Subject: bug#59452: 29.0.50; [PGTK] SIGSEV Args out of range: 6, 6

From: German Pacenza <[email-masked]>
Date: Tue, 22 Nov 2022 10:48:34 -0300

Po Lu <[email-masked]> writes:

> This looks like a signal happened in pgtk_read_socket, causing a longjmp
> outside and GLib to crash the next time pgtk_read_socket happens (as
> depicted in the backtrace.)
>
> Unfortunately, this backtrace doesn't help.  Would you please put a
> breakpoint on `args_out_of_range', and see what leads to it being called
> instead?

Something like this?:

Thread 1 "emacs" hit Breakpoint 1, args_out_of_range (a1=a1@entry=0x1a, a2=a2@entry=0x1a) at data.c:155
155	 xsignal2 (Qargs_out_of_range, a1, a2);
(gdb) bt full
#0  args_out_of_range (a1=a1@entry=0x1a, a2=a2@entry=0x1a) at data.c:155
#1  0x00005555555dd84e in validate_interval_range
    (object=0x555555e7e984, begin=0x7fffffffc658, end=<optimized out>, force=<optimized out>)
    at textprop.c:173
        len = <optimized out>
        i = <optimized out>
        searchpos = <optimized out>
        begin0 = 0x1a
        end0 = 0x1a
#2  0x00005555557cd0f0 in Ftext_properties_at (position=<optimized out>, 
    position@entry=0x1a, object=<optimized out>, object@entry=0x555555e7e984) at textprop.c:580
        i = <optimized out>
#3  0x00005555557cd15c in Fget_text_property
    (position=position@entry=0x1a, prop=prop@entry=0x8820, object=object@entry=0x555555e7e984)
    at textprop.c:604
#4  0x000055555564093f in note_mode_line_or_margin_highlight
    (area=<optimized out>, y=<optimized out>, x=<optimized out>, window=<optimized out>)
    at xdisp.c:34594
        f = 0x5555562dd9d0
        hlinfo = 0x5555564c00d0
        charpos = 6
        pos = 0x1a
        help = 0x0
        mouse_face_shown = <optimized out>
        w = 0x555556d41f18
        pointer = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--c
        row = 0x555556db2570
        dx = 5
        width = 20
        string = 0x555555e7e984
        glyph = <optimized out>
        dy = 19
        object = 0x0
        mouse_face = <optimized out>
        cursor = 0x0
        height = 18
        original_x_pixel = 55
        row_start_glyph = 0x555556dcfa50
        hlinfo = <optimized out>
        part = ON_MODE_LINE
        window = <optimized out>
        w = 0x555556d41f18
        cursor = <optimized out>
        pointer = 0x0
#5  note_mouse_highlight (f=f@entry=0x5555562dd9d0, x=<optimized out>, y=<optimized out>) at xdisp.c:34988
        hlinfo = <optimized out>
        part = ON_MODE_LINE
        window = <optimized out>
        w = 0x555556d41f18
        cursor = <optimized out>
        pointer = 0x0
#6  0x00005555558149fb in note_mouse_movement (event=0x5555563195b0, frame=0x5555562dd9d0) at pgtkterm.c:5821
        r = 0x5555564c0148
        dpyinfo = 0x5555564c0030
        inev = {kind = NO_EVENT, ie = {kind = NO_EVENT, part = scroll_bar_nowhere, code = 0, modifiers = 0, x = 0x0, y = 0x0, timestamp = 0, frame_or_window = 0x0, arg = 0x0, device = 0x30}, sie = {kind = NO_EVENT, dpyinfo = 0x0, requestor = 0x0, selection = 0x0, target = 0x0, property = 0x0, time = 0}}
        f = 0x5555562dd9d0
        frame = <optimized out>
        dpyinfo = <optimized out>
        hlinfo = <optimized out>
        do_help = <optimized out>
#7  motion_notify_event (widget=<optimized out>, event=0x5555563195b0, user_data=<optimized out>) at pgtkterm.c:5905
        inev = {kind = NO_EVENT, ie = {kind = NO_EVENT, part = scroll_bar_nowhere, code = 0, modifiers = 0, x = 0x0, y = 0x0, timestamp = 0, frame_or_window = 0x0, arg = 0x0, device = 0x30}, sie = {kind = NO_EVENT, dpyinfo = 0x0, requestor = 0x0, selection = 0x0, target = 0x0, property = 0x0, time = 0}}
        f = 0x5555562dd9d0
        frame = <optimized out>
        dpyinfo = <optimized out>
        hlinfo = <optimized out>
        do_help = <optimized out>
#8  0x00007ffff7684fd8 in  () at /usr/lib/libgtk-3.so.0
#9  0x00007ffff718f210 in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0
#10 0x00007ffff71bcea8 in  () at /usr/lib/libgobject-2.0.so.0
#11 0x00007ffff71ac980 in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#12 0x00007ffff71ad204 in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#13 0x00007ffff7944815 in  () at /usr/lib/libgtk-3.so.0
#14 0x00007ffff77e20bb in  () at /usr/lib/libgtk-3.so.0
#15 0x00007ffff77e2f9b in gtk_main_do_event () at /usr/lib/libgtk-3.so.0
