Subject: bug#47244: 28.0.50; SIGSEGV in long-runnning Emacs

From: Michael Welsh Duggan <[email-masked]>
Date: Wed, 07 Apr 2021 13:37:13 -0400

martin rudalics <[email-masked]> writes:

>  > Don't know where to go from here, but I have a breakpoint set on
>  >
>  >        replace_buffer_in_windows_safely_count = 0;
>  >
>  > conditioned on count != 0.
>
> Good.  IIUC this
>
>  > (gdb) p list_length(Vwindow_list)
>  > $2 = 2
>
> and this
>
>  > (gdb) xlist
>  > $13 = 0x1a
>  > Lisp_Int0
>  > $14 = 6
>
> together indicate that Vwindow_list spontaneously shrinks from 6 to 2
> elements (which is "impossible" as we know already).  Attaching the next
> patch which should catch this situation automatically.  It will still be
> of no help because we won't catch the one that apparently clobbers that
> list but hopefully more useful than the previous diff.

Triggered.  Here's the backtrace:

#0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647)
    at ../../master/src/emacs.c:379
#1  0x00005555557c4aa2 in die
    (msg=0x5555559105c8 "window_list_length == list_length (Vwindow_list)", file=0x55555590f9cf "../../master/src/window.c", line=2585)
    at ../../master/src/alloc.c:7420
#2  0x000055555564b3ea in window_list () at ../../master/src/window.c:2585
#3  0x000055555564bfec in window_list_1
    (window=XIL(0x555556f6f995), minibuf=XIL(0xc0), all_frames=XIL(0x30))
    at ../../master/src/window.c:2872
        tail = XIL(0x7ffff26647bd)
        list = XIL(0)
        rest = XIL(0x7ffff26647c0)
#4  0x000055555564c332 in Fwindow_list_1
    (window=XIL(0), minibuf=XIL(0), all_frames=XIL(0x30))
    at ../../master/src/window.c:2946
#5  0x00005555557fdb25 in funcall_subr
    (subr=0x555555dd4960 <Swindow_list_1>, numargs=3, args=0x7fffffffbfa0)
    at ../../master/src/eval.c:2992
        internal_argbuf = 
          {XIL(0x7fffffffbed0), XIL(0x1000000000), XIL(0x555555dd4960), XIL(0x7fffffffbed8), make_fixnum(23456248746435), XIL(0x10557f41d5), XIL(0x555555dd4965), XIL(0x7fffffffbef0)}
        internal_args = 0x7fffffffbfa0
#6  0x00005555557fd593 in Ffuncall (nargs=4, args=0x7fffffffbf98)
    at ../../master/src/eval.c:2914
        fun = XIL(0x555555dd4965)
        original_fun = XIL(0x2aaa9c71a7a8)
        funcar = XIL(0x7fffffffbf50)
        numargs = 3
        val = XIL(0x55555792ff75)
        count = 12
#7  0x0000555555856c56 in exec_byte_code
    (bytestr=XIL(0x7ffff277c864), vector=XIL(0x7ffff277c80d), maxdepth=make_fixnum(8), args_template=make_fixnum(256), nargs=1, args=0x7fffffffc4b0)
    at ../../master/src/bytecode.c:632
        op = 3
        type = (CATCHER_ALL | unknown: 0x20)
        targets = 
        const_length = 10
        bytestr_length = 56
        vectorp = 0x7ffff277c810
        quitcounter = 1 '\001'
        stack_items = 9
        sa_avail = 16256
        sa_count = 12
        alloc = 0x7fffffffbf80
        stack_base = 0x7fffffffbf80
        top = 0x7fffffffbf98
        stack_lim = 0x7fffffffbfc8
        bytestr_data = 0x7fffffffbfc8 "\300\001!\301\302\211\303#\211\205\067"
        pc = 0x7fffffffbfd0 "\211\205\067"
        count = 12
        result = XIL(0xc557d245f)
