From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.blaine.gmane.org!not-for-mail From: Pip Cet Newsgroups: gmane.emacs.bugs Subject: bug#47067: 28.0.50; [feature/native-comp] Crash while scrolling through dispnew.c Date: Sat, 13 Mar 2021 16:32:50 +0000 Message-ID: References: <83sg52lykn.fsf@gnu.org> <83mtv8lrmf.fsf@gnu.org> <83czw4lelg.fsf@gnu.org> <83mtv8jgn2.fsf@gnu.org> <834khfjv7q.fsf@gnu.org> <83tupfia1m.fsf@gnu.org> <83mtv7hy5c.fsf@gnu.org> <83k0qbhvnh.fsf@gnu.org> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="00000000000071236105bd6d9339" Injection-Info: ciao.gmane.io; posting-host="blaine.gmane.org:116.202.254.214"; logging-data="31178"; mail-complaints-to="usenet@ciao.gmane.io" Cc: Andrea Corallo , 47067@debbugs.gnu.org To: Eli Zaretskii Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Sat Mar 13 17:34:13 2021 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1lL7DR-0007y0-1W for geb-bug-gnu-emacs@m.gmane-mx.org; Sat, 13 Mar 2021 17:34:13 +0100 Original-Received: from localhost ([::1]:51314 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1lL7DQ-0000mA-3R for geb-bug-gnu-emacs@m.gmane-mx.org; Sat, 13 Mar 2021 11:34:12 -0500 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:40686) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1lL7DG-0000id-Dp for bug-gnu-emacs@gnu.org; Sat, 13 Mar 2021 11:34:02 -0500 Original-Received: from debbugs.gnu.org ([209.51.188.43]:49020) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1lL7DF-0004Hc-Tp for bug-gnu-emacs@gnu.org; Sat, 13 Mar 2021 11:34:01 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1lL7DF-0001mR-QQ for bug-gnu-emacs@gnu.org; Sat, 13 Mar 2021 11:34:01 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Pip Cet Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sat, 13 Mar 2021 16:34:01 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 47067 X-GNU-PR-Package: emacs Original-Received: via spool by 47067-submit@debbugs.gnu.org id=B47067.16156532146811 (code B ref 47067); Sat, 13 Mar 2021 16:34:01 +0000 Original-Received: (at 47067) by debbugs.gnu.org; 13 Mar 2021 16:33:34 +0000 Original-Received: from localhost ([127.0.0.1]:60566 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lL7Co-0001lm-85 for submit@debbugs.gnu.org; Sat, 13 Mar 2021 11:33:34 -0500 Original-Received: from mail-ot1-f43.google.com ([209.85.210.43]:45757) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1lL7Cl-0001lY-SR for 47067@debbugs.gnu.org; Sat, 13 Mar 2021 11:33:32 -0500 Original-Received: by mail-ot1-f43.google.com with SMTP id f73-20020a9d03cf0000b02901b4d889bce0so3020180otf.12 for <47067@debbugs.gnu.org>; Sat, 13 Mar 2021 08:33:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=FXRhnGgle/KYytmu46Ni2gPOvO/wTho9e1Bn+Nu/8TU=; b=iIDQ2Uxiig/vs69QsmUT6gufS/JxXifYN0BQtE93hm9AgGv+SvQVaSgDJlNkj60WI4 BssYSkLvbw/6tKc8TzLhC/IboPkvlcW+Gc6SmirCNgMJYxnK0kZvizAz4cnm3Ks9ydqj RcOpVYAkeAUCt6yFX0COvmXsh0q9NlWbY+uEE6ONtAURL19NESJg2MwAWErvdRePFlAQ fkjU+KWOCDg1HVoiYsw5FclPReAPhX06D7mSXdiDGkvKjh+QMm0Q1BKH/4d2mGlHdEvq 7BXdLRDAscXt5QBVttAvGXr1IJuD4hZpUT38HbA14xnmnhSzUHnNK+bOBCmlk6p5cjTn gc7w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=FXRhnGgle/KYytmu46Ni2gPOvO/wTho9e1Bn+Nu/8TU=; b=Fohv257qoKel8gECpJrMzIyPY3eQA20VWudi/Tq/o2C08fIPPfJ/VSndYuSTOo6zbH OBN8UHJUjZ8bKWurXYvgvRC6hC+NpgWU2sSfWTEYrdOK4kmZdI6+TUtkjE+U+HCKa5lN z5Crz0zdanclLuAly0p2O6W4qA9KIVrcs3Y3oWoQAnabBukm8c33b6x52VM4dgvv5T+v