Emacs crashes when selecting certain articles while in gnus summary buffer

[Peter Lee]

This bug report will be sent to the Free Software Foundation,
not to your local site managers!
Please write in English if possible, because the Emacs maintainers
usually do not have translators to read other languages for them.

Your bug report will be posted to the address@hidden mailing list.

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

=====================================================================

Certain articles I select while in Gnus summary buffer causes Emacs
to crash.  It happens every time I try to view the article:

"3d scene generation - Timothy Brady", in
comp.os.ms-windows.programmer.win32.

When I select that article, I see in the minibuffer "loading
uudecode" and then it crashes.

I built a debug version and attached a debugger... the following is
what I thought would be useful.  If you need more info just let me
know.  Below is the disassembled function, the registers, and the
stack at the time of the crash.  

The parms passed in were:
int spec=0x00000000, int key=0x213bc688, int * found=0x00000000

=====================================================================

static Lisp_Object
image_spec_value (spec, key, found)
     Lisp_Object spec, key;
     int *found;
{
010D806D  push        ebp  
010D806E  mov         ebp,esp 
  Lisp_Object tail;
    
  xassert (valid_image_p (spec));

  for (tail = XCDR (spec);
       CONSP (tail) && CONSP (XCDR (tail));
       tail = XCDR (XCDR (tail)))
010D8070  mov         ecx,dword ptr [ebp+8] 
010D8073  push        ebx  
010D8074  push        esi  
010D8075  mov         eax,1FFFFFFFh 
010D807A  and         ecx,eax 
010D807C  push        edi  
010D807D  mov         edi,dword ptr [ecx+4]  <<==== *** CRASH ***
010D8080  mov         ecx,edi 
010D8082  mov         esi,0E0000000h 
010D8087  and         ecx,esi 
010D8089  mov         edx,0A0000000h 
010D808E  cmp         ecx,edx 
010D8090  jne         image_spec_value+64h (10D80D1h) 
010D8092  mov         ecx,edi 
010D8094  and         ecx,eax 
010D8096  mov         dword ptr [spec],ecx 
010D8099  mov         ecx,dword ptr [ecx+4] 
010D809C  mov         ebx,ecx 
010D809E  and         ebx,esi 
010D80A0  cmp         ebx,edx 
010D80A2  jne         image_spec_value+64h (10D80D1h) 
    {
      if (EQ (XCAR (tail), key))
010D80A4  mov         ebx,dword ptr [spec] 
010D80A7  mov         ebx,dword ptr [ebx] 
010D80A9  cmp         ebx,dword ptr [key] 
010D80AC  je          image_spec_value+4Ch (10D80B9h) 
010D80AE  and         ecx,eax 
010D80B0  mov         edi,dword ptr [ecx+4] 
010D80B3  mov         ecx,edi 
010D80B5  and         ecx,esi 
010D80B7  jmp         image_spec_value+21h (10D808Eh) 
        {
          if (found)
010D80B9  mov         ecx,dword ptr [found] 
010D80BC  test        ecx,ecx 
010D80BE  je          image_spec_value+59h (10D80C6h) 
            *found = 1;
010D80C0  mov         dword ptr [ecx],1 
          return XCAR (XCDR (tail));
010D80C6  and         edi,eax 
010D80C8  mov         ecx,dword ptr [edi+4] 
010D80CB  and         ecx,eax 
010D80CD  mov         eax,dword ptr [ecx] 
010D80CF  jmp         image_spec_value+73h (10D80E0h) 
        }
    }

  if (found)
010D80D1  mov         eax,dword ptr [found] 
010D80D4  test        eax,eax 
010D80D6  je          image_spec_value+6Eh (10D80DBh) 
    *found = 0;
010D80D8  and         dword ptr [eax],0 
  return Qnil;
010D80DB  mov         eax,dword ptr [_Qnil (1104BB0h)] 
010D80E0  pop         edi  
010D80E1  pop         esi  
010D80E2  pop         ebx  
}
010D80E3  pop         ebp  
010D80E4  ret              

