GNU bug report logs - #1650
23.0.60; raw-text-dos memory corruption

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 1650 in the body.
You can then email your comments to 1650 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> emacsbugs.donarmstrong.com (full text, mbox):

From: bojohan+mail <at> dd.chalmers.se (Johan Bockgård)
To: emacs-pretest-bug <at> gnu.org
Subject: 23.0.60; raw-text-dos memory corruption
Date: Sat, 20 Dec 2008 16:55:54 +0100

GNU Emacs 23.0.60.12 (x86_64-unknown-linux-gnu, GTK+ Version 2.14.4) of
2008-12-20

emacs -Q

  ;; dictd is running on port 2628
  (let* ((coding-system-for-read 'raw-text-dos)
         (coding-system-for-write 'raw-text-dos)
         (proc (open-network-stream "foo" "foo" "localhost" 2628)))
    ;; The crash goes away if the next line is uncommented
    ;; (sit-for .1)
    (process-send-string proc "define * \"vice\"\r\n"))

=> Crash (backtrace below)

I can reproduce the crash on Emacs versions after 2008-03-25, whereas I
don't see the problem on versions before 2008-03-02. Intermediate
versions don't crash, but instead hang and consume all memory.


2008-03-25  Stefan Monnier  <monnier <at> iro.umontreal.ca>

        [...]

	* process.h (struct Lisp_Process): Remove filter_multibyte.
	* process.c (QCfilter_multibyte): Remove.
	(setup_process_coding_systems): Don't use filter_multibyte.
	(Fstart_process, Fmake_network_process): Don't set filter_multibyte.
	(read_process_output): Don't adjust multibyteness to filter_multibyte.
	(Fset_process_filter_multibyte): Change the coding-system to
	approximate the previous behavior.
	(Fprocess_filter_multibyte_p): Get the multibyteness straight from the
	coding-system.

	* coding.c (decode_coding_object): When not decoding into a buffer,
	obey the coding system's preference of (uni|multi)byte.


2008-03-02  Kenichi Handa  <handa <at> m17n.org>

	* coding.c (decode_coding_utf_8): When eol-type of CODING is
	`dos', don't decode '\r' if that is the last in the source.
	(decode_coding_utf_16, decode_coding_emacs_mule)
	(decode_coding_iso_2022, decode_coding_sjis, decode_coding_big5)
	(decode_coding_raw_text, decode_coding_charset): Likewise.
	(produce_chars): Don't decode EOL here.  Use EMACS_INT.


*** glibc detected *** /home/bojohan/vc/emacs/src/emacs: malloc(): memory corruption: 0x00000000022f83e0 ***
======= Backtrace: =========
/lib/libc.so.6[0x7f4f73ed2cff]
/lib/libc.so.6(__libc_malloc+0x98)[0x7f4f73ed4538]
/home/bojohan/vc/emacs/src/emacs[0x5497ce]
[...]

