From mboxrd@z Thu Jan 1 00:00:00 1970
Path: news.gmane.org!.POSTED!not-for-mail
From: Phil
Newsgroups: gmane.emacs.bugs
Subject: bug#24206: 25.1;
Curly quotes generate invalid strings, leading to a segfault
Date: Thu, 11 Aug 2016 11:55:05 -0700
Message-ID:
NNTP-Posting-Host: blaine.gmane.org
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-Trace: blaine.gmane.org 1470941867 24824 195.159.176.226 (11 Aug 2016 18:57:47 GMT)
X-Complaints-To: usenet@blaine.gmane.org
NNTP-Posting-Date: Thu, 11 Aug 2016 18:57:47 +0000 (UTC)
To: 24206@debbugs.gnu.org
Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Thu Aug 11 20:57:38 2016
Return-path:
Envelope-to: geb-bug-gnu-emacs@m.gmane.org
Original-Received: from lists.gnu.org ([208.118.235.17])
by blaine.gmane.org with esmtp (Exim 4.84_2)
(envelope-from )
id 1bXvAe-00069j-6R
for geb-bug-gnu-emacs@m.gmane.org; Thu, 11 Aug 2016 20:57:36 +0200
Original-Received: from localhost ([::1]:50179 helo=lists.gnu.org)
by lists.gnu.org with esmtp (Exim 4.71)
(envelope-from )
id 1bXvAb-0001FW-7E
for geb-bug-gnu-emacs@m.gmane.org; Thu, 11 Aug 2016 14:57:33 -0400
Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:48399)
by lists.gnu.org with esmtp (Exim 4.71)
(envelope-from ) id 1bXvAJ-0001FH-88
for bug-gnu-emacs@gnu.org; Thu, 11 Aug 2016 14:57:26 -0400
Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
(envelope-from ) id 1bXvA6-00059i-U2
for bug-gnu-emacs@gnu.org; Thu, 11 Aug 2016 14:57:14 -0400
Original-Received: from debbugs.gnu.org ([208.118.235.43]:56635)
by eggs.gnu.org with esmtp (Exim 4.71)
(envelope-from ) id 1bXvA6-00059Y-LI
for bug-gnu-emacs@gnu.org; Thu, 11 Aug 2016 14:57:02 -0400
Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2)
(envelope-from ) id 1bXvA6-0001gZ-E4
for bug-gnu-emacs@gnu.org; Thu, 11 Aug 2016 14:57:02 -0400
X-Loop: help-debbugs@gnu.org
Resent-From: Phil
Original-Sender: "Debbugs-submit"
Resent-CC: bug-gnu-emacs@gnu.org
Resent-Date: Thu, 11 Aug 2016 18:57:02 +0000
Resent-Message-ID:
Resent-Sender: help-debbugs@gnu.org
X-GNU-PR-Message: report 24206
X-GNU-PR-Package: emacs
X-GNU-PR-Keywords:
X-Debbugs-Original-To: bug-gnu-emacs@gnu.org
Original-Received: via spool by submit@debbugs.gnu.org id=B.14709417886432
(code B ref -1); Thu, 11 Aug 2016 18:57:02 +0000
Original-Received: (at submit) by debbugs.gnu.org; 11 Aug 2016 18:56:28 +0000
Original-Received: from localhost ([127.0.0.1]:54348 helo=debbugs.gnu.org)
by debbugs.gnu.org with esmtp (Exim 4.84_2)
(envelope-from )
id 1bXv9Y-0001fg-Gf
for submit@debbugs.gnu.org; Thu, 11 Aug 2016 14:56:28 -0400
Original-Received: from eggs.gnu.org ([208.118.235.92]:57088)
by debbugs.gnu.org with esmtp (Exim 4.84_2)
(envelope-from ) id 1bXv9X-0001fU-7S
for submit@debbugs.gnu.org; Thu, 11 Aug 2016 14:56:27 -0400
Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
(envelope-from ) id 1bXv9H-0004wP-52
for submit@debbugs.gnu.org; Thu, 11 Aug 2016 14:56:21 -0400
Original-Received: from lists.gnu.org ([2001:4830:134:3::11]:57295)
by eggs.gnu.org with esmtp (Exim 4.71)
(envelope-from ) id 1bXv9H-0004wH-02
for submit@debbugs.gnu.org; Thu, 11 Aug 2016 14:56:11 -0400
Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:47982)
