On Fri, Aug 22, 2008 at 3:32 AM, Matt Wozniski wrote:
> Not sure what's going on here, but I've found a crash that's easy to
> reproduce. First, open two X11 enabled vim (not gvim) processes. In
> the first, do:
> :let @+ = repeat('a', 1024*1024)
> in order to store 1MB of data to the clipboard. The exact amount is
> irrelevant, but the larger the size, the more often it will lead to a
> segfault.
>
> Then, in the second vim instance, repeatedly do ":reg +" and see what
> gets displayed. Depending upon the amount of data that you put on the
> clipboard, as well as upon some other factor I'm not seeing, this will
> either a) show a bunch of a's in register +, b) not show any
> registers, as though register + didn't exist, or c) cause the vim in
> which you copied to segfault, and the vim in which you're trying to
> display the register to enter a tight loop wasting a lot of CPU and
> only dying for kill -9. Just try the command 5 or so times and you
> should see a segfault - as well as the missing-register behavior. If
> you don't get the segfault at all, try upping the amount of data
> stored to the clipboard. If you get the segfault, but not the
> missing-register behavior, try lowering the amount of data stored to
> the clipboard. And if you can't reproduce either, that might help to
> pin down what exactly causes this.
>
> I can reproduce this on both a vim linked with the GTK2-Gnome gui, and
> one linked with the X11-Motif gui, so it doesn't seem to be something
> gnome-specific, either. This is vim 7.2.
>
> Let me know if we need more details.
>
> ~Matt
I tried it with Vim-7.2.2 (GTK2-GNOME) on Linux x86 and ":reg +" did
not show anything for me, no crash observed. But I expected to see
"aaa...." when doing ":reg +". Running both instances of Vim with
Valgrind memory checker finds problems in both instances of Vim:
1/ In first instance of vim where :let @+ = repeat('a', 1024*1024) is typed:
==6632== Invalid free() / delete / delete[]
==6632== at 0x402265C: free (vg_replace_malloc.c:323)
==6632== by 0x48B2D90: XtFree (in /usr/lib/libXt.so.6.0.0)
==6632== by 0x48D7ECC: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48CDFA9: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48CE0E1: XtAppNextEvent (in /usr/lib/libXt.so.6.0.0)
==6632== by 0x814D13B: xterm_update (os_unix.c:6502)
==6632== by 0x814B46F: RealWaitForChar (os_unix.c:4968)
==6632== by 0x814B0E0: WaitForChar (os_unix.c:4639)
==6632== by 0x8147033: mch_inchar (os_unix.c:389)
==6632== by 0x81B1F38: ui_inchar (ui.c:193)
==6632== by 0x80D585E: inchar (getchar.c:2959)
==6632== by 0x80D548F: vgetorpeek (getchar.c:2735)
==6632== by 0x80D3992: vgetc (getchar.c:1552)
==6632== by 0x80D3F0D: safe_vgetc (getchar.c:1757)
==6632== by 0x8121128: normal_cmd (normal.c:643)
==6632== by 0x80E540D: main_loop (main.c:1179)
==6632== by 0x80E4F5A: main (main.c:938)
==6632== Address 0x6c2d028 is 0 bytes inside a block of size 1,048,577 free'd
==6632== at 0x402265C: free (vg_replace_malloc.c:323)
==6632== by 0x48B2D90: XtFree (in /usr/lib/libXt.so.6.0.0)
==6632== by 0x48D4492: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48D7DB3: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48C13E4: XtDispatchEventToWidget (in /usr/lib/libXt.so.6.0.0)
==6632== by 0x48C1D87: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48C0CF6: XtDispatchEvent (in /usr/lib/libXt.so.6.0.0)
==6632== by 0x814D193: xterm_update (os_unix.c:6512)
==6632== by 0x814B46F: RealWaitForChar (os_unix.c:4968)
==6632== by 0x814B0E0: WaitForChar (os_unix.c:4639)
==6632== by 0x8147033: mch_inchar (os_unix.c:389)
==6632== by 0x81B1F38: ui_inchar (ui.c:193)
==6632== by 0x80D585E: inchar (getchar.c:2959)
==6632== by 0x80D548F: vgetorpeek (getchar.c:2735)
==6632== by 0x80D3992: vgetc (getchar.c:1552)
==6632== by 0x80D3F0D: safe_vgetc (getchar.c:1757)
