bug#72497: 30.0.60; Emacs segfaults when navigating a huge file

bug#72497: 30.0.60; Emacs segfaults when navigating a huge file

[Raffael Stocker]

Emacs crashes when evaluating ‘end-of-buffer’ on a huge file.
To reproduce:
1. emacs -Q
2. load a huge (e.g. 3 GB) binary file
3. Do ‘M->’
4. Emacs crashes

I am seeing the same behaviour on GNU/Linux and Windows 11, both
with recent 30.0.60 builds.

In GNU Emacs 30.0.60 (build 1, x86_64-pc-linux-gnu, GTK+ Version
 3.24.43, cairo version 1.18.0) of 2024-08-06 built on Whiteflame
Repository revision: 3817355aed503e79c03bca5d203bd73716d10d9e
Repository branch: emacs-30
Windowing system distributor 'The X.Org Foundation', version 11.0.12101013
System Description: Arch Linux

Configured using:
 'configure --prefix=/opt/emacs 'CFLAGS=-O0 -g3''

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ JPEG
LCMS2 LIBOTF LIBSYSTEMD LIBXML2 M17N_FLT MODULES NATIVE_COMP NOTIFY
INOTIFY PDUMPER PNG RSVG SECCOMP SOUND SQLITE3 THREADS TIFF
TOOLKIT_SCROLL_BARS TREE_SITTER WEBP X11 XDBE XIM XINPUT2 XPM GTK3 ZLIB

Important settings:
  value of $LC_MESSAGES: en_US.UTF-8
  value of $LANG: de_DE.UTF8
  locale-coding-system: utf-8-unix


Full backtrace:

