bug#6177: 23.2; emacs crashes when reverting a file

bug#6177: 23.2; emacs crashes when reverting a file

[Roland Winkler]

I've encountered a situation, where reverting a file reproducibly
crashes emacs.  I do not know much about debugging emacs on this level.
I've reproduced the crash under gdb. 
xbacktrace doesn't give any information.
`bt full' gives the info attached below. 
I'll be happy to provide more information if someone can give me further hints.

Roland



In GNU Emacs 23.2.1 (i686-pc-linux-gnu, GTK+ Version 2.14.4)
 of 2010-05-11 on regnitz.physics.niu.edu
Windowing system distributor `The X.Org Foundation', version 11.0.10502000
configured using `configure  '--prefix=/home/winkler/emacs/CVS/emacs''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: C
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: en_GB.utf8
  value of $LANG: en_US.ISO-8859-15
  value of $XMODIFIERS: nil
  locale-coding-system: iso-latin-9-unix
  default enable-multibyte-characters: t

Major mode: Outline

Minor modes in effect:
  display-battery-mode: t
  show-paren-mode: t
  display-time-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t
  abbrev-mode: t

Load-path shadows:
/home/winkler/emacs/site-lisp/tex-site hides /home/winkler/emacs/site-lisp/auctex/tex-site
/home/winkler/emacs/site-lisp/site-start hides /home/winkler/emacs/CVS/emacs/site-lisp/site-start

Features:
(shadow sort mail-extr message ecomplete rfc822 mml mml-sec
password-cache mm-decode mm-bodies mm-encode mailcap mail-parse rfc2231
rfc2047 rfc2045 qp ietf-drums mailabbrev nnheader gnus-util netrc
time-date mm-util mail-prsvr gmm-utils wid-edit mailheader canlock sha1
hex-util hashcash mail-utils warnings emacsbug multi-isearch noutline
outline easy-mmode help-mode view info battery bbdb-autoloads bbdb
timezone tex-site mozmail smtpmail sendmail bibtex ispell derived
disp-table ediff-init ediff-mult maplev align comint ring
browse-kill-ring himark table easymenu uniquify paren time regexp-opt
edmacro kmacro umlaute advice help-fns advice-preload vm-autoloads
tooltip ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd
font-setting tool-bar dnd fontset image fringe lisp-mode register page
menu-bar rfn-eshadow timer select scroll-bar mldrag mouse jit-lock
font-lock syntax facemenu font-core frame cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese hebrew
greek romanian slovak czech european ethiopic indian cyrillic chinese
case-table epa-hook jka-cmpr-hook help simple abbrev loaddefs button
minibuffer faces cus-face files text-properties overlay md5 base64
format env code-pages mule custom widget hashtable-print-readable
backquote make-network-process dbusbind font-render-setting gtk
x-toolkit x multi-tty emacs)


