bug#18832: 24.4; emacs crashed by eww on some webpages

bug#18832: 24.4; emacs crashed by eww on some webpages

[Евгений Терешков]

[-- Attachment #1: Type: text/plain, Size: 1339 bytes --]

Hi.

My freshly-compiled 24.4 emacs crashing reproducible on eww invocation
with some webpages.

Steps to reproduce:

1. Run "/usr/bin/emacs -Q"
2. M-x eww
3. http://ya.ru<RET>
4. *emacs crashes with lot of dump info in stderr*

Alternative way:

1. Open http://ya.ru in external browser and save full HTML source for page
2. Run "/usr/bin/emacs -Q"
3. M-x eww-open-file
4. Type path to saved HTML file + <RET>
5. *emacs crashes with lot of dump info in stderr*

I noticed that alternative way ISN'T working when option "Web Page, HTML only"
used in my Firefox's save dialog (crash is reproducible with option
"Web Page, complete"). EWW succesfully renders saved HTML file in that
case. To help with debugging, I have attached that "good" (HTML only)
and "bad" (complete) HTML pages (bzipped).

Also, I have checked all of my emacs builds:
non-X/motif/athena/gtk/gtk3.  Only non-X build behave differently: using
eww on URL/file just renders page AND write out some errors about ":3:
HTML parser error: Element script embeds close tag" on stderr (Ctrl+L
clean up this errors). With other buildw, emacs crashes.

I have attached bzipped listing of "bt full" on dumped core file, but
decide not attaching core file itself (it is about 4M bzipped and ~30M
raw).

I hope this information will be helpfull to fix this crash. Thanks in advance.

[-- Attachment #2: good html --]
[-- Type: application/octet-stream, Size: 3592 bytes --]

[-- Attachment #3: bad html --]
[-- Type: application/octet-stream, Size: 3894 bytes --]

[-- Attachment #4: gdb full backtrace --]
[-- Type: application/octet-stream, Size: 9022 bytes --]

[-- Attachment #5: Type: text/plain, Size: 9225 bytes --]


Below information from M-x report-emacs-bug:

In GNU Emacs 24.4.1 (x86_64-alt-linux-gnu, GTK+ Version 3.14.4)
 of 2014-10-25 on localhost.localdomain
Windowing system distributor `The X.Org Foundation', version 11.0.11601000
Configured using:
 `configure --build=x86_64-alt-linux --host=x86_64-alt-linux --prefix=/usr
 --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc
 --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64
 --libexecdir=/usr/lib --localstatedir=/var/lib --sharedstatedir=/var/lib
 --mandir=/usr/share/man --infodir=/usr/share/info
 --disable-dependency-tracking --without-included-gettext
 --sharedstatedir=/var --with-pop --with-x-toolkit=gtk3 --with-png
 --with-jpeg --with-xpm --with-gif --with-tiff --with-gpm
 --enable-font-backend --with-freetype --with-xft --with-dbus --with-rsvg
 --with-wide-int 'CFLAGS=-pipe -Wall -g -O2''

Important settings:
  value of $LANG: ru_RU.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Messages

Minor modes in effect:
  delete-selection-mode: t
  winpoint-mode: t
  shell-dirtrack-mode: t
  erc-services-mode: t
  erc-notifications-mode: t
  erc-hecomplete-mode: t
  which-function-mode: t
  url-handler-mode: t
  rcirc-track-minor-mode: t
  minibuffer-electric-default-mode: t
  iswitchb-mode: t
  icomplete-mode: t
  global-reveal-mode: t
  reveal-mode: t
  erc-autojoin-mode: t
  erc-ring-mode: t
  erc-networks-mode: t
  erc-pcomplete-mode: t
  erc-track-mode: t
  erc-track-minor-mode: t
  erc-match-mode: t
  erc-button-mode: t
  erc-fill-mode: t
  erc-stamp-mode: t
  erc-smiley-mode: t
  erc-irccontrols-mode: t
  erc-noncommands-mode: t
  erc-readonly-mode: t
  erc-scrolltobottom-mode: t
  display-time-mode: t
  desktop-save-mode: t
  global-hl-line-mode: t
  diff-auto-refine-mode: t
  jabber-activity-mode: t
  jabber-mode-line-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  buffer-read-only: t
  size-indication-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-x k <return> M-x r e p o <tab> r t - e m a <retu
rn>

Recent messages:
my-final stopped
my-gnus started
my-gnus stopped
emacs.d/init.el loaded in 3s
Wrote /home/evg/.emacs.desktop.lock
Package iswitchb is obsolete!
Package erc-hecomplete is obsolete!
Desktop: 2 frames, 0 buffers restored.
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list...

