Subject: bug#47244: 28.0.50; SIGSEGV in long-runnning Emacs

From: Michael Welsh Duggan <[email-masked]>
Date: Thu, 01 Apr 2021 09:54:03 -0400

martin rudalics <[email-masked]> writes:

>  > b->window_count is 1.
>
> What else should I have expected?  I attach yet another diff.  When the
> same assertion triggers we'll at least know which buffer got killed.
>
> martin
>

Okay.  I got a nice trigger from this.  I've added some extra
debugging info after the backtrace.

#0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647)
    at ../../master/src/emacs.c:379
#1  0x00005555557c48ef in die
    (msg=0x55555590f830 "count == replace_buffer_in_windows_safely_count", file=0x55555590e9cf "../../master/src/window.c", line=3450)
    at ../../master/src/alloc.c:7420
#2  0x000055555564d93a in replace_buffer_in_windows_safely
    (buffer=XIL(0x5555578531b5)) at ../../master/src/window.c:3450
        count = 1
#3  0x0000555555758e1a in Fkill_buffer (buffer_or_name=XIL(0x5555578531b5))
    at ../../master/src/buffer.c:1880
        buffer = XIL(0x5555578531b5)
        b = 0x5555578531b0
        tem = XIL(0)
        m = 0x7fffffffcbc0
#4  0x00005555557fd918 in funcall_subr
    (subr=0x555555dd8ce0 <Skill_buffer>, numargs=1, args=0x7fffffffcce8)
    at ../../master/src/eval.c:2987
        internal_argbuf = 
          {XIL(0x7fffffffcc20), XIL(0x1000000000), XIL(0x555555dd8ce0), XIL(0x7fffffffcc28), XIL(0x5555557f455b), make_fixnum(17538469896), XIL(0x555555dd8ce5), XIL(0x7fffffffcc40)}
        internal_args = 0x7fffffffcce8
#5  0x00005555557fd3e0 in Ffuncall (nargs=2, args=0x7fffffffcce0)
    at ../../master/src/eval.c:2914
        fun = XIL(0x555555dd8ce5)
        original_fun = XIL(0x2aaa9c7157c0)
        funcar = XIL(0x5ffffcca0)
        numargs = 1
        val = XIL(0x7fffffffccc0)
        count = 10
#6  0x0000555555856aa3 in exec_byte_code
    (bytestr=XIL(0x5555576cf5b4), vector=XIL(0x5555576e7d15), maxdepth=make_fixnum(5), args_template=make_fixnum(0), nargs=0, args=0x7fffffffd390)
    at ../../master/src/bytecode.c:632
        op = 1
        type = (CATCHER_ALL | unknown: 0x557d70b4)
        targets = 
        const_length = 9
        bytestr_length = 40
        vectorp = 0x5555576e7d18
        quitcounter = 1 '\001'
        stack_items = 6
        sa_avail = 16296
        sa_count = 10
        alloc = 0x7fffffffccd0
        stack_base = 0x7fffffffccd0
        top = 0x7fffffffcce0
        stack_lim = 0x7fffffffcd00
        bytestr_data = 0x7fffffffcd00 "\300\301!\210p\211\211\205\026"
        pc = 0x7fffffffcd1e "\210\305 \210\210\306\307\310\"\207\242^\205UUU"
        count = 10
        result = XIL(0xe0d0)
#7  0x00005555557fdbcb in fetch_and_exec_byte_code (fun=XIL(0x5555576e7d65), syms_left=make_fixnum(0), nargs=0, args=0x7fffffffd390) at ../../master/src/eval.c:3036
#8  0x00005555557fe051 in funcall_lambda (fun=XIL(0x5555576e7d65), nargs=0, arg_vector=0x7fffffffd390) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffd140)
        syms_left = make_fixnum(0)
        next = XIL(0x555555e62080)
        lexenv = XIL(0x1800000000)
        count = 10
        i = 93824994985307
        optional = false
        rest = false
#9  0x00005555557fd424 in Ffuncall (nargs=1, args=0x7fffffffd388) at ../../master/src/eval.c:2916
