bug#70914: 29.3; Crashes often on Windows

[Simen Endsjø]

Seems like conditional breakpoints crashes somehow, but I modified the
source to put a breakpoint when we get this path.
Here is a stack trace.

Thread 1 hit Breakpoint 1, parse_root (name=0x1dbad0c0 "//",
pPath=0xbf6710) at w32.c:2562
2562        assert(0 && "parse_root: name is \"//\"");
(gdb) bt
#0  parse_root (name=0x1dbad0c0 "//", pPath=0xbf6710) at w32.c:2562
#1  0x00007ff750e8bde9 in get_volume_info (name=0x1dbad0c0 "//",
pPath=0xbf6710) at w32.c:3484
#2  0x00007ff750e8bef8 in is_fat_volume (name=0x1dbad0c0 "//",
pPath=0xbf6710) at w32.c:3514
#3  0x00007ff750e8bf8e in map_w32_filename (name=0x1dbad0c0 "//",
pPath=0x0) at w32.c:3539
#4  0x00007ff750e8d13b in faccessat (dirfd=-3041965, path=0x1dbad0c0
"//", mode=8, flags=4) at w32.c:4135
#5  0x00007ff750cd5ec1 in file_access_p (file=0x1dbad0c0 "//",
amode=0) at fileio.c:162
#6  0x00007ff750cdbc91 in check_file_access (file=..., operation=...,
amode=0) at fileio.c:2893
#7  0x00007ff750cdbcde in Ffile_exists_p (filename=...) at fileio.c:2905
#8  0x00007ff750d68335 in eval_sub (form=...) at eval.c:2502
#9  0x00007ff750d60ef3 in For (args=...) at eval.c:349
#10 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#11 0x00007ff750d61087 in Fif (args=...) at eval.c:388
#12 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#13 0x00007ff750d613cd in Fprogn (body=...) at eval.c:436
#14 0x00007ff750d6abfe in funcall_lambda (fun=..., nargs=1,
arg_vector=0x0) at eval.c:3237
#15 0x00007ff750d69a11 in funcall_general (fun=..., numargs=1,
args=0x4b94bd0) at eval.c:2961
#16 0x00007ff750dcfaf1 in exec_byte_code (fun=..., args_template=514,
nargs=2, args=0x4b94bd8) at bytecode.c:811
#17 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=0, nargs=0, args=0x0) at eval.c:3085
#18 0x00007ff750d6ac89 in funcall_lambda (fun=..., nargs=0,
arg_vector=0x0) at eval.c:3246
#19 0x00007ff750d698ef in funcall_general (fun=..., numargs=0,
args=0xbf7bb8) at eval.c:2949
#20 0x00007ff750d69c22 in Ffuncall (nargs=1, args=0xbf7bb0) at eval.c:2999
#21 0x00007ff750d68e1d in funcall_nil (nargs=1, args=0xbf7bb0) at eval.c:2681
#22 0x00007ff750d6939c in run_hook_with_args (nargs=1, args=0xbf7bb0,
funcall=0x7ff750d68dfd <funcall_nil>) at eval.c:2858
#23 0x00007ff750d68eab in Frun_hook_with_args (nargs=1, args=0xbf7bb0)
at eval.c:2723
#24 0x00007ff750d6943b in run_hook (hook=...) at eval.c:2871
#25 0x00007ff750d68e65 in Frun_hooks (nargs=4, args=0xbf7d88) at eval.c:2705
#26 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e80
<Srun_hooks>, numargs=4, args=0xbf7d88) at eval.c:3063
#27 0x00007ff750d698a3 in funcall_general (fun=..., numargs=4,
args=0xbf7d88) at eval.c:2945
#28 0x00007ff750d69c22 in Ffuncall (nargs=5, args=0xbf7d80) at eval.c:2999
#29 0x00007ff750d68de2 in Fapply (nargs=2, args=0x4b94880) at eval.c:2670
#30 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=2, args=0x4b94880) at eval.c:3063
#31 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=1, args=0x4b94820) at bytecode.c:809
#32 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=256, nargs=0, args=0x4b946a8) at eval.c:3085
#33 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=0,
arg_vector=0x4b946a8) at eval.c:3157
#34 0x00007ff750d698ef in funcall_general (fun=..., numargs=0,
args=0x4b946a8) at eval.c:2949
#35 0x00007ff750d69c22 in Ffuncall (nargs=1, args=0x4b946a0) at eval.c:2999
#36 0x00007ff750d689b2 in Fapply (nargs=2, args=0x4b946a0) at eval.c:2623
#37 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=2, args=0x4b946a0) at eval.c:3063
--Type <RET> for more, q to quit, c to continue without paging--c
#38 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=0, args=0xbf8db8) at bytecode.c:809
#39 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=128, nargs=0, args=0xbf8db8) at eval.c:3085
