Subject: define-prefix-command with a name, pressing key sequence bound to it results in memory corruption

From: Peter Oberauer <[email-masked]>
Date: Fri, 24 Oct 2008 23:33:27 +0000 (GMT)

Hi

I have trimmed my .emacs to:

(define-prefix-command 'my-nice-map nil "cOnfigure, Compile, Make, make tEsts, run Tests, trY build, Install, sVn, ctaGs, cscoPe")
(define-key my-nice-map "c" 'compile)
(global-set-key [(meta ?m)] 'my-nice-map)

Sometimes, when pressing my key sequence (meta-m) for the prefix command, emacs crashes. Sometimes it crashes on the second key (e.g. the 'c' following the meta-m). 
I have also tried with (control ?.).

The crash does not always happen, but what is consistent, is that if I can successfully press the second key (e.g. meta-m followed by c) without a crash, it keeps working in that instance of Emacs. 

It seems to be affected by the length of the third optional argument to define-prefix-command, name, which "supplies a menu name string for the map", in that I haven't managed to reproduce with a shorter name.

I've reproduced the crash when pressing my key binding (meta-m) on the *GNU Emacs* welcome buffer, and find file buffers.

One way to reproduce on GNU/Linux is:
gdb emacs
run
press meta-m. If it doesn't crash, press c. if it still doesn't crash, close emacs and repeat a few times. 

I have reproduced on:
GNU/Linux Fedora 8 under VMware and Mac OS X 10.5.5 Intel Core 2 Duo

On GNU/Linux, also from cvs today.

This is GNU Emacs 23.0.60.1 (i686-pc-linux-gnu)
 of 2008-10-24 on ...

On Mac OS X

cvs -z3 -d:pserver:[email-masked]:/sources/emacs co emacs
cd emacs
./configure --with-ns
...
gcc --version
i686-apple-darwin9-gcc-4.0.1 (GCC) 4.0.1 (Apple Inc. build 5465)

This is GNU Emacs 23.0.60.1 (i386-apple-darwin9.5.0, NS apple-appkit-949.35) of 2008-10-24 on ...

I have also reproduced with http://emacs-app.sourceforge.net/ Version 9.0-rc2

Please let me know if you would like more info. 

gdb backtraces for GNU/Linux and Mac OS X are below.

