIST)
;;   Registration Number H13PRO009

;; Keywords: multilingual, Hebrew

;; This file is part of GNU Emacs.

;; GNU Emacs is free software: you can redistribute it and/or modify
;; it under the terms of the GNU General Public License as published by
;; the Free Software Foundation, either version 3 of the License, or
;; (at your option) any later version.

;; GNU Emacs is distributed in the hope that it will be useful,
;; but WITHOUT ANY WARRANTY; without even the implied warranty of
;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
;; GNU General Public License for more details.

;; You should have received a copy of the GNU General Public License
;; along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.

;;; Commentary:

;; For Hebrew, the character set ISO8859-8 is supported.
;; See http://www.ecma.ch/ecma1/STAND/ECMA-121.HTM.
;; Windows-1255 is also supported.

;;; Code:

(define-coding-system 'hebrew-iso-8bit
  "ISO 2022 based 8-bit encoding for Hebrew (MIME:ISO-8859-8)."
  :coding-type 'charset
  :mnemonic ?8
  :charset-list '(iso-8859-8)
  :mime-charset 'iso-8859-8)

(define-coding-system-alias 'iso-8859-8 'hebrew-iso-8bit)

;; These are for Explicit and Implicit directionality information, as
;; defined in RFC 1556.  We don't yet support directional information
;; in bidi languages, so these aliases are a lie, especially as far as
;; iso-8859-8-e is concerned.  FIXME.
(define-coding-system-alias 'iso-8859-8-e 'hebrew-iso-8bit)
(define-coding-system-alias 'iso-8859-8-i 'hebrew-iso-8bit)

(set-language-info-alist
 "Hebrew" '((charset iso-8859-8)
	    (coding-priority hebrew-iso-8bit)
	    (coding-system hebrew-iso-8bit windows-1255 cp862)
	    (nonascii-translation . iso-8859-8)
	    (input-method . "hebrew")
	    (unibyte-display . hebrew-iso-8bit)
	    (sample-text . "Hebrew	שלום")
	    (documentation . "Bidirectional editing is supported.")))

(set-language-info-alist
 "Windows-1255" '((coding-priority windows-1255)
		  (coding-system windows-1255)
		  (documentation . "\
Support for Windows-1255 encoding, e.g. for Yiddish.
Bidirectional editing is supported.")))

(define-coding-system 'windows-1255
  "windows-1255 (Hebrew) encoding (MIME: WINDOWS-1255)"
  :coding-type 'charset
  :mnemonic ?h
  :charset-list '(windows-1255)
  :mime-charset 'windows-1255)
(define-coding-system-alias 'cp1255 'windows-1255)

(define-coding-system 'cp862
  "DOS codepage 862 (Hebrew)"
  :coding-type 'charset
  :mnemonic ?D
  :charset-list '(cp862)
  :mime-charset 'cp862)
(define-coding-system-alias 'ibm862 'cp862)

;; Return a nested alist of Hebrew character sequences vs the
;; corresponding glyph of FONT-OBJECT.
(defun hebrew-font-get-precomposed (font-object)
  (let ((precomposed (font-get font-object 'hebrew-precomposed))
	;; Vector of Hebrew precomposed charaters.
	(chars [#xFB2A #xFB2B #xFB2C #xFB2D #xFB2E #xFB2F #xFB30 #xFB31
		#xFB32 #xFB33 #xFB34 #xFB35 #xFB36 #xFB38 #xFB39 #xFB3A
		#xFB3B #xFB3C #xFB3E #xFB40 #xFB41 #xFB43 #xFB44 #xFB46
		#xFB47 #xFB48 #xFB49 #xFB4A #xFB4B #xFB4C #xFB4D #xFB4E])
	;; Vector of decomposition character sequences corresponding
	;; to the above vector.
	(decomposed 
	 [[#x05E9 #x05C1]
	  [#x05E9 #x05C2]
	  [#x05E9 #x05BC #x05C1]
	  [#x05E9 #x05BC #x05C2]
	  [#x05D0 #x05B7]
	  [#x05D0 #x05B8]
	  [#x05D0 #x05BC]
	  [#x05D1 #x05BC]
	  [#x05D2 #x05BC]
	  [#x05D3 #x05BC]
	  [#x05D4 #x05BC]
	  [#x05D5 #x05BC]
	  [#x05D6 #x05BC]
	  [#x05D8 #x05BC]
	  [#x05D9 #x05BC]
	  [#x05DA #x05BC]
	  [#x05DB #x05BC]
	  [#x05DC #x05BC]
	  [#x05DE #x05BC]
	  [#x05E0 #x05BC]
	  [#x05E1 #x05BC]
	  [#x05E3 #x05BC]
	  [#x05E4 #x05BC]
	  [#x05E6 #x05BC]
	  [#x05E7 #x05BC]
	  [#x05E8 #x05BC]
	  [#x05E9 #x05BC]
	  [#x05EA #x05BC]
	  [#x05D5 #x05B9]
	  [#x05D1 #x05BF]
	  [#x05DB #x05BF]
	  [#x05E4 #x05BF]]))
    (unless precomposed
      (setq precomposed (list t))
      (let ((gvec (font-get-glyphs font-object 0 (length chars) chars)))
	(dotimes (i (length chars))
	  (if (aref gvec i)
	      (set-nested-alist (aref decomposed i) (aref gvec i)
				precomposed))))
      ;; Cache the result in FONT-OBJECT's property.
      (font-put font-object 'hebrew-precomposed precomposed))
    precomposed))

