Re: Crash caused by insert-file-contents, both trunk (bzr 111532) and 24.2.92 affected

[Eli Zaretskii <eliz@gnu.org>]

> Date: Tue, 15 Jan 2013 21:37:44 +0400
> From: Dmitry Antipov <dmantipov@yandex.ru>
> 
> On 24.2.92, (insert-file-contents "/dev/kmsg") ==>
> 
> #0  0x000000377da0eebb in raise () from /lib64/libpthread.so.0
> #1  0x0000000000546905 in terminate_due_to_signal (sig=11, backtrace_limit=40) at emacs.c:344
> #2  0x000000000056b5f5 in handle_fatal_signal (sig=11) at sysdep.c:1638
> #3  0x000000000056b5ca in deliver_thread_signal (sig=11, handler=0x56b5db <handle_fatal_signal>) at sysdep.c:1614
> #4  0x000000000056b62b in deliver_fatal_thread_signal (sig=11) at sysdep.c:1650
> #5  <signal handler called>
> #6  0x0000000000650791 in remove_properties (plist=10701014, list=12882466, i=0x0, object=12909269) at textprop.c:439
> #7  0x00000000006535ec in Fremove_text_properties (start=768, end=343928, properties=10701014, object=12909269) at textprop.c:1488

That seems to be an entirely different crash.  It happened as part of
signaling an error:

> #46 0x00000000005e486e in Fsignal (error_symbol=12934146, data=20028822) at eval.c:1527
> #47 0x00000000005e4986 in xsignal (error_symbol=12934146, data=20028822) at eval.c:1562
> #48 0x00000000005e49db in xsignal1 (error_symbol=12934146, arg=41969025) at eval.c:1577
> #49 0x00000000005e4fbc in verror (m=0x6ad708 "IO error reading %s: %s", ap=0x7fff035aa348) at eval.c:1776
> #50 0x00000000005e505b in error (m=0x6ad708 "IO error reading %s: %s") at eval.c:1788
> #51 0x0000000000591898 in Finsert_file_contents (filename=41974721, visit=12882466, beg=12882466, end=12882466, replace=12882466)
>      at fileio.c:4188

> (but ./src/emacs -Q /dev/kmsg ==> empty buffer and "File exists, but cannot be read" message).
> 
> For trunk with --enable-checking, (insert-file-contents "/dev/kmsg") ==>
> 
> /home/dima/work/stuff/emacs/trunk/src/intervals.c:675: Emacs fatal error: assertion failed: relative_position <= TOTAL_LENGTH (tree)
> Fatal error 6: Aborted
> 
> #0  0x000000377da0eebb in raise () from /lib64/libpthread.so.0
> #1  0x0000000000525d38 in terminate_due_to_signal (sig=sig@entry=6, backtrace_limit=backtrace_limit@entry=2147483647)
>      at /home/dima/work/stuff/emacs/trunk/src/emacs.c:342
> #2  0x0000000000594cb4 in die (msg=<optimized out>, file=<optimized out>, line=<optimized out>)
>      at /home/dima/work/stuff/emacs/trunk/src/alloc.c:6558
> #3  0x0000000000616e66 in find_interval (tree=0x0, position=252) at /home/dima/work/stuff/emacs/trunk/src/intervals.c:675
> #4  0x000000000061d6a1 in Ftext_properties_at (position=..., object=...) at /home/dima/work/stuff/emacs/trunk/src/textprop.c:555
> #5  0x000000000061d7ac in Fget_text_property (position=..., position@entry=..., prop=..., prop@entry=..., object=...,
>      object@entry=...) at /home/dima/work/stuff/emacs/trunk/src/textprop.c:575
> #6  0x000000000061da78 in get_char_property_and_overlay (position=..., prop=..., object=..., overlay=overlay@entry=0x0)
>      at /home/dima/work/stuff/emacs/trunk/src/textprop.c:641
> #7  0x000000000061de8b in Fget_char_property (position=..., position@entry=..., prop=..., object=..., object@entry=...)

Again, looks like a crash related to intervals, after signaling an error:

> #40 0x00000000005b64a9 in xsignal (error_symbol=..., error_symbol@entry=..., data=...)
>      at /home/dima/work/stuff/emacs/trunk/src/eval.c:1466
> #41 0x00000000005b6dc7 in xsignal1 (error_symbol=..., arg=..., arg@entry=...) at /home/dima/work/stuff/emacs/trunk/src/eval.c:1481
> #42 0x00000000005b6e39 in verror (m=<optimized out>, ap=ap@entry=0x7fff93cc42b8) at /home/dima/work/stuff/emacs/trunk/src/eval.c:1680
> #43 0x00000000005b6ecc in error (m=m@entry=0x6fd9d9 "IO error reading %s: %s") at /home/dima/work/stuff/emacs/trunk/src/eval.c:1692
> #44 0x00000000005684c3 in Finsert_file_contents (filename=..., visit=..., beg=..., end=..., replace=...)
>      at /home/dima/work/stuff/emacs/trunk/src/fileio.c:4329

> I also saw crashes with heap corruption messages from glibc malloc.

Maybe we have some memory corruption problem which happens when we try
reading devices.

> I can save /dev/kmsg to a file and then do insert-file-contents from that file -
> it works just fine, both with trunk and 24.2.92.

So the problem likely is triggered by non-regular files.