Thank you very much
  Peter

Peter Oberauer

Fedora 8

$ gdb emacs
GNU gdb Red Hat Linux (6.6-45.fc8rh)
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux-gnu"...
Using host libthread_db library "/lib/libthread_db.so.1".
(gdb) run
Starting program: /usr/local/bin/emacs 
*** glibc detected *** /usr/local/bin/emacs: malloc(): memory corruption: 0x089667f0 ***
======= Backtrace: =========
/lib/libc.so.6[0x4df253]
/lib/libc.so.6[0x4e0472]
/lib/libc.so.6(realloc+0x1a7)[0x4e23f7]
/usr/local/bin/emacs[0x814784d]
/usr/local/bin/emacs[0x810ef21]
/usr/local/bin/emacs[0x8118a45]
/usr/local/bin/emacs[0x8119db0]
/usr/local/bin/emacs[0x8119e53]
/usr/local/bin/emacs[0x807232c]
/usr/local/bin/emacs[0x80713d7]
/usr/local/bin/emacs[0x8071517]
/usr/local/bin/emacs[0x8087de3]
/usr/local/bin/emacs[0x810138e]
/usr/local/bin/emacs[0x80ff810]
/usr/local/bin/emacs[0x81019aa]
/usr/local/bin/emacs[0x810391f]
/usr/local/bin/emacs[0x815b172]
/usr/local/bin/emacs[0x80fd303]
/usr/local/bin/emacs[0x815b22a]
/usr/local/bin/emacs[0x80fdbc7]
/usr/local/bin/emacs[0x80fdf2a]
/usr/local/bin/emacs[0x80fe061]
/usr/local/bin/emacs[0x80f3a5c]
/lib/libc.so.6(__libc_start_main+0xe0)[0x48b390]
/usr/local/bin/emacs[0x804d7b1]
======= Memory map: ========
00110000-00111000 r-xp 00110000 00:00 0          [vdso]
00111000-0011b000 r-xp 00000000 fd:00 2228332    /lib/libnss_files-2.7.so
0011b000-0011c000 r-xp 00009000 fd:00 2228332    /lib/libnss_files-2.7.so
0011c000-0011d000 rwxp 0000a000 fd:00 2228332    /lib/libnss_files-2.7.so
00218000-00221000 r-xp 00000000 fd:00 2581955    /usr/lib/libXcursor.so.1.0.2
00221000-00222000 rwxp 00008000 fd:00 2581955    /usr/lib/libXcursor.so.1.0.2
00224000-00228000 r-xp 00000000 fd:00 2581954    /usr/lib/libXfixes.so.3.1.0
00228000-00229000 rwxp 00003000 fd:00 2581954    /usr/lib/libXfixes.so.3.1.0
0042e000-00439000 r-xp 00000000 fd:00 2228588    /lib/libgcc_s-4.1.2-20070925.so.1
00439000-0043a000 rwxp 0000a000 fd:00 2228588    /lib/libgcc_s-4.1.2-20070925.so.1
00456000-00471000 r-xp 00000000 fd:00 2228358    /lib/ld-2.7.so
00471000-00472000 r-xp 0001a000 fd:00 2228358    /lib/ld-2.7.so
00472000-00473000 rwxp 0001b000 fd:00 2228358    /lib/ld-2.7.so
00475000-005c8000 r-xp 00000000 fd:00 2228360    /lib/libc-2.7.so
005c8000-005ca000 r-xp 00153000 fd:00 2228360    /lib/libc-2.7.so
005ca000-005cb000 rwxp 00155000 fd:00 2228360    /lib/libc-2.7.so
005cb000-005ce000 rwxp 005cb000 00:00 0 
005d0000-005f7000 r-xp 00000000 fd:00 2228362    /lib/libm-2.7.so
005f7000-005f8000 r-xp 00026000 fd:00 2228362    /lib/libm-2.7.so
005f8000-005f9000 rwxp 00027000 fd:00 2228362    /lib/libm-2.7.so
005fb000-005fe000 r-xp 00000000 fd:00 2228421    /lib/libdl-2.7.so
005fe000-005ff000 r-xp 00002000 fd:00 2228421    /lib/libdl-2.7.so
005ff000-00600000 rwxp 00003000 fd:00 2228421    /lib/libdl-2.7.so
00727000-00728000 r-xp 00000000 fd:00 2581944    /usr/lib/libxcb-xlib.so.0.0.0
00728000-00729000 rwxp 00000000 fd:00 2581944    /usr/lib/libxcb-xlib.so.0.0.0
0072b000-00730000 r-xp 00000000 fd:00 2581942    /usr/lib/libXdmcp.so.6.0.0
00730000-00731000 rwxp 00004000 fd:00 2581942    /usr/lib/libXdmcp.so.6.0.0
00733000-0082b000 r-xp 00000000 fd:00 2581945    /usr/lib/libX11.so.6.2.0
0082b000-0082f000 rwxp 000f7000 fd:00 2581945    /usr/lib/libX11.so.6.2.0
00831000-0084c000 r-xp 00000000 fd:00 2581943    /usr/lib/libxcb.so.1.0.0
0084c000-0084d000 rwxp 0001a000 fd:00 2581943    /usr/lib/libxcb.so.1.0.0
0084f000-00851000 r-xp 00000000 fd:00 2581941    /usr/lib/libXau.so.6.0.0
00851000-00852000 rwxp 00001000 fd:00 2581941    /usr/lib/libXau.so.6.0.0
00be9000-00bf1000 r-xp 00000000 fd:00 2581982    /usr/lib/libSM.so.6.0.0
00bf1000-00bf2000 rwxp 00007000 fd:00 2581982    /usr/lib/libSM.so.6.0.0
00c13000-00c1b000 r-xp 00000000 fd:00 2581946    /usr/lib/libXrender.so.1.3.0
00c1b000-00c1c000 rwxp 00007000 fd:00 2581946    /usr/lib/libXrender.so.1.3.0
00c1e000-00c35000 r-xp 00000000 fd:00 2581981    /usr/lib/libICE.so.6.3.0
00c35000-00c36000 rwxp 00016000 fd:00 2581981    /usr/lib/libICE.so.6.3.0
00c36000-00c38000 rwxp 00c36000 00:00 0 
08048000-081ca000 r-xp 00000000 fd:00 2582257    /usr/local/bin/emacs
081ca000-08d8b000 rw-p 00181000 fd:00 2582257    /usr/local/bin/emacs
b7b00000-b7b21000 rw-p b7b00000 00:00 0 
b7b21000-b7c00000 ---p b7b21000 00:00 0 
b7cfa000-b7efa000 r--p 00000000 fd:00 2559084    /usr/lib/locale/locale-archive
b7efa000-b7efe000 rw-p 
Program received signal SIGABRT, Aborted.
0x00110402 in __kernel_vsyscall ()
Missing separate debuginfos, use: debuginfo-install gcc.i386 glibc.i686 libICE.i386 libSM.i386 libX11.i386 libXau.i386 libXcursor.i386 libXdmcp.i386 libXfixes.i386 libXrender.i386 libxcb.i386
(gdb) backtrace
#0  0x00110402 in __kernel_vsyscall ()
#1  0x0049e690 in raise () from /lib/libc.so.6
#2  0x0049ff91 in abort () from /lib/libc.so.6
#3  0x004d69eb in __libc_message () from /lib/libc.so.6
#4  0x004df253 in _int_malloc () from /lib/libc.so.6
#5  0x004e0472 in _int_realloc () from /lib/libc.so.6
#6  0x004e23f7 in realloc () from /lib/libc.so.6
#7  0x0814784d in xrealloc (block=0x0, size=2090) at alloc.c:786
#8  0x0810ef21 in enlarge_buffer_text (b=0x8c2df98, delta=2069)
    at buffer.c:5067
#9  0x08118a45 in make_gap_larger (nbytes_added=69) at insdel.c:526
#10 0x08119db0 in insert_1_both (
    string=0x8966798 "cOnfigure, Compile, Make, make tEsts, run Tests, trY build, Install, sVn, ctaGs, cscoPe: ", nchars=89, nbytes=89, inherit=1, prepare=0, 
    before_markers=0) at insdel.c:978
#11 0x08119e53 in insert_1 (
    string=0x8966798 "cOnfigure, Compile, Make, make tEsts, run Tests, trY build, Install, sVn, ctaGs, cscoPe: ", nbytes=89, inherit=1, prepare=0, 
    before_markers=0) at insdel.c:832
#12 0x0807232c in set_message_1 (a1=144074648, a2=137685193, nbytes=89, 
    multibyte_p=1) at xdisp.c:9042
#13 0x080713d7 in with_echo_area_buffer (w=0x0, which=<value optimized out>, 
    fn=0x8072250 <set_message_1>, a1=144074648, a2=137685193, a3=89, a4=1)
---Type <return> to continue, or q <return> to quit---
    at xdisp.c:8369
#14 0x08071517 in set_message (
    s=0x8966798 "cOnfigure, Compile, Make, make tEsts, run Tests, trY build, Install, sVn, ctaGs, cscoPe: ", string=137685193, nbytes=89, multibyte_p=1)
    at xdisp.c:8959
#15 0x08087de3 in message2_nolog (
    m=0x8966798 "cOnfigure, Compile, Make, make tEsts, run Tests, trY build, Install, sVn, ctaGs, cscoPe: ", nbytes=89, multibyte=1) at xdisp.c:7927
#16 0x0810138e in read_char_minibuf_menu_prompt (commandflag=1, nmaps=3, 
    maps=0xbfa9d730) at keyboard.c:8756
#17 0x080ff810 in read_char (commandflag=1, nmaps=3, maps=0xbfa9d730, 
    prev_event=1073742696, used_mouse_menu=0xbfa9d7d4, end_time=0x0)
    at keyboard.c:2718
#18 0x081019aa in read_key_sequence (keybuf=0xbfa9d874, bufsize=30, 
    prompt=137685193, dont_downcase_last=0, can_return_switch_frame=1, 
    fix_current_buffer=1) at keyboard.c:9343
#19 0x0810391f in command_loop_1 () at keyboard.c:1621
#20 0x0815b172 in internal_condition_case (bfun=0x8103770 <command_loop_1>, 
    handlers=137728409, hfun=0x80fdd60 <cmd_error>) at eval.c:1511
#21 0x080fd303 in command_loop_2 () at keyboard.c:1338
#22 0x0815b22a in internal_catch (tag=137724385, 
    func=0x80fd2e0 <command_loop_2>, arg=137685193) at eval.c:1247
#23 0x080fdbc7 in command_loop () at keyboard.c:1317
---Type <return> to continue, or q <return> to quit---
#24 0x080fdf2a in recursive_edit_1 () at keyboard.c:942
#25 0x080fe061 in Frecursive_edit () at keyboard.c:1004
#26 0x080f3a5c in main (argc=1, argv=0xbfa9df74) at emacs.c:1723