;; Composition function for hebrew.  GSTRING is made of a Hebrew base
;; character followed by Hebrew diacritical marks, or is made of
;; single Hebrew diacritical mark.  Adjust GSTRING to display that
;; sequence properly.  The basic strategy is:
;;
;; (1) If there's single diacritical, add padding space to the left
;; and right of the glyph.
;;
;; (2) If the font has OpenType features for Hebrew, ask the OTF
;; driver the whole work.
;;
;; (3) If the font has precomposed glyphs, use them as far as
;; possible.  Adjust the remaining glyphs artificially.

(defun hebrew-shape-gstring (gstring)
  (let* ((font (lgstring-font gstring))
	 (otf (font-get font :otf))
	 (nchars (lgstring-char-len gstring))
	 header nglyphs base-width glyph precomposed val idx)
    (cond
     ((= nchars 1)
      ;; Independent diacritical mark.  Add padding space to left or
      ;; right so that the glyph doesn't overlap with the surrounding
      ;; chars.
      (setq glyph (lgstring-glyph gstring 0))
      (let ((width (lglyph-width glyph))
	    bearing)
	(if (< (setq bearing (lglyph-lbearing glyph)) 0)
	    (lglyph-set-adjustment glyph bearing 0 (- width bearing)))
	(if (> (setq bearing (lglyph-rbearing glyph)) width)
	    (lglyph-set-adjustment glyph 0 0 bearing))))

     ((or (assq 'hebr (car otf)) (assq 'hebr (cdr otf)))
      ;; FONT has OpenType features for Hebrew.
      (font-shape-gstring gstring))

