Subject: bug#22 closed by Stefan Monnier <[email-masked]> (Re: 23.0.50; Emacs CVS segfaults on M-x delete-frame on Debian sarge under XFree86 Version 4.3.0.1)

From: [email-masked] (Emacs bug Tracking System)

This is an automatic notification regarding your bug report
which was filed against the emacs package:

#22: 23.0.50; Emacs CVS segfaults on M-x delete-frame on Debian sarge under XFree86 Version 4.3.0.1

It has been closed by Stefan Monnier <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Stefan Monnier <[email-masked]> by
replying to this email.

-- 
22: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=22
Emacs Bug Tracking System
Contact [email-masked] with problems
>From [email-masked] Sun Mar  2 13:49:57 2008
From: Stefan Monnier <[email-masked]>
To: [email-masked]
Subject: Re: 23.0.50;
	Emacs CVS segfaults on M-x delete-frame on Debian sarge under
	XFree86 Version 4.3.0.1
Date: Sun, 02 Mar 2008 16:49:39 -0500

It looks like this was addressed before I put it into the bugtracking
system: the problem is the old bug in Gtk.

        Stefan

>From [email-masked] Thu Feb 28 09:58:35 2008
Resent-Message-ID: <[email-masked]>
Resent-To: [email-masked]
Resent-From: Stefan Monnier <[email-masked]>
Resent-Date: Thu, 28 Feb 2008 12:58:08 -0500
From: [email-masked] (=?utf-8?B?w4Z2YXIgQXJuZmrDtnLDsA==?= Bjarmason)
To: [email-masked]
Date: Wed, 27 Feb 2008 15:35:30 +0000
Cc: [email-masked]
Subject: 23.0.50;
	Emacs CVS segfaults on M-x delete-frame on Debian sarge under
	XFree86 Version 4.3.0.1
Sender: emacs-devel-bounces+monnier=[email-masked]

The following produces a reproducable segfault on an emacs;

First I launch emacs under GDB and create an X frame:
=20=20=20=20
    gdb ./src/emacs
    run -Q -nw
    M-x make-frame-on-display RET :0.0 RET

Then, I try to delete the new X frame:

    M-x delete-frame
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1083362720 (LWP 1229)]
0x405ea727 in XFreeGC () from /usr/X11R6/lib/libX11.so.6
(gdb) bt full
#0  0x405ea727 in XFreeGC () from /usr/X11R6/lib/libX11.so.6
No symbol table info available.
#1  0x403458be in _gdk_gc_x11_get_type () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#2  0x40430749 in g_object_interface_list_properties () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#3  0x4032d638 in gdk_screen_get_type () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#4  0x40350047 in gdk_screen_set_default_colormap () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#5  0x40430871 in g_object_run_dispose () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#6  0x4032d6ad in _gdk_screen_close () from /usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#7  0x40337da4 in gdk_x11_display_ungrab () from
/usr/lib/libgdk-x11-2.0.so.0
No symbol table info available.
#8  0x40430871 in g_object_run_dispose () from
/usr/lib/libgobject-2.0.so.0
No symbol table info available.
#9  0x08162629 in xg_display_close (dpy=3D0x8c423d0) at gtkutil.c:176
        gdpy =3D (GdkDisplay *) 0x8436a88
#10 0x0813e272 in x_delete_terminal (terminal=3D0x8c7f558) at
xterm.c:11855
        dpyinfo =3D (struct x_display_info *) 0x8c5e878
        i =3D 3
#11 0x0811ec22 in Fdelete_terminal (terminal=3D147322204, force=3D138295545)
at terminal.c:324
        t =3D (struct terminal *) 0x8c7f558
#12 0x08094453 in Fdelete_frame (frame=3D139235804, force=3D138295497) at
frame.c:1545
        tmp =3D 147322204
        terminal =3D (struct terminal *) 0x8c7f558
        f =3D (struct frame *) 0x84c91d8
        sf =3D (struct frame *) 0x8403868
        kb =3D (struct kboard *) 0x0
        minibuffer_selected =3D 0
#13 0x081f14c4 in Ffuncall (nargs=3D1, args=3D0xbfffe750) at eval.c:3028
        fun =3D 136761988
        original_fun =3D 138330705
        funcar =3D 138295545
        numargs =3D 0
        lisp_numargs =3D 135713370
        val =3D -1073748216
        backtrace =3D {next =3D 0xbfffe920, function =3D 0xbfffe750, args =
=3D
        0xbfffe754, nargs =3D 0, evalargs =3D 0 '\0',=20
  debug_on_exit =3D 0 '\0'}
        internal_args =3D (Lisp_Object *) 0xbfffe6a0
        i =3D 2
#14 0x081ecfbf in Fcall_interactively (function=3D138330705,
record_flag=3D138295545, keys=3D138333916) at callint.c:842
        val =3D 138295497
        args =3D (Lisp_Object *) 0xbfffe750
        visargs =3D (Lisp_Object *) 0xbfffe740
        specs =3D 136785395
        filter_specs =3D 136785395
        teml =3D 138295497
        up_event =3D 138295497
        enable =3D 138295497
        speccount =3D 5
        next_event =3D 14
        prefix_arg =3D 138295497
        string =3D (unsigned char *) 0xbfffe760 ""
        tem =3D (unsigned char *) 0xbfffe760 ""
        varies =3D (int *) 0xbfffe730
        i =3D 1
        j =3D 0
        count =3D 0
        foo =3D 140868632
        prompt1 =3D
        "\200\001\000\000Q=EF=BF=BD>\bQ=EF=BF=BD>\b\r=EF=BF=BD=EF=BF=BD\bU=
=EF=BF=BDB\bI\214C\b=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD\206\a\030\bI\214C\=
b@o\200@\001\000\000\000\000y\200@x=EF=BF=BD=EF=BF=BD=EF=BF=BD\230\216t@\00=
0y\200@U=EF=BF=BDB\b=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=
=EF=BF=BD=EF=BF=BD=EF=BF=BD8>\b\025=EF=BF=BD=EF=BF=BD\b=EF=BF=BD=EF=BF=BD=
=EF=BF=BD=EF=BF=BD\000=EF=BF=BD=EF=BF=BD\005\230=EF=BF=BD=EF=BF=BD=EF=BF=BD=
K;\035\b\f\000\000"
        tem1 =3D 0x0
        arg_from_tty =3D 0
        gcpro1 =3D {next =3D 0x40746be5, var =3D 0x1c, nvars =3D 136125298}
        gcpro2 =3D {next =3D 0x83ec251, var =3D 0x0, nvars =3D 0}
        gcpro3 =3D {next =3D 0x83e38c9, var =3D 0x83e38c9, nvars =3D 1}
        gcpro4 =3D {next =3D 0x81d1b72, var =3D 0xbfffe7ec, nvars =3D 1}
        gcpro5 =3D {next =3D 0x83e1d6d, var =3D 0x0, nvars =3D 0}
        key_count =3D 14
        record_then_fail =3D 0
        save_this_command =3D 138330705
        save_last_command =3D 138328441
        save_this_original_command =3D 138487713
        save_real_this_command =3D 138330705
#15 0x081f14f3 in Ffuncall (nargs=3D4, args=3D0xbfffe9b0) at eval.c:3031
        fun =3D 137986028
        original_fun =3D 138458361
        funcar =3D 141286316
        numargs =3D 3
        lisp_numargs =3D 135812751
        val =3D -1073747448
        backtrace =3D {next =3D 0xbfffeb30, function =3D 0xbfffe9b0, args =
=3D
        0xbfffe9b4, nargs =3D 3, evalargs =3D 0 '\0',=20
  debug_on_exit =3D 0 '\0'}
        internal_args =3D (Lisp_Object *) 0xbfffe9b4
        i =3D 1
#16 0x081f1117 in call3 (fn=3D138458361, arg1=3D138330705, arg2=3D138295545,
arg3=3D138295497) at eval.c:2855
        ret_ungc_val =3D 138295497
        gcpro1 =3D {next =3D 0x83e0755, var =3D 0x83e38c9, nvars =3D 4}
#17 0x0817c839 in Fcommand_execute (cmd=3D138330705,
record_flag=3D138295545, keys=3D138295497, special=3D138295497)
    at keyboard.c:10443
        final =3D 136761988
        tem =3D 138295497
        prefixarg =3D 138295497
#18 0x0817cb79 in Fexecute_extended_command (prefixarg=3D138295497) at
keyboard.c:10556
        function =3D 138330705
        buf =3D "M-x
        \000\000\000\000\b\000\000\000\020F=EF=BF=BD\b\000\000\000\000\204^=
=EF=BF=BD\b=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD=EF=BF=BD4\035\b\000\234\215=
\b\001\000\000"
        saved_last_point_position =3D 1
        saved_keys =3D 140335180
        saved_last_point_position_buffer =3D 138321348
        bindings =3D 141286316
        value =3D 138295497
        gcpro1 =3D {next =3D 0x1, var =3D 0x84c91d8, nvars =3D 138426888}
        gcpro2 =3D {next =3D 0x83eaba9, var =3D 0x0, nvars =3D 1}
        gcpro3 =3D {next =3D 0x83e1d5d, var =3D 0x83eaba9, nvars =3D
        -1073747256}
        hstarted =3D 1