#0  0x00005555555d49b1 in get_large_narrowing_begv (pos=3292463496) at xdisp.c:3686
        len = 250000
        begv = -1002753800
        limit = 128
#1  0x00005555555dfd89 in reseat (it=0x7fffffffbe80, pos=..., force_p=true) at xdisp.c:7773
        original_pos = 1
#2  0x00005555555d449c in init_iterator (it=0x7fffffffbe80, w=0x5555564ce2c0, charpos=1, bytepos=1, row=0x5555560fdef0, base_face_id=DEFAULT_FACE_ID) at xdisp.c:3507
        remapped_base_face_id = DEFAULT_FACE_ID
        body_width = 1680
        body_height = 1309
#3  0x00005555555d4b38 in start_display (it=0x7fffffffbe80, w=0x5555564ce2c0, pos=...) at xdisp.c:3735
        row = 0x5555560fdef0
        first_vpos = 0
#4  0x0000555555649360 in Fwindow_end (window=0x0, update=0x30) at window.c:1876
        startp = {charpos = 1, bytepos = 1}
        it = {window = 0x5555564ce2c5, w = 0x5555564ce2c0, f = 0x5555564ce038, method = GET_FROM_BUFFER, stop_charpos = 1, prev_stop = 0, base_level_stop = 0, end_charpos = 3292463496, medium_narrowing_begv = 3292373700, medium_narrowing_zv = 3292463496, large_narrowing_begv = 0, large_narrowing_zv = 0, s = 0x0, string_nchars = 0, multibyte_p = true, tab_line_p = false, header_line_p = false, string_from_display_prop_p = false, string_from_prefix_prop_p = false, from_disp_prop_p = false, ellipsis_p = false, avoid_cursor_p = false, dp = 0x0, dpvec = 0x0, dpend = 0x0, dpvec_char_len = 0, dpvec_face_id = 0, saved_face_id = 0, ctl_chars = {0x0 <repeats 16 times>}, start = {pos = {charpos = 1, bytepos = 1}, overlay_string_index = -1, string_pos = {charpos = -1, bytepos = -1}, dpvec_index = -1}, current = {pos = {charpos = 1, bytepos = 1}, overlay_string_index = -1, string_pos = {charpos = -1, bytepos = -1}, dpvec_index = -1}, n_overlay_strings = 0, overlay_strings_charpos = 0, overlay_strings = {0x0 <repeats 16 times>}, string_overlays = {0x0 <repeats 16 times>}, string = 0x0, from_overlay = 0x0, stack = {{string = 0x0, string_nchars = 0, end_charpos = 0, stop_charpos = 0, prev_stop = 0, base_level_stop = 0, cmp_it = {stop_pos = 0, id = 0, ch = 0, rule_idx = 0, lookback = 0, nglyphs = 0, reversed_p = false, parent_it = 0x0, charpos = 0, nchars = 0, nbytes = 0, from = 0, to = 0, width = 0}, face_id = 0, u = {image = {object = 0x0, slice = {x = 0x0, y = 0x0, width = 0x0, height = 0x0}, image_id = 0}, stretch = {object = 0x0}, xwidget = {object = 0x0}}, position = {charpos = 0, bytepos = 0}, current = {pos = {charpos = 0, bytepos = 0}, overlay_string_index = 0, string_pos = {charpos = 0, bytepos = 0}, dpvec_index = 0}, from_overlay = 0x0, area = LEFT_MARGIN_AREA, method = GET_FROM_BUFFER, paragraph_embedding = NEUTRAL_DIR, multibyte_p = false, string_from_display_prop_p = false, string_from_prefix_prop_p = false, display_ellipsis_p = false, avoid_cursor_p = false, bidi_p = false, from_disp_prop_p = false, line_wrap = TRUNCATE, voffset = 0, space_width = 0x0, font_height = 0x0}, {string = 0x0, string_nchars = 0, end_charpos = 0, stop_charpos = 0, prev_stop = 0, base_level_stop = 0, cmp_it = {stop_pos = 0, id = 0, ch = 0, rule_idx = 0, lookback = 0, nglyphs = 0, reversed_p = false, parent_it = 0x0, charpos = 0, nchars = 0, nbytes = 0, from = 0, to = 0, width = 0}, face_id = 0, u = {image = {object = 0x0, slice = {x = 0x0, y = 0x0, width = 0x0, height = 0x0}, image_id = 0}, stretch = {object = 0x0}, xwidget = {object = 0x0}}, position = {charpos = 0, bytepos = 0}, current = {pos = {charpos = 0, bytepos = 0}, overlay_string_index = 0, string_pos = {charpos = 0, bytepos = 0}, dpvec_index = 0}, from_overlay = 0x0, area = LEFT_MARGIN_AREA, method = GET_FROM_BUFFER, paragraph_embedding = NEUTRAL_DIR, multibyte_p = false, string_from_display_prop_p = false, string_from_prefix_prop_p = false, display_ellipsis_p = false, avoid_cursor_p = false, bidi_p = false, from_disp_prop_p = false, line_wrap = TRUNCATE, voffset = 0, space_width = 0x0, font_height = 0x0}, {string = 0x0, string_nchars = 0, end_charpos = 0, stop_charpos = 0, prev_stop = 0, base_level_stop = 0, cmp_it = {stop_pos = 0, id = 0, ch = 0, rule_idx = 0, lookback = 0, nglyphs = 0, reversed_p = false, parent_it = 0x0, charpos = 0, nchars = 0, nbytes = 0, from = 0, to = 0, width = 0}, face_id = 0, u = {image = {object = 0x0, slice = {x = 0x0, y = 0x0, width = 0x0, height = 0x0}, image_id = 0}, stretch = {object = 0x0}, xwidget = {object = 0x0}}, position = {charpos = 0, bytepos = 0}, current = {pos = {charpos = 0, bytepos = 0}, overlay_string_index = 0, string_pos = {charpos = 0, bytepos = 0}, dpvec_index = 0}, from_overlay = 0x0, area = LEFT_MARGIN_AREA, method = GET_FROM_BUFFER, paragraph_embedding = NEUTRAL_DIR, multibyte_p = false, string_from_display_prop_p = false, string_from_prefix_prop_p = false, display_ellipsis_p = false, avoid_cursor_p = false, bidi_p = false, from_disp_prop_p = false, line_wrap = TRUNCATE, voffset = 0, space_width = 0x0, font_height = 0x0}, {string = 0x0, string_nchars = 0, end_charpos = 0, stop_charpos = 0, prev_stop = 0, base_level_stop = 0, cmp_it = {stop_pos = 0, id = 0, ch = 0, rule_idx = 0, lookback = 0, nglyphs = 0, reversed_p = false, parent_it = 0x0, charpos = 0, nchars = 0, nbytes = 0, from = 0, to = 0, width = 0}, face_id = 0, u = {image = {object = 0x0, slice = {x = 0x0, y = 0x0, width = 0x0, height = 0x0}, image_id = 0}, stretch = {object = 0x0}, xwidget = {object = 0x0}}, position = {charpos = 0, bytepos = 0}, current = {pos = {charpos = 0, bytepos = 0}, overlay_string_index = 0, string_pos = {charpos = 0, bytepos = 0}, dpvec_index = 0}, from_overlay = 0x0, area = LEFT_MARGIN_AREA, method = GET_FROM_BUFFER, paragraph_embedding = NEUTRAL_DIR, multibyte_p = false, string_from_display_prop_p = false, string_from_prefix_prop_p = false, display_ellipsis_p = false, avoid_cursor_p = false, bidi_p = false, from_disp_prop_p = false, line_wrap = TRUNCATE, voffset = 0, space_width = 0x0, font_height = 0x0}, {string = 0x0, string_nchars = 0, end_charpos = 0, stop_charpos = 0, prev_stop = 0, base_level_stop = 0, cmp_it = {stop_pos = 0, id = 0, ch = 0, rule_idx = 0, lookback = 0, nglyphs = 0, reversed_p = false, parent_it = 0x0, charpos = 0, nchars = 0, nbytes = 0, from = 0, to = 0, width = 0}, face_id = 0, u = {image = {object = 0x0, slice = {x = 0x0, y = 0x0, width = 0x0, height = 0x0}, image_id = 0}, stretch = {object = 0x0}, xwidget = {object = 0x0}}, position = {charpos = 0, bytepos = 0}, current = {pos = {charpos = 0, bytepos = 0}, overlay_string_index = 0, string_pos = {charpos = 0, bytepos = 0}, dpvec_index = 0}, from_overlay = 0x0, area = LEFT_MARGIN_AREA, method = GET_FROM_BUFFER, paragraph_embedding = NEUTRAL_DIR, multibyte_p = false, string_from_display_prop_p = false, string_from_prefix_prop_p = false, display_ellipsis_p = false, avoid_cursor_p = false, bidi_p = false, from_disp_prop_p = false, line_wrap = TRUNCATE, voffset = 0, space_width = 0x0, font_height = 0x0}}, sp = 0, selective = 0, what = IT_CHARACTER, face_id = 0, selective_display_ellipsis_p = true, ctl_arrow_p = true, face_box_p = false, start_of_box_run_p = false, end_of_box_run_p = false, overlay_strings_at_end_processed_p = false, ignore_overlay_strings_at_pos_p = false, glyph_not_available_p = false, starts_in_middle_of_char_p = false, face_before_selective_p = false, constrain_row_ascent_descent_p = false, line_number_produced_p = false, align_visually_p = false, line_wrap = WINDOW_WRAP, base_face_id = 0, c = 0, len = 0, cmp_it = {stop_pos = 0, id = -1, ch = 0, rule_idx = 0, lookback = 0, nglyphs = 0, reversed_p = false, parent_it = 0x7fffffffbe80, charpos = 0, nchars = 0, nbytes = 0, from = 0, to = 0, width = 