     (t
      ;; FONT doesn't have OpenType features for Hebrew.
      ;; Try a precomposed glyph.
      ;; Now GSTRING is in this form:
      ;;   [[FONT CHAR1 CHAR2 ... CHARn] nil GLYPH1 GLYPH2 ... GLYPHn nil ...]
      (setq precomposed (hebrew-font-get-precomposed font)
	    header (lgstring-header gstring)
	    val (lookup-nested-alist header precomposed nil 1))
      (if (and (consp val) (vectorp (car val)))
	  ;; All characters can be displayed by a single precomposed glyph.
	  ;; Reform GSTRING to [HEADER nil PRECOMPOSED-GLYPH nil ...]
	  (let ((glyph (copy-sequence (car val))))
	    (lglyph-set-from-to glyph 0 (1- nchars))
	    (lgstring-set-glyph gstring 0 glyph)
	    (lgstring-set-glyph gstring 1 nil))
	(if (and (integerp val) (> val 2)
		 (setq glyph (lookup-nested-alist header precomposed val 1))
		 (consp glyph) (vectorp (car glyph)))
	    ;; The first (1- VAL) characters can be displayed by a
	    ;; precomposed glyph.  Provided that VAL is 3, the first
	    ;; two glyphs should be replaced by the precomposed glyph.
	    ;; In that case, reform GSTRING to:
	    ;;   [HEADER nil PRECOMPOSED-GLYPH GLYPH3 ... GLYPHn nil ...]
	    (let* ((ncmp (1- val))	; number of composed glyphs
		   (diff (1- ncmp)))	; number of reduced glyphs
	      (setq glyph (copy-sequence (car glyph)))
	      (lglyph-set-from-to glyph 0 (1- nchars))
	      (lgstring-set-glyph gstring 0 glyph)
	      (setq idx ncmp)
	      (while (< idx nchars)
		(setq glyph (lgstring-glyph gstring idx))
		(lglyph-set-from-to glyph 0 (1- nchars))
		(lgstring-set-glyph gstring (- idx diff) glyph)
		(setq idx (1+ idx)))
	      (lgstring-set-glyph gstring (- idx diff) nil)
	      (setq idx (- ncmp diff)
		    nglyphs (- nchars diff)))
	  (setq glyph (lgstring-glyph gstring 0))
	  (lglyph-set-from-to glyph 0 (1- nchars))
	  (setq idx 1 nglyphs nchars))
	;; Now IDX is an index to the first non-precomposed glyph.
	;; Adjust positions of the remaining glyphs artificially.
	(setq base-width (lglyph-width (lgstring-glyph gstring 0)))
	(while (< idx nglyphs)
	  (setq glyph (lgstring-glyph gstring idx))
	  (lglyph-set-from-to glyph 0 (1- nchars))
	  (if (>= (lglyph-lbearing glyph) (lglyph-width glyph))
	      ;; It seems that this glyph is designed to be rendered
	      ;; before the base glyph.
	      (lglyph-set-adjustment glyph (- base-width) 0 0)
	    (if (>= (lglyph-lbearing glyph) 0)
		;; Align the horizontal center of this glyph to the
		;; horizontal center of the base glyph.
		(let ((width (- (lglyph-rbearing glyph)
				(lglyph-lbearing glyph))))
		  (lglyph-set-adjustment glyph
					 (- (/ (- base-width width) 2)
					    (lglyph-lbearing glyph)
					    base-width) 0 0))))
	  (setq idx (1+ idx))))))
    gstring))

;; For automatic composition.
(defconst hebrew-composable-pattern
  (concat
   "\\("
   "[\u05D6-\u05D9\u05DC-\u05E2\u05E5-\u05E8]" ;; base
   "\u05BC?"                        ;; 0-1 marks of 1st class (dagesh)
   "[\u05B0-\u05B9\u05BB\u05C7]?"   ;; 0-1 marks of 3rd class (niqqud)
   "[\u0591-\u05AF\u05BD]*"         ;; 0-2 (possibly 3) marks of 4th class
   "\\|"
   "[\u05D0-\u05D4\u05DA\u05DB\u05E4\u05E5-\u05EA]" 
                                    ;; base (allows rafe)
   "[\u05BC\u05BF]?"                ;; 0-1 marks of 1st class (dagesh/rafe)
   "[\u05B0-\u05B9\u05BB\u05C7]?"   ;; 0-1 marks of 3rd class (niqqud)
   "[\u0591-\u05AF\u05BD]*"         ;; 0-2 (possibly 3) marks of 4th class
   "\\|"
   "\u05D5"                         ;; base (vav)
   "\u05BC?"                        ;; 0-1 marks of 1st class (dagesh)
   "[\u05B0-\u05BB\u05C7]?"         ;; 0-1 marks of extended 3rd class (niqqud)
   "[\u0591-\u05AF\u05BD]*"         ;; 0-2 (possibly 3) marks of 4th class
   "\\|"
   "\u05E9"                         ;; base (shin)
   "\u05BC?"                        ;; 0-1 marks of 1st class (dagesh)
   "[\u05C1\u05C2]?"                ;; 0-1 marks of 2nd class (shin dot)
   "[\u05B0-\u05B9\u05BB\u05C7]?"   ;; 0-1 marks of 3rd class (niqqud)
   "[\u0591-\u05AF\u05BD]*"         ;; 0-2 (possibly 3) marks of 4th class
   "\\|"
   "[\u05F1-\u05F3]"                ;; base (yidish ligatures)
   "[\u05B0-\u05B9\u05BB\u05C7]?"   ;; 0-1 marks of 3rd class (niqqud)
   "[\u0591-\u05AF\u05BD]*"         ;; 0-2 (possibly 3) marks of 4th class
   "\\)")
  "Regexp matching a composable sequence of Hebrew characters.")

