Subject: Re: bug#11813: Segmentation fault on launch related to x_draw_glyph_string_background

From: Eli Zaretskii <[email-masked]>
Date: Fri, 29 Jun 2012 12:51:20 +0300

Again, PLEASE CC [email-masked] on all your messages in this
matter.

> Date: Fri, 29 Jun 2012 12:30:16 +0300
> From: Left Right <[email-masked]>
> 
> I've reset the flags to no optimization and recompiled, and I see the
> same error. Below is the full log

Thanks.

> I'll paste it here in case the list doesn't accept attachments

The list does accept attachments.

> Starting program: /home/wvxvw/projects/emacs-sources/emacs/src/emacs -q
> [Thread debugging using libthread_db enabled]
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x000000000056c02e in x_draw_glyph_string_background
> (s=0x7fffffffba40, force_p=1) at xterm.c:1210
> 1210	      else if (FONT_HEIGHT (s->font) < s->height - 2 * box_line_width
> #0  0x000000000056c02e in x_draw_glyph_string_background
> (s=0x7fffffffba40, force_p=1) at xterm.c:1210
>         box_line_width = 0
> #1  0x0000000000571508 in x_draw_glyph_string (s=0x7fffffffba40) at xterm.c:2814
>         relief_drawn_p = 0
> #2  0x0000000000493044 in draw_glyphs (w=0x146bdc0, x=850,
> row=0x16748e0, area=TEXT_AREA, start=0, end=68, hl=DRAW_NORMAL_TEXT,
> overlaps=0) at xdisp.c:23404
>         head = 0x7fffffffbbe0
>         tail = 0x7fffffffb940
>         s = 0x7fffffffba40
>         clip_head = 0x0
>         clip_tail = 0x0
>         i = 68
>         j = 32
>         x_reached = 850
>         last_x = 841
>         area_left = 1
>         f = 0x146adb0

Please go to the above stack frame:

  (gdb) frame 2

and then display the glyph_row 'row':

  (gdb) pgrow

and post here what it shows.

The 'pgrow' command is defined on src/.gdbinit, so either start GDB
from the src/ directory (so it reads .gdbinit automatically), or type

  (gdb) source /path/to/src/.gdbinit

before invoking the 'pgrow' command.

I leave the rest of the backtrace, to get it recorded by the bug
tracker.  Please always CC [email-masked] when you mail
responses about this bug.

