Subject: Re: bug#63711: 30.0.50; Crash in xdisp.c when it->string is 0x0

From: Thomas Fitzsimmons <[email-masked]>
Date: Thu, 25 May 2023 11:25:23 -0400

Eli Zaretskii <[email-masked]> writes:

>> From: Thomas Fitzsimmons <[email-masked]>
>> Cc: [email-masked]
>> Date: Thu, 25 May 2023 09:50:44 -0400
>> 
>> >   (gdb) p (*BYTE_POS_ADDR(pos->pos.bytepos))@100
>> >
>> > (Here 100 is the number of bytes to display; feel free to use more if
>> > 100 is insufficient.)
>> 
>> $14 = "\000\000;; js.el --- Major mode for editing JavaScript  -*- lexical-binding: t -*-\n\n;; Copyright (C) 2008-"
>> 
>> > Once you do understand what buffer is this, please try to describe the
>> > overlays at buffer position pos->pos.charpos in that buffer, if there
>> > are supposed to be any overlays there.
>> 
>> (gdb) p pos->pos.charpos
>> $16 = 0
>> 
>> So I guess the first 100 characters printed above already shows the
>> context at pos->pos.charpos?  Are those leading zero-bytes expected?
>
> No.  And pos->pos.charpos isn't supposed to be zero, since buffer
> positions start from 1.  So something is very wrong there.  Please
> show the results of the following commands:
>

PT is not accessible from frames 0 or 1.  I first did:

(gdb) frame 2
#2  0x00000001000ab8c4 in init_to_row_start (row=0x103755820, w=0x105ff7b40, it=0x7fffffff92b0) at xdisp.c:3980
3980      init_from_display_pos (it, w, &row->start);

>   (gdb) p PT

$21 = 143930

>   (gdb) frame 1

[skipped]

>   (gdb) prow

y=701 x=0 pwid=1287 a+d=18+5=23 phys=16+4=20 vis=23
used=(LMargin=0,Text=113,RMargin=0) Hash=258184180
start=0 end=0 ENA MODEL

