SEGV from safe_bcopy

[Robert Mecklenburg]

Sorry, I'm not even sure what command I was executing when this crash
happened, but here is what I know:

Program received signal SIGSEGV, Segmentation fault.
0x406d5e85 in bcopy () from /lib/tls/libc.so.6
(gdb) where
#0  0x406d5e85 in bcopy () from /lib/tls/libc.so.6
#1  0x08081c44 in safe_bcopy (from=0xa07f194 "\260F\002\n",
    to=0x140a382c <Address 0x140a382c out of bounds>, size=167921304) at 
dispnew.c:484
#2  0x0816f65f in compact_small_strings () at alloc.c:1871
#3  0x081725c3 in gc_sweep () at alloc.c:5283
#4  0x0817149d in Fgarbage_collect () at alloc.c:4486
#5  0x08186df2 in Ffuncall (nargs=2, args=0xbfffd720) at eval.c:2666
#6  0x08186b68 in call1 (fn=141049385, arg1=165768157) at eval.c:2520
#7  0x0818ffb5 in mapcar1 (leni=20, vals=0xbfffd7a0, fn=141049385, seq=2319484) 
at fns.c:2962
#8  0x08190204 in Fmapcar (function=141049385, sequence=159546565) at fns.c:3022
#9  0x08186f50 in Ffuncall (nargs=3, args=0xbfffd880) at eval.c:2737
#10 0x081b4b99 in Fbyte_code (bytestr=140345011, vector=143337556, maxdepth=72) 
at bytecode.c:689
#11 0x081872e0 in funcall_lambda (fun=143337748, nargs=0, 
arg_vector=0xbfffd9c8) at eval.c:2913
#12 0x08186dc3 in Ffuncall (nargs=1, args=0xbfffd9c4) at eval.c:2783
#13 0x081b4b99 in Fbyte_code (bytestr=143308907, vector=143310148, maxdepth=48) 
at bytecode.c:689
#14 0x081864ea in Feval (form=143324125) at eval.c:2088
#15 0x081850d8 in Fcondition_case (args=165767885) at eval.c:1280
#16 0x081b435f in Fbyte_code (bytestr=143308891, vector=143310292, maxdepth=24) 
at bytecode.c:870
#17 0x081872e0 in funcall_lambda (fun=143310428, nargs=0, 
arg_vector=0xbfffddac) at eval.c:2913
#18 0x08186dc3 in Ffuncall (nargs=1, args=0xbfffdda8) at eval.c:2783
#19 0x081868d1 in run_hook_with_args (nargs=1, args=0xbfffdda8, 
cond=to_completion) at eval.c:2394
#20 0x081867ba in Frun_hooks (nargs=1, args=0xbfffde54) at eval.c:2262
#21 0x08186f7e in Ffuncall (nargs=2, args=0xbfffde50) at eval.c:2707
#22 0x08186b68 in call1 (fn=138578737, arg1=138691857) at eval.c:2520
#23 0x08124a67 in safe_run_hooks_1 (hook=138494017) at keyboard.c:1984
#24 0x081851ed in internal_condition_case (bfun=0x8124a50 <safe_run_hooks_1>, 
handlers=138494017,
    hfun=0x8124a70 <safe_run_hooks_error>) at eval.c:1333
#25 0x08124aff in safe_run_hooks (hook=138691857) at keyboard.c:2012
#26 0x0809e0aa in update_menu_bar (f=0x92e0f28, save_match_data=0) at 
xdisp.c:8226
#27 0x0809de3a in prepare_menu_bars () at xdisp.c:8118
#28 0x080a01b1 in redisplay_internal (preserve_echo_area=1) at xdisp.c:9784
#29 0x080a13ae in redisplay_preserve_echo_area (from_where=12) at xdisp.c:10379
#30 0x081bb642 in wait_reading_process_input (time_limit=30, microsecs=0, 
read_kbd=-8, do_display=1)
    at process.c:4527
#31 0x0808a9eb in sit_for (sec=30, usec=0, reading=1, display=1, 
initial_display=0) at dispnew.c:6407
#32 0x081260f8 in read_char (commandflag=1, nmaps=6, maps=0xbfffeab0, 
prev_event=138493969,
    used_mouse_menu=0xbfffeaf8) at keyboard.c:2710
#33 0x0812cfc1 in read_key_sequence (keybuf=0xbfffec20, bufsize=30, 
prompt=138493969,
    dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at 
keyboard.c:8781
#34 0x08123077 in command_loop_1 () at keyboard.c:1489
#35 0x081851ed in internal_condition_case (bfun=0x8122ed0 <command_loop_1>, 
handlers=138554897,
    hfun=0x8122a00 <cmd_error>) at eval.c:1333
#36 0x08122d0b in command_loop_2 () at keyboard.c:1271
#37 0x08184d0a in internal_catch (tag=138548905, func=0x8122cf0 
<command_loop_2>, arg=138493969)
    at eval.c:1094
#38 0x08122cc1 in command_loop () at keyboard.c:1250
#39 0x08122752 in recursive_edit_1 () at keyboard.c:961
#40 0x0812289f in Frecursive_edit () at keyboard.c:1022
#41 0x0812101f in main (argc=3, argv=0xbffff234) at emacs.c:1693
(gdb) up
#1  0x08081c44 in safe_bcopy (from=0xa07f194 "\260F\002\n",
    to=0x140a382c <Address 0x140a382c out of bounds>, size=167921304) at 
dispnew.c:484
484                   bcopy (endf, endt, to - from);
(gdb) p from
$1 = 0xa07f194 "\260F\002\n"
(gdb) pr
#<window-configuration>
(gdb) p to
$2 = 0x140a382c <Address 0x140a382c out of bounds>

Unfortunately, here I did a dumb thing:

