bug#62507: 28.2; Crash when editing TODO line with malformed tag

bug#62507: 28.2; Crash when editing TODO line with malformed tag

[Patrick Brennan via Bug reports for GNU Emacs, the Swiss army knife of text editors]

[-- Attachment #1: Type: text/plain, Size: 15583 bytes --]

From: Patrick Brennan <patrickbrennan@google.com>
To: bug-gnu-emacs@gnu.org
Subject: 28.2; Crash when editing TODO line with malformed tag
Date: Tue, 28 Mar 2023 10:53:17 -0700
Message-ID: <cgwxa5zwvk36.fsf@google.com>
--text follows this line--

1. Create or open a .org file with a top-level TODO item, e.g.:

* TODO Do something special

2. Add a malformed tag by typing, so the line looks like this:

* TODO Do something special :to-do:zoom:

You will notice that Emacs/Org-mode doesn't highlight the tags. Also
note that the tag "to-do" is malformed; tags aren't allowed to contain
dashes.

3. Add a good tag by using C-c C-q, type "todo" and hit enter. Your line
should now look like this:

* TODO Do something  :to-do:zoom:
 :todo:

4. Now put your cursor on the first colon on the line (col 21) and hit
C-d repeatedly to delete the "tags" you placed earlier.

5. Crash!


In GNU Emacs 28.2 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.24.35,
cairo version 1.16.0)
 of 2023-03-19, modified by Debian built on kokoro-ubuntu
Windowing system distributor 'The X.Org Foundation', version 11.0.12101005
System Description: Debian GNU/Linux rodete

Configured using:
 'configure --build x86_64-linux-gnu --prefix=/usr
 --sharedstatedir=/var/lib --libexecdir=/usr/libexec
 --localstatedir=/var/lib --infodir=/usr/share/info
 --mandir=/usr/share/man --with-libsystemd --with-pop=yes
 --enable-locallisppath=/etc/google-emacs:/usr/local/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/site-lisp:/usr/local/share/google-emacs/site-lisp:/usr/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/site-lisp:/usr/share/google-emacs/site-lisp
 --with-sound=alsa --without-gconf --with-mailutils
 --with-native-compilation --program-prefix=google-
 --disable-silent-rules GOOGLE_VERSION=28.2+gg10+1.20230320.053433.rc252
 --build x86_64-linux-gnu --prefix=/usr --sharedstatedir=/var/lib
 --libexecdir=/usr/libexec --localstatedir=/var/lib
 --infodir=/usr/share/info --mandir=/usr/share/man --with-libsystemd
 --with-pop=yes
 --enable-locallisppath=/etc/google-emacs:/usr/local/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/site-lisp:/usr/local/share/google-emacs/site-lisp:/usr/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/site-lisp:/usr/share/google-emacs/site-lisp
 --with-sound=alsa --without-gconf --with-mailutils
 --with-native-compilation --program-prefix=google-
 --disable-silent-rules GOOGLE_VERSION=28.2+gg10+1.20230320.053433.rc252
 --with-cairo --with-x=yes --with-x-toolkit=gtk3
 --with-toolkit-scroll-bars 'CFLAGS=-g -O2
 -ffile-prefix-map=/build/google-emacs-81DL9e/google-emacs-28.2+gg10+1.20230320.053433.rc252=.
-fstack-protector-strong
 -Wformat -Werror=format-security -Wall' 'CPPFLAGS=-Wdate-time
 -D_FORTIFY_SOURCE=2' LDFLAGS=-Wl,-z,relro'

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM GSETTINGS HARFBUZZ JPEG
JSON LCMS2 LIBOTF LIBSELINUX LIBSYSTEMD LIBXML2 M17N_FLT MODULES
NATIVE_COMP NOTIFY INOTIFY PDUMPER PNG RSVG SECCOMP SOUND THREADS TIFF
TOOLKIT_SCROLL_BARS X11 XDBE XIM XPM GTK3 ZLIB

Important settings:
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Major mode: Org

Minor modes in effect:
  display-time-mode: t
  display-battery-mode: t
  global-auto-revert-mode: t
  google-emacs-support-show-upgrade-mode: t
  editorconfig-mode: t
  google3-build-global-integrate-build-manipulation-mode: t
  google3-build-integrate-build-manipulation-mode: t
  google-kg-mode: t
  shell-dirtrack-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  size-indication-mode: t
  column-number-mode: t
  line-number-mode: t
  auto-fill-function: org-auto-fill-function
  transient-mark-mode: t

