Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip

From: Tobias Getzner <[email-masked]>
Date: Tue, 16 Jun 2015 09:21:04 +0200

On Sa, 2015-06-13 at 12:38 +0300, Eli Zaretskii wrote:
> > From: Tobias Getzner <[email-masked]>
> > Date: Sat, 13 Jun 2015 11:18:38 +0200
> > 
> > When x-gtk-use-system-tooltips is set to nil, and the tooltip face 
> > is
> > customized using an invalid color string such as #zz, Emacs will
> > segfault when a tooltip is being drawn.
> 
> I cannot reproduce this on my system, so please show a backtrace from
> running Emacs inside GDB.  Also, please tell how you customized the
> face color, exactly -- it could be that only some specific ways of
> customizing it cause the problem.

Thanks to Martin for reproducing. From what little I can infer, you
seem to have made sense of this already, but just for the sake of
completeness, below is my backtrace. The line numbers seem a bit
different, but I guess it’s otherwise identical to Martin’s?

This was after setting x-gtk-use-system-tooltip to nil and customizing
the tooltip face to #qqq.

Best, and thanks,
TG

Program received signal SIGSEGV, Segmentation fault.
cache_image (f=0x1170a68, img=<optimized out>) at image.c:1782
1782	  for (i = 0; i < c->used; ++i)
(gdb) bt
#0  cache_image (f=0x1170a68, img=<optimized out>) at image.c:1782
#1  lookup_image (f=0x1170a68, spec=spec@entry=19521878) at
image.c:1693
#2  0x00000000004393ff in handle_single_display_spec (it=it@entry=0x7ff
fffff7da0, 
    spec=<optimized out>, object=object@entry=31549445, 
overlay=overlay@entry=12308786, 
    position=position@entry=0x7fffffff7ed8, bufpos=bufpos@entry=255,
display_replaced_p=0, 
    frame_window_p=1) at xdisp.c:5310
#3  0x0000000000439fd8 in handle_display_spec (it=it@entry=0x7fffffff7d
a0, spec=<optimized out>, 
    object=object@entry=31549445, overlay=12308786, 
position=position@entry=0x7fffffff7ed8, 
    bufpos=bufpos@entry=255, frame_window_p=1) at xdisp.c:4836
#4  0x000000000043a299 in handle_display_prop (it=0x7fffffff7da0) at
xdisp.c:4759
#5  0x000000000043d002 in handle_stop (it=it@entry=0x7fffffff7da0) at
xdisp.c:3492
#6  0x00000000004463a2 in next_element_from_buffer (it=0x7fffffff7da0)
at xdisp.c:8290
#7  0x0000000000441275 in get_next_display_element (it=it@entry=0x7ffff
fff7da0) at xdisp.c:6944
#8  0x0000000000447188 in display_line (it=it@entry=0x7fffffff7da0) at
xdisp.c:20241
#9  0x000000000044b6ea in try_window (window=window@entry=18291325,
pos=..., flags=flags@entry=1)
    at xdisp.c:17007
#10 0x000000000046170e in redisplay_window (window=18291325, 
    just_this_one_p=just_this_one_p@entry=false) at xdisp.c:16486
#11 0x0000000000463aa3 in redisplay_window_0 (window=window@entry=18291
325) at xdisp.c:14373
#12 0x000000000055b53b in internal_condition_case_1 (
    bfun=bfun@entry=0x463a70 <redisplay_window_0>, arg=18291325,
handlers=<optimized out>, 
    hfun=hfun@entry=0x42be50 <redisplay_window_error>) at eval.c:1372
#13 0x0000000000430caf in redisplay_windows (window=18291325) at
xdisp.c:14353
#14 0x0000000000450331 in redisplay_internal () at xdisp.c:13949
#15 0x0000000000452530 in redisplay_preserve_echo_area (
from_where=from_where@entry=2)
    at xdisp.c:14206
#16 0x000000000041b065 in Fredisplay (force=12308786) at dispnew.c:5896
#17 0x000000000055d1a7 in Ffuncall (nargs=<optimized out>, 
args=args@entry=0x7fffffffc1f0)
    at eval.c:2811
#18 0x00000000005927c3 in exec_byte_code (bytestr=<optimized out>,
vector=8822021, 
    maxdepth=<optimized out>, args_template=<optimized out>, 
nargs=nargs@entry=1, 
    args=<optimized out>, args@entry=0x869ce1 <pure+123745>) at
bytecode.c:916
#19 0x000000000055ccb7 in funcall_lambda (fun=140737488339872, 
nargs=nargs@entry=1, 
    arg_vector=0x869ce1 <pure+123745>, arg_vector@entry=0x7fffffffc340)
at eval.c:2978
#20 0x000000000055cfbb in Ffuncall (nargs=2, args=args@entry=0x7fffffff
c338) at eval.c:2872
#21 0x00000000005927c3 in exec_byte_code (bytestr=<optimized out>,
vector=10488933, 
    maxdepth=<optimized out>, args_template=<optimized out>,
nargs=<optimized out>, 
    args=<optimized out>) at bytecode.c:916
#22 0x000000000055c4e3 in eval_sub (form=<optimized out>) at
eval.c:2187
#23 0x000000000055fbc3 in Fprogn (body=10488838) at eval.c:462
#24 internal_lisp_condition_case (var=<optimized out>,
bodyform=10488550, 
    handlers=<optimized out>) at eval.c:1306
#25 0x0000000000593bcf in exec_byte_code (bytestr=<optimized out>,
vector=10488493, 
    maxdepth=<optimized out>, args_template=<optimized out>, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:1162