(let ((pattern1 "[\u05D0-\u05F2][\u0591-\u05BF\u05C1-\u05C5\u05C7]+")
      (pattern2 "[\u05D0-\u05F2]\u200D[\u0591-\u05BF\u05C1-\u05C5\u05C7]+"))
  (set-char-table-range
   composition-function-table '(#x591 . #x5C7)
   (list (vector pattern2 3 'hebrew-shape-gstring)
	 (vector pattern2 2 'hebrew-shape-gstring)
	 (vector pattern1 1 'hebrew-shape-gstring)
	 [nil 0 hebrew-shape-gstring]))
  (set-char-table-range
   composition-function-table #x5C0 nil)
  (set-char-table-range
   composition-function-table #x5C6 nil))

;;(set-char-table-range 
;; composition-function-table '(#x591 . #x5F4)
;; (list (vector hebrew-composable-pattern 0 'font-shape-gstring)))
;;
(provide 'hebrew)

;; arch-tag: 3ca04f32-3f1e-498e-af46-8267498ba5d9
;;; hebrew.el ends here

bug#6621: Emacs crash when trying to report emacs crash

[Eli Zaretskii]

> Date: Wed, 14 Jul 2010 20:54:33 +0300
> From: Yair F <yair.f.lists@gmail.com>
> Cc: handa@m17n.org, 6621@debbugs.gnu.org
> 
> > My Emacs is not compiled with -DENABLE_CHECKING, so the assert
> > triggered here is a no-op for me, and Emacs works for me just fine
> > with this recipe.
> I have a slight suspicion that this relates to OTF/XFT font handling.
> You build on Windows right?

Yes.

> > Finally, does the problem persist if you turn off
> > auto-composition-mode before pasting the text?
> As expected, turning off auto-composition-mode prevents the crash.

Handa-san, could you take a look at this crash, please?

> (gdb) up
> #1  0x0809cd6b in set_iterator_to_next (it=0xbfffdee4, reseat_p=1) at
> xdisp.c:6254
> 6254              xassert (IT_BYTEPOS (*it) == CHAR_TO_BYTE (IT_CHARPOS (*it)));
> (gdb) pit
> cur=151[277] pos=150[276] start=128[235] end=151 stop=151 face=16 MB ch='@'
> vpos=6 hpos=17 y=102 lvy=510 x=114 vx=0-640 w=8 a+d=13+4=17 max=13+4=17
> (gdb) pgrowx it->glyph_row
> TEXT: 17 glyphs
>   0    0: COMP[47 (0..1)] pos=128 w=9 a+d=13+4 face=16 MB
>   1    9: CHAR[0x5e7] pos=130 blev=0,btyp=UNDEF w=9 a+d=13+4 face=16 MB
>   2   18: CHAR[ ] pos=131 blev=0,btyp=UNDEF w=8 a+d=13+4 MB
>   3   26: COMP[49 (0..1)] pos=132 w=9 a+d=13+4 face=16 MB
>   4   35: CHAR[0x5e5] pos=134 blev=0,btyp=UNDEF w=7 a+d=13+4 face=16 MB
>   5   42: CHAR[ ] pos=135 blev=0,btyp=UNDEF w=8 a+d=13+4 MB
>   6   50: COMP[51 (0..1)] pos=136 w=3 a+d=13+4 face=16 MB
>   7   53: COMP[53 (0..1)] pos=138 w=8 a+d=13+4 face=16 MB
>   8   61: CHAR[0x5d9] pos=140 blev=0,btyp=UNDEF w=3 a+d=13+4 face=16 MB
>   9   64: CHAR[ ] pos=141 blev=0,btyp=UNDEF w=8 a+d=13+4 MB
>  10   72: COMP[55 (0..1)] pos=142 w=6 a+d=13+4 face=16 MB
>  11   78: COMP[57 (0..1)] pos=144 w=9 a+d=13+4 face=16 MB
>  12   87: CHAR[0x5e2] pos=146 blev=0,btyp=UNDEF w=8 a+d=13+4 face=16 MB
>  13   95: COMP[35 (0..0)] pos=147 w=3 a+d=13+4 face=16 MB
>  14   98: COMP[35 (1..1)] pos=149 w=0 a+d=13+4 face=16 MB
>  15   98: CHAR[^] pos=150 blev=0,btyp=UNDEF w=8 a+d=13+4 face=17 MB
>  16  106: CHAR[@] pos=150 blev=0,btyp=UNDEF w=8 a+d=13+4 face=17 MB

It somehow thinks there's a null character (displayed as "^@" at the
end of the glyph row above) at character position 150.  This is at
least a symptom of the assertion violation, if not its cause.

