Subject: bug#47244: 28.0.50; SIGSEGV in long-runnning Emacs

From: Michael Welsh Duggan <[email-masked]>
Date: Thu, 08 Apr 2021 12:01:23 -0400

martin rudalics <[email-masked]> writes:

>  > Okay, close, but not quite.  What seems to be happening is this:
>  > list_windows()
>
> This is a local rewrite.  You really intend window_list() here.  Right?

I did.  I've inverted the order of those words many times, and I didn't
catch it this time.

>  > is called while Vwindow_list is nil, and the if branch is
>  > taken.  Something causes list_windows() to exit without reaching the end
>  > of the if block.  This leaves Vwindow_list partially created.
>
> OK.  If you really get out of this after the first
>
> 	  Vwindow_list = nconc2 (Vwindow_list, arglist);
>
> then we have one recorded frame, the length of Vwindow_list is 2 but we
> did not record it in the earlier length-based experiment and the 2 won't
> show up in the list of lengths.  So the explanation is valid and a bit
> gruesome too.  This might hit us anywhere ...
>
>  > The next
>  > time list_windows() is called it returns the partially created list.
>  >
>  > To determine this I put a breakpoint at the beginning of the if block
>  > that sets a gdb convenience variable called $in_list_windows to one and
>  > continues.  I put a breakpoint at the end of that block that sets it to
>  > zero and continues.  I put a third condition breakpoint at the entrance
>  > to list_windows() that only triggers if $in_list_windows is one.  This
>  > triggered with the included backtrace.
>  >
>  > Once again, the state triggered when, due to the VPN state changing, a
>  > background gnus demon hung trying to fetch mail.  The trigger was me
>  > hitting C-g twice rapidly in succession to regain interactivity.
>  >
>  > Can anyone recommend a means to check if this my theory is true?  Does
>  > list_windows() need to be protected against quit?
>
> Try with
>
>    block_input ();
>    ...
>    unblock_input ();
>
> around it.
>
> martin

Before that, I include the backtrace with your latest patch.  And here's
the interesting bit:

(gdb) p Vwindow_list
$2 = XIL(0x55555863cae3)
(gdb) xlist
$3 = 0x555556fc8af5
Lisp_Vectorlike
PVEC_WINDOW
$4 = (struct window *) 0x555556fc8af0
84x59+0+0
---
$5 = 0x555556fc8d05
Lisp_Vectorlike
PVEC_WINDOW
$6 = (struct window *) 0x555556fc8d00
84x1+0+59
---
nil
(gdb) p Vwindow_list_2
$7 = XIL(0)

Right before this I hit a breakpoint that that I had set up that, once
again, implied that in this call of window_list() happened subsequent to
a call to window_list() that didn't complete, somehow. 

Before running with block_input(), unblock_input(), I'm going to modify
the sources to set a physical variable to one on entrance to the if
block and set it back to zero at the exit.  At least then I can be sure
that an unintended termination of this function is really happening and
that it is not a debugger artifact.