0}, char_to_display = 0, glyphless_method = GLYPHLESS_DISPLAY_THIN_SPACE, image_id = 0, xwidget = 0x0, slice = {x = 0x0, y = 0x0, width = 0x0, height = 0x0}, space_width = 0x0, voffset = 0, tab_width = 8, font_height = 0x0, object = 0x5555574a8855, position = {charpos = 1, bytepos = 1}, truncation_pixel_width = 0, continuation_pixel_width = 8, first_visible_x = 0, last_visible_x = 1680, last_visible_y = 1309, extra_line_spacing = 0, max_extra_line_spacing = 0, override_ascent = -1, override_descent = 0, override_boff = 0, glyph_row = 0x5555560fdef0, area = TEXT_AREA, nglyphs = 1, pixel_width = 0, ascent = 0, descent = 0, max_ascent = 0, max_descent = 0, phys_ascent = 0, phys_descent = 0, max_phys_ascent = 0, max_phys_descent = 0, current_x = 0, wrap_prefix_width = 0, continuation_lines_width = 0, eol_pos = {charpos = 0, bytepos = 0}, current_y = 0, first_vpos = 0, vpos = 0, hpos = 0, lnum = 0, lnum_bytepos = 0, lnum_width = 0, lnum_pixel_width = 0, pt_lnum = 0, stretch_adjust = 0, left_user_fringe_bitmap = 0, right_user_fringe_bitmap = 0, left_user_fringe_face_id = 0, right_user_fringe_face_id = 0, bidi_p = true, bidi_it = {bytepos = 1, charpos = 1, ch = 0, nchars = -1, ch_len = 0, type = NEUTRAL_B, type_after_wn = NEUTRAL_B, orig_type = NEUTRAL_B, resolved_level = 0 '\000', isolate_level = 0 '\000', invalid_levels = 0, invalid_isolates = 0, prev = {charpos = 0, type = UNKNOWN_BT, orig_type = UNKNOWN_BT}, last_strong = {charpos = 0, type = UNKNOWN_BT, orig_type = UNKNOWN_BT}, next_for_neutral = {charpos = -1, type = UNKNOWN_BT, orig_type = UNKNOWN_BT}, prev_for_neutral = {charpos = -1, type = UNKNOWN_BT, orig_type = UNKNOWN_BT}, next_for_ws = {charpos = 0, type = UNKNOWN_BT, orig_type = UNKNOWN_BT}, bracket_pairing_pos = -1, bracket_enclosed_type = UNKNOWN_BT, next_en_pos = 0, next_en_type = UNKNOWN_BT, sos = L2R, scan_dir = 0, disp_pos = -1, disp_prop = 0, stack_idx = 0, level_stack = {{next_for_neutral_pos = 0, next_for_neutral_type = 0, last_strong_type = 0, prev_for_neutral_type = 0, level = 0 '\000', flags = 0 '\000'} <repeats 128 times>}, string = {lstring = 0x0, s = 0x0, schars = 0, bufpos = 0, from_disp_str = false, unibyte = false}, w = 0x5555564ce2c0, paragraph_dir = NEUTRAL_DIR, separator_limit = -1, first_elt = true, new_paragraph = true, frame_window_p = true}, paragraph_embedding = NEUTRAL_DIR, min_width_property = 0x0, min_width_start = 0}
        old_buffer = 0x0
        itdata = 0x0
        value = 0x0
        w = 0x5555564ce2c0
        buf = 0x5555574a8855
        b = 0x5555574a8850
#5  0x00007fffeecb16e8 in F656e642d6f662d627566666572_end_of_buffer_0 () from /home/rst/build/emacs/src/../native-lisp/30.0.60-2a981135/preloaded/simple-fab5b0cf-0a04bfb3.eln
No symbol table info available.
#6  0x000055555581dfc2 in funcall_subr (subr=0x7fffef7a64d8, numargs=1, args=0x7fffffffd580) at eval.c:3161
        argbuf = {0x0, 0x7fffffffd320, 0x555555f459c0 <lispsym>, 0x0, 0x0, 0x7fffffffd340, 0x555555815c8b <builtin_lisp_symbol+48>, 0xef7a64dd}
        a = 0x7fffffffd580
        maxargs = 1
        fun = 0x555555f459c0 <lispsym>
#7  0x000055555581d9fe in funcall_general (fun=0x7fffef7a64dd, numargs=1, args=0x7fffffffd580) at eval.c:3040
        original_fun = 0x7a40
#8  0x000055555581dcaf in Ffuncall (nargs=2, args=0x7fffffffd578) at eval.c:3093
        count = {bytes = 256}
        val = 0x555555f4bd20 <lispsym+25440>
#9  0x00005555558131c3 in Ffuncall_interactively (nargs=2, args=0x7fffffffd578) at callint.c:250
        speccount = {bytes = 224}
#10 0x000055555581e216 in funcall_subr (subr=0x555555ec5e60 <Sfuncall_interactively>, numargs=2, args=0x7fffffffd578) at eval.c:3184
        maxargs = -2
        fun = 0x555555f459c0 <lispsym>
#11 0x000055555581d9fe in funcall_general (fun=0x555555ec5e65 <Sfuncall_interactively+5>, numargs=2, args=0x7fffffffd578) at eval.c:3040