#19 0x081f149f in Ffuncall (nargs=3D2, args=3D0xbfffebc0) at eval.c:3025
        fun =3D 136779020
        original_fun =3D 138334793
        funcar =3D 138295497
        numargs =3D 1
        lisp_numargs =3D 135713370
        val =3D -1073747080
        backtrace =3D {next =3D 0xbfffed90, function =3D 0xbfffebc0, args =
=3D
        0xbfffebc4, nargs =3D 1, evalargs =3D 0 '\0',=20
  debug_on_exit =3D 0 '\0'}
        internal_args =3D (Lisp_Object *) 0xbfffebc4
        i =3D 138295497
#20 0x081ecfbf in Fcall_interactively (function=3D138334793,
record_flag=3D138295497, keys=3D138333916) at callint.c:842
        val =3D 0
        args =3D (Lisp_Object *) 0xbfffebc0
        visargs =3D (Lisp_Object *) 0xbfffebb0
        specs =3D 143498243
        filter_specs =3D 143498243
        teml =3D 0
        up_event =3D 138295497
        enable =3D 138295497
        speccount =3D 3
        next_event =3D 1
        prefix_arg =3D 138295497
        string =3D (unsigned char *) 0xbfffebd0 "P"
        tem =3D (unsigned char *) 0x82670ac ""
        varies =3D (int *) 0xbfffeba0
        i =3D 2
        j =3D 1
        count =3D 1
        foo =3D 0
        prompt1 =3D '\0' <repeats 99 times>
        tem1 =3D 0x0
        arg_from_tty =3D 0
        gcpro1 =3D {next =3D 0x0, var =3D 0x0, nvars =3D 0}
        gcpro2 =3D {next =3D 0x0, var =3D 0x0, nvars =3D 0}
        gcpro3 =3D {next =3D 0x0, var =3D 0x0, nvars =3D 2}
        gcpro4 =3D {next =3D 0x0, var =3D 0x0, nvars =3D 2}
        gcpro5 =3D {next =3D 0x0, var =3D 0x0, nvars =3D 0}
        key_count =3D 1
        record_then_fail =3D 0
        save_this_command =3D 138334793
        save_last_command =3D 138497537
        save_this_original_command =3D 138334793
        save_real_this_command =3D 138334793
#21 0x081f14f3 in Ffuncall (nargs=3D4, args=3D0xbfffee20) at eval.c:3031
        fun =3D 137986028
        original_fun =3D 138458361
        funcar =3D 138295497
        numargs =3D 3
        lisp_numargs =3D 2
        val =3D -1073747032
        backtrace =3D {next =3D 0x0, function =3D 0xbfffee20, args =3D
        0xbfffee24, nargs =3D 3, evalargs =3D 0 '\0',=20
  debug_on_exit =3D 0 '\0'}
        internal_args =3D (Lisp_Object *) 0xbfffee24
        i =3D 0
#22 0x081f1117 in call3 (fn=3D138458361, arg1=3D138334793, arg2=3D138295497,
arg3=3D138295497) at eval.c:2855
        ret_ungc_val =3D 138295497
        gcpro1 =3D {next =3D 0x83e38c9, var =3D 0x83e38c9, nvars =3D 4}
#23 0x0817c839 in Fcommand_execute (cmd=3D138334793,
record_flag=3D138295497, keys=3D138295497, special=3D138295497)
    at keyboard.c:10443
        final =3D 136779020
        tem =3D 138295497
        prefixarg =3D 138295497
#24 0x0816eeea in command_loop_1 () at keyboard.c:1908
        scount =3D 2
        cmd =3D 138334793
        lose =3D -1073746008
        nonundocount =3D 0
        keybuf =3D {1073742784, 960, -1073746120, 1081301168, 147286128,
        1085183913, 0, 1085200928, -1073746068, 1,=20
  -1073746100, 1085181697, -1073746040, 11459104, 1080932728,
  -1073746016, 0, -1073746044, -1073746356, 0, 0, 0, 0, 0, 0,=20
  0, 0, 0, 138295497, 143469681}
        i =3D 1
        prev_modiff =3D 1
        prev_buffer =3D (struct buffer *) 0x83e9dc0
        already_adjusted =3D 0
#25 0x081ef0f3 in internal_condition_case (bfun=3D0x816d8b2
<command_loop_1>, handlers=3D138339729, hfun=3D0x816d2af <cmd_error>)
    at eval.c:1494
        val =3D 138605317
        c =3D {tag =3D 138295497, val =3D 138295497, next =3D 0xbffff120, g=
cpro
        =3D 0x0, jmp =3D {{__jmpbuf =3D {-1073744960,=20
        -1073744960, -1073745164, -1073745688, -1073746000, 136245384},
        __mask_was_saved =3D 0, __saved_mask =3D {__val =3D {
          136131703, 0, 0, 0, 1082158912, 147286128, 147286128,
          3221221116, 1081359036, 147286128, 3221221144, 1082158912,=20
          147286128, 3221221144, 1081372021, 147286128, 1081301168,
          1082158912, 0, 147286128, 3221221176, 1081301168,=20
          147286128, 1085183913, 0, 1085200928, 3221221228, 1,
          3221221856, 138217632, 3221221844, 3221221704}}}},=20
  backlist =3D 0x0, handlerlist =3D 0x0, lisp_eval_depth =3D 0, pdlcount =
=3D 2,
  poll_suppress_count =3D 1,=20
  interrupt_input_blocked =3D 0, byte_stack =3D 0x0}
        h =3D {handler =3D 138339729, var =3D 138295497, chosen_clause =3D =
0,
        tag =3D 0xbfffeff0, next =3D 0x0}
#26 0x0816d61a in command_loop_2 () at keyboard.c:1370
        val =3D 0
#27 0x081eeb8f in internal_catch (tag=3D138334577, func=3D0x816d5f6
<command_loop_2>, arg=3D138295497) at eval.c:1230
        c =3D {tag =3D 138334577, val =3D 138295497, next =3D 0x0, gcpro =
=3D 0x0,
        jmp =3D {{__jmpbuf =3D {-1073744960, -1073744960,=20
        -1073745164, -1073745400, -1073745648, 136244096},
        __mask_was_saved =3D 0, __saved_mask =3D {__val =3D {135784103,=20
          3221221856, 0, 0, 0, 0, 1, 3221221912, 135116808, 138427232,
          0, 0, 0, 0, 0, 0, 0, 0, 1081374788, 0, 2, 147404648,=20
          0, 0, 0, 0, 1081374788, 3221221880, 136159901, 138525137,
          138521730, 138295497}}}}, backlist =3D 0x0,=20
  handlerlist =3D 0x0, lisp_eval_depth =3D 0, pdlcount =3D 2,
  poll_suppress_count =3D 1, interrupt_input_blocked =3D 0,=20
  byte_stack =3D 0x0}
#28 0x0816d5cf in command_loop () at keyboard.c:1349
No locals.
#29 0x0816cec9 in recursive_edit_1 () at keyboard.c:958
        count =3D 1
        val =3D -1073744960
#30 0x0816d02d in Frecursive_edit () at keyboard.c:1020
        count =3D 0
        buffer =3D 138295497
#31 0x0816b94e in main (argc=3D3, argv=3D0xbffff624) at emacs.c:1787
        dummy =3D 136655259
        stack_bottom_variable =3D -65 '=EF=BF=BD'
        do_initial_setlocale =3D 1
        skip_args =3D 1
        rlim =3D {rlim_cur =3D 8388608, rlim_max =3D 18446744073709551615}
        no_loadup =3D 0
        junk =3D 0x0

