bug#6266: 24.0.50; emacs core dump on delete-other-window

[enami tsugutomo]

Emacs crashed while executing delete-other-window.  The backtrace is
below (bt full output is appended at the end of this mail).  It looks
like the emacs uses uninitialized stack variable `prop' if
find_composition() call on the line 1307 of composite.c fails.  We need
to check if the find_composition() success before proceeding.

enami@rplaca% gdb ./emacs-24.0.50.3 ../emacs.core 
GNU gdb 6.5
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64--netbsd"...
Reading symbols from /usr/lib/libossaudio.so.1...done.
Loaded symbols for /usr/lib/libossaudio.so.1
Reading symbols from /usr/lib/libterminfo.so.1...done.
Loaded symbols for /usr/lib/libterminfo.so.1
Reading symbols from /usr/lib/libm.so.0...done.
Loaded symbols for /usr/lib/libm.so.0
Reading symbols from /usr/lib/libc.so.12...done.
Loaded symbols for /usr/lib/libc.so.12
Reading symbols from /usr/libexec/ld.elf_so...done.
Loaded symbols for /usr/libexec/ld.elf_so
Core was generated by `emacs'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f7ffcc368ca in kill () from /usr/lib/libc.so.12
DISPLAY = :0.0
TERM = kterm
Breakpoint 1 at 0x46fd7c: file emacs.c, line 436.
Breakpoint 2 at 0x48807e: file sysdep.c, line 1036.
(gdb) bt
#0  0x00007f7ffcc368ca in kill () from /usr/lib/libc.so.12
#1  <signal handler called>
#2  0x000000000052adcf in get_composition_id (charpos=25758, bytepos=25758, 
    nchars=4896095, prop=25758, string=10930226) at composite.c:203
#3  0x000000000052c32a in composition_reseat_it (cmp_it=0x7f7fffffd350, 
    charpos=<value optimized out>, bytepos=25758, 
    endpos=<value optimized out>, w=0x16e0000, face=0x0, string=10930226)
    at composite.c:1308
#4  0x00000000004ab65d in compute_motion (from=0, 
    fromvpos=<value optimized out>, fromhpos=<value optimized out>, 
    did_motion=0, to=25758, tovpos=32768, tohpos=32768, width=79, hscroll=0, 
    tab_offset=<value optimized out>, win=0x16e0000) at indent.c:1527
#5  0x00000000004ac171 in vmotion (from=25758, vtarget=-55, w=0x16e0000)
    at indent.c:1914
#6  0x0000000000435e69 in Fdelete_other_windows (window=<value optimized out>)
    at window.c:2532
#7  0x00000000004d9558 in Ffuncall (nargs=<value optimized out>, 
    args=<value optimized out>) at eval.c:3073
#8  0x00000000004d6651 in Fcall_interactively (function=11241170, 
    record_flag=10930226, keys=10958341) at callint.c:869
#9  0x00000000004d9586 in Ffuncall (nargs=<value optimized out>, 
    args=<value optimized out>) at eval.c:3079
#10 0x00000000004d97e6 in call3 (fn=<value optimized out>, 
    arg1=<value optimized out>, arg2=4896095, arg3=25758) at eval.c:2901
#11 0x000000000047f7a8 in command_loop_1 () at keyboard.c:1755
#12 0x00000000004d7eaf in internal_condition_case (
    bfun=0x47f43c <command_loop_1>, handlers=11018434, 
    hfun=0x479e36 <cmd_error>) at eval.c:1510
#13 0x0000000000479b66 in command_loop_2 () at keyboard.c:1356
#14 0x00000000004d7f9f in internal_catch (tag=<value optimized out>, 
    func=0x479b4c <command_loop_2>, arg=10930226) at eval.c:1246
#15 0x0000000000479ca3 in command_loop () at keyboard.c:1335
#16 0x0000000000479fc3 in recursive_edit_1 () at keyboard.c:950
#17 0x000000000047a0e7 in Frecursive_edit () at keyboard.c:1012
#18 0x0000000000470eb9 in main (argc=<value optimized out>, 
    argv=0x7f7fffffdc30) at emacs.c:1801