by lists.gnu.org with esmtp (Exim 4.71)
(envelope-from ) id 1bXv95-00016k-LH
for bug-gnu-emacs@gnu.org; Thu, 11 Aug 2016 14:56:10 -0400
Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
(envelope-from ) id 1bXv8t-0004mi-PR
for bug-gnu-emacs@gnu.org; Thu, 11 Aug 2016 14:55:58 -0400
Original-Received: from mail-pf0-x22d.google.com ([2607:f8b0:400e:c00::22d]:34935)
by eggs.gnu.org with esmtp (Exim 4.71)
(envelope-from ) id 1bXv8s-0004lu-TX
for bug-gnu-emacs@gnu.org; Thu, 11 Aug 2016 14:55:47 -0400
Original-Received: by mail-pf0-x22d.google.com with SMTP id x72so1215650pfd.2
for ; Thu, 11 Aug 2016 11:55:46 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
h=from:to:subject:date:message-id:mime-version
:content-transfer-encoding;
bh=L8Scq8TfNM+0RV0T+rNIXB8zDHISQy+4kim5dKq4ymo=;
b=MNcqxhrh05GWfCmCPllGH1GltouTIyU2Vvw2liPYVhquCi+FzfRPFtdVccc8uooawm
xnzGX+ziG+ktSn9oSLIg/Q4lwh9HAIYGgEkKbl6O+1UWcwwbY3Vj91AutpkGmvl5a5rS
hqExLxnUWjK3qV2MBdKw8lJMAF7J2X0XNTGMut/acLfL9Fwf69mTQhwNgiOBuehHMZBB
DGxmkbW5p1d1aEsncrEcZY6e4ug0w8Sfn5/nNw9BnZim/mqUggXfYgWAMRMC1oR/rNT2
bxVspY0NIKT5GmyufxdK/kWJONOQ4LEH/O4kUy6GCF0e9jNgxt4UIMB5uvjmVtsFFrO3
tWsA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:from:to:subject:date:message-id:mime-version
:content-transfer-encoding;
bh=L8Scq8TfNM+0RV0T+rNIXB8zDHISQy+4kim5dKq4ymo=;
b=KGUcr16TqRVy5HUwqi8gbC9xBCMwgff7uckB/gIxGp/ED4Aan0OxrIC/iTHbXDfO1l
1HtJZSThyvYdVs7UXNbqMWd60JjFPtkg2JpgrhbrUK162wsMhzWy1I1OaQC8E/WJrzwT
VGcpjrzQSSk5Sux3v+wU9SIzsXmIzTzFvuo/cb5sTrnla/nMfY66YPAsFjvvuoZu1vC0
oeyQkhHZ7mjFkZHDdVwPbb+wPJKzCgCV/vXr5xCxfrWFsAEYq//e1Au5AcPyMp8w4QZX
Hnc/YByX5PbO3ZLwDd0JgU0WAEv6hg3ZWCMu+GGCQgL2aljYeyE99tRux6KXHw+IgRO9
HC4Q==
X-Gm-Message-State: AEkoouvUqlJZIflu/zHgbXGMkhNeYCJJ07jrwiEvVQSx+WbD5McX1PDXinZmZ/IUYEeWbQ==
X-Received: by 10.98.24.194 with SMTP id 185mr19950358pfy.52.1470941744783;
Thu, 11 Aug 2016 11:55:44 -0700 (PDT)
Original-Received: from phst-glaptop2 ([2620:0:100e:300:9896:7bc2:49e:9dae])
by smtp.gmail.com with ESMTPSA id
g21sm7056682pfj.88.2016.08.11.11.55.42 for
(version=TLS1_2 cipher=AES128-SHA bits=128/128);
Thu, 11 Aug 2016 11:55:43 -0700 (PDT)
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 208.118.235.43
X-BeenThere: bug-gnu-emacs@gnu.org
List-Id: "Bug reports for GNU Emacs,
the Swiss army knife of text editors"
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org
Original-Sender: "bug-gnu-emacs"
Xref: news.gmane.org gmane.emacs.bugs:122099
Archived-At:
Build is from the emacs-25 branch.
$ ./emacs -Q -eval "(progn (defface test nil \"\`\\240'\") (customize-face =
'test))"
character.h:703: Emacs fatal error: assertion failed: CHAR_VALID_P (ch)
Fatal error 6: Aborted
I think this is serious enough to be release-blocking. Seen in the wild
with older versions of show-wspace.el.
(gdb) bt full
#0 terminate_due_to_signal (sig=3D6, backtrace_limit=3D2147483647) at emac=
s.c:354
No locals.
#1 0x00000000006122e6 in die (msg=3D0x732ed0 "CHAR_VALID_P (ch)", file=3D0=
x732ec4 "character.h", line=3D703) at alloc.c:7223
No locals.
#2 0x000000000057c60d in char_table_translate (obj=3D..., ch=3D4195776) at=
character.h:703
No locals.
