GNU bug report logs - #1075
23.0.60; [NS] wrong number of arguments in call to ns_free_indexed_color

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 1075 in the body.
You can then email your comments to 1075 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Lennart Staflin <lenst <at> lysator.liu.se>
To: emacs-pretest-bug <at> gnu.org
Subject: 23.0.60; [NS] wrong number of arguments in call to ns_free_indexed_color
Date: Fri, 03 Oct 2008 16:39:07 +0200

After a crash I with ns_free_indexed_color, and x_clear_image_1 on the
stack. I noticed that x_clear_image_1 calls ns_free_indexed_color with
only one argument, but it takes two arguments. Perhaps that explains a
number of crashes in ns_free_indexed_color.

//Lennart Staflin


In GNU Emacs 23.0.60.1 (powerpc-apple-darwin8.11.0, *Step 9.0)
of 2008-10-03 on sin
Windowing system distributor `Apple', version 49.46.48
configured using `configure '--with-ns' '--enable-maintainer-mode' 
'--without-x' '--with-jpeg' '--with-gif' '--with-png' 'CFLAGS=-g''

Important settings:
value of $LC_ALL: nil
value of $LC_COLLATE: nil
value of $LC_CTYPE: en_US.UTF-8
value of $LC_MESSAGES: nil
value of $LC_MONETARY: nil
value of $LC_NUMERIC: nil
value of $LC_TIME: nil
value of $LANG: nil
value of $XMODIFIERS: nil
locale-coding-system: utf-8-unix
default-enable-multibyte-characters: t

Major mode: Fundamental

Minor modes in effect:
show-paren-mode: t
auto-insert-mode: t
iswitchb-mode: t
partial-completion-mode: t
recentf-mode: t
cua-mode: t
tooltip-mode: t
mouse-wheel-mode: t
menu-bar-mode: t
file-name-shadow-mode: t
global-font-lock-mode: t
global-auto-composition-mode: t
auto-encryption-mode: t
auto-compression-mode: t
line-number-mode: t
transient-mark-mode: t
abbrev-mode: t

Recent input:
M-x r e p o r t SPC b u g



Recent messages:
Loading /Users/lenst/emacs/lenst-lisp/loaddefs.el (source)...done
Loading /Users/lenst/emacs/lenst-lisp/suck.el (source)...done
Loading ~/emacs/lenst-lisp/lenst...done
Loading /Users/lenst/emacs/lisp/loaddefs.el (source)...done
Loading /Users/lenst/src/emorb/loaddefs.el (source)...done
Loading /Users/lenst/.recentf...done
Cleaning up the recentf list...done (0 removed)
Loading paren...done
Loading /Users/lenst/.emacs-records...done
For information about GNU Emacs and the GNU system, type C-h C-a.

Message #12 received at submit <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Harald Maier <harald <at> maierh.de>
To: bug-gnu-emacs <at> gnu.org
Cc: emacs-pretest-bug <at> gnu.org
Subject: Re: bug#1075: 23.0.60; [NS] wrong number of arguments in call to ns_free_indexed_color
Date: Fri, 03 Oct 2008 19:24:54 +0200

Lennart Staflin <lenst <at> lysator.liu.se> writes:

> After a crash I with ns_free_indexed_color, and x_clear_image_1 on the
> stack. I noticed that x_clear_image_1 calls ns_free_indexed_color with
> only one argument, but it takes two arguments. Perhaps that explains a
> number of crashes in ns_free_indexed_color.
>
> //Lennart Staflin
>
>
> In GNU Emacs 23.0.60.1 (powerpc-apple-darwin8.11.0, *Step 9.0)
> of 2008-10-03 on sin
> Windowing system distributor `Apple', version 49.46.48
> configured using `configure '--with-ns' '--enable-maintainer-mode'
> --without-x' '--with-jpeg' '--with-gif' '--with-png' 'CFLAGS=-g''

I am facing this bug too. Here is a full backtrace. It happens
for me intermittent.

