Subject: bug#3500: 23.0.94; [NS/Cocoa] Crash when entering accented chacters with Flyspell enabled

From: Ian Eure <[email-masked]>
Date: Mon, 8 Jun 2009 14:58:16 -0700

Recent (this morning) CVS crashes if you enter an accented character  
with Flyspell enablaed.

Steps to reproduce:
1. Launch emacs with -Q
2. Change modifiers so Option isn’t mapped:
    (setq mac-command-modifier 'meta mac-option-modifier nil)
3. Enable flyspell:
    M-x flyspell-mode RET
4. Type a a word with an accented character:
    touché SPC

    (That’s: t o u c h option-e e)

Emacs crashes with:
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x000ce138 in kbd_buffer_get_event (kbp=0xbfffdfa8,  
used_mouse_menu=0x0, end_time=0xbfffe138) at keyboard.c:4165
4165		  *used_mouse_menu = 1;

If flyspell-mode is disabled, Emacs doesn’t crash.

`bt full' output:

(gdb) bt full
#0  0x000ce138 in kbd_buffer_get_event (kbp=0xbfffdfa8,  
used_mouse_menu=0x0, end_time=0xbfffe138) at keyboard.c:4165
	event = (struct input_event *) 0x3ad3f4
	c = 0
	obj = 8252437
#1  0x000cbb65 in read_char (commandflag=0, nmaps=0, maps=0x0,  
prev_event=25165881, used_mouse_menu=0x0, end_time=0xbfffe138) at  
keyboard.c:3059
	kb = (KBOARD *) 0x839260
	c = 25165833
	count = -1
	jmpcount = 8
	local_getcjmp = {895, -1073749600, 8098, 830008, 863736, -1073749600,  
-1073749388, 1645590, -1073749768, -1073750208, 31, 658, 831883, 23,  
-65505, -65505, 0, 55}
	save_jump = {0 <repeats 18 times>}
	key_already_recorded = 0
	tem = 25165833
	save = 25165833
	previous_echo_area_message = 25165833
	also_record = 25165833
	reread = 0
	gcpro1 = {
   next = 0x939be2eb,
   var = 0x1f0b11,
   nvars = -1073749600
}
	gcpro2 = {
   next = 0x2,
   var = 0x8529e0,
   nvars = -1764089896
}
	polling_stopped_here = 1
	orig_kboard = (struct kboard *) 0x839260
#2  0x0019198d in read_filtered_event (no_switch_frame=0,  
ascii_required=0, error_nonascii=0, input_method=0, seconds=24) at  
lread.c:707
	val = 8
	delayed_switch_frame = 25165833
	end_time = {
   tv_sec = 1244497951,
   tv_usec = 581814
}
#3  0x00191c89 in Fread_event (prompt=25165833,  
inherit_input_method=25165833, seconds=24) at lread.c:821
No locals.
#4  0x00168bc4 in Ffuncall (nargs=4, args=0xbfffe270) at eval.c:3051
	fun = 3820052
	original_fun = 25246497
	funcar = 0
	numargs = 3
	lisp_numargs = 1803477
	val = 25165881
	backtrace = {
   next = 0xbfffe550,
   function = 0xbfffe270,
   args = 0xbfffe274,
   nargs = 3,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0xbfffe274
	i = 1
#5  0x001b9105 in Fbyte_code (bytestr=2401179, vector=2401196,  
maxdepth=40) at bytecode.c:678
	count = 8
	op = 3
	vectorp = (Lisp_Object *) 0x24a3b0
	bytestr_length = 90
	stack = {
   pc = 0x39549f "?\034??X",
   top = 0xbfffe27c,
   bottom = 0xbfffe270,
   byte_string = 2401179,
   byte_string_start = 0x39545f "\b??\020",
   constants = 2401196,
   next = 0xbfffe648
}
	top = (Lisp_Object *) 0xbfffe270
	result = -41
#6  0x00169450 in funcall_lambda (fun=2401116, nargs=1,  
arg_vector=0xbfffe5b4) at eval.c:3232
	val = 1476369
	syms_left = 25165833
	next = 25474761
	count = 5
	i = 1
	optional = 1
	rest = 0
#7  0x00168e31 in Ffuncall (nargs=2, args=0xbfffe5b0) at eval.c:3091
	fun = 2401116
	original_fun = 25471361
	funcar = 5206269
	numargs = 1
	lisp_numargs = 1803477
	val = -1073748584
	backtrace = {
   next = 0xbfffe880,
   function = 0xbfffe5b0,
   args = 0xbfffe5b4,
   nargs = 1,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0x1805e4a
	i = 25189962
#8  0x001b9105 in Fbyte_code (bytestr=33606163, vector=23225812,  
maxdepth=16) at bytecode.c:678
	count = 5
	op = 1
	vectorp = (Lisp_Object *) 0x16265d8
	bytestr_length = 81
	stack = {
   pc = 0x21021f8 "?̇̇",
   top = 0xbfffe5b4,
   bottom = 0xbfffe5b0,
   byte_string = 33606163,
   byte_string_start = 0x21021ac "dSeX?\t",
   constants = 23225812,
   next = 0xbfffe978
}
	top = (Lisp_Object *) 0xbfffe5b0
	result = 25165833
#9  0x00169450 in funcall_lambda (fun=23225988, nargs=0,  
arg_vector=0xbfffe8e4) at eval.c:3232
	val = 25165833
	syms_left = 25165833
	next = 2096
	count = 5
	i = 0
	optional = 0
	rest = 0
#10 0x00168e31 in Ffuncall (nargs=1, args=0xbfffe8e0) at eval.c:3091
	fun = 23225988
	original_fun = 33605145
	funcar = 1
	numargs = 0
	lisp_numargs = 1359974
	val = 25165833
	backtrace = {
   next = 0xbfffebb0,
   function = 0xbfffe8e0,
   args = 0xbfffe8e4,
   nargs = 0,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0x180975a
	i = 25204570
#11 0x001b9105 in Fbyte_code (bytestr=33607635, vector=8509204,  
maxdepth=32) at bytecode.c:678
	count = 3
	op = 0
	vectorp = (Lisp_Object *) 0x81d718
	bytestr_length = 121
	stack = {
   pc = 0x210262b "?*",
   top = 0xbfffe8e0,
   bottom = 0xbfffe8e0,
   byte_string = 33607635,
   byte_string_start = 0x2102610 "\b?x",
   constants = 8509204,