(gdb) xbacktrace
(gdb)
(gdb) bt full
#0  abort () at emacs.c:431
No locals.
#1  0x081deb85 in temp_set_point_both (buffer=0x98411c8, charpos=92, bytepos=92) at intervals.c:1950
No locals.
#2  0x08091754 in redisplay_window (window=159032549, just_this_one_p=0) at xdisp.c:13940
	w = (struct window *) 0x97aa4e0
	f = (struct frame *) 0x93908d8
	buffer = (struct buffer *) 0x93908d8
	old = (struct buffer *) 0x98411c8
	startp = {
  charpos = 154732760, 
  bytepos = 1
}
	update_mode_line = 1
	tem = <value optimized out>
	it = {
  window = 0, 
  w = 0xbf8ada24, 
  f = 0xbf8ad9f8, 
  method = 134789203, 
  stop_charpos = 1, 
  end_charpos = 154733456, 
  s = 0x1 <Address 0x1 out of bounds>, 
  string_nchars = 1, 
  region_beg_charpos = 155119152, 
  region_end_charpos = 0, 
  redisplay_end_trigger_charpos = 0, 
  multibyte_p = 0, 
  header_line_p = 0, 
  string_from_display_prop_p = 0, 
  ellipsis_p = 0, 
  avoid_cursor_p = 0, 
  dp = 0x9390b90, 
  dpvec = 0x1, 
  dpend = 0x1, 
  dpvec_char_len = -1081419228, 
  dpvec_face_id = 154733456, 
---Type <return> to continue, or q <return> to quit---
  saved_face_id = 0, 
  ctl_chars = {-1081418056, 134789871, -1081419228, 154733456, 1, 1, 1, 154732765, 58657919, -1210470454, -1209102348, 154733461, 154733456, 
    154732760, 0, 1}, 
  start = {
    pos = {
      charpos = 1, 
      bytepos = 0
    }, 
    overlay_string_index = 0, 
    string_pos = {
      charpos = -1, 
      bytepos = -1
    }, 
    dpvec_index = 0
  }, 
  current = {
    pos = {
      charpos = 0, 
      bytepos = 158106568
    }, 
    overlay_string_index = 0, 
    string_pos = {
      charpos = 0, 
      bytepos = 0
    }, 
    dpvec_index = 0
  }, 
  n_overlay_strings = -1, 
  overlay_strings = {0 <repeats 16 times>}, 
  string_overlays = {1, 1, -1, -1, -1, -1, 1, 1, -1, -1, -1, -1, 0, 0, 0, 0}, 
  string = 0, 
  from_overlay = 0, 
  stack = {{
      string = 0, 
      string_nchars = 0, 
      end_charpos = 0, 
      stop_charpos = 0, 
---Type <return> to continue, or q <return> to quit---
      cmp_it = {
        stop_pos = 0, 
        id = 0, 
        ch = 0, 
        lookback = 0, 
        nglyphs = 0, 
        nchars = 0, 
        nbytes = 0, 
        from = 0, 
        to = 0, 
        width = 0
      }, 
      face_id = 0, 
      u = {
        image = {
          object = 0, 
          slice = {
            x = 0, 
            y = 0, 
            width = 0, 
            height = 0
          }, 
          image_id = 0
        }, 
        comp = {
          object = 0
        }, 
        stretch = {
          object = 0
        }
      }, 
      position = {
        charpos = 0, 
        bytepos = 0
      }, 
      current = {
        pos = {
---Type <return> to continue, or q <return> to quit---
          charpos = 0, 
          bytepos = 0
        }, 
        overlay_string_index = 0, 
        string_pos = {
          charpos = 0, 
          bytepos = 138349850
        }, 
        dpvec_index = 0
      }, 
      from_overlay = 0, 
      area = LEFT_MARGIN_AREA, 
      method = GET_FROM_BUFFER, 
      multibyte_p = 0, 
      string_from_display_prop_p = 0, 
      display_ellipsis_p = 0, 
      avoid_cursor_p = 0, 
      line_wrap = TRUNCATE, 
      voffset = 0, 
      space_width = 0, 
      font_height = 0
    }, {
      string = 0, 
      string_nchars = 0, 
      end_charpos = 0, 
      stop_charpos = 0, 
      cmp_it = {
        stop_pos = 0, 
        id = 0, 
        ch = 0, 
        lookback = 0, 
        nglyphs = 0, 
        nchars = 0, 
        nbytes = 0, 
        from = 0, 
        to = 0, 
        width = 0
---Type <return> to continue, or q <return> to quit---
      }, 
      face_id = 0, 
      u = {
        image = {
          object = 0, 
          slice = {
            x = 0, 
            y = 0, 
            width = 0, 
            height = 0
          }, 
          image_id = 0
        }, 
        comp = {
          object = 0
        }, 
        stretch = {
          object = 0
        }
      }, 
      position = {
        charpos = 0, 
        bytepos = 0
      }, 
      current = {
        pos = {
          charpos = 0, 
          bytepos = 0
        }, 
        overlay_string_index = 0, 
