Crash in gc_sweep

[Kim F. Storm]

I was editing a medium size buffer, which I had recently pasted into
from the clipboard with mouse-2.

While doing this, I did this:

M-: (define-key [?ø] (lamdba () (interactive) (insert "|"))) RET

I hit ø, and got an error  -- wrong number of args

While still in the debugger, I corrected the first mistake:

C-x ESC ESC 
Redo: ... (define-key global-map [?ø] (lamdba () (interactive) (insert "|"))) 
RET

I hit ø again, and got an error -- unknown command.

I exited the debugger and corrected the second mistake

C-x ESC ESC 
Redo: ... (define-key global-map [?ø] (lambda () (interactive) (insert "|"))) 
RET

I now hit ø and got the expected | inserted in the buffer.

And emacs crashed...


Program received signal SIGSEGV, Segmentation fault.
0x081754c8 in gc_sweep () at alloc.c:6161
6161          if (!VECTOR_MARKED_P (vector))
(gdb) bt
#0  0x081754c8 in gc_sweep () at alloc.c:6161
#1  0x08173a09 in Fgarbage_collect () at alloc.c:5166
#2  0x0818e162 in Ffuncall (nargs=2, args=0xbffff070) at eval.c:2817
#3  0x0818dff0 in call1 (fn=137936913, arg1=137906097) at eval.c:2668
#4  0x08114b83 in safe_run_hooks_1 (hook=157606876) at keyboard.c:2036
#5  0x0818c274 in internal_condition_case (bfun=0x8114b69 <safe_run_hooks_1>,
    handlers=137869481, hfun=0x8114b88 <safe_run_hooks_error>) at eval.c:1465
#6  0x08114c1e in safe_run_hooks (hook=137906097) at keyboard.c:2064
#7  0x08113085 in command_loop_1 () at keyboard.c:1623
#8  0x0818c274 in internal_condition_case (bfun=0x8112af7 <command_loop_1>,
    handlers=137914073, hfun=0x811263c <cmd_error>) at eval.c:1465
#9  0x0811296f in command_loop_2 () at keyboard.c:1328
#10 0x0818bcf2 in internal_catch (tag=137910305,
    func=0x8112950 <command_loop_2>, arg=137869433) at eval.c:1211
#11 0x08112922 in command_loop () at keyboard.c:1307
#12 0x081123bb in recursive_edit_1 () at keyboard.c:1000
#13 0x081124fc in Frecursive_edit () at keyboard.c:1061
#14 0x08110df9 in main (argc=3, argv=0xbffff8a4) at emacs.c:1789
#15 0x42015574 in __libc_start_main () from /lib/tls/libc.so.6
(gdb) xba
(gdb) p vector
$1 = (struct Lisp_Vector *) 0x11
(gdb) up
#1  0x08173a09 in Fgarbage_collect () at alloc.c:5166
5166      gc_sweep ();
(gdb) do
#0  0x081754c8 in gc_sweep () at alloc.c:6161
6161          if (!VECTOR_MARKED_P (vector))
(gdb) list
6156      {
6157        register struct Lisp_Vector *vector = all_vectors, *prev = 0, *next;
6158        total_vector_size = 0;
6159
6160        while (vector)
6161          if (!VECTOR_MARKED_P (vector))
6162            {
6163              if (prev)
6164                prev->next = vector->next;
6165              else


The prev pointer can give us a clue...

(gdb) p prev
$273 = (struct Lisp_Vector *) 0x8a167e0
(gdb) p *$
$274 = {
  size = 1073743876,
  next = 0x11,
  contents = {144824549}
}
(gdb) p/x *$273
$275 = {
  size = 0x40000804,
  next = 0x11,
  contents = {0x8a1d8e5}
}

The contents is a list with all nils: (nil nil nil . nil)

(gdb) p 0x8a1d1e5
$279 = 144822757
(gdb) xtype
Lisp_Cons
(gdb) xcons
$280 = (struct Lisp_Cons *) 0x8a1d1e0
{
  car = 0x837b879,
  u = {
    cdr = 0x8a1d1dd,
    chain = 0x8a1d1dd
  }
}
(gdb) p->car
$281 = 137869433
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$282 = (struct Lisp_Symbol *) 0x837b878
"nil"
(gdb) p 0x8a1d1dd
$283 = 144822749
(gdb) xtype
Lisp_Cons
(gdb) xcons
$284 = (struct Lisp_Cons *) 0x8a1d1d8
{
  car = 0x837b879,
  u = {
    cdr = 0x8a1d1d5,
    chain = 0x8a1d1d5
  }
}
(gdb) p $->car
$285 = 137869433
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$286 = (struct Lisp_Symbol *) 0x837b878
"nil"
(gdb) p 0x8a1d1d5
$289 = 144822741
(gdb) xtype
Lisp_Cons
(gdb) xcons
$290 = (struct Lisp_Cons *) 0x8a1d1d0
{
  car = 0x837b879,
  u = {
    cdr = 0x837b879,
    chain = 0x837b879
  }
}
(gdb)

The last objects marked are t and nil:

(gdb) p last_marked_index
$267 = 406
(gdb) p last_marked[405]
$291 = 137869481
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$292 = (struct Lisp_Symbol *) 0x837b8a8
"t"
(gdb) p last_marked[404]
$293 = 137869433
(gdb) xtype
Lisp_Symbol
(gdb) xsymbol
$294 = (struct Lisp_Symbol *) 0x837b878
"nil"
(gdb) p last_marked[403]
$295 = 137869433
(gdb) p last_marked[402]
$296 = 137869481
(gdb) p last_marked[401]
$297 = 137869481
(gdb) p last_marked[400]
$298 = 137869481
.. and it continues like that for several more elements

.. until I get to the prompt - (or mini-buffer text?) where I repeated the
complex command

(gdb) p last_marked[380]
$318 = 157924317
(gdb) xtype
Lisp_Cons
(gdb) xcons
$319 = (struct Lisp_Cons *) 0x969bbd8
{
  car = 0x969bbd5,
  u = {
    cdr = 0x969bbcd,
    chain = 0x969bbcd
  }
}
(gdb) p $->car
$320 = 157924309
(gdb) xtype
Lisp_Cons
(gdb) xcons
$321 = (struct Lisp_Cons *) 0x969bbd0
{
  car = 0x86ccf8b,
  u = {
    cdr = 0x8,
    chain = 0x8
  }
}
(gdb) p $->car
$322 = 141348747
(gdb) xtype
Lisp_String
(gdb) xstring
$323 = (struct Lisp_String *) 0x86ccf88
"Redo: (eval-expression (quote (define-key global-map [2296] (function (lambda 
nil (interactive) (insert \"|\"))))) nil)"
(gdb)


(gdb) p handling_signal
$276 = 0



In GNU Emacs 22.0.50.66 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2006-03-06 on kfs-l.imdomain.dk
X server distributor `The XFree86 Project, Inc', version 11.0.40300000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8
  default-enable-multibyte-characters: t

Minor modes in effect:
  gnus-topic-mode: t
  gnus-undo-mode: t
  cua-mode: t
  display-time-mode: t
  tooltip-mode: t
  auto-compression-mode: t
  tool-bar-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  line-number-mode: t
  transient-mark-mode: t

-- 
Kim F. Storm  <address@hidden>      http://www.cua.dk