[tex-live] mf segfault

Fri Dec 24 16:47:39 CET 2004

I don't know if this helps, but I ran a version with "tracingall", 
and it crashed. Took a loooong time, but crashed nontheless. This 
is *not* the TL2004 binary, but mfw from tetex 2.0.2 under Mandrake 10.1

Attached are the last 500 lines of the 2GB log file.

Greetings, Taco

[taco at glenlivet mf-segfault]$ uname -a
  Linux glenlivet.elvenkind.com 2.6.3-13mdk #1 Tue May 18 18:49:17 EDT 2004 i686 AMD Duron(tm) processor unknown GNU/Linux
[taco at glenlivet mf-segfault]$  file /usr/bin/mfw
  /usr/bin/mfw: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), for GNU/Linux 2.2.5, dynamically linked (uses shared libs), stripped
[taco at glenlivet mf-segfault]$  ls -l /usr/bin/mf
  lrwxrwxrwx  1 root root 3 Jun 28 10:05 /usr/bin/mf -> mfw*
[taco at glenlivet mf-segfault]$ head -1 feta20.log
  This is METAFONT, Version 2.7182 (Web2C 7.4.5) (base=mf 2004.12.24)  24 DEC 2004 15:43

Also, here is a backtrace from a non-stripped, non-optimized compiled version of mf:

Program received signal SIGSEGV, Segmentation fault.
0x0806de9c in zpwithxbecomingq (p=4364, x=5145, q=44603, t=17 '\021') at mf1.c:2382
2382      while ( mem [mem [s ].hhfield .lhfield + 1 ].cint > sx ) {
(gdb) bt
#0  0x0806de9c in zpwithxbecomingq (p=4364, x=5145, q=44603, t=17 '\021') at mf1.c:2382
#1  0x0806e5ad in zlineareq (p=44603, t=17 '\021') at mf1.c:2559
#2  0x0807cb72 in ztryeq (l=44601, r=0) at mf1.c:9434
#3  0x0807cff0 in zmakeeq (lhs=44601) at mf1.c:9605
#4  0x0807d484 in doassignment () at mf1.c:9745
#5  0x0808090a in dostatement () at mf2.c:1526
#6  0x08081bf2 in scanprimary () at mf2.c:2101
#7  0x080828d9 in scansecondary () at mf2.c:2566
#8  0x080829bf in scantertiary () at mf2.c:2605
#9  0x08082abc in scanexpression () at mf2.c:2651
#10 0x080823f1 in scanprimary () at mf2.c:2379
#11 0x080828d9 in scansecondary () at mf2.c:2566
#12 0x080829bf in scantertiary () at mf2.c:2605
#13 0x08082abc in scanexpression () at mf2.c:2651
#14 0x080808dc in dostatement () at mf2.c:1520
#15 0x08081bf2 in scanprimary () at mf2.c:2101
#16 0x080828d9 in scansecondary () at mf2.c:2566
#17 0x080829bf in scantertiary () at mf2.c:2605
#18 0x08082abc in scanexpression () at mf2.c:2651
#19 0x080808dc in dostatement () at mf2.c:1520
#20 0x08081bf2 in scanprimary () at mf2.c:2101
#21 0x080828d9 in scansecondary () at mf2.c:2566
#22 0x080829bf in scantertiary () at mf2.c:2605
#23 0x08082abc in scanexpression () at mf2.c:2651
#24 0x080808dc in dostatement () at mf2.c:1520
#25 0x08081bf2 in scanprimary () at mf2.c:2101
#26 0x080828d9 in scansecondary () at mf2.c:2566
#27 0x080829bf in scantertiary () at mf2.c:2605
#28 0x08082abc in scanexpression () at mf2.c:2651
#29 0x080808dc in dostatement () at mf2.c:1520
#30 0x08081bf2 in scanprimary () at mf2.c:2101
#31 0x080828d9 in scansecondary () at mf2.c:2566
#32 0x080829bf in scantertiary () at mf2.c:2605
#33 0x08082abc in scanexpression () at mf2.c:2651
#34 0x080808dc in dostatement () at mf2.c:1520
#35 0x08081bf2 in scanprimary () at mf2.c:2101
#36 0x080828d9 in scansecondary () at mf2.c:2566
#37 0x080829bf in scantertiary () at mf2.c:2605
#38 0x08082abc in scanexpression () at mf2.c:2651
#39 0x080808dc in dostatement () at mf2.c:1520
#40 0x08081bf2 in scanprimary () at mf2.c:2101
#41 0x080828d9 in scansecondary () at mf2.c:2566
#42 0x080829bf in scantertiary () at mf2.c:2605
#43 0x08082abc in scanexpression () at mf2.c:2651
#44 0x080808dc in dostatement () at mf2.c:1520
#45 0x08080ce3 in maincontrol () at mf2.c:1701
#46 0x0804dac5 in mainbody () at mfini.c:1305
#47 0x080872aa in main (ac=2, av=0xbffff4e4) at mfextra.c:330
(gdb) p mem[s]
$3 = {hhfield = {v = {LH = 1114116, RH = 17}, u = {B1 = 4, B0 = 17}}, u = {junk = 1114116, CINT = 17}, v = {
    junk = 1114116, QQQQ = {u = {B3 = 17 '\021', B2 = 0 '\0', B1 = 0 '\0', B0 = 0 '\0'}}}}
(gdb) p mem [mem [s ].hhfield .v.LH + 1 ]
Cannot access memory at address 0x40b3e030

