SEGV in xmenu.c digest_single_submenu

SEGV in xmenu.c digest_single_submenu

[Sascha Wilde]

Hi *,

I had emacs crashing this morning, getting a SIGSEGV after starting
gnus, erc and opening a C source file.

Luckily I was able to reproduce the crash after starting emacs from
gdb.

Unfortunately I have no experience in debugging large, complex C code
and especially none debugging Emacs C core and very little time.

Here is what I got:

run
Starting program: /vol1/opt/cvs-emacs/bin/emacs 

Program received signal SIGSEGV, Segmentation fault.
0x08088b12 in digest_single_submenu (start=1, end=203, top_level_items=0)
    at xmenu.c:1833
1833              if (STRING_MULTIBYTE (item_name))
(gdb) where
#0  0x08088b12 in digest_single_submenu (start=1, end=203, top_level_items=0)
    at xmenu.c:1833
#1  0x080891b5 in set_frame_menubar (f=0x8603b38, first_time=1, deep_p=1)
    at xmenu.c:2123
#2  0x08089802 in initialize_frame_menubar (f=0x8603b38) at xmenu.c:2327
#3  0x080d526c in Fx_create_frame (parms=153915677) at xfns.c:3329
#4  0x08154a8b in Ffuncall (nargs=2, args=0x0) at eval.c:2901
#5  0x0818066d in Fbyte_code (bytestr=137887409, vector=1, 
    maxdepth=-1073749432) at bytecode.c:694
#6  0x08154447 in funcall_lambda (fun=136390924, nargs=1, 
    arg_vector=0xbfffe394) at eval.c:3088
#7  0x08154854 in Ffuncall (nargs=2, args=0xbfffe390) at eval.c:2956
#8  0x0818066d in Fbyte_code (bytestr=137887409, vector=1, 
    maxdepth=-1073749104) at bytecode.c:694
#9  0x08154447 in funcall_lambda (fun=136818468, nargs=1, 
    arg_vector=0xbfffe460) at eval.c:3088
#10 0x0815460e in apply_lambda (fun=136818468, args=136818464, eval_flag=1)
    at eval.c:3010
#11 0x08153c85 in Feval (form=136818464) at eval.c:2299
#12 0x08154251 in Fprogn (args=0) at eval.c:432
#13 0x08154529 in funcall_lambda (fun=139293040, nargs=0, 
    arg_vector=0xbfffe6c4) at eval.c:3081
#14 0x08154854 in Ffuncall (nargs=1, args=0xbfffe6c0) at eval.c:2956
---Type <return> to continue, or q <return> to quit--

I'll leave the debugger session open for now, so if you need further
information, please tell me what to do...  ;-)

cheers
sascha
-- 
Sascha Wilde : "Lies, was ich meine, nicht, was ich schreibe."
             : (Urs Traenkner in de.alt.admin)

Re: SEGV in xmenu.c digest_single_submenu

[Richard Stallman]

    Luckily I was able to reproduce the crash after starting emacs from
    gdb.

Can you tell us a precise recipe for reproducing it?
That's what's needed for someone other than you to debug this.

Re: SEGV in xmenu.c digest_single_submenu

[Sascha Wilde]

Richard Stallman <rms@gnu.org> wrote:

>     Luckily I was able to reproduce the crash after starting emacs from
>     gdb.
>
> Can you tell us a precise recipe for reproducing it?

I'm working on it.  I can reproduce the problem, but not with emacs -Q
(only with loaded .emacs).

What I do is 
- start emacs 
- C-x 5 f /PATH/TO/EMACS/src/xmenu.c
=> SIGSEGV

GDB:
Program received signal SIGSEGV, Segmentation fault.
0x08086f5c in digest_single_submenu (start=3803, end=4928,
top_level_items=0)
    at xmenu.c:1850
1850                save_wv->contents = wv;
(gdb) p save_wv 
$22 = (widget_value *) 0x0


As you can see, the problem is at a little bit altered location,
compared to my last report.  I can reproduce _this_ problem absolutely
reliable, but only with .emacs loaded.