Registers:

EAX = 1FFFFFFF EBX = 0082EF18 
ECX = 00000000 EDX = A0000000 
ESI = 00FB6E88 EDI = E0000000 
EIP = 010D807D ESP = 0082EF48 
EBP = 0082EF54 EFL = 00000246 

Stack:

>       emacs.exe!image_spec_value(int spec=0x00000000, int key=0x213bc688, int 
> * found=0x00000000)  Line 7268 + 0xd    C
        emacs.exe!lookup_image(frame * f=0x0166fa00, int spec=0xa2a37a60)  Line 
7998 + 0x10     C
        emacs.exe!Fimage_size(int spec=0xa2a37a60, int pixels=0x213bc400, int 
frame=0x213bc400)  Line 7299 + 0xb        C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082efec)  Line 
2737      C
        emacs.exe!Fbyte_code(int bytestr=0x0176e088, int vector=0x8176e080, int 
maxdepth=0x00000003)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x816c0e60, int nargs=0x00000001, int 
* arg_vector=0x0082f0a4)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f0a4)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x016c0d48, int vector=0x816c0d40, int 
maxdepth=0x00000002)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x816c0cc0, int nargs=0x00000002, int 
* arg_vector=0x0082f120)  Line 2917 + 0x11       C
        emacs.exe!apply_lambda(int fun=0x816c0cc0, int args=0x213bc400, int 
eval_flag=0x00000001)  Line 2840    C
        emacs.exe!Feval(int form=0x80000000)  Line 2138 + 0xb   C
        emacs.exe!Fprogn(int args=0xa159a5b0)  Line 409 C
        emacs.exe!funcall_lambda(int fun=0xa159a640, int nargs=0x00000001, int 
* arg_vector=0x0082f238)  Line 2908 + 0x15       C
        emacs.exe!Ffuncall(int nargs=0xa0000000, int * args=0x0082f238)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01783808, int vector=0x81783800, int 
maxdepth=0x00000004)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x8175c780, int nargs=0x00000001, int 
* arg_vector=0x0082f2f4)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f2f4)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01c44d08, int vector=0x81c44d00, int 
maxdepth=0xffffffff)  Line 691  C
        emacs.exe!Feval(int form=0x0082f364)  Line 2088 C
        emacs.exe!internal_catch(int tag=0x2140de88, int (void)* 
func=0x010b97c9, int arg=0xa1c38288)  Line 1094 + 0x6  C
        emacs.exe!Fbyte_code(int bytestr=0x01c2e188, int vector=0x81c2e180, int 
maxdepth=0xffffffff)  Line 852 + 0x10   C
        emacs.exe!funcall_lambda(int fun=0x81c455c0, int nargs=0x00000001, int 
* arg_vector=0x0082f4f4)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f4f4)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01c37908, int vector=0x81c37900, int 
maxdepth=0x00000006)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81c45820, int nargs=0x00000001, int 
* arg_vector=0x0082f5b8)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f5b8)  Line 
2785 + 0xc        C
        emacs.exe!call1(int fn=0x21c43cf0, int arg1=0xa1e29978)  Line 2518 + 
0xb        C
        emacs.exe!mapcar1()  Line 2965 + 0xf    C
        emacs.exe!Fmapcar(int function=0x21c43cf0, int sequence=0xa1e298c8)  
Line 3027  C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f650)  Line 
2732 + 0x8        C
        emacs.exe!Fbyte_code(int bytestr=0x01c45728, int vector=0x81c45720, int 
maxdepth=0x00000003)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81c456a0, int nargs=0x00000001, int 
* arg_vector=0x0082f708)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f708)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01c37908, int vector=0x81c37900, int 
maxdepth=0x00000006)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81c45820, int nargs=0x00000001, int 
* arg_vector=0x0082f7cc)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f7cc)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01c44e08, int vector=0x81c44e00, int 
maxdepth=0x00000005)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81c458e0, int nargs=0x00000000, int 