> #3  0x000000000049a056 in x_write_glyphs (start=0xf20600, len=68) at
> xdisp.c:25046
>         x = 0
>         hpos = 0
>         chpos = 0
> #4  0x0000000000415c2c in update_text_area (w=0x146bdc0, vpos=37) at
> dispnew.c:3773
>         current_row = 0xf23b90
>         desired_row = 0x16748e0
>         rif = 0xab19c0
>         changed_p = 0
> #5  0x000000000041676d in update_window_line (w=0x146bdc0, vpos=37,
> mouse_face_overwritten_p=0x7fffffffc16c) at dispnew.c:4014
>         current_row = 0xf23b90
>         desired_row = 0x16748e0
>         rif = 0xab19c0
>         changed_p = 0
> #6  0x000000000041563e in update_window (w=0x146bdc0, force_p=1) at
> dispnew.c:3575
>         end = 0x16748e0
>         mode_line_row = 0x16748e0
>         header_line_row = 0x0
>         changed_p = 0
>         mouse_face_overwritten_p = 0
>         row = 0x16723e0
>         yb = 612
>         n_updated = 0
>         desired_matrix = 0x11d6bb0
>         paused_p = 15208032
>         preempt_count = 9
>         rif = 0xab19c0
> #7  0x0000000000414cbc in update_window_tree (w=0x146bdc0, force_p=1)
> at dispnew.c:3340
>         paused_p = 0
> #8  0x00000000004149a8 in update_frame (f=0x146adb0, force_p=1,
> inhibit_hairy_id_p=1) at dispnew.c:3269
>         paused_p = 0
>         root_window = 0x146bdc0
> #9  0x000000000045f36f in echo_area_display (update_frame_p=1) at xdisp.c:10752
>         n = 1
>         mini_window = 21417429
>         w = 0x146cdd0
>         f = 0x146adb0
>         window_height_changed_p = 0
>         sf = 0x146adb0
> #10 0x000000000045ad75 in message3_nolog (m=23714017, nbytes=65,
> multibyte=0) at xdisp.c:9628
>         mini_window = 21417429
>         frame = 21409205
>         f = 0x146adb0
>         sf = 0x146adb0
> #11 0x000000000045a8cc in message3 (m=23714017, nbytes=65,
> multibyte=0) at xdisp.c:9565
>         gcpro1 = {
>           next = 0x7fffffffc430,
>           var = 0x6a9c9b,
>           nvars = 0
>         }
> #12 0x0000000000699686 in Fmessage (nargs=2, args=0x7fffffffc4f0) at
> editfns.c:3436
>         val = 23714017
> #13 0x00000000006a8de7 in Ffuncall (nargs=3, args=0x7fffffffc4e8) at eval.c:2802
>         fun = 14492773
>         original_fun = 15278610
>         funcar = 15361794
>         numargs = 2
>         lisp_numargs = 6827520
>         val = 11994129
>         backtrace = {
>           next = 0x7fffffffc940,
>           function = 0x7fffffffc4e8,
>           args = 0x7fffffffc4f0,
>           nargs = 2,
>           debug_on_exit = 0
>         }
>         internal_args = 0x7fffffffc9d8
>         i = 15279986
> #14 0x0000000000718bbc in exec_byte_code (bytestr=11994369,
> vector=11994557, maxdepth=24, args_template=0, nargs=0,
> args=0x7fffffffc9d8) at bytecode.c:784
>         count = 4
>         op = 2
>         vectorp = 0xb705c8
>         stack = {
>           pc = 0xd9cad0 ")\207",
>           byte_string = 11994369,
>           byte_string_start = 0xd9ca97 "\305\030\t\206\071",
>           constants = 11994557,
>           next = 0x7fffffffcac0
>         }
>         top = 0x7fffffffc4e8
>         result = 15527856
> #15 0x00000000006a9c9b in funcall_lambda (fun=11994317, nargs=0,
> arg_vector=0x7fffffffc9d8) at eval.c:2986
>         val = 8589921008
>         syms_left = 0
>         next = 19143602
>         lexenv = 412
>         count = 4
>         i = 2
>         optional = -13792
>         rest = 32767
> #16 0x00000000006a9529 in Ffuncall (nargs=1, args=0x7fffffffc9d0) at eval.c:2869
>         fun = 11994317
>         original_fun = 19439986
>         funcar = 100000000
>         numargs = 0
>         lisp_numargs = 23522358
>         val = 140737488347888
>         backtrace = {
>           next = 0x7fffffffcea0,
>           function = 0x7fffffffc9d0,
>           args = 0x7fffffffc9d8,
>           nargs = 0,
>           debug_on_exit = 0
>         }
>         internal_args = 0x7fffffffcf30
>         i = 0
> #17 0x0000000000718bbc in exec_byte_code (bytestr=11996273,
> vector=11997101, maxdepth=88, args_template=1028, nargs=1,
> args=0x7fffffffcf38) at bytecode.c:784
>         count = 4
>         op = 0
>         vectorp = 0xb70fb8
>         stack = {
>           pc = 0xd9c51a "\210\b\203\021",
>           byte_string = 11996273,
>           byte_string_start = 0xd9c518 "\306 \210\b\203\021",
>           constants = 11997101,
>           next = 0x7fffffffd000
>         }
>         top = 0x7fffffffc9d0
>         result = 140737488341568
> #18 0x00000000006a9c9b in funcall_lambda (fun=11996221, nargs=1,
> arg_vector=0x7fffffffcf30) at eval.c:2986
>         val = 4310088018