        string_pos = {
          charpos = 0, 
          bytepos = 0
        }, 
        dpvec_index = 0
      }, 
      from_overlay = 0, 
---Type <return> to continue, or q <return> to quit---
      area = LEFT_MARGIN_AREA, 
      method = GET_FROM_BUFFER, 
      multibyte_p = 0, 
      string_from_display_prop_p = 0, 
      display_ellipsis_p = 0, 
      avoid_cursor_p = 0, 
      line_wrap = TRUNCATE, 
      voffset = 0, 
      space_width = 0, 
      font_height = 0
    }, {
      string = 0, 
      string_nchars = 0, 
      end_charpos = 0, 
      stop_charpos = 0, 
      cmp_it = {
        stop_pos = 0, 
        id = 0, 
        ch = 0, 
        lookback = 0, 
        nglyphs = 0, 
        nchars = 0, 
        nbytes = 0, 
        from = 0, 
        to = 0, 
        width = 0
      }, 
      face_id = 0, 
      u = {
        image = {
          object = 0, 
          slice = {
            x = 0, 
            y = 0, 
            width = 0, 
            height = 0
          }, 
---Type <return> to continue, or q <return> to quit---
          image_id = 0
        }, 
        comp = {
          object = 0
        }, 
        stretch = {
          object = 0
        }
      }, 
      position = {
        charpos = 0, 
        bytepos = 0
      }, 
      current = {
        pos = {
          charpos = 0, 
          bytepos = 0
        }, 
        overlay_string_index = 0, 
        string_pos = {
          charpos = 0, 
          bytepos = 0
        }, 
        dpvec_index = 0
      }, 
      from_overlay = 0, 
      area = LEFT_MARGIN_AREA, 
      method = GET_FROM_BUFFER, 
      multibyte_p = 0, 
      string_from_display_prop_p = 0, 
      display_ellipsis_p = 0, 
      avoid_cursor_p = 0, 
      line_wrap = TRUNCATE, 
      voffset = 0, 
      space_width = 0, 
      font_height = 0
    }, {
---Type <return> to continue, or q <return> to quit---
      string = 0, 
      string_nchars = 0, 
      end_charpos = 0, 
      stop_charpos = 0, 
      cmp_it = {
        stop_pos = 0, 
        id = 0, 
        ch = 0, 
        lookback = 0, 
        nglyphs = 0, 
        nchars = 0, 
        nbytes = 0, 
        from = 0, 
        to = 0, 
        width = 0
      }, 
      face_id = 0, 
      u = {
        image = {
          object = 0, 
          slice = {
            x = 0, 
            y = 0, 
            width = 0, 
            height = 0
          }, 
          image_id = 0
        }, 
        comp = {
          object = 0
        }, 
        stretch = {
          object = 0
        }
      }, 
      position = {
        charpos = 0, 
---Type <return> to continue, or q <return> to quit---
        bytepos = 0
      }, 
      current = {
        pos = {
          charpos = 0, 
          bytepos = 0
        }, 
        overlay_string_index = 0, 
        string_pos = {
          charpos = 0, 
          bytepos = 0
        }, 
        dpvec_index = 0
      }, 
      from_overlay = 0, 
      area = LEFT_MARGIN_AREA, 
      method = GET_FROM_BUFFER, 
      multibyte_p = 0, 
      string_from_display_prop_p = 0, 
      display_ellipsis_p = 0, 
      avoid_cursor_p = 0, 
      line_wrap = TRUNCATE, 
      voffset = 0, 
      space_width = 0, 
      font_height = 0
    }}, 
  sp = 0, 
  selective = 0, 
  what = IT_CHARACTER, 
  face_id = 0, 
  selective_display_ellipsis_p = 0, 
  ctl_arrow_p = 0, 
  face_box_p = 0, 
  start_of_box_run_p = 0, 
  end_of_box_run_p = 0, 
  overlay_strings_at_end_processed_p = 0, 
  ignore_overlay_strings_at_pos_p = 0, 
---Type <return> to continue, or q <return> to quit---
  glyph_not_available_p = 0, 
  starts_in_middle_of_char_p = 0, 
  face_before_selective_p = 0, 
  constrain_row_ascent_descent_p = 0, 
  line_wrap = TRUNCATE, 
  base_face_id = 0, 
  c = 0, 
  len = 0, 
  cmp_it = {
    stop_pos = 0, 
    id = 0, 
    ch = 0, 
    lookback = 0, 
    nglyphs = 0, 
    nchars = 0, 
    nbytes = 0, 
    from = 0, 
    to = 0, 
    width = 0
  }, 
  char_to_display = 0, 
  image_id = 0, 
  slice = {
    x = 0, 
    y = 0, 
    width = 0, 
    height = 0
  }, 
  space_width = 0, 
  voffset = 0, 
  tab_width = 0, 
  font_height = 0, 
  object = 0, 
  position = {
    charpos = 0, 
    bytepos = 0
  }, 
