crash in the cvs head build of Feb 13 08:40

crash in the cvs head build of Feb 13 08:40

[Sam Steingold]

GNU Emacs 22.0.50.5 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2006-02-15 on quant8

Program received signal SIGSEGV, Segmentation fault.
0x080868fa in digest_single_submenu (start=Variable "start" is not available.
) at xmenu.c:1847
1847                save_wv->contents = wv;
(gdb) list
1842
1843              wv = xmalloc_widget_value ();
1844              if (prev_wv)
1845                prev_wv->next = wv;
1846              else
1847                save_wv->contents = wv;
1848
1849              wv->lname = item_name;
1850              if (!NILP (descrip))
1851                wv->lkey = descrip;
(gdb) p save_wv
$1 = (widget_value *) 0x0
(gdb) p prev_wv
$2 = (widget_value *) 0x0
(gdb) p wv
Variable "wv" is not available.
(gdb) p item_name
No symbol "item_name" in current context.
(gdb) where
#0  0x080868fa in digest_single_submenu (start=Variable "start" is not available
.
) at xmenu.c:1847
#1  0x0808702d in set_frame_menubar (f=0xad6d3d8, first_time=1, deep_p=1)
    at xmenu.c:2120
#2  0x0808739e in initialize_frame_menubar (f=0xad6d3d8) at xmenu.c:2324
#3  0x080ce3d7 in Fx_create_frame (parms=184865477) at xfns.c:3329
#4  0x08145638 in Ffuncall (nargs=2, args=0xbf988bc8) at eval.c:2879
#5  0x0816fd0d in Fbyte_code (bytestr=136314427, vector=136314508, maxdepth=5)
    at bytecode.c:694
#6  0x0814506b in funcall_lambda (fun=Variable "fun" is not available.
) at eval.c:3066
#7  0x0814556e in Ffuncall (nargs=2, args=0xbf988cd0) at eval.c:2934
#8  0x0816fd0d in Fbyte_code (bytestr=136740067, vector=136740108, maxdepth=3)
    at bytecode.c:694
#9  0x0814506b in funcall_lambda (fun=Variable "fun" is not available.
) at eval.c:3066
#10 0x0814556e in Ffuncall (nargs=2, args=0xbf988dd0) at eval.c:2934
#11 0x0816fd0d in Fbyte_code (bytestr=186424835, vector=172124596, maxdepth=5)
    at bytecode.c:694
#12 0x08144c4f in Feval (form=175843381) at eval.c:2225
#13 0x08144f53 in Fprogn (args=175870845) at eval.c:432
#14 0x0808dbbf in Fsave_window_excursion (args=175870845) at window.c:6376
#15 0x0816f15a in Fbyte_code (bytestr=186424851, vector=190640460, maxdepth=2)
    at bytecode.c:855
#16 0x0814506b in funcall_lambda (fun=Variable "fun" is not available.
) at eval.c:3066
#17 0x0814556e in Ffuncall (nargs=2, args=0xbf989010) at eval.c:2934
---Type <return> to continue, or q <return> to quit---
#18 0x0816fd0d in Fbyte_code (bytestr=170781747, vector=173772132, maxdepth=2)
    at bytecode.c:694
#19 0x0814506b in funcall_lambda (fun=Variable "fun" is not available.
) at eval.c:3066
#20 0x0814556e in Ffuncall (nargs=1, args=0xbf989158) at eval.c:2934
#21 0x08146676 in run_hook_with_args (nargs=1, args=0xbf989158, 
    cond=to_completion) at eval.c:2542
#22 0x081467eb in Frun_hooks (nargs=1, args=0xbf989258) at eval.c:2405
#23 0x081456ce in Ffuncall (nargs=2, args=0xbf989254) at eval.c:2860
#24 0x0814690d in Fapply (nargs=2, args=0xbf989254) at eval.c:2319
#25 0x081456ce in Ffuncall (nargs=3, args=0xbf989250) at eval.c:2860
#26 0x0816fd0d in Fbyte_code (bytestr=136851371, vector=136851412, maxdepth=4)
    at bytecode.c:694
#27 0x08144c4f in Feval (form=136851357) at eval.c:2225
#28 0x08146cd9 in internal_lisp_condition_case (var=137468921, 
    bodyform=136851357, handlers=136851445) at eval.c:1412
#29 0x0816f1bf in Fbyte_code (bytestr=136851091, vector=136851244, maxdepth=5)
    at bytecode.c:884
#30 0x0814506b in funcall_lambda (fun=Variable "fun" is not available.
) at eval.c:3066
#31 0x0814556e in Ffuncall (nargs=2, args=0xbf989560) at eval.c:2934
#32 0x08146521 in call1 (fn=137503513, arg1=181308988) at eval.c:2668
#33 0x080e691f in timer_check (do_it_now=1) at keyboard.c:4480
#34 0x080e6ac4 in readable_events (flags=1) at keyboard.c:3519
#35 0x080ed5cb in get_input_pending (addr=0x8307534, flags=1)
---Type <return> to continue, or q <return> to quit---
    at keyboard.c:6600
#36 0x080ed68f in detect_input_pending_run_timers (do_display=1)
    at keyboard.c:9964
#37 0x08176e4e in wait_reading_process_output (time_limit=0, microsecs=0, 
    read_kbd=-1, do_display=1, wait_for_cell=137468921, wait_proc=0x0, 
    just_wait_proc=0) at process.c:4593
#38 0x080ee2c0 in read_char (commandflag=1, nmaps=2, maps=0xbf989bb0, 
    prev_event=137468921, used_mouse_menu=0xbf989c58) at keyboard.c:3940
#39 0x080f0245 in read_key_sequence (keybuf=0xbf989cf4, bufsize=30, 
    prompt=137468921, dont_downcase_last=0, can_return_switch_frame=1, 
    fix_current_buffer=1) at keyboard.c:8874
#40 0x080f1d17 in command_loop_1 () at keyboard.c:1536
#41 0x08143b4f in internal_condition_case (bfun=0x80f1b88 <command_loop_1>, 
    handlers=137512729, hfun=0x80ea70c <cmd_error>) at eval.c:1465
#42 0x080e5092 in command_loop_2 () at keyboard.c:1328
#43 0x08143a67 in internal_catch (tag=137508961, 
    func=0x80e5074 <command_loop_2>, arg=137468921) at eval.c:1211
#44 0x080e4ea9 in command_loop () at keyboard.c:1307
#45 0x080e4f43 in recursive_edit_1 () at keyboard.c:1000
#46 0x080e5036 in Frecursive_edit () at keyboard.c:1061
#47 0x080e4148 in main (argc=1, argv=0xbf98a364) at emacs.c:1789