>   (gdb) pgrow

TEXT: 113 glyphs
  0    0: CHAR[ ] str=0xf188ab16[0] blev=0,btyp=L w=11 a+d=18+5 face=1
  1   11: CHAR[U] str=0x1ccec60[1] blev=0,btyp=L w=11 a+d=18+5 face=1
  2   22: CHAR[:] str=0x4e125d0[0] blev=0,btyp=L w=11 a+d=18+5 face=1
  3   33: STRETCH[23+18] str=0x1ccecb8[0] w=33 a+d=18+5 face=1
  4   66: CHAR[@] str=0x1ccecb8[0] blev=0,btyp=L w=11 a+d=18+5 face=1
  5   77: CHAR[-] str=0x1ccecc8[1] blev=0,btyp=L w=11 a+d=18+5 face=1
  6   88: CHAR[-] str=0x1ccecd8[1] blev=0,btyp=L w=11 a+d=18+5 face=1
  7   99: CHAR[-] str=0x1ccece8[1] blev=0,btyp=L w=11 a+d=18+5 face=1
  8  110: STRETCH[23+18] str=0xf17f69cb[0] w=22 a+d=18+5 face=1
  9  132: CHAR[ ] str=0xf17f69cb[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 10  143: CHAR[ ] str=0xf17f69cb[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 11  154: CHAR[j] str=0xf1829f14[1] blev=0,btyp=L w=11 a+d=18+5 face=21
 12  165: CHAR[s] str=0xf1829f14[1] blev=0,btyp=L w=11 a+d=18+5 face=21
 13  176: CHAR[.] str=0xf1829f14[1] blev=0,btyp=L w=11 a+d=18+5 face=21
 14  187: CHAR[e] str=0xf1829f14[1] blev=0,btyp=L w=11 a+d=18+5 face=21
 15  198: CHAR[l] str=0xf1829f14[1] blev=0,btyp=L w=11 a+d=18+5 face=21
 16  209: CHAR[ ] str=0xf1829f14[1] blev=0,btyp=B w=11 a+d=18+5 face=21
 17  220: CHAR[ ] str=0xf1829f14[1] blev=0,btyp=B w=11 a+d=18+5 face=21
 18  231: CHAR[ ] str=0xf1829f14[1] blev=0,btyp=B w=11 a+d=18+5 face=21
 19  242: CHAR[ ] str=0xf1829f14[1] blev=0,btyp=B w=11 a+d=18+5 face=21
 20  253: CHAR[ ] str=0xf1829f14[1] blev=0,btyp=B w=11 a+d=18+5 face=21
 21  264: CHAR[ ] str=0xf1829f14[1] blev=0,btyp=B w=11 a+d=18+5 face=21
 22  275: CHAR[ ] str=0xf1829f14[1] blev=0,btyp=B w=11 a+d=18+5 face=21
 23  286: CHAR[ ] str=0xf188a9c5[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 24  297: CHAR[ ] str=0xf188a9c5[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 25  308: CHAR[ ] str=0xf188a9c5[2] blev=0,btyp=L w=11 a+d=18+5 face=1
 26  319: CHAR[9] str=0x1ccecf8[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 27  330: CHAR[4] str=0x1ccecf8[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 28  341: CHAR[%] str=0x1ccecf8[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 29  352: STRETCH[23+18] str=0x1cced08[0] w=22 a+d=18+5 face=1
 30  374: CHAR[ ] str=0x1cced08[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 31  385: CHAR[(] str=0x1cced08[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 32  396: CHAR[3] str=0x1cced08[3] blev=0,btyp=L w=11 a+d=18+5 face=1
 33  407: CHAR[7] str=0x1cced08[3] blev=0,btyp=L w=11 a+d=18+5 face=1
 34  418: CHAR[3] str=0x1cced08[3] blev=0,btyp=L w=11 a+d=18+5 face=1
 35  429: CHAR[3] str=0x1cced08[3] blev=0,btyp=L w=11 a+d=18+5 face=1
 36  440: CHAR[,] str=0x1cced08[4] blev=0,btyp=L w=11 a+d=18+5 face=1
 37  451: CHAR[0] str=0x1cced08[6] blev=0,btyp=L w=11 a+d=18+5 face=1
 38  462: CHAR[)] str=0x1cced08[7] blev=0,btyp=L w=11 a+d=18+5 face=1
 39  473: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
 40  484: CHAR[ ] str=0xe598f10[0] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 41  495: CHAR[G] str=0xe598f10[1] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 42  506: CHAR[i] str=0xe598f10[2] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 43  517: CHAR[t] str=0xe598f10[3] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 44  528: CHAR[-] str=0xe598f10[4] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 45  539: CHAR[m] str=0xe598f10[5] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 46  550: CHAR[a] str=0xe598f10[6] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 47  561: CHAR[s] str=0xe598f10[7] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 48  572: CHAR[t] str=0xe598f10[8] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 49  583: CHAR[e] str=0xe598f10[9] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 50  594: CHAR[r] str=0xe598f10[10] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 51  605: CHAR[ ] str=0xf188a9c2[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 52  616: CHAR[ ] str=0xf188a9c2[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 53  627: CHAR[(] str=0xf188a9ad[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 54  638: CHAR[E] str=0x8873f40[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 55  649: CHAR[L] str=0x8873f40[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 56  660: CHAR[i] str=0x8873f40[2] blev=0,btyp=L w=11 a+d=18+5 face=1
