bug#3500: 23.0.94; [NS/Cocoa] Crash when entering accented chacters with Flyspell enabled

bug#3500: 23.0.94; [NS/Cocoa] Crash when entering accented chacters with Flyspell enabled

[Ian Eure]

Recent (this morning) CVS crashes if you enter an accented character  
with Flyspell enablaed.

Steps to reproduce:
1. Launch emacs with -Q
2. Change modifiers so Option isn’t mapped:
    (setq mac-command-modifier 'meta mac-option-modifier nil)
3. Enable flyspell:
    M-x flyspell-mode RET
4. Type a a word with an accented character:
    touché SPC

    (That’s: t o u c h option-e e)

Emacs crashes with:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x000ce138 in kbd_buffer_get_event (kbp=0xbfffdfa8,  
used_mouse_menu=0x0, end_time=0xbfffe138) at keyboard.c:4165
4165		  *used_mouse_menu = 1;


If flyspell-mode is disabled, Emacs doesn’t crash.

`bt full' output:

(gdb) bt full
#0  0x000ce138 in kbd_buffer_get_event (kbp=0xbfffdfa8,  
used_mouse_menu=0x0, end_time=0xbfffe138) at keyboard.c:4165
	event = (struct input_event *) 0x3ad3f4
	c = 0
	obj = 8252437
#1  0x000cbb65 in read_char (commandflag=0, nmaps=0, maps=0x0,  
prev_event=25165881, used_mouse_menu=0x0, end_time=0xbfffe138) at  
keyboard.c:3059
	kb = (KBOARD *) 0x839260
	c = 25165833
	count = -1
	jmpcount = 8
	local_getcjmp = {895, -1073749600, 8098, 830008, 863736, -1073749600,  
-1073749388, 1645590, -1073749768, -1073750208, 31, 658, 831883, 23,  
-65505, -65505, 0, 55}
	save_jump = {0 <repeats 18 times>}
	key_already_recorded = 0
	tem = 25165833
	save = 25165833
	previous_echo_area_message = 25165833
	also_record = 25165833
	reread = 0
	gcpro1 = {
   next = 0x939be2eb,
   var = 0x1f0b11,
   nvars = -1073749600
}
	gcpro2 = {
   next = 0x2,
   var = 0x8529e0,
   nvars = -1764089896
}
	polling_stopped_here = 1
	orig_kboard = (struct kboard *) 0x839260
#2  0x0019198d in read_filtered_event (no_switch_frame=0,  
ascii_required=0, error_nonascii=0, input_method=0, seconds=24) at  
lread.c:707
	val = 8
	delayed_switch_frame = 25165833
	end_time = {
   tv_sec = 1244497951,
   tv_usec = 581814
}
#3  0x00191c89 in Fread_event (prompt=25165833,  
inherit_input_method=25165833, seconds=24) at lread.c:821
No locals.
#4  0x00168bc4 in Ffuncall (nargs=4, args=0xbfffe270) at eval.c:3051
	fun = 3820052
	original_fun = 25246497
	funcar = 0
	numargs = 3
	lisp_numargs = 1803477
	val = 25165881
	backtrace = {
   next = 0xbfffe550,
   function = 0xbfffe270,
   args = 0xbfffe274,
   nargs = 3,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0xbfffe274
	i = 1
#5  0x001b9105 in Fbyte_code (bytestr=2401179, vector=2401196,  
maxdepth=40) at bytecode.c:678
	count = 8
	op = 3
	vectorp = (Lisp_Object *) 0x24a3b0
	bytestr_length = 90
	stack = {
   pc = 0x39549f "?\034??X",
   top = 0xbfffe27c,
   bottom = 0xbfffe270,
   byte_string = 2401179,
   byte_string_start = 0x39545f "\b??\020",
   constants = 2401196,
   next = 0xbfffe648
}
	top = (Lisp_Object *) 0xbfffe270
	result = -41
#6  0x00169450 in funcall_lambda (fun=2401116, nargs=1,  
arg_vector=0xbfffe5b4) at eval.c:3232
	val = 1476369
	syms_left = 25165833
	next = 25474761
	count = 5
	i = 1
	optional = 1
	rest = 0
#7  0x00168e31 in Ffuncall (nargs=2, args=0xbfffe5b0) at eval.c:3091