Harald

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000028
0x0015e306 in ns_free_indexed_color (idx=0, f=0x0) at nsterm.m:1310
(gdb) bt
#0  0x0015e306 in ns_free_indexed_color (idx=0, f=0x0) at nsterm.m:1310
#1  0x0018513a in x_clear_image_1 (f=<value temporarily unavailable, due to optimizations>, img=0x195778f0, pixmap_p=<value temporarily unavailable, due to optimizations>, mask_p=1, colors_p=1) at image.c:1627
#2  0x00184b93 in free_image (f=0x0, img=0x195778f0) at image.c:1322
#3  0x001854db in clear_image_cache (f=0x8b7150, filter=25165833) at image.c:1836
#4  0x001855b6 in clear_image_caches (filter=25165833) at image.c:1873
#5  0x00035868 in redisplay_internal (preserve_echo_area=<value temporarily unavailable, due to optimizations>) at xdisp.c:12060
#6  0x00035d28 in redisplay_preserve_echo_area (from_where=13) at xdisp.c:12094
#7  0x00146de7 in status_notify (deleting_process=0x0) at process.c:6906
#8  0x001498dc in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=25165833, wait_proc=0x0, just_wait_proc=0) at process.c:4678
#9  0x0000c296 in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6619
#10 0x0009bbf8 in read_char (commandflag=1, nmaps=6, maps=0xbfffdfd0, prev_event=25165833, used_mouse_menu=0xbfffe0d8, end_time=0x0) at keyboard.c:2895
#11 0x0009dc3b in read_key_sequence (keybuf=0xbfffe198, bufsize=30, prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9349
#12 0x000a012a in command_loop_1 () at keyboard.c:1620
#13 0x00101ffd in internal_condition_case (bfun=0x9fef0 <command_loop_1>, handlers=25205497, hfun=0x96ba0 <cmd_error>) at eval.c:1511
#14 0x0008ff38 in command_loop_2 () at keyboard.c:1338
#15 0x00101edc in internal_catch (tag=0, func=0x8fef0 <command_loop_2>, arg=25165833) at eval.c:1247
#16 0x0008fc8e in command_loop () at keyboard.c:1317
#17 0x0008fd52 in recursive_edit_1 () at keyboard.c:942
#18 0x0008fed1 in Frecursive_edit () at keyboard.c:1004
#19 0x0008eb6b in main (argc=1, argv=0xbfffe5a4) at emacs.c:1689

