Subject: bug#59452: 29.0.50; [PGTK] SIGSEV Args out of range: 6, 6

From: German Pacenza <[email-masked]>
Date: Mon, 21 Nov 2022 15:46:32 -0300

Emacs crashes after showing "Args out of range: 6, 6" in the echo area.
It is hard to reproduce but launching gnus from the command line
`emacs --eval "(gnus)"` and minimizing the window as soon as it appears
seems to trigger the crash sometimes.

I'm using Plasma wayland.

coredump:

(gdb) bt full
#0  __pthread_kill_implementation
    (threadid=<optimized out>, signo=signo@entry=11, no_tid=no_tid@entry=0) at pthread_kill.c:44
        tid = <optimized out>
        ret = 0
        pd = <optimized out>
        old_mask = {__val = {0}}
        ret = <optimized out>
#1  0x00007fead6ea16b3 in __pthread_kill_internal (signo=11, threadid=<optimized out>)
    at pthread_kill.c:78
#2  0x00007fead6e51958 in __GI_raise (sig=sig@entry=11) at ../sysdeps/posix/raise.c:26
        ret = <optimized out>
#3  0x000056499e550e4e in terminate_due_to_signal
    (sig=sig@entry=11, backtrace_limit=backtrace_limit@entry=40) at emacs.c:459
#4  0x000056499e55134b in handle_fatal_signal (sig=sig@entry=11) at sysdep.c:1783
#5  0x000056499e660b48 in deliver_thread_signal
    (sig=sig@entry=11, handler=0x56499e551340 <handle_fatal_signal>) at sysdep.c:1775
#6  0x000056499e660bc9 in deliver_fatal_thread_signal (sig=11) at sysdep.c:1795
        fatal = <optimized out>
#7  handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>) at sysdep.c:1888
        fatal = <optimized out>
#8  0x00007fead6e51a00 in <signal handler called> () at /usr/lib/libc.so.6
#9  emission_find (instance=0x5649a040e510, detail=670, signal_id=1)
    at ../glib/gobject/gsignal.c:895
        emission = 0x2
        emission_node = <optimized out>
        accumulator = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--c
        emission = {next = 0x7feadf2b9c20 <type_rw_lock>, instance = 0x7feadf1c1076 <g_rw_lock_reader_lock+54>, ihint = {signal_id = 2682665968, detail = 22089, run_type = (G_SIGNAL_DETAILED | G_SIGNAL_ACTION | G_SIGNAL_NO_HOOKS | G_SIGNAL_MUST_COLLECT | G_SIGNAL_DEPRECATED | G_SIGNAL_ACCUMULATOR_FIRST_RUN | unknown: 0x9fe43a00)}, state = 22089, chain_type = 0x56499fe63af8 [None]}
        hlist = <optimized out>
        handler_list = 0x0
        return_accu = <optimized out>
        accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        signal_id = 1
        max_sequential_handler_number = <optimized out>
        return_value_altered = 0
#10 signal_emit_unlocked_R.isra.0 (node=node@entry=0x5649a03aff10, detail=detail@entry=670, instance=instance@entry=0x5649a040e510, emission_return=emission_return@entry=0x0, instance_and_params=instance_and_params@entry=0x7ffe0f9c0a10) at ../glib/gobject/gsignal.c:3680
        emission_node = <optimized out>
        accumulator = <optimized out>
        emission = {next = 0x7feadf2b9c20 <type_rw_lock>, instance = 0x7feadf1c1076 <g_rw_lock_reader_lock+54>, ihint = {signal_id = 2682665968, detail = 22089, run_type = (G_SIGNAL_DETAILED | G_SIGNAL_ACTION | G_SIGNAL_NO_HOOKS | G_SIGNAL_MUST_COLLECT | G_SIGNAL_DEPRECATED | G_SIGNAL_ACCUMULATOR_FIRST_RUN | unknown: 0x9fe43a00)}, state = 22089, chain_type = 0x56499fe63af8 [None]}
        hlist = <optimized out>
        handler_list = 0x0
        return_accu = <optimized out>
        accu = {g_type = 0x0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        signal_id = 1
        max_sequential_handler_number = <optimized out>
        return_value_altered = 0
#11 0x00007feadf28af75 in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=var_args@entry=0x7ffe0f9c0bd0) at ../glib/gobject/gsignal.c:3549
        instance_and_params = 0x7ffe0f9c0a10
