Bug#254206: backtrace

[Richard Kettlewell <rjk@greenend.org.uk>]

I rebuilt gs with debugging on and optimization off and got a more
plausible backtrace:

#0  SwapTwoBytes (src=0x405fc000 <Address 0x405fc000 out of bounds>,
    dest=0x405c2ecc "\214\vA@\004\022A@|\030A@M-t\036A@M-'M-D@?M-.<@?M-4M-4@?M-;,@?M-AM-$@?M-H\034@?M-N\224@?M-U\f@?M-[\204@?M-aM-|@?M-ht@?M-nM-l@?M-ud@?M-{M-\@?\002T@@\bM-L@@\017D@@\025M-<@@\0344@@\"M-,@@)$@@/\234@@6\024@@<\214@@C\004@@I|@@OM-t@@Vl@@\\M-d@@c\\@@iM-T@@pL@@vM-D@@}<@@\203M-4@@\212,@@\220M-$@@\227\034@@\235\224@@M-$\f@@M-*\204@@M-0M-|@@", srclen=9920, srcinc=-8264,
    destinc=0, height=26, half_order=1) at PutImage.c:172

src has gone wrong here.

#1  0x400d06e6 in SendZImage (dpy=0x840be98, req=0x840c3f8, image=0x836fbb4,
    req_xoffset=0, req_yoffset=1326, dest_bits_per_pixel=16,
    dest_scanline_pad=1079783116) at PutImage.c:800

>    else if (image->bits_per_pixel == 16)
>        SwapTwoBytes(src, dest, bytes_per_src, (long)image->bytes_per_line,
>                     bytes_per_dest, req->height, image->byte_order);

src=0x405f91cc (and is readable)
dest=0x405bc008 (and is readable)
bytes_per_src=9920                   (AKA srclen)
image->bytes_per_line=1656           (AKA srcinc)
bytes_per_dest=9920                  (AKA destinc)
req->height=26
image->byte_order=1                  (AKA half_order)

I don't have time to analyze further right now but will revisit this
if I can...

#2  0x400d0b41 in PutSubImage (dpy=0x840be98, d=58720440, gc=0x84133f0,
    image=0x836fbb4, req_xoffset=0, req_yoffset=1326, x=0, y=1326,
    req_width=4960, req_height=5663, dest_bits_per_pixel=16,
    dest_scanline_pad=32) at PutImage.c:885
#3  0x400d0dcb in XPutImage (dpy=0x840be98, d=58720440, gc=0x84133f0,
    image=0x836fbb4, req_xoffset=0, req_yoffset=0, x=0, y=0, req_width=4960,
    req_height=7015) at PutImage.c:1001
#4  0x0812f6c4 in x_copy_image (xdev=0x836f8f4,
    base=0x403e103c 'M-^?' <repeats 200 times>..., sourcex=0, raster=1656, x=0,
    y=0, w=4960, h=7015) at src/gdevx.c:579
#5  0x08130f39 in update_do_flush (xdev=0x836f8f4) at src/gdevx.c:1057
#6  0x0812e55a in x_sync (dev=0x836f8f4) at src/gdevx.c:303
#7  0x0821870f in gs_fillpage (pgs=0x83395bc) at src/gspaint.c:84
#8  0x080ce412 in zfillpage (i_ctx_p=0x8349db0) at src/zpaint.c:51
#9  0x080a4b82 in interp (pi_ctx_p=0x83269e4, pref=0xbfffe948,
    perror_object=0xbfffea08) at src/interp.c:1491
#10 0x080a2893 in gs_call_interp (pi_ctx_p=0x83269e4, pref=0xbfffe948,
    user_errors=1, pexit_code=0xbfffea14, perror_object=0xbfffea08)
    at src/interp.c:486
#11 0x080a2743 in gs_interpret (pi_ctx_p=0x83269e4, pref=0xbfffe948,
    user_errors=1, pexit_code=0xbfffea14, perror_object=0xbfffea08)
    at src/interp.c:444
#12 0x08099828 in gs_main_interpret (minst=0x83267e0, pref=0xbfffe980,
    user_errors=1, pexit_code=0xbfffea14, perror_object=0xbfffea08)
    at src/imain.c:296
#13 0x0809a1f7 in gs_main_run_string_end (minst=0x83267e0, user_errors=1,
    pexit_code=0xbfffea14, perror_object=0xbfffea08) at src/imain.c:597
#14 0x0809a0d4 in gs_main_run_string_with_length (minst=0x83267e0,
    str=0x82738ee ".runstdin", length=9, user_errors=1, pexit_code=0xbfffea14,
    perror_object=0xbfffea08) at src/imain.c:555
#15 0x0809a03c in gs_main_run_string (minst=0x83267e0,
    str=0x82738ee ".runstdin", user_errors=1, pexit_code=0xbfffea14,
    perror_object=0xbfffea08) at src/imain.c:537
#16 0x0809c650 in run_string (minst=0x83267e0, str=0x82738ee ".runstdin",
    options=2) at src/imainarg.c:799
#17 0x0809b375 in swproc (minst=0x83267e0,
    arg=0xbffff90a "LD_LIBRARY_PATH=/usr/X11R6/lib/debug:/usr/lib/debug",
    pal=0xbfffedb0) at src/imainarg.c:306
#18 0x0809b17f in gs_main_init_with_args (minst=0x83267e0, argc=10,
    argv=0xbffff714) at src/imainarg.c:239
#19 0x0804cacc in main (argc=10, argv=0xbffff714) at src/gs.c:45