Subject: 23.0.50; Emacs CVS segfaults on M-x delete-frame on Debian sarge under XFree86 Version 4.3.0.1

From: [email-masked] (Ævar Arnfjörð Bjarmason)
Date: Wed, 27 Feb 2008 15:35:30 +0000

The following produces a reproducable segfault on an emacs;

First I launch emacs under GDB and create an X frame:
    
    gdb ./src/emacs
    run -Q -nw
    M-x make-frame-on-display RET :0.0 RET

Then, I try to delete the new X frame:

    M-x delete-frame
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1083362720 (LWP 1229)]
0x405ea727 in XFreeGC () from /usr/X11R6/lib/libX11.so.6
(gdb) bt full
#0  0x405ea727 in XFreeGC () from /usr/X11R6/lib/libX11.so.6
No symbol table info available.
#1  0x403458be in _gdk_gc_x11_get_type () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#2  0x40430749 in g_object_interface_list_properties () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#3  0x4032d638 in gdk_screen_get_type () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#4  0x40350047 in gdk_screen_set_default_colormap () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#5  0x40430871 in g_object_run_dispose () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#6  0x4032d6ad in _gdk_screen_close () from /usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#7  0x40337da4 in gdk_x11_display_ungrab () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#8  0x40430871 in g_object_run_dispose () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#9  0x08162629 in xg_display_close (dpy=0x8c423d0) at gtkutil.c:176
        gdpy = (GdkDisplay *) 0x8436a88
#10 0x0813e272 in x_delete_terminal (terminal=0x8c7f558) at
xterm.c:11855
        dpyinfo = (struct x_display_info *) 0x8c5e878
        i = 3
#11 0x0811ec22 in Fdelete_terminal (terminal=147322204, force=138295545)
at terminal.c:324
        t = (struct terminal *) 0x8c7f558
#12 0x08094453 in Fdelete_frame (frame=139235804, force=138295497) at
frame.c:1545
        tmp = 147322204
        terminal = (struct terminal *) 0x8c7f558
        f = (struct frame *) 0x84c91d8
        sf = (struct frame *) 0x8403868
        kb = (struct kboard *) 0x0
        minibuffer_selected = 0
#13 0x081f14c4 in Ffuncall (nargs=1, args=0xbfffe750) at eval.c:3028
        fun = 136761988
        original_fun = 138330705
        funcar = 138295545
        numargs = 0
        lisp_numargs = 135713370
        val = -1073748216
        backtrace = {next = 0xbfffe920, function = 0xbfffe750, args =
        0xbfffe754, nargs = 0, evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'}
        internal_args = (Lisp_Object *) 0xbfffe6a0
        i = 2
#14 0x081ecfbf in Fcall_interactively (function=138330705,
record_flag=138295545, keys=138333916) at callint.c:842
        val = 138295497
        args = (Lisp_Object *) 0xbfffe750
        visargs = (Lisp_Object *) 0xbfffe740
        specs = 136785395
        filter_specs = 136785395
        teml = 138295497
        up_event = 138295497
        enable = 138295497
        speccount = 5
        next_event = 14
        prefix_arg = 138295497
        string = (unsigned char *) 0xbfffe760 ""
        tem = (unsigned char *) 0xbfffe760 ""
        varies = (int *) 0xbfffe730
        i = 1
        j = 0
        count = 0
        foo = 140868632
        prompt1 =
        "\200\001\000\000Q�>\bQ�>\b\r��\bU�B\bI\214C\b����\206\a\030\bI\214C\b@o\200@\001\000\000\000\000y\200@x���\230\216t@\000y\200@U�B\b���������8>\b\025��\b����\000��\005\230���K;\035\b\f\000\000"
        tem1 = 0x0
        arg_from_tty = 0
        gcpro1 = {next = 0x40746be5, var = 0x1c, nvars = 136125298}
        gcpro2 = {next = 0x83ec251, var = 0x0, nvars = 0}
        gcpro3 = {next = 0x83e38c9, var = 0x83e38c9, nvars = 1}
        gcpro4 = {next = 0x81d1b72, var = 0xbfffe7ec, nvars = 1}
        gcpro5 = {next = 0x83e1d6d, var = 0x0, nvars = 0}
        key_count = 14
        record_then_fail = 0
        save_this_command = 138330705
        save_last_command = 138328441
        save_this_original_command = 138487713
        save_real_this_command = 138330705
#15 0x081f14f3 in Ffuncall (nargs=4, args=0xbfffe9b0) at eval.c:3031
        fun = 137986028
        original_fun = 138458361
        funcar = 141286316
        numargs = 3
        lisp_numargs = 135812751
        val = -1073747448
        backtrace = {next = 0xbfffeb30, function = 0xbfffe9b0, args =
        0xbfffe9b4, nargs = 3, evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'}
        internal_args = (Lisp_Object *) 0xbfffe9b4
        i = 1
#16 0x081f1117 in call3 (fn=138458361, arg1=138330705, arg2=138295545,
arg3=138295497) at eval.c:2855
        ret_ungc_val = 138295497
        gcpro1 = {next = 0x83e0755, var = 0x83e38c9, nvars = 4}
#17 0x0817c839 in Fcommand_execute (cmd=138330705,
record_flag=138295545, keys=138295497, special=138295497)
    at keyboard.c:10443
        final = 136761988
        tem = 138295497
        prefixarg = 138295497
#18 0x0817cb79 in Fexecute_extended_command (prefixarg=138295497) at
keyboard.c:10556
        function = 138330705
        buf = "M-x
        \000\000\000\000\b\000\000\000\020F�\b\000\000\000\000\204^�\b�����4\035\b\000\234\215\b\001\000\000"
        saved_last_point_position = 1
        saved_keys = 140335180
        saved_last_point_position_buffer = 138321348
        bindings = 141286316
        value = 138295497
        gcpro1 = {next = 0x1, var = 0x84c91d8, nvars = 138426888}
        gcpro2 = {next = 0x83eaba9, var = 0x0, nvars = 1}
        gcpro3 = {next = 0x83e1d5d, var = 0x83eaba9, nvars =
