GNU bug report logs - #20705
Emacs segfaults when typing "(yas-expand" after M-: in yas-minor-mode

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 20705 in the body.
You can then email your comments to 20705 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Clément Pit--Claudel
 <clement.pitclaudel <at> live.com>
To: bug-gnu-emacs <at> gnu.org
Subject: Emacs segfaults when typing "(yas-expand" after M-: in yas-minor-mode
Date: Sun, 31 May 2015 13:44:43 -0700

Hi all,

I'm running 25.0. I've just run into a strange segfault which kicks in when I run M-x yas-minor-mode followed by M-: (yas-expand. The following is a recipe to reproduce it with the latest source:

rm -rf temp-emacs-profile
emacs -Q \
      --eval '(setq user-emacs-directory "temp-emacs-profile")' \
      -l package \
      --eval "(add-to-list 'package-archives '(\"melpa\" . \"http://melpa.org/packages/\") t)" \
      --eval "(package-refresh-contents)" \
      --eval "(package-initialize)" \
      --eval "(package-install 'yasnippet)" \
      --eval "(yas-minor-mode)"

Then type `M-: (yas-expand'. Emacs segfaults after the last 'd' is typed. Surprisingly, the problem does not appear if one uses the yasnippet verson from ELPA, only the more recent one from MELPA.

GDB says

Program received signal SIGSEGV, Segmentation fault.
Fkey_binding (key=8568165, accept_default=43008, no_remap=0, position=0) at keymap.c:1662
1662	      if (EVENT_HAS_PARAMETERS (event) && CONSP (XCDR (event)))

Here is a backtrace:

