cvs head: segfaults when opening image in w3m-from-cvs

[David O'Toole]

I use emacs-w3m (the cvs version). I byte-compiled it with the same
emacs executable I am debugging, so I'm confident it's not a stale elc
issue.
I built emacs the other day, and since then w3m reliably segfaults
emacs when opening an image.

Step 1. Ran emacs in gbd
Step 2. M-x w3m
Step 3. g http://dto.mamalala.org/images/rlx2.png
Step 4. segfault, got GDB output below.

Current directory is ~/src/emacs23-23.0.50.2/src/
GNU gdb 6.7.1-debian
Copyright (C) 2007 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu"...
Using host libthread_db library "/lib/i686/cmov/libthread_db.so.1".
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not
from terminal]
DISPLAY = :0.0
TERM = dumb
Breakpoint 1 at 0x80fd356: file emacs.c, line 430.
Breakpoint 2 at 0x8116d49: file sysdep.c, line 1319.
(gdb) run
Starting program: /home/dto/src/emacs23-23.0.50.2/src/emacs
[Thread debugging using libthread_db enabled]
[New Thread 0xb7579720 (LWP 26779)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7579720 (LWP 26779)]
0x08176b4a in print_object (obj=0, printcharfun=137675065,
escapeflag=1) at print.c:1780
(gdb) bt full
#0  0x08176b4a in print_object (obj=0, printcharfun=137675065,
escapeflag=1) at print.c:1780
        end = <value optimized out>
        c = <value optimized out>
        i_byte = <value optimized out>
        confusing = <value optimized out>
        p = <value optimized out>
        size_byte = <value optimized out>
        buf = 
"\277\360\321\021\b\001N8\bI\f8\b\030\217\335\2779\3014\b9\3014\b9\3014\b\001\000\000\0009\3014\b\001\000"
#1  0x0817af22 in Fprin1 (object=1, printcharfun=137675065) at print.c:784
        old = (struct buffer *) 0x880a398
        old_point = -1
        start_point = -1
        old_point_byte = -1
        start_point_byte = -1
        free_print_buffer = 0
#2  0x0817b44d in print_error_message (data=162656813,
stream=137675065, context=0x81d107b "error in process filter: ",
caller=137675017) at print.c:1147
        obj = 1
        errname = 137719105
        errmsg = 137808555
        file_error = 137675017
        tail = <value optimized out>
        i = 1
#3  0x081085ae in cmd_error_internal (data=162656813,
context=0x81d107b "error in process filter: ") at keyboard.c:1315
No locals.
#4  0x08195889 in read_process_output_error_handler (error=162656813)
at process.c:4949
No locals.
#5  0x0816725c in internal_condition_case_1 (bfun=0x81958c0
<read_process_output_call>, arg=162656925, handlers=137719057,
hfun=0x8195870 <read_process_output_error_handler>) at eval.c:1532
        val = <value optimized out>
        c = {
  tag = 137675017,
  val = 162656813,
  next = 0xbfddbefc,
  gcpro = 0x0,
  jmp = {{
      __jmpbuf = {137719057, 157892832, 163946184, -1075998504,
-1356865407, 954459118},
      __mask_was_saved = 0,
      __saved_mask = {
        __val = {3218968648, 135632059, 1, 137675017, 3218968648,
157892832, 9, 137890889, 3218968680, 135632690, 137886682, 4096, 1,
157892832, 137803340, 143417264, 3218968712, 135385584, 137890889, 1,
3081081152, 3218968728, 137902884, 142648216, 3218968744, 134956379,
142648216, 137675017, 153920864, 153920720, 137675017, 162656949}
      }
    }},
  backlist = 0x0,
  handlerlist = 0xbfddbfc4,
  lisp_eval_depth = 0,
  pdlcount = 9,
  poll_suppress_count = 1,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
  handler = 137719057,
  var = 137675017,
  chosen_clause = 137675065,
  tag = 0xbfdd8ffc,
  next = 0xbfddbfc4
}
#6  0x081951f2 in read_process_output (proc=163946188, channel=<value
optimized out>) at process.c:5163
        odeactivate = 137675065
        text = 154961667
        outer_running_asynch_code = 1
        waiting = 0
        nbytes = 4095
        outstream = 152651377
        old = (struct buffer *) 0x880a398
        p = (struct Lisp_Process *) 0x9c59ec8
        opoint = <value optimized out>
        coding = (struct coding_system *) 0x96940e0
        carryover = 0
#7  0x081993fa in wait_reading_process_output (time_limit=2,
microsecs=0, read_kbd=0, do_display=0, wait_for_cell=137675017,
wait_proc=0x0, just_wait_proc=0) at process.c:4776
        nread = <value optimized out>
        timeout_reduced_for_timers = 1
        channel = 9
        nfds = 1
        Available = {
  fds_bits = {512, 0 <repeats 31 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = 1
        no_avail = 0
        xerrno = 0
        proc = 163946188
        timeout = {
  tv_sec = 0,
  tv_usec = 44266
}
        end_time = {
  tv_sec = 1206624950,
  tv_usec = 6824
}
        wait_channel = -1
        got_some_input = 1
#8  0x080542a7 in Fsleep_for (seconds=16, milliseconds=137675017) at
dispnew.c:6556
        sec = 2
        usec = 137675017
#9  0x081958ad in read_process_output_error_handler (error=162657933)
at process.c:4952
No locals.
#10 0x0816725c in internal_condition_case_1 (bfun=0x81958c0
<read_process_output_call>, arg=162658037, handlers=137719057,
hfun=0x8195870 <read_process_output_error_handler>) at eval.c:1532
        val = <value optimized out>
        c = {
  tag = 137675017,
  val = 162657933,
  next = 0xbfddbefc,
  gcpro = 0x0,
  jmp = {{
      __jmpbuf = {137719057, 157892832, 163946184, -1075993016,
-1354055551, 954459118},
      __mask_was_saved = 0,
      __saved_mask = {
        __val = {3218974136, 135632059, 1, 142249536, 3218974136,
157892832, 5, 137890889, 3218974168, 135632690, 137886682, 4096, 1,
157892832, 137803340, 143417264, 3218974200, 135385584, 137890889, 1,
3218974232, 135630821, 137902884, 142648216, 3218974232, 134956379,
142648216, 137675017, 153920800, 153920720, 137675017, 162658061}
      }
    }},
  backlist = 0x0,
  handlerlist = 0xbfddbfc4,
  lisp_eval_depth = 0,
  pdlcount = 5,
  poll_suppress_count = 1,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
  handler = 137719057,
  var = 137675017,
  chosen_clause = 137675065,
  tag = 0xbfdda56c,
  next = 0xbfddbfc4
}
#11 0x081951f2 in read_process_output (proc=163946188, channel=<value
optimized out>) at process.c:5163
        odeactivate = 137675017
        text = 154961763
        outer_running_asynch_code = 0
        waiting = -1
        nbytes = 4095