        signal_return_type = <optimized out>
        param_values = 0x7ffe0f9c0a28
        node = <optimized out>
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#12 0x00007feadf28b204 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at ../glib/gobject/gsignal.c:3606
        var_args = {{gp_offset = 32, fp_offset = 48, overflow_arg_area = 0x7ffe0f9c0cb0, reg_save_area = 0x7ffe0f9c0bf0}}
#13 0x00007feadf277fc6 in g_object_dispatch_properties_changed (object=0x5649a040e510, n_pspecs=<optimized out>, pspecs=<optimized out>) at ../glib/gobject/gobject.c:1428
        i = <optimized out>
#14 0x00007feadf27b488 in g_object_notify_by_spec_internal (pspec=<optimized out>, object=0x5649a040e510) at ../glib/gobject/gobject.c:1544
        nqueue = <optimized out>
        need_thaw = <optimized out>
        object_flags = <optimized out>
        needs_notify = 1
        in_init = <optimized out>
        __func__ = "g_object_notify_by_pspec"
#15 g_object_notify_by_pspec (object=0x5649a040e510, pspec=<optimized out>) at ../glib/gobject/gobject.c:1650
        __func__ = "g_object_notify_by_pspec"
#16 0x00007feadf9e33bb in gtk_main_do_event (event=<optimized out>) at ../gtk/gtk/gtkmain.c:1875
        window = 0x5649a040e510
        grab_widget = 0x5649a040e510
        window_group = 0x5649a08ff900
        rewritten_event = <optimized out>
        device = <optimized out>
        tmp_list = <optimized out>
        event_widget = <optimized out>
        topmost_widget = <optimized out>
        __func__ = "gtk_main_do_event"
#17 gtk_main_do_event (event=<optimized out>) at ../gtk/gtk/gtkmain.c:1691
        __func__ = "gtk_main_do_event"
#18 0x00007feadf744cc3 in _gdk_event_emit (event=0x5649a03e2700) at ../gtk/gdk/gdkevents.c:73
#19 _gdk_event_emit (event=0x5649a03e2700) at ../gtk/gdk/gdkevents.c:67
#20 0x00007feadf7738c8 in gdk_event_source_dispatch (base=<optimized out>, callback=<optimized out>, data=<optimized out>) at ../gtk/gdk/wayland/gdkeventsource.c:124
        source = <optimized out>
        display = <optimized out>
        event = 0x5649a03e2700
#21 0x00007feadf16f87b in g_main_dispatch (context=0x5649a03cd280) at ../glib/glib/gmain.c:3444
        dispatch = 0x7feadf7738a0 <gdk_event_source_dispatch>
        prev_source = 0x5649a03e2830
        begin_time_nsec = 6352334976965
        was_in_call = 2
        user_data = 0x0
        callback = 0x0
        cb_funcs = 0x0
        cb_data = 0x0
        need_destroy = <optimized out>
        source = 0x5649a03e2830
        current = 0x5649a03cd390
        i = 0
#22 g_main_context_dispatch (context=0x5649a03cd280) at ../glib/glib/gmain.c:4162
#23 0x000056499e783f08 in pgtk_read_socket (terminal=<optimized out>, hold_quit=0x7ffe0f9c0ee0) at pgtkterm.c:3839
        context = 0x5649a03cd280
        context_acquired = <optimized out>
        count = <optimized out>
        count = <optimized out>
#24 pgtk_read_socket (terminal=<optimized out>, hold_quit=0x7ffe0f9c0ee0) at pgtkterm.c:3818
        count = <optimized out>
#25 0x000056499e648d31 in gobble_input () at keyboard.c:7413
        nr = <optimized out>
        hold_quit = {kind = NO_EVENT, part = scroll_bar_nowhere, code = 0, modifiers = 0, x = 0x0, y = 0x0, timestamp = 0, frame_or_window = 0x0, arg = 0x0, device = 0x30}
        next = 0x0
        nread = 0
        err = false
        t = 0x5649a03a4288
#26 0x000056499e649115 in handle_async_input () at keyboard.c:7644
        nread = <optimized out>
#27 process_pending_signals () at keyboard.c:7658
#28 unblock_input_to (level=0) at keyboard.c:7673
#29 unblock_input_to (level=<optimized out>) at keyboard.c:7667
#30 0x000056499e649d5b in unblock_input () at keyboard.c:7692
        nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        timers = 0x5649a0057e73
        idle_timers = 0x5649a0057e03
        tem = 0x0
#31 timer_check () at keyboard.c:4738
        nexttime = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        timers = 0x5649a0057e73
        idle_timers = 0x5649a0057e03
        tem = 0x0
#32 0x000056499e64a355 in readable_events (flags=flags@entry=1) at keyboard.c:3520
#33 0x000056499e64a548 in get_input_pending (flags=flags@entry=1) at keyboard.c:7363
#34 0x000056499e64f408 in detect_input_pending_run_timers (do_display=do_display@entry=true) at keyboard.c:10893
        old_timers_run = <optimized out>
#35 0x000056499e72ced8 in wait_reading_process_output (time_limit=time_limit@entry=0, nsecs=nsecs@entry=0, read_kbd=read_kbd@entry=-1, do_display=<optimized out>, wait_for_cell=wait_for_cell@entry=0x0, wait_proc=wait_proc@entry=0x0, just_wait_proc=<optimized out>) at process.c:5779
        leave = false
        process_skipped = <optimized out>
        wrapped = <optimized out>
        channel_start = <optimized out>
        child_fd = <optimized out>
        last_read_channel = 18
        channel = <optimized out>
        nfds = <optimized out>
        Available = {fds_bits = {16, 0 <repeats 15 times>}}
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = true
        check_delay = <optimized out>
        no_avail = false
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 0, tv_nsec = 0}
        end_time = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        timer_delay = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        got_output_end_time = {tv_sec = 1669152744, tv_nsec = 622196508}
        wait = <optimized out>
        got_some_output = <optimized out>
        prev_wait_proc_nbytes_read = <optimized out>
        retry_for_async = <optimized out>
        count = {bytes = <optimized out>}
        now = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
#36 0x000056499e64aacc in kbd_buffer_get_event (end_time=0x0, used_mouse_menu=0x7ffe0f9c1c4b, kbp=<synthetic pointer>) at keyboard.c:3999
        do_display = <optimized out>
        obj = <optimized out>
        str = <optimized out>
        c = 0x0
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        kb = <optimized out>
        count = {bytes = <optimized out>}
#37 read_event_from_main_queue (end_time=<optimized out>, local_getcjmp=0x7ffe0f9c1940, used_mouse_menu=0x7ffe0f9c1c4b) at keyboard.c:2266
        c = 0x0
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        kb = <optimized out>
        count = {bytes = <optimized out>}
#38 0x000056499e650573 in read_decoded_event_from_main_queue (used_mouse_menu=<optimized out>, prev_event=<optimized out>, local_getcjmp=<optimized out>, end_time=<optimized out>) at keyboard.c:2329
        nextevt = <optimized out>
        frame = <optimized out>
        terminal = <optimized out>
        events = {0x80, 0x56499e6c4c2c <Fget_pos_property+908>, 0x0, 0x5649a0dca958, 0x2, 0x0, 0x300000080, 0x5649a0f7fca3, 0x5649a0dca95d, 0xce10, 0x300000000, 0x5649a0f7fca3, 0x0, 0x9bd0, 0x0, 0x3}
        n = 0
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {94874197109024, -3563864483271795924, 94874220774629, 0, 94874221143328, 140729160310144, 3564180304290913068, 7068858010357603116}, __mask_was_saved = 0, __saved_mask = {__val = {140729160309264, 94874231158595, 140729160309264, 94874231295328, 94874191034369, 140729160309216, 0, 94874231158595, 140729160309304, 94874231417181, 0, 0, 1, 2, 60, 0}}}}
        save_jump = {{__jmpbuf = {96, 0, 0, 36624, 94874231417181, 94874190548722, 0, 140646516155144}, __mask_was_saved = 0, __saved_mask = {__val = {94874190469145, 140646523924011, 94874190070880, 36624, 39888, 0, 8589934593, 154, 0, 0, 140729160309552, 0, 94874217241523, 6, 11384601093859441408, 0}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = true