==6632== by 0x8121128: normal_cmd (normal.c:643)
==6632== by 0x80E540D: main_loop (main.c:1179)
==6632== by 0x80E4F5A: main (main.c:938)
==6632== 408 (332 direct, 76 indirect) bytes in 2 blocks are
definitely lost in loss record 38 of 56
==6632== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6632== by 0x48B2F27: XtMalloc (in /usr/lib/libXt.so.6.0.0)
==6632== by 0x48D727B: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48D73BE: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48D76D5: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48D791A: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48C13E4: XtDispatchEventToWidget (in /usr/lib/libXt.so.6.0.0)
==6632== by 0x48C1D87: (within /usr/lib/libXt.so.6.0.0)
==6632== by 0x48C0CF6: XtDispatchEvent (in /usr/lib/libXt.so.6.0.0)
==6632== by 0x814D193: xterm_update (os_unix.c:6512)
==6632== by 0x814B46F: RealWaitForChar (os_unix.c:4968)
==6632== by 0x814B0E0: WaitForChar (os_unix.c:4639)
==6632== by 0x8147033: mch_inchar (os_unix.c:389)
==6632== by 0x81B1F38: ui_inchar (ui.c:193)
==6632== by 0x80D585E: inchar (getchar.c:2959)
==6632== by 0x80D548F: vgetorpeek (getchar.c:2735)
==6632== by 0x80D3992: vgetc (getchar.c:1552)
==6632== by 0x80D3F0D: safe_vgetc (getchar.c:1757)
==6632== by 0x8121128: normal_cmd (normal.c:643)
==6632== by 0x80E540D: main_loop (main.c:1179)
==6632== by 0x80E4F5A: main (main.c:938)
2/ In Vim instance where ":reg +" is typed:
==6651== Invalid read of size 1
==6651== at 0x40239E3: strlen (mc_replace_strmem.c:242)
==6651== by 0x81B44CA: clip_x11_request_selection_cb (ui.c:2079)
==6651== by 0x48D5FBA: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C13E4: XtDispatchEventToWidget (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C1D87: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C0CF6: XtDispatchEvent (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x814D193: xterm_update (os_unix.c:6512)
==6651== by 0x814B46F: RealWaitForChar (os_unix.c:4968)
==6651== by 0x814B027: mch_breakcheck (os_unix.c:4582)
==6651== by 0x81B20E5: ui_breakcheck (ui.c:368)
==6651== by 0x8135BD6: ex_display (ops.c:3999)
==6651== by 0x80A615D: do_one_cmd (ex_docmd.c:2621)
==6651== by 0x80A3A00: do_cmdline (ex_docmd.c:1095)
==6651== by 0x81288B3: nv_colon (normal.c:5214)
==6651== by 0x8121F3E: normal_cmd (normal.c:1181)
==6651== by 0x80E540D: main_loop (main.c:1179)
==6651== by 0x80E4F5A: main (main.c:938)
==6651== Address 0x621a8a0 is 0 bytes after a block of size 1,048,576 alloc'd
==6651== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6651== by 0x48B2F27: XtMalloc (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48B3030: __XtMalloc (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48D5B9A: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48D5CBA: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C13E4: XtDispatchEventToWidget (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C1D87: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C0CF6: XtDispatchEvent (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x81B46F3: clip_x11_request_selection (ui.c:2161)
==6651== by 0x814D24B: clip_xterm_request_selection (os_unix.c:6538)
==6651== by 0x81B3C04: clip_gen_request_selection (ui.c:1480)
==6651== by 0x81386A1: clip_get_selection (ops.c:5640)
==6651== by 0x813038E: may_get_selection (ops.c:916)
==6651== by 0x8135A83: ex_display (ops.c:3957)
==6651== by 0x80A615D: do_one_cmd (ex_docmd.c:2621)
==6651== by 0x80A3A00: do_cmdline (ex_docmd.c:1095)
==6651== by 0x81288B3: nv_colon (normal.c:5214)
==6651== by 0x8121F3E: normal_cmd (normal.c:1181)
==6651== by 0x80E540D: main_loop (main.c:1179)
==6651== by 0x80E4F5A: main (main.c:938)
==6651== 1 bytes in 1 blocks are definitely lost in loss record 1 of 58