Hmm... maybe these two lines a little ways up before the assert

	      IT_CHARPOS (*it) += it->cmp_it.nchars;
	      IT_BYTEPOS (*it) += it->cmp_it.nbytes;

overstepped the end of the buffer?

This glyph, the one before the null character, also looks suspicious:

>  14   98: COMP[35 (1..1)] pos=149 w=0 a+d=13+4 face=16 MB

Buffer position 149 is the newline, so why it is composed?  In
general, a newline should not appear in the glyph row, because it does
not take any screen space.

bug#6621: Emacs crash when trying to report emacs crash

[Kenichi Handa]

In article <83k4oxhk1c.fsf@gnu.org>, Eli Zaretskii <eliz@gnu.org> writes:

> > Date: Wed, 14 Jul 2010 20:54:33 +0300
> > From: Yair F <yair.f.lists@gmail.com>
> > Cc: handa@m17n.org, 6621@debbugs.gnu.org
> > 
> > > My Emacs is not compiled with -DENABLE_CHECKING, so the assert
> > > triggered here is a no-op for me, and Emacs works for me just fine
> > > with this recipe.
> > I have a slight suspicion that this relates to OTF/XFT font handling.
> > You build on Windows right?

> Yes.

> > > Finally, does the problem persist if you turn off
> > > auto-composition-mode before pasting the text?
> > As expected, turning off auto-composition-mode prevents the crash.

> Handa-san, could you take a look at this crash, please?

Unfortunately, I can't reproduce the crash, but anyway, I've
just started to investigate what is wrong.

---
Kenichi Handa
handa@m17n.org

bug#6621: Emacs crash when trying to report emacs crash

[Yair F]

Eli,
Since Handa-san is appearnly unavailable I tried to investigate the
crash myself.
The problem that I know nothing about emacs' structure.
All I can do is send the debug session. If you  think that you can
instruct me more on how to debug it let me know.
I'll try to get something more meaningful.

br 6138 if it->position.charpos==150
Breakpoint 7 at 0x809ca12: file xdisp.c, line 6138.
(gdb) c
Continuing.