Load-path shadows:
~/.emacs.d/lisp/cmake-mode hides /home/evg/.emacs.d/elpa/cmake-mode-20140217.659/cmake-mode
~/.emacs.d/lisp/yaml-mode hides /home/evg/.emacs.d/elpa/yaml-mode-20140824.2132/yaml-mode
/home/evg/.emacs.d/elpa/php-mode-20140825.301/php-mode hides /usr/share/emacs/site-lisp/php-mode
/usr/share/emacs/site-lisp/remember/remember hides /usr/share/emacs/site-lisp/remember
/home/evg/.emacs.d/elpa/rpm-spec-mode-20140120.50/rpm-spec-mode hides /usr/share/emacs/site-lisp/rpm-spec-mode
/usr/share/emacs/site-lisp/remember/remember hides /usr/share/emacs/24.4/lisp/textmodes/remember
/usr/share/emacs/site-lisp/css-mode hides /usr/share/emacs/24.4/lisp/textmodes/css-mode
/usr/share/emacs/site-lisp/fortune hides /usr/share/emacs/24.4/lisp/play/fortune
~/.emacs.d/lisp/erc-autoaway hides /usr/share/emacs/24.4/lisp/erc/erc-autoaway
/home/evg/.emacs.d/elpa/ert-0.1/ert hides /usr/share/emacs/24.4/lisp/emacs-lisp/ert
/usr/share/emacs/24.4/lisp/mouse-sel hides /usr/share/emacs/24.4/lisp/obsolete/mouse-sel

