Package: emacs;
Reported by: Eli Zaretskii <eliz <at> gnu.org>
Date: Thu, 11 Mar 2021 11:28:02 UTC
Severity: normal
Found in version 28.0.50
Done: Eli Zaretskii <eliz <at> gnu.org>
Bug is archived. No further changes may be made.
View this message in rfc822 format
From: Eli Zaretskii <eliz <at> gnu.org> To: Pip Cet <pipcet <at> gmail.com> Cc: 47067 <at> debbugs.gnu.org, akrl <at> sdf.org Subject: bug#47067: 28.0.50; [feature/native-comp] Crash while scrolling through dispnew.c Date: Sat, 13 Mar 2021 13:10:29 +0200
> From: Pip Cet <pipcet <at> gmail.com>
> Date: Sat, 13 Mar 2021 08:53:04 +0000
> Cc: Andrea Corallo <akrl <at> sdf.org>, 47067 <at> debbugs.gnu.org
>
> It's c-beginning-of-statement-1 that I think is the immediate caller.
It's nowhere in the C backtrace, only its caller
c-font-lock-cut-off-declarators is. And I'm not sure we can trust the
C backtrace anyway, given its abnormalities that I cannot explain yet.
In particular, if I put a breakpoint in wrong_type_argument, which
seems to appear in the backtrace, that breakpoint never breaks during
the recipe.
> Can you disassemble the function around 0x09c32285 (or, in another
> dump, whatever calls Flss), particularly the 256 bytes or so before
> that EIP?
Below. The updated address for the caller of Flss is 0x09d82285,
which is not in any function whose name is known to GDB.
(gdb) bt
#0 0x01236964 in arithcompare_driver (nargs=2, args=0x28,
comparison=ARITH_LESS) at data.c:2673
#1 0x01236a3c in Flss (nargs=2, args=0x28) at data.c:2691
#2 0x09d82285 in ?? ()
#3 0x01261a74 in funcall_lambda (fun=XIL(0xa000000000fcb7f8), nargs=5,
arg_vector=0x826a08) at eval.c:3292
#4 0x012603c9 in Ffuncall (nargs=6, args=0x826a00) at eval.c:3013
#5 0x09df0dbf in ?? ()
#6 0x012603c9 in Ffuncall (nargs=1, args=0x826bd8) at eval.c:3013
#7 0x09dde041 in ?? ()
#8 0x01261a74 in funcall_lambda (fun=XIL(0xa000000006a5d2c8), nargs=1,
arg_vector=0x826db8) at eval.c:3292
#9 0x012603c9 in Ffuncall (nargs=2, args=0x826db0) at eval.c:3013
#10 0x70895b36 in F632d666f6e742d6c6f636b2d6375742d6f66662d6465636c617261746f7273_c_font_lock_cut_off_declarators_0 ()
from d:\usr\eli\.emacs.d\eln-cache\28.0.50-7d88f6c1\cc-fonts-d7d8a7f5-b7c359cd.eln
#11 0x01261a74 in funcall_lambda (fun=XIL(0xa0000000077a8918), nargs=1,
arg_vector=0x827050) at eval.c:3292
#12 0x012603c9 in Ffuncall (nargs=2, args=0x827048) at eval.c:3013
#13 0x068daf93 in ?? ()
#14 0x012dea14 in helper_save_restriction () at comp.c:4575
#15 0x0122eb86 in wrong_type_argument (predicate=XIL(0x892404890c245c89),
value=XIL(0x8244c89e45d8be0)) at data.c:143
Backtrace stopped: previous frame inner to this frame (corrupt stack?)
Lisp Backtrace:
"c-beginning-of-statement-1" (0x826a08)
"c-just-after-func-arglist-p" (0x826be0)
"c-back-over-member-initializers" (0x826db8)
"c-font-lock-cut-off-declarators" (0x827050)
"font-lock-fontify-keywords-region" (0x8273a8)
"font-lock-default-fontify-region" (0x8276b8)
"c-font-lock-fontify-region" (0x827868)
"font-lock-fontify-region" (0x827a58)
0x6ac13c8 PVEC_COMPILED
"jit-lock--run-functions" (0x8283f0)
"jit-lock-fontify-now" (0x8286b0)
"jit-lock-function" (0x8288d8)
"redisplay_internal (C function)" (0x0)
"sit-for" (0x82e040)
"isearch-lazy-highlight-new-loop" (0x82e320)
"isearch-update" (0x82e620)
"isearch-search-and-update" (0x82e830)
"isearch-process-search-string" (0x82ea58)
"isearch-process-search-char" (0x82ec90)
"isearch-printing-char" (0x82f030)
"funcall-interactively" (0x82f028)
"command-execute" (0x82f598)
(gdb) disassemble 0x9d82100,+0x200
Dump of assembler code from 0x9d82100 to 0x9d82300:
0x09d82100: mov %edx,-0xe4(%ebp)