Breakpoint 7, set_iterator_to_next (it=0xbfffdeb4, reseat_p=1) at xdisp.c:6142
(gdb) p it->position.charpos
$7 = 150
(gdb) pit
cur=150[276] pos=150[276] start=128[235] end=151 stop=151 face=15 MB ch='@'
vpos=6 hpos=17 y=102 lvy=646 x=114 vx=0-560 w=8 a+d=13+4=17 max=13+4=17
(gdb) p it->what
$8 = IT_CHARACTER
(gdb) p *it
$9 = {
  window = 144783445,
  w = 0x8a13850,
  f = 0x8a136d0,
  method = GET_FROM_BUFFER,
  stop_charpos = 151,
  prev_stop = 0,
  base_level_stop = 0,
  end_charpos = 151,
  s = 0x0,
  string_nchars = 0,
  region_beg_charpos = -1,
  region_end_charpos = -1,
  redisplay_end_trigger_charpos = 0,
  multibyte_p = 1,
  header_line_p = 0,
  string_from_display_prop_p = 0,
  ellipsis_p = 0,
  avoid_cursor_p = 0,
  dp = 0x0,
  dpvec = 0x0,
  dpend = 0xbfffdf0c,
  dpvec_char_len = 1,
  dpvec_face_id = 16,
  saved_face_id = 15,
  ctl_chars = {376, 256, 0 <repeats 14 times>},
  start = {
    pos = {
      charpos = 128,
      bytepos = 235
    },
    overlay_string_index = -1,
    string_pos = {
      charpos = -1,
      bytepos = -1
    },
    dpvec_index = -1
  },
  current = {
    pos = {
      charpos = 150,
      bytepos = 276
    },
    overlay_string_index = -1,
    string_pos = {
      charpos = -1,
      bytepos = -1
    },
    dpvec_index = -1
  },
  n_overlay_strings = 0,
  overlay_strings = {0 <repeats 16 times>},
  string_overlays = {0 <repeats 16 times>},
  string = 142119346,
  from_overlay = 0,
  stack = {{
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      prev_stop = 0,
      base_level_stop = 0,
      cmp_it = {
        stop_pos = 0,
        id = 0,
        ch = 0,
        rule_idx = 0,
        lookback = 0,
        nglyphs = 0,
        reversed_p = 0,
        charpos = 0,
        nchars = 0,
        nbytes = 0,
        from = 0,
        to = 0,
        width = 0
      },
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      from_overlay = 0,
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      avoid_cursor_p = 0,
      line_wrap = TRUNCATE,
      voffset = 0,
      space_width = 0,
      font_height = 0
    }, {
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      prev_stop = 0,
      base_level_stop = 0,
      cmp_it = {
        stop_pos = 0,
        id = 0,
        ch = 0,
        rule_idx = 0,
        lookback = 0,
        nglyphs = 0,
        reversed_p = 0,
        charpos = 0,
        nchars = 0,
        nbytes = 0,
        from = 0,
        to = 0,
        width = 0
      },
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      from_overlay = 0,
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      avoid_cursor_p = 0,
      line_wrap = TRUNCATE,
      voffset = 0,
      space_width = 0,
      font_height = 0
    }, {
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      prev_stop = 0,
      base_level_stop = 0,
      cmp_it = {
        stop_pos = 0,
        id = 0,
        ch = 0,
        rule_idx = 0,
        lookback = 0,
        nglyphs = 0,
        reversed_p = 0,
        charpos = 0,
        nchars = 0,
        nbytes = 0,
        from = 0,
        to = 0,
        width = 0
      },
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      from_overlay = 0,
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      avoid_cursor_p = 0,
      line_wrap = TRUNCATE,
      voffset = 0,
      space_width = 0,
      font_height = 0
    }, {
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      prev_stop = 0,
      base_level_stop = 0,
      cmp_it = {
        stop_pos = 0,
        id = 0,
        ch = 0,
        rule_idx = 0,
        lookback = 0,
        nglyphs = 0,
        reversed_p = 0,
        charpos = 0,
        nchars = 0,
        nbytes = 0,
        from = 0,
        to = 0,
        width = 0
      },
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      from_overlay = 0,
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      avoid_cursor_p = 0,
      line_wrap = TRUNCATE,
      voffset = 0,
      space_width = 0,
      font_height = 0
    }, {
      string = 0,
      string_nchars = 0,
      end_charpos = 0,
      stop_charpos = 0,
      prev_stop = 0,
      base_level_stop = 0,
      cmp_it = {
        stop_pos = 0,
        id = 0,
        ch = 0,
        rule_idx = 0,
        lookback = 0,
        nglyphs = 0,
