segmentation fault in allocate_string

[Klaus Zeitler]

Symptoms:

CVS emacs (from 10/11/04) crashed with a segmentation fault.
Here's what gdb says about the core:

GNU gdb 6.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "sparc-sun-solaris2.8"...
Core was generated by `/usr/local/gnu/cvs/head/bin/emacs'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/lib/libXm.so.4...done.
Loaded symbols for /usr/lib/libXm.so.4
Reading symbols from /usr/lib/libgen.so.1...done.
Loaded symbols for /usr/lib/libgen.so.1
Reading symbols from /usr/openwin/lib/libXp.so.1...done.
Loaded symbols for /usr/openwin/lib/libXp.so.1
Reading symbols from /usr/lib/libXmu.so.4...done.
Loaded symbols for /usr/lib/libXmu.so.4
Reading symbols from /usr/lib/libXt.so.4...done.
Loaded symbols for /usr/lib/libXt.so.4
Reading symbols from /usr/lib/libSM.so.6...done.
Loaded symbols for /usr/lib/libSM.so.6
Reading symbols from /usr/lib/libICE.so.6...done.
Loaded symbols for /usr/lib/libICE.so.6
Reading symbols from /usr/lib/libXext.so.0...done.
Loaded symbols for /usr/lib/libXext.so.0
Reading symbols from /usr/local/gnu/lib/libjpeg.so.62...done.
Loaded symbols for /usr/local/gnu/lib/libjpeg.so.62
Reading symbols from /usr/local/gnu/lib/libpng12.so.0...done.
Loaded symbols for /usr/local/gnu/lib/libpng12.so.0
Reading symbols from /usr/lib/libz.so.1...done.
Loaded symbols for /usr/lib/libz.so.1
Reading symbols from /usr/lib/libm.so.1...done.
Loaded symbols for /usr/lib/libm.so.1
Reading symbols from /usr/local/gnu/lib/libXpm.so.4.11...done.
Loaded symbols for /usr/local/gnu/lib/libXpm.so.4.11
Reading symbols from /usr/lib/libX11.so.4...done.
Loaded symbols for /usr/lib/libX11.so.4
Reading symbols from /usr/lib/libsocket.so.1...done.
Loaded symbols for /usr/lib/libsocket.so.1
Reading symbols from /usr/lib/libnsl.so.1...done.
Loaded symbols for /usr/lib/libnsl.so.1
Reading symbols from /usr/lib/libkstat.so.1...done.
Loaded symbols for /usr/lib/libkstat.so.1
Reading symbols from /usr/lib/libcurses.so.1...done.
Loaded symbols for /usr/lib/libcurses.so.1
Reading symbols from /usr/lib/libc.so.1...done.
Loaded symbols for /usr/lib/libc.so.1
Reading symbols from /usr/lib/libdl.so.1...done.
Loaded symbols for /usr/lib/libdl.so.1
Reading symbols from /usr/lib/libmp.so.2...done.
Loaded symbols for /usr/lib/libmp.so.2
Reading symbols from /usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1...done.
Loaded symbols for /usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1
#0  allocate_string () at /vol/freeware/cvs/emacs/head/emacs/src/alloc.c:1584
1584      string_free_list = NEXT_FREE_LISP_STRING (s);
(gdb) bt
#0  allocate_string () at /vol/freeware/cvs/emacs/head/emacs/src/alloc.c:1584
#1  0x0013b2e4 in make_uninit_multibyte_string (nchars=21, nbytes=21)
    at /vol/freeware/cvs/emacs/head/emacs/src/alloc.c:2142
#2  0x0013b2ac in make_uninit_string (length=21)
    at /vol/freeware/cvs/emacs/head/emacs/src/alloc.c:2123
#3  0x001585e4 in concat (nargs=1, args=0xffbea8e4, target_type=Lisp_String, 
    last_special=0) at /vol/freeware/cvs/emacs/head/emacs/src/fns.c:659
#4  0x00157dfc in Fcopy_sequence (arg=8747891)
    at /vol/freeware/cvs/emacs/head/emacs/src/fns.c:527
#5  0x001279c4 in compile_pattern_1 (cp=0x31bef0, pattern=8747891, 
    translate=3231744, regp=0x0, posix=0, multibyte=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/search.c:171