        outstream = 152651377
        old = (struct buffer *) 0x880a398
        p = (struct Lisp_Process *) 0x9c59ec8
        opoint = <value optimized out>
        coding = (struct coding_system *) 0x96940e0
        carryover = 0
#12 0x081993fa in wait_reading_process_output (time_limit=30,
microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=137675017,
wait_proc=0x0, just_wait_proc=0) at process.c:4776
        nread = <value optimized out>
        timeout_reduced_for_timers = 1
        channel = 9
        nfds = 1
        Available = {
  fds_bits = {512, 0 <repeats 31 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = 1
        no_avail = 0
        xerrno = 0
        proc = 163946188
        timeout = {
  tv_sec = 0,
  tv_usec = 252039
}
        end_time = {
  tv_sec = 1206624977,
  tv_usec = 850731
}
        wait_channel = -1
        got_some_input = 1
#13 0x080543d6 in sit_for (timeout=240, reading=1, do_display=1) at
dispnew.c:6614
        sec = 30
        usec = 0
#14 0x0810a582 in read_char (commandflag=1, nmaps=6, maps=0xbfddbd20,
prev_event=137675017, used_mouse_menu=0xbfddbdc8, end_time=0x0) at
keyboard.c:2967
        tem0 = <value optimized out>
        delay_level = 30
        buffer_size = <value optimized out>
        c = 137675017
        local_getcjmp = {{
    __jmpbuf = {153920720, 146925540, 1, -1075987256, -1351270271, 892471790},
    __mask_was_saved = 0,
    __saved_mask = {
      __val = {142648220, 3218980056, 135966361, 164176525, 137704161,
142648220, 40, 3218979808, 1, 0, 3218979872, 142648216, 142648220,
3218980088, 135667103, 137704161, 8, 142648220, 0, 142648220, 8,
3218979960, 135966559, 142648216, 0, 0, 0, 0, 0, 0, 142867241,
142867241}
    }
  }}
        save_jump = {{
    __jmpbuf = {0, 0, 0, 0, 0, 0},
    __mask_was_saved = 0,
    __saved_mask = {
      __val = {0 <repeats 32 times>}
    }
  }}
        key_already_recorded = 0
        tem = <value optimized out>
        save = <value optimized out>
        previous_echo_area_message = 137675017
        also_record = 137675017
        reread = 0
        polling_stopped_here = <value optimized out>
        orig_kboard = (struct kboard *) 0x86312e0
#15 0x0810c1f3 in read_key_sequence (keybuf=0xbfddbe64, bufsize=30,
prompt=137675017, dont_downcase_last=0, can_return_switch_frame=1,
fix_current_buffer=1) at keyboard.c:9458
        interrupted_kboard = (KBOARD *) 0x86312e0
        key = 142648220
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 137675017
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 6
        nmaps_allocated = 6
        defs = (Lisp_Object * volatile) 0xbfddbcf0
        submaps = (Lisp_Object * volatile) 0xbfddbd20
        orig_local_map = 154669469
        orig_keymap = 137675017
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 147569461,
  map = 147569461,
  start = 0,
  end = 0
}
        keytran = {
  parent = 137668477,
  map = 137668477,
  start = 0,
  end = 0
}
        indec = {
  parent = 147569469,
  map = 147569469,
  start = 0,
  end = 0
}
        delayed_switch_frame = 137675017
        original_uppercase = 0
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x880a398
        fake_prefixed_keys = 137675017
#16 0x0810e102 in command_loop_1 () at keyboard.c:1653
        cmd = <value optimized out>
        lose = <value optimized out>
        nonundocount = 0
        keybuf = {824, 1, 1006, -1218857680, -1212959376, 134534114,
-1215186292, 134521220, 1, -1208078348, -1208076256, -1075986556,
-1075986528, -1208156310, 134521220, -1075986556, -1208076348, 24,
-1218857680, 0, -1075986744, -1075986896, 0, 0, 137675017, 143056065,
0, 138184616, 138184600, -1075986712}
        i = <value optimized out>
        prev_modiff = 48
        prev_buffer = (struct buffer *) 0x880a398
        already_adjusted = 0
#17 0x08167460 in internal_condition_case (bfun=0x810df60
<command_loop_1>, handlers=137719057, hfun=0x8108600 <cmd_error>) at
eval.c:1494
        val = <value optimized out>
        c = {
  tag = 137675017,
  val = 137675017,
  next = 0xbfddc010,
  gcpro = 0x0,
  jmp = {{
      __jmpbuf = {0, 138184616, 138184600, -1075986472, -1350705023,
954745838},
      __mask_was_saved = 0,
      __saved_mask = {
        __val = {44, 3079744700, 3079743712, 134534966, 147938456,
134534970, 0, 0, 1, 2022, 3076109616, 3082007920, 134534966,
3079781004, 134524052, 1, 3086888948, 3218980752, 3218981040,
4294967295, 3218980888, 135357571, 3218981040, 3079760796, 3082007920,
0, 110932256, 3086888948, 134521220, 3086890600, 3218980832,
3086829337}
      }
    }},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 1,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
        h = {
  handler = 137719057,
  var = 137675017,
  chosen_clause = 1,
  tag = 0xbfddbefc,
  next = 0x0
}
#18 0x08107a83 in command_loop_2 () at keyboard.c:1370
        val = 1
#19 0x0816753a in internal_catch (tag=137713905, func=0x8107a60
<command_loop_2>, arg=137675017) at eval.c:1230
        c = {
  tag = 137713905,
  val = 137675017,
  next = 0x0,
  gcpro = 0x0,
  jmp = {{
      __jmpbuf = {0, 138184616, 138184600, -1075986216, -1350565759,
954883054},
      __mask_was_saved = 0,
      __saved_mask = {
        __val = {0, 0, 0, 0, 0, 0, 0, 3080170529, 0, 0, 0, 0, 0, 0, 0,
144967840, 3080961146, 137806532, 3081081200, 3218981144, 137901018,
137901016, 137904448, 3218981064, 135630821, 137904449, 137901018,
137675017, 137700672, 0, 0, 137675041}
      }
    }},
  backlist = 0x0,
  handlerlist = 0x0,
  lisp_eval_depth = 0,
  pdlcount = 2,
  poll_suppress_count = 1,
  interrupt_input_blocked = 0,
  byte_stack = 0x0
}
#20 0x08108467 in command_loop () at keyboard.c:1349
No locals.
#21 0x081087cb in recursive_edit_1 () at keyboard.c:958
        val = <value optimized out>
#22 0x08108901 in Frecursive_edit () at keyboard.c:1020
        buffer = 137675017
#23 0x080fe11c in main (argc=1, argv=0xbfddc4e4) at emacs.c:1784
        displayname = 0x0
        count_before = <value optimized out>
        dummy = 146836320
        stack_bottom_variable = 8 '\b'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608,
  rlim_max = 18446744073709551615
}
        no_loadup = 0
        junk = 0x0
(gdb) xbacktrace
(gdb)