#8  0x00005555557fdd7e in fetch_and_exec_byte_code (fun=XIL(0x7ffff277c7b5), syms_left=make_fixnum(256), nargs=1, args=0x7fffffffc4a8) at ../../master/src/eval.c:3036
#9  0x00005555557fe204 in funcall_lambda (fun=XIL(0x7ffff277c7b5), nargs=1, arg_vector=0x7fffffffc4a8) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffc420)
        syms_left = make_fixnum(256)
        next = XIL(0x555555e63080)
        lexenv = XIL(0x1800000000)
        count = 12
        i = 93824994985742
        optional = false
        rest = false
#10 0x00005555557fd5d7 in Ffuncall (nargs=2, args=0x7fffffffc4a0) at ../../master/src/eval.c:2916
        fun = XIL(0x7ffff277c7b5)
        original_fun = XIL(0xbd60)
        funcar = XIL(0x7fffffffc470)
        numargs = 1
        val = XIL(0x555555e63080)
        count = 11
#11 0x00005555557fcda1 in call1 (fn=XIL(0xbd60), arg1=XIL(0x55555792ff75)) at ../../master/src/eval.c:2774
#12 0x000055555564d83c in replace_buffer_in_windows (buffer=XIL(0x55555792ff75)) at ../../master/src/window.c:3430
#13 0x0000555555758d98 in Fkill_buffer (buffer_or_name=XIL(0x55555792ff75)) at ../../master/src/buffer.c:1830
        buffer = XIL(0x55555792ff75)
        b = 0x55555792ff70
        tem = make_fixnum(23456248581479)
        m = 0x7fffffffc5f0
#14 0x00005555557fdacb in funcall_subr (subr=0x555555dd9ce0 <Skill_buffer>, numargs=1, args=0x7fffffffc710) at ../../master/src/eval.c:2987
        internal_argbuf = {XIL(0x7fffffffc650), XIL(0x1000000000), XIL(0x555555dd9ce0), XIL(0x7fffffffc658), make_fixnum(23456248746435), XIL(0x10557f41d5), XIL(0x555555dd9ce5), XIL(0x7fffffffc670)}
        internal_args = 0x7fffffffc710
#15 0x00005555557fd593 in Ffuncall (nargs=2, args=0x7fffffffc708) at ../../master/src/eval.c:2914
        fun = XIL(0x555555dd9ce5)
        original_fun = XIL(0x2aaa9c7147c0)
        funcar = XIL(0x7fffffffc6d0)
        numargs = 1
        val = XIL(0x7fffffffc6f0)
        count = 10
#16 0x0000555555856c56 in exec_byte_code (bytestr=XIL(0x7ffff25c7454), vector=XIL(0x555558229a65), maxdepth=make_fixnum(2), args_template=make_fixnum(0), nargs=0, args=0x7fffffffcbc0) at ../../master/src/bytecode.c:632
        op = 1
        type = (CONDITION_CASE | unknown: 0x5588e68c)
        const_length = 3
        bytestr_length = 10
        vectorp = 0x555558229a68
        quitcounter = 1 '\001'
        stack_items = 3
        sa_avail = 16350
        sa_count = 10
        alloc = 0x7fffffffc700
        stack_base = 0x7fffffffc700
        top = 0x7fffffffc708
        stack_lim = 0x7fffffffc718
        bytestr_data = 0x7fffffffc718 "\301\300!\205\t"
        pc = 0x7fffffffc721 "\207\377\377\377\177"
        count = 10
        result = XIL(0x9)
#17 0x00005555557fdd7e in fetch_and_exec_byte_code (fun=XIL(0x555557821b4d), syms_left=make_fixnum(0), nargs=0, args=0x7fffffffcbc0) at ../../master/src/eval.c:3036
#18 0x00005555557fe204 in funcall_lambda (fun=XIL(0x555557821b4d), nargs=0, arg_vector=0x7fffffffcbc0) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffcb40)
        syms_left = make_fixnum(0)
        next = XIL(0x1)
        lexenv = XIL(0x1800000000)
        count = 10
        i = 93824994985742
        optional = false
        rest = false
#19 0x00005555557fd5d7 in Ffuncall (nargs=1, args=0x7fffffffcbb8) at ../../master/src/eval.c:2916
