[mgp-users-jp 00659] FW: Bug#51513: mgp: coredumps on error reporting

[Fumitoshi UKAI <ukai@debian.or.jp>]

$B$3$&$$$&%P%0%l%]!<%H$b$-$F$^$9!#(B
http://bugs.debian.org/51513

| mgp writes the following and then segfaults:
| =====
| undefined directive 248 at page 6 line 24:
|         0x824fab8: 
| =====
| 
| Directive number varies.
| 
| Bug appears to be triggered by:
| * run "mgp -o"
| * edit/save page being viewed
| * have page refreshed by expose event
| * next page
| 
| Next page is drawn, then message is printed and core is dumped.
| Not easy to reproduce, maybe the random directive is sometimes valid
| - I often have my "next-slide" command duplicated :|
| 
| GDB backtrace:
| 
| #0  0x4011ca8e in vfprintf () from /lib/libc.so.6
| #1  0x4011fab3 in vfprintf () from /lib/libc.so.6
| #2  0x4011b426 in vfprintf () from /lib/libc.so.6
| #3  0x401222c1 in fprintf () from /lib/libc.so.6
| #4  0x8056b17 in debug0 (p=0x824fb78) at parse.c:1237
| #5  0x804e8d0 in process_direc (state=0x8093b2c, seenpause=0xbfffd998)
|     at draw.c:755
| #6  0x804dd7d in draw_one (state=0x8093b2c, e=0xbfffdb08) at draw.c:347
| #7  0x804c735 in main_loop (start_page=1) at mgp.c:709
| #8  0x804bf0b in main (argc=1, argv=0xbffffc6c) at mgp.c:418
| (gdb) f 4
| #4  0x8056b17 in debug0 (p=0x824fb78) at parse.c:1237
| 1237            fprintf(stderr, " %s ", ctl_words[p->ct_op].ctl_string);
| (gdb) p p->ct_op
| $1 = 176 '.AN0'
| 
| 
| It appears this value is a bit high...
| 
| FWIW:
| 
| (gdb) up
| #5  0x804e8d0 in process_direc (state=0x8093b2c, seenpause=0xbfffd998)
|     at draw.c:755
| 755                     debug0(cp);
| (gdb) p* state
| $19 = {page = 6, line = 24, cp = 0x824fb78, phase = P_PAGE, 
|   curprefix = 0x8243628 " ", tabprefix = 0x0, align = 3, special = 0, 
|   leftfillpos = 0, target = 121634817, height = 600, width = 800, ypos = 446, 
|   have_mark = 0, mark_ypos = 0, repaint = 0, maxascent = 18, maxdescent = 5, 
|   linewidth = 11, xfont = 0x82d16f8, obj = 0x0, objlast = 0x0}
| (gdb) p* state->cp
| $20 = {ct_op = 176 'N0', ct_flag = 43 '+', ct_page = 137402760, ct_next = 0x0, 
|   ct_val = {ctrl_double = {ct_value = 0}, ctrl_int = {ct_value = 0}, 
|     ctrl_long = {ct_value = 0}, ctrl_char = {ct_value = 0x0}, ctrl_char2 = {
|       ct_value1 = 0x0, ct_value2 = 0x0}, ctrl_image = {ct_fname = 0x0, 
|       ct_numcolor = 0, ct_ximagesize = 0, ct_yimagesize = 0, ct_zoomflag = 0}, 
|     ctrl_grad = {ct_numcolor = 0, ct_direction = 0, ct_width = 0, 
|       ct_height = 0, ct_zoomflag = 0, ct_mode = 0, ct_g_colors = 17, 
|       colors = 0x647473}, ctrl_bar = {ct_color = 0, ct_width = 0, 
|       ct_start = 0, ct_length = 0}, ctrl_args = {ct_argc = 0, ct_argv = 0x0, 
|       ct_flag = 0}, ctrl_icon = {ct_value = 0x0, ct_color = 0, ct_size = 0}, 
|     ctrl_pcache = {ct_cflag = 0, ct_cmode = 0, ct_ceffect = 0, ct_cvalue = 0}}}
| 
| 
| I kept the corefile in case more info is needed.
| Please tell me if I can help further.

-- 
$B1-;tJ8IR(B