Features:
(shadow sort org-rmail org-mhe org-irc org-info org-gnus org-docview
doc-view image-mode org-bibtex bibtex org-bbdb org-w3m org org-macro
org-footnote org-pcomplete org-list org-faces org-entities noutline outline
org-version ob-emacs-lisp ob ob-tangle ob-ref ob-lob ob-table ob-exp
org-src ob-keys ob-comint ob-core ob-eval org-compat org-macs org-loaddefs
find-func flyspell ispell mail-extr emacsbug mule-util .emacs my-init
my-rcirc my-gnus epa-mail gnus-cite gnus-alias gnus-dired spam spam-stat
gnus-uu yenc gnus-msg utf7 smtpmail sendmail imap pop3 my-final my-notmuch
my-org my-global-keys my-dired dired-single edmacro kmacro dired my-hooks
my-defuns my-setq disp-table delsel my-requires yaml-mode pabbrev
magit-key-mode magit view epa derived epg git-rebase-mode git-commit-mode
server edebug backtr rx autosmiley smiley gnus-art mm-uu mml2015 gnus-sum
nnoo gnus-group gnus-undo nnmail mail-source gnus-start gnus-spec gnus-int
gnus-range gnus-win uptimes winpoint tramp tramp-compat tramp-loaddefs
trampver shell-command shell yank-pop-summary e-other-window idle-require
midnight ibuf-ext ibuffer jka-compr erc-services erc-desktop-notifications
erc-hecomplete which-func imenu url-handlers url-parse url-vars rcirc avoid
minibuf-eldef iswitchb image-file icomplete grep compile gnus gnus-ems
nnheader reveal autorevert filenotify erc-list erc-menu erc-join erc-ring
erc-networks erc-pcomplete pcomplete erc-track erc-match erc-button
erc-fill erc-stamp erc-netsplit erc-goodies erc erc-backend erc-compat pp
time desktop frameset autoinsert cus-start cus-load bigint-autoloads
cmake-mode-autoloads command-frequency-autoloads elk-test-autoloads
erc-image-autoloads erc-view-log-autoloads ert-autoloads
fringe-helper-autoloads highlight-parentheses-autoloads
idle-require-autoloads jedi-autoloads auto-complete-autoloads epc-autoloads
ctable-autoloads concurrent-autoloads json-mode-autoloads
json-reformat-autoloads json-snatcher-autoloads log4j-mode-autoloads
lua-mode-autoloads info magit-autoloads git-rebase-mode-autoloads
git-commit-mode-autoloads nginx-mode-autoloads php-mode-autoloads cl-macs
popup-autoloads python-environment-autoloads deferred-autoloads
rpm-spec-mode-autoloads smart-tab-autoloads winpoint-autoloads
yaml-mode-autoloads package epg-config template quail help-mode remember
notmuch hl-line notmuch-version notmuch-message notmuch-maildir-fcc
notmuch-hello notmuch-tree notmuch-parser notmuch-show notmuch-print
notmuch-crypto notmuch-mua notmuch-address notmuch-wash diff-mode coolj
notmuch-query goto-addr thingatpt icalendar diary-lib diary-loaddefs
cal-menu calendar cal-loaddefs notmuch-tag crm notmuch-lib mm-view
mml-smime smime dig jabber jabber-notifications notifications
jabber-libnotify dbus jabber-awesome jabber-osd osd jabber-wmii
jabber-xmessage jabber-festival jabber-sawfish jabber-ratpoison jabber-tmux
jabber-screen jabber-socks5 jabber-ft-server jabber-si-server
jabber-ft-client jabber-ft-common jabber-si-client jabber-si-common
jabber-feature-neg jabber-truncate jabber-time jabber-autoaway
jabber-vcard-avatars jabber-chatstates jabber-events jabber-vcard
jabber-avatar mailcap jabber-activity jabber-watch jabber-modeline advice
jabber-ahc-presence jabber-ahc jabber-version jabber-ourversion
jabber-muc-nick-completion hippie-exp comint ansi-color jabber-browse
jabber-search jabber-register jabber-roster jabber-presence jabber-muc
jabber-bookmarks jabber-private jabber-muc-nick-coloring hexrgb
jabber-widget jabber-disco wid-edit jabber-chat jabber-history
jabber-chatbuffer jabber-alert jabber-iq jabber-core jabber-console
sgml-mode jabber-keymap jabber-sasl sasl sasl-anonymous sasl-login
sasl-plain fsm jabber-logon cl gv jabber-conn srv dns starttls tls gnutls
cl-loaddefs cl-lib jabber-xml xml jabber-menu jabber-util auth-source eieio
byte-opt bytecomp byte-compile cconv eieio-core gnus-util password-cache
git log-edit easy-mmode message format-spec rfc822 mml easymenu mml-sec
mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045 ietf-drums
mm-util help-fns mail-prsvr mailabbrev mail-utils gmm-utils mailheader ring
pcvs-util add-log ewoc saveplace paren time-date cyril-util tooltip
electric uniquify ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd
tool-bar dnd fontset image regexp-opt fringe tabulated-list newcomment
lisp-mode prog-mode register page menu-bar rfn-eshadow timer select
scroll-bar mouse jit-lock font-lock syntax facemenu font-core frame cham
georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev
minibuffer nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule custom
widget hashtable-print-readable backquote make-network-process dbusbind
gfilenotify dynamic-setting system-font-setting font-render-setting
move-toolbar gtk x-toolkit x multi-tty emacs)

Memory information:
((conses 16 404938 38938)
 (symbols 48 51050 1)
 (miscs 40 142 233)
 (strings 32 117248 43239)
 (string-bytes 1 3438341)
 (vectors 16 46317)
 (vector-slots 8 782094 21347)
 (floats 8 496 121)
 (intervals 56 470 94)
 (buffers 960 15)
 (heap 1024 35381 3140))

-- 
С уважением, Терешков Евгений.
Jabber ID: evg@altlinux.org, evg_krsk@jabber.ru

bug#18832: 24.4; emacs crashed by eww on some webpages

[Lars Magne Ingebrigtsen]

Евгений Терешков <evg-krsk@yandex.ru> writes:

