bugGNU TeXmacs - Bugs: bug #49652, 1.99.5 segfault due to a change in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #49652: 1.99.5 segfault due to a change in r 10067

Submitter:  Philippe Joyez <pjoyez>
Submitted:  Sat 19 Nov 2016 02:25:29 PM UTC
   
 
Category:  None Priority:  5 - Normal
Item Group:  None Status:  Confirmed
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  None Release: 
Fixed Release:  None Fixed Release: 
Keywords: 

Wed 01 Mar 2017 09:17:58 PM UTC, comment #3: 

Actually, prior to rev 10067 that function was simply not called at all to display the help widget (and thus it had no reason to trigger the bug)...

Anyway the bug was prevented to occur by r10609-10611
 but it does trigger some
TeXmacs] warning: invalid cursor position [ 1, 0, 0, 1, 1, 1, 0, 0, 95 ].

when the cursor is placed and moved around in the source code of the function that is displayed in the widget.

I'm closing nevertheless since the crash is gone.

Philippe Joyez <pjoyez>
Group Member
Fri 02 Dec 2016 09:56:19 PM UTC, comment #2: 

Upon inspection of frame 0 it appears that the index i has run off. If I prevent this by applying the following patch

--- a/src/Plugins/Freetype/unicode_font.cpp
+++ b/src/Plugins/Freetype/unicode_font.cpp
@@ -183,8 +183,9 @@ static unsigned int
 read_unicode_char (string s, int& i) {
   if (s[i] == '<') {
     i++;
-    int start= i;
-    while (s[i] != '>') i++;
+    int start= i, n=N(s);
+    while (s[i] != '>' && i<= n) i++;
+    if (i > n) { cout << "ERROR string not valid cork universal:" << s << "\n"; i=start; return (unsigned int) '<';}
     if (s[start] == '#') {
       start++;
       return (unsigned int) from_hexadecimal (s (start, i++));

Texmacs does not crash anymore and it shows on the console
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=
ERROR string not valid cork universal:<=

(and indeed the function's code contains "<=").

But again, the bug did not occur before r 10067 and the function did not change then...



Philippe Joyez <pjoyez>
Group Member
Fri 02 Dec 2016 09:23:36 PM UTC, comment #1: 

Here is a bt after the crash: the stack seems corrupted (the bt is not always, but this one is frequent).

(gdb) bt
#0  0x0000000000da85ff in unicode_font_rep::get_xpositions (this=0x4e96e18, s=..., xpos=0x7ffffffed540, ligf=false)
    at ./Plugins/Freetype/unicode_font.cpp:309
#1  0x000000000085995e in font_rep::get_xpositions (this=0x4e96e18, s=..., xpos=0x7ffffffed540, xk=0)
    at ./Graphics/Fonts/font.cpp:214
#2  0x0000000000c8c31c in smart_font_rep::get_xpositions (this=0x46c8a78, s=..., xpos=0x7ffffffed540, xk=0)
    at ./Graphics/Fonts/smart_font.cpp:1204
#3  0x0000000000cd80f9 in text_box_rep::text_box_rep (this=0x0, ip=..., pos2=0, s=..., fn2=..., p2=..., xk2=...)
    at ./Typeset/Boxes/Basic/text_boxes.cpp:102
#4  0x0000000000000000 in ?? ()

Philippe Joyez <pjoyez>
Group Member
Sat 19 Nov 2016 02:25:29 PM UTC, original submission:  

I found by chance a reproducible way to have texmacs 1.99.5 segfaulting on linux and windows.

the sequence that lead to segfault is:

developer menu> (re)build autocompletion index
developer menu> open symbol browser

select item "safely-kill-window" in the list, and click the "see documentation" button : texmacs crashes

Given the name of that function and the fact that other items (at least most of them) do not trigger the segfault, this bug looks almost like a joke.

By going back in time I found that the bug appeared at rev 10067, but I really don't understand why.

I reproduced this on several linux distros and including with the statically built version available on the website and also on a windows build I made.

I've tried gdb, but don't know how to get useful information out of it to fix the problem.


console output of the problem:
-----------------------------

Texmacs] Populating autocompletions tree... 7712 symbols in 709 msec
Throwing segmentation fault
-------------------------------------------------
Error message:
  segmentation fault

System information:
  TeXmacs version  : 1.99.5
  Built by         : pj
  Building date    : Thu Oct 20 21:25:01 CEST 2016
  Operating system : linux-gnu
  Vendor           : pc
  Processor        : x86_64
  Crash date       : samedi 19 novembre 2016, 14:46:33 (UTC+0100)

Editor status:
  Root path          : [ 1 ]
  Current path       : [ 1, 0, 0, 0 ]
  Shifted path       : [ 1, 0, 0, 0 ]
  Physical selection : [ 1, 0, 0, 0 ] -- [ 1, 0, 0, 0 ]

Backtrace of C++ stack:
  texmacs.bin() [0xcdfc40]
  texmacs.bin() [0x52b624]
  /lib/x86_64-linux-gnu/libc.so.6 : () + 0x36cb0
  texmacs.bin() [0xcc5f90]

-------------------------------------------------
terminate called after throwing an instance of 'string'
Aborted (core dumped)

Philippe Joyez <pjoyez>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by pjoyez (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-03-01 pjoyez Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code