-- 
Sam Steingold (http://www.podval.org/~sds) on Fedora Core release 4 (Stentz)
http://www.savegushkatif.org http://www.memri.org
http://www.jihadwatch.org http://www.dhimmi.com http://ffii.org
If a train station is a place where a train stops, what's a workstation?

Re: crash in the cvs head build of Feb 13 08:40

[Kim F. Storm]

Sam Steingold <sds@gnu.org> writes:

> GNU Emacs 22.0.50.5 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
>  of 2006-02-15 on quant8
>
> Program received signal SIGSEGV, Segmentation fault.
> 0x080868fa in digest_single_submenu (start=Variable "start" is not available.
> ) at xmenu.c:1847
> 1847                save_wv->contents = wv;
> (gdb) list
> 1842
> 1843              wv = xmalloc_widget_value ();
> 1844              if (prev_wv)
> 1845                prev_wv->next = wv;
> 1846              else
> 1847                save_wv->contents = wv;
> 1848
> 1849              wv->lname = item_name;
> 1850              if (!NILP (descrip))
> 1851                wv->lkey = descrip;
> (gdb) p save_wv
> $1 = (widget_value *) 0x0
> (gdb) p prev_wv
> $2 = (widget_value *) 0x0

It looks like some specific sequence of menu items can
trigger the crash (don't know which).