meta-m on the *GNU Emacs* buffer:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x80e99590
0x902c9558 in tiny_malloc_from_free_list ()
(gdb) backtrace
#0  0x902c9558 in tiny_malloc_from_free_list ()
#1  0x902c23ed in szone_malloc ()
#2  0x902c22f8 in malloc_zone_malloc ()
#3  0x90973451 in _CFRuntimeCreateInstance ()
#4  0x9098b251 in __CFStringCreateImmutableFunnel3 ()
#5  0x9098c36e in CFStringCreateWithBytes ()
#6  0x91c12c11 in CSStringCopyCFString ()
#7  0x91c2db7e in _LSCopyBindingInfoForTypeInfo ()
#8  0x91c15581 in AddImageByTypeInfo ()
#9  0x91c2d653 in GetIconRefFromTypeInfo ()
#10 0x94efe1d8 in -[NSWorkspace iconForFileType:] ()
#11 0x00193340 in ns_implicitly_set_icon_type (f=0x8ad300) at nsfns.m:839
#12 0x00034a37 in prepare_menu_bars () at xdisp.c:9471
#13 0x00035c2d in redisplay_internal (preserve_echo_area=<value temporarily unavailable, due to optimizations>) at xdisp.c:11426
#14 0x000367c3 in echo_area_display (update_frame_p=<value temporarily unavailable, due to optimizations>) at xdisp.c:9178
#15 0x00037284 in message2_nolog (m=0x36f7dc "\t", nbytes=88, multibyte=1) at xdisp.c:7935
#16 0x000bf5af in read_char (commandflag=1, nmaps=3, maps=0xbffff530, prev_event=1073742696, used_mouse_menu=0xbffff628, end_time=0x0) at keyboard.c:8756
#17 0x000bfc24 in read_key_sequence (keybuf=0xbffff6e8, bufsize=30, prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9343
#18 0x000c214a in command_loop_1 () at keyboard.c:1621
#19 0x00123ebd in internal_condition_case (bfun=0xc1f10 <command_loop_1>, handlers=25205521, hfun=0xb9090 <cmd_error>) at eval.c:1511
#20 0x000b18a8 in command_loop_2 () at keyboard.c:1338
#21 0x00123d9c in internal_catch (tag=1869439807, func=0xb1860 <command_loop_2>, arg=25165833) at eval.c:1247
#22 0x000b15fe in command_loop () at keyboard.c:1317
#23 0x000b16c2 in recursive_edit_1 () at keyboard.c:942
#24 0x000b1841 in Frecursive_edit () at keyboard.c:1004
#25 0x000b048b in main (argc=2, argv=0xbffffaf0) at emacs.c:1723

