[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#5856: 24.0.50; Crash in redisplay

From: Eli Zaretskii
Subject: bug#5856: 24.0.50; Crash in redisplay
Date: Fri, 09 Apr 2010 00:29:26 +0300

> Date: Thu, 08 Apr 2010 18:13:20 +0200
> From: Jan Djärv <address@hidden>
> CC: address@hidden
> > How many of these "C-x b"s caused the list of possible completions to
> > exceed one screen line?  If the answer is "many" or "all", then could
> > you try to figure out or recall if there was anything special about
> > the ones that caused crashes?
> Somewhere between "many" and "all".  It is the same list of files I was 
> editing.  They mostly start on x (xsettings, xtern, xfns, xlwmenu, and so 
> on), 
> so it probably looked pretty much the same each time.
> There was nothing special about the one that caused a crash I can think of.
> It seems it just takes time. I just got a crash again, but this time I hadn't 
> started it from gdb, unfortunately.  Also, about 3-5 hours before it crashed 
> this time.

I think I found the problem.  The invalid glyph that caused the crash
was not supposed to be dereferenced.  Its pointer is exactly the same
as `end', as your backtrace shows:

  #0  0x000000000044d2f1 in set_cursor_from_row (w=0x1378d60, row=0x1fbf550, 
  matrix=0x18217a0, delta=0, delta_bytes=0, dy=0, dvpos=0) at 
           glyph = 0x1fa5cd0
           end = 0x1fa5cd0

But `end' points beyond the last glyph in the TEXT_AREA of the glyph

  struct glyph *end = glyph + row->used[TEXT_AREA];

If we dereference this pointer, we could be referencing uninitialized
memory, e.g. if there are no margins (i.e. no glyphs in the row after

The old code was careful not to dereference such a pointer, but when I
rewrote set_cursor_from_row, I failed to copy those precautions.

I installed a fix.  Please see if it stops these crashes, and if so,
please close the bug report.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]