latest-from-bzr segfaults easily

latest-from-bzr segfaults easily

[Jim Meyering]

The latest is not usable for me on Fedora 15, x86_64.

How to reproduce using emacs built from the latest bzr
sources of about 5 hours ago:

First, get a cloned copy of the dash sources:
(you can probably use C source file, but this is particularly reliable)

   git clone git://git.kernel.org/pub/scm/utils/dash/dash.git && cd dash

Then, run this and type `C-s sh_':

  $ /p/p/emacs-2011-05-25.08h03/bin/emacs -q src/error.c
  Fatal error (11)zsh: abort (core dumped)


Here's a partial stack trace:

#0  0x00000000005591b6 in mark_object (arg=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/alloc.c:5344
#1  0x000000000055b6c1 in mark_maybe_pointer (p=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/alloc.c:4097
#2  mark_memory (offset=0, end=0x7fffffff1d10, start=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/alloc.c:4147
#3  mark_stack () at /h/j/w/co/emacs/trunk/src/alloc.c:4395
#4  Fgarbage_collect () at /h/j/w/co/emacs/trunk/src/alloc.c:4982
#5  0x0000000000570f85 in Ffuncall (nargs=4, args=0x7fffffff1de0)
    at /h/j/w/co/emacs/trunk/src/eval.c:2975
#6  0x00000000005a947e in exec_byte_code (bytestr=<optimized out>,
    vector=<optimized out>, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/bytecode.c:783
#7  0x0000000000570b99 in funcall_lambda (fun=16680341, nargs=0, arg_vector=
    0x7fffffff1fa8) at /h/j/w/co/emacs/trunk/src/eval.c:3272
#8  0x0000000000570f2b in Ffuncall (nargs=1, args=0x7fffffff1fa0)
    at /h/j/w/co/emacs/trunk/src/eval.c:3100
#9  0x00000000005a947e in exec_byte_code (bytestr=<optimized out>,
    vector=<optimized out>, maxdepth=<optimized out>,
    args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
    at /h/j/w/co/emacs/trunk/src/bytecode.c:783
#10 0x0000000000570b99 in funcall_lambda (fun=23897685, nargs=2, arg_vector=
    0x7fffffff2168) at /h/j/w/co/emacs/trunk/src/eval.c:3272
#11 0x0000000000570f2b in Ffuncall (nargs=3, args=0x7fffffff2160)
    at /h/j/w/co/emacs/trunk/src/eval.c:3100
#12 0x00000000005a947e in exec_byte_code (bytestr=<optimized out>,

in src/alloc.c,

   │5336      switch (SWITCH_ENUM_CAST (XTYPE (obj)))                           │
   │5337        {                                                               │
   │5338        case Lisp_String:                                               │
   │5339          {                                                             │
   │5340            register struct Lisp_String *ptr = XSTRING (obj);           │
   │5341            if (STRING_MARKED_P (ptr))                                  │
   │5342              break;                                                    │
   │5343            CHECK_ALLOCATED_AND_LIVE (live_string_p);                   │
  >│5344            MARK_INTERVAL_TREE (ptr->intervals);                        │
   │5345            MARK_STRING (ptr);                                          │

(gdb) p *ptr
$2 = {
  size = 6221254864074593878,
  size_byte = 6221254864074593878,
  intervals = 0x5656565656565656,
  data = 0x5656565656565656 <Address 0x5656565656565656 out of bounds>
}

Re: latest-from-bzr segfaults easily

[Eli Zaretskii]

> From: Jim Meyering <jim@meyering.net>
> Date: Wed, 25 May 2011 13:41:18 +0200
> 
> (gdb) p *ptr
> $2 = {
>   size = 6221254864074593878,
>   size_byte = 6221254864074593878,
>   intervals = 0x5656565656565656,
>   data = 0x5656565656565656 <Address 0x5656565656565656 out of bounds>
> }

FWIW, this struct seems to be overrun by ASCII text.

