From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Jason Rumney Newsgroups: gmane.emacs.devel Subject: Re: [lekktu@gmail.com: Re: Crash when having malformed PBM image on screen and viewing *Messages* buffer (on Windows)] Date: Wed, 25 Jul 2007 11:57:56 +0100 Message-ID: <46A72CB4.40701@gnu.org> References: NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit X-Trace: sea.gmane.org 1185361090 22827 80.91.229.12 (25 Jul 2007 10:58:10 GMT) X-Complaints-To: usenet@sea.gmane.org NNTP-Posting-Date: Wed, 25 Jul 2007 10:58:10 +0000 (UTC) Cc: emacs-devel@gnu.org To: rms@gnu.org Original-X-From: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Wed Jul 25 12:58:06 2007 Return-path: Envelope-to: ged-emacs-devel@m.gmane.org Original-Received: from lists.gnu.org ([199.232.76.165]) by lo.gmane.org with esmtp (Exim 4.50) id 1IDeZC-0002uK-8m for ged-emacs-devel@m.gmane.org; Wed, 25 Jul 2007 12:58:06 +0200 Original-Received: from localhost ([127.0.0.1] helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1IDeZB-00078l-KM for ged-emacs-devel@m.gmane.org; Wed, 25 Jul 2007 06:58:05 -0400 Original-Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1IDeZ9-00078c-6o for emacs-devel@gnu.org; Wed, 25 Jul 2007 06:58:03 -0400 Original-Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1IDeZ7-00078H-Hf for emacs-devel@gnu.org; Wed, 25 Jul 2007 06:58:01 -0400 Original-Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1IDeZ7-00078E-Ds for emacs-devel@gnu.org; Wed, 25 Jul 2007 06:58:01 -0400 Original-Received: from outmail1.freedom2surf.net ([194.106.33.237]) by monty-python.gnu.org with esmtp (Exim 4.60) (envelope-from ) id 1IDeZ5-0002k7-SP; Wed, 25 Jul 2007 06:58:00 -0400 Original-Received: from [127.0.0.1] (host81-149-25-51.in-addr.btopenworld.com [81.149.25.51]) by outmail1.freedom2surf.net (Postfix) with ESMTP id C8CC150892; Wed, 25 Jul 2007 11:57:58 +0100 (BST) User-Agent: Thunderbird 2.0.0.5 (Windows/20070716) In-Reply-To: X-detected-kernel: Linux 2.4-2.6 X-BeenThere: emacs-devel@gnu.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Emacs development discussions." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Original-Sender: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Errors-To: emacs-devel-bounces+ged-emacs-devel=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.devel:75520 Archived-At: Richard Stallman wrote: > [I sent this message month ago but did not get a response.] > > Would someone please investigate this, then ack? > As I said in the original thread about this bug, the problem can be reproduced on GNU/Linux. The recipe to reproduce it is: - start emacs -Q - run this in *scratch* buffer (progn (put-image '(image :type pbm :data "") 0) (pop-to-buffer "*Messages*") (goto-char (point-max))) Now press . The problem seems to be some mixup between the *scratch* buffer and the *Messages* buffer during redisplay. The crash occurs during redisplay of the window containing the *scratch* buffer, near the end of redisplay_window. /* Restore current_buffer and value of point in it. */ TEMP_SET_PT_BOTH (CHARPOS (opoint), BYTEPOS (opoint)); set_buffer_internal_1 (old); TEMP_SET_PT_BOTH (CHARPOS (lpoint), BYTEPOS (lpoint)); opoint is 193, which is the value of zv in the *scratch* buffer. But lpoint is 386, which I think may be the length of the *Messages* buffer at some point in the redisplay cycle (multiple messages are output during redisplay). Setting breakpoints in message_dolog seems to prevent the bug from appearing, so it is difficult to tell for sure. The only code that changes lpoint is on line 13062 of xdisp.c, and should only be run if the window being redisplayed is the selected window, and the current_buffer has not changed. But AFAICT, the selected_window should be the *Messages* buffer's window at this point, while we are redisplaying the *scratch* buffer, so the bug is probably to do with something changing selected_window somewhere before this point. The sequence of events I have figured out so far is: 1. Pressing right arrow when at the end of the *Messages* buffer causes a message "call interactively: End of buffer" to be displayed. 2. This triggers redisplay, during which Emacs attempts to display the broken image again. 3. Attempting to display the broken image results in a message: "Not a PBM image: `(image :type pbm :data )'". 4. When Emacs does not crash, the above message is (sometimes?) printed twice, the first such message appears on the same line as the "End of buffer" message. 5. Point in the *Messages* buffer ends up after the "End of buffer" message, but before the "Not a PBM image" messages. There is code in message_dolog to keep point at the end of the buffer if it was there before. The fact that this goes wrong may be related to the bug we are investigating.