(gdb) backtrace
#0  XTYPE (a=<error reading variable: Cannot access memory at address 0x8>) at lisp.h:843
#1  CONSP (x=<error reading variable: Cannot access memory at address 0x8>) at lisp.h:2486
#2  Fkey_binding (key=8568165, accept_default=43008, no_remap=0, position=0) at keymap.c:1662
#3  0x00000000005438a5 in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffaee8) at eval.c:2729
#4  0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=39171933, maxdepth=<optimized out>, args_template=args_template <at> entry=0, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x0) at bytecode.c:919
#5  0x00000000005435fd in funcall_lambda (fun=39172005, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffb0d0) at eval.c:2951
#6  0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffb0c8) at eval.c:2767
#7  0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=39542813, maxdepth=<optimized out>, args_template=args_template <at> entry=0, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x0) at bytecode.c:919
#8  0x00000000005435fd in funcall_lambda (fun=fun <at> entry=39542941, nargs=nargs <at> entry=1, arg_vector=arg_vector <at> entry=0x7fffffffb200) at eval.c:2951
#9  0x0000000000542b83 in apply_lambda (fun=fun <at> entry=39542941, args=<optimized out>, count=count <at> entry=49) at eval.c:2826
#10 0x00000000005430fc in eval_sub (form=form <at> entry=39526547) at eval.c:2226
#11 0x0000000000545b73 in Feval (form=form <at> entry=39526547, lexical=lexical <at> entry=0) at eval.c:1996
#12 0x0000000000536872 in Fdocumentation_property (symbol=symbol <at> entry=18887328, prop=prop <at> entry=23616, raw=raw <at> entry=43008) at doc.c:467
#13 0x00000000005368f9 in Fdocumentation (function=18887328, raw=43008) at doc.c:329
#14 0x0000000000543871 in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffb4f8) at eval.c:2721
#15 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=10126773, maxdepth=<optimized out>, args_template=args_template <at> entry=3078, nargs=nargs <at> entry=2, 
    args=<optimized out>, args <at> entry=0x7fffffffb6e8) at bytecode.c:919
#16 0x0000000000543413 in funcall_lambda (fun=10126693, nargs=nargs <at> entry=2, arg_vector=arg_vector <at> entry=0x7fffffffb6e8) at eval.c:2885
#17 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffb6e0) at eval.c:2767
#18 0x0000000000544874 in Fapply (nargs=<optimized out>, args=0x7fffffffb840) at eval.c:2337
#19 0x00000000005437da in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffb838) at eval.c:2698
#20 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=10126541, maxdepth=<optimized out>, args_template=args_template <at> entry=2, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x7fffffffbb30) at bytecode.c:919
#21 0x0000000000543413 in funcall_lambda (fun=10126461, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffbb30) at eval.c:2885
#22 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffbb28) at eval.c:2767
#23 0x000000000054466d in Fapply (nargs=2, args=0x7fffffffbb28) at eval.c:2289
#24 0x00000000005437da in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffbb20) at eval.c:2698
#25 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=19839389, maxdepth=<optimized out>, args_template=args_template <at> entry=514, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x7fffffffbd08) at bytecode.c:919
#26 0x0000000000543413 in funcall_lambda (fun=31570517, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffbd08) at eval.c:2885
#27 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffbd00) at eval.c:2767
#28 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=10373125, maxdepth=<optimized out>, args_template=args_template <at> entry=2, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x7fffffffbee0) at bytecode.c:919
#29 0x0000000000543413 in funcall_lambda (fun=10373053, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffbee0) at eval.c:2885
#30 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffbed8) at eval.c:2767
#31 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=10371773, maxdepth=<optimized out>, args_template=args_template <at> entry=2, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x7fffffffc1c8) at bytecode.c:919
#32 0x0000000000543413 in funcall_lambda (fun=10371701, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffc1c8) at eval.c:2885
#33 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffc1c0) at eval.c:2767
#34 0x000000000054466d in Fapply (nargs=2, args=0x7fffffffc1c0) at eval.c:2289
#35 0x00000000005437da in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffc1b8) at eval.c:2698
#36 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=9940461, maxdepth=<optimized out>, args_template=args_template <at> entry=0, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x0) at bytecode.c:919
#37 0x00000000005435fd in funcall_lambda (fun=9940381, nargs=nargs <at> entry=1, arg_vector=arg_vector <at> entry=0x7fffffffc3a8) at eval.c:2951
#38 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=2, args=args <at> entry=0x7fffffffc3a0) at eval.c:2767
#39 0x0000000000543aed in call1 (fn=fn <at> entry=43776, arg1=arg1 <at> entry=36969941) at eval.c:2573
#40 0x00000000004df92d in timer_check_2 (timers=<optimized out>, timers <at> entry=34816051, idle_timers=<optimized out>, idle_timers <at> entry=34815939) at keyboard.c:4533
#41 0x00000000004e1bcc in timer_check () at keyboard.c:4600
#42 0x00000000004e1be9 in readable_events (flags=flags <at> entry=1) at keyboard.c:3434
#43 0x00000000004e4ae8 in get_input_pending (flags=flags <at> entry=1) at keyboard.c:6818
#44 0x00000000004e4b97 in swallow_events (do_display=do_display <at> entry=true) at keyboard.c:4330
#45 0x000000000041f3cd in sit_for (timeout=timeout <at> entry=122, reading=reading <at> entry=true, display_option=display_option <at> entry=1) at dispnew.c:5707
#46 0x00000000004e6ccb in read_char (commandflag=1, map=map <at> entry=34816259, prev_event=0, used_mouse_menu=used_mouse_menu <at> entry=0x7fffffffc82b, end_time=end_time <at> entry=0x0)
    at keyboard.c:2781
#47 0x00000000004e7d4d in read_key_sequence (keybuf=keybuf <at> entry=0x7fffffffc8e0, bufsize=bufsize <at> entry=30, prompt=prompt <at> entry=0, 
    dont_downcase_last=dont_downcase_last <at> entry=false, can_return_switch_frame=can_return_switch_frame <at> entry=true, fix_current_buffer=fix_current_buffer <at> entry=true, 
    prevent_redisplay=prevent_redisplay <at> entry=false) at keyboard.c:9156
#48 0x00000000004e9289 in command_loop_1 () at keyboard.c:1407
#49 0x0000000000542136 in internal_condition_case (bfun=bfun <at> entry=0x4e8fb4 <command_loop_1>, handlers=handlers <at> entry=18624, hfun=hfun <at> entry=0x4e0885 <cmd_error>) at eval.c:1348
#50 0x00000000004dc6f8 in command_loop_2 (ignore=ignore <at> entry=0) at keyboard.c:1139
#51 0x000000000054201a in internal_catch (tag=tag <at> entry=19296, func=func <at> entry=0x4dc6e0 <command_loop_2>, arg=arg <at> entry=0) at eval.c:1108
#52 0x00000000004dc6d0 in command_loop () at keyboard.c:1110
#53 0x00000000004e0513 in recursive_edit_1 () at keyboard.c:728
#54 0x00000000005055db in read_minibuf (map=map <at> entry=16141203, initial=initial <at> entry=0, prompt=<optimized out>, prompt <at> entry=9448044, expflag=expflag <at> entry=true, 
    histvar=histvar <at> entry=271760, histpos=<optimized out>, defalt=defalt <at> entry=0, allow_props=false, inherit_input_method=inherit_input_method <at> entry=false) at minibuf.c:680
#55 0x00000000005058b6 in Fread_from_minibuffer (prompt=9448044, initial_contents=0, keymap=16141203, read=43008, hist=<optimized out>, default_value=0, inherit_input_method=0)
    at minibuf.c:963
#56 0x0000000000543917 in Ffuncall (nargs=nargs <at> entry=6, args=args <at> entry=0x7fffffffcc48) at eval.c:2744
#57 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=9447149, maxdepth=<optimized out>, args_template=args_template <at> entry=2054, nargs=nargs <at> entry=1, 
    args=<optimized out>, args <at> entry=0x7fffffffce50) at bytecode.c:919
#58 0x0000000000543413 in funcall_lambda (fun=9447069, nargs=nargs <at> entry=1, arg_vector=arg_vector <at> entry=0x7fffffffce50) at eval.c:2885
#59 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=2, args=args <at> entry=0x7fffffffce48) at eval.c:2767
#60 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=9448013, maxdepth=<optimized out>, args_template=args_template <at> entry=0, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x0) at bytecode.c:919
#61 0x00000000005745d0 in Fbyte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>) at bytecode.c:485
#62 0x0000000000542ff7 in eval_sub (form=form <at> entry=9447931) at eval.c:2187
#63 0x0000000000545b73 in Feval (form=form <at> entry=9447931, lexical=<optimized out>) at eval.c:1996
#64 0x000000000053fe03 in Fcall_interactively (function=3467936, record_flag=0, keys=<optimized out>) at callint.c:361
#65 0x0000000000543889 in Ffuncall (nargs=nargs <at> entry=4, args=args <at> entry=0x7fffffffd1b8) at eval.c:2725
#66 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=36694549, maxdepth=<optimized out>, args_template=args_template <at> entry=0, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x0) at bytecode.c:919
#67 0x00000000005435fd in funcall_lambda (fun=36694661, nargs=nargs <at> entry=4, arg_vector=arg_vector <at> entry=0x7fffffffd398) at eval.c:2951
#68 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=5, args=args <at> entry=0x7fffffffd390) at eval.c:2767
#69 0x0000000000544874 in Fapply (nargs=<optimized out>, args=0x7fffffffd4f8) at eval.c:2337
#70 0x00000000005437da in Ffuncall (nargs=nargs <at> entry=4, args=args <at> entry=0x7fffffffd4f0) at eval.c:2698
#71 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=36693741, maxdepth=<optimized out>, args_template=args_template <at> entry=514, nargs=nargs <at> entry=3, 
    args=<optimized out>, args <at> entry=0x7fffffffd700) at bytecode.c:919
#72 0x0000000000543413 in funcall_lambda (fun=36693781, nargs=nargs <at> entry=3, arg_vector=arg_vector <at> entry=0x7fffffffd700) at eval.c:2885
#73 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=4, args=args <at> entry=0x7fffffffd6f8) at eval.c:2767
#74 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=9451933, maxdepth=<optimized out>, args_template=args_template <at> entry=4102, nargs=nargs <at> entry=1, 
---Type <return> to continue, or q <return> to quit---
    args=<optimized out>, args <at> entry=0x7fffffffd8e8) at bytecode.c:919
#75 0x0000000000543413 in funcall_lambda (fun=9451853, nargs=nargs <at> entry=1, arg_vector=arg_vector <at> entry=0x7fffffffd8e8) at eval.c:2885
#76 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=2, args=args <at> entry=0x7fffffffd8e0) at eval.c:2767
#77 0x0000000000543aed in call1 (fn=fn <at> entry=14592, arg1=<optimized out>) at eval.c:2573
#78 0x00000000004e94e9 in command_loop_1 () at keyboard.c:1521
#79 0x0000000000542136 in internal_condition_case (bfun=bfun <at> entry=0x4e8fb4 <command_loop_1>, handlers=handlers <at> entry=18624, hfun=hfun <at> entry=0x4e0885 <cmd_error>) at eval.c:1348
#80 0x00000000004dc6f8 in command_loop_2 (ignore=ignore <at> entry=0) at keyboard.c:1139
#81 0x000000000054201a in internal_catch (tag=tag <at> entry=44352, func=func <at> entry=0x4dc6e0 <command_loop_2>, arg=arg <at> entry=0) at eval.c:1108
#82 0x00000000004dc69e in command_loop () at keyboard.c:1118
#83 0x00000000004e0513 in recursive_edit_1 () at keyboard.c:728
#84 0x00000000004e07d5 in Frecursive_edit () at keyboard.c:799
#85 0x00000000004dc0e9 in main (argc=1, argv=0x7fffffffdc28) at emacs.c:1626