Lisp Backtrace:
"delete-other-windows" (0xffffd578)
"call-interactively" (0xffffd778)
(gdb) up
#1  <signal handler called>
(gdb) 
#2  0x000000000052adcf in get_composition_id (charpos=25758, bytepos=25758, 
    nchars=4896095, prop=25758, string=10930226) at composite.c:203
warning: Source file is more recent than executable.
203       id = XCAR (prop);
(gdb) p prop
$1 = 25758
(gdb) xtype
Lisp_Cons
(gdb) xcons
$2 = (struct Lisp_Cons *) 0x6498
Cannot access memory at address 0x6498
(gdb) up
#3  0x000000000052c32a in composition_reseat_it (cmp_it=0x7f7fffffd350, 
    charpos=<value optimized out>, bytepos=25758, 
    endpos=<value optimized out>, w=0x16e0000, face=0x0, string=10930226)
    at composite.c:1308
1308          cmp_it->id = get_composition_id (charpos, bytepos, end - start,
(gdb) l
1303          /* We are looking at a static composition.  */
1304          EMACS_INT start, end;
1305          Lisp_Object prop;
1306
1307          find_composition (charpos, -1, &start, &end, &prop, string);
1308          cmp_it->id = get_composition_id (charpos, bytepos, end - start,
1309                                           prop, string);
1310          if (cmp_it->id < 0)
1311            goto no_composition;
1312          cmp_it->nchars = end - start;
(gdb) 


In GNU Emacs 24.0.50.3 (x86_64--netbsd)
 of 2010-05-25 on rplaca.sm.sony.co.jp
configured using `configure  'x86_64--netbsd' '--with-x=no' 
'build_alias=x86_64--netbsd' 'host_alias=x86_64--netbsd' 
'target_alias=x86_64--netbsd''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: nil
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default enable-multibyte-characters: t

Major mode: Fundamental

Minor modes in effect:
  file-name-shadow-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Recent input:
ESC x r e p o SPC r TAB RET

Recent messages:
("./emacs-24.0.50.3")
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list...

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr message sendmail regexp-opt rfc822 mml
mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045
ietf-drums mm-util mail-prsvr mailabbrev mail-utils gmm-utils mailheader
emacsbug help-mode easymenu view japan-util ediff-hook vc-hooks
lisp-float-type lisp-mode register page menu-bar rfn-eshadow timer
jit-lock font-lock syntax facemenu font-core frame cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev
loaddefs button minibuffer faces cus-face files text-properties overlay
md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process multi-tty emacs)

