assertion "nit->head->child == NULL" failed

assertion "nit->head->child == NULL" failed

[Anthony J. Bentley]

Hi,

This input crashes for me on OpenBSD -current:

.Dd
.Bl -offset indent -column local
.It x
.El

(gdb) run tmp.d8X8GXiA24
Starting program: /usr/bin/mandoc tmp.d8X8GXiA24
assertion "nit->head->child == NULL" failed: file "mdoc_validate.c", line 1503, function "post_it"

Program received signal SIGABRT, Aborted.
thrkill () at -:3
3       -: No such file or directory.
(gdb) bt
#0  thrkill () at -:3
#1  0x000010c2fb110e9e in _libc_abort () at /usr/src/lib/libc/stdlib/abort.c:51
#2  0x000010c2fb0c3fc2 in _libc___assert2 (file=<optimized out>, 
    line=<optimized out>, func=<optimized out>, failedexpr=<optimized out>)
    at /usr/src/lib/libc/gen/assert.c:52
#3  0x000010c044214f1e in post_it (mdoc=0x10c273b3ea00) at mdoc_validate.c:1503
#4  0x000010c044212a2c in mdoc_node_validate (mdoc=0x10c273b3ea00)
    at mdoc_validate.c:353
#5  0x000010c04421247c in mdoc_node_validate (mdoc=0x10c273b3ea00)
    at mdoc_validate.c:295
#6  0x000010c04421247c in mdoc_node_validate (mdoc=0x10c273b3ea00)
    at mdoc_validate.c:295
#7  0x000010c04421247c in mdoc_node_validate (mdoc=0x10c273b3ea00)
    at mdoc_validate.c:295
#8  0x000010c044211657 in mdoc_validate (mdoc=0x10c273b3ea00) at mdoc.c:455
#9  0x000010c04421b95c in parse (curp=0x7f7fffffa700, fd=3, 
    file=0x7f7fffffaa68 "tmp.d8X8GXiA24") at main.c:752
#10 0x000010c04421a9ab in main (argc=1, argv=0x7f7fffffa8b0) at main.c:448
--
 To unsubscribe send an email to tech+unsubscribe@mandoc.bsd.lv

Re: assertion "nit->head->child == NULL" failed

[Ingo Schwarze]

Hi Anthony,

Anthony J. Bentley wrote on Wed, Nov 22, 2017 at 02:49:09AM -0700:

> .Dd
> .Bl -offset indent -column local
> .It x
> .El
> 
> (gdb) run tmp.d8X8GXiA24
> Starting program: /usr/bin/mandoc tmp.d8X8GXiA24
> assertion "nit->head->child == NULL" failed:
> file "mdoc_validate.c", line 1503, function "post_it"

Oops, i broke that quite some time ago when moving the validation
phase after the parsing phase.  Fixed by the commit below.

Thanks for reporting!
  Ingo


Log Message:
-----------
Recognize .Bl -column at parse time, and not only at validation time,
even if other arguments precede -column.  This is required because 
the .It parser needs to know whether or not we are a -column list.
Fixes tree corruption leading to an assertion failure.
Bug reported by bentley@.

Modified Files:
--------------
    mandoc:
        mdoc_state.c

Revision Data
-------------
Index: mdoc_state.c
===================================================================
RCS file: /home/cvs/mandoc/mandoc/mdoc_state.c,v
retrieving revision 1.8
retrieving revision 1.9
diff -Lmdoc_state.c -Lmdoc_state.c -u -p -r1.8 -r1.9
--- mdoc_state.c
+++ mdoc_state.c
@@ -208,19 +208,24 @@ state_bd(STATE_ARGS)
 static void
 state_bl(STATE_ARGS)
 {
+	struct mdoc_arg	*args;
+	size_t		 i;
 
 	if (n->type != ROFFT_HEAD || n->parent->args == NULL)
 		return;
 
-	switch(n->parent->args->argv[0].arg) {
-	case MDOC_Diag:
-		n->norm->Bl.type = LIST_diag;
-		break;
-	case MDOC_Column:
-		n->norm->Bl.type = LIST_column;
-		break;
-	default:
-		break;
+	args = n->parent->args;
+	for (i = 0; i < args->argc; i++) {
+		switch(args->argv[i].arg) {
+		case MDOC_Diag:
+			n->norm->Bl.type = LIST_diag;
+			return;
+		case MDOC_Column:
+			n->norm->Bl.type = LIST_column;
+			return;
+		default:
+			break;
+		}
 	}
 }
 
--
 To unsubscribe send an email to tech+unsubscribe@mandoc.bsd.lv