#3 0x00000000005fe182 in re_search_2 (bufp=3D0xd76160 , s=
tr1=3D0x0, size1=3D0, str2=3D0x1ae6898 "=E2=80=98\240=E2=80=99", size2=3D7,=
startpos=3D0, range=3D1, regs=3D0xd766f0 , stop=3D7) at regex=
.c:4370
buf_charlen =3D 2
irange =3D 7
lim =3D 0
d =3D 0x1ae689e "\231"
buf_ch =3D 4195776
val =3D 14115136
string1 =3D 0x0
string2 =3D 0x1ae6898 "=E2=80=98\240=E2=80=99"
fastmap =3D 0xd761a0 ""
translate =3D {
i =3D 21377445
}
total_size =3D 7
endpos =3D 7
anchored_start =3D 0 '\000'
multibyte =3D 1 '\001'
#4 0x00000000005fdcef in re_search (bufp=3D0xd76160 , str=
ing=3D0x1ae6898 "=E2=80=98\240=E2=80=99", size=3D7, startpos=3D0, range=3D7=
, regs=3D0xd766f0 ) at regex.c:4228
No locals.
#5 0x00000000005ea018 in string_match_1 (regexp=3D..., string=3D..., start=
=3D..., posix=3Dfalse) at search.c:404
val =3D 5747501
bufp =3D 0xd76160
pos =3D 0
pos_byte =3D 0
i =3D 42963155872
#6 0x00000000005ea18d in Fstring_match (regexp=3D..., string=3D..., start=
=3D...) at search.c:444
No locals.
#7 0x0000000000637da1 in Ffuncall (nargs=3D3, args=3D0x7fffffff5df0) at ev=
al.c:2700
internal_argbuf =3D {{
i =3D 19272884
}, {
i =3D 19244804
}, {
i =3D 0
}, {
i =3D 0
}, {
i =3D 0
}, {
i =3D 6836305
}, {
i =3D 20056252
}, {
i =3D 326
}}
fun =3D {
i =3D 10117229
}
original_fun =3D {
i =3D 655680
}
funcar =3D {
i =3D 11020413
}
numargs =3D 2
lisp_numargs =3D {
i =3D 19272884
}
val =3D {
i =3D 43248
}
internal_args =3D 0x7fffffff5d60
count =3D 36
#8 0x0000000000685ea8 in exec_byte_code (bytestr=3D..., vector=3D..., maxd=
epth=3D..., args_template=3D..., nargs=3D1, args=3D0x7fffffff66e0) at bytec=
ode.c:880
targets =3D {0x68989f , 0x68990c , 0x68990e , 0x689910 , 0x689912 , 0x689912 , 0x6899=
78 , 0x6899e8 , 0x685480 , 0x685482 , 0x685484 , 0x685486 , 0x685488 , 0x685=
488 , 0x685491 , 0x68544b , 0x685a8d , 0x685a8f , 0x685a91 , 0x685a93 , 0x685a=
95 , 0x685a95 , 0x685ad3 , 0x685a9e , 0x685da3 , 0x685da5 , 0x685da7 , 0x685da=
9 , 0x685dab , 0x685dab , 0x685d54 , 0x685d6e , 0x685e66 , 0x685e68 , 0x685e6a=
, 0x685e6c , 0x685e6e , 0x685e6e , 0x685e17 =
, 0x685e31 , 0x685f31 , 0x685f33 =
, 0x685f35 , 0x685f37 , 0x685f39 , 0x685f39 ,=
0x685ee2 , 0x685efc , 0x686eee <=
exec_byte_code+8041>, 0x686da0 , 0x686d94 , 0x68989f , 0x68989f =
, 0x68989f , 0x68989f , 0x68989=
f , 0x687135 , 0x687260 , 0x6872ce , 0x68733d , 0x6873ad , 0x6858a8 , 0x68593=
7 , 0x687435 , 0x6857c2 , 0x6859a6 , 0x6874ab , 0x68751a , 0x687563 , 0x6875d2=
, 0x687628 , 0x68770a , 0x687753 , 0x6877c2 , 0x687854 , 0x68789d , 0x68=
78e6 , 0x687955 , 0x6879c4 , 0x687a33 , 0x687ac5 , 0x687b1b , 0x687b71 =
, 0x687c53 , 0x687ced , 0x687d8=
7 , 0x688027 , 0x68809b , 0x68810f , 0x688183 , 0x6881f7 , 0x68824d , 0=
x6882eb , 0x688341 , 0x688397 <=
exec_byte_code+13330>, 0x6883ed , 0x688508 , 0x686c2b , 0x68856b , 0x6885b4 , 0x68868e , 0x688=
6f1 , 0x688754 , 0x68879d , 0x6887ef , 0x688841 , 0x68889b , 0x68989f ,=
0x6888f4 , 0x68893b , 0x688982=
, 0x6889c9 , 0x688a10 , 0x688a57 , 0x686c2b , 0x68989f , 0x688aa0 , 0x6=
