Subject: Re: bug#16603: 24.3.50; Segfault when viewing a backtrace

From: Lars Ingebrigtsen <[email-masked]>
Date: Fri, 07 Feb 2014 17:23:28 -0800

Dmitry Antipov <[email-masked]> writes:

> On 02/07/2014 07:50 AM, Lars Ingebrigtsen wrote:
>
>> Oops.  No, it hasn't.  Or... uhm...  I got a backtrace once (so that's
>> fine), but then Emacs segfaulted.
>
> Doesn't crash for me. At least I can walk through *Backtrace* buffer
> and visit functions reported in the backtrace.

Yeah, that works fine.  But:

>> #0  mem_insert (start=start@entry=0x2089000, end=end@entry=0x20893e0,
>>      type=type@entry=MEM_TYPE_CONS) at alloc.c:3850
>
> This probably indicates a heap corruption. Could you please try
> to reproduce this crash with temacs under valgrind? I tried two
> times and there was nothing suspicious, BTW.

If you select Rotem's article three times (jumping out of the backtrace
the first two times), Emacs will segfault the third time.  It seems to
be totally reproducible for me.

I don't know how much of the valgrind output to include.  It's 15K lines.

Before the crash, I get lots of the following:

==13139== Invalid read of size 8
==13139==    at 0x547BA7: unbind_to (eval.c:3299)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f315e8 is 1,352 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 
==13139== Invalid read of size 8
==13139==    at 0x547BBA: unbind_to (eval.c:3334)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f315f0 is 1,360 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 
==13139== Invalid read of size 8
==13139==    at 0x547BF7: unbind_to (eval.c:3313)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f31588 is 1,256 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 
==13139== Invalid read of size 8
==13139==    at 0x547AF7: unbind_to (eval.c:3307)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f31510 is 1,136 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 
==13139== Invalid read of size 8
==13139==    at 0x547AFB: unbind_to (eval.c:3307)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f31508 is 1,128 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 
==13139== Invalid read of size 8
==13139==    at 0x547B4F: unbind_to (eval.c:3299)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f31468 is 968 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 
==13139== Invalid read of size 8
==13139==    at 0x547B53: unbind_to (eval.c:3299)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f31478 is 984 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 
==13139== Invalid read of size 8
==13139==    at 0x547B57: unbind_to (eval.c:3299)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f31470 is 976 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 
==13139== Invalid read of size 8
==13139==    at 0x547C40: unbind_to (eval.c:3299)
==13139==    by 0x547CB2: unwind_to_catch (eval.c:1165)
==13139==    by 0x549B9E: Fthrow (eval.c:1195)
==13139==    by 0x4E14F6: Ftop_level (keyboard.c:1209)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x54528F: Fcall_interactively (callint.c:836)
==13139==    by 0x548E27: Ffuncall (eval.c:2820)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x548F89: call1 (eval.c:2612)
==13139==    by 0x4E6F5C: command_loop_1 (keyboard.c:1552)
==13139==    by 0x5472ED: internal_condition_case (eval.c:1352)
==13139==  Address 0x21f313b0 is 784 bytes inside a block of size 65,536 free'd
==13139==    at 0x4A074C4: free (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x547AFD: unbind_to (eval.c:3307)
==13139==    by 0x48A5C9: decode_coding (coding.c:7468)
==13139==    by 0x48EBB1: decode_coding_object (coding.c:8125)
==13139==    by 0x490C54: code_convert_string (coding.c:9472)
==13139==    by 0x508315: Fexpand_file_name (fileio.c:1178)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x507CD6: Fexpand_file_name (fileio.c:982)
==13139==    by 0x567E41: openp (lread.c:1500)
==13139==    by 0x56B0B5: Fload (lread.c:1137)
==13139==    by 0x54A59F: Fautoload_do_load (eval.c:1968)
==13139==    by 0x548BA2: Ffuncall (eval.c:2877)
==13139== 

Then when it actually crashes, this is what's output:

valgrind: m_mallocfree.c:294 (get_bszB_as_is): Assertion 'bszB_lo == bszB_hi' failed.
valgrind: Heap block lo/hi size mismatch: lo = 65541, hi = 489626271855.
This is probably caused by your program erroneously writing past the
end of a heap block and corrupting heap metadata.  If you fix any
invalid writes reported by Memcheck, this assertion failure will
probably go away.  Please try that before reporting this as a bug.