#0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647)
    at ../../master/src/emacs.c:379
#1  0x00005555557c4b77 in die
    (msg=0x5555559105c8 "!NILP (Fequal (Vwindow_list, Vwindow_list_2))", file=0x55555590f9cf "../../master/src/window.c", line=2584)
    at ../../master/src/alloc.c:7420
#2  0x000055555564b3f9 in window_list () at ../../master/src/window.c:2584
#3  0x000055555564bffb in window_list_1
    (window=XIL(0x555556fc8af5), minibuf=XIL(0xc0), all_frames=XIL(0x30))
    at ../../master/src/window.c:2871
        tail = XIL(0x7ffff26647bd)
        list = XIL(0)
        rest = XIL(0x7ffff26647c0)
#4  0x000055555564c341 in Fwindow_list_1
    (window=XIL(0), minibuf=XIL(0), all_frames=XIL(0x30))
    at ../../master/src/window.c:2945
#5  0x00005555557fdbfa in funcall_subr
    (subr=0x555555dd4960 <Swindow_list_1>, numargs=3, args=0x7fffffffbfa0)
    at ../../master/src/eval.c:2992
        internal_argbuf = 
          {XIL(0x7fffffffbed0), XIL(0x1000000000), XIL(0x555555dd4960), XIL(0x7fffffffbed8), XIL(0x5555557f47e3), make_fixnum(17538470058), XIL(0x555555dd4965), XIL(0x7fffffffbef0)}
        internal_args = 0x7fffffffbfa0
#6  0x00005555557fd668 in Ffuncall (nargs=4, args=0x7fffffffbf98)
    at ../../master/src/eval.c:2914
        fun = XIL(0x555555dd4965)
        original_fun = XIL(0x2aaa9c71a7a8)
        funcar = XIL(0x7fffffffbf50)
        numargs = 3
        val = XIL(0x5555571d7ced)
        count = 12
#7  0x0000555555856d2b in exec_byte_code
    (bytestr=XIL(0x7ffff277c864), vector=XIL(0x7ffff277c80d), maxdepth=make_fixnum(8), args_template=make_fixnum(256), nargs=1, args=0x7fffffffc4b0)
    at ../../master/src/bytecode.c:632
        op = 3
        type = (CATCHER_ALL | unknown: 0x20)
        targets = 
        const_length = 10
        bytestr_length = 56
        vectorp = 0x7ffff277c810
        quitcounter = 1 '\001'
        stack_items = 9
        sa_avail = 16256
        sa_count = 12
        alloc = 0x7fffffffbf80
        stack_base = 0x7fffffffbf80
        top = 0x7fffffffbf98
        stack_lim = 0x7fffffffbfc8
        bytestr_data = 0x7fffffffbfc8 "\300\001!\301\302\211\303#\211\205\067"
        pc = 0x7fffffffbfd0 "\211\205\067"
        count = 12
        result = XIL(0xc557d2534)
#8  0x00005555557fde53 in fetch_and_exec_byte_code (fun=XIL(0x7ffff277c7b5), syms_left=make_fixnum(256), nargs=1, args=0x7fffffffc4a8) at ../../master/src/eval.c:3036
#9  0x00005555557fe2d9 in funcall_lambda (fun=XIL(0x7ffff277c7b5), nargs=1, arg_vector=0x7fffffffc4a8) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffc420)
        syms_left = make_fixnum(256)
        next = XIL(0x555555e63080)
        lexenv = XIL(0x1800000000)
        count = 12
        i = 93824994985955
        optional = false
        rest = false
#10 0x00005555557fd6ac in Ffuncall (nargs=2, args=0x7fffffffc4a0) at ../../master/src/eval.c:2916
        fun = XIL(0x7ffff277c7b5)
        original_fun = XIL(0xbd60)
        funcar = XIL(0x7fffffffc470)
        numargs = 1
        val = XIL(0x555555e63080)
        count = 11
#11 0x00005555557fce76 in call1 (fn=XIL(0xbd60), arg1=XIL(0x5555571d7ced)) at ../../master/src/eval.c:2774
#12 0x000055555564d859 in replace_buffer_in_windows (buffer=XIL(0x5555571d7ced)) at ../../master/src/window.c:3429
#13 0x0000555555758e6d in Fkill_buffer (buffer_or_name=XIL(0x5555571d7ced)) at ../../master/src/buffer.c:1830
        buffer = XIL(0x5555571d7ced)
        b = 0x5555571d7ce8
        tem = XIL(0x555555753673)
        m = 0x7fffffffc5f0
#14 0x00005555557fdba0 in funcall_subr (subr=0x555555dd9ce0 <Skill_buffer>, numargs=1, args=0x7fffffffc710) at ../../master/src/eval.c:2987
        internal_argbuf = {XIL(0x7fffffffc650), XIL(0x1000000000), XIL(0x555555dd9ce0), XIL(0x7fffffffc658), XIL(0x5555557f47e3), make_fixnum(17538470058), XIL(0x555555dd9ce5), XIL(0x7fffffffc670)}