meta-m on the *GNU Emacs* buffer:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x0000010c
0x91c964e6 in _cache_fill ()
(gdb) backtrace
#0  0x91c964e6 in _cache_fill ()
#1  0x91c948e0 in log_and_fill_cache ()
#2  0x91c952b6 in _class_lookupMethodAndLoadCache ()
#3  0x91ca56d6 in objc_msgSend ()
#4  0x00186b20 in -[EmacsApp sendEvent:] (self=0x818f80, _cmd=0x91cab4b8, theEvent=0xf1306d0) at nsterm.m:3988
#5  0x94c85d0f in -[NSApplication run] ()
#6  0x00184dca in ns_read_socket (terminal=0x83ddb0, expected=0, hold_quit=0xbffff0a4) at nsterm.m:3092
#7  0x000bcb21 in read_avail_input (expected=0) at keyboard.c:7007
#8  0x000bccc5 in gobble_input (expected=0) at keyboard.c:6918
#9  0x0000c949 in sit_for (timeout=240, reading=1, do_display=0) at dispnew.c:6634
#10 0x000be2bc in read_char (commandflag=1, nmaps=0, maps=0x0, prev_event=25165881, used_mouse_menu=0x0, end_time=0x0) at keyboard.c:2892
#11 0x000bf602 in read_char (commandflag=1, nmaps=3, maps=0xbffff530, prev_event=536871280, used_mouse_menu=0xbffff628, end_time=0x0) at keyboard.c:8766
#12 0x000bfc24 in read_key_sequence (keybuf=0xbffff6e8, bufsize=30, prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9343
#13 0x000c214a in command_loop_1 () at keyboard.c:1621
#14 0x00123ebd in internal_condition_case (bfun=0xc1f10 <command_loop_1>, handlers=25205521, hfun=0xb9090 <cmd_error>) at eval.c:1511
#15 0x000b18a8 in command_loop_2 () at keyboard.c:1338
#16 0x00123d9c in internal_catch (tag=260, func=0xb1860 <command_loop_2>, arg=25165833) at eval.c:1247
#17 0x000b15fe in command_loop () at keyboard.c:1317
#18 0x000b16c2 in recursive_edit_1 () at keyboard.c:942
#19 0x000b1841 in Frecursive_edit () at keyboard.c:1004
#20 0x000b048b in main (argc=2, argv=0xbffffaf0) at emacs.c:1723