Load-path shadows:
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/f/f-shortdoc
hides
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/f/google/f-shortdoc
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/async/dired-async
hides /usr/share/google-emacs/site-lisp/elpa/async-1.9.7/dired-async
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/async/smtpmail-async
hides /usr/share/google-emacs/site-lisp/elpa/async-1.9.7/smtpmail-async
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/async/async
hides /usr/share/google-emacs/site-lisp/elpa/async-1.9.7/async
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/async/async-bytecomp
hides /usr/share/google-emacs/site-lisp/elpa/async-1.9.7/async-bytecomp
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-css
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-css
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-bbdb
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-bbdb
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-abbrev
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-abbrev
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-ispell
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-ispell
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-oddmuse
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-oddmuse
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-cmake
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-cmake
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-tempo
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-tempo
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-nxml
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-nxml
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-tng
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-tng
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-keywords
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-keywords
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-dabbrev
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-dabbrev
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-template
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-template
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-capf
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-capf
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-dabbrev-code
hides
/usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-dabbrev-code
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-clang
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-clang
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-yasnippet
hides
/usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-yasnippet
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-semantic
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-semantic
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-gtags
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-gtags
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-files
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-files
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-elisp
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-elisp
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/company_mode/company-etags
hides /usr/share/google-emacs/site-lisp/elpa/company-0.9.13/company-etags
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/dash/dash
hides /usr/share/google-emacs/site-lisp/elpa/dash-2.19.1/dash
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/epl/epl
hides /usr/share/google-emacs/site-lisp/elpa/epl-0.9/epl
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/f/f
hides /usr/share/google-emacs/site-lisp/elpa/f-0.20.0/f
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/ht/ht
hides /usr/share/google-emacs/site-lisp/elpa/ht-2.3/ht
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/lv/lv
hides /usr/share/google-emacs/site-lisp/elpa/lv-0.15.0/lv
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/markdown_mode/markdown-mode
hides /usr/share/google-emacs/site-lisp/elpa/markdown-mode-2.5/markdown-mode
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/memoize/memoize
hides /usr/share/google-emacs/site-lisp/elpa/memoize-1.1/memoize
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/pkg_info/pkg-info
hides /usr/share/google-emacs/site-lisp/elpa/pkg-info-0.6/pkg-info
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/popup/popup
hides /usr/share/google-emacs/site-lisp/elpa/popup-0.5.8/popup
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/s/s
hides /usr/share/google-emacs/site-lisp/elpa/s-1.12.0/s
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/spinner/spinner
hides /usr/share/google-emacs/site-lisp/elpa/spinner-1.7.4/spinner
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/yasnippet/yasnippet
hides /usr/share/google-emacs/site-lisp/elpa/yasnippet-0.14.0/yasnippet
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/jsonrpc/jsonrpc
hides /usr/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/lisp/jsonrpc
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/transient/lisp/transient
hides
/usr/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/lisp/transient
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/project/project
hides
/usr/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/lisp/progmodes/project
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/flymake/flymake
hides
/usr/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/lisp/progmodes/flymake
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/xref/xref
hides
/usr/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/lisp/progmodes/xref
/usr/share/google-emacs/site-lisp/emacs-google-config/third_party/elisp/eldoc/eldoc
hides
/usr/share/google-emacs/28.2+gg10+1.20230320.053433.rc252/lisp/emacs-lisp/eldoc