#16 0x00007ffff7edecc3 in  () at /usr/lib/libgdk-3.so.0
#17 0x00007ffff7f0d8c8 in  () at /usr/lib/libgdk-3.so.0
#18 0x00007ffff709187b in g_main_context_dispatch () at /usr/lib/libglib-2.0.so.0
#19 0x0000555555811f88 in pgtk_read_socket (terminal=<optimized out>, hold_quit=0x7fffffffcec0) at pgtkterm.c:3839
        context = 0x555556304040
        context_acquired = <optimized out>
        count = <optimized out>
        count = <optimized out>
#20 pgtk_read_socket (terminal=<optimized out>, hold_quit=0x7fffffffcec0) at pgtkterm.c:3818
        count = <optimized out>
#21 0x00005555556d04d1 in gobble_input () at keyboard.c:7413
        nr = <optimized out>
        hold_quit = {kind = NO_EVENT, part = scroll_bar_nowhere, code = 0, modifiers = 0, x = 0x0, y = 0x0, timestamp = 0, frame_or_window = 0x0, arg = 0x0, device = 0x30}
        next = 0x0
        nread = 0
        err = false
        t = 0x5555562dd778
#22 0x00005555556d08b5 in handle_async_input () at keyboard.c:7644
        nread = <optimized out>
#23 process_pending_signals () at keyboard.c:7658
#24 unblock_input_to (level=0) at keyboard.c:7673
#25 unblock_input_to (level=<optimized out>) at keyboard.c:7667
#26 0x00005555556d14fb in unblock_input () at keyboard.c:7692
        nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        timers = 0x555557dc8bb3
        idle_timers = 0x555557dc8413
        tem = 0x0
#27 timer_check () at keyboard.c:4738
        nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        timers = 0x555557dc8bb3
        idle_timers = 0x555557dc8413
        tem = 0x0
#28 0x00005555556d1af5 in readable_events (flags=flags@entry=1) at keyboard.c:3520
#29 0x00005555556d1ce8 in get_input_pending (flags=flags@entry=1) at keyboard.c:7363
#30 0x00005555556d6ba8 in detect_input_pending_run_timers (do_display=do_display@entry=true) at keyboard.c:10893
        old_timers_run = <optimized out>
#31 0x00005555557b4a48 in wait_reading_process_output (time_limit=time_limit@entry=0, nsecs=nsecs@entry=0, read_kbd=read_kbd@entry=-1, do_display=<optimized out>, wait_for_cell=wait_for_cell@entry=0x0, wait_proc=wait_proc@entry=0x0, just_wait_proc=<optimized out>) at process.c:5779
        leave = false
        process_skipped = <optimized out>
        wrapped = <optimized out>
        channel_start = <optimized out>
        child_fd = <optimized out>
        last_read_channel = 17
        channel = <optimized out>
        nfds = <optimized out>
        Available = {fds_bits = {16, 0 <repeats 15 times>}}
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = true
        check_delay = <optimized out>
        no_avail = false
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 0, tv_nsec = 0}
        end_time = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        timer_delay = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        got_output_end_time = {tv_sec = 1669223983, tv_nsec = 200900201}
        wait = <optimized out>
        got_some_output = <optimized out>
        prev_wait_proc_nbytes_read = <optimized out>
        retry_for_async = <optimized out>
        count = {bytes = <optimized out>}
        now = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
#32 0x00005555556d226c in kbd_buffer_get_event (end_time=0x0, used_mouse_menu=0x7fffffffdc2b, kbp=<synthetic pointer>) at keyboard.c:3999
        do_display = <optimized out>
        obj = <optimized out>
        str = <optimized out>
        c = 0x0
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        kb = <optimized out>
        count = {bytes = <optimized out>}
#33 read_event_from_main_queue (end_time=<optimized out>, local_getcjmp=0x7fffffffd920, used_mouse_menu=0x7fffffffdc2b) at keyboard.c:2266
        c = 0x0
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        kb = <optimized out>
        count = {bytes = <optimized out>}
#34 0x00005555556d7d13 in read_decoded_event_from_main_queue (used_mouse_menu=<optimized out>, prev_event=<optimized out>, local_getcjmp=<optimized out>, end_time=<optimized out>) at keyboard.c:2329
        nextevt = <optimized out>
        frame = <optimized out>
        terminal = <optimized out>
        events = {0x80, 0x55555574c59c <Fget_pos_property+908>, 0x0, 0x555556d42728, 0x2, 0x0, 0x300000080, 0x555556eec373, 0x555556d4272d, 0xcff0, 0x300000000, 0x555556eec373, 0x0, 0x9cc0, 0x0, 0x3}