#40 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=0,
arg_vector=0xbf8db8) at eval.c:3157
#41 0x00007ff750d698ef in funcall_general (fun=..., numargs=0,
args=0xbf8db8) at eval.c:2949
#42 0x00007ff750d69c22 in Ffuncall (nargs=1, args=0xbf8db0) at eval.c:2999
#43 0x00007ff750d689b2 in Fapply (nargs=2, args=0xbf8db0) at eval.c:2623
#44 0x00007ff750d681b1 in eval_sub (form=...) at eval.c:2474
#45 0x00007ff750d613cd in Fprogn (body=...) at eval.c:436
#46 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#47 0x00007ff750d644ce in Funwind_protect (args=...) at eval.c:1301
#48 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#49 0x00007ff750d613cd in Fprogn (body=...) at eval.c:436
#50 0x00007ff750d63ab5 in Flet (args=...) at eval.c:1026
#51 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#52 0x00007ff750d6882c in eval_sub (form=...) at eval.c:2588
#53 0x00007ff750d610f8 in Fif (args=...) at eval.c:391
#54 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#55 0x00007ff750d613cd in Fprogn (body=...) at eval.c:436
#56 0x00007ff750d6abfe in funcall_lambda (fun=..., nargs=1,
arg_vector=0x0) at eval.c:3237
#57 0x00007ff750d69a11 in funcall_general (fun=..., numargs=1,
args=0x4b94660) at eval.c:2961
#58 0x00007ff750d69c22 in Ffuncall (nargs=2, args=0x4b94658) at eval.c:2999
#59 0x00007ff750d689b2 in Fapply (nargs=3, args=0x4b94658) at eval.c:2623
#60 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=3, args=0x4b94658) at eval.c:3063
#61 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=0, args=0x4b94620) at bytecode.c:809
#62 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=128, nargs=0, args=0x4b94620) at eval.c:3085
#63 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=0,
arg_vector=0x4b94620) at eval.c:3157
#64 0x00007ff750d698ef in funcall_general (fun=..., numargs=0,
args=0x4b94620) at eval.c:2949
#65 0x00007ff750d69c22 in Ffuncall (nargs=1, args=0x4b94618) at eval.c:2999
#66 0x00007ff750d689b2 in Fapply (nargs=2, args=0x4b94618) at eval.c:2623
#67 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=2, args=0x4b94618) at eval.c:3063
#68 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=513,
nargs=1, args=0x4b94718) at bytecode.c:809
#69 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=385, nargs=1, args=0x4b945d0) at eval.c:3085
#70 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=1,
arg_vector=0x4b945d0) at eval.c:3157
#71 0x00007ff750d698ef in funcall_general (fun=..., numargs=1,
args=0x4b945d0) at eval.c:2949
#72 0x00007ff750d69c22 in Ffuncall (nargs=2, args=0x4b945c8) at eval.c:2999
#73 0x00007ff750d689b2 in Fapply (nargs=3, args=0x4b945c8) at eval.c:2623
#74 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=3, args=0x4b945c8) at eval.c:3063
#75 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=0, args=0x4b94580) at bytecode.c:809
#76 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=1280, nargs=2, args=0xbfb058) at eval.c:3085
#77 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=2,
arg_vector=0xbfb058) at eval.c:3157
#78 0x00007ff750d698ef in funcall_general (fun=..., numargs=2,
args=0xbfb058) at eval.c:2949
#79 0x00007ff750d69c22 in Ffuncall (nargs=3, args=0xbfb050) at eval.c:2999
#80 0x00007ff750d68de2 in Fapply (nargs=2, args=0xbfb130) at eval.c:2670
#81 0x00007ff750d681b1 in eval_sub (form=...) at eval.c:2474
#82 0x00007ff750d613cd in Fprogn (body=...) at eval.c:436
#83 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#84 0x00007ff750d644ce in Funwind_protect (args=...) at eval.c:1301
#85 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#86 0x00007ff750d613cd in Fprogn (body=...) at eval.c:436
#87 0x00007ff750d63568 in FletX (args=...) at eval.c:958
#88 0x00007ff750d67f63 in eval_sub (form=...) at eval.c:2453
