Subject: bug#6988: 23.2; crash using compose-region under X

From: Tor Kinlok <[email-masked]>
Date: Sun, 05 Sep 2010 15:56:22 -0400

Starting a no-toolkit (ie ./configure --with-x-toolkit=no) emacs 23.2.1
under X windows and then doing a compose-region on a null string results
in a crash.  Something similar was reported by Johan Bockgård in 2006
and a fix applied at that time:

http://www.mail-archive.com/[email-masked]/msg05765.html

Following the same procedure from the old report causes the same results:

>$ emacs -Q
> Insert
>     (compose-region 1 2 "")
> in the *scratch* buffer and evaluate it.
> Emacs crashes during redisplay:

The emacs in question:

In GNU Emacs 23.2.1 (i686-pc-linux-gnu)
 of 2010-09-05
Windowing system distributor `The X.Org Foundation', version 11.0.10706000
configured using `configure  '--with-x-toolkit=no''

As requested, here is the gdb output:

GNU gdb (GDB) 7.1-ubuntu
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i486-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from <path deleted>/emacs-23.2/src/emacs...done.
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not from terminal]
DISPLAY = :0.0
TERM = xterm
Breakpoint 1 at 0x8103a66: file emacs.c, line 431.
Temporary breakpoint 2 at 0x81217d9: file sysdep.c, line 1134.
(gdb) run -Q
Starting program: <path deleted>/emacs-23.2/src/emacs -Q

