Re: bug#609: 23.0.60; Cocoa Emacs crashes in ns_free_indexed_color

[andrey . petushkov]

On Jul 25, 9:26 pm, Clifford Wulfman <cwulf...@Princeton.EDU> wrote:
> Typing C-x C-f crashed Emacs; output from Emacs.crash.log appended.
>
> In GNU Emacs 23.0.60.1 (i386-apple-darwin8.11.1, *Step 9.0)
>   of 2008-07-25 on hagen.princeton.edu
> Windowing system distributor `Apple', version 49.46.48
> configured using `configure  '--with-ns' '--disable-ns-self-contained''
>
> Important settings:
>    value of $LC_ALL: nil
>    value of $LC_COLLATE: nil
>    value of $LC_CTYPE: nil
>    value of $LC_MESSAGES: nil
>    value of $LC_MONETARY: nil
>    value of $LC_NUMERIC: nil
>    value of $LC_TIME: nil
>    value of $LANG: nil
>    value of $XMODIFIERS: nil
>    locale-coding-system: nil
>    default-enable-multibyte-characters: t
>
> Major mode: Fundamental
>
> Minor modes in effect:
>    diff-auto-refine-mode: t
>    tooltip-mode: t
>    mouse-wheel-mode: t
>    menu-bar-mode: t
>    file-name-shadow-mode: t
>    global-font-lock-mode: t
>    global-auto-composition-mode: t
>    auto-encryption-mode: t
>    auto-compression-mode: t
>    line-number-mode: t
>    transient-mark-mode: t
>
> Recent input:
> <menu-bar> <help-menu> <send-emacs-bug-report>
>
> Recent messages:
> Loading psvn...done
> Loading /usr/local/share/emacs/site-lisp/xml-site.el (source)...
> Loading rng-auto...done
> Loading xmlunicode...
> Loading /usr/local/share/emacs/site-lisp/xml/unichars.el (source)...done
> Loading xmlunicode...done
> Loading /usr/local/share/emacs/site-lisp/xml-site.el (source)...done
> Loading `slime': old-style backquotes detected!
> Loading /Users/cliff/elisp/org-setup.el (source)...done
> For information about GNU Emacs and the GNU system, type C-h C-a.
>
> **********
>
> Host Name:      hagen
> Date/Time:      2008-07-25 13:20:51.779 -0400
> OS Version:     10.4.11 (Build 8S2167)
> Report Version: 4
>
> Command: Emacs
> Path:    /Users/cliff/Applications/Emacs.app/Contents/MacOS/Emacs
> Parent:  WindowServer [62]
>
> Version: Version 23.0.60 (NS 9.0)
>
> PID:    271
> Thread: 0
>
> Exception:  EXC_BAD_ACCESS (0x0001)
> Codes:      KERN_INVALID_ADDRESS (0x0001) at 0xfff84505
>
> Thread 0 Crashed:
> 0   org.gnu.Emacs       0x00161b01 ns_free_indexed_color + 23 (nsterm.m:1309)
> 1   org.gnu.Emacs       0x00186ee9 x_clear_image_1 + 143 (image.c:1709)
> 2   org.gnu.Emacs       0x001869d6 free_image + 83 (image.c:1394)
> 3   org.gnu.Emacs       0x00187210 clear_image_cache + 192 (image.c:1927)
> 4   org.gnu.Emacs       0x001872cc clear_image_caches + 53 (image.c:1961)
> 5   org.gnu.Emacs       0x00032c7e redisplay_internal + 4412 (xdisp.c:12045)
> 6   org.gnu.Emacs       0x000a7165 read_char + 1787 (keyboard.c:2687)
> 7   org.gnu.Emacs       0x000a9592 read_key_sequence + 866 (keyboard.c:9431)
> 8   org.gnu.Emacs       0x000ab95c command_loop_1 + 542 (keyboard.c:1653)
> 9   org.gnu.Emacs       0x0010a0b1 internal_condition_case + 245 (eval.c:
> 1511)
> 10  org.gnu.Emacs       0x0009da0c command_loop_2 + 68 (keyboard.c:1370)
> 11  org.gnu.Emacs       0x00109fa2 internal_catch + 171 (eval.c:1247)
> 12  org.gnu.Emacs       0x0009d7ae command_loop + 170 (keyboard.c:1349)
> 13  org.gnu.Emacs       0x0009d867 recursive_edit_1 + 145 (keyboard.c:957)