#89 0x00007ff750d613cd in Fprogn (body=...) at eval.c:436
#90 0x00007ff750d6abfe in funcall_lambda (fun=..., nargs=3,
arg_vector=0x0) at eval.c:3237
#91 0x00007ff750d69a11 in funcall_general (fun=..., numargs=3,
args=0xbfb998) at eval.c:2961
#92 0x00007ff750d69c22 in Ffuncall (nargs=4, args=0xbfb990) at eval.c:2999
#93 0x00007ff750d68de2 in Fapply (nargs=3, args=0x4b944c8) at eval.c:2670
#94 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=3, args=0x4b944c8) at eval.c:3063
#95 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=2, args=0xbfc158) at bytecode.c:809
#96 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=128, nargs=2, args=0xbfc158) at eval.c:3085
#97 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=2,
arg_vector=0xbfc158) at eval.c:3157
#98 0x00007ff750d698ef in funcall_general (fun=..., numargs=2,
args=0xbfc158) at eval.c:2949
#99 0x00007ff750d69c22 in Ffuncall (nargs=3, args=0xbfc150) at eval.c:2999
#100 0x00007ff750d68de2 in Fapply (nargs=2, args=0x4b94488) at eval.c:2670
#101 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=2, args=0x4b94488) at eval.c:3063
#102 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=2, args=0xbfc918) at bytecode.c:809
#103 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=128, nargs=2, args=0xbfc918) at eval.c:3085
#104 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=2,
arg_vector=0xbfc918) at eval.c:3157
#105 0x00007ff750d698ef in funcall_general (fun=..., numargs=2,
args=0xbfc918) at eval.c:2949
#106 0x00007ff750d69c22 in Ffuncall (nargs=3, args=0xbfc910) at eval.c:2999
#107 0x00007ff750d68de2 in Fapply (nargs=2, args=0x4b94448) at eval.c:2670
#108 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=2, args=0x4b94448) at eval.c:3063
#109 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=2, args=0x4b94400) at bytecode.c:809
#110 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=1025, nargs=4, args=0xbfd0d8) at eval.c:3085
#111 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=4,
arg_vector=0xbfd0d8) at eval.c:3157
#112 0x00007ff750d698ef in funcall_general (fun=..., numargs=4,
args=0xbfd0d8) at eval.c:2949
#113 0x00007ff750d69c22 in Ffuncall (nargs=5, args=0xbfd0d0) at eval.c:2999
#114 0x00007ff750d68de2 in Fapply (nargs=3, args=0x4b942d0) at eval.c:2670
#115 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=3, args=0x4b942d0) at eval.c:3063
#116 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=514,
nargs=2, args=0x4b943f8) at bytecode.c:809
#117 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=642, nargs=5, args=0xbfd8a8) at eval.c:3085
#118 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=5,
arg_vector=0xbfd8a8) at eval.c:3157
#119 0x00007ff750d698ef in funcall_general (fun=..., numargs=5,
args=0xbfd8a8) at eval.c:2949
#120 0x00007ff750d69c22 in Ffuncall (nargs=6, args=0xbfd8a0) at eval.c:2999
#121 0x00007ff750d68de2 in Fapply (nargs=3, args=0x4b94260) at eval.c:2670
#122 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=3, args=0x4b94260) at eval.c:3063
#123 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=4, args=0x4b94210) at bytecode.c:809
#124 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=0, nargs=0, args=0x4b94138) at eval.c:3085
#125 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=0,
arg_vector=0x4b94138) at eval.c:3157
#126 0x00007ff750d698ef in funcall_general (fun=..., numargs=0,
args=0x4b94138) at eval.c:2949
#127 0x00007ff750d69c22 in Ffuncall (nargs=1, args=0x4b94130) at eval.c:2999
#128 0x00007ff750d689b2 in Fapply (nargs=2, args=0x4b94130) at eval.c:2623
#129 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462e40 <Sapply>,
numargs=2, args=0x4b94130) at eval.c:3063
#130 0x00007ff750dcfac8 in exec_byte_code (fun=..., args_template=128,