        fun = XIL(0x555557821b4d)
        original_fun = XIL(0x555557821b4d)
        funcar = XIL(0x7fffffffcb70)
        numargs = 0
        val = XIL(0x555555e63080)
        count = 9
#20 0x0000555555855f75 in bcall0 (f=XIL(0x555557821b4d)) at ../../master/src/bytecode.c:340
#21 0x00005555557ffa0b in do_one_unbind (this_binding=0x7fffffffcc30, unwinding=true, bindflag=SET_INTERNAL_UNBIND) at ../../master/src/eval.c:3575
#22 0x00005555557ffe37 in unbind_to (count=8, value=XIL(0)) at ../../master/src/eval.c:3713
        this_binding = {
          kind = SPECPDL_UNWIND,
          unwind = {
            kind = SPECPDL_UNWIND,
            func = 0x555555855f58 <bcall0>,
            arg = XIL(0x555557821b4d),
            eval_depth = 4
          },
          unwind_array = {
            kind = SPECPDL_UNWIND,
            nelts = 93824995385176,
            array = 0x555557821b4d
          },
          unwind_ptr = {
            kind = SPECPDL_UNWIND,
            func = 0x555555855f58 <bcall0>,
            arg = 0x555557821b4d
          },
          unwind_int = {
            kind = SPECPDL_UNWIND,
            func = 0x555555855f58 <bcall0>,
            arg = 1468144461
          },
          unwind_intmax = {
            kind = SPECPDL_UNWIND,
            func = 0x555555855f58 <bcall0>,
            arg = 93825028725581
          },
          unwind_excursion = {
            kind = SPECPDL_UNWIND,
            marker = XIL(0x555555855f58),
            window = XIL(0x555557821b4d)
          },
          unwind_void = {
            kind = SPECPDL_UNWIND,
            func = 0x555555855f58 <bcall0>
          },
          let = {
            kind = SPECPDL_UNWIND,
            symbol = XIL(0x555555855f58),
            old_value = XIL(0x555557821b4d),
            where = XIL(0x4),
            saved_value = XIL(0)
          },
          bt = {
            kind = SPECPDL_UNWIND,
            debug_on_exit = false,
            function = XIL(0x555555855f58),
            args = 0x555557821b4d,
            nargs = 4
          }
        }
        quitf = XIL(0)
#23 0x0000555555856d07 in exec_byte_code (bytestr=XIL(0x7ffff2908874), vector=XIL(0x7ffff2908525), maxdepth=make_fixnum(23), args_template=make_fixnum(257), nargs=1, args=0x7fffffffd3e0) at ../../master/src/bytecode.c:652
        op = 2
        type = (unknown: 0xffffd230)
        const_length = 51
        bytestr_length = 494
        vectorp = 0x7ffff2908528
        quitcounter = 59 ';'
        stack_items = 24
        sa_avail = 15698
        sa_count = 7
        alloc = 0x7fffffffcc80
        stack_base = 0x7fffffffcc80
        top = 0x7fffffffccb0
        stack_lim = 0x7fffffffcd40
        bytestr_data = 0x7fffffffcd40 "\211??\205\355\001\b\302p\001\031\303\304\302\"r\211q\210\305\306\002\"\216\004c\210eb\210`dW\203\345\001`ǉ\211\211g\310U\203\234\001\311\061:"
        pc = 0x7fffffffcf28 "\262\001)\266\203\207"
        count = 7
        result = XIL(0)
#24 0x00005555557fdd7e in fetch_and_exec_byte_code (fun=XIL(0x7ffff29084f5), syms_left=make_fixnum(257), nargs=1, args=0x7fffffffd3d8) at ../../master/src/eval.c:3036
#25 0x00005555557fe204 in funcall_lambda (fun=XIL(0x7ffff29084f5), nargs=1, arg_vector=0x7fffffffd3d8) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffd350)
