Subject: Re: bug#6214: 23.1; json-read-string crashes emacs with long string

From: Michal Sojka <[email-masked]>
Date: Sun, 15 Aug 2010 09:37:28 +0200

On Sat, 14 Aug 2010, Chong Yidong wrote:
> First, please check if this equivalent and simpler recipe also
> reproduces the problem, to make sure this is the same bug:
> 
>   emacs --batch -q --eval "(apply 'string (make-list 1122176 ?a)))"

Yes, the problem is still here.

> If so, please recompile without optimizations:
> 
>   CFLAGS="-g" ./configure
>   make
> 
> and see if you can obtain a cleaner backtrace.

Program received signal SIGSEGV, Segmentation fault.
0x00000000005f81fc in Fapply (nargs=2, args=0x7fffffffc670) at eval.c:2492
2492	  memcpy (funcall_args, args, nargs * sizeof (Lisp_Object));
#0  0x00000000005f81fc in Fapply (nargs=2, args=0x7fffffffc670) at eval.c:2492
        i = 0
        numargs = 1122176
        spread_arg = 38164022
        funcall_args = 0x7fffff76c9d0
        fun = 9260085
        gcpro1 = {
          next = 0x2465636, 
          var = 0x95cb41, 
          nvars = 1122177
        }
#1  0x00000000005f7ade in Feval (form=19244870) at eval.c:2321
        vals = 0x7fffffffc670
        argnum = 2
        numargs = 8
        args_left = 12507474
        i = 2
        maxargs = -14728
        argvals = {19244854, 18642001, 0, 6, 6, 25769803776, 16350976, 12420200}
        fun = 12011021
        val = 24
        original_fun = 12677650
        original_args = 19244918
        funcar = 19244870
        backtrace = {
          next = 0x7fffffffc800, 
          function = 0x7fffffffc770, 
          args = 0x7fffffffc670, 
          nargs = 2, 
          evalargs = 1 '\001', 
          debug_on_exit = 0 '\000'
        }
        gcpro1 = {
          next = 0x0, 
          var = 0x11c7471, 
          nvars = 39
        }
        gcpro2 = {
          next = 0x0, 
          var = 0x7fffffffd530, 
          nvars = -14512
        }
        gcpro3 = {
          next = 0x125a416, 
          var = 0x7fffffffc670, 
          nvars = 2
        }
#2  0x00000000005f8ead in Ffuncall (nargs=2, args=0x7fffffffc880) at eval.c:2983
        fun = 12010973
        original_fun = 12677602
        funcar = 9817142
        numargs = 1
        lisp_numargs = 6302634
        val = 19244870
        backtrace = {
          next = 0x7fffffffcc80, 
          function = 0x7fffffffc880, 
          args = 0x7fffffffc888, 
          nargs = 1, 
          evalargs = 0 '\000', 
          debug_on_exit = 0 '\000'
        }
        internal_args = 0x7fffffffc888
        i = 0
#3  0x0000000000645887 in Fbyte_code (bytestr=9815377, vector=9815413, maxdepth=40) at bytecode.c:679
        count = 5
        op = 1
        vectorp = 0x95c580
        bytestr_length = 1187
        stack = {
          pc = 0xb48b63 "\210\202\300\003\016L坃\311\001\346\347\016N\206\241\001\f\211A\024@!!\026F\016E\203\274\001\016E\016F\016EAB\241\210\016EA\026E\202\300\003\016F\016RB\211\026R\026E\202\300\003\016L蝃\372\001\347\016N\206\333\001\f\211A\024@!\036S\346\016S!\036T\351\016T!\203\357\001\016T\026S\352\016S\314\331#\210*\202\300\003\016L띃!\002\347\016N\206\f\002\f\211A\024@!\036S\346\016S!\036T\352\016T\314ى$\210*\202\300\003\016L욃J\002\331\026Q\016N\206\065\002\f\211A\024@\211\026F;\204@\002\332\355!\210\356\347\016F!!\210\202\300\003\016LX\002", <incomplete sequence \360>..., 
          top = 0x7fffffffc888, 
          bottom = 0x7fffffffc880, 
          byte_string = 9815377, 
