* bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
@ 2016-07-24 23:51 Sergei Litvin
2016-07-25 16:24 ` Eli Zaretskii
0 siblings, 1 reply; 8+ messages in thread
From: Sergei Litvin @ 2016-07-24 23:51 UTC (permalink / raw)
To: 24064
[-- Attachment #1: Type: text/plain, Size: 1092 bytes --]
Package: emacs
Version: 24.5
struct position *
compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
ptrdiff_t hscroll, int tab_offset, struct window *win)
{
...
if (dp == buffer_display_table ())
width_table = (VECTORP (BVAR (current_buffer, width_table))
? XVECTOR (BVAR (current_buffer, width_table))->contents
: 0);
else
/* If the window has its own display table, we can't use the width
run cache, because that's based on the buffer's display table. */
width_table = 0; // initialize it with 0 (current buffer has no
display table)
...
if (width_cache)
{
/* Is this character part of the current run? If so, extend
the run. */
if (pos - 1 == width_run_end
&& XFASTINT (width_table[c]) == width_run_width) //
dereference width_table here, and crash
width_run_end = pos;
...
Sergei Litvin
[-- Attachment #2: Type: text/html, Size: 1827 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
* bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
2016-07-24 23:51 bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c Sergei Litvin
@ 2016-07-25 16:24 ` Eli Zaretskii
2016-07-25 22:02 ` Sergei Litvin
0 siblings, 1 reply; 8+ messages in thread
From: Eli Zaretskii @ 2016-07-25 16:24 UTC (permalink / raw)
To: Sergei Litvin; +Cc: 24064
> From: Sergei Litvin <litvindev@gmail.com>
> Date: Mon, 25 Jul 2016 02:51:40 +0300
>
>
> struct position *
> compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
> EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
> EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
> ptrdiff_t hscroll, int tab_offset, struct window *win)
> {
>
> ...
>
> if (dp == buffer_display_table ())
> width_table = (VECTORP (BVAR (current_buffer, width_table))
> ? XVECTOR (BVAR (current_buffer, width_table))->contents
> : 0);
> else
> /* If the window has its own display table, we can't use the width
> run cache, because that's based on the buffer's display table. */
> width_table = 0; // initialize it with 0 (current buffer has no display table)
>
> ...
>
> if (width_cache)
> {
> /* Is this character part of the current run? If so, extend
> the run. */
> if (pos - 1 == width_run_end
> && XFASTINT (width_table[c]) == width_run_width) // dereference width_table here, and crash
> width_run_end = pos;
Did you actually see such a crash, and if so, can you show a recipe
for reproducing that?
Thanks.
^ permalink raw reply [flat|nested] 8+ messages in thread
* bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
2016-07-25 16:24 ` Eli Zaretskii
@ 2016-07-25 22:02 ` Sergei Litvin
2016-07-25 22:37 ` Clément Pit--Claudel
0 siblings, 1 reply; 8+ messages in thread
From: Sergei Litvin @ 2016-07-25 22:02 UTC (permalink / raw)
To: 24064
[-- Attachment #1: Type: text/plain, Size: 1363 bytes --]
I've prepared an elisp file to reproduce a crash:
1) Open it and move cursor to the end of the file
2) Execute eval-buffer
3) Press C-l several times
Sergei Litvin
On 07/25/2016 07:24 PM, Eli Zaretskii wrote:
>> From: Sergei Litvin <litvindev@gmail.com>
>> Date: Mon, 25 Jul 2016 02:51:40 +0300
>>
>>
>> struct position *
>> compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
>> EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
>> EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
>> ptrdiff_t hscroll, int tab_offset, struct window *win)
>> {
>>
>> ...
>>
>> if (dp == buffer_display_table ())
>> width_table = (VECTORP (BVAR (current_buffer, width_table))
>> ? XVECTOR (BVAR (current_buffer, width_table))->contents
>> : 0);
>> else
>> /* If the window has its own display table, we can't use the width
>> run cache, because that's based on the buffer's display table. */
>> width_table = 0; // initialize it with 0 (current buffer has no display table)
>>
>> ...
