Crash in gc_sweep (SIGH!)

[Kim F. Storm]

Following my last bug report on W32 display error, I noticed that
the image didn't get through.  So I tried various stuff to decode 
the base64 stuff in various ways like this:

- copy it to a new file buffer named x.gif, mark it, do base64-decode-region, 
  and C-c C-c to view the image  (no luck!)

- create new file buffer y.gif, set file coding system to binary, copy image
data into it, base64 decode it and C-c C-c  (no luck)

- went back to another version of the message (not the one I sent to
  the list) where the image was displayed properly, and tried to save
  that in a file:

- copy mime part (I'm using Gnus) with K o into file buffer z.gif, and
do C-c C-c  (definitely no luck, as it was the text part of the message
rather than the image part of the buffer that was copied.

- instructed Gnus to show the Mime buttons in the message buffer, and
use that to save the image to a file, opened the file, and this time
the image was shown alright.

I then quit the mail group in Gnus, and it decided to Expire some old
messages, but Emacs crashed doing so...

So whether it was the base64 stuff, the displaying of bad GIF image data,
or the Gnus expire that triggered the bug, I don't know.


Program received signal SIGSEGV, Segmentation fault.
0x08176dd6 in mem_find (start=0x905b1d0) at alloc.c:3601
3601      while (start < p->start || start >= p->end)
(gdb) bt
#0  0x08176dd6 in mem_find (start=0x905b1d0) at alloc.c:3601
#1  0x08174653 in lisp_free (block=0x905b1d0) at alloc.c:893
#2  0x0817a746 in gc_sweep () at alloc.c:6259
#3  0x08178c35 in Fgarbage_collect () at alloc.c:5253
#4  0x0819354e in Ffuncall (nargs=2, args=0xbfffcf30) at eval.c:2931
#5  0x081c7785 in Fbyte_code (bytestr=144394627, vector=144401828, maxdepth=64)
    at bytecode.c:679
#6  0x08193e43 in funcall_lambda (fun=144402116, nargs=1,
    arg_vector=0xbfffd140) at eval.c:3184
#7  0x0819395b in Ffuncall (nargs=2, args=0xbfffd13c) at eval.c:3043
#8  0x081c7785 in Fbyte_code (bytestr=144507739, vector=144545372, maxdepth=40)
    at bytecode.c:679
#9  0x08193e43 in funcall_lambda (fun=144545908, nargs=1,
    arg_vector=0xbfffd334) at eval.c:3184
#10 0x0819395b in Ffuncall (nargs=2, args=0xbfffd330) at eval.c:3043
#11 0x081c7785 in Fbyte_code (bytestr=145600651, vector=145603460, maxdepth=32)
    at bytecode.c:679
#12 0x08193e43 in funcall_lambda (fun=145603620, nargs=0,
    arg_vector=0xbfffd524) at eval.c:3184
#13 0x0819395b in Ffuncall (nargs=1, args=0xbfffd520) at eval.c:3043
#14 0x081c7785 in Fbyte_code (bytestr=145636427, vector=146060396, maxdepth=40)
    at bytecode.c:679
#15 0x08193e43 in funcall_lambda (fun=145848164, nargs=0,
    arg_vector=0xbfffd754) at eval.c:3184
#16 0x0819395b in Ffuncall (nargs=1, args=0xbfffd750) at eval.c:3043
#17 0x0819336e in apply1 (fn=141970785, arg=137822897) at eval.c:2738
#18 0x0818dc80 in Fcall_interactively (function=141970785,
    record_flag=137822897, keys=137864212) at callint.c:406
#19 0x08124853 in Fcommand_execute (cmd=141970785, record_flag=137822897,
    keys=137822897, special=137822897) at keyboard.c:10036
#20 0x08117a13 in command_loop_1 () at keyboard.c:1873
#21 0x0819153d in internal_condition_case (bfun=0x8116628 <command_loop_1>,
    handlers=137868353, hfun=0x811600a <cmd_error>) at eval.c:1481
#22 0x08116384 in command_loop_2 () at keyboard.c:1329
#23 0x08190fcc in internal_catch (tag=137861537,
    func=0x8116365 <command_loop_2>, arg=137822897) at eval.c:1222
#24 0x08116337 in command_loop () at keyboard.c:1308
#25 0x08115d9b in recursive_edit_1 () at keyboard.c:1006
#26 0x08115eca in Frecursive_edit () at keyboard.c:1067
#27 0x081147d9 in main (argc=3, argv=0xbfffe024) at emacs.c:1762
#28 0x42015574 in __libc_start_main () from /lib/tls/libc.so.6