---Type <return> to continue, or q <return> to quit---
  truncation_pixel_width = 4, 
  continuation_pixel_width = 0, 
  first_visible_x = 0, 
  last_visible_x = 35, 
  last_visible_y = 2, 
  extra_line_spacing = 0, 
  max_extra_line_spacing = 0, 
  override_ascent = 0, 
  override_descent = 1, 
  override_boff = -1, 
  glyph_row = 0xfffffffe, 
  area = LEFT_MARGIN_AREA, 
  nglyphs = 160019150, 
  pixel_width = 158482792, 
  ascent = 138380954, 
  descent = -1081418200, 
  max_ascent = 135801416, 
  max_descent = 138380954, 
  phys_ascent = 138387003, 
  phys_descent = 160019182, 
  max_phys_ascent = 0, 
  max_phys_descent = 138349850, 
  current_x = 138349850, 
  continuation_lines_width = 138349850, 
  current_y = 138380954, 
  first_vpos = 157708968, 
  vpos = 157710061, 
  hpos = -1081418168, 
  left_user_fringe_bitmap = 11211, 
  right_user_fringe_bitmap = 2072, 
  left_user_fringe_face_id = 1, 
  right_user_fringe_face_id = 0
}
	current_matrix_up_to_date_p = 0
	used_current_matrix_p = 0
	buffer_unchanged_p = 1
	temp_scroll_step = 138519602
---Type <return> to continue, or q <return> to quit---
	rc = -1081419228
	centering_position = 154732760
	last_line_misfit = <value optimized out>
	beg_unchanged = 12311
	end_unchanged = 0
#3  0x08093ff3 in redisplay_window_0 (window=159032549) at xdisp.c:12238
No locals.
#4  0x08191756 in internal_condition_case_1 (bfun=0x8093fd0 <redisplay_window_0>, arg=159032549, handlers=138338078, 
    hfun=0x806a7b0 <redisplay_window_error>) at eval.c:1538
	val = <value optimized out>
	c = {
  tag = 138349850, 
  val = 138349850, 
  next = 0xbf8aedbc, 
  gcpro = 0x0, 
  jmp = {{
      __jmpbuf = {159032544, 138782056, 154732760, -1081417912, -610484051, -66182206}, 
      __mask_was_saved = 0, 
      __saved_mask = {
        __val = {1, 1, 138349874, 138467880, 138792550, 138349850, 157710061, 138468856, 3213549288, 138394472, 138389171, 159650248, 
          3213549304, 135803355, 138394474, 138389171, 1600000, 159650248, 138349874, 138389168, 3213549352, 138394474, 1600000, 138394472, 
          3213549352, 135859596, 138394474, 1600000, 0, 1, 5, 140075512}
      }
    }}, 
  backlist = 0x0, 
  handlerlist = 0xbf8aee84, 
  lisp_eval_depth = 0, 
  pdlcount = 4, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
	h = {
  handler = 138338078, 
  var = 138349850, 
  chosen_clause = 0, 
  tag = 0xbf8ade6c, 
---Type <return> to continue, or q <return> to quit---
  next = 0xbf8aee84
}
#5  0x0807bdb3 in redisplay_windows (window=159650248) at xdisp.c:12217
	w = (struct window *) 0x97aa4e0
#6  0x0808c6a8 in redisplay_internal (preserve_echo_area=<value optimized out>) at xdisp.c:11789
	f = (struct frame *) 0x93908d8
	tail = 159650248
	frame = 92
	w = (struct window *) 0x97aa4e0
	pause = 0
	must_finish = 1
	number_of_visible_frames = 1
	polling_stopped_here = 0
	old_frame = 154732765
	consider_all_windows_p = 1
#7  0x0812d7fe in read_char (commandflag=1, nmaps=2, maps=0xbf8aebc0, prev_event=138349850, used_mouse_menu=0xbf8aec80, end_time=0x0)
    at keyboard.c:2727
	c = <value optimized out>
	local_getcjmp = {{
    __jmpbuf = {160010582, -1, -1081414996, 159650248, -1081415016, 136182064}, 
    __mask_was_saved = 160010582, 
    __saved_mask = {
      __val = {138378154, 1, 4294967295, 3213552300, 4294967295, 3213552520, 135839284, 160010582, 138378154, 159650253, 134863687, 
        159032549, 160437710, 136468072, 138380954, 138458362, 138349850, 138349898, 159032549, 138387738, 92, 3213552424, 134876963, 
        160437726, 160437718, 154732765, 160415008, 159650248, 1, 12311, 6661, 24814821}
    }
  }}
	save_jump = {{
    __jmpbuf = {6661, 138349850, 1033, -1081414504, 159650253, 0}, 
    __mask_was_saved = 159151648, 
    __saved_mask = {
      __val = {3213552120, 136178327, 0, 138498386, 12311, 6661, 159650253, 1033, 17, 159650253, 0, 159151648, 3213552168, 136178327, 
        138498386, 138378154, 3213552200, 136179695, 159650253, 1, 16, 138378154, 160011752, 138349850, 3213552248, 136181883, 138378154, 
        138349850, 3213552256, 0, 4294967295, 1}
    }
  }}
	key_already_recorded = 0
---Type <return> to continue, or q <return> to quit---
	tem = -1081414528
	save = <value optimized out>