I don't quite understand the code, but the following patch 
looks like a reasonable guard against the crash.

I have no way of testing it though.


*** xmenu.c	06 Feb 2006 18:21:51 +0100	1.299
--- xmenu.c	17 Feb 2006 14:33:19 +0100	
***************
*** 1843,1850 ****
  	  wv = xmalloc_widget_value ();
  	  if (prev_wv)
  	    prev_wv->next = wv;
! 	  else
  	    save_wv->contents = wv;
  
  	  wv->lname = item_name;
  	  if (!NILP (descrip))
--- 1843,1852 ----
  	  wv = xmalloc_widget_value ();
  	  if (prev_wv)
  	    prev_wv->next = wv;
! 	  else if (save_wv)
  	    save_wv->contents = wv;
+ 	  else
+ 	    first_wv->contents = wv;
  
  	  wv->lname = item_name;
  	  if (!NILP (descrip))

-- 
Kim F. Storm <storm@cua.dk> http://www.cua.dk

Re: crash in the cvs head build of Feb 13 08:40

[Richard M. Stallman]

In this case I think it is better to be less defensive
and stick more clearly to the rules from which the code was written.
Does this patch fix the bug?

*** xmenu.c	07 Feb 2006 18:13:41 -0500	1.299
--- xmenu.c	19 Feb 2006 11:46:11 -0500	
***************
*** 1807,1814 ****
  	      wv->enabled = 1;
  	      wv->button_type = BUTTON_TYPE_NONE;
  	      wv->help = Qnil;
  	    }
! 	  save_wv = wv;
  	  prev_wv = 0;
  	  i += MENU_ITEMS_PANE_LENGTH;
  	}
--- 1807,1817 ----
  	      wv->enabled = 1;
  	      wv->button_type = BUTTON_TYPE_NONE;
  	      wv->help = Qnil;
+ 	      save_wv = wv;
  	    }
! 	  else
! 	    save_wv = first_wv;
! 
  	  prev_wv = 0;
  	  i += MENU_ITEMS_PANE_LENGTH;
  	}

Re: crash in the cvs head build of Feb 13 08:40

[Sam Steingold]

> * Richard M. Stallman <ezf@tah.bet> [2006-02-19 12:45:43 -0500]:
>
> In this case I think it is better to be less defensive
> and stick more clearly to the rules from which the code was written.
> Does this patch fix the bug?

I cannot reproduce the bug (with or without the patch).

> *** xmenu.c	07 Feb 2006 18:13:41 -0500	1.299
> --- xmenu.c	19 Feb 2006 11:46:11 -0500	
> ***************
> *** 1807,1814 ****
>   	      wv->enabled = 1;
>   	      wv->button_type = BUTTON_TYPE_NONE;
>   	      wv->help = Qnil;
>   	    }
> ! 	  save_wv = wv;
>   	  prev_wv = 0;
>   	  i += MENU_ITEMS_PANE_LENGTH;
>   	}
> --- 1807,1817 ----
>   	      wv->enabled = 1;
>   	      wv->button_type = BUTTON_TYPE_NONE;
>   	      wv->help = Qnil;
> + 	      save_wv = wv;
>   	    }
> ! 	  else
> ! 	    save_wv = first_wv;
> ! 
>   	  prev_wv = 0;
>   	  i += MENU_ITEMS_PANE_LENGTH;
>   	}

-- 
Sam Steingold (http://www.podval.org/~sds) running FC3 GNU/Linux
http://truepeace.org http://www.dhimmi.com http://www.jihadwatch.org
http://www.iris.org.il http://www.camera.org http://pmw.org.il http://ffii.org
The software said it requires Windows 3.1 or better, so I installed Linux.