        -1073747256}
        hstarted = 1
#19 0x081f149f in Ffuncall (nargs=2, args=0xbfffebc0) at eval.c:3025
        fun = 136779020
        original_fun = 138334793
        funcar = 138295497
        numargs = 1
        lisp_numargs = 135713370
        val = -1073747080
        backtrace = {next = 0xbfffed90, function = 0xbfffebc0, args =
        0xbfffebc4, nargs = 1, evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'}
        internal_args = (Lisp_Object *) 0xbfffebc4
        i = 138295497
#20 0x081ecfbf in Fcall_interactively (function=138334793,
record_flag=138295497, keys=138333916) at callint.c:842
        val = 0
        args = (Lisp_Object *) 0xbfffebc0
        visargs = (Lisp_Object *) 0xbfffebb0
        specs = 143498243
        filter_specs = 143498243
        teml = 0
        up_event = 138295497
        enable = 138295497
        speccount = 3
        next_event = 1
        prefix_arg = 138295497
        string = (unsigned char *) 0xbfffebd0 "P"
        tem = (unsigned char *) 0x82670ac ""
        varies = (int *) 0xbfffeba0
        i = 2
        j = 1
        count = 1
        foo = 0
        prompt1 = '\0' <repeats 99 times>
        tem1 = 0x0
        arg_from_tty = 0
        gcpro1 = {next = 0x0, var = 0x0, nvars = 0}
        gcpro2 = {next = 0x0, var = 0x0, nvars = 0}
        gcpro3 = {next = 0x0, var = 0x0, nvars = 2}
        gcpro4 = {next = 0x0, var = 0x0, nvars = 2}
        gcpro5 = {next = 0x0, var = 0x0, nvars = 0}
        key_count = 1
        record_then_fail = 0
        save_this_command = 138334793
        save_last_command = 138497537
        save_this_original_command = 138334793
        save_real_this_command = 138334793
#21 0x081f14f3 in Ffuncall (nargs=4, args=0xbfffee20) at eval.c:3031
        fun = 137986028
        original_fun = 138458361
        funcar = 138295497
        numargs = 3
        lisp_numargs = 2
        val = -1073747032
        backtrace = {next = 0x0, function = 0xbfffee20, args =
        0xbfffee24, nargs = 3, evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'}
        internal_args = (Lisp_Object *) 0xbfffee24
        i = 0
#22 0x081f1117 in call3 (fn=138458361, arg1=138334793, arg2=138295497,
arg3=138295497) at eval.c:2855
        ret_ungc_val = 138295497
        gcpro1 = {next = 0x83e38c9, var = 0x83e38c9, nvars = 4}
#23 0x0817c839 in Fcommand_execute (cmd=138334793,
record_flag=138295497, keys=138295497, special=138295497)
    at keyboard.c:10443
        final = 136779020
        tem = 138295497
        prefixarg = 138295497
#24 0x0816eeea in command_loop_1 () at keyboard.c:1908
        scount = 2
        cmd = 138334793
        lose = -1073746008
        nonundocount = 0
        keybuf = {1073742784, 960, -1073746120, 1081301168, 147286128,
        1085183913, 0, 1085200928, -1073746068, 1, 
  -1073746100, 1085181697, -1073746040, 11459104, 1080932728,
  -1073746016, 0, -1073746044, -1073746356, 0, 0, 0, 0, 0, 0, 
  0, 0, 0, 138295497, 143469681}
        i = 1
        prev_modiff = 1
        prev_buffer = (struct buffer *) 0x83e9dc0
        already_adjusted = 0
#25 0x081ef0f3 in internal_condition_case (bfun=0x816d8b2
<command_loop_1>, handlers=138339729, hfun=0x816d2af <cmd_error>)
    at eval.c:1494
        val = 138605317
        c = {tag = 138295497, val = 138295497, next = 0xbffff120, gcpro
        = 0x0, jmp = {{__jmpbuf = {-1073744960, 
        -1073744960, -1073745164, -1073745688, -1073746000, 136245384},
        __mask_was_saved = 0, __saved_mask = {__val = {
          136131703, 0, 0, 0, 1082158912, 147286128, 147286128,
          3221221116, 1081359036, 147286128, 3221221144, 1082158912, 
          147286128, 3221221144, 1081372021, 147286128, 1081301168,
          1082158912, 0, 147286128, 3221221176, 1081301168, 
          147286128, 1085183913, 0, 1085200928, 3221221228, 1,
          3221221856, 138217632, 3221221844, 3221221704}}}}, 
  backlist = 0x0, handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2,
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, byte_stack = 0x0}
        h = {handler = 138339729, var = 138295497, chosen_clause = 0,
        tag = 0xbfffeff0, next = 0x0}
#26 0x0816d61a in command_loop_2 () at keyboard.c:1370
        val = 0
#27 0x081eeb8f in internal_catch (tag=138334577, func=0x816d5f6
<command_loop_2>, arg=138295497) at eval.c:1230
        c = {tag = 138334577, val = 138295497, next = 0x0, gcpro = 0x0,
        jmp = {{__jmpbuf = {-1073744960, -1073744960, 
        -1073745164, -1073745400, -1073745648, 136244096},
        __mask_was_saved = 0, __saved_mask = {__val = {135784103, 
          3221221856, 0, 0, 0, 0, 1, 3221221912, 135116808, 138427232,
          0, 0, 0, 0, 0, 0, 0, 0, 1081374788, 0, 2, 147404648, 
          0, 0, 0, 0, 1081374788, 3221221880, 136159901, 138525137,
          138521730, 138295497}}}}, backlist = 0x0, 
  handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2,
  poll_suppress_count = 1, interrupt_input_blocked = 0, 
  byte_stack = 0x0}
#28 0x0816d5cf in command_loop () at keyboard.c:1349
No locals.
#29 0x0816cec9 in recursive_edit_1 () at keyboard.c:958
        count = 1
        val = -1073744960
#30 0x0816d02d in Frecursive_edit () at keyboard.c:1020
        count = 0
        buffer = 138295497
#31 0x0816b94e in main (argc=3, argv=0xbffff624) at emacs.c:1787
        dummy = 136655259
        stack_bottom_variable = -65 '�'
        do_initial_setlocale = 1
        skip_args = 1
        rlim = {rlim_cur = 8388608, rlim_max = 18446744073709551615}
        no_loadup = 0
        junk = 0x0