        internal_args = 0x7fffffffc710
#15 0x00005555557fd668 in Ffuncall (nargs=2, args=0x7fffffffc708) at ../../master/src/eval.c:2914
        fun = XIL(0x555555dd9ce5)
        original_fun = XIL(0x2aaa9c7147c0)
        funcar = XIL(0x7fffffffc6d0)
        numargs = 1
        val = XIL(0x7fffffffc6f0)
        count = 10
#16 0x0000555555856d2b in exec_byte_code (bytestr=XIL(0x7ffff25c7454), vector=XIL(0x5555571fc36d), maxdepth=make_fixnum(2), args_template=make_fixnum(0), nargs=0, args=0x7fffffffcbc0) at ../../master/src/bytecode.c:632
        op = 1
        type = (CATCHER_ALL | unknown: 0x5588e760)
        const_length = 3
        bytestr_length = 10
        vectorp = 0x5555571fc370
        quitcounter = 1 '\001'
        stack_items = 3
        sa_avail = 16350
        sa_count = 10
        alloc = 0x7fffffffc700
        stack_base = 0x7fffffffc700
        top = 0x7fffffffc708
        stack_lim = 0x7fffffffc718
        bytestr_data = 0x7fffffffc718 "\301\300!\205\t"
        pc = 0x7fffffffc721 "\207\377\377\377\177"
        count = 10
        result = XIL(0x9)
#17 0x00005555557fde53 in fetch_and_exec_byte_code (fun=XIL(0x5555571d80fd), syms_left=make_fixnum(0), nargs=0, args=0x7fffffffcbc0) at ../../master/src/eval.c:3036
#18 0x00005555557fe2d9 in funcall_lambda (fun=XIL(0x5555571d80fd), nargs=0, arg_vector=0x7fffffffcbc0) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffcb40)
        syms_left = make_fixnum(0)
        next = XIL(0x1)
        lexenv = XIL(0x1800000000)
        count = 10
        i = 93824994985955
        optional = false
        rest = false
#19 0x00005555557fd6ac in Ffuncall (nargs=1, args=0x7fffffffcbb8) at ../../master/src/eval.c:2916
        fun = XIL(0x5555571d80fd)
        original_fun = XIL(0x5555571d80fd)
        funcar = XIL(0x7fffffffcb70)
        numargs = 0
        val = XIL(0x555555e63080)
        count = 9
#20 0x000055555585604a in bcall0 (f=XIL(0x5555571d80fd)) at ../../master/src/bytecode.c:340
#21 0x00005555557ffae0 in do_one_unbind (this_binding=0x7fffffffcc30, unwinding=true, bindflag=SET_INTERNAL_UNBIND) at ../../master/src/eval.c:3575
#22 0x00005555557fff0c in unbind_to (count=8, value=XIL(0)) at ../../master/src/eval.c:3713
        this_binding = {
          kind = SPECPDL_UNWIND,
          unwind = {
            kind = SPECPDL_UNWIND,
            func = 0x55555585602d <bcall0>,
            arg = XIL(0x5555571d80fd),
            eval_depth = 4
          },
          unwind_array = {
            kind = SPECPDL_UNWIND,
            nelts = 93824995385389,
            array = 0x5555571d80fd
          },
          unwind_ptr = {
            kind = SPECPDL_UNWIND,
            func = 0x55555585602d <bcall0>,
            arg = 0x5555571d80fd
          },
          unwind_int = {
            kind = SPECPDL_UNWIND,
            func = 0x55555585602d <bcall0>,
            arg = 1461551357
          },
          unwind_intmax = {
            kind = SPECPDL_UNWIND,
            func = 0x55555585602d <bcall0>,
            arg = 93825022132477
          },
          unwind_excursion = {
            kind = SPECPDL_UNWIND,
            marker = XIL(0x55555585602d),
            window = XIL(0x5555571d80fd)
          },
          unwind_void = {
            kind = SPECPDL_UNWIND,
            func = 0x55555585602d <bcall0>
          },
          let = {
            kind = SPECPDL_UNWIND,
            symbol = XIL(0x55555585602d),
            old_value = XIL(0x5555571d80fd),
            where = XIL(0x4),
            saved_value = XIL(0)
          },
          bt = {
            kind = SPECPDL_UNWIND,
            debug_on_exit = false,
            function = XIL(0x55555585602d),
            args = 0x5555571d80fd,
            nargs = 4
          }
        }