88af4 , 0x688b3d , 0x688b86 , 0x688bf5 , 0x688c64 , 0x688cad , 0x688ddd , 0x688e4c , 0x688ebb , 0x688f=
2a , 0x688f71 , 0x68989f , 0x686b5f , 0x685fe2 , 0x685665 , 0x686109 , 0x68=
6266 , 0x6863b4 , 0x686ae4 , 0x686b2a , 0x685cfd , 0x686bec , 0x686c5d , 0x686=
ce4 , 0x686d23 , 0x686f2d , 0x686fb5 , 0x687047 , 0x6870ab , 0x685f96 , 0x688f=
ba , 0x68904c , 0x689095 , 0x6890de , 0x689127 , 0x689170 , 0x6891df , =
0x68924e , 0x6892bd , 0x68932c =
, 0x6894b1 , 0x689520 , 0x68958f , 0x6895d8 , 0x689647 , 0x6896b6 , 0x6=
89710 , 0x68976a , 0x688443 , 0x688499 , 0x6897c0 , 0x689830 , 0x68989f , 0x686502 , 0x6865fc , 0x686738=
, 0x686874 , 0x6869ac , 0x68767e , 0x687bc7 , 0x688602 , 0x689a7f , 0x689a=
f2 , 0x68989f , 0x68989f , 0x689b8c , 0x68989f , 0x68989f , 0x68989f , =
0x68989f , 0x68989f , 0x68989f =
, 0x68989f , 0x68989f , 0x68989f , 0x689c26 }
count =3D 36
op =3D 2
vectorp =3D 0x15310e8
stack =3D {
pc =3D 0x1ae653d "\203\252",=20
byte_string =3D {
i =3D 19273556
},=20
byte_string_start =3D 0x1ae6528 "\300\301\002!!\302\002\303\"\302=
\211\004\304\"\305\"`\306\307\005\"\203\252",=20
next =3D 0x7fffffff6e00
}
top =3D 0x7fffffff5df0
result =3D {
i =3D 0
}
type =3D CATCHER
#9 0x000000000063873d in funcall_lambda (fun=3D..., nargs=3D1, arg_vector=
=3D0x7fffffff66d8) at eval.c:2855
size =3D 5
val =3D {
i =3D 21698117
}
syms_left =3D {
i =3D 1030
}
next =3D {
i =3D 60157747265
}
lexenv =3D {
i =3D 140737488315600
}
count =3D 36
i =3D 60143831280
optional =3D false
rest =3D false
#10 0x0000000000637fbb in Ffuncall (nargs=3D2, args=3D0x7fffffff66d0) at ev=
al.c:2742
fun =3D {
i =3D 21698117
}
original_fun =3D {
i =3D 13352512
}
funcar =3D {
i =3D 140737488315760
}
numargs =3D 1
lisp_numargs =3D {
i =3D 140737488315792
}
val =3D {
i =3D 0
}
internal_args =3D 0xda08f0
count =3D 35
#11 0x000000000063697b in Fapply (nargs=3D3, args=3D0x7fffffff66d0) at eval=
.c:2274
i =3D 5740786
numargs =3D 0
funcall_nargs =3D 13443920
funcall_args =3D 0x0
spread_arg =3D {
i =3D 0
}
fun =3D {
i =3D 13352512
}
retval =3D {
i =3D 140737488315952
}
sa_avail =3D 16384
sa_count =3D 35
sa_must_free =3D false
#12 0x000000000064631d in Fwidget_apply (nargs=3D2, args=3D0x7fffffff6828) =
at fns.c:2931
widget =3D {
i =3D 29645555
}
property =3D {
i =3D 13443920
}
propval =3D {
i =3D 13352512
}
trailing_args =3D {
i =3D 0
}
result =3D {
i =3D 13750941
}
#13 0x0000000000637bef in Ffuncall (nargs=3D3, args=3D0x7fffffff6820) at ev=
al.c:2673
fun =3D {
i =3D 13750941
}
original_fun =3D {
i =3D 209904
}
funcar =3D {
i =3D 327
}
numargs =3D 2
lisp_numargs =3D {
i =3D 0
}
val =3D {
i =3D 0
}
internal_args =3D 0x51a
count =3D 34
#14 0x0000000000685ea8 in exec_byte_code (bytestr=3D..., vector=3D..., maxd=
epth=3D..., args_template=3D..., nargs=3D1, args=3D0x7fffffff70c0) at bytec=
ode.c:880
targets =3D {0x68989f , 0x68990c , 0x68990e , 0x689910 , 0x689912 , 0x689912 , 0x6899=
78 , 0x6899e8 , 0x685480 , 0x685482 , 0x685484 , 0x685486 , 0x685488 , 0x685=
488 , 0x685491 , 0x68544b , 0x685a8d , 0x685a8f , 0x685a91 , 0x685a93 , 0x685a=
95 , 0x685a95 , 0x685ad3 , 0x685a9e , 0x685da3