	previous_echo_area_message = 138349850
	also_record = 138349850
	reread = 0
	polling_stopped_here = <value optimized out>
	orig_kboard = (struct kboard *) 0x85e5398
#8  0x0812fc02 in read_key_sequence (keybuf=0xbf8aed24, bufsize=30, prompt=138349850, dont_downcase_last=0, can_return_switch_frame=1, 
    fix_current_buffer=1) at keyboard.c:9512
	interrupted_kboard = (KBOARD *) 0x85e5398
	key = 136182226
	used_mouse_menu = 0
	echo_local_start = 0
	last_real_key_start = 0
	keys_local_start = 0
	local_first_binding = 0
	from_string = 138349850
	count = 2
	t = 0
	echo_start = 0
	keys_start = 0
	nmaps = 2
	nmaps_allocated = 2
	defs = (Lisp_Object * volatile) 0xbf8aeba0
	submaps = (Lisp_Object * volatile) 0xbf8aebc0
	orig_local_map = 158462166
	orig_keymap = 138349850
	localized_local_map = 0
	first_binding = 0
	first_unbound = 31
	mock_input = 0
	fkey = {
  parent = 140884014, 
  map = 140884014, 
  start = 0, 
  end = 0
}
---Type <return> to continue, or q <return> to quit---
	keytran = {
  parent = 138343142, 
  map = 138343142, 
  start = 0, 
  end = 0
}
	indec = {
  parent = 140884022, 
  map = 140884022, 
  start = 0, 
  end = 0
}
	shift_translated = 0
	delayed_switch_frame = 138349850
	original_uppercase = 0
	original_uppercase_position = -1
	starting_buffer = (struct buffer *) 0x98411c8
	fake_prefixed_keys = 138349850
#9  0x081319dc in command_loop_1 () at keyboard.c:1643
	cmd = <value optimized out>
	lose = <value optimized out>
	keybuf = {138381618, 196, 57, -1221169928, -1221175016, 0, 0, 0, 0, 1, 1011, -1224045256, -1219003112, 134545402, -1221133400, 
  134523852, 1, -1208881164, 0, -1081414268, -1081414432, 0, -1081475072, 138349850, 139145754, -379121664, 0, 138621440, 138621424, 
  -1081414232}
	i = <value optimized out>
	prev_modiff = 1767
	prev_buffer = (struct buffer *) 0x98411c8
	already_adjusted = 0
#10 0x08191850 in internal_condition_case (bfun=0x8131800 <command_loop_1>, handlers=138387834, hfun=0x812b0d0 <cmd_error>) at eval.c:1490
	val = <value optimized out>
	c = {
  tag = 138349850, 
  val = 138349850, 
  next = 0xbf8aeed0, 
  gcpro = 0x0, 
  jmp = {{
      __jmpbuf = {0, 138621440, 138621424, -1081413992, -604282707, -66051134}, 
---Type <return> to continue, or q <return> to quit---
      __mask_was_saved = 0, 
      __saved_mask = {
        __val = {3086086132, 3070921888, 32, 3213552916, 3086008477, 3075203392, 139781008, 3213552840, 3074245814, 3075203392, 3086068668, 
          3213552864, 3075198964, 276967387, 3075964184, 8655230, 57, 3213553520, 3213553228, 3213553520, 3213553368, 135516052, 2, 
          3073813544, 3075964184, 0, 4294967295, 3086086132, 134523852, 3086087784, 3213553312, 3086026075}
      }
    }}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
	h = {
  handler = 138387834, 
  var = 138349850, 
  chosen_clause = 1, 
  tag = 0xbf8aedbc, 
  next = 0x0
}
#11 0x0812a5f5 in command_loop_2 () at keyboard.c:1360
	val = 1
#12 0x0819192a in internal_catch (tag=138384906, func=0x812a5d0 <command_loop_2>, arg=138349850) at eval.c:1226
	c = {
  tag = 138384906, 
  val = 138349850, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {{
      __jmpbuf = {0, 138621440, 138621424, -1081413736, -604143443, -65913918}, 
      __mask_was_saved = 0, 
      __saved_mask = {
        __val = {0, 0, 0, 0, 0, 3075203520, 3075089079, 3075095872, 3075083313, 3075083103, 0, 0, 0, 3075203448, 177, 22, 0, 1, 139774040, 
          0, 138517264, 138515147, 138375704, 3213553544, 135803355, 138517266, 138515147, 138349850, 138375704, 138349874, 138515144, 
          140779680}
---Type <return> to continue, or q <return> to quit---
      }
    }}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
#13 0x0812af1f in command_loop () at keyboard.c:1339
No locals.
#14 0x0812b2db in recursive_edit_1 () at keyboard.c:954
	val = <value optimized out>
#15 0x0812b424 in Frecursive_edit () at keyboard.c:1016
	buffer = 138349850
#16 0x08120eb7 in main (argc=1, argv=0xbf8af3a4) at emacs.c:1833
	dummy = 139723384
	stack_bottom_variable = 8 '\b'
	do_initial_setlocale = 1
	skip_args = 0
	rlim = {
  rlim_cur = 8388608, 
  rlim_max = 18446744073709551615
}
	no_loadup = 0
	junk = 0x0
	dname_arg = 0x0
(gdb) 
(gdb) 
(gdb) 