Program received signal SIGABRT, Aborted.
[Switching to Thread 0x7f4f78df7770 (LWP 7357)]
0x00007f4f73e88fd5 in raise () from /lib/libc.so.6
(gdb) bt
#0  0x00007f4f73e88fd5 in raise () from /lib/libc.so.6
#1  0x00007f4f73e8ab43 in abort () from /lib/libc.so.6
#2  0x00007f4f73ec9fa8 in ?? () from /lib/libc.so.6
#3  0x00007f4f73ed2cff in ?? () from /lib/libc.so.6
#4  0x00007f4f73ed4538 in malloc () from /lib/libc.so.6
#5  0x00000000005497ce in lisp_malloc (nbytes=7357, type=7357) at alloc.c:861
#6  0x000000000054a09a in allocate_string_data (s=0xdc7510, nchars=8136, 
    nbytes=8136) at alloc.c:1991
#7  0x000000000054ab90 in make_uninit_multibyte_string (nchars=8136, 
    nbytes=8136) at alloc.c:2508
#8  0x000000000054ac87 in make_uninit_string (length=7357) at alloc.c:2486
#9  0x00000000005587fd in make_buffer_string_both (start=1, start_byte=1, 
    end=8137, end_byte=<value optimized out>, props=1) at editfns.c:2420
#10 0x0000000000481c35 in decode_coding_object (coding=0xab4800, 
    src_object=11030241, from=0, from_byte=0, to=<value optimized out>, 
    to_byte=<value optimized out>, dst_object=11030337) at coding.c:7307
#11 0x000000000059bc8e in read_process_output (proc=16927316, channel=153)
    at process.c:5409
#12 0x000000000059f4f1 in wait_reading_process_output (time_limit=30, 
    microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=11030241, 
    wait_proc=0x0, just_wait_proc=0) at process.c:4987
#13 0x0000000000415645 in sit_for (timeout=240, reading=1, do_display=1)
    at dispnew.c:6637
#14 0x00000000004f9f75 in read_char (commandflag=1, nmaps=2, 
    maps=0x7fff80e2ecc0, prev_event=11030241, used_mouse_menu=0x7fff80e2edd4, 
    end_time=0x0) at keyboard.c:2892
#15 0x00000000004fb8dd in read_key_sequence (keybuf=0x7fff80e2ee60, 
    bufsize=30, prompt=11030241, dont_downcase_last=0, 
    can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9343
#16 0x00000000004fd73a in command_loop_1 () at keyboard.c:1621
#17 0x00000000005608cf in internal_condition_case (
    bfun=0x4fd520 <command_loop_1>, handlers=11117457, 
    hfun=0x4f5dd0 <cmd_error>) at eval.c:1511
#18 0x00000000004f524e in command_loop_2 () at keyboard.c:1338
#19 0x00000000005609e7 in internal_catch (tag=<value optimized out>, 
    func=0x4f5230 <command_loop_2>, arg=11030241) at eval.c:1247
#20 0x00000000004f5c10 in command_loop () at keyboard.c:1317
#21 0x00000000004f601c in recursive_edit_1 () at keyboard.c:942
#22 0x00000000004f6194 in Frecursive_edit () at keyboard.c:1004
#23 0x00000000004eb057 in main (argc=2, argv=0x7fff80e2f678) at emacs.c:1786

Message #10 received at 1650 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Jason Rumney <jasonr <at> f2s.com>
To: Johan Bockgård <bojohan+mail <at> dd.chalmers.se>,
        1650 <at> debbugs.gnu.org
Subject: Re: bug#1650: 23.0.60; raw-text-dos memory corruption
Date: Sun, 21 Dec 2008 10:40:11 +0800

Johan Bockgård wrote:
> I can reproduce the crash on Emacs versions after 2008-03-25, whereas I
> don't see the problem on versions before 2008-03-02. Intermediate
> versions don't crash, but instead hang and consume all memory.
>   

This seems to be the same as bug #1035, which you reported in September, 
and which I fixed yesterday.

> 2008-03-02  Kenichi Handa  <handa <at> m17n.org>
>
> 	* coding.c (decode_coding_utf_8): When eol-type of CODING is
> 	`dos', don't decode '\r' if that is the last in the source.
> 	(decode_coding_utf_16, decode_coding_emacs_mule)
> 	(decode_coding_iso_2022, decode_coding_sjis, decode_coding_big5)
> 	(decode_coding_raw_text, decode_coding_charset): Likewise.
> 	(produce_chars): Don't decode EOL here.  Use EMACS_INT.
>   

Message #15 received at submit <at> emacsbugs.donarmstrong.com (full text, mbox):

From: bojohan+news <at> dd.chalmers.se (Johan Bockgård)
To: bug-gnu-emacs <at> gnu.org
Subject: Re: bug#1650: 23.0.60; raw-text-dos memory corruption
Date: Sun, 21 Dec 2008 10:37:54 +0100

Jason Rumney <jasonr <at> f2s.com> writes:

> Johan Bockgård wrote:
>> I can reproduce the crash on Emacs versions after 2008-03-25, whereas I
>> don't see the problem on versions before 2008-03-02. Intermediate
>> versions don't crash, but instead hang and consume all memory.
>>   
>
> This seems to be the same as bug #1035, which you reported in
> September, and which I fixed yesterday.

I thought so too; that's why I haven't reported this one earlier. But it
isn't--it still crashes in the same way even after your change (which I
did notice).

-- 
Johan Bockgård

Message #22 received at 1650 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Chong Yidong <cyd <at> stupidchicken.com>
To: bojohan+mail <at> dd.chalmers.se (Johan Bockgård)
Cc: 1650 <at> debbugs.gnu.org
Subject: Re: 23.0.60; raw-text-dos memory corruption
Date: Thu, 16 Apr 2009 13:57:01 -0400

> emacs -Q
>
>   ;; dictd is running on port 2628
>   (let* ((coding-system-for-read 'raw-text-dos)
>          (coding-system-for-write 'raw-text-dos)
>          (proc (open-network-stream "foo" "foo" "localhost" 2628)))
>     ;; The crash goes away if the next line is uncommented
>     ;; (sit-for .1)
>     (process-send-string proc "define * \"vice\"\r\n"))
>
> => Crash (backtrace below)

I can't reproduce this.  Do you still see the bug with latest CVS?

