Wed 28 Sep 2011 10:20:35 PM UTC, original submission:
I am able to consistently kill mit-scheme in OS X/X11 when using edwin by doing the following:
On a new line in edwin, create a literal tab character (e.g. in Fundamental mode) and then insert several characters. Then, proceed to insert characters BETWEEN the tab and the last (non-line-feed) character on the line until the cursor would normally line-wrap (i.e. the highlighted character is the character before the '\' line-wrap marker).
Typing any additional character such that the cursor would line-wrap causes the uncaught arithmetic exception (appearing to be a divide-by-zero).
This exception is also raised if the line-feed character at the end of the line is deleted with a backspace (such that the subsequent line would become concatenated to the end of the line-wrapped line).
In gdb, this backtrace reports as follows (in the i386 build):
(gdb) bt
#0 0x00ab94ff in ?? ()
#1 0x000007fe in ?? ()
Cannot access memory at address 0x3ffffff
and my registers are as follows:
(gdb) info registers
eax 0x13c0 5056
ecx 0x13c0 5056
edx 0x0 0
ebx 0x4000 16384
esp 0x80d94 0x80d94
ebp 0x3ffffff 0x3ffffff
esi 0x406ebd0 67562448
edi 0xe129b4 14756276
eip 0xab94ff 0xab94ff
eflags 0x10246 66118
cs 0x1b 27
ss 0x23 35
ds 0x23 35
es 0x23 35
fs 0x0 0
gs 0xf 15
Nearby dissassembled instructions include:
0x00ab94e8: or $0x1a,%edx
0x00ab94eb: ror $0x6,%edx
0x00ab94ee: cmp $0x68000000,%edx
0x00ab94f4: je 0xab9513
0x00ab94f6: mov %ebx,%eax
0x00ab94f8: mov %ecx,%eax
0x00ab94fa: mov %eax,%edx
0x00ab94fc: sar $0x1f,%edx
0x00ab94ff: idivl 0x600(%esi)
0x00ab9505: shl $0x6,%eax
0x00ab9508: or $0x1a,%eax
0x00ab950b: ror $0x6,%eax
0x00ab950e: mov %eax,0x8(%esi)
0x00ab9511: jmp 0xab94b9
0x00ab9513: mov %ecx,%eax
0x00ab9515: mov %eax,%edx
I am running OS X 10.7 and have observed this bug in the binary build of MIT-Scheme Release 9.0.1 (Microcode 15.1 || Runtime 15.7 || SF 4.41 || LIAR/i386 4.118 || Edwin 3.116) in both the i386 and x86-64 builds (albeit with different register values), and also observed what I believe was this bug in OS X 10.6.
In OS X 10.7, I am using Apple's stock X11: XQuartz 2.6.3 (xorg-server 1.10.2)
|