bug#6177: 23.2; emacs crashes when reverting a file

[Eli Zaretskii]

> From: Roland Winkler <roland.winkler@physik.uni-erlangen.de>
> Date: Tue, 11 May 2010 18:28:10 -0500
> Cc: 
> 
> I've encountered a situation, where reverting a file reproducibly
> crashes emacs.  I do not know much about debugging emacs on this level.
> I've reproduced the crash under gdb. 
> xbacktrace doesn't give any information.

Can you show the steps to reproduce this, starting with "emacs -Q"?

bug#6177: 23.2; emacs crashes when reverting a file

[Roland Winkler]

On Wed May 12 2010 Eli Zaretskii wrote:
> > I've encountered a situation, where reverting a file reproducibly
> > crashes emacs.  I do not know much about debugging emacs on this level.
> > I've reproduced the crash under gdb. 
> > xbacktrace doesn't give any information.
> 
> Can you show the steps to reproduce this, starting with "emacs -Q"?

I can try to boil it down to some simpler sequence. The crash occurs
with some larger package I've been working with where reverting
buffers did not quite work the way it is supposed to. At some point
I ended up with the situation that reverting a buffer reproducibly
crashes emacs. Yet it could well be the case that the real cause is
only loosely related to reverting.

If I don't succeed with pinning this down, I'll post the whole code
so that someone more knowledgeable can look into this.

Any hints on what these crashes are possibly be related with
according to the backtrace are greatly appreciated.

Roland

bug#6177: 23.2; emacs crashes when reverting a file

[Eli Zaretskii]

> Date: Wed, 12 May 2010 08:13:41 -0500
> From: "Roland Winkler" <Roland.Winkler@physik.uni-erlangen.de>
> Cc: 6177@debbugs.gnu.org
> 
> Any hints on what these crashes are possibly be related with
> according to the backtrace are greatly appreciated.

Let me try to give you some insights, by walking the call-stack
frames, telling what I see, and asking questions.

  #1  0x081deb85 in temp_set_point_both (buffer=0x98411c8, charpos=92, bytepos=92) at intervals.c:1950

This frame causes the crash here:

  if (charpos > BUF_ZV (buffer) || charpos < BUF_BEGV (buffer))
    abort ();

BUF_ZV and BUF_BEGV are, respectively (point-max) and (point-min) of
the buffer.  Since we see that charpos is 92, I'm guessing that the
first comparison is the culprit, i.e. (point-max) is less than or
equal to 92.

What do the following GDB commands display in frame #1?

  (gdb) print buffer->zv
  (gdb) print *buffer->text->beg@N

Here N is the value of buffer->zv displayed by the first command.

  #2  0x08091754 in redisplay_window (window=159032549, just_this_one_p=0) at xdisp.c:13940

This frame calls temp_set_point_both here:

  /* Restore current_buffer and value of point in it.  */
  TEMP_SET_PT_BOTH (CHARPOS (opoint), BYTEPOS (opoint));

opoint is initialized at the beginning of the function to the value of
point:

  SET_TEXT_POS (lpoint, PT, PT_BYTE);
  opoint = lpoint;

So it looks like the value of point that was valid before redisplaying
the window somehow became invalid during redisplaying it.  Hmm...
What kind of buffer is this?  Type these commands to find out:

  (gdb) print buffer->name
  (gdb) xstring

Also, what window are we redisplaying?  Type these commands:

  (gdb) print w->mini_p
  (gdb) xsymbol

TIA

bug#6177: 23.2; emacs crashes when reverting a file

[Roland Winkler]

On Wed May 12 2010 Eli Zaretskii wrote:
> > I've encountered a situation, where reverting a file reproducibly
> > crashes emacs.  I do not know much about debugging emacs on this level.
> > I've reproduced the crash under gdb. 
> > xbacktrace doesn't give any information.
> 
> Can you show the steps to reproduce this, starting with "emacs -Q"?