          byte_string_start = 0xb489d9 "\306 \210\b\203\021", 
          constants = 9815413, 
          next = 0x7fffffffcd70
        }
        top = 0x7fffffffc880
        result = 140737488341184
#4  0x00000000005f9701 in funcall_lambda (fun=9815317, nargs=1, arg_vector=0x7fffffffcd08) at eval.c:3165
        val = 12535520
        syms_left = 12507474
        next = 14517122
        count = 4
        i = 1
        optional = 0
        rest = 0
#5  0x00000000005f90bb in Ffuncall (nargs=2, args=0x7fffffffcd00) at eval.c:3029
        fun = 9815317
        original_fun = 14191698
        funcar = 12535520
        numargs = 1
        lisp_numargs = 6152191
        val = 19245862
        backtrace = {
          next = 0x7fffffffd0f0, 
          function = 0x7fffffffcd00, 
          args = 0x7fffffffcd08, 
          nargs = 1, 
          evalargs = 0 '\000', 
          debug_on_exit = 0 '\000'
        }
        internal_args = 0x125ab36
        i = 0
#6  0x0000000000645887 in Fbyte_code (bytestr=9788449, vector=9788485, maxdepth=28) at bytecode.c:679
        count = 4
        op = 1
        vectorp = 0x955c50
        bytestr_length = 1723
        stack = {
          pc = 0xb4b681 "\210\016N\203^\006\201", <incomplete sequence \343>, 
          top = 0x7fffffffcd08, 
          bottom = 0x7fffffffcd00, 
          byte_string = 9788449, 
          byte_string_start = 0xb4b02f "\306 \020\307\021\n\023\307\024\310\311!\211\035\307=\204\064", 
          constants = 9788485, 
          next = 0x7fffffffd1d0
        }
        top = 0x7fffffffcd00
        result = 13467377
#7  0x00000000005f9701 in funcall_lambda (fun=9788405, nargs=0, arg_vector=0x7fffffffd178) at eval.c:3165
        val = 12535520
        syms_left = 12507474
        next = 13258642
        count = 4
        i = 0
        optional = 0
        rest = 0
#8  0x00000000005f90bb in Ffuncall (nargs=1, args=0x7fffffffd170) at eval.c:3029
        fun = 9788405
        original_fun = 13569954
        funcar = 13569906
        numargs = 0
        lisp_numargs = 6152191
        val = 13467377
        backtrace = {
          next = 0x7fffffffd6c0, 
          function = 0x7fffffffd170, 
          args = 0x7fffffffd178, 
          nargs = 0, 
          evalargs = 0 '\000', 
          debug_on_exit = 0 '\000'
        }
        internal_args = 0xcd7ef1
        i = 0
#9  0x0000000000645887 in Fbyte_code (bytestr=9783473, vector=9783509, maxdepth=24) at bytecode.c:679
        count = 2
        op = 0
        vectorp = 0x9548e0
        bytestr_length = 220
        stack = {
          pc = 0xb4be2e "\210*\340\341\342\"\210\343\321\344\"\211\036$;\203\251", 
          top = 0x7fffffffd170, 
          bottom = 0x7fffffffd170, 
          byte_string = 9783473, 
          byte_string_start = 0xb4bda0 "\b\203\b", 
          constants = 9783509, 
          next = 0x0
        }
        top = 0x7fffffffd170
        result = 4294967295
#10 0x00000000005f9701 in funcall_lambda (fun=9783429, nargs=0, arg_vector=0x7fffffffd530) at eval.c:3165
        val = 1
        syms_left = 12507474
        next = 140733193388033
        count = 2
        i = 0
        optional = 0
        rest = 0
#11 0x00000000005f932f in apply_lambda (fun=9783429, args=12507474, eval_flag=1) at eval.c:3092
        args_left = 12507474
        numargs = 0
        arg_vector = 0x7fffffffd530
        gcpro1 = {
          next = 0x7ffff1e40970, 
          var = 0x7ffff7fc14d0, 
          nvars = 0
        }