Features:
(shadow sort mail-extr emacsbug sendmail markdown-mode edit-indirect
color org-duration diary-lib diary-loaddefs cal-iso vc-fig vc-hg
diff-mode vc vc-dispatcher org-element avl-tree ol-eww eww url-queue
mm-url ol-rmail ol-mhe ol-irc ol-info ol-gnus nnselect gnus-search
eieio-opt speedbar ezimage dframe gnus-art mm-uu mml2015 mm-view
mml-smime smime dig gnus-sum shr kinsoku svg dom gnus-group gnus-undo
gnus-start gnus-dbus gnus-cloud nnimap nnmail mail-source utf7 netrc
nnoo gnus-spec gnus-int gnus-range message rmc puny rfc822 mml mml-sec
epa derived epg rfc6068 epg-config mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader gnus-win gnus
nnheader gnus-util rmail rmail-loaddefs rfc2047 rfc2045 ietf-drums
mail-utils mm-util mail-prsvr ol-docview doc-view jka-compr image-mode
exif dired dired-loaddefs ol-bibtex ol-bbdb ol-w3m ol-doi org-link-doi
editorconfig-core editorconfig-core-handle editorconfig-fnmatch
face-remap org-agenda org-refile org ob ob-tangle ob-ref ob-lob ob-table
ob-exp org-macro org-footnote org-src ob-comint org-pcomplete org-list
org-faces org-entities noutline outline org-version ob-emacs-lisp
ob-core ob-eval org-table oc-basic bibtex org-keys oc org-loaddefs
find-func cal-menu calendar cal-loaddefs ol org-compat org-macs edmacro
kmacro time battery dbus ido-completing-read+ memoize cus-edit pp
wid-edit minibuf-eldef ido xml cus-load finder-inf autorevert filenotify
google google-emacs-support editorconfig google-log gud easy-mmode
url-sso google3-build-fn google-imports google3 compile google-gud
google-comint google-kg google-trailing-whitespace google-coding-style
python-custom sh-script smie executable python tramp-sh tramp
tramp-loaddefs trampver tramp-integration files-x tramp-compat
parse-time iso8601 time-date ls-lisp format-spec js imenu cc-mode
cc-fonts cc-guess cc-menus cc-cmds cc-styles cc-align cc-engine cc-vars
cc-defs google-codemaker google-process google-emacs-utilities advice
with-editor shell pcomplete server compat compat-29 f f-shortdoc
shortdoc text-property-search dash s aio generator
emacs-google-config-loaddefs pcase google-paths xdg google-platform sql
view thingatpt comint ansi-color ring comp comp-cstr warnings rx
cl-extra help-mode package browse-url url url-proxy url-privacy
url-expand url-methods url-history url-cookie url-domsuf url-util
mailcap url-handlers url-parse auth-source cl-seq eieio eieio-core
cl-macs eieio-loaddefs password-cache json subr-x map url-vars seq
byte-opt gv bytecomp byte-compile cconv cl-loaddefs cl-lib iso-transl
tooltip eldoc paren electric uniquify ediff-hook vc-hooks
lisp-float-type elisp-mode mwheel term/x-win x-win term/common-win x-dnd
tool-bar dnd fontset image regexp-opt fringe tabulated-list replace
newcomment text-mode lisp-mode prog-mode register page tab-bar menu-bar
rfn-eshadow isearch easymenu timer select scroll-bar mouse jit-lock
font-lock syntax font-core term/tty-colors frame minibuffer cl-generic
cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese composite emoji-zwj charscript
charprop case-table epa-hook jka-cmpr-hook help simple abbrev obarray
cl-preloaded nadvice button loaddefs faces cus-face macroexp files
window text-properties overlay sha1 md5 base64 format env code-pages
mule custom widget hashtable-print-readable backquote threads dbusbind
inotify lcms2 dynamic-setting system-font-setting font-render-setting
cairo move-toolbar gtk x-toolkit x multi-tty make-network-process
native-compile emacs)

Memory information:
((conses 16 459641 33881)
 (symbols 48 32879 1)
 (strings 32 122158 9499)
 (string-bytes 1 4752198)
 (vectors 16 65089)
 (vector-slots 8 1740541 240563)
 (floats 8 540 210)
 (intervals 56 2134 0)
 (buffers 992 15))

[-- Attachment #2: Type: text/html, Size: 16346 bytes --]

bug#62507: 28.2; Crash when editing TODO line with malformed tag

[Eli Zaretskii]

> Date: Tue, 28 Mar 2023 10:54:53 -0700
> From:  Patrick Brennan via "Bug reports for GNU Emacs,
>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
> 
> 1. Create or open a .org file with a top-level TODO item, e.g.:
> 
> * TODO Do something special
> 
> 2. Add a malformed tag by typing, so the line looks like this:
> 
> * TODO Do something special :to-do:zoom:
> 
> You will notice that Emacs/Org-mode doesn't highlight the tags. Also
> note that the tag "to-do" is malformed; tags aren't allowed to contain
> dashes.
> 
> 3. Add a good tag by using C-c C-q, type "todo" and hit enter. Your line
> should now look like this:
> 
> * TODO Do something  :to-do:zoom:                                      :todo:
> 
> 4. Now put your cursor on the first colon on the line (col 21) and hit
> C-d repeatedly to delete the "tags" you placed earlier.
> 
> 5. Crash!

I cannot reproduce the crash, neither in Emacs 28.2 nor in what will
soon be Emacs 29.1.  Does this happen if you start with "emacs -Q" and
then follow the recipe you posted?

In any case, if you can run this under GDB and show backtrace after
the crash, it might help (assuming your Emacs was built with debug
symbols and not stripped).

