GNU bug report logs - #13262
24.3.50; crash when multibyte directory name completion.

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 13262 in the body.
You can then email your comments to 13262 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: yfb02119 <at> nifty.com
To: bug-gnu-emacs <at> gnu.org
Subject: 24.3.50; crash when multibyte directory name completion.
Date: Mon, 24 Dec 2012 10:25:30 +0900

[Message part 1 (text/plain, inline)]

I encounter Emacs crash when I try to complete directory with multibyte
name.  I attach `bt full` output.

This is my reproduce steps.
1. mkdir /tmp/aあb
2. In Emacs, M-x find-file, input '/tmp/a', then hit TAB.
   mini-buffer shows "Find file: ....//tmp/aあb/".
3. Hit return key.

GNU Emacs 24.3.50.1 (i386-mingw-nt6.1.7601)
Bzr revision: 111247 jay.p.belanger <at> gmail.com-20121216020730-iik3hbvw4uxgvugz
Windowing system distributor `Microsoft Corp.', version 6.1.7601

Important settings:
  value of $LANG: ja_JP.SJIS
  locale-coding-system: cp932
  default enable-multibyte-characters: t

[bt_full (application/octet-stream, attachment)]

Message #8 received at 13262 <at> debbugs.gnu.org (full text, mbox):

From: Stefan Monnier <monnier <at> iro.umontreal.ca>
To: yfb02119 <at> nifty.com
Cc: 13262 <at> debbugs.gnu.org
Subject: Re: bug#13262: 24.3.50;
	crash when multibyte directory name completion.
Date: Mon, 24 Dec 2012 00:10:41 -0500

> GNU Emacs 24.3.50.1 (i386-mingw-nt6.1.7601)

Thanks.  Can you reproduce this in the current pretest (24.2.91)?


        Stefan

Message #13 received at 13262-done <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Stefan Monnier <monnier <at> iro.umontreal.ca>
Cc: yfb02119 <at> nifty.com, 13262-done <at> debbugs.gnu.org
Subject: Re: bug#13262: 24.3.50;
	crash when multibyte directory name completion.
Date: Mon, 24 Dec 2012 18:21:45 +0200

> From: Stefan Monnier <monnier <at> iro.umontreal.ca>
> Date: Mon, 24 Dec 2012 00:10:41 -0500
> Cc: 13262 <at> debbugs.gnu.org
> 
> > GNU Emacs 24.3.50.1 (i386-mingw-nt6.1.7601)
> 
> Thanks.  Can you reproduce this in the current pretest (24.2.91)?

Yes, he could, until revision 111077 on the emacs-24 branch fixed that
(I think).

Sorry, the changes touch quite a few places, but they all had the same
problem: unwarranted assumptions that input Lisp strings passed to
primitives are multibyte.  The crash happened because file completion
calls directory-file-name with a unibyte string (an encoded file
name).  A similar mess was found and fixed in file-name-directory and
in expand-file-name.

Message #16 received at 13262 <at> debbugs.gnu.org (full text, mbox):

From: martin rudalics <rudalics <at> gmx.at>
To: 13262 <at> debbugs.gnu.org, eliz <at> gnu.org, yfb02119 <at> nifty.com
Subject: Re: bug#13262: 24.3.50;
	crash when multibyte directory name completion.
Date: Mon, 24 Dec 2012 19:21:10 +0100

> Sorry, the changes touch quite a few places, but they all had the same
> problem: unwarranted assumptions that input Lisp strings passed to
> primitives are multibyte.  The crash happened because file completion
> calls directory-file-name with a unibyte string (an encoded file
> name).  A similar mess was found and fixed in file-name-directory and
> in expand-file-name.

There's a crash I can reproduce easily but only randomly with my setup
and not with emacs -Q (backtrace with actual trunk).  Can it be related?

martin


Program received signal SIGSEGV, Segmentation fault.
0x0107160b in FETCH_MULTIBYTE_CHAR (pos=54295370) at buffer.h:1168
1168	  return STRING_CHAR (p);
(gdb) backtrace
#0  0x0107160b in FETCH_MULTIBYTE_CHAR (pos=54295370) at buffer.h:1168
#1  0x01140efb in handle_composition_prop (it=0x82d32c) at xdisp.c:5273
#2  0x0113d072 in handle_stop (it=0x82d32c) at xdisp.c:3253
#3  0x0114367b in reseat (it=0x82d32c, pos=..., force_p=1) at xdisp.c:6297
#4  0x0113c5ed in init_iterator (it=0x82d32c, w=0x3b2f3b0, charpos=4, bytepos=54295370, row=0x3b36000, base_face_id=DEFAULT_FACE_ID) at xdisp.c:2910
#5  0x0113c708 in start_display (it=0x82d32c, w=0x3b2f3b0, pos=...) at xdisp.c:2926
#6  0x01158363 in redisplay_window (window=62059445, just_this_one_p=1) at xdisp.c:15939
#7  0x0115332f in redisplay_window_1 (window=62059445) at xdisp.c:13888
#8  0x0100b74b in internal_condition_case_1 (bfun=0x11532f9 <redisplay_window_1>, arg=62059445, handlers=54162446, hfun=0x1153298 <redisplay_window_error>) at eval.c:1230
#9  0x01152828 in redisplay_internal () at xdisp.c:13522
#10 0x01150b01 in redisplay () at xdisp.c:12730
#11 0x01027f93 in read_char (commandflag=1, nmaps=3, maps=0x82f9b0, prev_event=54179866, used_mouse_menu=0x82fa83, end_time=0x0) at keyboard.c:2421
#12 0x01032315 in read_key_sequence (keybuf=0x82fc00, bufsize=30, prompt=54179866, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true) at keyboard.c:9232
#13 0x010264b8 in command_loop_1 () at keyboard.c:1453
#14 0x0100b663 in internal_condition_case (bfun=0x1026155 <command_loop_1>, handlers=54230186, hfun=0x1025b4b <cmd_error>) at eval.c:1192
#15 0x01025ed2 in command_loop_2 (ignore=54179866) at keyboard.c:1168
#16 0x0100b1e1 in internal_catch (tag=54220042, func=0x1025eae <command_loop_2>, arg=54179866) at eval.c:963
#17 0x01025e8e in command_loop () at keyboard.c:1147
#18 0x01025799 in recursive_edit_1 () at keyboard.c:780
#19 0x010258e8 in Frecursive_edit () at keyboard.c:844
#20 0x010027ad in main (argc=1, argv=0xa32808) at emacs.c:1573