        quitf = XIL(0)
#23 0x0000555555856ddc in exec_byte_code (bytestr=XIL(0x7ffff2908874), vector=XIL(0x7ffff2908525), maxdepth=make_fixnum(23), args_template=make_fixnum(257), nargs=1, args=0x7fffffffd3e0) at ../../master/src/bytecode.c:652
        op = 2
        type = (unknown: 0xffffd230)
        const_length = 51
        bytestr_length = 494
        vectorp = 0x7ffff2908528
        quitcounter = 59 ';'
        stack_items = 24
        sa_avail = 15698
        sa_count = 7
        alloc = 0x7fffffffcc80
        stack_base = 0x7fffffffcc80
        top = 0x7fffffffccb0
        stack_lim = 0x7fffffffcd40
        bytestr_data = 0x7fffffffcd40 "\211??\205\355\001\b\302p\001\031\303\304\302\"r\211q\210\305\306\002\"\216\004c\210eb\210`dW\203\345\001`ǉ\211\211g\310U\203\234\001\311\061:"
        pc = 0x7fffffffcf28 "\262\001)\266\203\207"
        count = 7
        result = XIL(0)
#24 0x00005555557fde53 in fetch_and_exec_byte_code (fun=XIL(0x7ffff29084f5), syms_left=make_fixnum(257), nargs=1, args=0x7fffffffd3d8) at ../../master/src/eval.c:3036
#25 0x00005555557fe2d9 in funcall_lambda (fun=XIL(0x7ffff29084f5), nargs=1, arg_vector=0x7fffffffd3d8) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffd350)
        syms_left = make_fixnum(257)
        next = XIL(0x555555e63080)
        lexenv = XIL(0x1800000000)
        count = 7
        i = 93824994985955
        optional = false
        rest = false
#26 0x00005555557fd6ac in Ffuncall (nargs=2, args=0x7fffffffd3d0) at ../../master/src/eval.c:2916
        fun = XIL(0x7ffff29084f5)
        original_fun = XIL(0xcff0)
        funcar = XIL(0x555555e63080)
        numargs = 1
        val = XIL(0x5af0)
        count = 6
#27 0x00005555557fce76 in call1 (fn=XIL(0xcff0), arg1=XIL(0x555556232294)) at ../../master/src/eval.c:2774
#28 0x0000555555831074 in print_error_message (data=XIL(0x55555863cb33), stream=XIL(0x30), context=0x7ffff2c64148 "", caller=XIL(0)) at ../../master/src/print.c:944
        error_conditions = XIL(0x7ffff2c2da33)
        errname = XIL(0xb820)
        errmsg = XIL(0x55555571d654)
        file_error = XIL(0x7fffffffd4c0)
        tail = XIL(0x30)
#29 0x0000555555720a23 in Fcommand_error_default_function (data=XIL(0x55555863cb33), context=XIL(0x7ffff25734c4), signal=XIL(0)) at ../../master/src/keyboard.c:1032
        sf = 0x55555702c630
#30 0x00005555557fdbfa in funcall_subr (subr=0x555555dd86a0 <Scommand_error_default_function>, numargs=3, args=0x7fffffffd628) at ../../master/src/eval.c:2992
        internal_argbuf = {XIL(0x7fffffffd570), XIL(0x1000000000), XIL(0x555555dd86a0), XIL(0x7fffffffd578), XIL(0x5555557f47e3), make_fixnum(17538470058), XIL(0x555555dd86a5), XIL(0x7fffffffd590)}
        internal_args = 0x7fffffffd628
#31 0x00005555557fd668 in Ffuncall (nargs=4, args=0x7fffffffd620) at ../../master/src/eval.c:2914
        fun = XIL(0x555555dd86a5)
        original_fun = XIL(0x2aaa9ccc8548)
        funcar = XIL(0x7fffffffd5f0)
        numargs = 3
        val = XIL(0x7fffffffd610)
        count = 5
#32 0x00005555557fc78c in Fapply (nargs=2, args=0x7fffffffd7e8) at ../../master/src/eval.c:2544
        i = 4
        funcall_nargs = 4
        funcall_args = 0x7fffffffd620
        spread_arg = XIL(0)
        fun = XIL(0x555555dd86a5)
        sa_avail = 16352
        sa_count = 5
        numargs = 3
        retval = XIL(0)
#33 0x00005555557fda91 in funcall_subr (subr=0x555555de04a0 <Sapply>, numargs=2, args=0x7fffffffd7e8) at ../../master/src/eval.c:2967
#34 0x00005555557fd668 in Ffuncall (nargs=3, args=0x7fffffffd7e0) at ../../master/src/eval.c:2914
        fun = XIL(0x555555de04a5)
        original_fun = XIL(0x2d60)
        funcar = XIL(0x7fffffffd7a0)
        numargs = 2
        val = XIL(0x7fffffffdcc8)
        count = 4