* arg_vector=0x0082f88c)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f88c)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01c2e408, int vector=0x81c2e400, int 
maxdepth=0x00000003)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81c3f880, int nargs=0x00000000, int 
* arg_vector=0x0082f944)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082f944)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01c36c08, int vector=0x81c36c00, int 
maxdepth=0xffffffff)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81c3f920, int nargs=0x00000002, int 
* arg_vector=0x0082fa00)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082fa00)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01bc9008, int vector=0x81bc9000, int 
maxdepth=0x00000004)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81bc08c0, int nargs=0x00000002, int 
* arg_vector=0x0082fabc)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082fabc)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01bc5b08, int vector=0x81bc5b00, int 
maxdepth=0x00000004)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81bc0780, int nargs=0x00000003, int 
* arg_vector=0x0082fb78)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082fb78)  Line 
2785 + 0xc        C
        emacs.exe!Fbyte_code(int bytestr=0x01bc9e88, int vector=0x81bc9e80, int 
maxdepth=0x00000004)  Line 691  C
        emacs.exe!funcall_lambda(int fun=0x81bcade0, int nargs=0x00000001, int 
* arg_vector=0x0082fc54)  Line 2917 + 0x11       C
        emacs.exe!Ffuncall(int nargs=0x80000000, int * args=0x0082fc54)  Line 
2785 + 0xc        C
        emacs.exe!Fcall_interactively(int function=0x21b9dfc0, int 
record_flag=0x213bc400, int keys=0x813b6c00)  Line 872       C
        emacs.exe!Fcommand_execute(int cmd=0x21b9dfc0, int 
record_flag=0x213bc400, int keys=0x213bc400, int special=0x80000000)  Line 9629 
     C
        emacs.exe!command_loop_1()  Line 1727 + 0x9     C
        emacs.exe!internal_condition_case(int (void)* bfun=0x0100e4b2, int 
handlers=0x213d2e10, int (void)* hfun=0x0100e146)  Line 1334 C
        emacs.exe!command_loop_2()  Line 1260 + 0x15    C
        emacs.exe!internal_catch(int tag=0x213d13c0, int (void)* 
func=0x0100e3ba, int arg=0x213bc400)  Line 1094 + 0x6  C
        emacs.exe!command_loop()  Line 1244     C
        emacs.exe!recursive_edit_1()  Line 959 + 0x5    C
        emacs.exe!Frecursive_edit()  Line 1016  C
        emacs.exe!main()  Line 1666 + 0x5       C
        emacs.exe!_mainCRTStartup()  + 0xb4     
        kernel32.dll!GetCurrentDirectoryW()  + 0x44     


=====================================================================

In GNU Emacs 21.3.50.1 (i386-msvc-nt5.1.2600)
 of 2004-02-09 on PONGMASTER
configured using `configure --with-msvc (12.00) --cflags -Ie:/gnuwin32/include 
--ldflags /LIBPATH:e:/gnuwin32/lib'

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: ENU
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Major mode: Info

Minor modes in effect:
  iswitchb-mode: t
  display-time-mode: t
  which-function-mode: t
  show-paren-mode: t
  global-auto-revert-mode: t
  cua-mode: t
  mouse-wheel-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  unify-8859-on-encoding-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-n M-b M-b M-b M-b M-b M-b M-b M-b M-b C-SPC SPC C-_ 
M-v C-SPC M-f M-f M-f M-b M-b M-b C-SPC M-f M-f M-f 
M-f M-f M-w C-a C-n C-n C-n C-n C-n C-n C-n C-n C-n 
C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n 
C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n 
C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n 
C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n C-n M-x 
r e p o r t SPC e m <return>

Recent messages:
Loading vc-cvs...done
Composing main Info directory...
Mark set
Composing main Info directory...done
End of buffer
Mark set
Buffer is read-only: #<buffer *info*>
Mark Cleared
Mark activated
Loading emacsbug...done