#6  0x00127a90 in compile_pattern (pattern=8747891, regp=0x0, 
    translate=3313665, posix=0, multibyte=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/search.c:235
#7  0x00128108 in fast_string_match (regexp=8747891, string=9332211)
    at /vol/freeware/cvs/emacs/head/emacs/src/search.c:458
#8  0x0011568c in Ffind_file_name_handler (filename=9332211, operation=9093968)
    at /vol/freeware/cvs/emacs/head/emacs/src/fileio.c:370
#9  0x00115d94 in Fexpand_file_name (name=9332211, default_directory=3313665)
    at /vol/freeware/cvs/emacs/head/emacs/src/fileio.c:1053
#10 0x0011d55c in Fdo_auto_save (no_message=414214, current_only=3313665)
    at /vol/freeware/cvs/emacs/head/emacs/src/fileio.c:5828
#11 0x000e8b80 in shut_down_emacs (sig=11, no_x=0, stuff=3313665)
    at /vol/freeware/cvs/emacs/head/emacs/src/emacs.c:2032
#12 0x000e7198 in fatal_error_signal (sig=11)
    at /vol/freeware/cvs/emacs/head/emacs/src/emacs.c:378
#13 <signal handler called>
#14 allocate_string () at /vol/freeware/cvs/emacs/head/emacs/src/alloc.c:1584
---Type <return> to continue, or q <return> to quit--- 
#15 0x0013b2e4 in make_uninit_multibyte_string (nchars=4, nbytes=4)
    at /vol/freeware/cvs/emacs/head/emacs/src/alloc.c:2142
#16 0x0013b2ac in make_uninit_string (length=4)
    at /vol/freeware/cvs/emacs/head/emacs/src/alloc.c:2123
#17 0x001585e4 in concat (nargs=1, args=0xffbeb2ac, target_type=Lisp_String, 
    last_special=0) at /vol/freeware/cvs/emacs/head/emacs/src/fns.c:659
#18 0x00157dfc in Fcopy_sequence (arg=3768963)
    at /vol/freeware/cvs/emacs/head/emacs/src/fns.c:527
#19 0x001279c4 in compile_pattern_1 (cp=0x31bef0, pattern=3768963, 
    translate=3231744, regp=0x0, posix=0, multibyte=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/search.c:171
#20 0x00127a90 in compile_pattern (pattern=3768963, regp=0x0, 
    translate=3371012, posix=0, multibyte=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/search.c:235
#21 0x001281a4 in fast_c_string_match_ignore_case (regexp=3768963, 
    string=0x356100 "-b&h-lucida sans typewriter-medium-r-normal-sans-18-180-72-
72-m-110-iso8859-1") at /vol/freeware/cvs/emacs/head/emacs/src/search.c:488
#22 0x000caf20 in x_find_ccl_program (fontp=0x626000)
    at /vol/freeware/cvs/emacs/head/emacs/src/xterm.c:10029
#23 0x000db63c in fs_load_font (f=0x329000, c=0, 
    fontname=0x35a000 "-B&H-Lucida Sans Typewriter-Medium-R-Normal-Sans-18-180-7
2-72-M-110-ISO8859-1", id=3313665, face=0x0)
    at /vol/freeware/cvs/emacs/head/emacs/src/fontset.c:753
#24 0x000db3a4 in fontset_font_pattern (f=0xa75000, id=34, c=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/fontset.c:628
#25 0x000bbd7c in choose_face_font (f=0xa75000, attrs=0xd14148, fontset=34, 
    c=0, needs_overstrike=0xffbeb5e4)
    at /vol/freeware/cvs/emacs/head/emacs/src/xfaces.c:6786
#26 0x000b1f98 in load_face_font (f=0xa75000, face=0xd14100, c=0)
---Type <return> to continue, or q <return> to quit---
    at /vol/freeware/cvs/emacs/head/emacs/src/xfaces.c:1240
#27 0x000bc91c in realize_face (cache=0x7076c0, attrs=0xffbeb6c8, c=0, 
    base_face=0xd580a7c9, former_face_id=9146758)
    at /vol/freeware/cvs/emacs/head/emacs/src/xfaces.c:7050
#28 0x000bdda8 in face_at_string_position (w=0x0, string=7406291, 