   next = 0x0
}
	top = (Lisp_Object *) 0xbfffe8e0
	result = 24110326
#12 0x00169450 in funcall_lambda (fun=8509412, nargs=0,  
arg_vector=0xbfffeca0) at eval.c:3232
	val = 25501976
	syms_left = 25165833
	next = 6297212
	count = 3
	i = 0
	optional = 0
	rest = 0
#13 0x00168e31 in Ffuncall (nargs=1, args=0xbfffec9c) at eval.c:3091
	fun = 8509412
	original_fun = 33930793
	funcar = 1362040
	numargs = 0
	lisp_numargs = 34545322
	val = 25165833
	backtrace = {
   next = 0xbfffed20,
   function = 0xbfffec9c,
   args = 0xbfffeca0,
   nargs = 0,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0x1800009
	i = 34545322
#14 0x00168413 in run_hook_with_args (nargs=1, args=0xbfffec9c,  
cond=to_completion) at eval.c:2704
	sym = 25196057
	val = 8191213
	ret = 25165833
	globals = 25165833
	gcpro1 = {
   next = 0x0,
   var = 0x0,
   nvars = 33827088
}
	gcpro2 = {
   next = 0xbfffec78,
   var = 0x181b109,
   nvars = 25165833
}
	gcpro3 = {
   next = 0x82787a,
   var = 0x105,
   nvars = 1480343
}
#15 0x001681dc in Frun_hooks (nargs=1, args=0xbfffeda4) at eval.c:2567
	hook = {33930793}
	i = 0
#16 0x00168a21 in Ffuncall (nargs=2, args=0xbfffeda0) at eval.c:3026
	fun = 3815364
	original_fun = 25255761
	funcar = 1021522
	numargs = 1
	lisp_numargs = 0
	val = -1073746552
	backtrace = {
   next = 0x0,
   function = 0xbfffeda0,
   args = 0xbfffeda4,
   nargs = 1,
   evalargs = 0 '\0',
   debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0x828
	i = 2096
#17 0x00168630 in call1 (fn=25255761, arg1=25196057) at eval.c:2830
	ret_ungc_val = 1142808
	gcpro1 = {
   next = 0x0,
   var = 0x116299,
   nvars = 2
}
#18 0x000ca3bf in safe_run_hooks_1 (hook=-1073746408) at keyboard.c:2156
No locals.
#19 0x00165fac in internal_condition_case (bfun=0xca36b  
<safe_run_hooks_1>, handlers=25165881, hfun=0xca3cb  
<safe_run_hooks_error>) at eval.c:1512
	val = 677756
	c = {
   tag = 25165833,
   val = 25165833,
   next = 0xbffff0a8,
   gcpro = 0x0,
   jmp = {-1073806465, 25253690, 8098, 1465995, 0, 1, 0, 25165833,  
-1073746296, -1073746480, 31, 658, 1466161, 1441815, 25231391,  
25165855, 6291456, 55},
   backlist = 0x0,
   handlerlist = 0xbffff094,
   lisp_eval_depth = 0,
   pdlcount = 3,
   poll_suppress_count = 0,
   interrupt_input_blocked = 0,
   byte_stack = 0x0
}
	h = {
   handler = 25165881,
   var = 25165833,
   chosen_clause = 1361607,
   tag = 0xbfffee08,
   next = 0xbffff094
}
#20 0x000ca4a3 in safe_run_hooks (hook=25196057) at keyboard.c:2184
	count = 2
#21 0x000c95a7 in command_loop_1 () at keyboard.c:1920
	cmd = 25195913
	lose = 0
	nonundocount = 5
	keybuf = {832, 40, -1566119790, 4122928, -1754246680, -1880941672,  
-1880949728, -1073745796, 152, 0, 4706304, 163, 1245186, 249856,  
-1880941408, 182, 151, 41910568, -1826387128, 230, 9, 0, -1073745904,  
-1073746208, 0, 524288, 25165833, 25599729, 2600356, 4856205}
	i = 1
	prev_modiff = 336
	prev_buffer = (struct buffer *) 0x601678
	already_adjusted = 0
#22 0x00165fac in internal_condition_case (bfun=0xc775e  
<command_loop_1>, handlers=25205425, hfun=0xc6e67 <cmd_error>) at  
eval.c:1512
	val = 4856205
	c = {
   tag = 25165833,
   val = 25165833,
   next = 0xbffff16c,
   gcpro = 0x0,
   jmp = {-1073806465, 76, 8098, 1465995, 33630208, 1464437, 0, 0,  
-1073745624, -1073745808, 31, 658, 1466161, -1826422761, 31, 31, 0, 55},
   backlist = 0x0,
   handlerlist = 0x0,
   lisp_eval_depth = 0,
   pdlcount = 2,
   poll_suppress_count = 0,
   interrupt_input_blocked = 0,
   byte_stack = 0x0
}
	h = {
   handler = 25205425,
   var = 25165833,
   chosen_clause = -1881116971,
   tag = 0xbffff0a8,
   next = 0x0
}
#23 0x000c738e in command_loop_2 () at keyboard.c:1359
	val = 4028928
#24 0x0016593d in internal_catch (tag=25201545, func=0xc7359  
<command_loop_2>, arg=25165833) at eval.c:1248
	c = {
   tag = 25201545,
   val = 25165833,
   next = 0x0,
   gcpro = 0x0,
   jmp = {-1826421889, 0, 8098, 1464437, -1826422635, 0, 0, 0,  
-1073745432, -1073745584, 25296927, 662, 1464622, 23, 25165855,  
-1073807329, 25296896, 25296951},
   backlist = 0x0,
   handlerlist = 0x0,
   lisp_eval_depth = 0,
   pdlcount = 2,
   poll_suppress_count = 0,
   interrupt_input_blocked = 0,
   byte_stack = 0x0
}
#25 0x000c7317 in command_loop () at keyboard.c:1338
No locals.
#26 0x000c68eb in recursive_edit_1 () at keyboard.c:953
	count = 1
	val = 1481113
#27 0x000c6af4 in Frecursive_edit () at keyboard.c:1015
	count = 0
	buffer = 25165833
#28 0x000c4df9 in main (argc=2, argv=0xbffff47c) at emacs.c:1852
	dummy = 0
	stack_bottom_variable = 0 '\0'
	do_initial_setlocale = 1
	skip_args = 0
	rlim = {
   rlim_cur = 8388608,
   rlim_max = 67104768
}
	no_loadup = 0
	junk = 0x0
	dname_arg = 0x0
	dname_arg2 = "|???\002\000\000\000X???r\030?? 
\000\020\000\000\000\000\000\000\002\000\000\000|???????\030???", '\0'  
<repeats 39 times>