Lisp Backtrace:
"gnus-find-method-for-group" (0x8d97203)
"gnus-virtual-group-p" (0x8d97203)
"gnus-cache-possibly-remove-articles" (0x87aaae1)
"gnus-summary-exit" (0x83702b1)
"call-interactively" (0x8764d61)
(gdb) up
#1  0x08174653 in lisp_free (block=0x905b1d0) at alloc.c:893
893       mem_delete (mem_find (block));
(gdb) up
#2  0x0817a746 in gc_sweep () at alloc.c:6259
6259              lisp_free (vector);
(gdb) list
6254              if (prev)
6255                prev->next = vector->next;
6256              else
6257                all_vectors = vector->next;
6258              next = vector->next;
6259              lisp_free (vector);
6260              n_vectors--;
6261              vector = next;
6262
6263            }
(gdb) p vector
$1 = (struct Lisp_Vector *) 0x905b1d0
(gdb) p *vector
$2 = {
  size = 149540320,
  next = 0x8960770,
  contents = {1192}
}
(gdb) p n_vectors
$16 = 28862
(gdb) p prev
$17 = (struct Lisp_Vector *) 0x962eed0
(gdb) p *prev
$18 = {
  size = 120,
  next = 0x8960770,
  contents = {137822945}
}
(gdb) p prev->contents[0]
$19 = 137822945
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$20 = (struct Lisp_Symbol *) 0x83702e0
"t"
(gdb) p *vector
$21 = {
  size = 149540320,
  next = 0x8960770,
  contents = {1192}
}
(gdb) p/x vector->size
$22 = 0x8e9cde0
(gdb) xtype
Lisp_Int
(gdb) xint
$23 = 18692540
(gdb) p next
$24 = (struct Lisp_Vector *) 0x8960770
(gdb) p *next
$25 = {
  size = 1,
  next = 0x8de3508,
  contents = {1184}
}
(gdb)

(gdb) up
#3  0x08178c35 in Fgarbage_collect () at alloc.c:5253
5253      gc_sweep ();


(gdb)

#0  0x08176dd6 in mem_find (start=0x905b1d0) at alloc.c:3601
3601      while (start < p->start || start >= p->end)
(gdb) p p
$3 = (struct mem_node *) 0x0
(gdb) list
3596      /* Make the search always successful to speed up the loop below.  */
3597      mem_z.start = start;
3598      mem_z.end = (char *) start + 1;
3599
3600      p = mem_root;
3601      while (start < p->start || start >= p->end)
3602        p = start < p->start ? p->left : p->right;
3603      return p;
3604    }
3605
(gdb) p start
$4 = (void *) 0x905b1d0
(gdb) p mem_root
$5 = (struct mem_node *) 0x84d9868
(gdb) p mem_z
$6 = {
  left = 0x8358884,
  right = 0x8358884,
  parent = 0x8fa4638,
  start = 0x905b1d0,
  end = 0x905b1d1,
  color = MEM_BLACK,
  type = MEM_TYPE_NON_LISP
}
(gdb) p *mem_root
$7 = {
  left = 0x84ad388,
  right = 0x8b771b8,
  parent = 0x0,
  start = 0x84d9848,
  end = 0x84d9864,
  color = MEM_BLACK,
  type = MEM_TYPE_VECTOR
}
(gdb) p *mem_root->right
$8 = {
  left = 0x89970b8,
  right = 0x8c05ef8,
  parent = 0x84d9868,
  start = 0x8b795f0,
  end = 0x8b799e4,
  color = MEM_BLACK,
  type = MEM_TYPE_STRING
}
(gdb) p *mem_root->right->right
$9 = {
  left = 0x8c06ff8,
  right = 0x8f545f8,
  parent = 0x8b771b8,
  start = 0x8d07140,
  end = 0x8d07534,
  color = MEM_BLACK,
  type = MEM_TYPE_SYMBOL
}
(gdb) p *mem_root->right->right->right
$10 = {
  left = 0x8dd2118,
  right = 0x90b48f8,
  parent = 0x8c05ef8,
  start = 0x8f545d8,
  end = 0x8f545f4,
  color = MEM_BLACK,
  type = MEM_TYPE_VECTOR
}
(gdb) p *mem_root->right->right->right->right
$11 = {
  left = 0x8ff0210,
  right = 0x92481b8,
  parent = 0x8f545f8,
  start = 0x90a6c00,
  end = 0x90a6ffc,
  color = MEM_RED,
  type = MEM_TYPE_CONS
}
(gdb) p *mem_root->right->right->right->right->right
$12 = {
  left = 0x9178578,
  right = 0x950d2a8,
  parent = 0x90b48f8,
  start = 0x924fa78,
  end = 0x924faa0,
  color = MEM_BLACK,
  type = MEM_TYPE_VECTOR
}
(gdb) p start
$13 = (void *) 0x905b1d0
(gdb) p *mem_root->right->right->right->right
$14 = {
  left = 0x8ff0210,
  right = 0x92481b8,
  parent = 0x8f545f8,
  start = 0x90a6c00,
  end = 0x90a6ffc,
  color = MEM_RED,
  type = MEM_TYPE_CONS
}
(gdb) p *mem_root->right->right->right->right->left
$15 = {
  left = 0x8fb20b8,
  right = 0x905e778,
  parent = 0x90b48f8,
  start = 0x8ff0230,
  end = 0x8ff0248,
  color = MEM_BLACK,
  type = MEM_TYPE_VECTOR
}



In GNU Emacs 22.0.97.4 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2007-04-08 on kfs-l.imdomain.dk
Windowing system distributor `The XFree86 Project, Inc', version 11.0.40300000
configured using `configure  'CFLAGS=-g -O0''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8
  default-enable-multibyte-characters: t

Major mode: Summary

Minor modes in effect:
  display-time-mode: t
  cua-mode: t
  tooltip-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t


-- 
Kim F. Storm  <address@hidden>      http://www.cua.dk