Re: Emacs 23.1.93 pretest

[Chong Yidong]

Eli Zaretskii <address@hidden> writes:

>> Hmm, this is strange.  This change (actually the succeeding 2010-02-06
>> change to the same place) switches from using alloca to SAFE_ALLOCA
>> (i.e. malloc, since the desired structure is large).  But the only way I
>> can see for this code to crash is if load_charset_map somehow makes a
>> pointer into the allocated structure.  But in that case, the old alloca
>> case should have crashed too.
>
> Yes, it _is_ weird.  But the effect (see below) does look like we are
> freeing memory being used, or maybe overwriting some allocated buffer,
> or in some other way thrashing the arena.

Hmm, I think I may see the problem.  Does this patch help?

=== modified file 'src/charset.c'
*** src/charset.c       2010-02-06 13:23:33 +0000
--- src/charset.c       2010-02-28 01:45:17 +0000
***************
*** 530,535 ****
--- 530,536 ----
       large (larger than MAX_ALLOCA).  */
    SAFE_ALLOCA (head, struct charset_map_entries *,
               sizeof (struct charset_map_entries));
+   bzero (head, sizeof (struct charset_map_entries));
    entries = head;
  
    n_entries = 0;
***************
*** 556,561 ****
--- 557,563 ----
        {
          SAFE_ALLOCA (entries->next, struct charset_map_entries *,
                       sizeof (struct charset_map_entries));
+         bzero (entries->next, sizeof (struct charset_map_entries));
          entries = entries->next;
        }
        idx = n_entries % 0x10000;
***************
*** 595,600 ****
--- 597,603 ----
       large (larger than MAX_ALLOCA).  */
    SAFE_ALLOCA (head, struct charset_map_entries *,
               sizeof (struct charset_map_entries));
+   bzero (head, sizeof (struct charset_map_entries));
    entries = head;
  
    n_entries = 0;
***************
*** 631,636 ****
--- 634,640 ----
        {
          SAFE_ALLOCA (entries->next, struct charset_map_entries *,
                       sizeof (struct charset_map_entries));
+         bzero (entries->next, sizeof (struct charset_map_entries));
          entries = entries->next;
        }
        idx = n_entries % 0x10000;