> 14  org.gnu.Emacs       0x0009d9af Frecursive_edit + 228 (keyboard.c:1020)
> 15  org.gnu.Emacs       0x0009c6cb main + 2477 (emacs.c:1800)
> 16  org.gnu.Emacs       0x0000234a _start + 216
> 17  org.gnu.Emacs       0x00002271 start + 41
>
> Thread 0 crashed with X86 Thread State (32-bit):
>    eax: 0xfff84495  ebx: 0x00161af8  ecx: 0x00000003  edx: 0x0439b3f0
>    edi: 0x00af5780  esi: 0x0439b0d0  ebp: 0xbfffed18  esp: 0xbfffecf0
>     ss: 0x0000001f  efl: 0x00010286  eip: 0x00161b01   cs: 0x00000017
>     ds: 0x0000001f   es: 0x0000001f   fs: 0x00000000   gs: 0x00000037
>
> Binary Images Description:
>      0x1000 -   0x1a4fff org.gnu.Emacs Version 23.0.60 (NS 9.0) /
> Users/cliff/Applications/Emacs.app/Contents/MacOS/Emacs
>    0x70e000 -   0x738fff libdbus-1.3.dylib      /opt/local/lib/
> libdbus-1.3.dylib
>    0x74b000 -   0x774fff libncurses.5.dylib     /opt/local/lib/
> libncurses.5.dylib
>    0xb5d000 -   0xb64fff com.unsanity.smartcrashreports Smart Crash  
> Reports version 1.2.1 (1.2.1)   /Users/cliff/Library/InputManagers/
> Smart Crash Reports/Smart Crash Reports.bundle/Contents/MacOS/Smart  
> Crash Reports
> 0x8fe00000 - 0x8fe4afff dyld 46.16      /usr/lib/dyld
> 0x90000000 - 0x90171fff libSystem.B.dylib       /usr/lib/libSystem.B.dylib
> 0x901c1000 - 0x901c3fff libmathCommon.A.dylib   /usr/lib/system/
> libmathCommon.A.dylib
> 0x901c5000 - 0x90202fff com.apple.CoreText 1.1.3 (???)  /System/
> Library/Frameworks/ApplicationServices.framework/Versions/A/
> Frameworks/CoreText.framework/Versions/A/CoreText
> 0x90229000 - 0x902fffff ATS     /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/ATS.framework/
> Versions/A/ATS
> 0x9031f000 - 0x90774fff com.apple.CoreGraphics 1.258.78 (???)   /System/
> Library/Frameworks/ApplicationServices.framework/Versions/A/
> Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
> 0x9080b000 - 0x908d3fff com.apple.CoreFoundation 6.4.11 (368.35)        /
> System/Library/Frameworks/CoreFoundation.framework/Versions/A/
> CoreFoundation
> 0x90911000 - 0x90911fff com.apple.CoreServices 10.4 (???)       /System/
> Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
> 0x90913000 - 0x90a07fff libicucore.A.dylib      /usr/lib/libicucore.A.dylib
> 0x90a57000 - 0x90ad6fff libobjc.A.dylib         /usr/lib/libobjc.A.dylib
> 0x90aff000 - 0x90b63fff libstdc++.6.dylib       /usr/lib/libstdc++.6.dylib
> 0x90bd2000 - 0x90bd9fff libgcc_s.1.dylib        /usr/lib/libgcc_s.1.dylib
> 0x90bde000 - 0x90c51fff com.apple.framework.IOKit 1.4.8 (???)   /System/
> Library/Frameworks/IOKit.framework/Versions/A/IOKit
> 0x90c66000 - 0x90c78fff libauto.dylib   /usr/lib/libauto.dylib
> 0x90c7e000 - 0x90f24fff com.apple.CoreServices.CarbonCore 682.29        /
> System/Library/Frameworks/CoreServices.framework/Versions/A/
> Frameworks/CarbonCore.framework/Versions/A/CarbonCore
> 0x90f67000 - 0x90fcffff com.apple.CoreServices.OSServices 4.1   /System/
> Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/
> OSServices.framework/Versions/A/OSServices
> 0x91008000 - 0x91047fff com.apple.CFNetwork 129.22 (129.23)     /System/
> Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/
> CFNetwork.framework/Versions/A/CFNetwork
> 0x9105a000 - 0x9106afff com.apple.WebServices 1.1.3 (1.1.0)     /System/
> Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/
> WebServicesCore.framework/Versions/A/WebServicesCore
> 0x91075000 - 0x910f4fff com.apple.SearchKit 1.0.7       /System/Library/
> Frameworks/CoreServices.framework/Versions/A/Frameworks/
> SearchKit.framework/Versions/A/SearchKit
> 0x9112e000 - 0x9114cfff com.apple.Metadata 10.4.4 (121.36)      /System/
> Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/
> Metadata.framework/Versions/A/Metadata
> 0x91158000 - 0x91166fff libz.1.dylib    /usr/lib/libz.1.dylib
> 0x91169000 - 0x91308fff com.apple.security 4.5.2 (29774)        /System/
> Library/Frameworks/Security.framework/Versions/A/Security
> 0x91406000 - 0x9140efff com.apple.DiskArbitration 2.1.2 /System/
> Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration
> 0x91415000 - 0x9141cfff libbsm.dylib    /usr/lib/libbsm.dylib
> 0x91420000 - 0x91446fff com.apple.SystemConfiguration 1.8.6     /System/
> Library/Frameworks/SystemConfiguration.framework/Versions/A/
> SystemConfiguration
> 0x91458000 - 0x914cefff com.apple.audio.CoreAudio 3.0.5 /System/
> Library/Frameworks/CoreAudio.framework/Versions/A/CoreAudio
> 0x9151f000 - 0x9151ffff com.apple.ApplicationServices 10.4 (???)        /
> System/Library/Frameworks/ApplicationServices.framework/Versions/A/
> ApplicationServices
> 0x91521000 - 0x9154dfff com.apple.AE 314 (313)  /System/Library/
> Frameworks/ApplicationServices.framework/Versions/A/Frameworks/
> AE.framework/Versions/A/AE
> 0x91560000 - 0x91634fff com.apple.ColorSync 4.4.10      /System/Library/
> Frameworks/ApplicationServices.framework/Versions/A/Frameworks/
> ColorSync.framework/Versions/A/ColorSync
> 0x9166f000 - 0x916e2fff com.apple.print.framework.PrintCore 4.6  
> (177.13)        /System/Library/Frameworks/ApplicationServices.framework/
> Versions/A/Frameworks/PrintCore.framework/Versions/A/PrintCore
> 0x91710000 - 0x917b9fff com.apple.QD 3.10.25 (???)      /System/Library/
> Frameworks/ApplicationServices.framework/Versions/A/Frameworks/
> QD.framework/Versions/A/QD
> 0x917df000 - 0x9182afff com.apple.HIServices 1.5.2 (???)        /System/
> Library/Frameworks/ApplicationServices.framework/Versions/A/
> Frameworks/HIServices.framework/Versions/A/HIServices
> 0x91849000 - 0x9185ffff com.apple.LangAnalysis 1.6.3    /System/Library/
> Frameworks/ApplicationServices.framework/Versions/A/Frameworks/
> LangAnalysis.framework/Versions/A/LangAnalysis
> 0x9186b000 - 0x91886fff com.apple.FindByContent 1.5     /System/Library/
> Frameworks/ApplicationServices.framework/Versions/A/Frameworks/
> FindByContent.framework/Versions/A/FindByContent
> 0x91891000 - 0x918cefff com.apple.LaunchServices 183    /System/Library/
> Frameworks/ApplicationServices.framework/Versions/A/Frameworks/
> LaunchServices.framework/Versions/A/LaunchServices
> 0x918e2000 - 0x918eefff com.apple.speech.synthesis.framework 3.5        /
> System/Library/Frameworks/ApplicationServices.framework/Versions/A/
> Frameworks/SpeechSynthesis.framework/Versions/A/SpeechSynthesis
> 0x918f5000 - 0x91935fff com.apple.ImageIO.framework 1.5.7       /System/
> Library/Frameworks/ApplicationServices.framework/Versions/A/
> Frameworks/ImageIO.framework/Versions/A/ImageIO
> 0x91948000 - 0x919fafff libcrypto.0.9.7.dylib   /usr/lib/libcrypto.
