[lekktu@gmail.com: Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)]

[lekktu@gmail.com: Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)]

[Richard Stallman]

Would someone please investigate this, then ack?

------- Start of forwarded message -------
X-Spam-Status: No, score=0.0 required=5.0 tests=UNPARSEABLE_RELAY 
	autolearn=failed version=3.1.0
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=jjLYd6aVBHAs6P9cM8EZsL02ek3MANOqVQCZ4KwMxcaDF94J6qKr952PRwFrN01qhDa3jKt3FrrBkINnV6BYRL0K7Dr1o+6bgIydG46Y5FOt4iipKSwFL6NY5qdSwZgnbGypQOSHQcfiDOvhecKo1kgbE0iUtxfHOrne97V3IPc=
Date: Sat, 16 Jun 2007 02:20:10 +0200
From: "Juanma Barranquero" <lekktu@gmail.com>
To: "Michael Schierl" <schierlm@gmx.de>
In-Reply-To: <467300B7.9080501@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Disposition: inline
Cc: bug-gnu-emacs@gnu.org
Subject: Re: Crash when having malformed PBM image on screen and viewing
	*Messages* buffer (on Windows)

On 6/15/07, Michael Schierl <schierlm@gmx.de> wrote:

> Sorry, this should have been xpm (and not xbm and not pbm in the
> subject). And also in the bug report below it should be :type xpm,
> although it crashes with :type pbm as well.

It's perfectly reproducible, yes.

It is aborting in temp_set_point_both, in the "charpos > BUF_ZV
(buffer)" comparison. In test runs, I get charpos == 316, BUF_ZV
(buffer) = 293.

Time for someone versed in redisplay.

#0  0x7c911231 in _end__ ()
#1  0x01135627 in w32_abort () at w32fns.c:9087
#2  0x01119ed7 in temp_set_point_both (buffer=0x16c1200, charpos=350,
    bytepos=350) at intervals.c:1954
#3  0x0102a503 in redisplay_window (window=24978436, just_this_one_p=0)
    at xdisp.c:13523
#4  0x0102c924 in redisplay_window_0 (window=24978436) at xdisp.c:11790
#5  0x0100a0b4 in internal_condition_case_1 (
    bfun=0x102c8fa <redisplay_window_0>, arg=24978436, handlers=23807125,
    hfun=0x101f526 <redisplay_window_error>) at eval.c:1529
#6  0x0101f308 in redisplay_windows (window=2089944429) at xdisp.c:11769
#7  0x0101f2c9 in redisplay_windows (window=2089944429) at xdisp.c:11763
#8  0x0102e417 in redisplay_internal (preserve_echo_area=6) at xdisp.c:11329
#9  0x010596b9 in read_char (commandflag=1, nmaps=3, maps=0x82fb40,
    prev_event=23824385, used_mouse_menu=0x82fb88, end_time=0x0)
    at keyboard.c:2670
#10 0x0105ae41 in read_key_sequence (keybuf=0x82fcb0, bufsize=30,
    prompt=23824385, dont_downcase_last=0, can_return_switch_frame=1,
    fix_current_buffer=1) at keyboard.c:9218
#11 0x0105c617 in command_loop_1 () at keyboard.c:1618
#12 0x0100a347 in internal_condition_case (bfun=0x105c486 <command_loop_1>,
    handlers=23892617, hfun=0x105645e <cmd_error>) at eval.c:1481
#13 0x01050656 in command_loop_2 () at keyboard.c:1329
#14 0x0100a27c in internal_catch (tag=23882753,
    func=0x1050633 <command_loop_2>, arg=23824385) at eval.c:1222
#15 0x010504a3 in command_loop () at keyboard.c:1308
#16 0x01050537 in recursive_edit_1 () at keyboard.c:1006
#17 0x0105061c in Frecursive_edit () at keyboard.c:1067
#18 0x01002a2b in main (argc=2, argv=0xf826a8) at emacs.c:1768
#19 0x01001247 in __mingw_CRTStartup ()
#20 0x01001298 in mainCRTStartup ()
#21 0x7c816fd7 in _end__ ()

             Juanma


_______________________________________________
bug-gnu-emacs mailing list
bug-gnu-emacs@gnu.org
http://lists.gnu.org/mailman/listinfo/bug-gnu-emacs
------- End of forwarded message -------

[lekktu@gmail.com: Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)]

[Richard Stallman]

[I sent this message month ago but did not get a response.]

Would someone please investigate this, then ack?

------- Start of forwarded message -------
X-Spam-Status: No, score=0.0 required=5.0 tests=UNPARSEABLE_RELAY 
	autolearn=failed version=3.1.0
DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta;
	h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
	b=jjLYd6aVBHAs6P9cM8EZsL02ek3MANOqVQCZ4KwMxcaDF94J6qKr952PRwFrN01qhDa3jKt3FrrBkINnV6BYRL0K7Dr1o+6bgIydG46Y5FOt4iipKSwFL6NY5qdSwZgnbGypQOSHQcfiDOvhecKo1kgbE0iUtxfHOrne97V3IPc=
Date: Sat, 16 Jun 2007 02:20:10 +0200
From: "Juanma Barranquero" <lekktu@gmail.com>
To: "Michael Schierl" <schierlm@gmx.de>
In-Reply-To: <467300B7.9080501@gmx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Disposition: inline
Cc: bug-gnu-emacs@gnu.org
Subject: Re: Crash when having malformed PBM image on screen and viewing
	*Messages* buffer (on Windows)

On 6/15/07, Michael Schierl <schierlm@gmx.de> wrote:

> Sorry, this should have been xpm (and not xbm and not pbm in the
> subject). And also in the bug report below it should be :type xpm,
> although it crashes with :type pbm as well.