(gdb) frame 9
#9  0x08162629 in xg_display_close (dpy=0x8c423d0) at gtkutil.c:176
176       g_object_run_dispose (G_OBJECT (gdpy));
(gdb) p gdpy
$1 = (GdkDisplay *) 0x8436a88
(gdb) p *gdpy
$2 = {parent_instance = {g_type_instance = {g_class = 0x8704f10}, ref_count = 2, qdata = 0x0}, queued_events = 0x8552844,   queued_tail = 0x8552844, button_click_time = {0, 0}, button_window = {0x0, 0x0}, button_number = {-1, -1}, double_click_time = 250, core_pointer = 0x8992ec8, pointer_hooks = 0x403800ac, closed = 0, double_click_distance = 5, button_x = {0, 0}, button_y = {0, 0}}

This is manually pasted from the M-x report-emacs-bug form on the emacs
that crashed:

In GNU Emacs 23.0.60.1 (i686-pc-linux-gnu, GTK+ Version 2.6.4)
 of 2008-02-27 on tharsis
configured using `configure  'CFLAGS=-ggdb3 -fno-crossjumping''

Important settings:
  value of $LC_ALL: en_US.UTF-8
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
ESC x r e p TAB o TAB r TAB RET

Recent messages:
("/var/src/emacs/src/emacs" "-Q")
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list... [2 times]