Lisp Backtrace:
"key-binding" (0xffffaef0)
"yas--keybinding-beyond-yasnippet" (0xffffb0d0)
"yas--expand-from-trigger-key-doc" (0xffffb200)
"documentation" (0xffffb500)
"elisp-get-fnsym-args-string" (0xffffb6e8)
"apply" (0xffffb840)
"elisp-eldoc-documentation-function" (0xffffbb30)
"apply" (0xffffbb28)
0x1e1ba50 PVEC_COMPILED
"eldoc-print-current-symbol-info" (0xffffbee0)
0x9e4270 PVEC_COMPILED
"apply" (0xffffc1c0)
"timer-event-handler" (0xffffc3a8)
"read-from-minibuffer" (0xffffcc50)
"read--expression" (0xffffce50)
"byte-code" (0xffffcf50)
0xb0a6a8 PVEC_SUBR
"ad-Advice-call-interactively" (0xffffd398)
"apply" (0xffffd4f8)
"call-interactively" (0xffffd700)
"command-execute" (0xffffd8e8)

What extra information should I provide to help track this bug?

Clément.

Message #8 received at 20705 <at> debbugs.gnu.org (full text, mbox):

From: Clément Pit--Claudel
 <clement.pitclaudel <at> live.com>
To: 20705 <at> debbugs.gnu.org
Subject: Re: bug#20705: Acknowledgement (Emacs segfaults when typing
 "(yas-expand" after M-: in yas-minor-mode)
Date: Sun, 31 May 2015 14:21:11 -0700

Some further investigation:

* yas-minor-mode is useless; (require 'yasnippet) is sufficient.
* The bug is triggered by eldoc; disabling global-eldoc-mode makes it go away.