Program received signal SIGSEGV, Segmentation fault.
set_glyph_string_background_width (s=0x838aca0, start=1, last_x=665)
    at xdisp.c:19970
19970	  if (start == s->row->used[s->area]
(gdb) bt full
#0  set_glyph_string_background_width (s=0x838aca0, start=1, last_x=665)
    at xdisp.c:19970
No locals.
#1  0x08069412 in draw_glyphs (w=<value optimized out>, x=<value optimized out>, 
    row=<value optimized out>, area=TEXT_AREA, start=<value optimized out>, 
    end=1, hl=DRAW_NORMAL_TEXT, overlaps=0) at xdisp.c:20297
        first_glyph = <value optimized out>
        head = 0x0
        tail = 0x0
        s = 0x838aca0
        clip_head = 0x878b6c0
        clip_tail = <value optimized out>
        i = <value optimized out>
        j = <value optimized out>
        x_reached = <value optimized out>
        last_x = 665
        area_left = 25
#2  0x0806c3d1 in x_write_glyphs (start=0x870e960, len=1) at xdisp.c:21866
        x = <value optimized out>
#3  0x08056f3c in update_text_area (w=<value optimized out>, 
    vpos=<value optimized out>, mouse_face_overwritten_p=<value optimized out>)
    at dispnew.c:4595
        can_skip_p = 1
        stop = 77
        i = 1
        desired_glyph = 0x870e980
        desired_stop_pos = <value optimized out>
        abort_skipping = 0
        x = <value optimized out>
        current_glyph = 0x8697288
        changed_p = 0
#4  update_window_line (w=<value optimized out>, vpos=<value optimized out>, 
    mouse_face_overwritten_p=<value optimized out>) at dispnew.c:4696
        current_row = 0x870d360
        desired_row = <value optimized out>
        rif = 0x81f7320
        changed_p = 0
#5  0x0805893c in update_window (w=<value optimized out>, force_p=0)
    at dispnew.c:4311
        i = <value optimized out>
        end = <value optimized out>
        header_line_row = 0x0
        changed_p = 0
        mouse_face_overwritten_p = 0
        row = 0x86d3648
        yb = 527
        desired_matrix = 0x86df2b0
        paused_p = 141380216
        rif = 0x81f7320
#6  0x08059a7a in update_window_tree (w=0x86a8c00, force_p=0) at dispnew.c:4004
        paused_p = <value optimized out>
#7  0x0805a15d in update_frame (f=0x86a8a80, force_p=0, inhibit_hairy_id_p=0)
    at dispnew.c:3931
        paused_p = <value optimized out>
        root_window = 0x86a8c00
#8  0x0808d0f1 in redisplay_internal (preserve_echo_area=<value optimized out>)
    at xdisp.c:11826
        f = 0x86a8a80
        tail = <value optimized out>
        frame = <value optimized out>
        w = 0x86a8c00
        pause = 0
        must_finish = 1
        number_of_visible_frames = <value optimized out>
        polling_stopped_here = 0
        old_frame = 141200005
        consider_all_windows_p = <value optimized out>
#9  0x081117d0 in read_char (commandflag=1, nmaps=2, maps=0xbfffecf0, 
    prev_event=138238154, used_mouse_menu=0xbfffeda4, end_time=0x0)
    at keyboard.c:2727
        c = <value optimized out>
        local_getcjmp = {{
            __jmpbuf = {856, 8192, 0, 138238154, -1, -1073747012}, 
            __mask_was_saved = 138264008, 
            __saved_mask = {
              __val = {3221220520, 135717833, 138266458, 860, 138264013, 
                3221220032, 3221220036, 3, 3221159936, 1329340160, 138338370, 
                138238154, 138238154, 138238154, 138338370, 141311961, 
                3221220024, 135744233, 4, 3221220032, 138238154, 138238154, 
                138338370, 141311961, 3221220168, 135326670, 138264013, 860, 
                3221220488, 136083518, 138264008, 0}
            }
          }}
        save_jump = {{
            __jmpbuf = {860, 0, 0, 5, 138264013, 138238154}, 
            __mask_was_saved = -1073747128, 
            __saved_mask = {
              __val = {136060187, 138386618, 140795966, 3221220168, 136082773, 
                138448456, 215, 1, 138238154, 3221220080, 3221220240, 0, 
                138264013, 215, 860, 3221220200, 136060368, 138238154, 
                138386618, 1, 138264013, 138264013, 138264013, 3221220264, 
                136083085, 138238154, 138386618, 138264013, 3221220452, 
                3221220288, 138264008, 0}
            }
          }}
        key_already_recorded = 0
        tem = <value optimized out>
        save = <value optimized out>
        previous_echo_area_message = 138238154
        also_record = 138238154
        reread = 0
        polling_stopped_here = <value optimized out>
        orig_kboard = 0x85049c8
#10 0x08113a95 in read_key_sequence (keybuf=<value optimized out>, 
    bufsize=<value optimized out>, prompt=<value optimized out>, 
    dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1)
    at keyboard.c:9512
        interrupted_kboard = 0x85049c8
        key = <value optimized out>
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 138238154
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 2
        nmaps_allocated = 2
        defs = 0xbfffecd0
        submaps = 0xbfffecf0
        orig_local_map = 140732902
        orig_keymap = 138238154
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
          parent = 140744710, 
          map = 140744710, 
          start = 0, 
          end = 0
        }
        keytran = {
          parent = 138231526, 
          map = 138231526, 
          start = 0, 
          end = 0
        }
        indec = {
          parent = 140748774, 
          map = 140748774, 
          start = 0, 
          end = 0
        }
        shift_translated = 0
        delayed_switch_frame = 138238154
        original_uppercase = 3
        original_uppercase_position = -1
        starting_buffer = <value optimized out>
        fake_prefixed_keys = 138238154
#11 0x08115deb in command_loop_1 () at keyboard.c:1643
        cmd = <value optimized out>
        lose = <value optimized out>
        keybuf = {108, 480, 140419466, -1207963660, -1212016252, 13, 
          -1073746180, -1208041370, -1073746248, -1212798922, 140889116, 
          -1210620984, -1212735500, 8, 0, -1073746264, -1073746448, 0, 
          -1208025088, 138238154, 139140290, 1329340160, -1211994624, 
          -1213016484, -1472036457, 139008584, 139008584, 139008600, 
          -1073746200, 135310243}
        i = <value optimized out>
        prev_modiff = 18
        prev_buffer = 0x83dbdc8
        already_adjusted = 0
#12 0x08173c61 in internal_condition_case (bfun=0x8115c10 <command_loop_1>, 
    handlers=138276114, hfun=0x810e0a0 <cmd_error>) at eval.c:1490
        val = 137931936
        c = {
          tag = 138238154, 
          val = 138238154, 
          next = 0xbffff028, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {139008584, 139008584, 139008600, -1073745944, 
                -1168840485, 1810975668}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {176, 880, 20, 152, 3084196595, 3084346360, 0, 
                  3221221344, 3221221272, 3221221284, 3, 3087005944, 0, 
                  3083389358, 3084346352, 134531515, 3084346304, 0, 3221221272, 
                  3083399068, 3084347120, 138341448, 0, 191, 1544, 0, 
                  3082972672, 3085720248, 3084196595, 4294967295, 3087003636, 
                  134531515}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
        h = {
          handler = 138276114, 
          var = 138238154, 
          chosen_clause = 134526120, 
          tag = 0xbfffef04, 
          next = 0x0
        }
#13 0x0810d585 in command_loop_2 () at keyboard.c:1360
        val = 137931936
#14 0x08173d41 in internal_catch (tag=138273186, 
    func=0x810d560 <command_loop_2>, arg=138238154) at eval.c:1226
        c = {
          tag = 138273186, 
          val = 138238154, 
          next = 0x0, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {139008584, 139008584, 139008600, -1073745672, 
                -1167513381, 1811100596}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {48, 2, 0, 3084346304, 96, 3084346352, 3084341236, 
                  3084346304, 10, 3221221528, 138264008, 138238154, 138405496, 
                  3221221592, 135682500, 138405498, 138403451, 138238154, 
                  138264008, 41, 3083389358, 3084346304, 138340688, 0, 
                  138340688, 3221221672, 138238178, 3084346424, 14, 3221221708, 
                  138405498, 138238154}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
#15 0x0810deef in command_loop () at keyboard.c:1339
No locals.
#16 0x0810e29a in recursive_edit_1 () at keyboard.c:954
        val = <value optimized out>
#17 0x0810e3c2 in Frecursive_edit () at keyboard.c:1016
        buffer = 138238154
#18 0x081048ad in main (argc=<value optimized out>, argv=<value optimized out>)
    at emacs.c:1833
        dummy = -1073744760
        stack_bottom_variable = 8 '\b'
        do_initial_setlocale = 139008584
        skip_args = 0
        rlim = {
          rlim_cur = 8388608, 
          rlim_max = 18446744073709551615
        }
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
(gdb) xbacktrace
(gdb) cont
Continuing.
Fatal error (11)
Program received signal SIGSEGV, Segmentation fault.
0xb7fe2430 in __kernel_vsyscall ()
(gdb) cont
Continuing.

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
(gdb) quit

-- 
Sent using GNU Emacs