More info on sporadic OS/X crash

[John Wiegley]

I've been running Emacs built with -g, waiting for the frequent OS/X
Carbon crash to appear.  Now I have much more info, though I still
don't know what it means:

The crash occurs here:

  0x9158ccd0 <SetupOffscreenGDevice+208>: lwz     r4,0(r4)

because $r4 is -1.  This value comes from:

  0x9158ccc4 <SetupOffscreenGDevice+196>: lwz     r4,24(r3)

because r3 points to a structure (at 0xbfffd314; argument?),
containing a pointer at byte offset 24 that points to the value -1.
Here is the structure:

  0xbfffd314:  0xba1bb000  0xffff8940  0xffea0000  0x020d0245
  0xbfffd324:  0x00040010  0x20030890 *0x007e63a4* 0xffea0000
  0xbfffd334:  0x00000020  0x00000053  0x00053300  0x006e5db8
  0xbfffd344:  0x01f10001  0x01fe0244  0x01f10001  0x01fe0244
  0xbfffd354:  0x01f10001  0x01fe0244  0x00000000  0xbfffd3c0
  0xbfffd364:  0x01010000  0x00f9f46d  0x927d14fc  0x031d98b0

And the pointer:

(gdb) x/1 0x7e63a4
0x7e63a4:  0xffffffff

----------------------------------------------------------------------
This is the backtrace leading to the crash.  Note that the arguments
to DrawText (macterm.c:764) look just fine:

Program received signal EXC_BAD_ACCESS, Could not access memory.
0x9158ccd4 in SetupOffscreenGDevice ()
(gdb) bt
#0  0x9158ccd4 in SetupOffscreenGDevice ()
#1  0x91587990 in PortToNQDPixMap ()
#2  0x91587990 in PortToNQDPixMap ()
#3  0x915755d4 in StdText ()
#4  0x00206608 in mac_draw_string_common (display=0x0, w=0x25c9e20, 
gc=0x3139970, x=1, y=507, buf=0xbfffd620 "-:** address@hidden 3:33PM 1.04 (ERC 
Abbrev)--Bot", '-' <repeats 27 times>, "R", nchars=83, mode=1, 
bytes_per_char=1) at macterm.c:764
#5  0x00206678 in XDrawString (display=0x0, w=0x25c9e20, gc=0x3139970, x=1, 
y=507, buf=0xbfffd620 "-:** address@hidden 3:33PM 1.04 (ERC Abbrev)--Bot", '-' 
<repeats 27 times>, "R", nchars=83) at macterm.c:779
#6  0x00208e20 in x_draw_glyph_string_foreground (s=0xbfffd6e0) at 
macterm.c:2087
#7  0x0020b718 in x_draw_glyph_string (s=0xbfffd6e0) at macterm.c:3070
#8  0x0005585c in draw_glyphs (w=0x25e88c0, x=582, row=0x4e3804c, 
area=TEXT_AREA, start=0, end=83, hl=DRAW_NORMAL_TEXT, overlaps_p=0) at 
xdisp.c:17978
#9  0x00058fa0 in x_write_glyphs (start=0x4f80400, len=83) at xdisp.c:18979
#10 0x000110d0 in update_text_area (w=0x25e88c0, vpos=51) at dispnew.c:4288
#11 0x00011a68 in update_window_line (w=0x25e88c0, vpos=51, 
mouse_face_overwritten_p=0xbfffda54) at dispnew.c:4512
#12 0x00010a88 in update_window (w=0x25e88c0, force_p=0) at dispnew.c:4110
#13 0x000101f8 in update_window_tree (w=0x25e88c0, force_p=0) at dispnew.c:3897
#14 0x0000fffc in update_frame (f=0x31c07a0, force_p=0, inhibit_hairy_id_p=0) 
at dispnew.c:3829
#15 0x0003e69c in redisplay_internal (preserve_echo_area=0) at xdisp.c:10132
#16 0x0003c0f8 in redisplay () at xdisp.c:9337

----------------------------------------------------------------------
And lastly, the disassembly for SetupOffscreenGDevice.  I can't find
documentation on this function anywhere, so I have no idea what the
bad pointer means.

