Re: "corrupted size vs. prev_size"

[Eli Zaretskii]

> From: Lars Ingebrigtsen <larsi@gnus.org>
> Date: Tue, 12 Apr 2022 12:59:38 +0200
> 
> After the recent GIF/WebP caching changes, I sometimes get "corrupted
> size vs. prev_size" and Emacs then hangs, so I guess I'm messing up
> something in the memory allocation/freeing/writing bits somewhere.
> 
> But I'm getting it very, very rarely -- like one out of every thirty
> times with a bunch of WebP/GIF images, so it's hard to track down.
> Connecting to the hung Emacs isn't very informative:
> 
> (gdb) info threads
>   Id   Target Id                                        Frame 
> * 1    Thread 0x7f303a430000 (LWP 84136) "emacs"        0x00007f303d54e1f3 in 
> __pselect (nfds=22, readfds=0x7ffd058d69e0, writefds=0x7ffd058d6a60, 
>     exceptfds=0x0, timeout=0x7ffd058d6800, sigmask=<optimized out>)
>     at ../sysdeps/unix/sysv/linux/pselect.c:52
>   2    Thread 0x7f3039229640 (LWP 84137) "gmain"        0x00007f303d54b87f in 
> __GI___poll (fds=0x561b63028870, nfds=2, timeout=-1)
>     at ../sysdeps/unix/sysv/linux/poll.c:29
>   3    Thread 0x7f303898c640 (LWP 84138) "gdbus"        0x00007f303d54b87f in 
> __GI___poll (fds=0x561b63452d20, nfds=3, timeout=-1)
>     at ../sysdeps/unix/sysv/linux/poll.c:29
>   4    Thread 0x7f3033fff640 (LWP 84139) "dconf worker" 0x00007f303d54b87f in 
> __GI___poll (fds=0x561b634be7d0, nfds=1, timeout=-1)
>     at ../sysdeps/unix/sysv/linux/poll.c:29
> 
> I've stared at the code for some time now to see whether I can track the
> problem down that way -- perhaps I've got some lifetime issues;
> deallocating webp iterators twice, for instance, or something similar in
> the gif code.  Does anybody else see something obviously wonky in that
> code in gif_load or webp_load?

I didn't see anything obviously wonky, but I can report that I had one
segfault in webp_load.  I couldn't reproduce it no matter how hard I
tried.  Here's the backtrace from that crash, in case it helps (I
doubt that):

  Thread 1 received signal SIGSEGV, Segmentation fault.
  0x61b4c91a in ?? () from D:\usr\bin\libwebp-7.dll
  (gdb) bt
  #0  0x61b4c91a in ?? () from D:\usr\bin\libwebp-7.dll
  #1  0x61b4ce35 in ?? () from D:\usr\bin\libwebp-7.dll
  #2  0x61b4d795 in ?? () from D:\usr\bin\libwebp-7.dll
  #3  0x6bdc18f5 in ?? () from D:\usr\bin\libwebpdemux-2.dll
  #4  0x013d9d13 in webp_load (f=0x7575c68, img=0x7adfd88) at image.c:9467
  #5  0x013cf399 in lookup_image (f=0x7575c68, spec=XIL(0xc000000006791ac0),
      face_id=0) at image.c:2666
  #6  0x0104d011 in handle_single_display_spec (it=0x82ac68,
      spec=XIL(0xc000000006791ac0), object=XIL(0xa000000007697960),
      overlay=XIL(0), position=0x82ad50, bufpos=1, display_replaced=0,
      frame_window_p=true, enable_eval_p=true) at xdisp.c:6012
  #7  0x01049c42 in handle_display_spec (it=0x82ac68,
      spec=XIL(0xc000000006791ac0), object=XIL(0xa000000007697960),
      overlay=XIL(0), position=0x82ad50, bufpos=1, frame_window_p=true)
      at xdisp.c:5475
  #8  0x010490fb in handle_display_prop (it=0x82ac68) at xdisp.c:5383
  #9  0x010449c2 in handle_stop (it=0x82ac68) at xdisp.c:3875
  #10 0x010515db in reseat (it=0x82ac68, pos=..., force_p=true) at xdisp.c:7336
  #11 0x01043c26 in init_iterator (it=0x82ac68, w=0x7575e80, charpos=1,
      bytepos=1, row=0x7635008, base_face_id=DEFAULT_FACE_ID) at xdisp.c:3476
  #12 0x01043cbe in start_display (it=0x82ac68, w=0x7575e80, pos=...)
      at xdisp.c:3492
  #13 0x0107adfc in try_window (window=XIL(0xa000000007575e80), pos=...,
      flags=1) at xdisp.c:20019
  #14 0x01077a6e in redisplay_window (window=XIL(0xa000000007575e80),
      just_this_one_p=false) at xdisp.c:19432
  #15 0x0106f1e3 in redisplay_window_0 (window=XIL(0xa000000007575e80))
      at xdisp.c:17077
  #16 0x0126c924 in internal_condition_case_1 (
      bfun=0x106f18b <redisplay_window_0>, arg=XIL(0xa000000007575e80),
      handlers=XIL(0xc0000000060b349c), hfun=0x106f148 <redisplay_window_error>)
      at eval.c:1474
  #17 0x0106f10a in redisplay_windows (window=XIL(0xa000000007575e80))
      at xdisp.c:17057
  #18 0x0106d96a in redisplay_internal () at xdisp.c:16525
  #19 0x0106e7fb in redisplay_preserve_echo_area (from_where=8) at xdisp.c:16878
  #20 0x0118d249 in detect_input_pending_run_timers (do_display=true)
      at keyboard.c:10758
  #21 0x012fa97a in wait_reading_process_output (time_limit=30, nsecs=0,
      read_kbd=-1, do_display=true, wait_for_cell=XIL(0), wait_proc=0x0,
      just_wait_proc=0) at process.c:5695
  #22 0x01012764 in sit_for (timeout=make_fixnum(30), reading=true,
      display_option=1) at dispnew.c:6154
  #23 0x01171b37 in read_char (commandflag=1, map=XIL(0xc000000007679cb0),
      prev_event=XIL(0), used_mouse_menu=0x82f49f, end_time=0x0)
      at keyboard.c:2837
  #24 0x0118a950 in read_key_sequence (keybuf=0x82f770, prompt=XIL(0),
      dont_downcase_last=false, can_return_switch_frame=true,
      fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:9932
  #25 0x0116c667 in command_loop_1 () at keyboard.c:1401
  #26 0x0126c83a in internal_condition_case (bfun=0x116bf54 <command_loop_1>,
      handlers=XIL(0x90), hfun=0x116af52 <cmd_error>) at eval.c:1450
  #27 0x0116b9c1 in command_loop_2 (handlers=XIL(0x90)) at keyboard.c:1142
  #28 0x0126b6d9 in internal_catch (tag=XIL(0xfb70),
      func=0x116b98a <command_loop_2>, arg=XIL(0x90)) at eval.c:1180
  #29 0x0116b944 in command_loop () at keyboard.c:1120
  #30 0x0116a9b2 in recursive_edit_1 () at keyboard.c:729
  #31 0x0116ac50 in Frecursive_edit () at keyboard.c:812
  #32 0x01165c0a in main (argc=4, argv=0xa42990) at emacs.c:2447

  Lisp Backtrace:
  "redisplay_internal (C function)" (0x0)