>>
>> if (width_cache)
>> {
>> /* Is this character part of the current run? If so, extend
>> the run. */
>> if (pos - 1 == width_run_end
>> && XFASTINT (width_table[c]) == width_run_width) // dereference width_table here, and crash
>> width_run_end = pos;
> Did you actually see such a crash, and if so, can you show a recipe
> for reproducing that?
>
> Thanks.
[-- Attachment #2: emacs-crash.el --]
[-- Type: text/x-emacs-lisp, Size: 470 bytes --]
(set-window-display-table (selected-window) #^[nil nil display-table nil nil nil nil nil nil nil nil nil nil nil
nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil
nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil
nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil
nil nil nil nil nil nil nil nil nil])
(set-buffer-multibyte nil)
; 1) Move cursor to this line
; 2) Execute eval-buffer
; 3) Press C-l several times
^ permalink raw reply [flat|nested] 8+ messages in thread
* bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
2016-07-25 22:02 ` Sergei Litvin
@ 2016-07-25 22:37 ` Clément Pit--Claudel
2016-07-26 2:33 ` npostavs
0 siblings, 1 reply; 8+ messages in thread
From: Clément Pit--Claudel @ 2016-07-25 22:37 UTC (permalink / raw)
To: 24064
[-- Attachment #1.1: Type: text/plain, Size: 1640 bytes --]
On 2016-07-25 18:02, Sergei Litvin wrote:
> I've prepared an elisp file to reproduce a crash:
>
> 1) Open it and move cursor to the end of the file
> 2) Execute eval-buffer
> 3) Press C-l several times
Running this recipe does not cause a crash for me in GNU Emacs 25.1.50.7 (x86_64-pc-linux-gnu, GTK+ Version 3.18.9) of 2016-07-20. Am I missing something?
> On 07/25/2016 07:24 PM, Eli Zaretskii wrote:
>>> From: Sergei Litvin <litvindev@gmail.com>
>>> Date: Mon, 25 Jul 2016 02:51:40 +0300
>>>
>>>
>>> struct position *
>>> compute_motion (ptrdiff_t from, ptrdiff_t frombyte, EMACS_INT fromvpos,
>>> EMACS_INT fromhpos, bool did_motion, ptrdiff_t to,
>>> EMACS_INT tovpos, EMACS_INT tohpos, EMACS_INT width,
>>> ptrdiff_t hscroll, int tab_offset, struct window *win)
>>> {
>>>
>>> ...
>>>
>>> if (dp == buffer_display_table ())
>>> width_table = (VECTORP (BVAR (current_buffer, width_table))
>>> ? XVECTOR (BVAR (current_buffer, width_table))->contents
>>> : 0);
>>> else
>>> /* If the window has its own display table, we can't use the width
>>> run cache, because that's based on the buffer's display table. */
>>> width_table = 0; // initialize it with 0 (current buffer has no display table)
>>>
>>> ...
>>>
>>> if (width_cache)
>>> {
>>> /* Is this character part of the current run? If so, extend
>>> the run. */
>>> if (pos - 1 == width_run_end
>>> && XFASTINT (width_table[c]) == width_run_width) // dereference width_table here, and crash
>>> width_run_end = pos;
>> Did you actually see such a crash, and if so, can you show a recipe
>> for reproducing that?
>>
>> Thanks.
>
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
* bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
2016-07-25 22:37 ` Clément Pit--Claudel
@ 2016-07-26 2:33 ` npostavs
2016-07-26 2:49 ` Clément Pit--Claudel
0 siblings, 1 reply; 8+ messages in thread
From: npostavs @ 2016-07-26 2:33 UTC (permalink / raw)
To: Clément Pit--Claudel; +Cc: 24064
Clément Pit--Claudel <clement.pit@gmail.com> writes:
> On 2016-07-25 18:02, Sergei Litvin wrote:
>> I've prepared an elisp file to reproduce a crash:
>>
>> 1) Open it and move cursor to the end of the file
>> 2) Execute eval-buffer
>> 3) Press C-l several times
>
> Running this recipe does not cause a crash for me in GNU Emacs 25.1.50.7 (x86_64-pc-linux-gnu, GTK+ Version 3.18.9) of 2016-07-20. Am I missing something?
It crashes for me on 24.5, but not on 25.0.95. Perhaps it was fixed?