Tr8421aWQx5v1IGpQd3P2TaWPXgjnqeGEgXud58lcJ6BKb/vVvu+P9NscFB07agvR8pp mLFdFI7qXUXWx6F3MlagITg/e3aSM3cR+bxYfgTmDRkLrfiHVeAPc0QMQDQhr3Ng0NFn YS4A== X-Gm-Message-State: AOAM533QC+mcPewV+6BCQ5bNFd5ykfSAA7uFZugrWHXch4n6osZcLsh+ fQpN8NqWDnovMInNuWup420E0DmMukGQy5DSVMs= X-Google-Smtp-Source: ABdhPJzyOqXFBwVgOPfH5KUlIRLSAAN2ZEj5Zk0DOgVfStS4oVuryAQr/kPAv/KXSYOFu8UjPTCNUahMgypMGC3E/80= X-Received: by 2002:a05:6830:1e51:: with SMTP id e17mr7658288otj.292.1615653206266; Sat, 13 Mar 2021 08:33:26 -0800 (PST) In-Reply-To: <83k0qbhvnh.fsf@gnu.org> X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:202271 Archived-At: --00000000000071236105bd6d9339 Content-Type: text/plain; charset="UTF-8" On Sat, Mar 13, 2021 at 4:21 PM Eli Zaretskii wrote: > > From: Pip Cet > > Date: Sat, 13 Mar 2021 15:45:52 +0000 > > Cc: Andrea Corallo , 47067@debbugs.gnu.org > > > > On Sat, Mar 13, 2021 at 3:27 PM Eli Zaretskii wrote: > > > > > It's nowhere in the C backtrace, only its caller > > > > > > > > But it was in one of the previous backtraces? > > > > > > Too many moons ago. The ABI was bumped since then, and so did the > > > *.eln files. > > > > The code you pasted matches c-beginning-of-statement-1, and so does > > the Lisp backtrace, so I would suggest we go with it... > > I don't know how to go with it: the backtrace is truncated (for > reasons I don't yet understand) before it gets to it. I'm pretty sure the first ?? is c-beginning-of-stmt-1. It's a function with five arguments, at least. > > > > So EDI is bunk at this point. Can you go back a bit further to where > > > > it's initialized? > > > > > > Sorry, I don't understand: I gave you the disassembly of 512 bytes > > > before, isn't that enough to see where EDI is assigned the value? Or > > > what do you mean by "go back"? > > > > It's not enough, no. we're looking for an insn of the form mov XXX, > > %edi or lea XXX, %edi, or anything like that. > > I went back 4KB, and the only two instructions that write into EDI are It's a long function, that might not have been enough. > the following: > > 0x09e3159d: mov -0x100(%ebp),%edi > 0x09e31c71: mov 0x9f37b9c,%edi > > > I'm suspicious because EDI is a register variable that is clobbered > > somehow right after a setjmp returned. Which setjmp implementation are > > you using? > > Not sure how to answer that. AFAIK, it's a setjmp from the MS runtime. So not some mingw wrapper for it? I just checked the only "mingw"-like sources I could find, and they don't appear to use the frame pointer argument properly... > > Is it possible that you're on Windows, but unlike other Windows > > setjmps, it's unsafe to call your setjmp through a function pointer? > > How do I tell? Well, you could just apply this untested patch, fix any obvious compile errors I might not have spotted, and try to reproduce it. I'm not currently on a Windows (or x86) machine, so it's a bit hard for me to test... > And why I never had any problems with setjmp elsewhere in Emacs, > although we use it all the time in keyboard.c and elsewhere? It's only natively-compiled code that attempts to call setjmp through a function pointer. This was fixed in the POSIX case, but I didn't touch the Windows code because I assumed that they used the extra argument in their non-standard API to do this right... > Here's an interesting factoid: while most addresses in the backtraces > I see with this recipe are identical from run to run, the 'fun' > arguments