Lisp Backtrace:
"redisplay_internal (C function)" (0x144723c)

Message #19 received at 13262 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: martin rudalics <rudalics <at> gmx.at>
Cc: yfb02119 <at> nifty.com, 13262 <at> debbugs.gnu.org
Subject: Re: bug#13262: 24.3.50;
	crash when multibyte directory name completion.
Date: Mon, 24 Dec 2012 23:20:23 +0200

> Date: Mon, 24 Dec 2012 19:21:10 +0100
> From: martin rudalics <rudalics <at> gmx.at>
> 
>  > Sorry, the changes touch quite a few places, but they all had the same
>  > problem: unwarranted assumptions that input Lisp strings passed to
>  > primitives are multibyte.  The crash happened because file completion
>  > calls directory-file-name with a unibyte string (an encoded file
>  > name).  A similar mess was found and fixed in file-name-directory and
>  > in expand-file-name.
> 
> There's a crash I can reproduce easily but only randomly with my setup
> and not with emacs -Q (backtrace with actual trunk).  Can it be related?

No.  The changes were all made in functions that manipulate file
names, not something even remotely related to redisplay.

Any chance of a recipe?  Also, what data causes the crash?

Message #22 received at 13262 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: rudalics <at> gmx.at
Cc: yfb02119 <at> nifty.com, 13262 <at> debbugs.gnu.org
Subject: Re: bug#13262: 24.3.50;
	crash when multibyte directory name completion.
Date: Mon, 24 Dec 2012 23:26:56 +0200

> Date: Mon, 24 Dec 2012 23:20:23 +0200
> From: Eli Zaretskii <eliz <at> gnu.org>
> Cc: yfb02119 <at> nifty.com, 13262 <at> debbugs.gnu.org
> 
> > Date: Mon, 24 Dec 2012 19:21:10 +0100
> > From: martin rudalics <rudalics <at> gmx.at>
> > 
> >  > Sorry, the changes touch quite a few places, but they all had the same
> >  > problem: unwarranted assumptions that input Lisp strings passed to
> >  > primitives are multibyte.  The crash happened because file completion
> >  > calls directory-file-name with a unibyte string (an encoded file
> >  > name).  A similar mess was found and fixed in file-name-directory and
> >  > in expand-file-name.
> > 
> > There's a crash I can reproduce easily but only randomly with my setup
> > and not with emacs -Q (backtrace with actual trunk).  Can it be related?
> 
> No.  The changes were all made in functions that manipulate file
> names, not something even remotely related to redisplay.
> 
> Any chance of a recipe?  Also, what data causes the crash?

Better file a new bug report, btw.

Also, does this buffer position make sense?

  Program received signal SIGSEGV, Segmentation fault.
  0x0107160b in FETCH_MULTIBYTE_CHAR (pos=54295370) at buffer.h:1168
                                      ^^^^^^^^^^^^

Were you indeed editing a 54MB buffer?

Message #25 received at 13262 <at> debbugs.gnu.org (full text, mbox):

From: martin rudalics <rudalics <at> gmx.at>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: yfb02119 <at> nifty.com, 13262 <at> debbugs.gnu.org
Subject: Re: bug#13262: 24.3.50;
	crash when multibyte directory name completion.
Date: Tue, 25 Dec 2012 19:08:10 +0100

> Any chance of a recipe?  Also, what data causes the crash?

I create a standalone minibuffer window, insert some Lisp text into it,
and scroll that window with the mouse.  After a few times the crash
happens.  Hardly a realistic scenario and so far irreproducible with
emacs -Q.  I'd have to bisect my .emacs but this will take some time.

> Better file a new bug report, btw.

I'll do that as soon as I have a presentable recipe.

> Also, does this buffer position make sense?
>
>   Program received signal SIGSEGV, Segmentation fault.
>   0x0107160b in FETCH_MULTIBYTE_CHAR (pos=54295370) at buffer.h:1168
>                                       ^^^^^^^^^^^^
>
> Were you indeed editing a 54MB buffer?

No.  There were at most a few 100 characters in the minibuffer.

martin

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.