        original_fun = 0x9510
#12 0x000055555581dcaf in Ffuncall (nargs=3, args=0x7fffffffd570) at eval.c:3093
        count = {bytes = 192}
        val = 0x555555f4b4e0 <lispsym+23328>
#13 0x00005555558156e1 in Fcall_interactively (function=0x7a40, record_flag=0x0, keys=0x5555574a87c5) at callint.c:789
        speccount = {bytes = 160}
        arg_from_tty = false
        key_count = 1
        record_then_fail = false
        save_this_command = 0x7a40
        save_this_original_command = 0x7a40
        save_real_this_command = 0x7a40
        save_last_command = 0x2aaa98ff5b68
        prefix_arg = 0x0
        enable = 0x0
        up_event = 0x0
        form = 0x7fffef7a6533
        specs = 0x7fffef7a6554
        sa_avail = 16309
        sa_count = {bytes = 192}
        string_len = 2
        string = 0x7fffffffd5c1 "P"
        string_end = 0x7fffffffd5c2 ""
        next_event = 1
        nargs = 3
        args = 0x7fffffffd570
        visargs = 0x7fffffffd588
        varies = 0x7fffffffd5a0 ""
        tem = 0x7fffffffd5c2 ""
        val = 0x7fffeed4a0a0 <d_reloc>
#14 0x00007fffeecba905 in F636f6d6d616e642d65786563757465_command_execute_0 () from /home/rst/build/emacs/src/../native-lisp/30.0.60-2a981135/preloaded/simple-fab5b0cf-0a04bfb3.eln
No symbol table info available.
#15 0x000055555581e060 in funcall_subr (subr=0x7fffef7a8648, numargs=1, args=0x7fffffffda78) at eval.c:3167
        argbuf = {0x7a40, 0x0, 0x0, 0x0, 0x0, 0x7fffffffd950, 0x555555815c8b <builtin_lisp_symbol+48>, 0xef7a864d}
        a = 0x7fffffffd910
        maxargs = 4
        fun = 0x555555f459c0 <lispsym>
#16 0x000055555581d9fe in funcall_general (fun=0x7fffef7a864d, numargs=1, args=0x7fffffffda78) at eval.c:3040
        original_fun = 0x5b80
#17 0x000055555581dcaf in Ffuncall (nargs=2, args=0x7fffffffda70) at eval.c:3093
        count = {bytes = 128}
        val = 0x5b80
#18 0x000055555574f436 in command_loop_1 () at keyboard.c:1550
        scount = {bytes = 96}
        cmd = 0x7a40
        keybuf = {0x200000fa, 0x1a, 0x0, 0x7fffffffdac0, 0x555555815c8b <builtin_lisp_symbol+48>, 0x55ffb6a0, 0x7fffffffdb30, 0x55555581fa9e <unbind_to+213>, 0x7ffff03a85d3, 0x60, 0x5555558163b1 <KBOARD_OBJFWDP+24>, 0x0, 0xb, 0xb310, 0x555555f459c0 <lispsym>, 0x0, 0x0, 0x60, 0x7fffffffdb30, 0x555555eaf0a0 <main_thread>, 0x7fffffffdb70, 0x55555581a4fb <push_handler_nosignal+246>, 0x100000030, 0x90, 0x30, 0x55555613f8f0, 0x55555574b835 <builtin_lisp_symbol+48>, 0x90, 0x7fffffffdba0, 0x55555581a3ea <push_handler+32>}
        i = 1
        last_pt = 1
        prev_modiff = 33
        prev_buffer = 0x5555574a8850
#19 0x000055555581a0dc in internal_condition_case (bfun=0x55555574ebd3 <command_loop_1>, handlers=0x90, hfun=0x55555574e104 <cmd_error>) at eval.c:1613
        val = 0x55555574b835 <builtin_lisp_symbol+48>
        c = 0x55555613f8f0
#20 0x000055555574e820 in command_loop_2 (handlers=0x90) at keyboard.c:1168
        val = 0x90
#21 0x000055555581958a in internal_catch (tag=0x122d0, func=0x55555574e7f6 <command_loop_2>, arg=0x90) at eval.c:1292
        val = 0x60f00000000
        c = 0x55555613f2d0
#22 0x000055555574e7b2 in command_loop () at keyboard.c:1146
No locals.
#23 0x000055555574dca6 in recursive_edit_1 () at keyboard.c:754
        count = {bytes = 32}
        val = 0x55555581f36d <record_unwind_protect+114>
#24 0x000055555574de52 in Frecursive_edit () at keyboard.c:837
        count = {bytes = 0}
        buffer = 0x0
#25 0x0000555555749fd2 in main (argc=2, argv=0x7fffffffdf78) at emacs.c:2635
        stack_bottom_variable = 0x0
        old_argc = 2
        dump_file = 0x0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = true
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = 0x0
        sockfd = -1
        module_assertions = false