Re: latest-from-bzr segfaults easily

[Paul Eggert]

On 05/25/11 04:41, Jim Meyering wrote:
> The latest is not usable for me on Fedora 15, x86_64.
> 
> How to reproduce using emacs built from the latest bzr
> sources of about 5 hours ago:
> 
> First, get a cloned copy of the dash sources:
> (you can probably use C source file, but this is particularly reliable)
> 
>    git clone git://git.kernel.org/pub/scm/utils/dash/dash.git && cd dash
> 
> Then, run this and type `C-s sh_':
> 
>   $ /p/p/emacs-2011-05-25.08h03/bin/emacs -q src/error.c
>   Fatal error (11)zsh: abort (core dumped)

I can't reproduce the problem on Fedora 14, x86_64.
I used bzr 104366 and the command:

  ~/src/gnu/emacs/trunkclone/src/emacs -q src/error.c

It could be a Fedora 15 thing, or it could be something else
different in our setups.

I recall having a similer problem on Ubuntu 10.10 that I tracked
down to a bug in the glibc string headers: they had marked memmove's
parameters to be 'restrict', which is quite bogus, and caused
GCC 4.6.0 to generate incorrect code.  Are you using GCC 4.6.0?
Maybe you should look into those headers.

Re: latest-from-bzr segfaults easily

[Jim Meyering]

Paul Eggert wrote:

> On 05/25/11 04:41, Jim Meyering wrote:
>> The latest is not usable for me on Fedora 15, x86_64.
>>
>> How to reproduce using emacs built from the latest bzr
>> sources of about 5 hours ago:
>>
>> First, get a cloned copy of the dash sources:
>> (you can probably use C source file, but this is particularly reliable)
>>
>>    git clone git://git.kernel.org/pub/scm/utils/dash/dash.git && cd dash
>>
>> Then, run this and type `C-s sh_':
>>
>>   $ /p/p/emacs-2011-05-25.08h03/bin/emacs -q src/error.c
>>   Fatal error (11)zsh: abort (core dumped)
>
> I can't reproduce the problem on Fedora 14, x86_64.
> I used bzr 104366 and the command:
>
>   ~/src/gnu/emacs/trunkclone/src/emacs -q src/error.c
>
> It could be a Fedora 15 thing, or it could be something else
> different in our setups.
>
> I recall having a similer problem on Ubuntu 10.10 that I tracked
> down to a bug in the glibc string headers: they had marked memmove's
> parameters to be 'restrict', which is quite bogus, and caused
> GCC 4.6.0 to generate incorrect code.  Are you using GCC 4.6.0?

Yes, but the head from just a dozen hours earlier works fine.
I'll end up using bisection, if I find the time.

Re: latest-from-bzr segfaults easily

[Jim Meyering]

Jim Meyering wrote:

> Paul Eggert wrote:
>
>> On 05/25/11 04:41, Jim Meyering wrote:
>>> The latest is not usable for me on Fedora 15, x86_64.
>>>
>>> How to reproduce using emacs built from the latest bzr
>>> sources of about 5 hours ago:
>>>
>>> First, get a cloned copy of the dash sources:
>>> (you can probably use C source file, but this is particularly reliable)
>>>
>>>    git clone git://git.kernel.org/pub/scm/utils/dash/dash.git && cd dash
>>>
>>> Then, run this and type `C-s sh_':
>>>
>>>   $ /p/p/emacs-2011-05-25.08h03/bin/emacs -q src/error.c
>>>   Fatal error (11)zsh: abort (core dumped)
>>
>> I can't reproduce the problem on Fedora 14, x86_64.
>> I used bzr 104366 and the command:
>>
>>   ~/src/gnu/emacs/trunkclone/src/emacs -q src/error.c
>>
>> It could be a Fedora 15 thing, or it could be something else
>> different in our setups.
>>
>> I recall having a similer problem on Ubuntu 10.10 that I tracked
>> down to a bug in the glibc string headers: they had marked memmove's
>> parameters to be 'restrict', which is quite bogus, and caused
>> GCC 4.6.0 to generate incorrect code.  Are you using GCC 4.6.0?
>
> Yes, but the head from just a dozen hours earlier works fine.
> I'll end up using bisection, if I find the time.

Luckily(?) the problem disappeared when I rebuilt
with the latest from some time yesterday.