        reversed_p = 0,
        charpos = 0,
        nchars = 0,
        nbytes = 0,
        from = 0,
        to = 0,
        width = 0
      },
      face_id = 0,
      u = {
        image = {
          object = 0,
          slice = {
            x = 0,
            y = 0,
            width = 0,
            height = 0
          },
          image_id = 0
        },
        comp = {
          object = 0
        },
        stretch = {
          object = 0
        }
      },
      position = {
        charpos = 0,
        bytepos = 0
      },
      current = {
        pos = {
          charpos = 0,
          bytepos = 0
        },
        overlay_string_index = 0,
        string_pos = {
          charpos = 0,
          bytepos = 0
        },
        dpvec_index = 0
      },
      from_overlay = 0,
      area = LEFT_MARGIN_AREA,
      method = GET_FROM_BUFFER,
      multibyte_p = 0,
      string_from_display_prop_p = 0,
      display_ellipsis_p = 0,
      avoid_cursor_p = 0,
      line_wrap = TRUNCATE,
      voffset = 0,
      space_width = 0,
      font_height = 0
    }},
  sp = 0,
  selective = 0,
  what = IT_CHARACTER,
  face_id = 15,
  selective_display_ellipsis_p = 1,
  ctl_arrow_p = 1,
  face_box_p = 0,
  start_of_box_run_p = 0,
  end_of_box_run_p = 0,
  overlay_strings_at_end_processed_p = 0,
  ignore_overlay_strings_at_pos_p = 0,
  glyph_not_available_p = 0,
  starts_in_middle_of_char_p = 0,
  face_before_selective_p = 0,
  constrain_row_ascent_descent_p = 0,
  line_wrap = WINDOW_WRAP,
  base_face_id = 0,
  c = 64,
  len = 1,
  cmp_it = {
    stop_pos = 151,
    id = -1,
    ch = -2,
    rule_idx = 2,
    lookback = 1,
    nglyphs = 2,
    reversed_p = 0,
    charpos = 149,
    nchars = 1,
    nbytes = 2,
    from = 1,
    to = 2,
    width = 0
  },
  char_to_display = 64,
  image_id = 0,
  slice = {
    x = 142119346,
    y = 142119346,
    width = 142119346,
    height = 142119346
  },
  space_width = 142119346,
  voffset = 0,
  tab_width = 8,
  font_height = 142119346,
  object = 149209493,
  position = {
    charpos = 150,
    bytepos = 276
  },
  truncation_pixel_width = 0,
  continuation_pixel_width = 0,
  first_visible_x = 0,
  last_visible_x = 560,
  last_visible_y = 646,
  extra_line_spacing = 0,
  max_extra_line_spacing = 0,
  override_ascent = -1,
  override_descent = 0,
  override_boff = 0,
  glyph_row = 0x8fb8448,
  area = TEXT_AREA,
  nglyphs = 1,
  pixel_width = 8,
  ascent = 13,
  descent = 4,
  max_ascent = 13,
  max_descent = 4,
  phys_ascent = 10,
  phys_descent = 2,
  max_phys_ascent = 13,
  max_phys_descent = 4,
  current_x = 114,
  continuation_lines_width = 0,
  eol_pos = {
    charpos = 0,
    bytepos = 0
  },
  current_y = 102,
  first_vpos = 0,
  vpos = 6,
  hpos = 17,
  left_user_fringe_bitmap = 0,
  right_user_fringe_bitmap = 0,
  left_user_fringe_face_id = 0,
  right_user_fringe_face_id = 0,
  bidi_p = 0,
  bidi_it = {
    bytepos = 0,
    charpos = 0,
    ch = 0,
    ch_len = 0,
    type = UNKNOWN_BT,
    type_after_w1 = UNKNOWN_BT,
    orig_type = UNKNOWN_BT,
    resolved_level = 0,
    invalid_levels = 0,
    invalid_rl_levels = 0,
    prev_was_pdf = 0,
    prev = {
      bytepos = 0,
      charpos = 0,
      type = UNKNOWN_BT,
      type_after_w1 = UNKNOWN_BT,
      orig_type = UNKNOWN_BT
    },
    last_strong = {
      bytepos = 0,
      charpos = 0,
      type = UNKNOWN_BT,
      type_after_w1 = UNKNOWN_BT,
      orig_type = UNKNOWN_BT
    },
    next_for_neutral = {
      bytepos = 0,
      charpos = 0,
      type = UNKNOWN_BT,
      type_after_w1 = UNKNOWN_BT,
      orig_type = UNKNOWN_BT
    },
    prev_for_neutral = {
      bytepos = 0,
      charpos = 0,
      type = UNKNOWN_BT,
      type_after_w1 = UNKNOWN_BT,
      orig_type = UNKNOWN_BT
    },
    next_for_ws = {
      bytepos = 0,
      charpos = 0,
      type = UNKNOWN_BT,
      type_after_w1 = UNKNOWN_BT,
      orig_type = UNKNOWN_BT
    },
    next_en_pos = 0,
    ignore_bn_limit = 0,
    sor = NEUTRAL_DIR,
    scan_dir = 0,
    stack_idx = 0,
    level_stack = {{
        level = 0,
        override = NEUTRAL_DIR
      } <repeats 64 times>},
    first_elt = 0,
    paragraph_dir = NEUTRAL_DIR,
    new_paragraph = 0,
    separator_limit = 0
  },
  paragraph_embedding = NEUTRAL_DIR
}
(gdb) s
(gdb) s