        syms_left = make_fixnum(257)
        next = XIL(0x555555e63080)
        lexenv = XIL(0x1800000000)
        count = 7
        i = 93824994985742
        optional = false
        rest = false
#26 0x00005555557fd5d7 in Ffuncall (nargs=2, args=0x7fffffffd3d0) at ../../master/src/eval.c:2916
        fun = XIL(0x7ffff29084f5)
        original_fun = XIL(0xcff0)
        funcar = XIL(0x555555e63080)
        numargs = 1
        val = XIL(0x5af0)
        count = 6
#27 0x00005555557fcda1 in call1 (fn=XIL(0xcff0), arg1=XIL(0x555556232084)) at ../../master/src/eval.c:2774
#28 0x0000555555830f9f in print_error_message (data=XIL(0x5555584b93b3), stream=XIL(0x30), context=0x7ffff2c64148 "", caller=XIL(0)) at ../../master/src/print.c:944
        error_conditions = XIL(0x7ffff2c2da13)
        errname = XIL(0xb820)
        errmsg = XIL(0x55555571d57f)
        file_error = XIL(0x7fffffffd4c0)
        tail = XIL(0x30)
#29 0x000055555572094e in Fcommand_error_default_function (data=XIL(0x5555584b93b3), context=XIL(0x7ffff25734c4), signal=XIL(0)) at ../../master/src/keyboard.c:1032
        sf = 0x555556f6f728
#30 0x00005555557fdb25 in funcall_subr (subr=0x555555dd86a0 <Scommand_error_default_function>, numargs=3, args=0x7fffffffd628) at ../../master/src/eval.c:2992
        internal_argbuf = {XIL(0x7fffffffd570), XIL(0x1000000000), XIL(0x555555dd86a0), XIL(0x7fffffffd578), make_fixnum(23456248746435), XIL(0x10557f41d5), XIL(0x555555dd86a5), XIL(0x7fffffffd590)}
        internal_args = 0x7fffffffd628
#31 0x00005555557fd593 in Ffuncall (nargs=4, args=0x7fffffffd620) at ../../master/src/eval.c:2914
        fun = XIL(0x555555dd86a5)
        original_fun = XIL(0x2aaa9ccc8548)
        funcar = XIL(0x7fffffffd5f0)
        numargs = 3
        val = XIL(0x7fffffffd610)
        count = 5
#32 0x00005555557fc6b7 in Fapply (nargs=2, args=0x7fffffffd7e8) at ../../master/src/eval.c:2544
        i = 4
        funcall_nargs = 4
        funcall_args = 0x7fffffffd620
        spread_arg = XIL(0)
        fun = XIL(0x555555dd86a5)
        sa_avail = 16352
        sa_count = 5
        numargs = 3
        retval = XIL(0)
#33 0x00005555557fd9bc in funcall_subr (subr=0x555555de04a0 <Sapply>, numargs=2, args=0x7fffffffd7e8) at ../../master/src/eval.c:2967
#34 0x00005555557fd593 in Ffuncall (nargs=3, args=0x7fffffffd7e0) at ../../master/src/eval.c:2914
        fun = XIL(0x555555de04a5)
        original_fun = XIL(0x2d60)
        funcar = XIL(0x7fffffffd7a0)
        numargs = 2
        val = XIL(0x7fffffffdcc8)
        count = 4
#35 0x0000555555856c56 in exec_byte_code (bytestr=XIL(0x7ffff258f0e4), vector=XIL(0x7ffff2c1d0fd), maxdepth=make_fixnum(5), args_template=make_fixnum(128), nargs=3, args=0x7fffffffdcc8) at ../../master/src/bytecode.c:632
        op = 2
        type = (unknown: 0xffffdb10)
        const_length = 4
        bytestr_length = 10
        vectorp = 0x7ffff2c1d100
        quitcounter = 1 '\001'
        stack_items = 6
        sa_avail = 16326
        sa_count = 4
        alloc = 0x7fffffffd7d0
        stack_base = 0x7fffffffd7d0
        top = 0x7fffffffd7e0
        stack_lim = 0x7fffffffd800