I got a simpler test case that works with emacs -Q.

The point about the code below is that buffer *bar* depends on what
happens to file foo.txt visited in its own buffer: reverting buffer
*bar* really operates on the buffer visiting foo.txt.

The detailed steps to reprdouce this bug are as follows:

Create file foo.txt

cat > ~/foo.txt <<EOF
Hello world.
EOF

In "emacs -Q" load the code below. Then run my-init, touch file
foo.txt and finally move point in buffer bar which triggers
my-revert-buffer. This crashes emacs.
If the second with-current-buffer is removed from my-revert-buffer
the code runs fine.

Roland



(setq my-buffer "foo.txt")

(defun my-init ()
  (interactive)
  (find-file (concat "~/" my-buffer))
  (my-bar))

(defun my-bar ()
  (with-current-buffer (get-buffer-create "*bar*")
    (erase-buffer)
    (insert "acdef")
    (setq revert-buffer-function 'my-revert-buffer
          mode-line-buffer-identification
          (list 24 (buffer-name) "  "
                '(:eval (format "%d" (my-revert-buffer)))))
    (add-hook 'post-command-hook 'force-mode-line-update nil t)))

(defun my-revert-buffer (&optional ignore-auto noconfirm)
  "My `revert-buffer-function'."
  (when (or noconfirm
            (not (verify-visited-file-modtime (get-buffer my-buffer))))
    (with-current-buffer my-buffer
      (kill-all-local-variables)
      (let (revert-buffer-function)       ; don't loop.
        (revert-buffer ignore-auto t)))
    ;; the following two lines make emacs crash
    (with-current-buffer (get-buffer-create "*bar*")
      (erase-buffer)))
  0)

bug#6177: 23.2; emacs crashes when reverting a file

[Geoff Gole]

I can reproduce this crash in an emacs -Q with the following code:

(with-current-buffer (get-buffer-create "foo")
  (setq mode-line-buffer-identification '(:eval (erase-buffer)))
  (switch-to-buffer "foo")
  (insert "a"))

This is GNU Emacs 23.1.50.1 (i686-pc-linux-gnu, GTK+ Version 2.12.11)
of 2009-07-30. Other people were able to reproduce with 64 bit linux,
GNU Emacs 24.0.50.1 (x86_64-unknown-linux-gnu, GTK+ Version 2.20.0)
and GNU Emacs 21.3.1 (i386-mingw-nt5.1.2600) of 2004-03-10.

bug#6177: 23.2; emacs crashes when reverting a file

[Roland Winkler]

On Wed May 26 2010 Geoff Gole wrote:
> I can reproduce this crash in an emacs -Q with the following code:
> 
> (with-current-buffer (get-buffer-create "foo")
>   (setq mode-line-buffer-identification '(:eval (erase-buffer)))
>   (switch-to-buffer "foo")
>   (insert "a"))

This looks, indeed, like the same thing in a yet simpler version.
Since I submitted my original bug report I switched from a 32bit to
a 64bit OS, with which I can reproduce these crashes, too.

In GNU Emacs 23.2.1 (x86_64-unknown-linux-gnu, GTK+ Version 2.20.0)
 of 2010-05-21 on regnitz

bug#6177: 23.2; emacs crashes when reverting a file

[Chong Yidong]

"Roland Winkler" <Roland.Winkler@physik.uni-erlangen.de> writes:

> On Wed May 26 2010 Geoff Gole wrote:
>> I can reproduce this crash in an emacs -Q with the following code:
>> 
>> (with-current-buffer (get-buffer-create "foo")
>>   (setq mode-line-buffer-identification '(:eval (erase-buffer)))
>>   (switch-to-buffer "foo")
>>   (insert "a"))
>
> This looks, indeed, like the same thing in a yet simpler version.
> Since I submitted my original bug report I switched from a 32bit to
> a 64bit OS, with which I can reproduce these crashes, too.

I've checked in a fix.  Thanks for the bug reports.

bug#6177: 23.2; emacs crashes when reverting a file

[Gilles Pion]

Chong Yidong <cyd <at> stupidchicken.com> writes:


> 
> I've checked in a fix.  Thanks for the bug reports.
> 
> 



Hello,

Since I' also encounter this bug from time to time (using GNU Emacs 23.2.1
powerpc-ibm-aix5.3.0.0, X toolkit) , could possibly someone explains me how to
fetch a copy of the fix?