`xbacktrace' output:

In GNU Emacs 23.0.94.1 (i386-apple-darwin9.7.0, NS apple-appkit-949.46)
  of 2009-06-08 on neutron.local
Windowing system distributor `Apple', version 10.3.949
configured using `configure  '--with-ns''

Important settings:
   value of $LC_ALL: nil
   value of $LC_COLLATE: nil
   value of $LC_CTYPE: nil
   value of $LC_MESSAGES: nil
   value of $LC_MONETARY: nil
   value of $LC_NUMERIC: nil
   value of $LC_TIME: nil
   value of $LANG: nil
   value of $XMODIFIERS: nil
   locale-coding-system: nil
   default-enable-multibyte-characters: t

Major mode: Inferior Python

Minor modes in effect:
   diff-auto-refine-mode: t
   erc-track-mode: t
   erc-track-minor-mode: t
   erc-spelling-mode: t
   erc-ring-mode: t
   erc-pcomplete-mode: t
   erc-netsplit-mode: t
   erc-match-mode: t
   erc-button-mode: t
   erc-fill-mode: t
   erc-autojoin-mode: t
   erc-irccontrols-mode: t
   erc-noncommands-mode: t
   erc-readonly-mode: t
   erc-scrolltobottom-mode: t
   compilation-shell-minor-mode: t
   which-function-mode: t
   yas/minor-mode: t
   shell-dirtrack-mode: t
   ime-bindings: t
   show-paren-mode: t
   recentf-mode: t
   iswitchb-mode: t
   cua-mode: t
   auto-insert-mode: t
   tooltip-mode: t
   mouse-wheel-mode: t
   menu-bar-mode: t
   file-name-shadow-mode: t
   global-font-lock-mode: t
   font-lock-mode: t
   blink-cursor-mode: t
   global-auto-composition-mode: t
   auto-composition-mode: t
   auto-encryption-mode: t
   auto-compression-mode: t
   size-indication-mode: t
   column-number-mode: t
   line-number-mode: t
   transient-mark-mode: t
   abbrev-mode: t

Recent input:
<menu-bar> <help-menu> <send-emacs-bug-report>

Recent messages:
Quit