        gcpro2 = {
          next = 0x83b, 
          var = 0x1000, 
          nvars = 8
        }
        gcpro3 = {
          next = 0x1, 
          var = 0x81a4, 
          nvars = 0
        }
        i = 0
        tem = 5
#12 0x00000000005f7dea in Feval (form=12978838) at eval.c:2390
        fun = 9783429
        val = 140737488345192
        original_fun = 14516546
        original_args = 12507474
        funcar = 140737354130560
        backtrace = {
          next = 0x0, 
          function = 0x7fffffffd6f0, 
          args = 0x7fffffffd530, 
          nargs = 0, 
          evalargs = 0 '\000', 
          debug_on_exit = 0 '\000'
        }
        gcpro1 = {
          next = 0x7ffff7fb6488, 
          var = 0x7ffff7fc14d0, 
          nvars = -134225624
        }
        gcpro2 = {
          next = 0x7fffffffd810, 
          var = 0x7ffff1e34c28, 
          nvars = -236739152
        }
        gcpro3 = {
          next = 0x0, 
          var = 0x7fff00000017, 
          nvars = 44108294
        }
#13 0x00000000005599d1 in top_level_2 () at keyboard.c:1347
No locals.
#14 0x00000000005f5f8c in internal_condition_case (bfun=0x5599be <top_level_2>, handlers=12559570, hfun=0x5595a8 <cmd_error>) at eval.c:1458
        val = 5609939
        c = {
          tag = 12507474, 
          val = 12507474, 
          next = 0x7fffffffd930, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {5, 7988929332933021680, 4279008, 140737488346960, 0, 0, 7988929332880592880, -7988928721167724560}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {4294967295, 140737488345248, 1, 9246952, 0, 0, 0, 0, 140737351959490, 1, 0, 0, 140737251616176, 12936662, 5, 140737488345664}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
        h = {
          handler = 12559570, 
          var = 12507474, 
          chosen_clause = 140737488345104, 
          tag = 0x7fffffffd7c0, 
          next = 0x0
        }
#15 0x0000000000559a0b in top_level_1 (ignore=12507474) at keyboard.c:1355
No locals.
#16 0x00000000005f592e in internal_catch (tag=12555634, func=0x5599d3 <top_level_1>, arg=12507474) at eval.c:1202
        c = {
          tag = 12555634, 
          val = 12507474, 
          next = 0x0, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {5, 7988929332987547632, 4279008, 140737488346960, 0, 0, 7988929332960284656, -7988928721370886160}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {6153582, 140737255104152, 4301629832, 0, 12507474, 12779824, 140737488345720, 60129542288, 12535520, 12033184, 6152158, 140737488345680, 12507474, 4279008, 140737488346960, 140737488345696}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
#17 0x0000000000559939 in command_loop () at keyboard.c:1310
No locals.
#18 0x00000000005590df in recursive_edit_1 () at keyboard.c:940
        count = 1
        val = 5608104
#19 0x0000000000559292 in Frecursive_edit () at keyboard.c:1002
        count = 0
        buffer = 12507474
#20 0x00000000005575cc in main (argc=5, argv=0x7fffffffdf58) at emacs.c:1764
        dummy = 140737251592752
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = 1
        skip_args = 1
        rlim = {
          rlim_cur = 8720000, 
          rlim_max = 18446744073709551615
        }
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x45 <Address 0x45 out of bounds>

Lisp Backtrace:
"apply" (0xffffc670)
"eval" (0xffffc888)
"command-line-1" (0xffffcd08)
"command-line" (0xffffd178)
"normal-top-level" (0xffffd530)