        n = 0
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {93825000950432, 3557804219960580310, 93825017325352, 0, 93825026390467, 140737488346464, -3557804221298190122, -7208725008076711722}, __mask_was_saved = 0, __saved_mask = {__val = {140737488345584, 93825017070131, 140737488345584, 93825017204688, 93824994833265, 140737488345536, 0, 93825017070131, 140737488345624, 93825017325357, 0, 0, 1, 2, 20, 0}}}}
        save_jump = {{__jmpbuf = {96, 0, 0, 36864, 93825017325357, 93824994267041, 0, 140737111371096}, __mask_was_saved = 0, __saved_mask = {__val = {93824994267529, 140737119238907, 93824993868800, 36864, 40128, 0, 8589934593, 154, 0, 0, 140737488345872, 0, 93825002882515, 6, 10607902197667024640, 0}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = true
        orig_kboard = 0x555556345ec0
#35 read_char (commandflag=1, map=0x5555575db5d3, prev_event=0x0, used_mouse_menu=0x7fffffffdc2b, end_time=0x0) at keyboard.c:2960
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {93825000950432, 3557804219960580310, 93825017325352, 0, 93825026390467, 140737488346464, -3557804221298190122, -7208725008076711722}, __mask_was_saved = 0, __saved_mask = {__val = {140737488345584, 93825017070131, 140737488345584, 93825017204688, 93824994833265, 140737488345536, 0, 93825017070131, 140737488345624, 93825017325357, 0, 0, 1, 2, 20, 0}}}}
        save_jump = {{__jmpbuf = {96, 0, 0, 36864, 93825017325357, 93824994267041, 0, 140737111371096}, __mask_was_saved = 0, __saved_mask = {__val = {93824994267529, 140737119238907, 93824993868800, 36864, 40128, 0, 8589934593, 154, 0, 0, 140737488345872, 0, 93825002882515, 6, 10607902197667024640, 0}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = true
        orig_kboard = 0x555556345ec0
#36 0x00005555556da303 in read_key_sequence (keybuf=<optimized out>, prompt=0x0, dont_downcase_last=<optimized out>, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:10070
        interrupted_kboard = 0x555556345ec0
        interrupted_frame = 0x5555562dd9d0
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = <optimized out>
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 0x5555575db5d3
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {parent = 0x55555622de33, map = 0x55555622de33, start = 0, end = 0}
        keytran = {parent = 0x7fffe9ff123b, map = 0x7fffe9ff123b, start = 0, end = 0}
        indec = {parent = 0x55555622de23, map = 0x55555622de23, start = 0, end = 0}
        shift_translated = false
        delayed_switch_frame = 0x0
        original_uppercase = 0x0
        original_uppercase_position = -1
        dummyflag = false
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = <optimized out>
#37 0x00005555556dc1b5 in command_loop_1 () at keyboard.c:1376
        cmd = <optimized out>
        keybuf = {0x0, 0x80, 0x7fffe9bb1cdd, 0xa0, 0x2, 0x9336d6d880074f00, 0x0, 0x0, 0x80, 0x4000000011000000, 0x400000003f000000, 0x2aaa93e0a328, 0x7fffffffde80, 0x55555575c372 <eval_sub+578>, 0x7fffe9df4e68, 0x0, 0x7fffffffde80, 0x7fff93e0a328, 0x0, 0x555555758f10 <Fapply+256>, 0x7fffffffde50, 0x9336d6d880074f00, 0x60, 0x30, 0x0, 0x9570, 0x7fffe987670d, 0x5555557588c2 <unbind_to+514>, 0x60, 0x9336d6d880074f00}
        i = <optimized out>
        prev_modiff = 0
        prev_buffer = 0x0
#38 0x00005555557573d7 in internal_condition_case (bfun=bfun@entry=0x5555556dbff0 <command_loop_1>, handlers=handlers@entry=0x90, hfun=hfun@entry=0x5555556cf060 <cmd_error>) at eval.c:1474
        val = <optimized out>
        c = 0x555555ed3cd0
#39 0x00005555556c7b26 in command_loop_2 (handlers=handlers@entry=0x90) at keyboard.c:1125
        val = <optimized out>
#40 0x0000555555757331 in internal_catch (tag=tag@entry=0xfa20, func=func@entry=0x5555556c7b00 <command_loop_2>, arg=arg@entry=0x90) at eval.c:1197
        val = <optimized out>
        c = 0x555555ed4400
#41 0x00005555556c7ac1 in command_loop () at keyboard.c:1103
#42 0x00005555556cebe2 in recursive_edit_1 () at keyboard.c:712
        val = <optimized out>
#43 0x00005555556cef70 in Frecursive_edit () at keyboard.c:795
        buffer = <optimized out>
#44 0x00005555555e0a66 in main (argc=<optimized out>, argv=0x7fffffffe208) at emacs.c:2522
        stack_bottom_variable = 0x6ed834980
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = <optimized out>
        sockfd = -1
(gdb) 

-- 
German Pacenza