GNU bug report logs - #20802
Segfault when showing non-GTK+ tooltip

Previous Next

Full log

Message #71 received at 20802 <at> debbugs.gnu.org (full text, mbox):

From: martin rudalics <rudalics <at> gmx.at>
To: Tobias Getzner <tobias.getzner <at> gmx.de>, Eli Zaretskii <eliz <at> gnu.org>
Cc: 20802 <at> debbugs.gnu.org
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
Date: Tue, 16 Jun 2015 19:31:21 +0200

> Breakpoint 1, x_free_frame_resources (f=0x124fd70) at xterm.c:10970
> 10970	{
> (gdb) bt
> #0  x_free_frame_resources (f=0x124fd70) at xterm.c:10970
> #1  0x00000000004c9715 in unwind_create_frame (frame=19201397) at xfns.c:2842
> #2  0x00000000004c9759 in unwind_create_tip_frame (frame=<optimized out>) at xfns.c:4997
> #3  0x0000000000557b2e in unbind_to (count=<optimized out>, value=value <at> entry=0) at eval.c:3211
> #4  0x0000000000557cf9 in unwind_to_catch (catch=catch <at> entry=0x140a040, value=value <at> entry=19849283)
>      at eval.c:1157
> #5  0x00000000005592ed in Fsignal (error_symbol=error_symbol <at> entry=18624, data=<optimized out>)
>      at eval.c:1557
> #6  0x00000000005595f9 in xsignal (error_symbol=error_symbol <at> entry=18624, data=<optimized out>)
>      at eval.c:1581
> #7  0x0000000000559c6d in signal_error (s=s <at> entry=0x5e3d1d "Undefined color", arg=19849315,
>      arg <at> entry=34016084) at eval.c:1636
> #8  0x00000000004ccc57 in x_decode_color (f=<optimized out>, color_name=34016084,
>      mono_color=<optimized out>) at xfns.c:495
> #9  0x00000000004ce96c in x_set_foreground_color (f=0x124fd70, arg=34016084, oldval=<optimized out>)
>      at xfns.c:602
> #10 0x0000000000426ff6 in x_set_frame_parameters (f=f <at> entry=0x124fd70, alist=alist <at> entry=140737488338931)
>      at frame.c:3152
> #11 0x0000000000429ac7 in x_default_parameter (f=f <at> entry=0x124fd70, alist=alist <at> entry=19856675,
>      prop=prop <at> entry=22320, deflt=34090788, xprop=xprop <at> entry=0x5db8ca "foreground",
>      xclass=xclass <at> entry=0x5e3f61 "Foreground", type=RES_TYPE_STRING) at frame.c:4374
> #12 0x00000000004cd200 in x_create_tip_frame (dpyinfo=0x173c900, parms=19856675, parms <at> entry=19857043,
>      text=text <at> entry=34092084) at xfns.c:5181
> #13 0x00000000004cd94d in Fx_show_tip (string=34092084, frame=18429029, parms=19857043, timeout=42, dx=22,
>      dy=82) at xfns.c:5540

Why am I not surprised?  xfns.c sets image_cache_refcount on line 5192,
that is, after it processes the foreground parameter on line 5181 so
probably line 5192 is not executed.  I initially tried to set it right
after the record_unwind_protect on line 5061 but that got me a(nother?)
segfault as well.  Funnily I coudn't get a crash after my patch.

Can you try whether my conjecture is true by putting a breakpoint on
line 5192 and check whether the refcount gets set there for the tooltip
frame?  If it isn't, then could you experimentally try to move the

  image_cache_refcount =
    FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
#ifdef GLYPH_DEBUG
  dpyinfo_refcount = dpyinfo->reference_count;
#endif /* GLYPH_DEBUG */

block from line 5192 somewhere up in the code, first before line 5172,
later maybe a bit further up and check whether it helps?

Thanks, martin

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.