I'm not sure what to look for in .emacs that might cause the
problem -- but in any case I would think that lisp code shouldn't
cause a SEGV in any case.

btw. this is latest CVS Emacs, with lucid toolkit.

cheers
sascha 
-- 
Sascha Wilde 
- no sig today... sorry!

Re: SEGV in xmenu.c digest_single_submenu

[Jan D.]

Sascha Wilde wrote:
> Richard Stallman <rms@gnu.org> wrote:
> 
>>     Luckily I was able to reproduce the crash after starting emacs from
>>     gdb.
>>
>> Can you tell us a precise recipe for reproducing it?
> 
> I'm working on it.  I can reproduce the problem, but not with emacs -Q
> (only with loaded .emacs).
> 
> What I do is 
> - start emacs 
> - C-x 5 f /PATH/TO/EMACS/src/xmenu.c
> => SIGSEGV
> 
> GDB:
> Program received signal SIGSEGV, Segmentation fault.
> 0x08086f5c in digest_single_submenu (start=3803, end=4928,
> top_level_items=0)
>     at xmenu.c:1850
> 1850                save_wv->contents = wv;
> (gdb) p save_wv 
> $22 = (widget_value *) 0x0
> 
> 
> As you can see, the problem is at a little bit altered location,
> compared to my last report.  I can reproduce _this_ problem absolutely
> reliable, but only with .emacs loaded.
> 
> I'm not sure what to look for in .emacs that might cause the
> problem -- but in any case I would think that lisp code shouldn't
> cause a SEGV in any case.

This is the same as the thread "Problem #18" talks about, save_wv being 
dereferenced while it is NULL.  Do our .emacs load any c-mode customizations, 
such as special menu entries?  Or some minor mode that adds a menu for C-files?

	Jan D.

Re: SEGV in xmenu.c digest_single_submenu

[Sascha Wilde]

"Jan D." <jan.h.d@swipnet.se> wrote:

> Sascha Wilde wrote:
[...]
>> GDB:
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x08086f5c in digest_single_submenu (start=3803, end=4928,
>> top_level_items=0)
>>     at xmenu.c:1850
>> 1850                save_wv->contents = wv;
>> (gdb) p save_wv $22 = (widget_value *) 0x0
[...]
> This is the same as the thread "Problem #18" talks about, save_wv
> being dereferenced while it is NULL.

yes.

> Do our .emacs load any c-mode customizations, such as special menu
> entries?  Or some minor mode that adds a menu for C-files?

at least not directly -- I'll examine all loaded third party modes as
soon as I can.

I observed an other problem, that seems to be related:
- I start Emacs using my .emacs
- M-x c-mode
- klick on the Menubar
=> I get: 
  Debugger entered--Lisp error: (void-variable c-subword-mode)

Of cause: w/o my .emacs the problem is not there, so something seems
to mess with cc-mode...

Now, when I:
- start Emacs using my .emacs
- M-x load-library cc-subword
- C-x 5 f /PATH/TO/ANY/FILE.c

It works without SEGV, so those problems seem to be related.

cheers
sascha
-- 
Sascha Wilde  :  "I heard that if you play the Windows CD backward, you
              :  get a satanic message. But that's nothing compared to
              :  when you play it forward: It installs Windows...." 
              :  -- G. R. Gaudreau

Re: SEGV in xmenu.c digest_single_submenu

[Sascha Wilde]

I just stumbled across a way of reproducing the class of problems
(both under GNU/Linux/X11 with lucid widgets):

1. start emacs -Q
2. M-x set-variable RET debug-on-error RET t RET
3. C-x 5 f /PATH/TO/ANY/C-file.c

You'll get a SEGV somewhere in xmenu.c

To reproduce the related problem without SEGV:

1. start emacs -Q
2. M-x set-variable RET debug-on-error RET t RET
3. M-x c-mode RET
4. click on the menu bar

You'll get a *Backtrace* buffer:
bugger entered--Lisp error: (void-variable c-subword-mode)

