I-search backward broken under MacOS 10.3 in Nov/1/03 CVS version

I-search backward broken under MacOS 10.3 in Nov/1/03 CVS version

[Stephen McCracken]

Here are some console messages, though I presume that this bug should be
easy to reproduce.  The first time I try C-r, cpu usage jumps to 100% for a
while, and then emacs crashes.

/Users/steve % 
/pkg/stow/emacs-21-cvs-2003-11-1/Emacs.app/Contents/MacOS/Emacs &
[1] 11058
/Users/steve % *** malloc[11058]: Deallocation of a pointer not malloced:
0x136d580; This could be a double free(), or free() called with the middle
of an allocated block; Try setting environment variable MallocHelp to see
tools to help debug
*** malloc[11058]: Deallocation of a pointer not malloced: 0x136d580; This
could be a double free(), or free() called with the middle of an allocated
block; Try setting environment variable MallocHelp to see tools to help
debug
*** malloc[11058]: error for object 0x136d4c0: Double free
*** malloc[11058]: Deallocation of a pointer not malloced: 0x13a0000; This
could be a double free(), or free() called with the middle of an allocated
block; Try setting environment variable MallocHelp to see tools to help
debug
*** malloc[11058]: Deallocation of a pointer not malloced: 0x136d580; This
could be a double free(), or free() called with the middle of an allocated
block; Try setting environment variable MallocHelp to see tools to help
debug
*** malloc[11058]: error for object 0x136d4c0: Double free
*** malloc[11058]: error for object 0x136d0f0: Incorrect checksum for freed
object - object was probably modified after being freed; break at
szone_error

[1]    Segmentation fault
/pkg/stow/emacs-21-cvs-2003-11-1/Emacs.app/Contents/MacOS/Emacs
/Users/steve % 
/pkg/stow/emacs-21-cvs-2003-11-1/Emacs.app/Contents/MacOS/Emacs --version
GNU Emacs 21.3.50.1
Copyright (C) 2002 Free Software Foundation, Inc.
GNU Emacs comes with ABSOLUTELY NO WARRANTY.
You may redistribute copies of Emacs
under the terms of the GNU General Public License.
For more information about these matters, see the file named COPYING.

Re: I-search backward broken under MacOS 10.3 in Nov/1/03 CVS version

[Stephen McCracken]

I apologize for my unhelpful earlier bug report.  I have tried harder to
reproduce this in a 2003-11-5 CVS version, and I didn't have much success.

However, while testing I-search Backward, I twice put emacs into a hung
state when I accidentally entered a recursive edit mode.  This may be what I
did earlier when I was got several segfaults, but I'm not sure.

Anyway, here is a stack trace from a hung emacs.  Sometimes when I interrupt
emacs, it is in ReleaseEvent, and sometimes it is in
dyld_stub_CompareAndSwap, but it is unable to finish the ReleaseEvent

Note: I built on MacOS 10.3 with this gcc, and these configure flags:
/Users/steve % gcc --version
gcc (GCC) 3.3 20030304 (Apple Computer, Inc. build 1495)
./configure --enable-carbon-app=/pkg/stow/emacs-21-cvs-2003-11-5
--with-carbon --without-x --prefix=/pkg/stow/emacs-21-cvs-2003-11-5