> My freshly-compiled 24.4 emacs crashing reproducible on eww invocation
> with some webpages.
>
> Steps to reproduce:
>
> 1. Run "/usr/bin/emacs -Q"
> 2. M-x eww
> 3. http://ya.ru<RET>
> 4. *emacs crashes with lot of dump info in stderr*

I'm unable to reproduce this in the trunk.  Does this still happen for
you?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

bug#18832: 24.4; emacs crashed by eww on some webpages

[Евгений Терешков]

[-- Attachment #1: Type: text/plain, Size: 533 bytes --]

Lars Magne Ingebrigtsen writes:

>> My freshly-compiled 24.4 emacs crashing reproducible on eww invocation
>> with some webpages.
>> Steps to reproduce:
>> 1. Run "/usr/bin/emacs -Q"
>> 2. M-x eww
>> 3. http://ya.ru<RET>
>> 4. *emacs crashes with lot of dump info in stderr*
>
> I'm unable to reproduce this in the trunk.  Does this still happen for
> you?

Thanks for reply.

It is very strange, but at this moment I see only stderr output and CANT
REPRODUCE crash (I have re-checked X and non-X builds, see attached
streenshots).


[-- Attachment #2: emacs24-Xs.png --]
[-- Type: image/png, Size: 16373 bytes --]

[-- Attachment #3: emacs24-nox.png --]
[-- Type: image/png, Size: 6843 bytes --]

[-- Attachment #4: Type: text/plain, Size: 109 bytes --]

-- 
С уважением, Терешков Евгений.
Jabber ID: evg@altlinux.org, evg_krsk@jabber.ru

bug#18832: 24.4; emacs crashed by eww on some webpages

[Lars Magne Ingebrigtsen]

Евгений Терешков <evg-krsk@yandex.ru> writes:

> It is very strange, but at this moment I see only stderr output and CANT
> REPRODUCE crash (I have re-checked X and non-X builds, see attached
> streenshots).

I would assume that those messages are coming from gtk+ or libxml2.  Are
you running a debugging build of those libraries?  I don't get any such
messages.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

bug#18832: 24.4; emacs crashed by eww on some webpages

[Евгений Терешков]

Lars Magne Ingebrigtsen writes:

>> It is very strange, but at this moment I see only stderr output and CANT
>> REPRODUCE crash (I have re-checked X and non-X builds, see attached
>> streenshots).
>
> I would assume that those messages are coming from gtk+ or libxml2.  Are
> you running a debugging build of those libraries?  I don't get any such
> messages.

Nope, this is ordinary builds. This messages are not specific to gtk+, as I
have seen it in nonx/gtk/gtk3/motif/athena builds (as you can see on
screenshots in my previous message). And yes, all those build are compiled
with libxml2.

How can I check wherevers it is problem in my libxml2 build or emacs
itself?

-- 
С уважением, Терешков Евгений.
Jabber ID: evg@altlinux.org, evg_krsk@jabber.ru

bug#18832: 24.4; emacs crashed by eww on some webpages

[Lars Magne Ingebrigtsen]

Евгений Терешков <evg-krsk@yandex.ru> writes:

> Nope, this is ordinary builds. This messages are not specific to gtk+, as I
> have seen it in nonx/gtk/gtk3/motif/athena builds (as you can see on
> screenshots in my previous message). And yes, all those build are compiled
> with libxml2.
>
> How can I check wherevers it is problem in my libxml2 build or emacs
> itself?

I'm not sure, but I'm pretty sure those warnings are not from Emacs
directly.  Do you have any environment variables set that would make
libxml2 (or other libraries) output warning messages?

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no

bug#18832: 24.4; emacs crashed by eww on some webpages

[Dmitry Antipov]

On 11/11/2014 04:55 AM, Евгений Терешков wrote:

> How can I check wherevers it is problem in my libxml2 build or emacs
> itself?

How do you configure and compile libxml2?  In particular, do you have
--with-debug/--with-mem-debug/--with-run-debug options enabled?