Backtrace full:
enami@rplaca% gdb ./emacs-24.0.50.3 ../emacs.core
GNU gdb 6.5
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64--netbsd"...
Reading symbols from /usr/lib/libossaudio.so.1...done.
Loaded symbols for /usr/lib/libossaudio.so.1
Reading symbols from /usr/lib/libterminfo.so.1...done.
Loaded symbols for /usr/lib/libterminfo.so.1
Reading symbols from /usr/lib/libm.so.0...done.
Loaded symbols for /usr/lib/libm.so.0
Reading symbols from /usr/lib/libc.so.12...done.
Loaded symbols for /usr/lib/libc.so.12
Reading symbols from /usr/libexec/ld.elf_so...done.
Loaded symbols for /usr/libexec/ld.elf_so
Core was generated by `emacs'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f7ffcc368ca in kill () from /usr/lib/libc.so.12
DISPLAY = :0.0
TERM = kterm
Breakpoint 1 at 0x46fd7c: file emacs.c, line 436.
Breakpoint 2 at 0x48807e: file sysdep.c, line 1036.
(gdb) bt full
#0  0x00007f7ffcc368ca in kill () from /usr/lib/libc.so.12
No symbol table info available.
#1  <signal handler called>
No symbol table info available.
#2  0x000000000052adcf in get_composition_id (charpos=25758, bytepos=25758, 
    nchars=4896095, prop=25758, string=10930226) at composite.c:203
        id = <value optimized out>
        length = <value optimized out>
        components = <value optimized out>
        key = <value optimized out>
        key_contents = <value optimized out>
        glyph_len = <value optimized out>
        hash_table = <value optimized out>
        hash_index = <value optimized out>
        hash_code = <value optimized out>
        cmp = <value optimized out>
        i = <value optimized out>
        ch = <value optimized out>
#3  0x000000000052c32a in composition_reseat_it (cmp_it=0x7f7fffffd350, 
    charpos=<value optimized out>, bytepos=25758, 
    endpos=<value optimized out>, w=0x16e0000, face=0x0, string=10930226)
    at composite.c:1308
        start = 140187732530064
        end = 4884719
        prop = 25758
#4  0x00000000004ab65d in compute_motion (from=0, 
    fromvpos=<value optimized out>, fromhpos=<value optimized out>, 
    did_motion=0, to=25758, tovpos=32768, tohpos=32768, width=79, hscroll=0, 
    tab_offset=<value optimized out>, win=0x16e0000) at indent.c:1527
        c = <value optimized out>
        ptr = <value optimized out>
        bytes = 32639
        width = <value optimized out>
        hpos = 0
        vpos = 1
        pos = <value optimized out>
        pos_byte = <value optimized out>
        c = <value optimized out>
        tab_width = 8
        dp = (struct Lisp_Char_Table *) 0x0
        selective = 0
        selective_rlen = 0
        next_boundary = 152696
        width_run_start = 25733
        width_run_end = 25733
        width_run_width = 0
        width_table = (Lisp_Object *) 0x0
        next_width_run = 25733
        window = 23986181
        multibyte = 1
        wide_column_end_hpos = 0
        prev_pos = 25757
        prev_pos_byte = 25757
        prev_hpos = 45
        prev_vpos = 0
        contin_hpos = 0
        prev_tab_offset = 0
        cmp_it = {
  stop_pos = 25758, 
  id = -1, 
  ch = -2, 
  lookback = 0, 
  nglyphs = 0, 
  nchars = 0, 
  nbytes = 0, 
  from = 0, 
  to = 0, 
  width = 0, 
  reversed_p = 0
}
#5  0x00000000004ac171 in vmotion (from=25758, vtarget=-55, w=0x16e0000)
    at indent.c:1914
        propval = <value optimized out>
        hscroll = 0
        vpos = -25
        prevline = 25733
        first = <value optimized out>
        lmargin = 0
        selective = 0
        did_motion = <value optimized out>
        text_prop_object = 23986181
#6  0x0000000000435e69 in Fdelete_other_windows (window=<value optimized out>)
    at window.c:2532
        obuf = (struct buffer *) 0x13d2400
        startpos = <value optimized out>
        top = -55
#7  0x00000000004d9558 in Ffuncall (nargs=<value optimized out>, 
    args=<value optimized out>) at eval.c:3073
        fun = <value optimized out>
        original_fun = <value optimized out>
        funcar = <value optimized out>
        numargs = 0
        val = <value optimized out>
        backtrace = {
  next = 0x7f7fffffd710, 
  function = 0x7f7fffffd570, 
  args = 0x7f7fffffd578, 
  nargs = 0, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x7f7fffffd4a0
        i = 25758
#8  0x00000000004d6651 in Fcall_interactively (function=11241170, 
    record_flag=10930226, keys=10958341) at callint.c:869
        val = <value optimized out>