        orig_kboard = 0x5649a03fe520
#39 read_char (commandflag=1, map=0x5649a0030693, prev_event=0x0, used_mouse_menu=0x7ffe0f9c1c4b, end_time=0x0) at keyboard.c:2960
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {94874197109024, -3563864483271795924, 94874220774629, 0, 94874221143328, 140729160310144, 3564180304290913068, 7068858010357603116}, __mask_was_saved = 0, __saved_mask = {__val = {140729160309264, 94874231158595, 140729160309264, 94874231295328, 94874191034369, 140729160309216, 0, 94874231158595, 140729160309304, 94874231417181, 0, 0, 1, 2, 60, 0}}}}
        save_jump = {{__jmpbuf = {96, 0, 0, 36624, 94874231417181, 94874190548722, 0, 140646516155144}, __mask_was_saved = 0, __saved_mask = {__val = {94874190469145, 140646523924011, 94874190070880, 36624, 39888, 0, 8589934593, 154, 0, 0, 140729160309552, 0, 94874217241523, 6, 11384601093859441408, 0}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = true
        orig_kboard = 0x5649a03fe520
#40 0x000056499e652b63 in read_key_sequence (keybuf=<optimized out>, prompt=0x0, dont_downcase_last=<optimized out>, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:10070
        interrupted_kboard = 0x5649a03fe520
        interrupted_frame = 0x5649a03a44e0
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = <optimized out>
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 0x5649a0030693
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {parent = 0x5649a02f5d73, map = 0x5649a02f5d73, start = 0, end = 0}
        keytran = {parent = 0x7fead218457b, map = 0x7fead218457b, start = 0, end = 0}
        indec = {parent = 0x5649a02f5d63, map = 0x5649a02f5d63, start = 0, end = 0}
        shift_translated = false
        delayed_switch_frame = 0x0
        original_uppercase = 0x0
        original_uppercase_position = -1
        dummyflag = false
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = <optimized out>
#41 0x000056499e654a15 in command_loop_1 () at keyboard.c:1376
        cmd = <optimized out>
        keybuf = {0x5649a1410c04, 0x3, 0x10680, 0x9dfe3a606d03fb00, 0xa0, 0x9dfe3a606d03fb00, 0x60, 0x0, 0x0, 0xe940, 0x5649a0dca95d, 0x56499e6d0ef2 <unbind_to+514>, 0x7ffe0f9c1e60, 0x0, 0x9, 0xe940, 0x30, 0x5649a0dca95d, 0x7fead19b6fa4, 0x5649a0030ab3, 0x60, 0x7ffe0f9c1e60, 0x56499ff09733, 0x7ffe0f9c1fd8, 0x7ffe0f9c36b2, 0x56499e647a21 <cmd_error+353>, 0x0, 0x0, 0x56499ff09000, 0x9dfe3a606d03fb00}
        i = <optimized out>
        prev_modiff = 0
        prev_buffer = 0x0
#42 0x000056499e6cfa67 in internal_condition_case (bfun=bfun@entry=0x56499e654850 <command_loop_1>, handlers=handlers@entry=0x90, hfun=hfun@entry=0x56499e6478c0 <cmd_error>) at eval.c:1474
        val = <optimized out>
        c = 0x56499ff9df80
#43 0x000056499e640396 in command_loop_2 (handlers=handlers@entry=0x90) at keyboard.c:1125
        val = <optimized out>
#44 0x000056499e6cf9c1 in internal_catch (tag=tag@entry=0xf810, func=func@entry=0x56499e640370 <command_loop_2>, arg=arg@entry=0x90) at eval.c:1197
        val = <optimized out>
        c = 0x56499ff95700
#45 0x000056499e640331 in command_loop () at keyboard.c:1103
#46 0x000056499e647442 in recursive_edit_1 () at keyboard.c:712
        val = <optimized out>
#47 0x000056499e6477d0 in Frecursive_edit () at keyboard.c:795
        buffer = <optimized out>
#48 0x000056499e5592d6 in main (argc=<optimized out>, argv=0x7ffe0f9c2228) at emacs.c:2516
        stack_bottom_variable = 0x6d5834980
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = <optimized out>
        sockfd = -1
(gdb) 