(gdb) pr

Program received signal SIGSEGV, Segmentation fault.
0x08197df4 in print_object (obj=336214060, printcharfun=138578089, 
escapeflag=1) at print.c:1469
1469      switch (XGCTYPE (obj))
The program being debugged was signaled while in a function called from GDB.
GDB remains in the frame where the signal was received.
To change this behavior use "set unwindonsignal on"
Evaluation of the expression containing the function (debug_print) will be 
abandoned.
(gdb) up
#1  0x0819600d in Fprin1 (object=336214060, printcharfun=138578089) at 
print.c:742
742       print (object, printcharfun, 1);
(gdb) up
#2  0x08197385 in debug_print (arg=336214060) at print.c:965
965       Fprin1 (arg, Qexternal_debugging_output);
(gdb) up
#3  <function called from gdb>
Current language:  auto; currently asm

Now we get back to something relevant...but gdb wouldn't give any
more details:

(gdb) up
#4  0x406d5e85 in bcopy () from /lib/tls/libc.so.6
(gdb) up
#5  0x08081c44 in safe_bcopy (from=0xa07f194 "\260F\002\n",
    to=0x140a382c <Address 0x140a382c out of bounds>, size=167921304) at 
dispnew.c:484
484                   bcopy (endf, endt, to - from);
Current language:  auto; currently c
(gdb) up
#6  0x0816f65f in compact_small_strings () at alloc.c:1871
warning: Source file is more recent than executable.

1871
(gdb) up
#7  0x081725c3 in gc_sweep () at alloc.c:5283
5283                  {
(gdb) list
5278            int this_free = 0;
5279
5280            for (i = 0; i < lim; i++)
5281              {
5282                if (!iblk->intervals[i].gcmarkbit)
5283                  {
5284                    SET_INTERVAL_PARENT (&iblk->intervals[i], 
interval_free_list);
5285                    interval_free_list = &iblk->intervals[i];
5286                    this_free++;
5287                  }
(gdb) p i
Variable "i" is not available.
(gdb) info locals
i = Variable "i" is not available.
(gdb) p iblk
No symbol "iblk" in current context.
(gdb) up
#8  0x0817149d in Fgarbage_collect () at alloc.c:4486
4486                        if (NILP (prev))
(gdb) p prev
No symbol "prev" in current context.
(gdb) up
#9  0x08186df2 in Ffuncall (nargs=2, args=0xbfffd720) at eval.c:2666
warning: Source file is more recent than executable.

2666        Fgarbage_collect ();
(gdb)



The last several days I get a compilation error from the emacs CVS
tree so my sources are slightly out of date WRT the binary.  Here is
the compilation error:

1005 oops:emacs$ make
cd lib-src; make all  \
  CC='gcc' CFLAGS='-g -O2' CPPFLAGS='-D_BSD_SOURCE  ' \
  LDFLAGS='-Wl,-znocombreloc -L/usr/X11R6/lib' MAKE='make'
make[1]: Entering directory `/home/mecklen/Emacs/trunk/emacs/lib-src'
make[1]: Nothing to be done for `all'.
make[1]: Leaving directory `/home/mecklen/Emacs/trunk/emacs/lib-src'
cd src; make all  \
  CC='gcc' CFLAGS='-g -O2' CPPFLAGS='-D_BSD_SOURCE  ' \
  LDFLAGS='-Wl,-znocombreloc -L/usr/X11R6/lib' MAKE='make'
make[1]: Entering directory `/home/mecklen/Emacs/trunk/emacs/src'
LC_ALL=C ./temacs -batch -l loadup dump
Loading loadup.el (source)...
Using load-path (/home/mecklen/Emacs/trunk/emacs/lisp)
Loading emacs-lisp/byte-run...
Loading emacs-lisp/backquote...
Loading subr (compiled; note, source file is newer)...
Loading version.el (source)...
Loading widget...
Loading custom (compiled; note, source file is newer)...
Loading emacs-lisp/map-ynp...
Loading env...
Loading cus-start...
Loading international/mule...
Loading international/mule-conf.el (source)...
Loading format (compiled; note, source file is newer)...
Loading bindings (compiled; note, source file is newer)...
Loading files...
Loading cus-face...
Loading faces (compiled; note, source file is newer)...
Symbol's function definition is void: tty-supports-face-attributes-p
make[1]: *** [emacs] Error 255
make[1]: Leaving directory `/home/mecklen/Emacs/trunk/emacs/src'
make: *** [src] Error 2






In GNU Emacs 21.3.50.13 (i686-pc-linux-gnu, GTK+ Version 2.2.4)
 of 2004-05-27 on oops.realmsys.com
configured using `configure '--with-x11' '--with-x-toolkit=gtk''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: en_US
  value of $LC_CTYPE: en_US
  value of $LC_MESSAGES: en_US
  value of $LC_MONETARY: en_US
  value of $LC_NUMERIC: en_US
  value of $LC_TIME: en_US
  value of $LANG: en_US
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  show-paren-mode: t
  eldoc-mode: t
  auto-image-file-mode: t
  recentf-mode: t
  auto-compression-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  unify-8859-on-encoding-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
<help-echo> <down-mouse-1> <mouse-1> C-x o <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <help-echo> <help-echo> <help-echo> 
<help-echo> <help-echo> <menu-bar> <help-menu> <re
port-emacs-bug>

Recent messages:
Loading junit (source)...done
Loading code-conversion (source)...done
Loading core-utils (source)...done
Loading /usr/local/share/emacs/site-lisp/local/local.el (source)...done
Loading ~/bin/emacs-helpers (source)...done
Starting the BeanShell. Please wait...
Loading semantic-el...done
Loading jit-lock...done
Mark set [2 times]
Loading emacsbug...done


-- 
Robert