Here we are   else if (it->cmp_it.id >= 0)

(gdb) p it->cmp_it
$10 = {
  stop_pos = 151,
  id = -1,
  ch = -2,
  rule_idx = 2,
  lookback = 1,
  nglyphs = 2,
  reversed_p = 0,
  charpos = 149,
  nchars = 1,
  nbytes = 2,
  from = 1,
  to = 2,
  width = 0
}
(gdb) n

Before
	  xassert (it->len != 0);


(gdb) p it->len
$11 = 1

These are the damaging lines:
	      IT_BYTEPOS (*it) += it->len;
	      IT_CHARPOS (*it) += 1;

(gdb) n
(gdb) n
(gdb) n
(gdb) n
Finally this fails:

	  xassert (IT_BYTEPOS (*it) == CHAR_TO_BYTE (IT_CHARPOS (*it)));


Breakpoint 1, abort () at emacs.c:430
(gdb) up
#1  0x0809ce55 in set_iterator_to_next (it=0xbfffdeb4, reseat_p=1) at
xdisp.c:6253
(gdb)

bug#6621: Emacs crash when trying to report emacs crash

[Kenichi Handa]

In article <AANLkTikE5X6BUROA31sXDe7FyIXqy_ZRm-J7iiZb_l4I@mail.gmail.com>, Yair F <yair.f.lists@gmail.com> writes:

> Since Handa-san is appearnly unavailable I tried to investigate the
> crash myself.
> The problem that I know nothing about emacs' structure.
> All I can do is send the debug session. If you  think that you can
> instruct me more on how to debug it let me know.
> I'll try to get something more meaningful.

Thank you, and sorry for the late response.  I've been busy
for preparing for the next Monday's presentation.

I found a suspicious code in Ffont_shape_gstring, and the
attached patch will fix the bug.  Could you please try it?
I have not yet committed it because I have not yet fully
traced the impact of the change to the other places..

=== modified file 'src/font.c'
--- src/font.c	2010-07-14 03:40:47 +0000
+++ src/font.c	2010-07-23 12:31:43 +0000
@@ -4492,6 +4492,8 @@
     }
   if (i == 3 || XINT (n) == 0)
     return Qnil;
+  if (XINT (n) < LGSTRING_GLYPH_LEN (gstring))
+    LGSTRING_SET_GLYPH (gstring, XINT (n), Qnil);
 
   glyph = LGSTRING_GLYPH (gstring, 0);
   from = LGLYPH_FROM (glyph);

---
Kenichi Handa
handa@m17n.org

bug#6621: Emacs crash when trying to report emacs crash

[Yair F]

I can confirm that this fix resolves the bugs (two forms I found).

Thank you,
Yair

> I found a suspicious code in Ffont_shape_gstring, and the
> attached patch will fix the bug.  Could you please try it?
> I have not yet committed it because I have not yet fully
> traced the impact of the change to the other places..
>
> === modified file 'src/font.c'
> --- src/font.c  2010-07-14 03:40:47 +0000
> +++ src/font.c  2010-07-23 12:31:43 +0000
> @@ -4492,6 +4492,8 @@
>     }
>   if (i == 3 || XINT (n) == 0)
>     return Qnil;
> +  if (XINT (n) < LGSTRING_GLYPH_LEN (gstring))
> +    LGSTRING_SET_GLYPH (gstring, XINT (n), Qnil);
>
>   glyph = LGSTRING_GLYPH (gstring, 0);
>   from = LGLYPH_FROM (glyph);
>
> ---
> Kenichi Handa
> handa@m17n.org
>

bug#6621: Emacs crash when trying to report emacs crash

[Kenichi Handa]

In article <AANLkTinorNXJFg9vpnRgk+Cw+c2ptxBurPhq7KfHEdi1@mail.gmail.com>, Yair F <yair.f.lists@gmail.com> writes:

> I can confirm that this fix resolves the bugs (two forms I found).

Thank you for testing it.  I've just comitted the change.

---
Kenichi Handa
handa@m17n.org

bug#6621: Emacs crash when trying to report emacs crash

[Juanma Barranquero]

On Mon, Jul 26, 2010 at 06:30, Kenichi Handa <handa@m17n.org> wrote:

> Thank you for testing it.  I've just comitted the change.

Closed by this change:

revno: 100903 [merge]
revision-id: handa@etlken-20100726043005-sq8wr6296isnsfrw
parent: lekktu@gmail.com-20100726004358-dchef7mntej1zxhq
parent: handa@etlken-20100726042908-0nfhiahf4n71e4l0
committer: Kenichi Handa <handa@etlken>
branch nick: trunk
timestamp: Mon 2010-07-26 13:30:05 +0900
message:
  font.c (Ffont_shape_gstring): Terminate GSTRING by nil if the number
of glyphs gets smaller than the original length.
modified:
  src/ChangeLog                  changelog-20091113204419-o5vbwnq5f7feedwu-1438
  src/font.c                     font.c-20091113204419-o5vbwnq5f7feedwu-8540