^ permalink raw reply [flat|nested] 8+ messages in thread
* bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
2016-07-26 2:33 ` npostavs
@ 2016-07-26 2:49 ` Clément Pit--Claudel
2016-07-26 15:35 ` Eli Zaretskii
0 siblings, 1 reply; 8+ messages in thread
From: Clément Pit--Claudel @ 2016-07-26 2:49 UTC (permalink / raw)
To: npostavs; +Cc: 24064
[-- Attachment #1.1: Type: text/plain, Size: 636 bytes --]
On 2016-07-25 22:33, npostavs@users.sourceforge.net wrote:
> Clément Pit--Claudel <clement.pit@gmail.com> writes:
>
>> On 2016-07-25 18:02, Sergei Litvin wrote:
>>> I've prepared an elisp file to reproduce a crash:
>>>
>>> 1) Open it and move cursor to the end of the file
>>> 2) Execute eval-buffer
>>> 3) Press C-l several times
>>
>> Running this recipe does not cause a crash for me in GNU Emacs 25.1.50.7 (x86_64-pc-linux-gnu, GTK+ Version 3.18.9) of 2016-07-20. Am I missing something?
>
> It crashes for me on 24.5, but not on 25.0.95. Perhaps it was fixed?
Indeed, same here. Crashes on 24.5, but not 25.
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
* bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
2016-07-26 2:49 ` Clément Pit--Claudel
@ 2016-07-26 15:35 ` Eli Zaretskii
2016-07-26 16:04 ` Clément Pit--Claudel
0 siblings, 1 reply; 8+ messages in thread
From: Eli Zaretskii @ 2016-07-26 15:35 UTC (permalink / raw)
To: Clément Pit--Claudel; +Cc: 24064-done, npostavs
> From: Clément Pit--Claudel <clement.pit@gmail.com>
> Date: Mon, 25 Jul 2016 22:49:35 -0400
> Cc: 24064@debbugs.gnu.org
>
> >>> I've prepared an elisp file to reproduce a crash:
> >>>
> >>> 1) Open it and move cursor to the end of the file
> >>> 2) Execute eval-buffer
> >>> 3) Press C-l several times
> >>
> >> Running this recipe does not cause a crash for me in GNU Emacs 25.1.50.7 (x86_64-pc-linux-gnu, GTK+ Version 3.18.9) of 2016-07-20. Am I missing something?
> >
> > It crashes for me on 24.5, but not on 25.0.95. Perhaps it was fixed?
>
> Indeed, same here. Crashes on 24.5, but not 25.
C-l (a.k.a. "recenter") no longer calls compute_motion in Emacs 25, so
to trigger the segfault, the recipe should be changed like this:
1) Open it and move cursor to the end of the file
2) Execute eval-buffer
3) Type "M-x set-variable RET scroll-preserve-screen-position RET t RET"
4) Type "C-u 1 C-v"
In addition, the above should be done on a TTY frame.
This 22-year old bug is now fixed on the master branch.
Thanks.
^ permalink raw reply [flat|nested] 8+ messages in thread
* bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c
2016-07-26 15:35 ` Eli Zaretskii
@ 2016-07-26 16:04 ` Clément Pit--Claudel
0 siblings, 0 replies; 8+ messages in thread
From: Clément Pit--Claudel @ 2016-07-26 16:04 UTC (permalink / raw)
To: Eli Zaretskii; +Cc: 24064-done, npostavs
[-- Attachment #1.1: Type: text/plain, Size: 112 bytes --]
On 2016-07-26 11:35, Eli Zaretskii wrote:
> This 22-year old bug is now fixed on the master branch.
! :)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2016-07-26 16:04 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-07-24 23:51 bug#24064: 24.5; NULL pointer dereference in compute_motion(), indent.c Sergei Litvin
2016-07-25 16:24 ` Eli Zaretskii
2016-07-25 22:02 ` Sergei Litvin
2016-07-25 22:37 ` Clément Pit--Claudel
2016-07-26 2:33 ` npostavs
2016-07-26 2:49 ` Clément Pit--Claudel
2016-07-26 15:35 ` Eli Zaretskii
2016-07-26 16:04 ` Clément Pit--Claudel
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/emacs.git
https://git.savannah.gnu.org/cgit/emacs/org-mode.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.