        fun = XIL(0x5555576e7d65)
        original_fun = XIL(0x18856b0)
        funcar = XIL(0xffffd1e0)
        numargs = 0
        val = XIL(0)
        count = 9
#10 0x00005555557f1518 in Ffuncall_interactively (nargs=1, args=0x7fffffffd388) at ../../master/src/callint.c:260
        speccount = 8
#11 0x00005555557fd809 in funcall_subr (subr=0x555555ddeca0 <Sfuncall_interactively>, numargs=1, args=0x7fffffffd388) at ../../master/src/eval.c:2967
#12 0x00005555557fd3e0 in Ffuncall (nargs=2, args=0x7fffffffd380) at ../../master/src/eval.c:2914
        fun = XIL(0x555555ddeca5)
        original_fun = XIL(0x70b0)
        funcar = XIL(0x7fffffffd2b0)
        numargs = 1
        val = XIL(0)
        count = 7
#13 0x00005555557fc0c9 in Fapply (nargs=3, args=0x7fffffffd380) at ../../master/src/eval.c:2497
        i = 2582717749968
        funcall_nargs = 25712400
        funcall_args = 0x0
        spread_arg = XIL(0)
        fun = XIL(0x70b0)
        sa_avail = 16384
        sa_count = 7
        numargs = 0
        retval = XIL(0x5555557f0258)
#14 0x00005555557f198d in Fcall_interactively (function=XIL(0x18856b0), record_flag=XIL(0), keys=XIL(0x5555582113c5)) at ../../master/src/callint.c:353
        funval = XIL(0x5555576e7d65)
        events = 1433
        input = XIL(0)
        speccount = 6
        arg_from_tty = false
        key_count = 1
        record_then_fail = false
        save_this_command = XIL(0x18856b0)
        save_this_original_command = XIL(0x18856b0)
        save_real_this_command = XIL(0x18856b0)
        save_last_command = XIL(0x1885710)
        prefix_arg = XIL(0)
        enable = XIL(0)
        up_event = XIL(0)
        form = XIL(0x555558b00b03)
        specs = XIL(0)
        sa_avail = 93825001726080
        sa_count = 93824995577276
        string_len = 93824993913254
        string = 0x5555576e7d65 ""
        string_end = 0x7fffffffd4e0 ""
        next_event = 93824994845356
        nargs = 0
        args = 0x0
        visargs = 0x0
        varies = 0x555555e62080 <lispsym> "\230\001"
        tem = 0x7fffffffd570 "e}nWUU"
        val = XIL(0)
#15 0x00005555557fd972 in funcall_subr (subr=0x555555ddece0 <Scall_interactively>, numargs=3, args=0x7fffffffd720) at ../../master/src/eval.c:2992
        internal_argbuf = {XIL(0x7fffffffd630), XIL(0x1000000000), XIL(0x555555ddece0), XIL(0x7fffffffd638), XIL(0x5555557f455b), make_fixnum(17538469896), XIL(0x555555ddece5), XIL(0x7fffffffd650)}
        internal_args = 0x7fffffffd720
#16 0x00005555557fd3e0 in Ffuncall (nargs=4, args=0x7fffffffd718) at ../../master/src/eval.c:2914
        fun = XIL(0x555555ddece5)
        original_fun = XIL(0x2aaa9c71a1d0)
        funcar = XIL(0x7fffffffd6b0)
        numargs = 3
        val = XIL(0x7fffffffd6d0)
        count = 5
#17 0x0000555555856aa3 in exec_byte_code (bytestr=XIL(0x7ffff26110fc), vector=XIL(0x7ffff2610d65), maxdepth=make_fixnum(13), args_template=make_fixnum(1025), nargs=1, args=0x7fffffffdc90) at ../../master/src/bytecode.c:632
        op = 3
        type = CATCHER
        const_length = 24
        bytestr_length = 138
        vectorp = 0x7ffff2610d68
        quitcounter = 1 '\001'
        stack_items = 14
        sa_avail = 16134
        sa_count = 5
        alloc = 0x7fffffffd6e0
        stack_base = 0x7fffffffd6e0
        top = 0x7fffffffd718
