bug#6126: 24.0.50; Segmentation fault when w32-shell-execute try to open an unassociated file

[Chunyu Wang <cymacs@gmail.com>]

This bug report will be sent to the Free Software Foundation,
not to your local site managers!
Please write in English if possible, because the Emacs maintainers
usually do not have translators to read other languages for them.

Your bug report will be posted to the bug-gnu-emacs@gnu.org mailing list,
and to the gnu.emacs.bug news group.

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug.  If you can, give
a recipe starting from `emacs -Q':


emacs -Q  to start
M-: (w32-shell-execute "open" "C:\\abc.ttt")

Emacs got killed by system because of segmentation fault. The file C:/abc.ttt
is just a text file with no system default associated program, and this should
make a w32-shell-execute error in the *Message* buffer. The following is the
mingw gdb backtraces.

GNU gdb (GDB) 7.1
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "mingw32".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from C:\free_ware\emacs-bzr\src\oo-spd\i386/emacs.exe...done.
(gdb) run -Q
Starting program: C:\free_ware\emacs-bzr\src\oo-spd\i386/emacs.exe -Q
[New Thread 3204.0x1304]
[New Thread 3204.0x1338]
[New Thread 3204.0x134c]
[New Thread 3204.0x108]
[New Thread 3204.0x13f8]
[New Thread 3204.0x13ec]
[New Thread 3204.0xfe8]