I've tried to download the development snapshot from savannah using bzr but,
have been able to wait for the download process to finish, after having using
enormous amounts of memory. And "Browse source" is disabled on Savannah
("loggerhead disabled due to unstability")...

thks,

bug#6177: 23.2; emacs crashes when reverting a file

[Gilles Pion]

Gilles Pion <gpion <at> lfdj.com> writes:

> 
> Since I' also encounter this bug from time to time (using GNU Emacs 23.2.1
> powerpc-ibm-aix5.3.0.0, X toolkit) , could possibly someone explains me how to
> fetch a copy of the fix?
> 


Suddenly realizing that my problem is not *exactly* the same as the one which is
described in the initial post of this thread.

Here, emacs don't crash but goes in an endless loop

Steps to reproduce: (emacs started with "-Q")

* create text file outside of emacs 
* open it in emacs buffer (C-x C-F)
* make minor modifications in emacs buffer
* "/bin/touch" the file outside of emacs
* M-x revert-buffer

-> emacs goes into endless loop

bug#6177: 23.2; emacs crashes when reverting a file

[Glenn Morris]

Gilles Pion wrote:

> I've tried to download the development snapshot from savannah using
> bzr but, have been able to wait for the download process to finish,
> after having using enormous amounts of memory.

I used to recommend lightweight checkouts for this kind of problem:

http://lists.gnu.org/archive/html/emacs-devel/2010-02/msg00058.html

But I've since found out there is a bug that makes them fairly
useless, IMO:

https://bugs.launchpad.net/bzr/+bug/319374

Anyway, it might work for you; or perhaps you could use one of the
unoffical mirrors that offer the repository in alternative formats.

>  And "Browse source" is disabled on Savannah ("loggerhead disabled
> due to unstability")...

Yes, it seems Savannah is not capable of providing this service.
I can only refer you to an unofficial mirror:

http://bazaar.launchpad.net/~vcs-imports/emacs/trunk/revision/100461

bug#6177: 23.2; emacs crashes when reverting a file

[Gilles Pion]

Glenn Morris <rgm <at> gnu.org> writes:

> 
> Yes, it seems Savannah is not capable of providing this service.
> I can only refer you to an unofficial mirror:
> 
> http://bazaar.launchpad.net/~vcs-imports/emacs/trunk/revision/100461
> 

unsuccessful:
> Sorry, there was a problem connecting to the Launchpad server.
>Try reloading this page in a minute or two. If the problem persists, let us 
>know in the #launchpad IRC channel on Freenode.
>Thanks for your patience.

I give up: I've tried a big number of times to download using bzr and it has
failed every time, after 2 or three hours, with an error like this one:

>ShortReadvError: readv() read 3242361 bytes rather than 100198581 bytes at 0 
>for "http://bzr.savannah.gnu.org/r/emacs/.bzr/repository/packs
>/cbc955c848fe27435bbc01a59b4808b0.pack"

/../

>*** Bazaar has encountered an internal error.  This probably indicates a
>    bug in Bazaar.  You can help us fix it by filing a bug report at
>        https://bugs.launchpad.net/bzr/+filebug
>    including this traceback and a description of the problem.

Still searching for a way to download *easily* the latest emacs dev source
snapshot

:-(

bug#6177: 23.2; emacs crashes when reverting a file

[Stefan Monnier]

>> http://bazaar.launchpad.net/~vcs-imports/emacs/trunk/revision/100461
> unsuccessful:
>> Sorry, there was a problem connecting to the Launchpad server.
>> Try reloading this page in a minute or two. If the problem persists, let us 
>> know in the #launchpad IRC channel on Freenode.
>> Thanks for your patience.

IIUC launchpad works, but if the Bzr it uses internally takes too long
it returns the above page.  The good thing is that the caches mean that
the subsequent accesses are faster, so in my experience the first access
fails but if I try it again, then it works.


        Stefan

bug#6177: 23.2; emacs crashes when reverting a file

[Glenn Morris]

Gilles Pion wrote:

>>*** Bazaar has encountered an internal error.  This probably indicates a
>>    bug in Bazaar.  You can help us fix it by filing a bug report at
>>        https://bugs.launchpad.net/bzr/+filebug
>>    including this traceback and a description of the problem.

If you report it as suggested, you are likely to get more expert help,
and you will be helping to improve GNU Bazaar.

> Still searching for a way to download *easily* the latest emacs dev source
> snapshot

bzr branch --stacked http://bzr.savannah.gnu.org/r/emacs/trunk

is not ideal, but takes < 5 minutes for me (on a machine with a good
network connection), and never uses more than 240MB resident memory.
(bzr revert works on the result too.)

The Bazaar mailing list seems to be a helpful one.