GNU bug report logs - #9495
24.0.50; Segfault in try_cursor_movement

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 9495 in the body.
You can then email your comments to 9495 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Johan Bockgård <bojohan <at> gnu.org>
To: bug-gnu-emacs <at> gnu.org
Subject: 24.0.50; Segfault in try_cursor_movement
Date: Tue, 13 Sep 2011 21:28:17 +0200

Program terminated with signal 11, Segmentation fault.
#0  0x00007f5bccbe6fe7 in kill () at ../sysdeps/unix/syscall-template.S:82
82      ../sysdeps/unix/syscall-template.S: No such file or directory.
        in ../sysdeps/unix/syscall-template.S
(gdb) bt
#0  0x00007f5bccbe6fe7 in kill () at ../sysdeps/unix/syscall-template.S:82
#1  0x000000000056e889 in fatal_error_signal (sig=11) at emacs.c:358
#2  <signal handler called>
#3  0x0000000000465f3f in try_cursor_movement (window=20987605, startp=...,
    scroll_step=0x7fff5e400758) at xdisp.c:14639

xdisp.c:14639: (BUFFERP (g->object) && g->charpos == PT)

g is not a valid glyph here.

(gdb) p MATRIX_ROW (w->current_matrix, w->cursor.vpos).used[TEXT_AREA]
$3 = 80
(gdb) p w->cursor.hpos
$4 = 80


2011-09-13  Johan Bockgård  <bojohan <at> gnu.org>

	* xdisp.c (try_cursor_movement): Check bounds of hpos.

=== modified file 'src/xdisp.c'
--- src/xdisp.c	2011-09-09 01:06:52 +0000
+++ src/xdisp.c	2011-09-11 15:03:56 +0000
@@ -14627,7 +14627,11 @@ try_cursor_movement (Lisp_Object window,
 		     is set, we are done.  */
 		  at_zv_p =
 		    MATRIX_ROW (w->current_matrix, w->cursor.vpos)->ends_at_zv_p;
-		  if (!at_zv_p)
+		  if (!at_zv_p
+		      && w->cursor.hpos >= 0
+		      && (w->cursor.hpos
+			  < MATRIX_ROW_USED (w->current_matrix,
+					     w->cursor.vpos)))
 		    {
 		      struct glyph_row *candidate =
 			MATRIX_ROW (w->current_matrix, w->cursor.vpos);


BTW, is this code in try_window_reusing_current_matrix correct?

    struct glyph *glyph = row->glyphs[TEXT_AREA] + w->cursor.hpos;
    struct glyph *end = glyph + row->used[TEXT_AREA];

It doesn't seem right for end to depend on hpos.

Message #8 received at 9495 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Johan Bockgård <bojohan <at> gnu.org>
Cc: 9495 <at> debbugs.gnu.org
Subject: Re: bug#9495: 24.0.50; Segfault in try_cursor_movement
Date: Wed, 14 Sep 2011 01:22:21 -0400

> From: Johan Bockgård <bojohan <at> gnu.org>
> Date: Tue, 13 Sep 2011 21:28:17 +0200
> 
> 
> Program terminated with signal 11, Segmentation fault.
> #0  0x00007f5bccbe6fe7 in kill () at ../sysdeps/unix/syscall-template.S:82
> 82      ../sysdeps/unix/syscall-template.S: No such file or directory.
>         in ../sysdeps/unix/syscall-template.S
> (gdb) bt
> #0  0x00007f5bccbe6fe7 in kill () at ../sysdeps/unix/syscall-template.S:82
> #1  0x000000000056e889 in fatal_error_signal (sig=11) at emacs.c:358
> #2  <signal handler called>
> #3  0x0000000000465f3f in try_cursor_movement (window=20987605, startp=...,
>     scroll_step=0x7fff5e400758) at xdisp.c:14639
> 
> xdisp.c:14639: (BUFFERP (g->object) && g->charpos == PT)
> 
> g is not a valid glyph here.
> 
> (gdb) p MATRIX_ROW (w->current_matrix, w->cursor.vpos).used[TEXT_AREA]
> $3 = 80
> (gdb) p w->cursor.hpos
> $4 = 80

Thanks.  But what is the value of `rv' at that point?

> 2011-09-13  Johan Bockgård  <bojohan <at> gnu.org>
> 
> 	* xdisp.c (try_cursor_movement): Check bounds of hpos.

That will prevent your particular crash, but I'm not sure it's correct
in all cases (like R2L lines and other atrocities).  Can you give a
recipe for reproducing this crash from "emacs -Q"?  I'd like to
investigate a bit more.  TIA.

> BTW, is this code in try_window_reusing_current_matrix correct?
> 
>     struct glyph *glyph = row->glyphs[TEXT_AREA] + w->cursor.hpos;
>     struct glyph *end = glyph + row->used[TEXT_AREA];

No, it's a bug.  I fixed it.  Thanks for spotting it.