It's perfectly reproducible, yes.

It is aborting in temp_set_point_both, in the "charpos > BUF_ZV
(buffer)" comparison. In test runs, I get charpos == 316, BUF_ZV
(buffer) = 293.

Time for someone versed in redisplay.

#0  0x7c911231 in _end__ ()
#1  0x01135627 in w32_abort () at w32fns.c:9087
#2  0x01119ed7 in temp_set_point_both (buffer=0x16c1200, charpos=350,
    bytepos=350) at intervals.c:1954
#3  0x0102a503 in redisplay_window (window=24978436, just_this_one_p=0)
    at xdisp.c:13523
#4  0x0102c924 in redisplay_window_0 (window=24978436) at xdisp.c:11790
#5  0x0100a0b4 in internal_condition_case_1 (
    bfun=0x102c8fa <redisplay_window_0>, arg=24978436, handlers=23807125,
    hfun=0x101f526 <redisplay_window_error>) at eval.c:1529
#6  0x0101f308 in redisplay_windows (window=2089944429) at xdisp.c:11769
#7  0x0101f2c9 in redisplay_windows (window=2089944429) at xdisp.c:11763
#8  0x0102e417 in redisplay_internal (preserve_echo_area=6) at xdisp.c:11329
#9  0x010596b9 in read_char (commandflag=1, nmaps=3, maps=0x82fb40,
    prev_event=23824385, used_mouse_menu=0x82fb88, end_time=0x0)
    at keyboard.c:2670
#10 0x0105ae41 in read_key_sequence (keybuf=0x82fcb0, bufsize=30,
    prompt=23824385, dont_downcase_last=0, can_return_switch_frame=1,
    fix_current_buffer=1) at keyboard.c:9218
#11 0x0105c617 in command_loop_1 () at keyboard.c:1618
#12 0x0100a347 in internal_condition_case (bfun=0x105c486 <command_loop_1>,
    handlers=23892617, hfun=0x105645e <cmd_error>) at eval.c:1481
#13 0x01050656 in command_loop_2 () at keyboard.c:1329
#14 0x0100a27c in internal_catch (tag=23882753,
    func=0x1050633 <command_loop_2>, arg=23824385) at eval.c:1222
#15 0x010504a3 in command_loop () at keyboard.c:1308
#16 0x01050537 in recursive_edit_1 () at keyboard.c:1006
#17 0x0105061c in Frecursive_edit () at keyboard.c:1067
#18 0x01002a2b in main (argc=2, argv=0xf826a8) at emacs.c:1768
#19 0x01001247 in __mingw_CRTStartup ()
#20 0x01001298 in mainCRTStartup ()
#21 0x7c816fd7 in _end__ ()

             Juanma


_______________________________________________
bug-gnu-emacs mailing list
bug-gnu-emacs@gnu.org
http://lists.gnu.org/mailman/listinfo/bug-gnu-emacs
------- End of forwarded message -------

Re: [lekktu@gmail.com: Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)]

[Jason Rumney]

Richard Stallman wrote:
> [I sent this message month ago but did not get a response.]
>
> Would someone please investigate this, then ack?
>   

As I said in the original thread about this bug, the problem can be
reproduced on GNU/Linux.  The recipe to reproduce it is:

	- start emacs -Q
	- run this in *scratch* buffer

	(progn
	  (put-image '(image :type pbm :data "") 0)
	  (pop-to-buffer "*Messages*")
	  (goto-char (point-max)))

	Now press <down> <right> <down> <right>.


The problem seems to be some mixup between the *scratch* buffer and the
*Messages* buffer during redisplay.  The crash occurs during redisplay
of the window containing the *scratch* buffer, near the end of
redisplay_window.

  /* Restore current_buffer and value of point in it.  */
  TEMP_SET_PT_BOTH (CHARPOS (opoint), BYTEPOS (opoint));
  set_buffer_internal_1 (old);
  TEMP_SET_PT_BOTH (CHARPOS (lpoint), BYTEPOS (lpoint));

opoint is 193, which is the value of zv in the *scratch* buffer. But
lpoint is 386, which I think may be the length of the *Messages* buffer
at some point in the redisplay cycle (multiple messages are output
during redisplay).  Setting breakpoints in message_dolog seems to
prevent the bug from appearing, so it is difficult to tell for sure. 
The only code that changes lpoint is on line 13062 of xdisp.c, and
should only be run if the window being redisplayed is the selected
window, and the current_buffer has not changed.  But AFAICT, the
selected_window should be the *Messages* buffer's window at this point,
while we are redisplaying the *scratch* buffer, so the bug is probably
to do with something changing selected_window somewhere before this point.