Thanks.

bug#62507: 28.2; Crash when editing TODO line with malformed tag

[Gregory Heytings]

>
> I cannot reproduce the crash, neither in Emacs 28.2 nor in what will 
> soon be Emacs 29.1.  Does this happen if you start with "emacs -Q" and 
> then follow the recipe you posted?
>

I cannot reproduce that crash either, I tried Debian's Emacs 28.2, and 
Emacs 28 and 29.  By any chance, does Google Emacs include local patches?

bug#62507: 28.2; Crash when editing TODO line with malformed tag

[Patrick Brennan via Bug reports for GNU Emacs, the Swiss army knife of text editors]

[-- Attachment #1: Type: text/plain, Size: 746 bytes --]

I can't reproduce the bug using that same recipe either. So now I think I
may have made a mistake in exactly how the recipe is to be followed.
However, I am fairly sure that there is some way to make emax crash using
malformed tags using approximately the same procedure. As far as I know,
emax at Google is stock.

On Wed, Mar 29, 2023, 5:28 AM Gregory Heytings <gregory@heytings.org> wrote:

>
> >
> > I cannot reproduce the crash, neither in Emacs 28.2 nor in what will
> > soon be Emacs 29.1.  Does this happen if you start with "emacs -Q" and
> > then follow the recipe you posted?
> >
>
> I cannot reproduce that crash either, I tried Debian's Emacs 28.2, and
> Emacs 28 and 29.  By any chance, does Google Emacs include local patches?
>
>

[-- Attachment #2: Type: text/html, Size: 1077 bytes --]

bug#62507: 28.2; Crash when editing TODO line with malformed tag

[Patrick Brennan via Bug reports for GNU Emacs, the Swiss army knife of text editors]

[-- Attachment #1: Type: text/plain, Size: 962 bytes --]

Well that's what I get for voice to text. Obviously, I meant to say Emacs.
😁

On Wed, Mar 29, 2023, 9:11 AM Patrick Brennan <patrickbrennan@google.com>
wrote:

> I can't reproduce the bug using that same recipe either. So now I think I
> may have made a mistake in exactly how the recipe is to be followed.
> However, I am fairly sure that there is some way to make emax crash using
> malformed tags using approximately the same procedure. As far as I know,
> emax at Google is stock.
>
> On Wed, Mar 29, 2023, 5:28 AM Gregory Heytings <gregory@heytings.org>
> wrote:
>
>>
>> >
>> > I cannot reproduce the crash, neither in Emacs 28.2 nor in what will
>> > soon be Emacs 29.1.  Does this happen if you start with "emacs -Q" and
>> > then follow the recipe you posted?
>> >
>>
>> I cannot reproduce that crash either, I tried Debian's Emacs 28.2, and
>> Emacs 28 and 29.  By any chance, does Google Emacs include local patches?
>>
>>

[-- Attachment #2: Type: text/html, Size: 1544 bytes --]

bug#62507: 28.2; Crash when editing TODO line with malformed tag

[Gregory Heytings]

>
> I can't reproduce the bug using that same recipe either. So now I think 
> I may have made a mistake in exactly how the recipe is to be followed. 
> However, I am fairly sure that there is some way to make emax crash 
> using malformed tags using approximately the same procedure. As far as I 
> know, emax at Google is stock.
>

Thanks.  Can we close this bug?  If you find a better recipe, you can 
always file another bug report.

bug#62507: 28.2; Crash when editing TODO line with malformed tag

[Patrick Brennan via Bug reports for GNU Emacs, the Swiss army knife of text editors]

[-- Attachment #1: Type: text/plain, Size: 570 bytes --]

Sure thing.

On Thu, Mar 30, 2023 at 8:21 AM Gregory Heytings <gregory@heytings.org>
wrote:

>
> >
> > I can't reproduce the bug using that same recipe either. So now I think
> > I may have made a mistake in exactly how the recipe is to be followed.
> > However, I am fairly sure that there is some way to make emax crash
> > using malformed tags using approximately the same procedure. As far as I
> > know, emax at Google is stock.
> >
>
> Thanks.  Can we close this bug?  If you find a better recipe, you can
> always file another bug report.
>
>

[-- Attachment #2: Type: text/html, Size: 907 bytes --]

bug#62507: 28.2; Crash when editing TODO line with malformed tag

[Gregory Heytings]

[-- Attachment #1: Type: text/plain, Size: 61 bytes --]


>
> Sure thing. 
>

Okay, thanks.  Closing this bug.