bug#72497: 30.0.60; Emacs segfaults when navigating a huge file

[Eli Zaretskii]

> From: Raffael Stocker <r.stocker@mnet-mail.de>
> Date: Tue, 06 Aug 2024 19:33:25 +0200
> 
> 
> Full backtrace:
> 
> #0  0x00005555555d49b1 in get_large_narrowing_begv (pos=3292463496) at xdisp.c:3686
>         len = 250000
>         begv = -1002753800
>         limit = 128

Thanks, I installed a fix on the emacs-30 branch, please see if it
fixes your problems.

bug#72497: 30.0.60; Emacs segfaults when navigating a huge file

[Raffael Stocker]

Eli Zaretskii <eliz@gnu.org> writes:

> Thanks, I installed a fix on the emacs-30 branch, please see if it
> fixes your problems.

Yes, this solves the problem.  Thanks!

bug#72497: 30.0.60; Emacs segfaults when navigating a huge file

[Eli Zaretskii]

> From: Raffael Stocker <r.stocker@mnet-mail.de>
> Cc: 72497@debbugs.gnu.org
> Date: Tue, 06 Aug 2024 20:39:03 +0200
> 
> Eli Zaretskii <eliz@gnu.org> writes:
> 
> > Thanks, I installed a fix on the emacs-30 branch, please see if it
> > fixes your problems.
> 
> Yes, this solves the problem.  Thanks!

Thanks for testing (and for a very helpful backtrace to begin with).
I'm therefore closing this bug.