Most interestingly, as you can see, the problems are only triggered
when debug-on-error is activated...

cheers
sascha
-- 
Sascha Wilde : The most exciting phrase to hear in science, the one
             : that heralds new discoveries, is not "Eureka!" (I found
             : it!) but "That's funny ..." -- Isaac Asimov

Re: SEGV in xmenu.c digest_single_submenu

[Sascha Wilde]

Sascha Wilde <wilde@sha-bang.de> wrote:

> I just stumbled across a way of reproducing the class of problems
> (both under GNU/Linux/X11 with lucid widgets):
>
> 1. start emacs -Q
> 2. M-x set-variable RET debug-on-error RET t RET
> 3. C-x 5 f /PATH/TO/ANY/C-file.c
>
> You'll get a SEGV somewhere in xmenu.c
>
> To reproduce the related problem without SEGV:
>
> 1. start emacs -Q
> 2. M-x set-variable RET debug-on-error RET t RET
> 3. M-x c-mode RET
> 4. click on the menu bar
>
> You'll get a *Backtrace* buffer:
> bugger entered--Lisp error: (void-variable c-subword-mode)
>
> Most interestingly, as you can see, the problems are only triggered
> when debug-on-error is activated...

Hi *,

there were replies yet -- I would be interested to know if someone
besides me can reproduce this bugs?

I myself tested it on two different GNU/Linux systems with different
gcc, glibc, kernel etc.  and with lucid as well as with gtk toolkit.

cheers
sascha
-- 
Sascha Wilde 
"If you were young again, would you start writing TeX again or would
you use Microsoft Word, or another word processor?" - "I hope to die
before I *have* to use Microsoft Word."    --  Prof. Donald E. Knuth

Re: SEGV in xmenu.c digest_single_submenu

[Jan Djärv]

Sascha Wilde wrote:
> Sascha Wilde <wilde@sha-bang.de> wrote:
> 
> 
>>I just stumbled across a way of reproducing the class of problems
>>(both under GNU/Linux/X11 with lucid widgets):
>>
>>1. start emacs -Q
>>2. M-x set-variable RET debug-on-error RET t RET
>>3. C-x 5 f /PATH/TO/ANY/C-file.c
>>
>>You'll get a SEGV somewhere in xmenu.c
>>
>>To reproduce the related problem without SEGV:
>>
>>1. start emacs -Q
>>2. M-x set-variable RET debug-on-error RET t RET
>>3. M-x c-mode RET
>>4. click on the menu bar
>>
>>You'll get a *Backtrace* buffer:
>>bugger entered--Lisp error: (void-variable c-subword-mode)
>>
>>Most interestingly, as you can see, the problems are only triggered
>>when debug-on-error is activated...
> 
> 
> Hi *,
> 
> there were replies yet -- I would be interested to know if someone
> besides me can reproduce this bugs?
> 
> I myself tested it on two different GNU/Linux systems with different
> gcc, glibc, kernel etc.  and with lucid as well as with gtk toolkit.

Yes, I could reproduce it.  There was some fix checked in in HEAD, but I 
haven't tried it yet.

	Jan D.

Re: SEGV in xmenu.c digest_single_submenu

[Sascha Wilde]

Sascha Wilde <wilde@sha-bang.de> wrote:

> I just stumbled across a way of reproducing the class of problems
> (both under GNU/Linux/X11 with lucid widgets):
>
> 1. start emacs -Q
> 2. M-x set-variable RET debug-on-error RET t RET
> 3. C-x 5 f /PATH/TO/ANY/C-file.c
>
> You'll get a SEGV somewhere in xmenu.c
>
> To reproduce the related problem without SEGV:
>
> 1. start emacs -Q
> 2. M-x set-variable RET debug-on-error RET t RET
> 3. M-x c-mode RET
> 4. click on the menu bar

both issues seem to be solved in CVS now.  Thanks.

sascha
-- 
Sascha Wilde
To become a Jedi, use Emacs you have to.