	fun = 2401116
	original_fun = 25471361
	funcar = 5206269
	numargs = 1
	lisp_numargs = 1803477
	val = -1073748584
	backtrace = {
   next = 0xbfffe880,
   function = 0xbfffe5b0,
   args = 0xbfffe5b4,
   nargs = 1,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0x1805e4a
	i = 25189962
#8  0x001b9105 in Fbyte_code (bytestr=33606163, vector=23225812,  
maxdepth=16) at bytecode.c:678
	count = 5
	op = 1
	vectorp = (Lisp_Object *) 0x16265d8
	bytestr_length = 81
	stack = {
   pc = 0x21021f8 "?̇̇",
   top = 0xbfffe5b4,
   bottom = 0xbfffe5b0,
   byte_string = 33606163,
   byte_string_start = 0x21021ac "dSeX?\t",
   constants = 23225812,
   next = 0xbfffe978
}
	top = (Lisp_Object *) 0xbfffe5b0
	result = 25165833
#9  0x00169450 in funcall_lambda (fun=23225988, nargs=0,  
arg_vector=0xbfffe8e4) at eval.c:3232
	val = 25165833
	syms_left = 25165833
	next = 2096
	count = 5
	i = 0
	optional = 0
	rest = 0
#10 0x00168e31 in Ffuncall (nargs=1, args=0xbfffe8e0) at eval.c:3091
	fun = 23225988
	original_fun = 33605145
	funcar = 1
	numargs = 0
	lisp_numargs = 1359974
	val = 25165833
	backtrace = {
   next = 0xbfffebb0,
   function = 0xbfffe8e0,
   args = 0xbfffe8e4,
   nargs = 0,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0x180975a
	i = 25204570
#11 0x001b9105 in Fbyte_code (bytestr=33607635, vector=8509204,  
maxdepth=32) at bytecode.c:678
	count = 3
	op = 0
	vectorp = (Lisp_Object *) 0x81d718
	bytestr_length = 121
	stack = {
   pc = 0x210262b "?*",
   top = 0xbfffe8e0,
   bottom = 0xbfffe8e0,
   byte_string = 33607635,
   byte_string_start = 0x2102610 "\b?x",
   constants = 8509204,
   next = 0x0
}
	top = (Lisp_Object *) 0xbfffe8e0
	result = 24110326
#12 0x00169450 in funcall_lambda (fun=8509412, nargs=0,  
arg_vector=0xbfffeca0) at eval.c:3232
	val = 25501976
	syms_left = 25165833
	next = 6297212
	count = 3
	i = 0
	optional = 0
	rest = 0
#13 0x00168e31 in Ffuncall (nargs=1, args=0xbfffec9c) at eval.c:3091
	fun = 8509412
	original_fun = 33930793
	funcar = 1362040
	numargs = 0
	lisp_numargs = 34545322
	val = 25165833
	backtrace = {
   next = 0xbfffed20,
   function = 0xbfffec9c,
   args = 0xbfffeca0,
   nargs = 0,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0x1800009
	i = 34545322
#14 0x00168413 in run_hook_with_args (nargs=1, args=0xbfffec9c,  
cond=to_completion) at eval.c:2704
	sym = 25196057
	val = 8191213
	ret = 25165833
	globals = 25165833
	gcpro1 = {
   next = 0x0,
   var = 0x0,
   nvars = 33827088
}
	gcpro2 = {
   next = 0xbfffec78,
   var = 0x181b109,
   nvars = 25165833
}
	gcpro3 = {
   next = 0x82787a,
   var = 0x105,
   nvars = 1480343
}
#15 0x001681dc in Frun_hooks (nargs=1, args=0xbfffeda4) at eval.c:2567
	hook = {33930793}
	i = 0
#16 0x00168a21 in Ffuncall (nargs=2, args=0xbfffeda0) at eval.c:3026
	fun = 3815364
	original_fun = 25255761
	funcar = 1021522
	numargs = 1
	lisp_numargs = 0
	val = -1073746552
	backtrace = {
   next = 0x0,
   function = 0xbfffeda0,
   args = 0xbfffeda4,
   nargs = 1,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0x828
	i = 2096
#17 0x00168630 in call1 (fn=25255761, arg1=25196057) at eval.c:2830
	ret_ungc_val = 1142808
	gcpro1 = {
   next = 0x0,
   var = 0x116299,