Olaf Weber wrote:
> Werner LEMBERG writes:
> 
> 
>>>Well, the same seg fault occured using nonstriped mf binary.
>>>Compiled and tested on the same machine (RH9.0)
> 
> 
>>Yes, I've sent a backtrace to Olaf already.  For the interested, I'm
>>repeating it here.
> 
> 
>>======================================================================
> 
> 
>>Program received signal SIGSEGV, Segmentation fault.
>>0x0806e781 in zpwithxbecomingq (p=6725, x=4719, q=48049, t=17 '\021')
>>    at mf1.c:2382
>>(gdb) bt
>>#0  0x0806e781 in zpwithxbecomingq (p=6725, x=4719, q=48049, t=17 '\021')
>>    at mf1.c:2382
> 
> 
> In mf1.c:
> 
>    2381   sx = mem [x + 1 ].cint ;
> *  2382   while ( mem [mem [s ].hhfield .lhfield + 1 ].cint > sx ) {
>    2383
>    2384     r = s ;
>    2385     s = mem [s ].hhfield .v.RH ;
>    2386   }
> 
> In mf.web:
> 
>   12790 @p function p_with_x_becoming_q(@!p,@!x,@!q:pointer;@!t:small_number):pointer;
>   12791 var @!r,@!s:pointer; {for list manipulation}
>   12792 @!v:integer; {coefficient of |x|}
>   12793 @!sx:integer; {serial number of |x|}
>   12794 begin s:=p; r:=temp_head; sx:=value(x);
> * 12795 while value(info(s))>sx do
>   12796   begin r:=s; s:=link(s);
>   12797   end;
>   12798 if info(s)<>x then p_with_x_becoming_q:=p
>   12799 else  begin link(temp_head):=p; link(r):=link(s); v:=value(s);
>   12800   free_node(s,dep_node_size);
>   12801   p_with_x_becoming_q:=p_plus_fq(link(temp_head),v,q,t,dependent);
>   12802   end;
>   12803 end;
> 
> I still cannot duplicate the crash, and am not certain what's going on
> either.
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: feta20-final.log
Type: text/x-log
Size: 9735 bytes
Desc: not available
Url : http://tug.org/pipermail/tex-live/attachments/20041224/9e9fe4dc/feta20-final.bin