Subject: bug#30182: 27.0.50; Crash when doing mouse-over on modeline

From: Sujith <[email-masked]>
Date: Sat, 20 Jan 2018 11:56:29 +0530

On master branch, emacs crashes when moving the mouse pointer
across the modeline.

* emacs -Q
* M-x w3m
* Move the mouse cursor across the modeline.
* Emacs crashes.

Backtrace:
----------

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
concat (nargs=nargs@entry=1, args=args@entry=0x7fffffffd8e8, target_type=<optimized out>, last_special=last_special@entry=false) at fns.c:751
751                     XSETCAR (tail, elt);
(gdb)
(gdb) bt full
#0  0x000000000056c25c in concat (nargs=nargs@entry=1, args=args@entry=0x7fffffffd8e8, target_type=<optimized out>, last_special=last_special@entry=false)
    at fns.c:751
        elt = 0x146ae45 <bss_sbrk_buffer+8834693>
        thislen = <optimized out>
        thisleni = <optimized out>
        thisindex = <optimized out>
        thisindex_byte = 0
        val = <optimized out>
        tail = 0x0
        this = <optimized out>
        toindex = -1
        toindex_byte = 0
        result_len = <optimized out>
        result_len_byte = <optimized out>
        argnum = 0
        last_tail = 0x0
        prev = 0x39fdf13
        some_multibyte = <optimized out>
        textprops = <optimized out>
        num_textprops = 0
        sa_avail = <optimized out>
        sa_must_free = <optimized out>
#1  0x000000000056c9cc in Fcopy_sequence (arg=<optimized out>) at fns.c:514
#2  0x00000000004f2bff in timer_check () at keyboard.c:4381
        nexttime = <optimized out>
        timers = <optimized out>
        idle_timers = <optimized out>
        tem = 0x0
#3  0x00000000004f3179 in readable_events (flags=flags@entry=1) at keyboard.c:3349
#4  0x00000000004f3bb8 in get_input_pending (flags=flags@entry=1) at keyboard.c:6805
#5  0x00000000004f6388 in detect_input_pending_run_timers (do_display=do_display@entry=true) at keyboard.c:9943
        old_timers_run = <optimized out>
#6  0x00000000005a470e in wait_reading_process_output (time_limit=time_limit@entry=30, nsecs=nsecs@entry=0, read_kbd=read_kbd@entry=-1, do_display=do_display@entry=true, wait_for_cell=wait_for_cell@entry=0x0, wait_proc=wait_proc@entry=0x0, just_wait_proc=0) at process.c:5514
        old_timers_run = 42
        old_buffer = 0x399c7d0
        old_window = 0x13e9c35 <bss_sbrk_buffer+8305781>
        leave = false
        process_skipped = <optimized out>
        channel = <optimized out>
        nfds = 1
        Available = {fds_bits = {32, 0 <repeats 15 times>}}
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = <optimized out>
        check_delay = <optimized out>
        no_avail = false
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 0, tv_nsec = 0}
        end_time = <optimized out>
        timer_delay = <optimized out>
        got_output_end_time = {tv_sec = 1516429254, tv_nsec = 917181698}
        wait = TIMEOUT
        got_some_output = -1
        retry_for_async = <optimized out>
        now = {tv_sec = 0, tv_nsec = -1}
#7  0x0000000000420219 in sit_for (timeout=<optimized out>, reading=reading@entry=true, display_option=display_option@entry=1) at dispnew.c:5799
        sec = 30
        nsec = 0
        do_display = true
#8  0x00000000004f940d in read_char (commandflag=commandflag@entry=1, map=map@entry=0x39621d3, prev_event=0x0, used_mouse_menu=used_mouse_menu@entry=0x7fffffffe50b, end_time=end_time@entry=0x0) at keyboard.c:2723
        tem0 = <optimized out>
        timeout = <optimized out>
        delay_level = <optimized out>
        buffer_size = <optimized out>
        c = <optimized out>
        jmpcount = 3
        local_getcjmp =
                {{__jmpbuf = {12419232, 2843205084361714529, 20880437, 59917508, 0, 60533139, -2843205083308037279, 2843204488341678945}, __mask_was_saved = 0, __saved_mask = {__val = {140737488348000, 60409808, 60409813, 950, 5608020, 0, 4, 0, 60409808, 0, 140737488347616, 237, 31296, 0, 0, 0}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x2cb1870