> 0.9.7.dylib
> 0x91a40000 - 0x91a56fff libcups.2.dylib         /usr/lib/libcups.2.dylib
> 0x91a5b000 - 0x91a79fff libJPEG.dylib   /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/
> Versions/A/Resources/libJPEG.dylib
> 0x91a7e000 - 0x91addfff libJP2.dylib    /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/
> Versions/A/Resources/libJP2.dylib
> 0x91aef000 - 0x91af3fff libGIF.dylib    /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/
> Versions/A/Resources/libGIF.dylib
> 0x91af5000 - 0x91b7dfff libRaw.dylib    /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/
> Versions/A/Resources/libRaw.dylib
> 0x91b81000 - 0x91bbefff libTIFF.dylib   /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/
> Versions/A/Resources/libTIFF.dylib
> 0x91bc4000 - 0x91bdffff libPng.dylib    /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/
> Versions/A/Resources/libPng.dylib
> 0x91be4000 - 0x91be6fff libRadiance.dylib       /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/
> Versions/A/Resources/libRadiance.dylib
> 0x91be8000 - 0x91cc6fff libxml2.2.dylib         /usr/lib/libxml2.2.dylib
> 0x91ce3000 - 0x91ce3fff com.apple.Accelerate 1.3.1 (Accelerate  
> 1.3.1)  /System/Library/Frameworks/Accelerate.framework/Versions/A/
> Accelerate
> 0x91ce5000 - 0x91d73fff com.apple.vImage 2.5    /System/Library/
> Frameworks/Accelerate.framework/Versions/A/Frameworks/
> vImage.framework/Versions/A/vImage
> 0x91d7a000 - 0x91d7afff com.apple.Accelerate.vecLib 3.3.1 (vecLib  
> 3.3.1)  /System/Library/Frameworks/Accelerate.framework/Versions/A/
> Frameworks/vecLib.framework/Versions/A/vecLib
> 0x91d7c000 - 0x91dd5fff libvMisc.dylib  /System/Library/Frameworks/
> Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/
> A/libvMisc.dylib
> 0x91dde000 - 0x91e02fff libvDSP.dylib   /System/Library/Frameworks/
> Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/
> A/libvDSP.dylib
> 0x91e0a000 - 0x92213fff libBLAS.dylib   /System/Library/Frameworks/
> Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/
> A/libBLAS.dylib
> 0x9224d000 - 0x92601fff libLAPACK.dylib         /System/Library/Frameworks/
> Accelerate.framework/Versions/A/Frameworks/vecLib.framework/Versions/
> A/libLAPACK.dylib
> 0x9262e000 - 0x9271bfff libiconv.2.dylib        /usr/lib/libiconv.2.dylib
> 0x9271d000 - 0x9279bfff com.apple.DesktopServices 1.3.7 /System/
> Library/PrivateFrameworks/DesktopServicesPriv.framework/Versions/A/
> DesktopServicesPriv
> 0x927dc000 - 0x92a0cfff com.apple.Foundation 6.4.10 (567.37)    /System/
> Library/Frameworks/Foundation.framework/Versions/C/Foundation
> 0x92b26000 - 0x92b41fff libGL.dylib     /System/Library/Frameworks/
> OpenGL.framework/Versions/A/Libraries/libGL.dylib
> 0x92b4d000 - 0x92ba5fff libGLU.dylib    /System/Library/Frameworks/
> OpenGL.framework/Versions/A/Libraries/libGLU.dylib
> 0x92bda000 - 0x92be2fff com.apple.speech.recognition.framework 3.6      /