In GNU Emacs 29.0.50 (build 52, x86_64-pc-linux-gnu, GTK+ Version
 3.24.34, cairo version 1.17.6) of 2022-11-21 built on KRONOS
Repository revision: f176a36f4629b56c9fd9e3fc15aebd04a168c4f5
Repository branch: HEAD
System Description: Manjaro Linux

Configured using:
 'configure --without-modules --without-libotf --without-m17n-flt
 --without-gconf --with-pgtk --with-sound=no --without-gpm
 --with-native-compilation --without-gsettings --without-libsystemd
 --without-sqlite3 --without-xim --with-xwidgets
 --without-compress-install --prefix=/home/german/.local/emacs'

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS HARFBUZZ JPEG JSON LCMS2
LIBXML2 NATIVE_COMP NOTIFY INOTIFY PDUMPER PGTK PNG RSVG SECCOMP THREADS
TIFF TOOLKIT_SCROLL_BARS WEBP XIM XWIDGETS GTK3 ZLIB

Important settings:
  value of $LC_MONETARY: es_AR.UTF-8
  value of $LC_NUMERIC: es_AR.UTF-8
  value of $LC_TIME: es_AR.UTF-8
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  savehist-mode: t
  popper-mode: t
  electric-pair-mode: t
  vertico-mode: t
  minibuffer-depth-indicate-mode: t
  delete-selection-mode: t
  global-so-long-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  window-divider-mode: t
  line-number-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
/home/german/.emacs.d/elpa/transient-0.3.7/transient hides /home/german/.local/emacs/share/emacs/29.0.50/lisp/transient

Features:
(shadow sort mail-extr emacsbug message mailcap yank-media puny dired
dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg rfc6068
epg-config gnus-util text-property-search time-date mm-decode mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils orderless
savehist popper comp comp-cstr subr-x rx cl-seq cl-macs gv cl-extra
help-mode bytecomp byte-compile elec-pair vertico mb-depth delsel
xah-fly-keys g3r-dark-theme info vertico-autoloads
embark-consult-autoloads consult-autoloads embark-autoloads
popper-autoloads helpful-autoloads f-autoloads orderless-autoloads
elisp-refs-autoloads s-autoloads compat-autoloads magit-autoloads
magit-section-autoloads git-commit-autoloads with-editor-autoloads
transient-autoloads dash-autoloads warnings icons so-long cl-loaddefs
cl-lib rmc iso-transl tooltip cconv eldoc paren electric uniquify
ediff-hook vc-hooks lisp-float-type elisp-mode mwheel term/pgtk-win
pgtk-win term/common-win pgtk-dnd tool-bar dnd fontset image regexp-opt
fringe tabulated-list replace newcomment text-mode lisp-mode prog-mode
register page tab-bar menu-bar rfn-eshadow isearch easymenu timer select
scroll-bar mouse jit-lock font-lock syntax font-core term/tty-colors
frame minibuffer nadvice seq simple cl-generic indonesian philippine
cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese composite emoji-zwj charscript
charprop case-table epa-hook jka-cmpr-hook help abbrev obarray oclosure
cl-preloaded button loaddefs theme-loaddefs faces cus-face macroexp
files window text-properties overlay sha1 md5 base64 format env
code-pages mule custom widget keymap hashtable-print-readable backquote
threads xwidget-internal dbusbind inotify dynamic-setting
font-render-setting cairo gtk pgtk lcms2 multi-tty make-network-process
native-compile emacs)

Memory information:
((conses 16 99056 66894)
 (symbols 48 8575 6)
 (strings 32 26491 9376)
 (string-bytes 1 833390)
 (vectors 16 16047)
 (vector-slots 8 290226 130864)
 (floats 8 51 277)
 (intervals 56 385 78)
 (buffers 984 11))

-- 
German Pacenza