bug#2435: Bug 2435

[Chong Yidong <cyd@stupidchicken.com>]

Kenichi Handa <handa@m17n.org> writes:

>> I get a crash with the following recipe, and I think it's related to the
>> new composition code:
>> 
>> emacs -Q
>> M-x customize-group RET whitespace RET
>> C-v C-v
>
> I can't reproduce the crash with that.

It doesn't happen all the time---about once every three or four
attempts.  Quite strange.

> It seems that the regular expression
> tibetan-composable-pattern (which starts with "[\340\275..."
> and the byte length is surely 88) is being compiled.
> Parhaps the display routine is going to display #xF20
> (tibetan character).  But, in my case, regex_compile never
> calls analyse_first at line 2853.
>
>   2846			if (many_times_ok)
>   2847			  {
>   2848			    boolean simple = skip_one_char (laststart) == b;
>   2849			    unsigned int startoffset = 0;
>   2850			    re_opcode_t ofj =
>   2851			      /* Check if the loop can match the empty string.  */
>   2852			      (simple || !analyse_first (laststart, b, NULL, 0))
>   2853			      ? on_failure_jump : on_failure_jump_loop;
>
> Here, "simple" is always set to 1, so analyse_first is not
> called.

When I get the crash, simple is set to 0.

(gdb) p b
$4 = (unsigned char *) 0x8b927b7 ""
(gdb) p laststart
$5 = (unsigned char *) 0x8b92786 "\a\201\f"

The return value of `skip_one_char (laststart)' is NULL.

> Could you please try:
>     ESC : (re-search-forward tibetan-composable-pattern) RET
> in some buffer and checks if analyse_first is called?

It's called, not for the search itself but in the error handler:

#0  analyse_first (
    p=0x8860bc0 "\t\002\037Previous command was not a
    yank\n\001\005eval-\0164", pend=0x8860be4 "\005eval-\0164",
    fastmap=0x83e3984 "", multibyte=0)
    at regex.c:4022
#1  0x081aa0b5 in re_compile_fastmap (bufp=0x83e3960) at regex.c:4339
#2  0x081aa2c2 in re_search_2 (bufp=0x83e3960, str1=0x0, size1=0, 
    str2=0x89fa230 "Search failed:
    \"[\340\275\200-\340\275\251\340\275\252][\340\276\220-\340\276\271\340\276\272\340\276\273\340\276\274]*[\340\275\260\366\220\202\216\340\275\261\340\275\262-\340\275\275\340\276\200\340\276\201\340\276\204]*[\340\275\276\340\276\202\340\276\203\340\276\206-\340\276\213\340\274\231\340\274\265\340\274\267]*\"",
    size2=105, startpos=0, range=105, regs=0x0, 
    stop=105) at regex.c:4487
#3  0x081aa18c in re_search (bufp=0x83e3960, 
    string=0x89fa230 "Search failed:
    \"[\340\275\200-\340\275\251\340\275\252][\340\276\220-\340\276\271\340\276\272\340\276\273\340\276\274]*[\340\275\260\366\220\202\216\340\275\261\340\275\262-\340\275\275\340\276\200\340\276\201\340\276\204]*[\340\275\276\340\276\202\340\276\203\340\276\206-\340\276\213\340\274\231\340\274\265\340\274\267]*\"",
    size=105, startpos=0, range=105, regs=0x0)
    at regex.c:4393
#4  0x081972f1 in fast_string_match (regexp=139244403, string=138652283)
    at search.c:505
#5  0x081d3fb6 in skip_debugger (conditions=138346117, data=141320317)
    at eval.c:1862
#6  0x081d4097 in maybe_call_debugger (conditions=138346117,
    sig=138556777, 
    data=141320309) at eval.c:1889
#7  0x081d41e0 in find_handler_clause (handlers=138402201, 
    conditions=138346117, sig=138556777, data=141320309) at eval.c:1961
#8  0x081d3c34 in Fsignal (error_symbol=138556777, data=141320309)
    at eval.c:1700