of funcall_lambda's aren't. Compare the backtrace I sent 3 > messages ago with this one: > > #0 0x01236964 in arithcompare_driver (nargs=2, args=0x28, > comparison=ARITH_LESS) at data.c:2673 > #1 0x01236a3c in Flss (nargs=2, args=0x28) at data.c:2691 > #2 0x09e32285 in ?? () > #3 0x01261a74 in funcall_lambda (fun=XIL(0xa000000007650188), nargs=5, > arg_vector=0x826a08) at eval.c:3292 > #4 0x012603c9 in Ffuncall (nargs=6, args=0x826a00) at eval.c:3013 > #5 0x09ea0dbf in ?? () > #6 0x012603c9 in Ffuncall (nargs=1, args=0x826bd8) at eval.c:3013 > #7 0x09e8e041 in ?? () > #8 0x01261a74 in funcall_lambda (fun=XIL(0xa00000000778d5b8), nargs=1, > arg_vector=0x826db8) at eval.c:3292 > #9 0x012603c9 in Ffuncall (nargs=2, args=0x826db0) at eval.c:3013 > #10 0x70895b36 in F632d666f6e742d6c6f636b2d6375742d6f66662d6465636c617261746f7273_c_font_lock_cut_off_declarators_0 () > from d:\usr\eli\.emacs.d\eln-cache\28.0.50-7d88f6c1\cc-fonts-d7d8a7f5-b7c359cd.eln > #11 0x01261a74 in funcall_lambda (fun=XIL(0xa000000007785f78), nargs=1, > arg_vector=0x827050) at eval.c:3292 > #12 0x012603c9 in Ffuncall (nargs=2, args=0x827048) at eval.c:3013 > #13 0x068daf93 in ?? () > #14 0x012dea14 in helper_save_restriction () at comp.c:4575 > #15 0x0122eb86 in wrong_type_argument (predicate=XIL(0x892404890c245c89), > value=XIL(0x8244c89e45d8be0)) at data.c:143 > Backtrace stopped: previous frame inner to this frame (corrupt stack?) > > Note how arguments to Funcall's are the same, whereas arguments to > funcall_lambda's aren't. Even the garbage in the 2 arguments to > wrong_type_argument are identical. Which non-stack addresses are invariant in that backtrace? > Sounds like something is uninitialized somewhere? Hmm... Maybe... Pip --00000000000071236105bd6d9339 Content-Type: text/x-diff; charset="US-ASCII"; name="bug46824.diff" Content-Disposition: attachment; filename="bug46824.diff" Content-Transfer-Encoding: base64 Content-ID: X-Attachment-Id: f_km7y4se80 ZGlmZiAtLWdpdCBhL3NyYy9jb21wLmMgYi9zcmMvY29tcC5jCmluZGV4IGIyNGZjYjViZjVhOTku LmNlM2FkMjJiMzA1NzYgMTAwNjQ0Ci0tLSBhL3NyYy9jb21wLmMKKysrIGIvc3JjL2NvbXAuYwpA QCAtMTk0Niw2ICsxOTQ2LDExIEBAIGVtaXRfc2V0am1wIChnY2Nfaml0X3J2YWx1ZSAqYnVmKQog ICByZXR1cm4gZ2NjX2ppdF9jb250ZXh0X25ld19jYWxsIChjb21wLmN0eHQsIE5VTEwsIGYsIDEs IGFyZ3MpOwogI2Vsc2UKICAgLyogX3NldGptcCAoYnVmLCBfX2J1aWx0aW5fZnJhbWVfYWRkcmVz cyAoMCkpICovCisgIGdjY19qaXRfcGFyYW0gKnBhcmFtc1tdID0KKyAgeworICAgIGdjY19qaXRf Y29udGV4dF9uZXdfcGFyYW0gKGNvbXAuY3R4dCwgTlVMTCwgY29tcC52b2lkX3B0cl90eXBlLCAi YnVmIiksCisgICAgZ2NjX2ppdF9jb250ZXh0X25ld19wYXJhbSAoY29tcC5jdHh0LCBOVUxMLCBj b21wLnVuc2lnbmVkX3R5cGUsICJyZXQiKSwKKyAgfTsKICAgZ2NjX2ppdF9ydmFsdWUgKmFyZ3Nb Ml07CiAKICAgYXJnc1swXSA9CkBAIC0xOTU5LDggKzE5NjQsMTQgQEAgZW1pdF9zZXRqbXAgKGdj Y19qaXRfcnZhbHVlICpidWYpCiAJCQkJCSAgICAiX19idWlsdGluX2ZyYW1lX2FkZHJlc3MiKSwK ICAgICAgIDEsIGFyZ3MpOwogICBhcmdzWzBdID0gYnVmOwotICByZXR1cm4gZW1pdF9jYWxsIChp bnRlcm5fY19zdHJpbmcgKFNUUiAoU0VUSk1QX05BTUUpKSwgY29tcC5pbnRfdHlwZSwgMiwgYXJn cywKLSAgICAgICAgICAgICAgICAgICAgZmFsc2UpOworICBnY2Nfaml0X2Z1bmN0aW9uICpmID0K KyAgICBnY2Nfaml0X2NvbnRleHRfbmV3X2Z1bmN0aW9uIChjb21wLmN0eHQsIE5VTEwsCisJCQkJ ICBHQ0NfSklUX0ZVTkNUSU9OX0lNUE9SVEVELAorCQkJCSAgY29tcC5pbnRfdHlwZSwgU1RSIChT RVRKTVBfTkFNRSksCisJCQkJICBBUlJBWUVMVFMgKHBhcmFtcyksIHBhcmFtcywKKwkJCQkgIGZh bHNlKTsKKworICByZXR1cm4gZ2NjX2ppdF9jb250ZXh0X25ld19jYWxsIChjb21wLmN0eHQsIE5V TEwsIGYsIDIsIGFyZ3MpOwogI2VuZGlmCiB9CiAK --00000000000071236105bd6d9339--