The sequence of events I have figured out so far is:

1. Pressing right arrow when at the end of the *Messages* buffer causes
a message "call interactively: End of buffer" to be displayed.

2. This triggers redisplay, during which Emacs attempts to display the
broken image again.

3. Attempting to display the broken image results in a message: "Not a
PBM image: `(image :type pbm :data )'".

4. When Emacs does not crash, the above message is (sometimes?) printed
twice, the first such message appears on the same line as the "End of
buffer" message.

5. Point in the *Messages* buffer ends up after the "End of buffer"
message, but before the "Not a PBM image" messages. There is code in
message_dolog to keep point at the end of the buffer if it was there
before. The fact that this goes wrong may be related to the bug we are
investigating.

Re: [lekktu@gmail.com: Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)]

[Richard Stallman]

Thanks for repeating the added info.  Would someone please debug this
on GNU/Linux, then DTRT and ack?

X-Spam-Status: No, score=0.0 required=5.0 tests=none autolearn=failed 
	version=3.1.0
Date: Wed, 25 Jul 2007 11:57:56 +0100
From: Jason Rumney <jasonr@gnu.org>
MIME-Version: 1.0
To: rms@gnu.org
Cc: emacs-devel@gnu.org
Subject: Re: [lekktu@gmail.com: Re: Crash when having malformed PBM image
 on screen and viewing *Messages* buffer (on Windows)]
In-Reply-To: <E1ID2Iv-00087H-OW@fencepost.gnu.org>
Content-Type: text/plain; charset=ISO-8859-15

Richard Stallman wrote:
> [I sent this message month ago but did not get a response.]
>
> Would someone please investigate this, then ack?
>   

As I said in the original thread about this bug, the problem can be
reproduced on GNU/Linux.  The recipe to reproduce it is:

	- start emacs -Q
	- run this in *scratch* buffer

	(progn
	  (put-image '(image :type pbm :data "") 0)
	  (pop-to-buffer "*Messages*")
	  (goto-char (point-max)))

	Now press <down> <right> <down> <right>.


The problem seems to be some mixup between the *scratch* buffer and the
*Messages* buffer during redisplay.  The crash occurs during redisplay
of the window containing the *scratch* buffer, near the end of
redisplay_window.

  /* Restore current_buffer and value of point in it.  */
  TEMP_SET_PT_BOTH (CHARPOS (opoint), BYTEPOS (opoint));
  set_buffer_internal_1 (old);
  TEMP_SET_PT_BOTH (CHARPOS (lpoint), BYTEPOS (lpoint));

opoint is 193, which is the value of zv in the *scratch* buffer. But
lpoint is 386, which I think may be the length of the *Messages* buffer
at some point in the redisplay cycle (multiple messages are output
during redisplay).  Setting breakpoints in message_dolog seems to
prevent the bug from appearing, so it is difficult to tell for sure. 
The only code that changes lpoint is on line 13062 of xdisp.c, and
should only be run if the window being redisplayed is the selected
window, and the current_buffer has not changed.  But AFAICT, the
selected_window should be the *Messages* buffer's window at this point,
while we are redisplaying the *scratch* buffer, so the bug is probably
to do with something changing selected_window somewhere before this point.


The sequence of events I have figured out so far is:

1. Pressing right arrow when at the end of the *Messages* buffer causes
a message "call interactively: End of buffer" to be displayed.

2. This triggers redisplay, during which Emacs attempts to display the
broken image again.

3. Attempting to display the broken image results in a message: "Not a
PBM image: `(image :type pbm :data )'".

4. When Emacs does not crash, the above message is (sometimes?) printed
twice, the first such message appears on the same line as the "End of
buffer" message.

5. Point in the *Messages* buffer ends up after the "End of buffer"
message, but before the "Not a PBM image" messages. There is code in
message_dolog to keep point at the end of the buffer if it was there
before. The fact that this goes wrong may be related to the bug we are
investigating.

Re: [lekktu@gmail.com: Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)]

[Chong Yidong]

> As I said in the original thread about this bug, the problem can be
> reproduced on GNU/Linux.  The recipe to reproduce it is:
>
> 	- start emacs -Q
> 	- run this in *scratch* buffer
>
> 	(progn
> 	  (put-image '(image :type pbm :data "") 0)
> 	  (pop-to-buffer "*Messages*")
> 	  (goto-char (point-max)))
>
> 	Now press <down> <right> <down> <right>.

The problem is that the size of the *Messages* buffer shrinks during
redisplay_window, as a result of message log truncation: from

...
unsigned char *) 0x85da2f8 "pe pbm :data )'
call-interactively: End of bufferNot a PBM image: `(image :type pbm :data )'
call-interactively: End of buffer

to

...
unsigned char *) 0x85da4cc "pe pbm :data )'
call-interactively: End of bufferNot a PBM image: `(image :type pbm :data )' [2 times]

I've checked in code into both the trunk and branch to handle this
corner case.