Clément.

On 05/31/2015 01:46 PM, GNU bug Tracking System wrote:
> Thank you for filing a new bug report with debbugs.gnu.org.
> 
> This is an automatically generated reply to let you know your message
> has been received.
> 
> Your message is being forwarded to the package maintainers and other
> interested parties for their attention; they will reply in due course.
> 
> Your message has been sent to the package maintainer(s):
>  bug-gnu-emacs <at> gnu.org
> 
> If you wish to submit further information on this problem, please
> send it to 20705 <at> debbugs.gnu.org.
> 
> Please do not send mail to help-debbugs <at> gnu.org unless you wish
> to report a problem with the Bug-tracking system.
> 

Message #11 received at 20705 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Clément Pit--Claudel <clement.pitclaudel <at> live.com>
Cc: 20705 <at> debbugs.gnu.org
Subject: Re: bug#20705: Acknowledgement (Emacs segfaults when typing
 "(yas-expand"	after M-: in yas-minor-mode)
Date: Mon, 01 Jun 2015 17:52:29 +0300

> Date: Sun, 31 May 2015 14:21:11 -0700
> From: Clément Pit--Claudel
>  <clement.pitclaudel <at> live.com>
> 
> Some further investigation:
> 
> * yas-minor-mode is useless; (require 'yasnippet) is sufficient.
> * The bug is triggered by eldoc; disabling global-eldoc-mode makes it go away.

Thanks.

Is the complex command line you show in your report still needed?

In any case, could you try reproducing in a non-optimized build, where
hopefully the backtrace will be more informative?

Message #14 received at 20705 <at> debbugs.gnu.org (full text, mbox):

From: Clément Pit--Claudel
 <clement.pitclaudel <at> live.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 20705 <at> debbugs.gnu.org
Subject: Re: bug#20705: Acknowledgement (Emacs segfaults when typing
 "(yas-expand" after M-: in yas-minor-mode)
Date: Tue, 02 Jun 2015 02:17:15 -0700

[Message part 1 (text/plain, inline)]

On 06/01/2015 07:52 AM, Eli Zaretskii wrote:
>> Date: Sun, 31 May 2015 14:21:11 -0700
>> From: Clément Pit--Claudel
>>  <clement.pitclaudel <at> live.com>
>>
>> Some further investigation:
>>
>> * yas-minor-mode is useless; (require 'yasnippet) is sufficient.
>> * The bug is triggered by eldoc; disabling global-eldoc-mode makes it go away.
> 
> Thanks.
> 
> Is the complex command line you show in your report still needed?

Not anymore. I've reduced it further (it turns out that it's sufficient to just load the right file from yasnippet to trigger the bug, so given the attached file the following recipe does the trick):

   1. emacs -Q -l segfault.el
   2. Type "(yas-expand"

This reliably crash emacs on my machine. I've affixed a backtrace to this email, but I'm not sure if it's more useful. I used the parameters recommended in M-x view-emacs-debugging.

I tried reducing the attached file (it's large!) and for that I started by removing all comments and strings. Interestingly this caused Emacs to stop crashing, giving the following message instead:

   eldoc error: (cyclic-function-indirection yas-expand)

Maybe someone can make sense out of that? It seems to come from src/data.c:2129:

/* If OBJECT is a symbol, find the end of its function chain and
   return the value found there.  If OBJECT is not a symbol, just
   return it.  If there is a cycle in the function chain, signal a
   cyclic-function-indirection error.

   This is like Findirect_function, except that it doesn't signal an
   error if the chain ends up unbound.  */
Lisp_Object
indirect_function (register Lisp_Object object)
{
  Lisp_Object tortoise, hare;

  hare = tortoise = object;

  for (;;)
    {
      if (!SYMBOLP (hare) || NILP (hare))
	break;
      hare = XSYMBOL (hare)->function;
      if (!SYMBOLP (hare) || NILP (hare))
	break;
      hare = XSYMBOL (hare)->function;

      tortoise = XSYMBOL (tortoise)->function;

      if (EQ (hare, tortoise))
	xsignal1 (Qcyclic_function_indirection, object);
    }

  return hare;
}

Which matches part of the backtrace:

Program received signal SIGSEGV, Segmentation fault.
Fkey_binding (key=8568165, accept_default=43008, no_remap=0, position=0) at keymap.c:1662
1662	      if (EVENT_HAS_PARAMETERS (event) && CONSP (XCDR (event)))
(gdb) backtrace
#0  Fkey_binding (key=8568165, accept_default=43008, no_remap=0, position=0) at keymap.c:1662
#1  0x0000000000543012 in eval_sub (form=<optimized out>) at eval.c:2191
#2  0x000000000054327f in For (args=25549251) at eval.c:346
#3  0x0000000000542e17 in eval_sub (form=<optimized out>) at eval.c:2131
#4  0x00000000005432d3 in Fprogn (body=25549363) at eval.c:445
#5  0x00000000005454cc in FletX (args=25549171) at eval.c:896
#6  0x0000000000542e17 in eval_sub (form=<optimized out>) at eval.c:2131
#7  0x00000000005432d3 in Fprogn (body=25549411) at eval.c:445
#8  0x00000000005435b8 in funcall_lambda (fun=fun <at> entry=25549523, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffba60) at eval.c:2944
#9  0x0000000000542b83 in apply_lambda (fun=fun <at> entry=25549523, args=<optimized out>, count=count <at> entry=26) at eval.c:2826
#10 0x00000000005431ef in eval_sub (form=<optimized out>) at eval.c:2256
#11 0x000000000054543a in FletX (args=25990723) at eval.c:871
#12 0x0000000000542e17 in eval_sub (form=<optimized out>) at eval.c:2131
#13 0x00000000005432d3 in Fprogn (body=25990515) at eval.c:445
#14 0x0000000000544fac in Fcond (args=25990483) at eval.c:423
#15 0x0000000000542e17 in eval_sub (form=<optimized out>) at eval.c:2131
#16 0x000000000054543a in FletX (args=25989955) at eval.c:871
#17 0x0000000000542e17 in eval_sub (form=<optimized out>) at eval.c:2131
#18 0x00000000005432d3 in Fprogn (body=25989731) at eval.c:445
#19 0x00000000005435b8 in funcall_lambda (fun=fun <at> entry=25989619, nargs=nargs <at> entry=1, arg_vector=arg_vector <at> entry=0x7fffffffbf70) at eval.c:2944
#20 0x0000000000542b83 in apply_lambda (fun=fun <at> entry=25989619, args=<optimized out>, count=count <at> entry=20) at eval.c:2826
#21 0x00000000005431ef in eval_sub (form=form <at> entry=25991539) at eval.c:2256
#22 0x0000000000545b73 in Feval (form=form <at> entry=25991539, lexical=lexical <at> entry=0) at eval.c:1996
#23 0x0000000000536872 in Fdocumentation_property (symbol=symbol <at> entry=12823344, prop=prop <at> entry=23616, raw=raw <at> entry=43008) at doc.c:467
#24 0x00000000005368f9 in Fdocumentation (function=12823344, raw=43008) at doc.c:329
#25 0x0000000000543871 in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffc268) at eval.c:2721
#26 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=10126773, maxdepth=<optimized out>, args_template=args_template <at> entry=3078, nargs=nargs <at> entry=2, 
    args=<optimized out>, args <at> entry=0x7fffffffc458) at bytecode.c:919
#27 0x0000000000543413 in funcall_lambda (fun=10126693, nargs=nargs <at> entry=2, arg_vector=arg_vector <at> entry=0x7fffffffc458) at eval.c:2885
#28 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffc450) at eval.c:2767
#29 0x0000000000544874 in Fapply (nargs=<optimized out>, args=0x7fffffffc5b0) at eval.c:2337
#30 0x00000000005437da in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffc5a8) at eval.c:2698
#31 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=10126541, maxdepth=<optimized out>, args_template=args_template <at> entry=2, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x7fffffffc8a0) at bytecode.c:919
#32 0x0000000000543413 in funcall_lambda (fun=10126461, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffc8a0) at eval.c:2885
#33 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffc898) at eval.c:2767
#34 0x000000000054466d in Fapply (nargs=2, args=0x7fffffffc898) at eval.c:2289
#35 0x00000000005437da in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffc890) at eval.c:2698
#36 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=19216853, maxdepth=<optimized out>, args_template=args_template <at> entry=514, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x7fffffffca78) at bytecode.c:919
#37 0x0000000000543413 in funcall_lambda (fun=19216893, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffca78) at eval.c:2885
#38 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffca70) at eval.c:2767
#39 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=10373125, maxdepth=<optimized out>, args_template=args_template <at> entry=2, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x7fffffffcc50) at bytecode.c:919
#40 0x0000000000543413 in funcall_lambda (fun=10373053, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffcc50) at eval.c:2885
#41 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffcc48) at eval.c:2767
#42 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=10371773, maxdepth=<optimized out>, args_template=args_template <at> entry=2, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x7fffffffcf38) at bytecode.c:919
#43 0x0000000000543413 in funcall_lambda (fun=10371701, nargs=nargs <at> entry=0, arg_vector=arg_vector <at> entry=0x7fffffffcf38) at eval.c:2885
#44 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=1, args=args <at> entry=0x7fffffffcf30) at eval.c:2767
#45 0x000000000054466d in Fapply (nargs=2, args=0x7fffffffcf30) at eval.c:2289
#46 0x00000000005437da in Ffuncall (nargs=nargs <at> entry=3, args=args <at> entry=0x7fffffffcf28) at eval.c:2698
#47 0x00000000005720e1 in exec_byte_code (bytestr=<optimized out>, vector=9940461, maxdepth=<optimized out>, args_template=args_template <at> entry=0, nargs=nargs <at> entry=0, 
    args=<optimized out>, args <at> entry=0x0) at bytecode.c:919
#48 0x00000000005435fd in funcall_lambda (fun=9940381, nargs=nargs <at> entry=1, arg_vector=arg_vector <at> entry=0x7fffffffd118) at eval.c:2951
#49 0x0000000000543980 in Ffuncall (nargs=nargs <at> entry=2, args=args <at> entry=0x7fffffffd110) at eval.c:2767
#50 0x0000000000543aed in call1 (fn=fn <at> entry=43776, arg1=arg1 <at> entry=19720309) at eval.c:2573
#51 0x00000000004df92d in timer_check_2 (timers=<optimized out>, timers <at> entry=0, idle_timers=<optimized out>, idle_timers <at> entry=25452755) at keyboard.c:4533
#52 0x00000000004e1bcc in timer_check () at keyboard.c:4600
#53 0x00000000004e1be9 in readable_events (flags=flags <at> entry=1) at keyboard.c:3434
#54 0x00000000004e4ae8 in get_input_pending (flags=flags <at> entry=1) at keyboard.c:6818
#55 0x00000000004e4c3f in detect_input_pending_run_timers (do_display=do_display <at> entry=true) at keyboard.c:9973
#56 0x000000000057ca91 in wait_reading_process_output (time_limit=<optimized out>, time_limit <at> entry=30, nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, 
    do_display=do_display <at> entry=true, wait_for_cell=wait_for_cell <at> entry=0, wait_proc=wait_proc <at> entry=0x0, just_wait_proc=just_wait_proc <at> entry=0) at process.c:5013
#57 0x000000000041f49a in sit_for (timeout=timeout <at> entry=122, reading=reading <at> entry=true, display_option=display_option <at> entry=1) at dispnew.c:5748
#58 0x00000000004e6ccb in read_char (commandflag=1, map=map <at> entry=25459891, prev_event=0, used_mouse_menu=used_mouse_menu <at> entry=0x7fffffffd84b, end_time=end_time <at> entry=0x0)
    at keyboard.c:2781
#59 0x00000000004e7d4d in read_key_sequence (keybuf=keybuf <at> entry=0x7fffffffd900, bufsize=bufsize <at> entry=30, prompt=prompt <at> entry=0, 
    dont_downcase_last=dont_downcase_last <at> entry=false, can_return_switch_frame=can_return_switch_frame <at> entry=true, fix_current_buffer=fix_current_buffer <at> entry=true, 
    prevent_redisplay=prevent_redisplay <at> entry=false) at keyboard.c:9156
#60 0x00000000004e9289 in command_loop_1 () at keyboard.c:1407
#61 0x0000000000542136 in internal_condition_case (bfun=bfun <at> entry=0x4e8fb4 <command_loop_1>, handlers=handlers <at> entry=18624, hfun=hfun <at> entry=0x4e0885 <cmd_error>) at eval.c:1348
#62 0x00000000004dc6f8 in command_loop_2 (ignore=ignore <at> entry=0) at keyboard.c:1139
#63 0x000000000054201a in internal_catch (tag=tag <at> entry=44352, func=func <at> entry=0x4dc6e0 <command_loop_2>, arg=arg <at> entry=0) at eval.c:1108
#64 0x00000000004dc69e in command_loop () at keyboard.c:1118
#65 0x00000000004e0513 in recursive_edit_1 () at keyboard.c:728
#66 0x00000000004e07d5 in Frecursive_edit () at keyboard.c:799
#67 0x00000000004dc0e9 in main (argc=4, argv=0x7fffffffdc18) at emacs.c:1626