#9  0x00000000004f98b8 in read_key_sequence (keybuf=keybuf@entry=0x7fffffffe600, prompt=prompt@entry=0x0, dont_downcase_last=dont_downcase_last@entry=false, can_return_switch_frame=can_return_switch_frame@entry=true, fix_current_buffer=fix_current_buffer@entry=true, prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at keyboard.c:9137
        interrupted_kboard = 0x2cb1870
        interrupted_frame = 0x13e8c30 <bss_sbrk_buffer+8301680>
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = <optimized out>
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 0x39621d3
        first_unbound = 31
        mock_input = 0
        fkey = {parent = 0x1066b23 <bss_sbrk_buffer+4623203>, map = 0x1066b23 <bss_sbrk_buffer+4623203>, start = 0, end = 0}
        keytran = {parent = 0xc6aa93 <bss_sbrk_buffer+445139>, map = 0xc6aa93 <bss_sbrk_buffer+445139>, start = 0, end = 0}
        indec = {parent = 0x1066b33 <bss_sbrk_buffer+4623219>, map = 0x1066b33 <bss_sbrk_buffer+4623219>, start = 0, end = 0}
        shift_translated = false
        delayed_switch_frame = 0x0
        original_uppercase = 0x0
        original_uppercase_position = -1
        dummyflag = false
        fake_prefixed_keys = 0x0
        first_event = 0x0
#10 0x00000000004fb47c in command_loop_1 () at keyboard.c:1370
        cmd = <optimized out>
        keybuf =
          {0x200001e2, 0x4ef901 <Fcommand_error_default_function+177>, 0x0, 0xbda740 <lispsym>, 0x3, 0x56290c <Ffuncall+604>, 0xcb4401 <bss_sbrk_buffer+746561>, 0x3694c33, 0x7fffffffe6d0, 0x0, 0x3694c33, 0xcb44c3 <bss_sbrk_buffer+746755>, 0xffffffffffffffff, 0x565e84 <call3+52>, 0x99520, 0x3694c33, 0x85a144 <pure+36>, 0x0, 0x0, 0xa8f7ec3c8fd0ea00, 0x7fffffffe6d0, 0x4f20a1 <cmd_error_internal+113>, 0x7fffffffe6d0, 0x0, 0x0, 0x4f21e7 <cmd_error+279>, 0xcb4400 <bss_sbrk_buffer+746560>, 0x562399 <unbind_to+137>, 0x5, 0x7590}
        i = <optimized out>
        prev_modiff = 15
        prev_buffer = 0xc6d400 <bss_sbrk_buffer+455744>
#11 0x0000000000561afe in internal_condition_case (bfun=bfun@entry=0x4fb280 <command_loop_1>, handlers=handlers@entry=0x4dd0, hfun=hfun@entry=0x4f20d0 <cmd_error>) at eval.c:1332
        val = <optimized out>
        c = 0x2c4b0b0
#12 0x00000000004ecc24 in command_loop_2 (ignore=ignore@entry=0x0) at keyboard.c:1111
        val = 0x3
#13 0x0000000000561a6d in internal_catch (tag=tag@entry=0xc2a0, func=func@entry=0x4ecc00 <command_loop_2>, arg=arg@entry=0x0) at eval.c:1097
        val = <optimized out>
        c = 0x2c45900
#14 0x00000000004ecbbb in command_loop () at keyboard.c:1090
#15 0x00000000004f1ce3 in recursive_edit_1 () at keyboard.c:696
        val = <optimized out>
#16 0x00000000004f2009 in Frecursive_edit () at keyboard.c:767
        buffer = <optimized out>
#17 0x000000000041633f in main (argc=<optimized out>, argv=0x7fffffffe998) at emacs.c:1724
        stack_bottom_variable = 0x7ffff0013ea2
        do_initial_setlocale = <optimized out>
        dumping = <optimized out>
        skip_args = 0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
        disable_aslr = <optimized out>
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        sockfd = -1

In GNU Emacs 27.0.50 (build 2, x86_64-pc-linux-gnu, GTK+ Version 3.22.26)
 of 2018-01-20 built on the-damned
Repository revision: 95ce4eb5d9e1c7644b598ee0aa9b2524d1bc868f
Windowing system distributor 'The X.Org Foundation', version 11.0.11906000
Recent messages:
Wrote /home/sujith/a.txt
Saving file /home/sujith/a.txt...
Wrote /home/sujith/a.txt
Saving file /home/sujith/a.txt...
Wrote /home/sujith/a.txt
Saving file /home/sujith/a.txt...
Wrote /home/sujith/a.txt
Mark set
scroll-down-command: Beginning of buffer [7 times]
Making completion list...