 From your backtrace:

...
#14 0x00000000005c3adf in imagemagick_load_image (f=0x2, img=0x7fff55375e30, contents=0x1d16168 \
     "\211PNG\r\n\032\n", size=1384, filename=0x0) at ../../src/image.c:8206
#15 0x00000000005c77f0 in lookup_image (f=f@entry=0x114e308, spec=spec@entry=29760774) at ../../src/image.c:1694
...

0x114e308 looks like a valid 'struct frame *' pointer, but 0x2 is definitely not.
Usually this means a kind of heap or stack corruption.  It may be useful to compile
Emacs with '-O0 -g3' and run *undumped* (temacs) under valgrind.

Dmitry

bug#18832: 24.4; emacs crashed by eww on some webpages

[Евгений Терешков]

Lars Magne Ingebrigtsen writes:

>> Nope, this is ordinary builds. This messages are not specific to gtk+, as I
>> have seen it in nonx/gtk/gtk3/motif/athena builds (as you can see on
>> screenshots in my previous message). And yes, all those build are compiled
>> with libxml2.
>>
>> How can I check wherevers it is problem in my libxml2 build or emacs
>> itself?
>
> I'm not sure, but I'm pretty sure those warnings are not from Emacs
> directly.  Do you have any environment variables set that would make
> libxml2 (or other libraries) output warning messages?

No, there is not such variables. But you are rigth, seems like emacs and
libxml2 works correctly (emacs uses HTML_PARSE_RECOVERY if present, see
https://bugzilla.gnome.org/show_bug.cgi?id=600410) and I have to tune my
libxml2 to discard this messages.

Anyway, it is worth to find out how problems with xml parsing can crash
emacs (see my initial bug message and attaches). Unfortunatly, I cant
reproduce crash now (some packages on my system was upgraded since bug
reporting time).

-- 
С уважением, Терешков Евгений.
Jabber ID: evg@altlinux.org, evg_krsk@jabber.ru

bug#18832: 24.4; emacs crashed by eww on some webpages

[Евгений Терешков]

Dmitry Antipov writes:

> How do you configure and compile libxml2?  In particular, do you have
> --with-debug/--with-mem-debug/--with-run-debug options enabled?

Here is full configure string for my libxml2 build:
=8<=======================================================================
/configure --build=x86_64-alt-linux --host=x86_64-alt-linux --prefix=/usr
--exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc
--datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64
--libexecdir=/usr/lib --localstatedir=/var/lib --sharedstatedir=/var/lib
--mandir=/usr/share/man --infodir=/usr/share/info
--disable-dependency-tracking --without-included-gettext --with-python
--with-html-dir=/usr/share/doc --with-html-subdir=libxml2-2.9.0
--disable-static --disable-silent-rules
=8<=======================================================================

>  From your backtrace:
> ...
> #14 0x00000000005c3adf in imagemagick_load_image (f=0x2, img=0x7fff55375e30, contents=0x1d16168 \
>      "\211PNG\r\n\032\n", size=1384, filename=0x0) at ../../src/imagec:8206
> #15 0x00000000005c77f0 in lookup_image (f=f@entry=0x114e308, spec=spec@entry=29760774) at ../../src/image.c:1694
> ...
> 0x114e308 looks like a valid 'struct frame *' pointer, but 0x2 is definitely not.
> Usually this means a kind of heap or stack corruption.  It may be useful to compile
> Emacs with '-O0 -g3' and run *undumped* (temacs) under valgrind.

Unfortunatly, I dont have sufficient knowledge about debugging emacs and
using valgrind. However, I can run some step-by-step checks, if needed.

-- 
С уважением, Терешков Евгений.
Jabber ID: evg@altlinux.org, evg_krsk@jabber.ru

bug#18832: 24.4; emacs crashed by eww on some webpages

[Lars Magne Ingebrigtsen]

Евгений Терешков <evg-krsk@yandex.ru> writes:

> Anyway, it is worth to find out how problems with xml parsing can crash
> emacs (see my initial bug message and attaches). Unfortunatly, I cant
> reproduce crash now (some packages on my system was upgraded since bug
> reporting time).

Well, without a test case here I don't think we're going to get any
further, so I'm closing this bug report.  If you see this again, please
reopen.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no