[segfault.el (text/x-emacs-lisp, attachment)]

Message #17 received at 20705 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Clément Pit--Claudel <clement.pitclaudel <at> live.com>
Cc: 20705 <at> debbugs.gnu.org
Subject: Re: bug#20705: Acknowledgement (Emacs segfaults when typing
 "(yas-expand" after M-: in yas-minor-mode)
Date: Tue, 02 Jun 2015 18:21:42 +0300

> Date: Tue, 02 Jun 2015 02:17:15 -0700
> From: Clément Pit--Claudel
>  <clement.pitclaudel <at> live.com>
> CC: 20705 <at> debbugs.gnu.org
> 
> > Is the complex command line you show in your report still needed?
> 
> Not anymore. I've reduced it further (it turns out that it's sufficient to just load the right file from yasnippet to trigger the bug, so given the attached file the following recipe does the trick):
> 
>    1. emacs -Q -l segfault.el
>    2. Type "(yas-expand"
> 
> This reliably crash emacs on my machine.

I cannot reproduce the crash on mine.  How recent are your sources?
(I don't see this information in your original report.)  I tried the
current master, and it didn't crash.

Also, can you try configuring without optimizations and with the
--enable-checking='yes,glyphs' option to configure?

> I tried reducing the attached file (it's large!) and for that I started by removing all comments and strings. Interestingly this caused Emacs to stop crashing, giving the following message instead:
> 
>    eldoc error: (cyclic-function-indirection yas-expand)
> 
> Maybe someone can make sense out of that? It seems to come from src/data.c:2129:
> [...]
> Which matches part of the backtrace:

Which part of the backtrace matches that?

Thanks.

