bugGNU TeXmacs - Bugs: bug #49652, 1.99.5 segfault due to a change in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #49652: 1.99.5 segfault due to a change in r 10067

Submitted by:  Philippe Joyez <pjoyez>
Submitted on:  Sat 19 Nov 2016 02:25:29 PM UTC  
 
Category: NonePriority: 5 - Normal
Item Group: NoneStatus: Confirmed
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Closed
Release: Release: None
Fixed Release: NoneFixed Release: 
Keywords: 

Wed 01 Mar 2017 09:17:58 PM UTC, comment #3:

Actually, prior to rev 10067 that function was simply not called at all to display the help widget (and thus it had no reason to trigger the bug)...

Anyway the bug was prevented to occur by r10609-10611
but it does trigger some
TeXmacs] warning: invalid cursor position [ 1, 0, 0, 1, 1, 1, 0, 0, 95 ].

when the cursor is placed and moved around in the source code of the function that is displayed in the widget.

I'm closing nevertheless since the crash is gone.

Philippe Joyez <pjoyez>
Project Member
Fri 02 Dec 2016 09:56:19 PM UTC, comment #2:

Upon inspection of frame 0 it appears that the index i has run off. If I prevent this by applying the following patch

--- a/src/Plugins/Freetype/unicode_font.cpp
+++ b/src/Plugins/Freetype/unicode_font.cpp
@@ -183,8 +183,9 @@ static unsigned int
read_unicode_char (string s, int& i) {
if (s[i] == '<') {
i++;
- int start= i;
- while (s[i] != '>') i++;
+ int start= i, n=N(s);
+ while (s[i] != '>' && i<= n) i++;
+ if (i > n) { cout << "ERROR string not valid cork universal:" << s << "\n"; i=start; return (unsigned int) '<';}
if (s[start] == '#') {
start++;
return (unsigned int) from_hexadecimal (s (start, i++));

Texmacs does not crash anymore and it shows on the console
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=

(and indeed the function's code contains "<=").

But again, the bug did not occur before r 10067 and the function did not change then...

Philippe Joyez <pjoyez>
Project Member
Fri 02 Dec 2016 09:23:36 PM UTC, comment #1:

Here is a bt after the crash: the stack seems corrupted (the bt is not always, but this one is frequent).

(gdb) bt
#0 0x0000000000da85ff in unicode_font_rep::get_xpositions (this=0x4e96e18, s=..., xpos=0x7ffffffed540, ligf=false)
at ./Plugins/Freetype/unicode_font.cpp:309
#1 0x000000000085995e in font_rep::get_xpositions (this=0x4e96e18, s=..., xpos=0x7ffffffed540, xk=0)
at ./Graphics/Fonts/font.cpp:214
#2 0x0000000000c8c31c in smart_font_rep::get_xpositions (this=0x46c8a78, s=..., xpos=0x7ffffffed540, xk=0)
at ./Graphics/Fonts/smart_font.cpp:1204
#3 0x0000000000cd80f9 in text_box_rep::text_box_rep (this=0x0, ip=..., pos2=0, s=..., fn2=..., p2=..., xk2=...)
at ./Typeset/Boxes/Basic/text_boxes.cpp:102
#4 0x0000000000000000 in ?? ()

Philippe Joyez <pjoyez>
Project Member
Sat 19 Nov 2016 02:25:29 PM UTC, original submission:

I found by chance a reproducible way to have texmacs 1.99.5 segfaulting on linux and windows.

the sequence that lead to segfault is:

developer menu> (re)build autocompletion index
developer menu> open symbol browser

select item "safely-kill-window" in the list, and click the "see documentation" button : texmacs crashes

Given the name of that function and the fact that other items (at least most of them) do not trigger the segfault, this bug looks almost like a joke.

By going back in time I found that the bug appeared at rev 10067, but I really don't understand why.

I reproduced this on several linux distros and including with the statically built version available on the website and also on a windows build I made.

I've tried gdb, but don't know how to get useful information out of it to fix the problem.

console output of the problem:
-----------------------------

Texmacs] Populating autocompletions tree... 7712 symbols in 709 msec
Throwing segmentation fault
-------------------------------------------------
Error message:
segmentation fault

System information:
TeXmacs version : 1.99.5
Built by : pj
Building date : Thu Oct 20 21:25:01 CEST 2016
Operating system : linux-gnu
Vendor : pc
Processor : x86_64
Crash date : samedi 19 novembre 2016, 14:46:33 (UTC+0100)

Editor status:
Root path : [ 1 ]
Current path : [ 1, 0, 0, 0 ]
Shifted path : [ 1, 0, 0, 0 ]
Physical selection : [ 1, 0, 0, 0 ] -- [ 1, 0, 0, 0 ]

Backtrace of C++ stack:
texmacs.bin() [0xcdfc40]
texmacs.bin() [0x52b624]
/lib/x86_64-linux-gnu/libc.so.6 : () + 0x36cb0
texmacs.bin() [0xcc5f90]

-------------------------------------------------
terminate called after throwing an instance of 'string'
Aborted (core dumped)

Philippe Joyez <pjoyez>
Project Member

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by pjoyez (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 01 Mar 2017 09:17:58 PM UTCpjoyezOpen/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1