(gdb) bt full
#0  0x0015e306 in ns_free_indexed_color (idx=0, f=0x0) at nsterm.m:1310
        color_table = <value temporarily unavailable, due to optimizations>
#1  0x0018513a in x_clear_image_1 (f=<value temporarily unavailable, due to optimizations>, img=0x195778f0, pixmap_p=<value temporarily unavailable, due to optimizations>, mask_p=1, colors_p=1) at image.c:1627
No locals.
#2  0x00184b93 in free_image (f=0x0, img=0x195778f0) at image.c:1322
        c = (struct image_cache *) 0x16f0c540
#3  0x001854db in clear_image_cache (f=0x8b7150, filter=25165833) at image.c:1836
        img = (struct image *) 0x195778f0
        t = {
  tv_sec = 1218913349, 
  tv_usec = 686755
}
        old = 1218911549
        i = 3
        nfreed = 2
        c = (struct image_cache *) 0x16f0c540
#4  0x001855b6 in clear_image_caches (filter=25165833) at image.c:1873
        tail = 4300800
#5  0x00035868 in redisplay_internal (preserve_echo_area=<value temporarily unavailable, due to optimizations>) at xdisp.c:12060
        w = (struct window *) 0x195978f0
        f = <value temporarily unavailable, due to optimizations>
        pause = 0
        must_finish = 1
        tlbufpos = {
  charpos = 425537696, 
  bytepos = 425537696
}
        number_of_visible_frames = 1
        polling_stopped_here = 1
        old_frame = 9138516
        consider_all_windows_p = <value temporarily unavailable, due to optimizations>
#6  0x00035d28 in redisplay_preserve_echo_area (from_where=13) at xdisp.c:12094
No locals.
#7  0x00146de7 in status_notify (deleting_process=0x0) at process.c:6906
        proc = 422480020
        buffer = 425665812
        tail = <value temporarily unavailable, due to optimizations>
        msg = 51929347
#8  0x001498dc in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=25165833, wait_proc=0x0, just_wait_proc=0) at process.c:4678
        Atemp = {
  fds_bits = {0 <repeats 32 times>}
}
        Ctemp = {
  fds_bits = {0 <repeats 32 times>}
}
        timeout_reduced_for_timers = 1
        channel = <value temporarily unavailable, due to optimizations>
        nfds = 1
        Available = {
  fds_bits = {128, 0 <repeats 31 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = 0
        no_avail = <value temporarily unavailable, due to optimizations>
        xerrno = <value temporarily unavailable, due to optimizations>
        proc = <value temporarily unavailable, due to optimizations>
        timeout = {
  tv_sec = 0, 
  tv_usec = 0
}
        end_time = {
  tv_sec = 1218913379, 
  tv_usec = 636576
}
        wait_channel = -1
        got_some_input = 1
#9  0x0000c296 in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6619
        sec = <value temporarily unavailable, due to optimizations>
        usec = 0
#10 0x0009bbf8 in read_char (commandflag=1, nmaps=6, maps=0xbfffdfd0, prev_event=25165833, used_mouse_menu=0xbfffe0d8, end_time=0x0) at keyboard.c:2895
        tem0 = <value temporarily unavailable, due to optimizations>
        delay_level = 4
        buffer_size = <value temporarily unavailable, due to optimizations>
        c = 25165833
        count = <value temporarily unavailable, due to optimizations>
        jmpcount = 2
        local_getcjmp = {918399, 0, 8098, 633595, 981200, 3440316, 0, 3440316, -1073750152, -1073750544, 25165855, 662, 635534, 23, 31, 31, 33554432, -1073807305}
        save_jump = {0 <repeats 18 times>}
        key_already_recorded = 0
        tem = <value temporarily unavailable, due to optimizations>
        save = <value temporarily unavailable, due to optimizations>
        previous_echo_area_message = 25165833
        also_record = 25165833
        reread = 0
        polling_stopped_here = <value temporarily unavailable, due to optimizations>
        orig_kboard = (struct kboard *) 0x83b140
#11 0x0009dc3b in read_key_sequence (keybuf=0xbfffe198, bufsize=30, prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9349
        interrupted_kboard = (KBOARD *) 0x83b140
        key = 1058327
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 25165833
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 6
        nmaps_allocated = 6
        defs = (Lisp_Object * volatile) 0xbfffdfa0
        submaps = (Lisp_Object * volatile) 0xbfffdfd0
        orig_local_map = 50222101
        orig_keymap = 25165833
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 4941253, 
  map = 4941253, 
  start = 0, 
  end = 0
}
        keytran = {
  parent = 4386685, 
  map = 4386685, 
  start = 0, 
  end = 0
}
        indec = {
  parent = 4941261, 
  map = 4941261, 
  start = 0, 
  end = 0
}
        shift_translated = 0
        delayed_switch_frame = 25165833
        original_uppercase = -1073749720
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x19523aa0
        fake_prefixed_keys = 25165833
#12 0x000a012a in command_loop_1 () at keyboard.c:1620
        cmd = <value temporarily unavailable, due to optimizations>
        lose = <value temporarily unavailable, due to optimizations>
        nonundocount = 0
        keybuf = {35523785, 617387, 3441000, 25165833, -1073749464, 617600, 366757405, -1073749538, -1073749512, -1880941328, 4301001, 152, -1073749538, 25165833, 1, 10, 0, -1895817300, 6307477, 1, -1073749448, -1791741113, 50388496, 0, -1073749492, -1073749680, 0, 3866624, 25165833, 33476529}
        i = 1
        prev_modiff = 25222
        prev_buffer = (struct buffer *) 0x19523aa0
        already_adjusted = 0
#13 0x00101ffd in internal_condition_case (bfun=0x9fef0 <command_loop_1>, handlers=25205497, hfun=0x96ba0 <cmd_error>) at eval.c:1511
        val = <value temporarily unavailable, due to optimizations>
        c = {
  tag = 25165833, 
  val = 25165833, 
  next = 0xbfffe34c, 
  gcpro = 0x0, 
  jmp = {-1073806465, -1880940628, 8098, 1056523, 25165833, 25165833, 3440252, 3440316, -1073749272, -1073749456, 31, 662, 1056666, 1245207, 3407903, 3407903, -1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 25205497, 
  var = 25165833, 
  chosen_clause = 25165881, 
  tag = 0xbfffe248, 
  next = 0x0
}
#14 0x0008ff38 in command_loop_2 () at keyboard.c:1338
        val = 0
#15 0x00101edc in internal_catch (tag=0, func=0x8fef0 <command_loop_2>, arg=25165833) at eval.c:1247
        c = {
  tag = 25201569, 
  val = 25165833, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {-1791753345, 0, 8098, 1056313, -1791740947, 19216, 3440384, 3440316, -1073749048, -1073749200, 25296927, 662, 1056463, 25296919, 25296927, 25165855, 6291456, 4259895}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
#16 0x0008fc8e in command_loop () at keyboard.c:1317
No locals.
#17 0x0008fd52 in recursive_edit_1 () at keyboard.c:942
        val = <value temporarily unavailable, due to optimizations>
#18 0x0008fed1 in Frecursive_edit () at keyboard.c:1004
        buffer = 25165833
#19 0x0008eb6b in main (argc=1, argv=0xbfffe5a4) at emacs.c:1689
        dummy = 0
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67104768
}
        no_loadup = 0
        junk = 0x0