Dump of assembler code for function SetupOffscreenGDevice:
0x9158cc00 <SetupOffscreenGDevice+0>:   mflr    r0
0x9158cc04 <SetupOffscreenGDevice+4>:   bcl-    20,4*cr7+so,0x9158cc08 
<SetupOffscreenGDevice+8>
0x9158cc08 <SetupOffscreenGDevice+8>:   stmw    r29,-12(r1)
0x9158cc0c <SetupOffscreenGDevice+12>:  mflr    r31
0x9158cc10 <SetupOffscreenGDevice+16>:  addis   r29,r31,4093
0x9158cc14 <SetupOffscreenGDevice+20>:  stw     r0,8(r1)
0x9158cc18 <SetupOffscreenGDevice+24>:  addi    r10,r29,29020
0x9158cc1c <SetupOffscreenGDevice+28>:  stwu    r1,-80(r1)
0x9158cc20 <SetupOffscreenGDevice+32>:  lwz     r2,0(r10)
0x9158cc24 <SetupOffscreenGDevice+36>:  addi    r11,r3,8
0x9158cc28 <SetupOffscreenGDevice+40>:  lwz     r0,0(r3)
0x9158cc2c <SetupOffscreenGDevice+44>:  lwz     r2,0(r2)
0x9158cc30 <SetupOffscreenGDevice+48>:  lwz     r2,22(r2)
0x9158cc34 <SetupOffscreenGDevice+52>:  lwz     r30,0(r2)
0x9158cc38 <SetupOffscreenGDevice+56>:  li      r2,-32768
0x9158cc3c <SetupOffscreenGDevice+60>:  stw     r0,0(r30)
0x9158cc40 <SetupOffscreenGDevice+64>:  addi    r9,r30,6
0x9158cc44 <SetupOffscreenGDevice+68>:  lhz     r0,6(r3)
0x9158cc48 <SetupOffscreenGDevice+72>:  or      r0,r0,r2
0x9158cc4c <SetupOffscreenGDevice+76>:  lis     r2,72
0x9158cc50 <SetupOffscreenGDevice+80>:  sth     r0,4(r30)
0x9158cc54 <SetupOffscreenGDevice+84>:  lswi    r7,r11,8
0x9158cc58 <SetupOffscreenGDevice+88>:  stswi   r7,r9,8
0x9158cc5c <SetupOffscreenGDevice+92>:  li      r9,0
0x9158cc60 <SetupOffscreenGDevice+96>:  lhz     r0,16(r3)
0x9158cc64 <SetupOffscreenGDevice+100>: stw     r2,26(r30)
0x9158cc68 <SetupOffscreenGDevice+104>: sth     r0,14(r30)
0x9158cc6c <SetupOffscreenGDevice+108>: li      r0,0
0x9158cc70 <SetupOffscreenGDevice+112>: sth     r0,16(r30)
0x9158cc74 <SetupOffscreenGDevice+116>: stw     r9,18(r30)
0x9158cc78 <SetupOffscreenGDevice+120>: stw     r2,22(r30)
0x9158cc7c <SetupOffscreenGDevice+124>: lhz     r0,18(r3)
0x9158cc80 <SetupOffscreenGDevice+128>: sth     r0,30(r30)
0x9158cc84 <SetupOffscreenGDevice+132>: lbz     r0,20(r3)
0x9158cc88 <SetupOffscreenGDevice+136>: extsb   r0,r0
0x9158cc8c <SetupOffscreenGDevice+140>: sth     r0,32(r30)
0x9158cc90 <SetupOffscreenGDevice+144>: lbz     r0,21(r3)
0x9158cc94 <SetupOffscreenGDevice+148>: extsb   r0,r0
0x9158cc98 <SetupOffscreenGDevice+152>: sth     r0,34(r30)
0x9158cc9c <SetupOffscreenGDevice+156>: lbz     r0,22(r3)
0x9158cca0 <SetupOffscreenGDevice+160>: stw     r9,46(r30)
0x9158cca4 <SetupOffscreenGDevice+164>: extsb   r0,r0
0x9158cca8 <SetupOffscreenGDevice+168>: stw     r9,38(r30)
0x9158ccac <SetupOffscreenGDevice+172>: sth     r0,36(r30)
0x9158ccb0 <SetupOffscreenGDevice+176>: lwz     r2,0(r10)
0x9158ccb4 <SetupOffscreenGDevice+180>: lwz     r2,0(r2)
0x9158ccb8 <SetupOffscreenGDevice+184>: addi    r2,r2,34
0x9158ccbc <SetupOffscreenGDevice+188>: lswi    r8,r11,8
0x9158ccc0 <SetupOffscreenGDevice+192>: stswi   r8,r2,8
0x9158ccc4 <SetupOffscreenGDevice+196>: lwz     r4,24(r3)
0x9158ccc8 <SetupOffscreenGDevice+200>: cmpwi   cr7,r4,0
0x9158cccc <SetupOffscreenGDevice+204>: beq-    cr7,0x9158ccf0 
<SetupOffscreenGDevice+240>
0x9158ccd0 <SetupOffscreenGDevice+208>: lwz     r4,0(r4)
0x9158ccd4 <SetupOffscreenGDevice+212>: lha     r0,6(r4)  ; r4 = -1