Another time, after pressing q and visiting a few files and then meta-m

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x80e99590
0x902c9605 in tiny_malloc_from_free_list ()
(gdb) backtrace
#0  0x902c9605 in tiny_malloc_from_free_list ()
#1  0x902c23ed in szone_malloc ()
#2  0x902c22f8 in malloc_zone_malloc ()
#3  0x902c228c in malloc ()
#4  0x0015f6b7 in unexec_malloc (size=0) at unexmacosx.c:1256
#5  0x0010b165 in lisp_malloc (nbytes=32, type=MEM_TYPE_VECTORLIKE) at alloc.c:861
#6  0x0010b42a in allocate_vectorlike (len=6) at alloc.c:2937
#7  0x0010b601 in allocate_vector (nslots=0) at alloc.c:2963
#8  0x0010b63e in Fmake_vector (length=48, init=6) at alloc.c:3047
#9  0x0014aa04 in read_vector (readcharfun=25246473, bytecodeflag=1) at lread.c:3241
#10 0x00149c10 in read1 (readcharfun=25246473, pch=0xbfffeddc, first_in_list=0) at lread.c:2420
#11 0x0014a5f5 in read_list (flag=0, readcharfun=25246473) at lread.c:3339
#12 0x0014916a in read1 (readcharfun=25246473, pch=0xbfffeefc, first_in_list=0) at lread.c:2330
#13 0x0014a1f7 in read0 (readcharfun=<value temporarily unavailable, due to optimizations>) at lread.c:2013
#14 0x0014a29f in read_internal_start (stream=25246473, start=25165833, end=<value temporarily unavailable, due to optimizations>) at lread.c:1981
#15 0x0014b46c in readevalloop (readcharfun=25246473, stream=0xa0083e38, sourcename=33348139, evalfun=0x124f10 <Feval>, printflag=0, unibyte=25165833, readfun=25165833, start=25165833, end=25165833) at lread.c:1774
#16 0x0014bc9c in Fload (file=<value temporarily unavailable, due to optimizations>, noerror=25165833, nomessage=25165881, nosuffix=25165833, must_suffix=<value temporarily unavailable, due to optimizations>) at lread.c:1254
#17 0x00131177 in Frequire (feature=53245433, filename=33461163, noerror=25165833) at fns.c:2985
#18 0x00125f21 in Ffuncall (nargs=2, args=0xbffff270) at eval.c:3050
#19 0x0016087b in Fbyte_code (bytestr=33440443, vector=253129156, maxdepth=10) at bytecode.c:678
#20 0x00125336 in Feval (form=7692317) at eval.c:2385
#21 0x0014af04 in readevalloop (readcharfun=25246473, stream=0xa0083de0, sourcename=33378187, evalfun=0x124f10 <Feval>, printflag=0, unibyte=25165833, readfun=25165833, start=25165833, end=25165833) at lread.c:1784
#22 0x0014bc9c in Fload (file=<value temporarily unavailable, due to optimizations>, noerror=25165833, nomessage=25165881, nosuffix=25165833, must_suffix=<value temporarily unavailable, due to optimizations>) at lread.c:1254
#23 0x00126a9d in do_autoload (fundef=5159125, funname=33665345) at eval.c:2227
#24 0x000b823e in Fcommand_execute (cmd=33665345, record_flag=25165833, keys=25165833, special=25165833) at keyboard.c:10297
#25 0x000c2391 in command_loop_1 () at keyboard.c:1880
#26 0x00123ebd in internal_condition_case (bfun=0xc1f10 <command_loop_1>, handlers=25205521, hfun=0xb9090 <cmd_error>) at eval.c:1511
#27 0x000b18a8 in command_loop_2 () at keyboard.c:1338
#28 0x00123d9c in internal_catch (tag=-1073741821, func=0xb1860 <command_loop_2>, arg=25165833) at eval.c:1247
#29 0x000b15fe in command_loop () at keyboard.c:1317
#30 0x000b16c2 in recursive_edit_1 () at keyboard.c:942
#31 0x000b1841 in Frecursive_edit () at keyboard.c:1004
#32 0x000b048b in main (argc=2, argv=0xbffffaf0) at emacs.c:1723