In GNU Emacs 23.0.60.2 (i686-pc-linux-gnu, X toolkit)
 of 2008-03-26 on pod
Windowing system distributor `The X.Org Foundation', version 11.0.10300000
configured using `configure  '--without-toolkit-scroll-bars'
'--disable-font-backend' '--with-x-toolkit=lucid' '--with-rsvg'
'--prefix=/opt''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Dired by name

Minor modes in effect:
  minibuffer-indicate-depth-mode: t
  icicle-mode: t
  recentf-mode: t
  iswitchb-mode: t
  display-time-mode: t
  show-paren-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-x C-f C-g M-x o i m a <backspace> <backspace> <backspace>
<backspace> i m a g e - d i r e d <tab> <return> e
o n / r l x <return> y C-x k <return> M-x s w <backspace>
<backspace> w 3 m <backspace> <backspace> <backspace>
r e p o r t - e m a c s - b u g <return>

Recent messages:
Cleaning up the recentf list...done (0 removed)
Loading /home/dto/e/init.el (source)...done
Loading /home/dto/.emacs.d/elpa/package.el (source)...done
Loading /home/dto/.emms-cache...done
OVERVIEW
For information about GNU Emacs and the GNU system, type C-h C-a.
Marking matching files...
74 matching files marked.
Directory contains more than 50 image files.  Proceed? (y or n)
image-dired-thumbnail-mode enabled