        bytestr_data = 0x7fffffffd800 "\300\302\002\"\300\301\003\"\210\207"
        pc = 0x7fffffffd804 "\300\301\003\"\210\207"
        count = 4
        result = XIL(0x5555557f41d5)
#36 0x00005555557fdd7e in fetch_and_exec_byte_code (fun=XIL(0x7ffff2c1d0cd), syms_left=make_fixnum(128), nargs=3, args=0x7fffffffdcc8) at ../../master/src/eval.c:3036
#37 0x00005555557fe204 in funcall_lambda (fun=XIL(0x7ffff2c1d0cd), nargs=3, arg_vector=0x7fffffffdcc8) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffdc30)
        syms_left = make_fixnum(128)
        next = make_fixnum(2)
        lexenv = XIL(0x1800000003)
        count = 4
        i = 93824994985742
        optional = false
        rest = false
#38 0x00005555557fd5d7 in Ffuncall (nargs=4, args=0x7fffffffdcc0) at ../../master/src/eval.c:2916
        fun = XIL(0x7ffff2c1d0cd)
        original_fun = XIL(0x7ffff2c1d0cd)
        funcar = XIL(0x7fffffffdc70)
        numargs = 3
        val = XIL(0x7fffffffdc90)
        count = 3
#39 0x00005555557fce2b in call3 (fn=XIL(0x7ffff2c1d0cd), arg1=XIL(0x5555584b93b3), arg2=XIL(0x7ffff25734c4), arg3=XIL(0)) at ../../master/src/eval.c:2788
#40 0x0000555555720769 in cmd_error_internal (data=XIL(0x5555584b93b3), context=0x7fffffffdd70 "") at ../../master/src/keyboard.c:987
#41 0x0000555555720637 in cmd_error (data=XIL(0x5555584b93b3)) at ../../master/src/keyboard.c:956
        old_level = XIL(0)
        old_length = XIL(0)
        macroerror = "\000\000\000\000\000\000\000\000\360\350\365UUU\000\000\260\335\377\377\001\000\000\000\002\000\000\000\000\000\000\000\000x\000\000\000\000\000\000\230\227\177UUU\000\000\360h"
#42 0x00005555557f9347 in internal_condition_case (bfun=0x555555720ec1 <command_loop_1>, handlers=XIL(0x90), hfun=0x5555557204e4 <cmd_error>) at ../../master/src/eval.c:1435
        val = XIL(0x5555584b93b3)
        c = 0x555555f5e8f0
#43 0x0000555555720ab1 in command_loop_2 (ignore=XIL(0)) at ../../master/src/keyboard.c:1094
        val = make_fixnum(0)
#44 0x00005555557f875f in internal_catch (tag=XIL(0xd9e0), func=0x555555720a84 <command_loop_2>, arg=XIL(0)) at ../../master/src/eval.c:1189
        val = XIL(0xd9e0)
        c = 0x555555f47770
#45 0x0000555555720a50 in command_loop () at ../../master/src/keyboard.c:1073
#46 0x000055555571ffcd in recursive_edit_1 () at ../../master/src/keyboard.c:720
        count = 1
        val = XIL(0x7fffffffdf00)
#47 0x00005555557201c4 in Frecursive_edit () at ../../master/src/keyboard.c:789
        count = 0
        buffer = XIL(0)
#48 0x000055555571c0a9 in main (argc=2, argv=0x7fffffffe168) at ../../master/src/emacs.c:2050
        stack_bottom_variable = 0x7ffff617e053
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 1
        temacs = 0x0
        attempt_load_pdump = true
        rlim = {
          rlim_cur = 10022912,
          rlim_max = 18446744073709551615
        }
        lc_all = 0x0
        sockfd = -1
        module_assertions = false

Lisp Backtrace:
"window-list-1" (0xffffbfa0)
"replace-buffer-in-windows" (0xffffc4a8)
"kill-buffer" (0xffffc710)
0x57821b48 PVEC_COMPILED
"substitute-command-keys" (0xffffd3d8)
"command-error-default-function" (0xffffd628)
"apply" (0xffffd7e8)
0xf2c1d0c8 PVEC_COMPILED

-- 
Michael Welsh Duggan
([email-masked])