nargs=0, args=0xbfeae0) at bytecode.c:809
#131 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=128, nargs=0, args=0xbfeae0) at eval.c:3085
#132 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=0,
arg_vector=0xbfeae0) at eval.c:3157
#133 0x00007ff750d698ef in funcall_general (fun=..., numargs=0,
args=0xbfeae0) at eval.c:2949
#134 0x00007ff750d69c22 in Ffuncall (nargs=1, args=0xbfead8) at eval.c:2999
#135 0x00007ff750d5ba35 in Ffuncall_interactively (nargs=1,
args=0xbfead8) at callint.c:250
#136 0x00007ff750d6a0c6 in funcall_subr (subr=0x7ff751462580
<Sfuncall_interactively>, numargs=1, args=0xbfead8) at eval.c:3063
#137 0x00007ff750d698a3 in funcall_general (fun=..., numargs=1,
args=0xbfead8) at eval.c:2945
#138 0x00007ff750d69c22 in Ffuncall (nargs=2, args=0xbfead0) at eval.c:2999
#139 0x00007ff750d689b2 in Fapply (nargs=3, args=0xbfead0) at eval.c:2623
#140 0x00007ff750d5bf05 in Fcall_interactively (function=...,
record_flag=..., keys=...) at callint.c:342
#141 0x00007ff750d69eae in funcall_subr (subr=0x7ff7514625c0
<Scall_interactively>, numargs=3, args=0x4b940a0) at eval.c:3042
#142 0x00007ff750dcfac8 in exec_byte_code (fun=...,
args_template=1025, nargs=1, args=0xbff410) at bytecode.c:809
#143 0x00007ff750d6a24a in fetch_and_exec_byte_code (fun=...,
args_template=1025, nargs=1, args=0xbff408) at eval.c:3085
#144 0x00007ff750d6a6de in funcall_lambda (fun=..., nargs=1,
arg_vector=0xbff408) at eval.c:3157
#145 0x00007ff750d698ef in funcall_general (fun=..., numargs=1,
args=0xbff408) at eval.c:2949
#146 0x00007ff750d69c22 in Ffuncall (nargs=2, args=0xbff400) at eval.c:2999
#147 0x00007ff750c71956 in call1 (fn=..., arg1=...) at lisp.h:3248
#148 0x00007ff750c75605 in command_loop_1 () at keyboard.c:1503
#149 0x00007ff750d64fc2 in internal_condition_case
(bfun=0x7ff750c74c50 <command_loop_1>, handlers=...,
hfun=0x7ff750c73e80 <cmd_error>) at eval.c:1474
#150 0x00007ff750c7479e in command_loop_2 (handlers=...) at keyboard.c:1133
#151 0x00007ff750d640ff in internal_catch (tag=...,
func=0x7ff750c74772 <command_loop_2>, arg=...) at eval.c:1197
#152 0x00007ff750c746db in command_loop () at keyboard.c:1111
#153 0x0000000000000000 in ?? ()
(gdb)

On Wed, May 22, 2024 at 8:12 AM Hannes Domani <ssbssa@yahoo.de> wrote:
>
>  Am Mittwoch, 22. Mai 2024 um 07:57:48 MESZ hat Simen Endsjø 
> <simendsjo@gmail.com> Folgendes geschrieben:
>
> > >  I think (or rather hope) it will show us some large path.
> >
> > It was a bit difficult to get it crashing as it "hung" several times 
> > instead of
> > crashing. But here is at last a crash:
> >
> >     get_volume_info: name="d:/profiles/%s"
> >     get_volume_info: name="//"
> >
> >     Thread 1 received signal SIGSEGV, Segmentation fault.
> >     [Switching to Thread 27916.0x5a7c]
> >     0x0000000000000000 in ?? ()
>
> Whoa, the result is very different from what I expected, but we found the
> culprit.
>
> @Eli
>
> Not sure where this "//" path is coming from, but parse_root() does
> not handle it correctly, it will look for 2 additional slashes after
> them for some reason (?), buf first ignore the null-delimiter with 'name++',
> before the 'while ( *name )' check:
>
>   else if (IS_DIRECTORY_SEP (name[0]) && IS_DIRECTORY_SEP (name[1]))
>     {
>       int slashes = 2;
>
>       name += 2;
>       do
>         {
>       if (IS_DIRECTORY_SEP (*name) && --slashes == 0)
>         break;
>       name++;
>     }
>       while ( *name );
>       if (IS_DIRECTORY_SEP (name[0]))
>     name++;
>     }
>
> The 'root_len' it returns to get_volume_info() then likely overflows
> 'temp' in the following strncpy() call:
>
>       strncpy (temp, name, root_len);
>
> As a quick fix I suggest changing the if() to something like:
>
>       if (!*name || (IS_DIRECTORY_SEP (*name) && --slashes == 0))
>
> Hannes