Message #27 received at 1650 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: bojohan+mail <at> dd.chalmers.se (Johan Bockgård)
To: Chong Yidong <cyd <at> stupidchicken.com>
Cc: 1650 <at> debbugs.gnu.org
Subject: Re: 23.0.60; raw-text-dos memory corruption
Date: Thu, 16 Apr 2009 22:56:31 +0200

Chong Yidong <cyd <at> stupidchicken.com> writes:

>> emacs -Q
>>
>>   ;; dictd is running on port 2628
>>   (let* ((coding-system-for-read 'raw-text-dos)
>>          (coding-system-for-write 'raw-text-dos)
>>          (proc (open-network-stream "foo" "foo" "localhost" 2628)))
>>     ;; The crash goes away if the next line is uncommented
>>     ;; (sit-for .1)
>>     (process-send-string proc "define * \"vice\"\r\n"))
>>
>> => Crash (backtrace below)
>
> I can't reproduce this.  Do you still see the bug with latest CVS?

Yes.

Note that a similar crash was reported in the following message:

Subject: core dump in malloc
http://lists.gnu.org/archive/html/emacs-devel/2009-02/msg00449.html

Message #32 received at 1650 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Chong Yidong <cyd <at> stupidchicken.com>
To: emacs-devel <at> gnu.org
Cc: 1650 <at> debbugs.gnu.org,
        bojohan+mail <at> dd.chalmers.se (Johan
 Bockgård)
Subject: Re: 23.0.60; raw-text-dos memory corruption
Date: Fri, 01 May 2009 21:09:33 -0400

> emacs -Q
>
>   ;; dictd is running on port 2628
>   (let* ((coding-system-for-read 'raw-text-dos)
>          (coding-system-for-write 'raw-text-dos)
>          (proc (open-network-stream "foo" "foo" "localhost" 2628)))
>     ;; The crash goes away if the next line is uncommented
>     ;; (sit-for .1)
>     (process-send-string proc "define * \"vice\"\r\n"))
>
> => Crash (backtrace below)

I haven't been able to reproduce this.  Can anyone on this list
reproduce this?  If so, please try to debug it.

Message #37 received at 1650 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: bojohan+mail <at> dd.chalmers.se (Johan Bockgård)
To: Chong Yidong <cyd <at> stupidchicken.com>
Cc: 1650 <at> debbugs.gnu.org, emacs-devel <at> gnu.org
Subject: Re: bug#1650: 23.0.60; raw-text-dos memory corruption
Date: Sat, 02 May 2009 05:45:07 +0200

Chong Yidong <cyd <at> stupidchicken.com> writes:

> I haven't been able to reproduce this. Can anyone on this list
> reproduce this? If so, please try to debug it.

Ok, I've found a rather minimal recipe.


Start one Emacs and evaluate the following:

    (make-network-process
     :name "foo" :server t
     :host "localhost" :service 8888
     :sentinel (lambda (proc stat)
                 (when (string-match "^open from" stat)
                   (process-send-string proc (make-string 5000 ?\r)))))

Start a second Emacs and run this:

    (let* ((coding-system-for-read 'raw-text-dos))
      (open-network-stream "foo" "foo" "localhost" 8888))

Message #42 received at 1650 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Andreas Schwab <schwab <at> linux-m68k.org>
To: bojohan+mail <at> dd.chalmers.se (Johan Bockgård)
Cc: Chong Yidong <cyd <at> stupidchicken.com>, 1650 <at> debbugs.gnu.org,
        emacs-devel <at> gnu.org
Subject: Re: bug#1650: 23.0.60; raw-text-dos memory corruption
Date: Sat, 02 May 2009 13:34:17 +0200

I've checked in a fix.

Andreas.

-- 
Andreas Schwab, schwab <at> linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Message #47 received at 1650-done <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Chong Yidong <cyd <at> stupidchicken.com>
To: Andreas Schwab <schwab <at> linux-m68k.org>
Cc: bojohan+mail <at> dd.chalmers.se (Johan Bockgård),
        1650-done <at> debbugs.gnu.org, emacs-devel <at> gnu.org
Subject: Re: bug#1650: 23.0.60; raw-text-dos memory corruption
Date: Sat, 02 May 2009 09:49:55 -0400

Andreas Schwab <schwab <at> linux-m68k.org> writes:

> I've checked in a fix.

Thanks.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.