(gdb) frame 9
#9  0x08162629 in xg_display_close (dpy=3D0x8c423d0) at gtkutil.c:176
176       g_object_run_dispose (G_OBJECT (gdpy));
(gdb) p gdpy
$1 =3D (GdkDisplay *) 0x8436a88
(gdb) p *gdpy
$2 =3D {parent_instance =3D {g_type_instance =3D {g_class =3D 0x8704f10}, r=
ef_count =3D 2, qdata =3D 0x0}, queued_events =3D 0x8552844,   queued_tail =
=3D 0x8552844, button_click_time =3D {0, 0}, button_window =3D {0x0, 0x0}, =
button_number =3D {-1, -1}, double_click_time =3D 250, core_pointer =3D 0x8=
992ec8, pointer_hooks =3D 0x403800ac, closed =3D 0, double_click_distance =
=3D 5, button_x =3D {0, 0}, button_y =3D {0, 0}}

This is manually pasted from the M-x report-emacs-bug form on the emacs
that crashed:

In GNU Emacs 23.0.60.1 (i686-pc-linux-gnu, GTK+ Version 2.6.4)
 of 2008-02-27 on tharsis
configured using `configure  'CFLAGS=3D-ggdb3 -fno-crossjumping''

Important settings:
  value of $LC_ALL: en_US.UTF-8
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  global-auto-composition-mode: t
  auto-composition-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
ESC x r e p TAB o TAB r TAB RET

Recent messages:
("/var/src/emacs/src/emacs" "-Q")
For information about GNU Emacs and the GNU system, type C-h C-a.
Making completion list... [2 times]