Message #24 received at 1075 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Glenn Morris <rgm <at> gnu.org>
To: Lennart Staflin <lenst <at> lysator.liu.se>
Cc: 1075 <at> debbugs.gnu.org
Subject: Re: bug#1075: 23.0.60; [NS] wrong number of arguments in call to ns_free_indexed_color
Date: Fri, 03 Oct 2008 13:53:26 -0400

Lennart Staflin wrote:

> After a crash I with ns_free_indexed_color, and x_clear_image_1 on the
> stack. I noticed that x_clear_image_1 calls ns_free_indexed_color with
> only one argument, but it takes two arguments. Perhaps that explains a
> number of crashes in ns_free_indexed_color.

Wow. I have just noticed how many ns crash reports have basically the
same backtrace. I for one am sorry for not noticing that before.
Your observation looks good to me.

Message #29 received at 1075 <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Adrian Robert <adrian.b.robert <at> gmail.com>
To: 1075 <at> debbugs.gnu.org
Subject: #1075 - 23.0.60; [NS] wrong number of arguments in call to ns_free_indexed_color - Emacs bug report logs
Date: Fri, 3 Oct 2008 14:30:23 -0400

> After a crash I with ns_free_indexed_color, and x_clear_image_1 on  
> the stack. I noticed that x_clear_image_1 calls  
> ns_free_indexed_color with only one argument, but it takes two  
> arguments. Perhaps that explains a number of crashes in  
> ns_free_indexed_color

Thanks for this info.  I checked in a fix based on your suggestion,  
but am unsure whether this will solve the crash since I have not  
experienced it.  If it seems to go away could you please let me know?

thanks

Message #34 received at 1075-done <at> emacsbugs.donarmstrong.com (full text, mbox):

From: Adrian Robert <Adrian.B.Robert <at> gmail.com>
To: 1075-done <at> debbugs.gnu.org
Subject: #1075 - 23.0.60; [NS] wrong number of arguments in call to ns_free_indexed_color - Emacs bug report logs
Date: Mon, 24 Nov 2008 23:46:03 -0500

I am closing this bug.  The call to ns_free_indexed_color() in  
x_clear_image_1() (image.c:1625) had no business being there -- that  
color is not indexed, but a long RGB value derived from  
four_corners_best() or x_alloc_image_color() (which eventually calls  
ns_defined_color() with makeIndex=0).  I checked in a removal as of  
11/24, after closer examination prompted by yet another posting bug  
#1362.  Hopefully this is the end of this!

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.