Program received signal SIGSEGV, Segmentation fault.
0x01129096 in char_table_ref (table=47436805, c=16390349) at chartab.c:210
210	      if (SUB_CHAR_TABLE_P (val))
(gdb) p val
$1 = 1073774669
(gdb) bt full
#0  0x01129096 in char_table_ref (table=47436805, c=16390349) at chartab.c:210
        tbl = 0x2d3d400
        val = 1073774669
#1  0x011185ab in c_string_width (
    str=0x137bc48
"\317\265\315\263\325\322\262\273\265\275\326\270\266\250\265\304\316\304\274\376\241\243\r\n",
len=24, precision=-1, nchars=0x0,
    nbytes=0x0) at character.c:420
        bytes = 5
        thiswidth = 1073774664
        val = 1073774669
        c = 16390349
        i = 7
        i_byte = 18
        width = 6
        dp = 0x2db7200
#2  0x0111870b in strwidth (
    str=0x40008048 <Address 0x40008048 out of bounds>, len=1073774664)
    at character.c:453
No locals.
#3  0x0114386d in doprnt (buffer=0x88f520 "ShellExecute failed: \236\310",
    bufsize=178,
    format=0x137bc48
"\317\265\315\263\325\322\262\273\265\275\326\270\266\250\265\304\316\304\274\376\241\243\r\n",
format_end=0x13497ab "", nargs=3,
    args=0x88f510) at doprnt.c:213
        size_bound = 0
        width = 2003054591
        cnt = 1
        fmt = 0x13497ab ""
        bufptr = 0x88f535 "\236\310"
        tembuf =
"\304\000\306\000\370;\310\000\370\003\000\000\177\000\000\000(\364\210\000\000\000\306\000&\252iwp\236\310\000p\021\000\000\372\066dwE\236\312t\000\000\000\000\000\000\306\000h\236\310\000\364\300fw\350\242S\004p\036S\004\000\000\000\000q\000\004u\000\000\000\000\b\365\210\000\000\000\000\000P\001\306\000\000\000\306\000\336\363cwP\001\306\000\304\000\306\000\000\000\000\000\001\000S\004\000\000\000\000\001\000\000\000\001\000\000\000\000\000\274u\177\000\000\000\004\000\000\000\002\000\000\000\000\000\274\000\004\b\000\000\370;\310\000\004\000\000\000\370\003\000\000\000\000\000\000\330\364\210\000S5ew\177\000\000\000\000\000\000\000X$\300u\000\000\000\000\336\363cwP\001\306\000\000\000"...
        size_allocated = 408
        sprintf_buffer = 0x88f320 "\304"
        big_buffer = 0x0
        tem = 24
        string = 0x137bc48
"\317\265\315\263\325\322\262\273\265\275\326\270\266\250\265\304\316\304\274\376\241\243\r\n"
        fixed_buffer =
"p\r\000\000\356\376\356\376\000\000\306\000`\236\310\000\000\000\000"
        fmtcpy = 0x88f280 "%s"
        minlen = 0
        charbuf = "\201\034ew\000"
#4  0x0100b463 in error (m=0x1349794 "ShellExecute failed: %s",
    a1=0x40008048 <Address 0x40008048 out of bounds>,
    a2=0x40008048 <Address 0x40008048 out of bounds>,
    a3=0x40008048 <Address 0x40008048 out of bounds>) at eval.c:2078
        used = 1073774664
        buf = "ShellExecute failed:
\236\310\000\000\000\000\000\000\020\000\000\000\000\000\000,\212~\363\314\365\210\000\304\365\210\000\000\000\000\000\244\365\210\000\000\000\000\000H\274\000\001\030\000\000\000\260\365\210\000\202\236\000\000\244\364\210\000\311\237\312t\304\377\210\000\035\004hw\235\254!\003\376\377\377\377\372\066dw\362\062dw`\236\310\000h\236\310\000H\274\067\001h\236\310\000\030\000\000\000`\236\310\000\330\365\210\000)>\275u\000\000\306\000\000\000\000\000h\236\310\000
\001e\004\032x\275\002\002\000\000\000\030\000\364\001H\274\067\001\032\000\034\000h\236\310\000\000\000\000\000\b\366\210\000\323\377\a\001\000\000\000\000\000\000\000"
        size = 200
        buffer = 0x88f520 "ShellExecute failed: \236\310"
        args = {
          0x137bc48
"\317\265\315\263\325\322\262\273\265\275\326\270\266\250\265\304\316\304\274\376\241\243\r\n",
0x465fc78 "C:\\abc.ttt", 0x0}
        allocated = 0
        string = 200
#5  0x0116332f in Fw32_shell_execute (operation=73728336, document=73728256,
    parameters=45971482, show_flag=45971482) at w32fns.c:6356
        current_dir = 73728288
#6  0x0100bbcb in Feval (form=20121176) at eval.c:2423
        numargs = 2
        args_left = 45971482
        i = 4
        maxargs = 4
        argvals = {73728337, 73728321, 45971482, 45971482, 7, 5, 18825454,
          46130778}
        fun = 20121176
        val = 1073774669
        original_fun = 46186146
        original_args = 48068942
        funcar = 1073774669
        backtrace = {next = 0x88f740, function = 0x88f67c, args = 0x88f680,
          nargs = 2, evalargs = 1 '\001', debug_on_exit = 0 '\000'}
        gcpro1 = {next = 0x2c360c2, var = 0x88f6a0, nvars = 7}
        gcpro2 = {next = 0x2bfe4da, var = 0x2bd781a, nvars = 45971482}
        gcpro3 = {next = 0x11f40f1, var = 0x88f680, nvars = 4}
#7  0x0100c622 in Ffuncall (nargs=2, args=0x118fa78) at eval.c:3072
        fun = 18414200
        original_fun = 8976276
        funcar = 1073774669
        lisp_numargs = 1073774664
        val = 1073774669
        backtrace = {next = 0x88f8b0, function = 0x88f790, args = 0x88f794,
          nargs = 1, evalargs = 0 '\000', debug_on_exit = 0 '\000'}
        internal_args = 0x88f794
        i = 1073774669
#8  0x011217ac in Fbyte_code (bytestr=1073774669, vector=8976272, maxdepth=1)
    at bytecode.c:680
        op = 1
        vectorp = 0x11f4050
        stack = {pc = 0x12f154f "\nB\022\r\023)\f\v=\204&", top = 0x88f794,
          bottom = 0x88f790, byte_string = 18825273,
          byte_string_start = 0x12f1537 "\b\204\r", constants = 18825293,
          next = 0x0}
        top = 0x88f790
#9  0x0100c01d in funcall_lambda (fun=18825221, nargs=2, arg_vector=0x88f904)
    at eval.c:3259
        val = 1073774664