Message #20 received at 20705 <at> debbugs.gnu.org (full text, mbox):

From: Johan Bockgård <bojohan <at> gnu.org>
To: Clément Pit--Claudel <clement.pitclaudel <at> live.com>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 20705 <at> debbugs.gnu.org
Subject: Re: bug#20705: Emacs segfaults when typing "(yas-expand" after M-: in
 yas-minor-mode
Date: Tue, 02 Jun 2015 19:32:50 +0200

Clément Pit--Claudel <clement.pitclaudel <at> live.com> writes:

> Lisp Backtrace:
> "key-binding" (0xffffaef0)
> "yas--keybinding-beyond-yasnippet" (0xffffb0d0)
> "yas--expand-from-trigger-key-doc" (0xffffb200)
> "documentation" (0xffffb500)
> "elisp-get-fnsym-args-string" (0xffffb6e8)
> "apply" (0xffffb840)
> "elisp-eldoc-documentation-function" (0xffffbb30)
> "apply" (0xffffbb28)
> 0x1e1ba50 PVEC_COMPILED
> "eldoc-print-current-symbol-info" (0xffffbee0)
> 0x9e4270 PVEC_COMPILED
> "apply" (0xffffc1c0)
> "timer-event-handler" (0xffffc3a8)

The code looks like this:

    (defun yas--keybinding-beyond-yasnippet ()
      "Get current keys's binding as if YASsnippet didn't exist."
      (let* ((yas-minor-mode nil)
             (yas--direct-keymaps nil)
             (keys (this-single-command-keys)))
        (or (key-binding keys t)
            (key-binding (yas--fallback-translate-input keys) t))))

Apparently this-single-command-keys returns [] (empty vector) when run
from a timer. This in turn makes key-binding crash.

Message #23 received at 20705 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Johan Bockgård <bojohan <at> gnu.org>
Cc: clement.pitclaudel <at> live.com, 20705 <at> debbugs.gnu.org
Subject: Re: bug#20705: Emacs segfaults when typing "(yas-expand" after M-: in
 yas-minor-mode
Date: Wed, 03 Jun 2015 18:29:06 +0300

> From: Johan Bockgård <bojohan <at> gnu.org>
> Cc: 20705 <at> debbugs.gnu.org, Eli Zaretskii <eliz <at> gnu.org>
> Date: Tue, 02 Jun 2015 19:32:50 +0200
> 
> The code looks like this:
> 
>     (defun yas--keybinding-beyond-yasnippet ()
>       "Get current keys's binding as if YASsnippet didn't exist."
>       (let* ((yas-minor-mode nil)
>              (yas--direct-keymaps nil)
>              (keys (this-single-command-keys)))
>         (or (key-binding keys t)
>             (key-binding (yas--fallback-translate-input keys) t))))
> 
> Apparently this-single-command-keys returns [] (empty vector) when run
> from a timer. This in turn makes key-binding crash.

Thanks for the analysis.

Clément, can you try the patch below?

diff --git a/src/keymap.c b/src/keymap.c
index 8f4ac0d..b69b409 100644
--- a/src/keymap.c
+++ b/src/keymap.c
@@ -1652,10 +1652,14 @@ Returns nil if COMMAND is not remapped (or not a symbol).
 
   if (NILP (position) && VECTORP (key))
     {
-      Lisp_Object event
-	/* mouse events may have a symbolic prefix indicating the
-	   scrollbar or mode line */
-	= AREF (key, SYMBOLP (AREF (key, 0)) && ASIZE (key) > 1 ? 1 : 0);
+      Lisp_Object event;
+
+      if (ASIZE (key) == 0)
+	return Qnil;
+
+      /* mouse events may have a symbolic prefix indicating the
+	 scrollbar or mode line */
+      event = AREF (key, SYMBOLP (AREF (key, 0)) && ASIZE (key) > 1 ? 1 : 0);
 
       /* We are not interested in locations without event data */
 

Message #26 received at 20705 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: clement.pitclaudel <at> live.com
Cc: bojohan <at> gnu.org, 20705 <at> debbugs.gnu.org
Subject: Re: bug#20705: Emacs segfaults when typing "(yas-expand" after M-:
 in	yas-minor-mode
Date: Sat, 06 Jun 2015 16:34:35 +0300

Ping!  Clément, any word on this?

