Subject: bug#15575: 24.3.50; New tty menus crash Emacs

From: Jan Djärv <[email-masked]>
Date: Wed, 9 Oct 2013 19:05:30 +0200

Hello.

Starting emacs with -Q -nw and then press F10 gives a crash:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x000000000002fe21
0x00007fff8a1cb20d in memmove$VARIANT$sse3x ()
#0  0x00007fff8a1cb207 in memmove$VARIANT$sse3x ()
#1  0x00000001000484bc in deep_copy_glyph_row (to=0x10383ae00, from=0x10383c600) at /Users/jhd/src/emacs/current/src/xdisp.c:20619
#2  0x0000000100047e39 in display_tty_menu_item (item_text=0x1006124b1 "New Frame on Display...", width=40, face_id=15, x=0, y=24, submenu=0) at /Users/jhd/src/emacs/current/src/xdisp.c:20661
#3  0x0000000100118958 in tty_menu_display (menu=0x100e09030, x=0, y=1, pn=1, faces=0x7fff5fbfcfe0, mx=0, my=1, disp_help=1) at /Users/jhd/src/emacs/current/src/term.c:2948
#4  0x0000000100111eff in tty_menu_activate (menu=0x100e08e30, pane=0x7fff5fbfd474, selidx=0x7fff5fbfd470, x0=1, y0=1, txt=0x7fff5fbfd450, help_callback=0x100112090 <tty_menu_help_callback>, kbd_navigation=1) at /Users/jhd/src/emacs/current/src/term.c:3404
#5  0x00000001001108eb in tty_menu_show (f=0x10181c268, x=1, y=0, for_click=1, keymaps=1, title=4299165865, kbd_navigation=1, error_name=0x7fff5fbfd690) at /Users/jhd/src/emacs/current/src/term.c:3781
#6  0x00000001000948f7 in Fx_popup_menu (position=4347610518, menu=4346524678) at /Users/jhd/src/emacs/current/src/menu.c:1454
#7  0x0000000100205b55 in Ffuncall (nargs=3, args=0x7fff5fbfd798) at /Users/jhd/src/emacs/current/src/eval.c:2792
#8  0x0000000100267580 in exec_byte_code (bytestr=4300144865, vector=4300144901, maxdepth=24, args_template=4320145466, nargs=0, args=0x0) at /Users/jhd/src/emacs/current/src/bytecode.c:919
#9  0x000000010020744a in funcall_lambda (fun=4300144741, nargs=4, arg_vector=0x7fff5fbfdee0) at /Users/jhd/src/emacs/current/src/eval.c:3025
#10 0x0000000100205d56 in Ffuncall (nargs=5, args=0x7fff5fbfded8) at /Users/jhd/src/emacs/current/src/eval.c:2838
#11 0x0000000100267580 in exec_byte_code (bytestr=4300146009, vector=4300146045, maxdepth=32, args_template=4320145466, nargs=0, args=0x0) at /Users/jhd/src/emacs/current/src/bytecode.c:919
#12 0x000000010020744a in funcall_lambda (fun=4300145957, nargs=0, arg_vector=0x7fff5fbfe670) at /Users/jhd/src/emacs/current/src/eval.c:3025
#13 0x0000000100205d56 in Ffuncall (nargs=1, args=0x7fff5fbfe668) at /Users/jhd/src/emacs/current/src/eval.c:2838
#14 0x00000001001fe35a in apply1 (fn=4323262346, arg=4320145466) at /Users/jhd/src/emacs/current/src/eval.c:2555
#15 0x00000001001fab56 in Fcall_interactively (function=4323262346, record_flag=4320145466, keys=4320182853) at /Users/jhd/src/emacs/current/src/callint.c:378
#16 0x0000000100205b84 in Ffuncall (nargs=4, args=0x7fff5fbfead8) at /Users/jhd/src/emacs/current/src/eval.c:2796
#17 0x0000000100267580 in exec_byte_code (bytestr=4299590377, vector=4299590413, maxdepth=52, args_template=4100, nargs=1, args=0x7fff5fbff230) at /Users/jhd/src/emacs/current/src/bytecode.c:919
#18 0x0000000100206f4d in funcall_lambda (fun=4299590333, nargs=1, arg_vector=0x7fff5fbff228) at /Users/jhd/src/emacs/current/src/eval.c:2959
#19 0x0000000100205d56 in Ffuncall (nargs=2, args=0x7fff5fbff220) at /Users/jhd/src/emacs/current/src/eval.c:2838
#20 0x00000001002067d9 in call1 (fn=4320213578, arg1=4323262346) at /Users/jhd/src/emacs/current/src/eval.c:2588
#21 0x0000000100136a49 in command_loop_1 () at /Users/jhd/src/emacs/current/src/keyboard.c:1561
#22 0x0000000100203359 in internal_condition_case (bfun=0x100135e60 <command_loop_1>, handlers=4320220922, hfun=0x1001539d0 <cmd_error>) at /Users/jhd/src/emacs/current/src/eval.c:1331
#23 0x00000001001538c9 in command_loop_2 (ignore=4320145466) at /Users/jhd/src/emacs/current/src/keyboard.c:1162
#24 0x00000001002025e1 in internal_catch (tag=4320217114, func=0x1001538a0 <command_loop_2>, arg=4320145466) at /Users/jhd/src/emacs/current/src/eval.c:1097
#25 0x000000010013533b in command_loop () at /Users/jhd/src/emacs/current/src/keyboard.c:1141
#26 0x0000000100135204 in recursive_edit_1 () at /Users/jhd/src/emacs/current/src/keyboard.c:780
#27 0x0000000100135522 in Frecursive_edit () at /Users/jhd/src/emacs/current/src/keyboard.c:844
#28 0x0000000100133584 in main (argc=3, argv=0x7fff5fbff8c0) at /Users/jhd/src/emacs/current/src/emacs.c:1577

Lisp Backtrace:
No symbol "ARRAY_MARK_FLAG" in current context.

Same problem as my report about VALMASK, this is optimized away.

	Jan D.

In GNU Emacs 24.3.50.5 (x86_64-apple-darwin12.5.0, NS apple-appkit-1187.40)
of 2013-10-09 on zeplin
Bzr revision: 114590 [email-masked]
Windowing system distributor `Apple', version 10.3.1187
Configured using:
`configure --verbose --with-ns CFLAGS=-g3'

Important settings:
  value of $LC_COLLATE: C
  value of $LANG: sv_SE.UTF-8
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
<escape> x r e p o r t - e m a c s - b u g <return

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr emacsbug message format-spec rfc822 mml
easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils time-date tooltip ediff-hook vc-hooks
lisp-float-type mwheel ns-win tool-bar dnd fontset image regexp-opt
fringe tabulated-list newcomment lisp-mode prog-mode register page
menu-bar rfn-eshadow timer select scroll-bar mouse jit-lock font-lock
syntax facemenu font-core frame cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
case-table epa-hook jka-cmpr-hook help simple abbrev minibuffer nadvice
loaddefs button faces cus-face macroexp files text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process ns multi-tty
emacs)