#26 0x000000000055cc1f in funcall_lambda (fun=10488365, 
nargs=nargs@entry=2, 
    arg_vector=arg_vector@entry=0x7fffffffc720) at eval.c:3044
#27 0x000000000055cfbb in Ffuncall (nargs=3, args=args@entry=0x7fffffff
c718) at eval.c:2872
#28 0x00000000005927c3 in exec_byte_code (bytestr=<optimized out>,
vector=10490901, 
    maxdepth=<optimized out>, args_template=<optimized out>, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:916
#29 0x000000000055cc1f in funcall_lambda (fun=10490821, 
nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffc978) at eval.c:3044
#30 0x000000000055cfbb in Ffuncall (nargs=2, args=0x7fffffffc970) at
eval.c:2872
#31 0x000000000055b89d in run_hook_with_args (nargs=2,
args=0x7fffffffc970, 
    funcall=0x55cd90 <Ffuncall>) at eval.c:2547
#32 0x000000000055d09a in Ffuncall (nargs=<optimized out>, 
args=args@entry=0x7fffffffc968)
    at eval.c:2792
#33 0x00000000005927c3 in exec_byte_code (bytestr=<optimized out>,
vector=10488085, 
    maxdepth=<optimized out>, args_template=<optimized out>, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:916
#34 0x000000000055cc1f in funcall_lambda (fun=10488021, 
nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffcbf8) at eval.c:3044
#35 0x000000000055cfbb in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffcbf0)
    at eval.c:2872
#36 0x000000000055e6a2 in Fapply (nargs=2, args=0x7fffffffcbf0) at
eval.c:2297
#37 0x000000000055d09a in Ffuncall (nargs=<optimized out>, 
args=args@entry=0x7fffffffcbe8)
    at eval.c:2792
#38 0x00000000005927c3 in exec_byte_code (bytestr=<optimized out>,
vector=10054405, 
    maxdepth=<optimized out>, args_template=<optimized out>,
nargs=<optimized out>, 
    args=<optimized out>) at bytecode.c:916
#39 0x000000000055c4e3 in eval_sub (form=form@entry=10054326) at
eval.c:2187
#40 0x000000000055fade in internal_lisp_condition_case (var=<optimized
out>, bodyform=10054326, 
    handlers=<optimized out>) at eval.c:1317
#41 0x0000000000593bcf in exec_byte_code (bytestr=<optimized out>,
vector=10054093, 
    maxdepth=<optimized out>, args_template=<optimized out>, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:1162
#42 0x000000000055cc1f in funcall_lambda (fun=10054013, 
nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffcfe8) at eval.c:3044
#43 0x000000000055cfbb in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffcfe0)
    at eval.c:2872
#44 0x000000000055d2da in call1 (fn=<optimized out>, arg1=arg1@entry=18
809933) at eval.c:2610
#45 0x00000000004ef218 in timer_check_2 (idle_timers=<optimized out>,
timers=<optimized out>)
    at keyboard.c:4515
#46 timer_check () at keyboard.c:4582
#47 0x00000000004ef5d1 in readable_events (flags=1) at keyboard.c:3448
#48 0x00000000004f0c78 in get_input_pending (flags=flags@entry=1) at
keyboard.c:6766
#49 0x00000000004f3ea8 in detect_input_pending_run_timers (
do_display=do_display@entry=true)
    at keyboard.c:9895
#50 0x000000000059cd8c in wait_reading_process_output (
time_limit=time_limit@entry=30, 
    nsecs=nsecs@entry=0, read_kbd=read_kbd@entry=-1, 
do_display=do_display@entry=true, 
    wait_for_cell=12308786, wait_proc=wait_proc@entry=0x0,
just_wait_proc=0) at process.c:4702
#51 0x00000000004221f3 in sit_for (timeout=<optimized out>, 
reading=reading@entry=true, 
    display_option=display_option@entry=1) at dispnew.c:5867
#52 0x00000000004f4df4 in read_char (commandflag=1, map=map@entry=35325
094, prev_event=12308786, 
    used_mouse_menu=used_mouse_menu@entry=0x7fffffffd7bb, 
end_time=end_time@entry=0x0)
    at keyboard.c:2810
#53 0x00000000004f5fcd in read_key_sequence (keybuf=keybuf@entry=0x7fff
ffffd890, prompt=12308786, 
    dont_downcase_last=dont_downcase_last@entry=false, 
    can_return_switch_frame=can_return_switch_frame@entry=true, 
    fix_current_buffer=fix_current_buffer@entry=true, 
    prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at
keyboard.c:9089
#54 0x00000000004f7d30 in command_loop_1 () at keyboard.c:1453
#55 0x000000000055b417 in internal_condition_case (bfun=bfun@entry=0x4f
7b30 <command_loop_1>, 
    handlers=<optimized out>, hfun=hfun@entry=0x4ee880 <cmd_error>) at
eval.c:1348
#56 0x00000000004e9d6e in command_loop_2 (ignore=ignore@entry=12308786)
at keyboard.c:1178
#57 0x000000000055b2fb in internal_catch (tag=12356258, 
    func=func@entry=0x4e9d50 <command_loop_2>, arg=12308786) at
eval.c:1112
#58 0x00000000004ee467 in command_loop () at keyboard.c:1157
#59 recursive_edit_1 () at keyboard.c:778
#60 0x00000000004ee7a8 in Frecursive_edit () at keyboard.c:849
#61 0x00000000004181a9 in main (argc=<optimized out>,
argv=0x7fffffffdbf8) at emacs.c:1642