    pos=-4278584, bufpos=0, region_beg=-712989792, region_end=9146758, 
    endptr=0xffbeb794, base_face_id=MODE_LINE_FACE_ID, mouse_p=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/xfaces.c:5594
#29 0x0005b340 in handle_face_prop (it=0xffbebc20)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:2905
#30 0x0005ac8c in handle_stop (it=0xffbebc20)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:2590
#31 0x0005f0e8 in next_element_from_string (it=0xffbebc20)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:5247
#32 0x0005e6e0 in get_next_display_element (it=0xffbebc20)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:4837
#33 0x00073a54 in display_string (string=0x329001 "", lisp_string=0, 
    face_string=3313665, face_string_pos=0, start=0, it=0xffbebc20, 
    field_width=0, precision=3, max_x=0, multibyte=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:16758
#34 0x00071d20 in display_mode_element (it=0xffbebc20, depth=5, 
    field_width=-9, precision=-9, elt=7406291, props=3313665, risky=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:15474
#35 0x00071950 in display_mode_element (it=0xffbebc20, depth=4, 
    field_width=-9, precision=-9, elt=5403416, props=3313665, risky=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:15699
#36 0x00071950 in display_mode_element (it=0xffbebc20, depth=2, 
    field_width=-4, precision=-4, elt=5403528, props=3313665, risky=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:15699
---Type <return> to continue, or q <return> to quit---
#37 0x00071950 in display_mode_element (it=0xffbebc20, depth=1, field_width=0, 
    precision=0, elt=9980432, props=3313665, risky=0)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:15699
#38 0x00071584 in display_mode_line (w=0x1, face_id=MODE_LINE_FACE_ID, 
    format=9980421) at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:15278
#39 0x00058378 in pos_visible_p (w=0xc79a00, charpos=706, fully=0xffbec3dc, 
    x=0xffbec3d8, y=0xffbec3d4, exact_mode_line_heights_p=3222528)
    at /vol/freeware/cvs/emacs/head/emacs/src/xdisp.c:1262
#40 0x00086a18 in Fpos_visible_in_window_p (pos=5648, window=13081088, 
    partially=3313665) at /vol/freeware/cvs/emacs/head/emacs/src/window.c:369
#41 0x00153954 in Ffuncall (nargs=1, args=0xffbec4f8)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2743
#42 0x0017f7bc in Fbyte_code (bytestr=-4274952, vector=10311428, maxdepth=24)
    at /vol/freeware/cvs/emacs/head/emacs/src/bytecode.c:686
#43 0x00153ce0 in funcall_lambda (fun=9559076, nargs=4, arg_vector=0xffbec6a4)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2923
#44 0x001537ec in Ffuncall (nargs=4, args=0xffbec6a0)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2793
#45 0x0017f7bc in Fbyte_code (bytestr=-4274528, vector=10305540, maxdepth=72)
    at /vol/freeware/cvs/emacs/head/emacs/src/bytecode.c:686
#46 0x00153ce0 in funcall_lambda (fun=9345316, nargs=1, arg_vector=0xffbec864)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2923
#47 0x001537ec in Ffuncall (nargs=1, args=0xffbec860)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2793
#48 0x0017f7bc in Fbyte_code (bytestr=-4274080, vector=9957636, maxdepth=40)
    at /vol/freeware/cvs/emacs/head/emacs/src/bytecode.c:686
#49 0x00153ce0 in funcall_lambda (fun=8905828, nargs=1, arg_vector=0xffbeca14)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2923