#35 0x0000555555856d2b in exec_byte_code (bytestr=XIL(0x7ffff258f0e4), vector=XIL(0x7ffff2c1d11d), maxdepth=make_fixnum(5), args_template=make_fixnum(128), nargs=3, args=0x7fffffffdcc8) at ../../master/src/bytecode.c:632
        op = 2
        type = (unknown: 0xffffdb10)
        const_length = 4
        bytestr_length = 10
        vectorp = 0x7ffff2c1d120
        quitcounter = 1 '\001'
        stack_items = 6
        sa_avail = 16326
        sa_count = 4
        alloc = 0x7fffffffd7d0
        stack_base = 0x7fffffffd7d0
        top = 0x7fffffffd7e0
        stack_lim = 0x7fffffffd800
        bytestr_data = 0x7fffffffd800 "\300\302\002\"\300\301\003\"\210\207"
        pc = 0x7fffffffd804 "\300\301\003\"\210\207"
        count = 4
        result = make_fixnum(23456248746154)
#36 0x00005555557fde53 in fetch_and_exec_byte_code (fun=XIL(0x7ffff2c1d0ed), syms_left=make_fixnum(128), nargs=3, args=0x7fffffffdcc8) at ../../master/src/eval.c:3036
#37 0x00005555557fe2d9 in funcall_lambda (fun=XIL(0x7ffff2c1d0ed), nargs=3, arg_vector=0x7fffffffdcc8) at ../../master/src/eval.c:3117
        val = XIL(0x7fffffffdc30)
        syms_left = make_fixnum(128)
        next = make_fixnum(2)
        lexenv = XIL(0x1800000003)
        count = 4
        i = 93824994985955
        optional = false
        rest = false
#38 0x00005555557fd6ac in Ffuncall (nargs=4, args=0x7fffffffdcc0) at ../../master/src/eval.c:2916
        fun = XIL(0x7ffff2c1d0ed)
        original_fun = XIL(0x7ffff2c1d0ed)
        funcar = XIL(0x7fffffffdc70)
        numargs = 3
        val = XIL(0x7fffffffdc90)
        count = 3
#39 0x00005555557fcf00 in call3 (fn=XIL(0x7ffff2c1d0ed), arg1=XIL(0x55555863cb33), arg2=XIL(0x7ffff25734c4), arg3=XIL(0)) at ../../master/src/eval.c:2788
#40 0x000055555572083e in cmd_error_internal (data=XIL(0x55555863cb33), context=0x7fffffffdd70 "") at ../../master/src/keyboard.c:987
#41 0x000055555572070c in cmd_error (data=XIL(0x55555863cb33)) at ../../master/src/keyboard.c:956
        old_level = XIL(0)
        old_length = XIL(0)
        macroerror = "\000\000\000\000\000\000\000\000\360\350\365UUU\000\000\260\335\377\377\001", '\000' <repeats 11 times>, "\060\256_\001\000\000\000\000m\230\177UUU\000\000Ph"
#42 0x00005555557f941c in internal_condition_case (bfun=0x555555720f96 <command_loop_1>, handlers=XIL(0x90), hfun=0x5555557205b9 <cmd_error>) at ../../master/src/eval.c:1435
        val = XIL(0x55555863cb33)
        c = 0x555555f5e8f0
#43 0x0000555555720b86 in command_loop_2 (ignore=XIL(0)) at ../../master/src/keyboard.c:1094
        val = XIL(0)
#44 0x00005555557f8834 in internal_catch (tag=XIL(0xd9e0), func=0x555555720b59 <command_loop_2>, arg=XIL(0)) at ../../master/src/eval.c:1189
        val = XIL(0xd9e0)
        c = 0x555555f47770
#45 0x0000555555720b25 in command_loop () at ../../master/src/keyboard.c:1073
#46 0x00005555557200a2 in recursive_edit_1 () at ../../master/src/keyboard.c:720
        count = 1
        val = XIL(0x7fffffffdf00)
#47 0x0000555555720299 in Frecursive_edit () at ../../master/src/keyboard.c:789
        count = 0
        buffer = XIL(0)
#48 0x000055555571c17e in main (argc=2, argv=0x7fffffffe168) at ../../master/src/emacs.c:2050
        stack_bottom_variable = 0x7ffff617e053
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 1
        temacs = 0x0
        attempt_load_pdump = true
        rlim = {
          rlim_cur = 10022912,
          rlim_max = 18446744073709551615
        }
        lc_all = 0x0
        sockfd = -1
        module_assertions = false

Lisp Backtrace:
"window-list-1" (0xffffbfa0)
"replace-buffer-in-windows" (0xffffc4a8)
"kill-buffer" (0xffffc710)
0x571d80f8 PVEC_COMPILED
"substitute-command-keys" (0xffffd3d8)
"command-error-default-function" (0xffffd628)
"apply" (0xffffd7e8)
0xf2c1d0e8 PVEC_COMPILED

-- 
Michael Welsh Duggan
([email-masked])