Configured using:
 'configure --prefix=/usr --without-gconf --without-gsettings
 --without-selinux --without-gnutls --without-libsystemd
 --without-threads --without-dbus
 PKG_CONFIG_PATH=/usr/lib/imagemagick6/pkgconfig/'

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM NOTIFY ACL LIBXML2
FREETYPE M17N_FLT LIBOTF XFT ZLIB TOOLKIT_SCROLL_BARS GTK3 X11 LCMS2

Important settings:
  value of $LANG: en_IN.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Text

Minor modes in effect:
  flyspell-mode: t
  global-magit-file-mode: t
  diff-auto-refine-mode: t
  magit-auto-revert-mode: t
  global-git-commit-mode: t
  async-bytecomp-package-mode: t
  shell-dirtrack-mode: t
  display-time-mode: t
  iswitchb-mode: t
  savehist-mode: t
  override-global-mode: t
  save-place-mode: t
  cl-old-struct-compat-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: 1
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow face-remap emacsbug term/tmux term/xterm xterm flyspell ispell
elec-pair mu4e-alert pcase ht s alert log4e rx notifications dbus xml
gntp magit-obsolete magit-blame magit-stash magit-bisect magit-remote
magit-commit magit-sequence magit-notes magit-worktree magit-branch
magit-collab ghub url-auth url url-proxy url-privacy url-expand
url-methods url-history url-cookie url-domsuf url-util mailcap let-alist
magit-files magit-refs magit-status magit magit-repos magit-apply
magit-wip magit-log magit-diff smerge-mode diff-mode magit-core
magit-autorevert autorevert filenotify magit-process magit-margin
magit-mode git-commit magit-git magit-section magit-utils crm
magit-popup log-edit pcvs-util add-log with-editor cl-extra help-mode
async-bytecomp advice async shell pcomplete dash mu4e-contrib mu4e
desktop frameset mu4e-speedbar speedbar sb-image ezimage dframe
mu4e-main mu4e-context mu4e-view cal-menu calendar cal-loaddefs
thingatpt browse-url comint ansi-color mu4e-headers mu4e-compose
mu4e-draft mu4e-actions ido rfc2368 smtpmail sendmail mu4e-mark
mu4e-message html2text mu4e-proc mu4e-utils doc-view jka-compr
image-mode mu4e-lists mu4e-vars message rmc puny format-spec rfc822 mml
mml-sec epa derived epg gnus-util rmail rmail-loaddefs mm-decode
mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045 mm-util
ietf-drums mail-prsvr mailabbrev mail-utils gmm-utils mailheader hl-line
cl mu4e-meta time dired-x dired dired-loaddefs edmacro kmacro xcscope
ring server iswitchb savehist bind-key easy-mmode saveplace finder-inf
info package easymenu epg-config url-handlers url-parse auth-source
cl-seq eieio eieio-core cl-macs eieio-loaddefs password-cache json map
url-vars seq byte-opt gv bytecomp byte-compile cconv cl-loaddefs cl-lib
time-date mule-util tooltip eldoc electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel term/x-win x-win term/common-win x-dnd tool-bar
dnd fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode elisp-mode lisp-mode prog-mode register page menu-bar
rfn-eshadow isearch timer select scroll-bar mouse jit-lock font-lock
syntax facemenu font-core term/tty-colors frame cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray minibuffer
cl-preloaded nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote inotify lcms2
dynamic-setting font-render-setting move-toolbar gtk x-toolkit x
multi-tty make-network-process emacs)

Memory information:
((conses 16 212648 40734)
 (symbols 48 31715 1)
 (miscs 40 622 2583)
 (strings 32 67813 4045)
 (string-bytes 1 1998341)
 (vectors 16 31729)
 (vector-slots 8 661669 18786)
 (floats 8 126 425)
 (intervals 56 307 0)
 (buffers 992 13))