        syms_left = 45971482
        next = 18825216
        i = 2
        optional = 1
        rest = 0
#10 0x0100c401 in Ffuncall (nargs=3, args=0x11f4005) at eval.c:3129
        fun = 18825221
        original_fun = 46442690
        funcar = 1073774669
        lisp_numargs = 1073774664
        val = 1073774669
        backtrace = {next = 0x88fb30, function = 0x88f900, args = 0x88f904,
          nargs = 2, evalargs = 0 '\000', debug_on_exit = 0 '\000'}
        internal_args = 0x2c4a8c2
        i = 1073774669
#11 0x0100ce7a in Fapply (nargs=2, args=0x88f978) at eval.c:2570
        i = 3
        numargs = 2
        spread_arg = 45971482
        funcall_args = 0x88f900
        fun = 18825221
        gcpro1 = {next = 0x3, var = 0x0, nvars = 3}
#12 0x0100cfcb in apply1 (fn=46442690, arg=1073774669) at eval.c:2839
        args = {46442690, 48069150}
        gcpro1 = {next = 0x1056b87, var = 0x88f978, nvars = 2}
#13 0x0111f5b2 in Fcall_interactively (function=46442690,
    record_flag=45971482, keys=45992709) at callint.c:396
        specs = 48069150
        filter_specs = 46442690
        teml = 46442690
        up_event = 45971482
        enable = 45971482
        next_event = 18111393
        prefix_arg = 45971482
        string = 0x2bf8212 ""
        tem = 0x2be2362 ""
        i = 45971482
        j = 45971482
        foo = 1073774664
        prompt1 =
"\001\000\000\000\374\372\210\000\b\373\210\000\310\376\f\001\032x\275\002\001\000\000\000\001\000\000\000`\330\353\002\000\020\276\002\374\372\210\000\270\372\210\000H\372\030\001\000\000\000\000\370\372\210\000\374\372\210\000\001\000\000\000\000\000\000\000\372\031\300\002\330\372\210\000\324\\\000\001Xz8\001\000\000\000\000\000\000\000\000\002\000\000\000\302\250\304\002"
        arg_from_tty = 0
        gcpro1 = {next = 0x2bf80c2, var = 0x118fa48, nvars = 8977112}
        gcpro2 = {next = 0x0, var = 0x2be253a, nvars = 50332722}
        gcpro3 = {next = 0x1, var = 0x88fafc, nvars = 8977000}
        gcpro4 = {next = 0x2c3d88e, var = 0x2be256a, nvars = 8976984}
        gcpro5 = {next = 0x2be2e42, var = 0x2bd4d4e, nvars = 8977000}
        key_count = 1
        record_then_fail = 0
        save_this_command = 46442690
        save_last_command = 45971482
        save_this_original_command = 46442690
        save_real_this_command = 46442690
#14 0x0100c5fb in Ffuncall (nargs=4, args=0x132f190) at eval.c:3078
        fun = 20115856
        original_fun = 8977284
        funcar = 1073774669
        lisp_numargs = 1073774664
        val = 1073774669
        backtrace = {next = 0x0, function = 0x88fb80, args = 0x88fb84,
          nargs = 3, evalargs = 0 '\000', debug_on_exit = 0 '\000'}
        internal_args = 0x88fb84
        i = 1073774669
#15 0x0100c825 in call3 (fn=1073774664, arg1=1073774664, arg2=1073774664,
    arg3=1073774664) at eval.c:2900
        ret_ungc_val = 1073774664
        gcpro1 = {next = 0x2bf66ba, var = 0x2bd781a, nvars = 4}
        args = {46117394, 46442690, 45971482, 45971482}
#16 0x0105c568 in Fcommand_execute (cmd=46442690, record_flag=45971482,
    keys=1073774664, special=45971482) at keyboard.c:10397
        final = 18825216
        tem = 1073774669
        prefixarg = 45971482
#17 0x010635b4 in command_loop_1 () at keyboard.c:1755
        cmd = 2
        keybuf = {536871144, 8977724, 0, 8977784, 8977720, 0, 33689212,
          5181052, 0, 8977704, 8977708, 0, 0, 8977704, 0, 33689241, 5508761,
          0, 245, 0, 0, 8977484, 8977312, 0, 1975451648, 13035872,
          2003123744, 1959433885, 8977700, 13013560}
        i = 1
        prev_modiff = 10
        prev_buffer = 0x2be1000
#18 0x0100a122 in internal_condition_case (bfun=0x1063281 <command_loop_1>,
    handlers=46029042, hfun=0x105d002 <cmd_error>) at eval.c:1509
        val = 1073774664
        c = {tag = 45971482, val = 45971482, next = 0x88fdd0, gcpro = 0x0,
          jmp = {8977816, 0, 20431289, 1, 8977644, 16818383, 8978372, 0,
            1979200060, 1979200144, -1, 1975293735, -480, 7602240, 7471226,
            7536741}, backlist = 0x0, handlerlist = 0x0, lisp_eval_depth = 0,
          pdlcount = 2, poll_suppress_count = 0, interrupt_input_blocked = 0,
          byte_stack = 0x0}
        h = {handler = 46029042, var = 45971482, chosen_clause = 0,
          tag = 0x88fd20, next = 0x0}
#19 0x01056e52 in command_loop_2 () at keyboard.c:1356
        val = 1073774664
#20 0x0100a057 in internal_catch (tag=1073774664,
    func=0x1056e2f <command_loop_2>, arg=45971482) at eval.c:1245
        c = {tag = 46027210, val = 45971482, next = 0x0, gcpro = 0x0, jmp = {
            8977992, 0, 20431289, 1, 8977852, 16818237, 8978372, 0, 0,
            1975450067, 0, 0, 8977948, 1978573890, 1979187344, 0},
          backlist = 0x0, handlerlist = 0x0, lisp_eval_depth = 0,
          pdlcount = 2, poll_suppress_count = 0, interrupt_input_blocked = 0,
          byte_stack = 0x0}
#21 0x01056c5f in command_loop () at keyboard.c:1335
No locals.
#22 0x01056cf8 in recursive_edit_1 () at keyboard.c:950
        val = 0
#23 0x01056e19 in Frecursive_edit () at keyboard.c:1012
        buffer = 45971482
#24 0x01002ed5 in main (argc=2, argv=0x310c0) at emacs.c:1784
        dummy = 54
        stack_bottom_variable = 1 '\001'
        do_initial_setlocale = 1
        skip_args = 0
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x1188e50 "U\211\345\203\354\b\241\354\025\063\001\213"
(gdb) qu      quit
A debugging session is active.