==6651== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6651== by 0x4AE0B8C: XGetWindowProperty (in /usr/lib/libX11.so.6.2.0)
==6651== by 0x48D5EC2: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C13E4: XtDispatchEventToWidget (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C1D87: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C0CF6: XtDispatchEvent (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x814D193: xterm_update (os_unix.c:6512)
==6651== by 0x814B46F: RealWaitForChar (os_unix.c:4968)
==6651== by 0x814B027: mch_breakcheck (os_unix.c:4582)
==6651== by 0x81B20E5: ui_breakcheck (ui.c:368)
==6651== by 0x8135BD6: ex_display (ops.c:3999)
==6651== by 0x80A615D: do_one_cmd (ex_docmd.c:2621)
==6651== by 0x80A3A00: do_cmdline (ex_docmd.c:1095)
==6651== by 0x81288B3: nv_colon (normal.c:5214)
==6651== by 0x8121F3E: normal_cmd (normal.c:1181)
==6651== by 0x80E540D: main_loop (main.c:1179)
==6651== by 0x80E4F5A: main (main.c:938)
==6651== 516 (440 direct, 76 indirect) bytes in 3 blocks are
definitely lost in loss record 42 of 58
==6651== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6651== by 0x48B2F27: XtMalloc (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48D3CEA: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48D3DEA: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48D6865: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48D6FCF: XtGetSelectionValue (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x81B4675: clip_x11_request_selection (ui.c:2132)
==6651== by 0x814D24B: clip_xterm_request_selection (os_unix.c:6538)
==6651== by 0x81B3C04: clip_gen_request_selection (ui.c:1480)
==6651== by 0x81386A1: clip_get_selection (ops.c:5640)
==6651== by 0x8130368: may_get_selection (ops.c:909)
==6651== by 0x8135A83: ex_display (ops.c:3957)
==6651== by 0x80A615D: do_one_cmd (ex_docmd.c:2621)
==6651== by 0x80A3A00: do_cmdline (ex_docmd.c:1095)
==6651== by 0x81288B3: nv_colon (normal.c:5214)
==6651== by 0x8121F3E: normal_cmd (normal.c:1181)
==6651== by 0x80E540D: main_loop (main.c:1179)
==6651== by 0x80E4F5A: main (main.c:938)
==6651==
==6651==
==6651== 2,097,166 bytes in 2 blocks are possibly lost in loss record 58 of 58
==6651== at 0x4022AB8: malloc (vg_replace_malloc.c:207)
==6651== by 0x48B2F27: XtMalloc (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48B3030: __XtMalloc (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48D5B9A: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48D5CBA: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C13E4: XtDispatchEventToWidget (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C1D87: (within /usr/lib/libXt.so.6.0.0)
==6651== by 0x48C0CF6: XtDispatchEvent (in /usr/lib/libXt.so.6.0.0)
==6651== by 0x81B46F3: clip_x11_request_selection (ui.c:2161)
==6651== by 0x814D24B: clip_xterm_request_selection (os_unix.c:6538)
==6651== by 0x81B3C04: clip_gen_request_selection (ui.c:1480)
==6651== by 0x81386A1: clip_get_selection (ops.c:5640)
==6651== by 0x813038E: may_get_selection (ops.c:916)
==6651== by 0x8135A83: ex_display (ops.c:3957)
==6651== by 0x80A615D: do_one_cmd (ex_docmd.c:2621)
==6651== by 0x80A3A00: do_cmdline (ex_docmd.c:1095)
==6651== by 0x81288B3: nv_colon (normal.c:5214)
==6651== by 0x8121F3E: normal_cmd (normal.c:1181)
==6651== by 0x80E540D: main_loop (main.c:1179)
==6651== by 0x80E4F5A: main (main.c:938)
Doing the same with a smaller value such as ":let @+ = repeat('a', 10*10"
gives no error with Valgrind, and the second instance of Vim shows a bunch
of "aaa..." when doing ":reg +" as expected. I did not have the time to look
further yet.
-- Dominique
--~--~---------~--~----~------------~-------~--~----~
You received this message from the "vim_dev" maillist.
For more information, visit http://www.vim.org/maillist.php
-~----------~----~----~----~------~----~------~--~---