>         syms_left = 1028
>         next = 15147520
>         lexenv = 14970704
>         count = 4
>         i = 140737488345264
>         optional = 22
>         rest = 0
> #19 0x00000000006a9529 in Ffuncall (nargs=2, args=0x7fffffffcf28) at eval.c:2869
>         fun = 11996221
>         original_fun = 19437266
>         funcar = 15147520
>         numargs = 1
>         lisp_numargs = 6827520
>         val = 19597478
>         backtrace = {
>           next = 0x7fffffffd3e0,
>           function = 0x7fffffffcf28,
>           args = 0x7fffffffcf30,
>           nargs = 1,
>           debug_on_exit = 0
>         }
>         internal_args = 0x12b0896
>         i = 15279746
> #20 0x0000000000718bbc in exec_byte_code (bytestr=11955625,
> vector=11957277, maxdepth=72, args_template=0, nargs=0,
> args=0x7fffffffd478) at bytecode.c:784
>         count = 4
>         op = 1
>         vectorp = 0xb67428
>         stack = {
>           pc = 0xd9f3d7 "\210\016H\203\214\005\201\300",
>           byte_string = 11955625,
>           byte_string_start = 0xd9ee57 "\306
> \020\307\021\n\023\307\024\310\311!\211\307=\204\060",
>           constants = 11957277,
>           next = 0x7fffffffd4f0
>         }
>         top = 0x7fffffffcf28
>         result = 23097713
> #21 0x00000000006a9c9b in funcall_lambda (fun=11955573, nargs=0,
> arg_vector=0x7fffffffd478) at eval.c:2986
>         val = 140737488345264
>         syms_left = 0
>         next = 140737488343984
>         lexenv = 6786392
>         count = 4
>         i = 5
>         optional = -11112
>         rest = 32767
> #22 0x00000000006a9529 in Ffuncall (nargs=1, args=0x7fffffffd470) at eval.c:2869
>         fun = 11955573
>         original_fun = 19238802
>         funcar = 15147520
>         numargs = 0
>         lisp_numargs = 6827520
>         val = 15120722
>         backtrace = {
>           next = 0x7fffffffda40,
>           function = 0x7fffffffd470,
>           args = 0x7fffffffd478,
>           nargs = 0,
>           debug_on_exit = 0
>         }
>         internal_args = 0x1607171
>         i = 22203478
> #23 0x0000000000718bbc in exec_byte_code (bytestr=11951433,
> vector=11951885, maxdepth=32, args_template=0, nargs=0,
> args=0x7fffffffd8b0) at bytecode.c:784
>         count = 3
>         op = 0
>         vectorp = 0xb65f18
>         stack = {
>           pc = 0xd9f934
> "\210)\210\351\352\353\"\210\354\321\355\"\211;\203\256",
>           byte_string = 11951433,
>           byte_string_start = 0xd9f89f "\b\203\b",
>           constants = 11951885,
>           next = 0x0
>         }
>         top = 0x7fffffffd470
>         result = 140737308851520
> #24 0x00000000006a9c9b in funcall_lambda (fun=11951381, nargs=0,
> arg_vector=0x7fffffffd8b0) at eval.c:2986
>         val = 140737353973760
>         syms_left = 0
>         next = 140737308427896
>         lexenv = 140737293415912
>         count = 3
>         i = 4294969316
>         optional = 33
>         rest = 0
> #25 0x00000000006a98c5 in apply_lambda (fun=11951381, args=15120722)
> at eval.c:2929
>         args_left = 15120722
>         i = 0
>         numargs = 0
>         arg_vector = 0x7fffffffd8b0
>         gcpro1 = {
>           next = 0x0,
>           var = 0x15f0778,
>           nvars = 0
>         }
>         gcpro2 = {
>           next = 0x100000000,
>           var = 0xffffffff,
>           nvars = 140737488345680
>         }
>         gcpro3 = {
>           next = 0x7fff00000001,
>           var = 0x0,
>           nvars = 140733193388033
>         }
>         tem = 2
>         sa_count = 3
>         sa_must_free = 0
> #26 0x00000000006a7120 in eval_sub (form=15346758) at eval.c:2212
>         fun = 11951381
>         val = 140737353973760
>         original_fun = 19139458
>         original_args = 15120722
>         funcar = 15120722
>         backtrace = {
>           next = 0x0,
>           function = 0x7fffffffda70,
>           args = 0x7fffffffd8b0,
>           nargs = 0,
>           debug_on_exit = 0
>         }
>         gcpro1 = {
>           next = 0x7fffffffdaa0,
>           var = 0x683a75,
>           nvars = 2822930839
>         }
>         gcpro2 = {
>           next = 0x7ffff7fd66e0,
>           var = 0x7fffffffda90,
>           nvars = 276967387
>         }
>         gcpro3 = {
>           next = 0x7ffff4617000,
>           var = 0x7fffffffda70,
>           nvars = 1
>         }
> #27 0x00000000006a6270 in Feval (form=15346758, lexical=15120722) at eval.c:2021
>         count = 2
> #28 0x00000000005cc3bf in top_level_2 () at keyboard.c:1164
> No locals.
> #29 0x00000000006a446d in internal_condition_case (bfun=0x5cc3a2
