GNU bug report logs - #24764
25.1.50; Another crash in automatic gc

Previous Next

Full log

Message #11 received at 24764 <at> debbugs.gnu.org (full text, mbox):

From: Andreas Schwab <schwab <at> linux-m68k.org>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: Michael Heerdegen <michael_heerdegen <at> web.de>, 24764 <at> debbugs.gnu.org
Subject: Re: bug#24764: 25.1.50; Another crash in automatic gc
Date: Sat, 22 Oct 2016 13:41:15 +0200

On Okt 22 2016, Eli Zaretskii <eliz <at> gnu.org> wrote:

>> I think this could be provoked by some lisp stuff I currently develop
>> that does a lot of consing, dunno (but of cause I don't funcall `crash'
>> anywhere, at least not willingly :-) ).  Crashs happen every ten minutes or
>> so, and at totally random points.
>> 
>> Here is the gdb output.  Session still open.
>> [...]
>> 
>> (gdb) bt full
>> #0  0x000000000058aae0 in unchain_marker (marker=0x88e9968) at marker.c:605
>>         tail = 0x2020200020202020 <<<<<<<<<<<<<<<<<<<<<<<<
>>         prev = 0x2020200020202030 <<<<<<<<<<<<<<<<<<<<<<<<
>
> Your marker pointers are actually full of blank (and other ASCII)
> characters.  So some code somewhere either writes past the end of some
> stack-based array or otherwise overwrites the stack.

More likely, BUF_MARKERS is already overwritten.  (The "other ASCII
character" comes from the offset of ->next).  What do the other contents
of b->text look like?  Finding the place where a member of a struct
buffer is overwritten can be done with a watchpoint.

Andreas.

-- 
Andreas Schwab, schwab <at> linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.