   nvars = 2
}
#18 0x000ca3bf in safe_run_hooks_1 (hook=-1073746408) at keyboard.c:2156
No locals.
#19 0x00165fac in internal_condition_case (bfun=0xca36b  
<safe_run_hooks_1>, handlers=25165881, hfun=0xca3cb  
<safe_run_hooks_error>) at eval.c:1512
	val = 677756
	c = {
   tag = 25165833,
   val = 25165833,
   next = 0xbffff0a8,
   gcpro = 0x0,
   jmp = {-1073806465, 25253690, 8098, 1465995, 0, 1, 0, 25165833,  
-1073746296, -1073746480, 31, 658, 1466161, 1441815, 25231391,  
25165855, 6291456, 55},
   backlist = 0x0,
   handlerlist = 0xbffff094,
   lisp_eval_depth = 0,
   pdlcount = 3,
   poll_suppress_count = 0,
   interrupt_input_blocked = 0,
   byte_stack = 0x0
}
	h = {
   handler = 25165881,
   var = 25165833,
   chosen_clause = 1361607,
   tag = 0xbfffee08,
   next = 0xbffff094
}
#20 0x000ca4a3 in safe_run_hooks (hook=25196057) at keyboard.c:2184
	count = 2
#21 0x000c95a7 in command_loop_1 () at keyboard.c:1920
	cmd = 25195913
	lose = 0
	nonundocount = 5
	keybuf = {832, 40, -1566119790, 4122928, -1754246680, -1880941672,  
-1880949728, -1073745796, 152, 0, 4706304, 163, 1245186, 249856,  
-1880941408, 182, 151, 41910568, -1826387128, 230, 9, 0, -1073745904,  
-1073746208, 0, 524288, 25165833, 25599729, 2600356, 4856205}
	i = 1
	prev_modiff = 336
	prev_buffer = (struct buffer *) 0x601678
	already_adjusted = 0
#22 0x00165fac in internal_condition_case (bfun=0xc775e  
<command_loop_1>, handlers=25205425, hfun=0xc6e67 <cmd_error>) at  
eval.c:1512
	val = 4856205
	c = {
   tag = 25165833,
   val = 25165833,
   next = 0xbffff16c,
   gcpro = 0x0,
   jmp = {-1073806465, 76, 8098, 1465995, 33630208, 1464437, 0, 0,  
-1073745624, -1073745808, 31, 658, 1466161, -1826422761, 31, 31, 0, 55},
   backlist = 0x0,
   handlerlist = 0x0,
   lisp_eval_depth = 0,
   pdlcount = 2,
   poll_suppress_count = 0,
   interrupt_input_blocked = 0,
   byte_stack = 0x0
}
	h = {
   handler = 25205425,
   var = 25165833,
   chosen_clause = -1881116971,
   tag = 0xbffff0a8,
   next = 0x0
}
#23 0x000c738e in command_loop_2 () at keyboard.c:1359
	val = 4028928
#24 0x0016593d in internal_catch (tag=25201545, func=0xc7359  
<command_loop_2>, arg=25165833) at eval.c:1248
	c = {
   tag = 25201545,
   val = 25165833,
   next = 0x0,
   gcpro = 0x0,
   jmp = {-1826421889, 0, 8098, 1464437, -1826422635, 0, 0, 0,  
-1073745432, -1073745584, 25296927, 662, 1464622, 23, 25165855,  
-1073807329, 25296896, 25296951},
   backlist = 0x0,
   handlerlist = 0x0,
   lisp_eval_depth = 0,
   pdlcount = 2,
   poll_suppress_count = 0,
   interrupt_input_blocked = 0,
   byte_stack = 0x0
}
#25 0x000c7317 in command_loop () at keyboard.c:1338
No locals.
#26 0x000c68eb in recursive_edit_1 () at keyboard.c:953
	count = 1
	val = 1481113
#27 0x000c6af4 in Frecursive_edit () at keyboard.c:1015
	count = 0
	buffer = 25165833
#28 0x000c4df9 in main (argc=2, argv=0xbffff47c) at emacs.c:1852
	dummy = 0
	stack_bottom_variable = 0 '\0'
	do_initial_setlocale = 1
	skip_args = 0
	rlim = {
   rlim_cur = 8388608,
   rlim_max = 67104768
}
	no_loadup = 0
	junk = 0x0
	dname_arg = 0x0
	dname_arg2 = "|???\002\000\000\000X???r\030?? 
\000\020\000\000\000\000\000\000\002\000\000\000|???????\030???", '\0'  
<repeats 39 times>