> <top_level_2>, handlers=15172450, hfun=0x5cbea5 <cmd_error>) at
> eval.c:1333
>         val = 6079425
>         c = {
>           tag = 15120722,
>           val = 15120722,
>           next = 0x7fffffffdd00,
>           gcpro = 0x0,
>           jmp = {{
>               __jmpbuf = {2, -5741430973350281040, 4243568,
> 140737488347888, 0, 0, -5741430973453041488, 5741431852756107440},
>               __mask_was_saved = 0,
>               __saved_mask = {
>                 __val = {4294967295, 0, 1, 11191568, 0, 0, 0, 0,
> 140737351960338, 1, 0, 1, 140737308399024, 1, 2, 140737488346656}
>               }
>             }},
>           backlist = 0x0,
>           handlerlist = 0x0,
>           lisp_eval_depth = 0,
>           pdlcount = 2,
>           poll_suppress_count = 1,
>           interrupt_input_blocked = 0,
>           byte_stack = 0x0
>         }
>         h = {
>           handler = 15172450,
>           var = 15120722,
>           chosen_clause = 140737488346080,
>           tag = 0x7fffffffdb90,
>           next = 0x0
>         }
> #30 0x00000000005cc3f9 in top_level_1 (ignore=15120722) at keyboard.c:1172
> No locals.
> #31 0x00000000006a3cfd in internal_catch (tag=15168242, func=0x5cc3c1
> <top_level_1>, arg=15120722) at eval.c:1090
>         c = {
>           tag = 15168242,
>           val = 15120722,
>           next = 0x0,
>           gcpro = 0x0,
>           jmp = {{
>               __jmpbuf = {2, -5741430973297852240, 4243568,
> 140737488347888, 0, 0, -5741430973339795280, 5741431850440851632},
>               __mask_was_saved = 0,
>               __saved_mask = {
>                 __val = {15120722, 140737488346608, 6830709, 0,
> 4302523939, 140737311891096, 15120722, 15340368, 140737488346712, 14,
> 15147520, 14523360, 6827487, 140737488346672,
>                   15120722, 4243568}
>               }
>             }},
>           backlist = 0x0,
>           handlerlist = 0x0,
>           lisp_eval_depth = 0,
>           pdlcount = 2,
>           poll_suppress_count = 1,
>           interrupt_input_blocked = 0,
>           byte_stack = 0x0
>         }
> #32 0x00000000005cc31d in command_loop () at keyboard.c:1127
> No locals.
> #33 0x00000000005cb6f1 in recursive_edit_1 () at keyboard.c:754
>         count = 1
>         val = 6077156
> #34 0x00000000005cbacc in Frecursive_edit () at keyboard.c:818
>         count = 0
>         buffer = 15120722
> #35 0x00000000005c927c in main (argc=2, argv=0x7fffffffe2f8) at emacs.c:1693
>         dummy = 140737354131128
>         stack_bottom_variable = 0 '\000'
>         do_initial_setlocale = 1
>         skip_args = 0
>         rlim = {
>           rlim_cur = 8720000,
>           rlim_max = 18446744073709551615
>         }
>         no_loadup = 0
>         junk = 0x0
>         dname_arg = 0x0
>         ch_to_dir = 0x3d8f538 <Address 0x3d8f538 out of bounds>
> 
> Lisp Backtrace:
> "message" (0xffffc4f0)
> "display-startup-echo-area-message" (0xffffc9d8)
> "command-line-1" (0xffffcf30)
> "command-line" (0xffffd478)
> "normal-top-level" (0xffffd8b0)
> $1 = {
>   x = 82,
>   y = 631,
>   ybase = 649,
>   width = 288,
>   background_width = 288,
>   height = 25,
>   left_overhang = 0,
>   right_overhang = 0,
>   f = 0x146adb0,
>   w = 0x146bdc0,
>   display = 0x161a6b0,
>   window = 52428926,
>   row = 0x16748e0,
>   area = TEXT_AREA,
>   char2b = 0x0,
>   nchars = 12,
>   hl = DRAW_NORMAL_TEXT,
>   face = 0x16549c0,
>   font = 0x0,
>   cmp = 0x0,
>   cmp_id = 0,
>   cmp_from = 0,
>   cmp_to = 0,
>   extends_to_end_of_line_p = 0,
>   background_filled_p = 0,
>   two_byte_p = 0,
>   font_not_found_p = 0,
>   stippled_p = 0,
>   for_overlaps = 0,
>   padding_p = 0,
>   gc = 0xf64360,
>   first_glyph = 0xf20780,
>   img = 0x0,
>   slice = {
>     x = 0,
>     y = 0,
>     width = 0,
>     height = 0
>   },
>   clip_head = 0x0,
>   clip_tail = 0x0,
>   clip = {{
>       x = 1,
>       y = 631,
>       width = 840,
>       height = 25
>     }, {
>       x = 0,
>       y = 0,
>       width = 0,
>       height = 0
>     }},
>   num_clips = 1,
>   underline_position = 0,
>   underline_thickness = 0,
>   next = 0x7fffffffb940,
>   prev = 0x7fffffffbbe0
> }
> Continuing.
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff548a497 in kill () from /lib/libc.so.6
> A debugging session is active.
> 
> 	Inferior 1 [process 27265] will be killed.
> 
> Quit anyway? (y or n)
> 
> As an aside, I also tried to compile it with no XFT support, with the
> same result. When configuring for this compilation I didn't add any
> more options, just the --enable-checking --enable-asserts.