#50 0x001537ec in Ffuncall (nargs=1, args=0xffbeca10)
---Type <return> to continue, or q <return> to quit---
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2793
#51 0x0017f7bc in Fbyte_code (bytestr=-4273648, vector=7390084, maxdepth=16)
    at /vol/freeware/cvs/emacs/head/emacs/src/bytecode.c:686
#52 0x00153ce0 in funcall_lambda (fun=7364260, nargs=1, arg_vector=0xffbecbb4)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2923
#53 0x001537ec in Ffuncall (nargs=1, args=0xffbecbb0)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2793
#54 0x0017f7bc in Fbyte_code (bytestr=-4273232, vector=10307844, maxdepth=32)
    at /vol/freeware/cvs/emacs/head/emacs/src/bytecode.c:686
#55 0x00153ce0 in funcall_lambda (fun=9558404, nargs=1, arg_vector=0xffbecd7c)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2923
#56 0x001537ec in Ffuncall (nargs=1, args=0xffbecd78)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:2793
#57 0x0014f144 in Fcall_interactively (function=9679329, record_flag=3313665, 
    keys=3391492) at /vol/freeware/cvs/emacs/head/emacs/src/callint.c:863
#58 0x000f72d0 in Fcommand_execute (cmd=9679329, record_flag=3313665, 
    keys=3313665, special=9558404)
    at /vol/freeware/cvs/emacs/head/emacs/src/keyboard.c:9724
#59 0x000ea508 in command_loop_1 ()
    at /vol/freeware/cvs/emacs/head/emacs/src/keyboard.c:1779
#60 0x00151b58 in internal_condition_case (bfun=0xea0a0 <command_loop_1>, 
    handlers=3398209, hfun=0xe9ac8 <cmd_error>)
    at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:1346
#61 0x000e9e5c in command_loop_2 ()
    at /vol/freeware/cvs/emacs/head/emacs/src/keyboard.c:1309
#62 0x0015169c in internal_catch (tag=3387329, func=0xe9e38 <command_loop_2>, 
    arg=3313665) at /vol/freeware/cvs/emacs/head/emacs/src/eval.c:1107
#63 0x000e9de8 in command_loop ()
    at /vol/freeware/cvs/emacs/head/emacs/src/keyboard.c:1288
---Type <return> to continue, or q <return> to quit---
#64 0x000e9804 in recursive_edit_1 ()
    at /vol/freeware/cvs/emacs/head/emacs/src/keyboard.c:981
#65 0x000e9960 in Frecursive_edit ()
    at /vol/freeware/cvs/emacs/head/emacs/src/keyboard.c:1042
#66 0x000e8698 in main (argc=0, argv=0xffbed4fc)
    at /vol/freeware/cvs/emacs/head/emacs/src/emacs.c:1687
(gdb) 
(gdb) p s
$1 = (struct Lisp_String *) 0xc8



In GNU Emacs 21.3.50.13 (sparc-sun-solaris2.8, Motif Version 2.1.0)
 of 2004-10-11 on sfsws4
configured using `configure '--with-gcc' 
'--prefix=/vol/freeware/SunOS-5.8/emacs/cvs' 
'--sharedstatedir=/vol/freeware/SunOS-5.8/emacs/cvs/share' 
'--with-x-toolkit=motif' 
'--x-includes=/usr/openwin/include:/usr/local/gnu/include' 
'--x-libraries=/usr/openwin/lib:/usr/local/gnu/lib' '--with-pop' 'CC=gcc''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: C
  locale-coding-system: nil
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  line-number-mode: t

Recent input:
<down-mouse-1> <mouse-1> <prior> <help-echo> <help-echo> 
<menu-bar> <help-menu> <report-emacs-bug>

Recent messages:
Loading mwheel...done
(/usr/local/gnu/cvs/head/bin/emacs -q --no-site-file)
Loading tool-bar...done
Loading image...done
Loading tooltip...done
For information about the GNU Project and its goals, type C-h C-p.
call-interactively: Beginning of buffer
Loading emacsbug...done