        stack_lim = 0x7fffffffd750
        bytestr_data = 0x7fffffffd750 "\304\020\211?\205\023"
        pc = 0x7fffffffd7b2 "\006\006\071\203\211"
        count = 5
        result = XIL(0)
#18 0x00005555557fdbcb in fetch_and_exec_byte_code (fun=XIL(0x7ffff2610d35), syms_left=make_fixnum(1025), nargs=1, args=0x7fffffffdc88) at ../../master/src/eval.c:3036
#19 0x00005555557fe051 in funcall_lambda (fun=XIL(0x7ffff2610d35), nargs=1, arg_vector=0x7fffffffdc88) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffdc00)
        syms_left = make_fixnum(1025)
        next = XIL(0x555555e62080)
        lexenv = XIL(0x1800000000)
        count = 5
        i = 93824994985307
        optional = false
        rest = false
#20 0x00005555557fd424 in Ffuncall (nargs=2, args=0x7fffffffdc80) at ../../master/src/eval.c:2916
        fun = XIL(0x7ffff2610d35)
        original_fun = XIL(0x4470)
        funcar = XIL(0)
        numargs = 1
        val = XIL(0x7fffffffdca8)
        count = 4
#21 0x00005555557fcbee in call1 (fn=XIL(0x4470), arg1=XIL(0x18856b0)) at ../../master/src/eval.c:2774
#22 0x0000555555721564 in command_loop_1 () at ../../master/src/keyboard.c:1466
        scount = 3
        cmd = XIL(0x18856b0)
        i = 1
        prev_modiff = 60
        prev_buffer = 0x5555578531b0
        already_adjusted = false
#23 0x00005555557f919c in internal_condition_case (bfun=0x555555720d0e <command_loop_1>, handlers=XIL(0x90), hfun=0x555555720331 <cmd_error>) at ../../master/src/eval.c:1439
        val = XIL(0x5555560c2983)
        c = 0x555555f5d3e0
#24 0x00005555557208fe in command_loop_2 (ignore=XIL(0)) at ../../master/src/keyboard.c:1094
        val = make_fixnum(0)
#25 0x00005555557f85ac in internal_catch (tag=XIL(0xd9e0), func=0x5555557208d1 <command_loop_2>, arg=XIL(0)) at ../../master/src/eval.c:1189
        val = XIL(0xd9e0)
        c = 0x555555f46710
#26 0x000055555572089d in command_loop () at ../../master/src/keyboard.c:1073
#27 0x000055555571fe1a in recursive_edit_1 () at ../../master/src/keyboard.c:720
        count = 1
        val = XIL(0x7fffffffdf50)
#28 0x0000555555720011 in Frecursive_edit () at ../../master/src/keyboard.c:789
        count = 0
        buffer = XIL(0)
#29 0x000055555571bef6 in main (argc=2, argv=0x7fffffffe1b8) at ../../master/src/emacs.c:2050
        stack_bottom_variable = 0x7ffff617e053
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 1
        temacs = 0x0
        attempt_load_pdump = true
        rlim = {
          rlim_cur = 10022912,
          rlim_max = 18446744073709551615
        }
        lc_all = 0x0
        sockfd = -1
        module_assertions = false

Lisp Backtrace:
"kill-buffer" (0xffffcce8)
"gnus-server-exit" (0xffffd390)
"funcall-interactively" (0xffffd388)
"call-interactively" (0xffffd720)
"command-execute" (0xffffdc88)

(gdb) p replace_buffer_in_windows_safely_count 
$1 = 0
(gdb) frame 2
#2  0x000055555564d93a in replace_buffer_in_windows_safely (
    buffer=XIL(0x5555578531b5)) at ../../master/src/window.c:3450
3450      eassert (count == replace_buffer_in_windows_safely_count);
(gdb) p buffer
$2 = XIL(0x5555578531b5)
(gdb) xtype
Lisp_Vectorlike
PVEC_BUFFER
(gdb) xbuffer
$3 = (struct buffer *) 0x5555578531b0
0x5555587d0e90 "*Server*"

-- 
Michael Welsh Duggan
([email-masked])