`xbacktrace' output:



In GNU Emacs 23.0.94.1 (i386-apple-darwin9.7.0, NS apple-appkit-949.46)
  of 2009-06-08 on neutron.local
Windowing system distributor `Apple', version 10.3.949
configured using `configure  '--with-ns''

Important settings:
   value of $LC_ALL: nil
   value of $LC_COLLATE: nil
   value of $LC_CTYPE: nil
   value of $LC_MESSAGES: nil
   value of $LC_MONETARY: nil
   value of $LC_NUMERIC: nil
   value of $LC_TIME: nil
   value of $LANG: nil
   value of $XMODIFIERS: nil
   locale-coding-system: nil
   default-enable-multibyte-characters: t

Major mode: Inferior Python

Minor modes in effect:
   diff-auto-refine-mode: t
   erc-track-mode: t
   erc-track-minor-mode: t
   erc-spelling-mode: t
   erc-ring-mode: t
   erc-pcomplete-mode: t
   erc-netsplit-mode: t
   erc-match-mode: t
   erc-button-mode: t
   erc-fill-mode: t
   erc-autojoin-mode: t
   erc-irccontrols-mode: t
   erc-noncommands-mode: t
   erc-readonly-mode: t
   erc-scrolltobottom-mode: t
   compilation-shell-minor-mode: t
   which-function-mode: t
   yas/minor-mode: t
   shell-dirtrack-mode: t
   ime-bindings: t
   show-paren-mode: t
   recentf-mode: t
   iswitchb-mode: t
   cua-mode: t
   auto-insert-mode: t
   tooltip-mode: t
   mouse-wheel-mode: t
   menu-bar-mode: t
   file-name-shadow-mode: t
   global-font-lock-mode: t
   font-lock-mode: t
   blink-cursor-mode: t
   global-auto-composition-mode: t
   auto-composition-mode: t
   auto-encryption-mode: t
   auto-compression-mode: t
   size-indication-mode: t
   column-number-mode: t
   line-number-mode: t
   transient-mark-mode: t
   abbrev-mode: t

Recent input:
<menu-bar> <help-menu> <send-emacs-bug-report>

Recent messages:
Quit

bug#3500: 23.0.94; [NS/Cocoa] Crash when entering accented chacters with Flyspell enabled

[Adrian Robert]

http://emacsbugs.donarmstrong.com/cgi-bin/bugreport.cgi?bug=3500

I cannot reproduce this with latest trunk.  Can you?  If so please  
send updated crash report.

thanks.

bug#3500: 23.0.94; [NS/Cocoa] Crash when entering accented chacters with Flyspell enabled

[Glenn Morris]

This report refers to what is now an old pretest of Emacs 23.1 and could
not be reproduced. If you still see the issue with the latest release,
23.3, please reply and we can reopen the report if needed.

Adrian Robert wrote:

> I cannot reproduce this with latest trunk.  Can you?  If so please
> send updated crash report.