> Date: Wed, 03 Jun 2015 18:29:06 +0300
> From: Eli Zaretskii <eliz <at> gnu.org>
> Cc: clement.pitclaudel <at> live.com, 20705 <at> debbugs.gnu.org
> 
> > From: Johan Bockgård <bojohan <at> gnu.org>
> > Cc: 20705 <at> debbugs.gnu.org, Eli Zaretskii <eliz <at> gnu.org>
> > Date: Tue, 02 Jun 2015 19:32:50 +0200
> > 
> > The code looks like this:
> > 
> >     (defun yas--keybinding-beyond-yasnippet ()
> >       "Get current keys's binding as if YASsnippet didn't exist."
> >       (let* ((yas-minor-mode nil)
> >              (yas--direct-keymaps nil)
> >              (keys (this-single-command-keys)))
> >         (or (key-binding keys t)
> >             (key-binding (yas--fallback-translate-input keys) t))))
> > 
> > Apparently this-single-command-keys returns [] (empty vector) when run
> > from a timer. This in turn makes key-binding crash.
> 
> Thanks for the analysis.
> 
> Clément, can you try the patch below?
> 
> diff --git a/src/keymap.c b/src/keymap.c
> index 8f4ac0d..b69b409 100644
> --- a/src/keymap.c
> +++ b/src/keymap.c
> @@ -1652,10 +1652,14 @@ Returns nil if COMMAND is not remapped (or not a symbol).
>  
>    if (NILP (position) && VECTORP (key))
>      {
> -      Lisp_Object event
> -	/* mouse events may have a symbolic prefix indicating the
> -	   scrollbar or mode line */
> -	= AREF (key, SYMBOLP (AREF (key, 0)) && ASIZE (key) > 1 ? 1 : 0);
> +      Lisp_Object event;
> +
> +      if (ASIZE (key) == 0)
> +	return Qnil;
> +
> +      /* mouse events may have a symbolic prefix indicating the
> +	 scrollbar or mode line */
> +      event = AREF (key, SYMBOLP (AREF (key, 0)) && ASIZE (key) > 1 ? 1 : 0);
>  
>        /* We are not interested in locations without event data */
>  
> 
> 
> 
> 

Message #29 received at 20705 <at> debbugs.gnu.org (full text, mbox):

From: Clément Pit--Claudel
 <clement.pitclaudel <at> live.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: bojohan <at> gnu.org, 20705 <at> debbugs.gnu.org
Subject: Re: bug#20705: Emacs segfaults when typing "(yas-expand" after M-:
 in	yas-minor-mode
Date: Sat, 06 Jun 2015 17:35:20 -0700

Yes! Brilliant debugging as always :) This patch seems to fix the problem.

Thanks Johan and Eli,
Clément.

On 06/06/2015 06:34 AM, Eli Zaretskii wrote:
> Ping!  Clément, any word on this?
> 
>> Date: Wed, 03 Jun 2015 18:29:06 +0300
>> From: Eli Zaretskii <eliz <at> gnu.org>
>> Cc: clement.pitclaudel <at> live.com, 20705 <at> debbugs.gnu.org
>>
>>> From: Johan Bockgård <bojohan <at> gnu.org>
>>> Cc: 20705 <at> debbugs.gnu.org, Eli Zaretskii <eliz <at> gnu.org>
>>> Date: Tue, 02 Jun 2015 19:32:50 +0200
>>>
>>> The code looks like this:
>>>
>>>     (defun yas--keybinding-beyond-yasnippet ()
>>>       "Get current keys's binding as if YASsnippet didn't exist."
>>>       (let* ((yas-minor-mode nil)
>>>              (yas--direct-keymaps nil)
>>>              (keys (this-single-command-keys)))
>>>         (or (key-binding keys t)
>>>             (key-binding (yas--fallback-translate-input keys) t))))
>>>
>>> Apparently this-single-command-keys returns [] (empty vector) when run
>>> from a timer. This in turn makes key-binding crash.
>>
>> Thanks for the analysis.
>>
>> Clément, can you try the patch below?
>>
>> diff --git a/src/keymap.c b/src/keymap.c
>> index 8f4ac0d..b69b409 100644
>> --- a/src/keymap.c
>> +++ b/src/keymap.c
>> @@ -1652,10 +1652,14 @@ Returns nil if COMMAND is not remapped (or not a symbol).
>>  
>>    if (NILP (position) && VECTORP (key))
>>      {
>> -      Lisp_Object event
>> -	/* mouse events may have a symbolic prefix indicating the
>> -	   scrollbar or mode line */
>> -	= AREF (key, SYMBOLP (AREF (key, 0)) && ASIZE (key) > 1 ? 1 : 0);
>> +      Lisp_Object event;
>> +
>> +      if (ASIZE (key) == 0)
>> +	return Qnil;
>> +
>> +      /* mouse events may have a symbolic prefix indicating the
>> +	 scrollbar or mode line */
>> +      event = AREF (key, SYMBOLP (AREF (key, 0)) && ASIZE (key) > 1 ? 1 : 0);
>>  
>>        /* We are not interested in locations without event data */
>>  
>>
>>
>>
>>
> 
> 

Message #34 received at 20705-done <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Clément Pit--Claudel <clement.pitclaudel <at> live.com>
Cc: 20705-done <at> debbugs.gnu.org, bojohan <at> gnu.org
Subject: Re: bug#20705: Emacs segfaults when typing "(yas-expand" after M-:
 in	yas-minor-mode
Date: Mon, 08 Jun 2015 17:40:47 +0300

> Date: Sat, 06 Jun 2015 17:35:20 -0700
> From: Clément Pit--Claudel
>  <clement.pitclaudel <at> live.com>
> CC: bojohan <at> gnu.org, 20705 <at> debbugs.gnu.org
> 
> Yes! Brilliant debugging as always :) This patch seems to fix the problem.

Thanks, pushed.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.