> System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/
> SpeechRecognition.framework/Versions/A/SpeechRecognition
> 0x92dce000 - 0x92ddcfff com.apple.audio.SoundManager 3.9.1      /System/
> Library/Frameworks/Carbon.framework/Versions/A/Frameworks/
> CarbonSound.framework/Versions/A/CarbonSound
> 0x92ded000 - 0x930e2fff com.apple.HIToolbox 1.4.10 (???)        /System/
> Library/Frameworks/Carbon.framework/Versions/A/Frameworks/
> HIToolbox.framework/Versions/A/HIToolbox
> 0x931e8000 - 0x931f4fff com.apple.opengl 1.5.1  /System/Library/
> Frameworks/OpenGL.framework/Versions/A/OpenGL
> 0x93284000 - 0x93284fff com.apple.Cocoa 6.4 (???)       /System/Library/
> Frameworks/Cocoa.framework/Versions/A/Cocoa
> 0x93286000 - 0x9393cfff com.apple.AppKit 6.4.10 (824.48)        /System/
> Library/Frameworks/AppKit.framework/Versions/C/AppKit
> 0x93cbd000 - 0x93d38fff com.apple.CoreData 91 (92.1)    /System/Library/
> Frameworks/CoreData.framework/Versions/A/CoreData
> 0x93d71000 - 0x93e2afff com.apple.audio.toolbox.AudioToolbox 1.4.7      /
> System/Library/Frameworks/AudioToolbox.framework/Versions/A/AudioToolbox
> 0x93e6d000 - 0x93e6dfff com.apple.audio.units.AudioUnit 1.4.3   /System/
> Library/Frameworks/AudioUnit.framework/Versions/A/AudioUnit
> 0x93e6f000 - 0x94030fff com.apple.QuartzCore 1.4.12     /System/Library/
> Frameworks/QuartzCore.framework/Versions/A/QuartzCore
> 0x94076000 - 0x940b7fff libsqlite3.0.dylib      /usr/lib/libsqlite3.0.dylib
> 0x940bf000 - 0x94102fff libGLImage.dylib        /System/Library/Frameworks/
> OpenGL.framework/Versions/A/Libraries/libGLImage.dylib
> 0x94106000 - 0x9411cfff com.apple.CoreVideo 1.4.2       /System/Library/
> Frameworks/CoreVideo.framework/Versions/A/CoreVideo
> 0x9412c000 - 0x945e8fff libGLProgrammability.dylib      /System/Library/
> Frameworks/OpenGL.framework/Versions/A/Libraries/
> libGLProgrammability.dylib
> 0x94867000 - 0x94876fff libCGATS.A.dylib        /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/
> CoreGraphics.framework/Versions/A/Resources/libCGATS.A.dylib
> 0x9487d000 - 0x94888fff libCSync.A.dylib        /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/
> CoreGraphics.framework/Versions/A/Resources/libCSync.A.dylib
> 0x948d4000 - 0x948eefff libRIP.A.dylib  /System/Library/Frameworks/
> ApplicationServices.framework/Versions/A/Frameworks/
> CoreGraphics.framework/Versions/A/Resources/libRIP.A.dylib
> 0x94fed000 - 0x9500afff libresolv.9.dylib       /usr/lib/libresolv.9.dylib
>
> Clifford E. Wulfman
> Coordinator of Library Digital Initiatives
> Princeton University Library
> cwulf...@Princeton.EDU

This looks like compiler bug: in function x_clear_image_1 first
parameter (f) get passed in register eax. Which is used by compiler
throught the function body for each and every purpose. Thid
effectively destroies the original value so ns_free_indexed_color gets
0 as (f) and tries to derefence it

Regards,
Andrey