Message #11 received at 9495 <at> debbugs.gnu.org (full text, mbox):

From: Johan Bockgård <bojohan <at> gnu.org>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 9495 <at> debbugs.gnu.org
Subject: Re: bug#9495: 24.0.50; Segfault in try_cursor_movement
Date: Wed, 14 Sep 2011 21:50:29 +0200

Eli Zaretskii <eliz <at> gnu.org> writes:

>> From: Johan Bockgård <bojohan <at> gnu.org>
>> Date: Tue, 13 Sep 2011 21:28:17 +0200
>> 
>> 
>> Program terminated with signal 11, Segmentation fault.
>> #0  0x00007f5bccbe6fe7 in kill () at ../sysdeps/unix/syscall-template.S:82
>> 82      ../sysdeps/unix/syscall-template.S: No such file or directory.
>>         in ../sysdeps/unix/syscall-template.S
>> (gdb) bt
>> #0  0x00007f5bccbe6fe7 in kill () at ../sysdeps/unix/syscall-template.S:82
>> #1  0x000000000056e889 in fatal_error_signal (sig=11) at emacs.c:358
>> #2  <signal handler called>
>> #3  0x0000000000465f3f in try_cursor_movement (window=20987605, startp=...,
>>     scroll_step=0x7fff5e400758) at xdisp.c:14639
>> 
>> xdisp.c:14639: (BUFFERP (g->object) && g->charpos == PT)
>> 
>> g is not a valid glyph here.
>> 
>> (gdb) p MATRIX_ROW (w->current_matrix, w->cursor.vpos).used[TEXT_AREA]
>> $3 = 80
>> (gdb) p w->cursor.hpos
>> $4 = 80
>
> Thanks.  But what is the value of `rv' at that point?

1

>> 2011-09-13  Johan Bockgård  <bojohan <at> gnu.org>
>> 
>> 	* xdisp.c (try_cursor_movement): Check bounds of hpos.
>
> That will prevent your particular crash, but I'm not sure it's correct
> in all cases (like R2L lines and other atrocities).  Can you give a
> recipe for reproducing this crash from "emacs -Q"?  I'd like to
> investigate a bit more.  TIA.

emacs -Q -eval '(setq line-move-visual nil truncate-lines t track-eol t)'

C-u 100 x RET
y <up>

At this point, in try_cursor_movement, point is in the "x" line, the
window has not yet hscrolled, and the value of hpos is just after the
last valid element in glyphs[TEXT_AREA].

(It only actually crashes some of the time, of course.)

Message #14 received at 9495 <at> debbugs.gnu.org (full text, mbox):

From: Leo <sdl.web <at> gmail.com>
To: Johan Bockgård <bojohan <at> gnu.org>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 9495 <at> debbugs.gnu.org
Subject: Re: bug#9495: 24.0.50; Segfault in try_cursor_movement
Date: Thu, 15 Sep 2011 11:12:32 +0800

On 2011-09-15 03:50 +0800, Johan Bockgård wrote:
> emacs -Q -eval '(setq line-move-visual nil truncate-lines t track-eol t)'
>
> C-u 100 x RET
> y <up>
>
> At this point, in try_cursor_movement, point is in the "x" line, the
> window has not yet hscrolled, and the value of hpos is just after the
> last valid element in glyphs[TEXT_AREA].
>
> (It only actually crashes some of the time, of course.)

Does this happen with emacs-23? FWIW, I cannot get emacs-23 to crash.

Leo

Message #17 received at 9495 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Leo <sdl.web <at> gmail.com>
Cc: bojohan <at> gnu.org, 9495 <at> debbugs.gnu.org
Subject: Re: bug#9495: 24.0.50; Segfault in try_cursor_movement
Date: Thu, 15 Sep 2011 00:41:32 -0400

> From: Leo <sdl.web <at> gmail.com>
> Cc: Eli Zaretskii <eliz <at> gnu.org>,  9495 <at> debbugs.gnu.org
> Date: Thu, 15 Sep 2011 11:12:32 +0800
> 
> On 2011-09-15 03:50 +0800, Johan Bockgård wrote:
> > emacs -Q -eval '(setq line-move-visual nil truncate-lines t track-eol t)'
> >
> > C-u 100 x RET
> > y <up>
> >
> > At this point, in try_cursor_movement, point is in the "x" line, the
> > window has not yet hscrolled, and the value of hpos is just after the
> > last valid element in glyphs[TEXT_AREA].
> >
> > (It only actually crashes some of the time, of course.)
> 
> Does this happen with emacs-23? FWIW, I cannot get emacs-23 to crash.

It cannot possibly happen with Emacs 23, because this code is part of
the changes introduced in Emacs 24 for supporting display of
bidirectional text.

IOW, it's my fault ;-)

Message #22 received at 9495-done <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Johan Bockgård <bojohan <at> gnu.org>
Cc: 9495-done <at> debbugs.gnu.org
Subject: Re: bug#9495: 24.0.50; Segfault in try_cursor_movement
Date: Thu, 15 Sep 2011 19:05:20 +0300

> From: Johan Bockgård <bojohan <at> gnu.org>
> Cc: 9495 <at> debbugs.gnu.org
> Date: Wed, 14 Sep 2011 21:50:29 +0200
> 
> emacs -Q -eval '(setq line-move-visual nil truncate-lines t track-eol t)'
> 
> C-u 100 x RET
> y <up>
> 
> At this point, in try_cursor_movement, point is in the "x" line, the
> window has not yet hscrolled, and the value of hpos is just after the
> last valid element in glyphs[TEXT_AREA].
> 
> (It only actually crashes some of the time, of course.)

Thanks, I committed your patch with a minor variation.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.