 57  671: CHAR[s] str=0x8873f40[3] blev=0,btyp=L w=11 a+d=18+5 face=1
 58  682: CHAR[p] str=0x8873f40[4] blev=0,btyp=L w=11 a+d=18+5 face=1
 59  693: CHAR[/] str=0x8873f50[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 60  704: CHAR[l] str=0x8873f50[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 61  715: CHAR[ ] str=0x8873f60[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 62  726: CHAR[P] str=0x8873f60[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 63  737: CHAR[a] str=0x8873f60[2] blev=0,btyp=L w=11 a+d=18+5 face=1
 64  748: CHAR[r] str=0x8873f60[3] blev=0,btyp=L w=11 a+d=18+5 face=1
 65  759: CHAR[e] str=0x8873f60[4] blev=0,btyp=L w=11 a+d=18+5 face=1
 66  770: CHAR[d] str=0x8873f60[5] blev=0,btyp=L w=11 a+d=18+5 face=1
 67  781: CHAR[i] str=0x8873f60[6] blev=0,btyp=L w=11 a+d=18+5 face=1
 68  792: CHAR[t] str=0x8873f60[7] blev=0,btyp=L w=11 a+d=18+5 face=1
 69  803: CHAR[ ] str=0x8873f78[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 70  814: CHAR[E] str=0x8873f78[1] blev=0,btyp=L w=11 a+d=18+5 face=1
 71  825: CHAR[l] str=0x8873f78[2] blev=0,btyp=L w=11 a+d=18+5 face=1
 72  836: CHAR[D] str=0x8873f78[3] blev=0,btyp=L w=11 a+d=18+5 face=1
 73  847: CHAR[o] str=0x8873f78[4] blev=0,btyp=L w=11 a+d=18+5 face=1
 74  858: CHAR[c] str=0x8873f78[5] blev=0,btyp=L w=11 a+d=18+5 face=1
 75  869: CHAR[)] str=0xf182b36b[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 76  880: CHAR[ ] str=0xf182b340[0] blev=0,btyp=L w=11 a+d=18+5 face=1
 77  891: CHAR[T] str=0x7054200[0] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 78  902: CHAR[h] str=0x7054200[1] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 79  913: CHAR[u] str=0x7054200[2] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 80  924: CHAR[ ] str=0x7054200[3] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 81  935: CHAR[M] str=0x7054200[4] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 82  946: CHAR[a] str=0x7054200[5] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 83  957: CHAR[y] str=0x7054200[6] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 84  968: CHAR[ ] str=0x7054200[7] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 85  979: CHAR[2] str=0x7054200[8] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 86  990: CHAR[5] str=0x7054200[9] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 87 1001: CHAR[ ] str=0x7054200[10] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 88 1012: CHAR[0] str=0x7054200[11] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 89 1023: CHAR[2] str=0x7054200[12] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 90 1034: CHAR[:] str=0x7054200[13] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 91 1045: CHAR[0] str=0x7054200[14] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 92 1056: CHAR[0] str=0x7054200[15] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 93 1067: CHAR[ ] str=0x7054200[16] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 94 1078: CHAR[0] str=0x7054200[17] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 95 1089: CHAR[.] str=0x7054200[18] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 96 1100: CHAR[1] str=0x7054200[19] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 97 1111: CHAR[0] str=0x7054200[20] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 98 1122: CHAR[ ] str=0x7054200[21] blev=0,btyp=L w=11 a+d=18+5 face=1 MB
 99 1133: CHAR[ ] pos=0 blev=0,btyp=L w=11 a+d=18+5 face=1
100 1144: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
101 1155: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
102 1166: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
103 1177: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
104 1188: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
105 1199: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
106 1210: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
107 1221: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
108 1232: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
109 1243: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
110 1254: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
111 1265: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1
112 1276: CHAR[ ] pos=-1 blev=0,btyp=B w=11 a+d=18+5 face=1