(gdb) finish
Run till exit from #0  0x927d24bc in ReleaseEvent ()
^Z
Program received signal SIGTSTP, Stopped (user).
0x92a6f128 in dyld_stub_CompareAndSwap ()
(gdb) where
#0  0x92a6f128 in dyld_stub_CompareAndSwap ()
#1  0x927d24bc in ReleaseEvent ()
#2  0x927ddcb8 in SendControlDefDraw(HIView*, short, OpaqueGrafPtr*,
OpaqueRgnHandle*, CGContext*) ()
#3  0x927dbac4 in HIView::DrawInternal(short, OpaqueGrafPtr*,
OpaqueRgnHandle*, unsigned char, unsigned char, unsigned char, HIView*,
CGContext*) ()
#4  0x927dcb68 in HIView::Draw(short, OpaqueGrafPtr*, OpaqueRgnHandle*,
unsigned long, HIView*, CGContext*) ()
#5  0x0012f9c8 in XTset_vertical_scroll_bar (w=0x153db10, portion=924,
whole=40649, position=6877) at macterm.c:4015
#6  0x0002cc88 in redisplay_window (window=-2125210864, just_this_one_p=1)
at xdisp.c:12007
#7  0x00029180 in redisplay_window_1 (window=0) at xdisp.c:10480
#8  0x000dd3a0 in internal_condition_case_1 (bfun=0x29144
<redisplay_window_1>, arg=-2125210864, handlers=-1604258768, hfun=0x290b4
<redisplay_window_error>) at eval.c:1374
#9  0x000287e0 in redisplay_internal (preserve_echo_area=0) at xdisp.c:10106
#10 0x00028b90 in redisplay_preserve_echo_area (from_where=0) at
xdisp.c:10265
#11 0x00115004 in wait_reading_process_input (time_limit=0, microsecs=0,
read_kbd=3452600, do_display=1) at process.c:4088
#12 0x00011158 in sit_for (sec=0, usec=1, reading=1, display=3452600,
initial_display=22272784) at dispnew.c:6251
#13 0x0007b31c in read_char (commandflag=1, nmaps=2, maps=0xbfffee00,
prev_event=595592196, used_mouse_menu=0xbfffef04) at keyboard.c:2720
#14 0x000833a0 in read_key_sequence (keybuf=0x34aeb8, bufsize=0,
prompt=-2125210864, dont_downcase_last=Cannot access memory at address 0x1d8
) at keyboard.c:8825
#15 0x00078b40 in command_loop_1 () at keyboard.c:1504
#16 0x000dd234 in internal_condition_case (bfun=0x78684 <command_loop_1>,
handlers=595637244, hfun=0x7804c <cmd_error>) at eval.c:1333
#17 0x00078474 in command_loop_2 () at keyboard.c:1292
#18 0x000dcc9c in internal_catch (tag=0, func=0x78434 <command_loop_2>,
arg=595592196) at eval.c:1094
#19 0x000783cc in command_loop () at keyboard.c:1271
#20 0x00077de8 in recursive_edit_1 () at keyboard.c:987
#21 0x00077f70 in Frecursive_edit () at keyboard.c:1043
#22 0x00076a74 in main (argc=3440300, argv=0xbffffc88) at emacs.c:1666
(gdb) 


--------------------------------------------
Here is another stack trace from an earlier attempt.  Sorry, but I didn't do
as much poking around in this one, but the problem seems related
(macterm.c:4015).