        args = (Lisp_Object *) 0x7f7fffffd570
        visargs = (Lisp_Object *) 0x7f7fffffd550
        specs = <value optimized out>
        filter_specs = 7748801
        teml = <value optimized out>
---Type <return> to continue, or q <return> to quit---
        up_event = 10930226
        enable = 10930226
        speccount = 2
        next_event = 2
        prefix_arg = 10930226
        string = <value optimized out>
        tem = <value optimized out>
        varies = (int *) 0x7f7fffffd530
        i = 1
        j = 0
        foo = <value optimized out>
        prompt1 = 
"\360\204\246\000\000\000\000\000\002\310\246\000\000\000\000\000\302\313\247\000\000\000\000\000\001\000\000\000\000\000\000\000\360\362)\000\000\000\000\000[2H\000\000\000\000\000\200\364\304\000\000\000\000\000\360\362)\000\000\000\000\000\002\000\000\000\000\000\000\000\226\236\246\000\000\000\000\0002\310\246\000\000\000\000\000\302\313\247\000\000\000\000\000\302\313\247"
        arg_from_tty = 0
        key_count = 2
        record_then_fail = 0
        save_this_command = 11241170
        save_last_command = 11765762
        save_this_original_command = 11241170
        save_real_this_command = 11241170
#9  0x00000000004d9586 in Ffuncall (nargs=<value optimized out>, 
    args=<value optimized out>) at eval.c:3079
        fun = <value optimized out>
        original_fun = <value optimized out>
        funcar = <value optimized out>
        numargs = 3
        val = <value optimized out>
        backtrace = {
  next = 0x0, 
  function = 0x7f7fffffd770, 
  args = 0x7f7fffffd778, 
  nargs = 3, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x7f7fffffd778
        i = <value optimized out>
#10 0x00000000004d97e6 in call3 (fn=<value optimized out>, 
    arg1=<value optimized out>, arg2=4896095, arg3=25758) at eval.c:2901
        ret_ungc_val = 6
        args = {11136386, 11241170, 10930226, 10930226}
#11 0x000000000047f7a8 in command_loop_1 () at keyboard.c:1755
        cmd = 11241170
        keybuf = {96, 196, 7762193, 16723968, 10930274, 20784128, -1, 
  4294967295, 0, 10930226, 2, 10930226, 10930274, 11018482, 140187732531312, 
  5193072, 7762193, 140187732531360, 10930226, 140187732532272, 1, 
  140187732532168, 22768166, 4693490, 10930226, 22768166, 10930226, 4693730, 
  0, 140187732531400}
        i = 2
        prev_modiff = 2
        prev_buffer = (struct buffer *) 0x13d2400
#12 0x00000000004d7eaf in internal_condition_case (
    bfun=0x47f43c <command_loop_1>, handlers=11018434, 
    hfun=0x479e36 <cmd_error>) at eval.c:1510
        val = <value optimized out>
        c = {
  tag = 10930226, 
  val = 10930226, 
  next = 0x7f7fffffda30, 
  gcpro = 0x0, 
  jmp = {11837440, 11837472, 11837440, 140187732532272, 1, 140187732532168, 
    140187732531464, 5078578, 8175336, 8175352, 0}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 0, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 11018434, 
  var = 10930226, 
  chosen_clause = 10930274, 
  tag = 0x7f7fffffd930, 
  next = 0x0
}
#13 0x0000000000479b66 in command_loop_2 () at keyboard.c:1356
        val = 6
#14 0x00000000004d7f9f in internal_catch (tag=<value optimized out>, 
    func=0x479b4c <command_loop_2>, arg=10930226) at eval.c:1246
        c = {
  tag = 11014722, 
  val = 10930226, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {11837440, 11837472, 11837440, 140187732532272, 1, 140187732532168, 
    140187732531736, 5078931, 8175256, 0, 11837440}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 0, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
#15 0x0000000000479ca3 in command_loop () at keyboard.c:1335
No locals.
#16 0x0000000000479fc3 in recursive_edit_1 () at keyboard.c:950
        val = <value optimized out>
#17 0x000000000047a0e7 in Frecursive_edit () at keyboard.c:1012
        buffer = 10930226
#18 0x0000000000470eb9 in main (argc=<value optimized out>, 
    argv=0x7f7fffffdc30) at emacs.c:1801
        tz = 0x0
        dummy = 140187681291328
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = <value optimized out>
---Type <return> to continue, or q <return> to quit---
        skip_args = 0
        rlim = {
  rlim_cur = 33554432, 
  rlim_max = 33554432
}
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0

Lisp Backtrace:
"delete-other-windows" (0xffffd578)
"call-interactively" (0xffffd778)
(gdb) xbacktrace
"delete-other-windows" (0xffffd578)
"call-interactively" (0xffffd778)
(gdb)