	Inferior 1 [process 3204] will be killed.

Quit anyway? (y or n) error return ../../gdb-7.1/gdb/windows-nat.c:1162 was 5



If Emacs crashed, and you have the Emacs process in the gdb debugger,
please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
For information about debugging Emacs, please read the file
c:/free_ware/emacs-bzr/etc/DEBUG.


In GNU Emacs 24.0.50.1 (i386-mingw-nt6.1.7600)
 of 2010-05-06 on NCCY-PC
Windowing system distributor `Microsoft Corp.', version 6.1.7600
configured using `configure --with-gcc (3.4)'

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: zh_CN
  value of $XMODIFIERS: nil
  locale-coding-system: cp936
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x b <backspace> e m a c s SPC b u SPC <M-backspace>
<M-backspace> b u SPC <M-backspace> r e p o r t SPC
b u SPC SPC <return>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list...

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr message rfc822 mml mml-sec mm-decode
mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mailabbrev mail-utils gmm-utils mailheader emacsbug
help-mode easymenu view china-util tooltip ediff-hook vc-hooks
lisp-float-type mwheel dos-w32 disp-table ls-lisp w32-win w32-vars
tool-bar dnd fontset image fringe lisp-mode register page menu-bar
rfn-eshadow timer select scroll-bar mldrag mouse jit-lock font-lock
syntax facemenu font-core frame cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
case-table epa-hook jka-cmpr-hook help simple abbrev button minibuffer
faces cus-face files text-properties overlay md5 base64 format env
code-pages mule custom widget hashtable-print-readable backquote
make-network-process multi-tty emacs)


-- 
Harbin Institute of Technology, China
Chunyu Wang