Vim segv'ing

Corinna Vinschen corinna-cygwin@cygwin.com
Fri Jul 1 11:44:00 GMT 2011


On Jul  1 11:21, Andy Koppe wrote:
> On 1 July 2011 10:43, Corinna Vinschen wrote:
> > On Jul  1 10:36, Corinna Vinschen wrote:
> >> FYI, I tracked it down to the place where the stack overwrite occurs.
> >> This is most puzzeling.  When typing :wq!, the following chain of functions
> >> is called:
> >>
> >>   nv_colon
> >>    do_cmdline
> >>     ex_exit
> >>      do_write
> >>       open                           <- Here it calls into the Cygwin DLL
> >>        fhandler_base::open_with_arch
> >>         fhandler_base::open_fs
> >>          fhandler_base::open
> >>           NtCreateFile               <--Here it calls into NTDLL.DLL
> >>
> >> The open call tries to open the backup file "/etc/hosts~", not the
> >> symlink itself.
> >>
> >> In the optimized version of vim, the local variable "cap" in the
> >> function nv_colon is kept in register $esi.  When do_cmdline is called,
> >> $esi is pushed onto the stack.  Then everything goes its normal ways,
> >> until NtCreateFile is called.
> >>
> >> And here's the puzzler: This call to NtCreateFile overwrites the 4 byte
> >> stack slot in which the "cap" pointer is saved with the value 0x10c!
> 
> What else has access to that? The signal thread?

No, it's just the call stack of the main thread.  cap is a local variable
of a vim function and the location is just the one cap gets pushed to to
be restored when returning from do_cmdline.  It's so far away from the
NtCreateFile call, it's no concern to anybody at that point.

> > And it also does not happen if I build Cygwin with gcc 4.5.1 rather than
> > with gcc 4.3.4.  Is it possible that a compiler bug is playing a role
> > here?  I can't quite believe it, the effect is too specific.
> 
> This sounds similar to some unexplained mintty crashes that Chris
> Sutcliffe and I have seen with gcc 4.3.4, triggered by setup.exe
> running postinstall scripts or vim accessing /etc/fstab. Unfortunately
> we never managed to pin down the actual cause, inspite of a fair bit
> of debugging and staring at the compiler's assembly output. The
> crashes went away with changes that should have made no difference.
> 
> See here:
> http://code.google.com/p/mintty/source/detail?r=928
> http://code.google.com/p/mintty/source/detail?r=894
> http://groups.google.com/group/mintty-discuss/browse_thread/thread/7f1afcb74c61fe99

Hmm, that's really strange...


Corinna

-- 
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Project Co-Leader          cygwin AT cygwin DOT com
Red Hat

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple



More information about the Cygwin mailing list