/Users/steve % gdb 
/pkg/stow/emacs-21-cvs-2003-11-5/Emacs.app/Contents/MacOS/Emacs 22146
GNU gdb 5.3-20030128 (Apple version gdb-292) (Sat Sep 20 03:22:27 GMT 2003)
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "powerpc-apple-darwin".
Reading symbols for shared libraries .... done
/Users/steve/22146: No such file or directory.
Attaching to program:
`/pkg/stow/emacs-21-cvs-2003-11-5/Emacs.app/Contents/MacOS/Emacs', process
22146.
Reading symbols for shared libraries
.................................................. done
0x900075c8 in mach_msg_trap ()
(gdb) where
#0  0x900075c8 in mach_msg_trap ()
#1  0x90007118 in mach_msg ()
#2  0x936097a0 in _CGSSynchronizeWindowBackingStore ()
#3  0x935dcdc0 in _CGSSynchronizeWindow ()
#4  0x935d8854 in _CGSLockWindow ()
#5  0x935df7cc in CGSDeviceLock ()
#6  0x91b86838 in ripd_Lock ()
#7  0x91b8512c in ripl_BltShape ()
#8  0x91b845e0 in ripc_Render ()
#9  0x91b87a0c in ripc_DrawRects ()
#10 0x935f03f4 in __CGContextDrawRects ()
#11 0x936030a8 in CGContextFillRects ()
#12 0x93607994 in CGContextFillRect ()
#13 0x927d98bc in TilePixMapListCG ()
#14 0x927db6dc in DrawPartCG(TTheme*, CGRect const&, CGRect const&,
ThemePart*, ThemeStateData*, ThemeStateData*, float, CGContext*) ()
#15 0x927db31c in DrawLayoutCG(TTheme*, LayoutCache*, long, CGRect const&,
unsigned short, unsigned long, CGRect const&, unsigned long const*, unsigned
long const*, float, CGContext*) ()
#16 0x927e6d34 in LayoutEngine::DrawLayoutWithClipComposited(TTheme*, long,
CGRect const&, unsigned short, long const*, unsigned long, short, unsigned
long const*, unsigned long const*, float, CGContext*, short) ()
#17 0x927faf90 in LayoutEngine::DrawLayoutWithClip(TTheme*, long, CGRect
const&, unsigned short, long const*, unsigned long, short, unsigned long
const*, CGContext*, short) ()
#18 0x927faf44 in LayoutEngine::DrawLayout(TTheme*, long, CGRect const&,
unsigned short, long const*, unsigned long, unsigned long const*,
CGContext*, short) ()
#19 0x927eb534 in DataEngine::DrawThemeTrack(HIThemeTrackDrawInfo const*,
CGRect const*, ThemeEraseXUPP*, unsigned long, CGContext*) ()
#20 0x92808a08 in _HIThemeDrawTrack(HIThemeTrackDrawInfo const*, CGRect
const*, ThemeEraseXUPP*, unsigned long, CGContext*, unsigned long) ()
#21 0x9280f57c in HIScrollBar::DrawSelf(short, OpaqueRgnHandle*, CGContext*)
()
#22 0x927f5acc in HIView::DrawCacheOrSelf(short, OpaqueRgnHandle*,
CGContext*) ()
#23 0x927d5444 in HIView::EventHandler(OpaqueEventHandlerCallRef*,
OpaqueEventRef*, void*) ()
#24 0x927d1f94 in DispatchEventToHandlers ()
#25 0x927d2208 in SendEventToEventTargetInternal ()
#26 0x927d6600 in SendEventToEventTargetWithOptions ()
#27 0x927ddcac in SendControlDefDraw(HIView*, short, OpaqueGrafPtr*,
OpaqueRgnHandle*, CGContext*) ()
#28 0x927dbac4 in HIView::DrawInternal(short, OpaqueGrafPtr*,
OpaqueRgnHandle*, unsigned char, unsigned char, unsigned char, HIView*,
CGContext*) ()
#29 0x927dcb68 in HIView::Draw(short, OpaqueGrafPtr*, OpaqueRgnHandle*,
unsigned long, HIView*, CGContext*) ()
#30 0x0012f9c8 in XTset_vertical_scroll_bar (w=0x133ddb0, portion=1265,
whole=244286, position=49885) at macterm.c:4015
#31 0x0002cc88 in redisplay_window (window=-2127307344, just_this_one_p=1)
at xdisp.c:12007
#32 0x00029180 in redisplay_window_1 (window=0) at xdisp.c:10480
#33 0x000dd3a0 in internal_condition_case_1 (bfun=0x29144
<redisplay_window_1>, arg=-2127307344, handlers=-1604258768, hfun=0x290b4
<redisplay_window_error>) at eval.c:1374
#34 0x000287e0 in redisplay_internal (preserve_echo_area=0) at xdisp.c:10106
#35 0x00028b90 in redisplay_preserve_echo_area (from_where=0) at
xdisp.c:10265
#36 0x00115004 in wait_reading_process_input (time_limit=0, microsecs=0,
read_kbd=3452600, do_display=1) at process.c:4088
#37 0x00011158 in sit_for (sec=0, usec=1, reading=1, display=3452600,
initial_display=20176304) at dispnew.c:6251
#38 0x0007b31c in read_char (commandflag=1, nmaps=2, maps=0xbffff000,
prev_event=595592196, used_mouse_menu=0xbffff104) at keyboard.c:2720
#39 0x000833a0 in read_key_sequence (keybuf=0x34aeb8, bufsize=0,
prompt=-2127307344, dont_downcase_last=Cannot access memory at address 0x1de
) at keyboard.c:8825
#40 0x00078b40 in command_loop_1 () at keyboard.c:1504
#41 0x000dd234 in internal_condition_case (bfun=0x78684 <command_loop_1>,
handlers=595637244, hfun=0x7804c <cmd_error>) at eval.c:1333
#42 0x00078474 in command_loop_2 () at keyboard.c:1292
#43 0x000dcc9c in internal_catch (tag=0, func=0x78434 <command_loop_2>,
arg=595592196) at eval.c:1094
#44 0x000783cc in command_loop () at keyboard.c:1271
#45 0x00077de8 in recursive_edit_1 () at keyboard.c:987
#46 0x00077f70 in Frecursive_edit () at keyboard.c:1043
#47 0x00076a74 in main (argc=3440300, argv=0xbffffea4) at emacs.c:1666
(gdb)