>   (gdb) frame 2

(gdb) up
#3  try_window_reusing_current_matrix (w=w@entry=0x105ff7b40) at xdisp.c:21101
21101         init_to_row_start (&it, w, first_row_to_display);

>   (gdb) pgrowx start_row

TEXT: 58 glyphs
  0    0: CHAR[ ] pos=142803 blev=0,btyp=L w=11 a+d=18+5 MB
  1   11: CHAR[ ] pos=142804 blev=0,btyp=L w=11 a+d=18+5 MB
  2   22: CHAR[ ] pos=142805 blev=0,btyp=L w=11 a+d=18+5 MB
  3   33: CHAR[ ] pos=142806 blev=0,btyp=L w=11 a+d=18+5 MB
  4   44: CHAR[(] pos=142807 blev=0,btyp=L w=11 a+d=18+5 face=23 MB
  5   55: CHAR["] pos=142808 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
  6   66: CHAR[l] pos=142809 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
  7   77: CHAR[e] pos=142810 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
  8   88: CHAR[x] pos=142811 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
  9   99: CHAR[i] pos=142812 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 10  110: CHAR[c] pos=142813 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 11  121: CHAR[a] pos=142814 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 12  132: CHAR[l] pos=142815 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 13  143: CHAR[_] pos=142816 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 14  154: CHAR[d] pos=142817 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 15  165: CHAR[e] pos=142818 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 16  176: CHAR[c] pos=142819 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 17  187: CHAR[l] pos=142820 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 18  198: CHAR[a] pos=142821 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 19  209: CHAR[r] pos=142822 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 20  220: CHAR[a] pos=142823 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 21  231: CHAR[t] pos=142824 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 22  242: CHAR[i] pos=142825 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 23  253: CHAR[o] pos=142826 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 24  264: CHAR[n] pos=142827 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 25  275: CHAR["] pos=142828 blev=0,btyp=L w=11 a+d=18+5 face=20 MB
 26  286: CHAR[ ] pos=142829 blev=0,btyp=L w=11 a+d=18+5 MB
 27  297: CHAR[(] pos=142830 blev=0,btyp=L w=11 a+d=18+5 face=25 MB
 28  308: CHAR[t] pos=142831 blev=0,btyp=L w=11 a+d=18+5 MB
 29  319: CHAR[r] pos=142832 blev=0,btyp=L w=11 a+d=18+5 MB
 30  330: CHAR[e] pos=142833 blev=0,btyp=L w=11 a+d=18+5 MB
 31  341: CHAR[e] pos=142834 blev=0,btyp=L w=11 a+d=18+5 MB
 32  352: CHAR[s] pos=142835 blev=0,btyp=L w=11 a+d=18+5 MB
 33  363: CHAR[i] pos=142836 blev=0,btyp=L w=11 a+d=18+5 MB
 34  374: CHAR[t] pos=142837 blev=0,btyp=L w=11 a+d=18+5 MB
 35  385: CHAR[-] pos=142838 blev=0,btyp=L w=11 a+d=18+5 MB
 36  396: CHAR[n] pos=142839 blev=0,btyp=L w=11 a+d=18+5 MB
 37  407: CHAR[o] pos=142840 blev=0,btyp=L w=11 a+d=18+5 MB
 38  418: CHAR[d] pos=142841 blev=0,btyp=L w=11 a+d=18+5 MB
 39  429: CHAR[e] pos=142842 blev=0,btyp=L w=11 a+d=18+5 MB
 40  440: CHAR[-] pos=142843 blev=0,btyp=L w=11 a+d=18+5 MB
 41  451: CHAR[t] pos=142844 blev=0,btyp=L w=11 a+d=18+5 MB
 42  462: CHAR[o] pos=142845 blev=0,btyp=L w=11 a+d=18+5 MB
 43  473: CHAR[p] pos=142846 blev=0,btyp=L w=11 a+d=18+5 MB
 44  484: CHAR[-] pos=142847 blev=0,btyp=L w=11 a+d=18+5 MB
 45  495: CHAR[l] pos=142848 blev=0,btyp=L w=11 a+d=18+5 MB
 46  506: CHAR[e] pos=142849 blev=0,btyp=L w=11 a+d=18+5 MB
 47  517: CHAR[v] pos=142850 blev=0,btyp=L w=11 a+d=18+5 MB
 48  528: CHAR[e] pos=142851 blev=0,btyp=L w=11 a+d=18+5 MB
 49  539: CHAR[l] pos=142852 blev=0,btyp=L w=11 a+d=18+5 MB
 50  550: CHAR[ ] pos=142853 blev=0,btyp=L w=11 a+d=18+5 MB
 51  561: CHAR[n] pos=142854 blev=0,btyp=L w=11 a+d=18+5 MB
 52  572: CHAR[o] pos=142855 blev=0,btyp=L w=11 a+d=18+5 MB
 53  583: CHAR[d] pos=142856 blev=0,btyp=L w=11 a+d=18+5 MB
 54  594: CHAR[e] pos=142857 blev=0,btyp=L w=11 a+d=18+5 MB
 55  605: CHAR[)] pos=142858 blev=0,btyp=L w=11 a+d=18+5 face=25 MB
 56  616: CHAR[)] pos=142859 blev=0,btyp=L w=11 a+d=18+5 face=23 MB
 57  627: CHAR[ ] pos=0 blev=0,btyp=B w=11 a+d=18+5 MB

>   (gdb) p first_reusable_row - start_row

$22 = 15

>   (gdb) p first_row_to_display - start_row

$23 = 30

>   (gdb) p first_row_to_display->y

$24 = 701

>   (gdb) p window_text_bottom_y(w)

$25 = 701

>> > That position is supposed to be the first position of a screen line,
>> > i.e. the position of the leftmost character on display in that line.
>> 
>> I was experimenting with font-locking JavaScript.  Maybe I put Emacs
>> into a strange state that way (though it still shouldn't be crashable).
>> I can't visually inspect the affected window anymore; it was an X11
>> window, tunneled through an SSH connection which I've since closed.
>
> But there weren't supposed to be any overlays at the beginning of the
> buffer, right?

Correct, there weren't supposed to be any overlays at the beginning of
the buffer -- as far as I know, anyway.  I didn't explicitly do anything
with overlays.

> Can you describe your experiments with font-locking JavaScript?  Which
> display-related features did you try?

I was enabling and disabling font-lock-mode, running font-lock-ensure
and font-lock-flush on temporary buffers (not in the js.el buffer).  I
wasn't doing anything particularly fancy or low-level, just elisp-level
function calls and changing font-lock variable settings, primarily the
js keyword variables.

Thanks,
Thomas