0x09d82106: mov 0x9e87564,%edx
0x09d8210c: mov %eax,-0xe0(%ebp)
0x09d82112: mov -0x100(%ebp),%eax
0x09d82118: mov %edx,-0xdc(%ebp)
0x09d8211e: mov %eax,0x4(%esp)
0x09d82122: call *0xd84(%ebx)
0x09d82128: mov %eax,-0xf0(%ebp)
0x09d8212e: mov %edx,-0xec(%ebp)
0x09d82134: mov %eax,(%esp)
0x09d82137: mov %edx,0x4(%esp)
0x09d8213b: call *0xad8(%ebx)
0x09d82141: mov %eax,-0xf0(%ebp)
0x09d82147: mov %edx,-0xec(%ebp)
0x09d8214d: call *0xab0(%ebx)
0x09d82153: jmp 0x9d80934
0x09d82158: lea 0x0(%esi,%eiz,1),%esi
0x09d8215f: nop
0x09d82160: mov 0x9e87b50,%eax
0x09d82165: mov 0x9e87b54,%edx
0x09d8216b: mov %eax,-0xf0(%ebp)
0x09d82171: mov 0x9e87aa0,%eax
0x09d82176: mov %edx,-0xec(%ebp)
0x09d8217c: mov 0x9e87aa4,%edx
0x09d82182: mov %eax,(%esp)
0x09d82185: mov %edx,0x4(%esp)
0x09d82189: call *0x1358(%ebx)
0x09d8218f: movl $0x4,(%esp)
0x09d82196: mov %eax,-0xe8(%ebp)
0x09d8219c: mov 0x9e875f0,%eax
0x09d821a1: mov %edx,-0xe4(%ebp)
0x09d821a7: mov 0x9e875f4,%edx
0x09d821ad: mov %eax,-0xe0(%ebp)
0x09d821b3: mov %eax,-0xd8(%ebp)
0x09d821b9: mov -0x100(%ebp),%eax
0x09d821bf: mov %edx,-0xdc(%ebp)
0x09d821c5: mov %edx,-0xd4(%ebp)
0x09d821cb: mov %eax,0x4(%esp)
0x09d821cf: call *0xd84(%ebx)
0x09d821d5: mov 0x9e8a750,%ecx
0x09d821db: mov %eax,-0xf0(%ebp)
0x09d821e1: mov (%ecx),%ecx
0x09d821e3: mov %edx,-0xec(%ebp)
0x09d821e9: mov 0x54(%ecx),%esi
0x09d821ec: mov 0x20(%esi),%esi
0x09d821ef: mov %esi,0x54(%ecx)
0x09d821f2: jmp 0x9d808b2
0x09d821f7: lea 0x0(%esi,%eiz,1),%esi
0x09d821fe: xchg %ax,%ax
0x09d82200: mov 0x9e87950,%eax
0x09d82205: mov 0x9e87954,%edx
0x09d8220b: mov %eax,(%esp)
0x09d8220e: mov %edx,0x4(%esp)
0x09d82212: call *0x1358(%ebx)
0x09d82218: mov %edx,-0xec(%ebp)
0x09d8221e: or %eax,%edx
0x09d82220: mov %eax,-0xf0(%ebp)
0x09d82226: je 0x9d82308
0x09d8222c: mov 0x9e87690,%eax
0x09d82231: mov 0x9e87694,%edx
0x09d82237: mov %eax,(%esp)
0x09d8223a: mov %edx,0x4(%esp)
0x09d8223e: call *0x1358(%ebx)
0x09d82244: mov %eax,-0xf0(%ebp)
0x09d8224a: mov 0x9e875a8,%eax
0x09d8224f: mov %edx,-0xec(%ebp)
0x09d82255: mov 0x9e875ac,%edx
0x09d8225b: mov %eax,(%esp)
0x09d8225e: mov %edx,0x4(%esp)
0x09d82262: call *0x1358(%ebx)
0x09d82268: mov %edi,0x4(%esp)
0x09d8226c: mov %eax,-0xe8(%ebp)
0x09d82272: mov %edx,-0xe4(%ebp)
0x09d82278: movl $0x2,(%esp)
0x09d8227f: call *0x1318(%ebx)
0x09d82285: mov %edx,-0xec(%ebp) <<<<<<<<<<<<<<<<<<<<
0x09d8228b: or %eax,%edx
0x09d8228d: mov %eax,-0xf0(%ebp)
0x09d82293: jne 0x9d82308
0x09d82295: mov 0x9e87690,%eax
0x09d8229a: mov 0x9e87694,%edx
0x09d822a0: mov %eax,(%esp)
0x09d822a3: mov %edx,0x4(%esp)
0x09d822a7: call *0x1358(%ebx)
0x09d822ad: mov %eax,-0xf0(%ebp)
0x09d822b3: mov 0x9e87988,%eax
0x09d822b8: mov %edx,-0xec(%ebp)
0x09d822be: mov 0x9e8798c,%edx
0x09d822c4: mov %eax,(%esp)
0x09d822c7: mov %edx,0x4(%esp)
0x09d822cb: call *0x1358(%ebx)
0x09d822d1: mov %edi,0x4(%esp)
0x09d822d5: mov %eax,-0xe8(%ebp)
0x09d822db: mov %edx,-0xe4(%ebp)
0x09d822e1: movl $0x2,(%esp)
0x09d822e8: call *0x130c(%ebx)
0x09d822ee: mov %edx,-0xec(%ebp)
0x09d822f4: or %eax,%edx
0x09d822f6: mov %eax,-0xf0(%ebp)
0x09d822fc: je 0x9d7ee24
End of assembler dump.
(gdb) fr 2
#2 0x09d82285 in ?? ()
(gdb) info registers
eax 0x30 48
ecx 0x6a54fe8 111497192
edx 0x8 8
ebx 0x187b8c0 25671872
esp 0x826650 0x826650
ebp 0x826778 0x826778
esi 0x4002d2b0 1073926832
edi 0x28 40
eip 0x9d82285 0x9d82285
eflags 0x10216 [ PF AF IF RF ]
cs 0x1b 27
ss 0x23 35
ds 0x23 35
es 0x23 35
fs 0x3b 59
gs 0x0 0
(gdb) info symbol (0x187b8c0+0x1318)
freloc + 4888 in section .bss of D:\gnu\git\emacs\native-comp\src\emacs.exe
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.