==13139==    at 0x38059B6F: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==13139==    by 0x38059CB2: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==13139==    by 0x38066556: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==13139==    by 0x3802C465: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==13139==    by 0x3802CA6B: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==13139==    by 0x3802CC32: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==13139==    by 0x3809F3AD: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)
==13139==    by 0x380AE0FC: ??? (in /usr/lib64/valgrind/memcheck-amd64-linux)

sched status:
  running_tid=1

Thread 1: status = VgTs_Runnable
==13139==    at 0x4A06409: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==13139==    by 0x52DC0C: xmalloc (alloc.c:677)
==13139==    by 0x5640C9: Fprin1 (print.c:560)
==13139==    by 0x546D14: Fbacktrace (eval.c:3414)
==13139==    by 0x548E4B: Ffuncall (eval.c:2810)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x54A05B: Fapply (eval.c:2352)
==13139==    by 0x54A28F: apply1 (eval.c:2586)
==13139==    by 0x54A435: call_debugger (eval.c:330)
==13139==    by 0x5493AC: Fsignal (eval.c:1731)
==13139==    by 0x549578: xsignal (eval.c:1586)
==13139==    by 0x549C43: signal_error (eval.c:1641)
==13139==    by 0x549CD1: grow_specpdl (eval.c:2030)
==13139==    by 0x549DC5: specbind (eval.c:3145)
==13139==    by 0x57C7E2: exec_byte_code (bytecode.c:881)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)
==13139==    by 0x548C6A: Ffuncall (eval.c:2874)
==13139==    by 0x57C81C: exec_byte_code (bytecode.c:919)
==13139==    by 0x54890E: funcall_lambda (eval.c:3047)

Thread 2: status = VgTs_WaitSys
==13139==    at 0x3F49AEB7FD: ??? (in /usr/lib64/libc-2.17.so)
==13139==    by 0x3F4BE480E3: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4BE481EB: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4BE48238: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4BE6C164: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4A207C52: start_thread (in /usr/lib64/libpthread-2.17.so)
==13139==    by 0x3F49AF5DBC: clone (in /usr/lib64/libc-2.17.so)

Thread 3: status = VgTs_WaitSys
==13139==    at 0x3F49AEB7FD: ??? (in /usr/lib64/libc-2.17.so)
==13139==    by 0x3F4BE480E3: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4BE48549: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4D2C6DB5: ??? (in /usr/lib64/libgio-2.0.so.0.3600.3)
==13139==    by 0x3F4BE6C164: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4A207C52: start_thread (in /usr/lib64/libpthread-2.17.so)
==13139==    by 0x3F49AF5DBC: clone (in /usr/lib64/libc-2.17.so)

Thread 4: status = VgTs_WaitSys
==13139==    at 0x3F49AEB7FD: ??? (in /usr/lib64/libc-2.17.so)
==13139==    by 0x3F4BE480E3: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4BE481EB: g_main_context_iteration (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x208B79CC: ??? (in /usr/lib64/gio/modules/libdconfsettings.so)
==13139==    by 0x3F4BE6C164: ??? (in /usr/lib64/libglib-2.0.so.0.3600.3)
==13139==    by 0x3F4A207C52: start_thread (in /usr/lib64/libpthread-2.17.so)
==13139==    by 0x3F49AF5DBC: clone (in /usr/lib64/libc-2.17.so)

Note: see also the FAQ in the source distribution.
It contains workarounds to several common problems.
In particular, if Valgrind aborted or crashed after
identifying problems in your program, there's a good chance
that fixing those problems will prevent Valgrind aborting or
crashing, especially if it happened in m_mallocfree.c.

If that doesn't help, please report this bug to: www.valgrind.org

In the bug report, send all the above text, the valgrind
version, and what OS and version you are using.  Thanks.

-- 
(domestic pets only, the antidote for overdose, milk.)
  bloggy blog http://lars.ingebrigtsen.no/