terminated by signal SIGSEGV (Address boundary error) (again)

[lunowpagarib]

Problem

i was not familiar with recursive keybinds, at the moment of #1392, and got frustrated by it. But i found that vis crushes when typing text containing any non-ascii characters, reaches the terminal edge.

systemd log:

sep 02 21:30:34 cachyos-x8664 kernel: traps: vis[12860] general protection fault ip:55644241508f sp:7ffceb8b2d30 error:0 in vis[1f08f,5564423fa000+45000]
sep 02 21:30:34 cachyos-x8664 systemd-coredump[23526]: Process 12860 (vis) of user 1000 terminated abnormally with signal 11/SEGV, processing...
sep 02 21:30:34 cachyos-x8664 systemd[1]: Created slice Slice /system/systemd-coredump.
sep 02 21:30:34 cachyos-x8664 systemd[1]: Started Process Core Dump (PID 23526/UID 0).
sep 02 21:30:34 cachyos-x8664 systemd-coredump[23527]: [🡕] Process 12860 (vis) of user 1000 dumped core.
                                                          
                                                          Stack trace of thread 12860:
                                                          #0  0x000055644241508f n/a (vis + 0x1f08f)
                                                          #1  0x0000556442432d93 n/a (vis + 0x3cd93)
                                                          #2  0x00005564423fa796 n/a (vis + 0x4796)
                                                          #3  0x00007f383ee27d0e n/a (libc.so.6 + 0x27d0e)
                                                          #4  0x00007f383ee27e4b __libc_start_main (libc.so.6 + 0x27e4b)
                                                          #5  0x00005564423fa935 n/a (vis + 0x4935)
                                                          ELF object binary architecture: AMD x86-64
sep 02 21:30:34 cachyos-x8664 systemd[1]: systemd-coredump@0-1-23526_23527-0.service: Deactivated successfully.

i was able to reproduce it with an empty config.

Steps to reproduce

1. enter at least 1 non-ascii character
2. continue typing until text hits the terminal edge

vis version (vis -v)

vis v0.9-498-gad0f1deb-dirty +curses +lua +tre +acl

Terminal name/version

foot 1.27.0-2.1

TERM environment variable

foot

[myrrc]

Also got it, backtrace:

#0  0x0000aaaaaaad8bf4 in window_draw_eof (win=0xaaaaaab29eb0) at /home/myrrc/src/vis/vis.c:303
#1  0x0000aaaaaaad8cc8 in vis_window_draw (win=0xaaaaaab29eb0) at /home/myrrc/src/vis/vis.c:316
#2  0x0000aaaaaaacb088 in ui_window_draw (win=0xaaaaaab29eb0) at /home/myrrc/src/vis/ui-terminal.c:365
#3  0x0000aaaaaaacb978 in ui_draw (vis=0xaaaaaab12638 <vis>) at /home/myrrc/src/vis/ui-terminal.c:482
#4  0x0000aaaaaaadc598 in vis_run (vis=0xaaaaaab12638 <vis>) at /home/myrrc/src/vis/vis.c:1307
#5  0x0000aaaaaaae2a5c in main (argc=1, argv=0xfffffffffb38) at main.c:1453

(gdb) p *win
$4 = {width = 172, height = 41, x = 0, y = 0, sidebar_width = 0, min_sidebar_width = 0, options = (UI_OPTION_SYMBOL_EOF | UI_OPTION_STATUSBAR), view = {
    text = 0xaaaaaab29870, textbuf = 0xaaaaaab3b650 "ф", '1' <repeats 171 times>

#0  0x0000aaaaaaad8bf4 in window_draw_eof (win=0xaaaaaab29eb0) at /home/myrrc/src/vis/vis.c:303
303			l->cells[0] = cell;

(gdb) list
298		VisCell cell = {.width = 1};
299		cell.style = vis_cell_style_merge(win->vis->ui.styles[UI_STYLE_DEFAULT], win->vis->ui.styles[UI_STYLE_EOF]);
300		cell.data_length = Min(view->symbols[SYNTAX_SYMBOL_EOF].length, countof(cell.data));
301		memory_copy(cell.data, view->symbols[SYNTAX_SYMBOL_EOF].data, cell.data_length);
302		for (Line *l = view->lastline->next; l; l = l->next)
303			l->cells[0] = cell;
304	}
305	
306	void vis_window_draw(Win *win) {
307		if (!view_update(&win->view))

(gdb) p cell
$5 = {file_byte_count = 0, data_length = 1, width = 1, multi_codepoint = 0, data = "~\000\000\000\000", style = {attributes = 0 '\000', properties = 15 '\017', 
    fg_r = 0 '\000', fg_g = 7 '\a', fg_b = 0 '\000', bg_r = 0 '\000', bg_g = 0 '\000', bg_b = 0 '\000'}}

(gdb) p view->lastline->next
$10 = (Line *) 0xaaaaaab42cd0
(gdb) p view->lastline->next->next
$11 = (Line *) 0x7000f06 <- invalid address

[rnpnr]

Thanks for the backtrace! It is probably the same thing as #1377. The explanation I gave there likely holds here as well (meaning my known hacky fix didn't handle an edge case).

I have tried a number of times to split the line metadata up from the cells (it makes the code harder to work with, performs worse, and is annoying to debug) and have yet to be successful. There is some (broken) part of the code that relies on the cells being fused to the line in a completely obscured way and I haven't been able to find it yet. I will probably try again once I finish the other thing I'm currently working on. All of these bugs are a result of the code trying to do something much more complicated than it has any business doing.