08/16 の日記 とは、また違うところから getenv を呼出していて落ちる

livorno@makoto 08:17:48/130908(..editors/emacs24)%  gdb work/emacs-24.3/src/emacs
GNU gdb (GDB) 7.3.1
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64--netbsd".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /export/CHROOT/usr/pkgsrc/editors/emacs24/work/emacs-24.3/src/emacs...
   (no debugging symbols found)...done.
(gdb) run  /export/CHROOT/usr/pkgsrc/doc/guide/files/options.xml
Starting program: /export/CHROOT/usr/pkgsrc/editors/emacs24/work/emacs-24.3/src/emacs 
   /export/CHROOT/usr/pkgsrc/doc/guide/files/options.xml

Program received signal SIGSEGV, Segmentation fault.
[Switching to LWP 1]
0x00007f7febcfc134 in strncmp () from /usr/lib/libc.so.12
(gdb) bt
#0  0x00007f7febcfc134 in strncmp () from /usr/lib/libc.so.12
#1  0x00007f7febcb311e in __getenvslot () from /usr/lib/libc.so.12
#2  0x00007f7febcb3272 in __findenvvar () from /usr/lib/libc.so.12
#3  0x00007f7febcb2d10 in getenv () from /usr/lib/libc.so.12
#4  0x00007f7ff2852c5e in _XkbGetCharset () from /usr/X11R7/lib/libX11.so.7
#5  0x00007f7ff285ca26 in XkbTranslateKeySym () from /usr/X11R7/lib/libX11.so.7
#6  0x00007f7ff285cc7e in XLookupString () from /usr/X11R7/lib/libX11.so.7
#7  0x00007f7fe6417fc5 in _XimLocalFilter () from /usr/X11R7/lib/X11/locale/lib/common/ximcp.so.2
#8  0x00000000004af224 in event_handler_gdk ()
#9  0x00007f7ff545d558 in ?? () from /usr/pkg/lib/libgdk-x11-2.0.so.0
#10 0x00007f7ff545f0ad in ?? () from /usr/pkg/lib/libgdk-x11-2.0.so.0
#11 0x00007f7ff5460433 in ?? () from /usr/pkg/lib/libgdk-x11-2.0.so.0
#12 0x00007f7ff0050c90 in g_main_context_dispatch () from /usr/pkg/lib/libglib-2.0.so.0
#13 0x00007f7ff0051030 in g_main_context_iterate () from /usr/pkg/lib/libglib-2.0.so.0
#14 0x00007f7ff00510c4 in g_main_context_iteration () from /usr/pkg/lib/libglib-2.0.so.0
#15 0x00007f7ff5946678 in gtk_main_iteration () from /usr/pkg/lib/libgtk-x11-2.0.so.0
#16 0x00000000004a7f84 in XTread_socket ()
#17 0x00000000004d7de2 in gobble_input ()
#18 0x00000000004d740d in process_pending_signals ()
#19 0x00000000005245b1 in Fmake_list ()
#20 0x0000000000545137 in concat ()
#21 0x000000000054598c in Fcopy_sequence ()
#22 0x00000000004d5fb0 in timer_check ()
#23 0x00000000004d65da in readable_events ()
#24 0x00000000004d7ed4 in get_input_pending ()
#25 0x00000000004da1db in detect_input_pending_run_timers ()
#26 0x0000000000576755 in wait_reading_process_output ()
#27 0x000000000041c5f1 in sit_for ()
#28 0x00000000004db2ac in read_char ()
#29 0x00000000004dccea in read_key_sequence.clone.16 ()
#30 0x00000000004deb57 in command_loop_1 ()
#31 0x000000000053b3ef in internal_condition_case ()
#32 0x00000000004d3949 in command_loop_2 ()
#33 0x000000000053b2be in internal_catch ()
#34 0x00000000004d46cc in recursive_edit_1 ()
#35 0x00000000004d4990 in Frecursive_edit ()
#36 0x00000000004d034f in main ()
(gdb) quit

strncmp is written in assembly language:

(gdb) x/16i  0x00007f7febcfc120
   0x7f7febcfc120 <strncmp>:    test   %rdx,%rdx
   0x7f7febcfc123 <strncmp+3>:  jmp    0x7f7febcfc12e <strncmp+14>
   0x7f7febcfc125 <strncmp+5>:  inc    %rdi
   0x7f7febcfc128 <strncmp+8>:  inc    %rsi
   0x7f7febcfc12b <strncmp+11>: dec    %rdx
   0x7f7febcfc12e <strncmp+14>: je     0x7f7febcfc1f6 <strncmp+214>
   0x7f7febcfc134 <strncmp+20>: mov    (%rdi),%al
   0x7f7febcfc136 <strncmp+22>: test   %al,%al
   0x7f7febcfc138 <strncmp+24>: je     0x7f7febcfc1ed <strncmp+205>
   0x7f7febcfc13e <strncmp+30>: cmp    %al,(%rsi)
   0x7f7febcfc140 <strncmp+32>: jne    0x7f7febcfc1ed <strncmp+205>
   0x7f7febcfc146 <strncmp+38>: inc    %rdi
   0x7f7febcfc149 <strncmp+41>: inc    %rsi
   0x7f7febcfc14c <strncmp+44>: dec    %rdx
   0x7f7febcfc14f <strncmp+47>: je     0x7f7febcfc1f6 <strncmp+214>
   0x7f7febcfc155 <strncmp+53>: mov    (%rdi),%al
(gdb) 

modena@makoto 09:45:51/130908(..lib/libc)% view arch/x86_64/string/strncmp.S

      1 /*
      2  * Written by J.T. Conklin <jtc@NetBSD.org>.
      3  * Public domain.
      4  */
      5
      6 #include <machine/asm.h>
      7
      8 #if defined(LIBC_SCCS)
      9         RCSID("$NetBSD: strncmp.S,v 1.3 2005/08/03 22:59:50 rpaulo Exp $")
     10 #endif
     11
     12 /*
     13  * NOTE: I've unrolled the loop eight times: large enough to make a
     14  * significant difference, and small enough not to totally trash the
     15  * cache.
     16  */
     17
     18 ENTRY(strncmp)
     19         testq   %rdx,%rdx
     20         jmp     L2                      /* Jump into the loop! */
     21
     22 L1:     incq    %rdi
     23         incq    %rsi
     24         decq    %rdx
     25 L2:     jz      L4                      /* strings are equal */
     26         movb    (%rdi),%al
     27         testb   %al,%al
     28         jz      L3
     29         cmpb    %al,(%rsi)

modena@makoto 09:49:52/130908(..lib/libc)% view ./stdlib/_env.c

 254 __getenvslot(const char *name, size_t l_name, bool allocate)
 255 {
 256         size_t new_size, num_entries, required_size;
 257         char **new_environ; 
 258
 259         /* Does the environ need scrubbing? */
 260         if (environ != allocated_environ && allocated_environ != NULL)
 261                 __scrubenv();
 262
 263         /* Search for an existing environment variable of the given name. */
 264         num_entries = 0;
 265         while (environ[num_entries] != NULL) {
 266                 if (strncmp(environ[num_entries], name, l_name) == 0 &&
 267                     environ[num_entries][l_name] == '=') {
 268                         /* We found a match. */
 269                         return num_entries;
 270                 }
 271                 num_entries ++;
 272         }

%rdi   environ[num_entries]
%rsi   name
%rdx:  l_name (size_t len)

In the line 26 of strncmp.S, fetch from address 'name', but its address is incorrect.