GNU bug report logs - #74902
31.0.50; Segfault when deleting frames

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 74902 in the body.
You can then email your comments to 74902 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Steven Allen <steven <at> stebalien.com>
To: bug-gnu-emacs <at> gnu.org
Subject: 31.0.50; Segfault when deleting frames
Date: Sun, 15 Dec 2024 14:01:17 -0800

I use EXWM and, Emacs very occasionally seems to crash when closing
floating windows. Specifically, it crashes when deleting the frame
wrapping the floating window. Unfortunately, I don't have a great way to
reproduce it with a minimal setup or to reproduce it reliably enough to
grab a trace with GDB.

As far as I can tell, this is because `delete-frame' calls `delq' (from
C) which then handles a signal (not sure what signal) via the
`FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
eventually calls `gobble_input' which operates on frames.


Backtrace:

    /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
    /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
    /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
    /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
    /usr/bin/emacs(+0xeff78) [0x61e779237f78]
    /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
    /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
    /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
    /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
    /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
    /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
    /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
    /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
    /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]
    /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-9789f41c/preloaded/window-0d1b8b93-5fc421c3.eln(F77696e646f772d2d64656c657465_window__delete_0+0xf6) [0x7e3a500879e6]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-9789f41c/preloaded/window-0d1b8b93-5fc421c3.eln(F7265706c6163652d6275666665722d696e2d77696e646f7773_replace_buffer_in_windows_0+0x2fb) [0x7e3a5008893b]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/emacs(Fkill_buffer+0x179) [0x61e779367229]
    /home/steb/.config/emacs/eln-cache/31.0.50-9789f41c/exwm-manage-481a2a54-f343330e.eln(F616e6f6e796d6f75732d6c616d626461_anonymous_lambda_20+0x72) [0x7e3a48615462]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/emacs(Fapply+0x464) [0x61e7793ec0f4]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-9789f41c/preloaded/timer-3ee7cfd9-4017b895.eln(F74696d65722d6576656e742d68616e646c6572_timer_event_handler_0+0x408) [0x7e3a4fa48468]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/emacs(timer_check+0x4de) [0x61e779331bce]
    /usr/bin/emacs(+0x3d325b) [0x61e77951b25b]
    /usr/bin/emacs(read_char+0x1c8f) [0x61e779339e0f]
    /usr/bin/emacs(+0x3c4c9e) [0x61e77950cc9e]
    /usr/bin/emacs(+0x1e60e3) [0x61e77932e0e3]
    /usr/bin/emacs(internal_condition_case+0x77) [0x61e7793eb237]
    /usr/bin/emacs(command_loop_2+0x2f) [0x61e77932d45f]
    /usr/bin/emacs(internal_catch+0x46) [0x61e7793eb176]
    /usr/bin/emacs(+0x1e58cb) [0x61e77932d8cb]
    /usr/bin/emacs(recursive_edit_1+0xf6) [0x61e77932da86]
    /usr/bin/emacs(Frecursive_edit+0x110) [0x61e77932dd30]
    /usr/bin/emacs(main+0x298b) [0x61e7791b9ecb]
    /usr/lib/libc.so.6(+0x2618e) [0x7e3a544c018e]
    /usr/lib/libc.so.6(__libc_start_main+0x8a) [0x7e3a544c024a]
    /usr/bin/emacs(_start+0x25) [0x61e7791ba695]

In GNU Emacs 31.0.50 (build 1, x86_64-pc-linux-gnu, cairo version
 1.18.2) of 2024-12-07 built on Laptop
Repository revision: 6f6b641975e4828f96913b29b1476c6323c952d8
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.12101014
System Description: Arch Linux

Configured using:
 'configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/lib
 --localstatedir=/var --mandir=/usr/share/man --with-gameuser=:games
 --with-modules --without-m17n-flt --without-selinux --without-pop
 --without-gconf --disable-gc-mark-trace --enable-link-time-optimization
 --with-native-compilation=yes --with-xinput2 --with-x-toolkit=no
 --without-toolkit-scroll-bars --without-xft --without-xaw3d
 --without-gsettings --with-cairo-xcb --with-sound=no --with-tree-sitter
 --without-gpm --without-compress-install
 '--program-transform-name=s/\([ec]tags\)/\1.emacs/'
 'CFLAGS=-march=native -mtune=native -O3 -pipe -fno-plt -fexceptions
 -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security
 -fstack-clash-protection -fcf-protection -fomit-frame-pointer
 -fno-math-errno -fno-trapping-math -fno-math-errno -fno-trapping-math
 -flto=auto' 'LDFLAGS=-Wl,-O1 -Wl,--sort-common -Wl,--as-needed
 -Wl,-z,relro -Wl,-z,now -Wl,-z,pack-relative-relocs -flto=auto''

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS HARFBUZZ JPEG LCMS2 LIBOTF
LIBSYSTEMD LIBXML2 MODULES NATIVE_COMP NOTIFY INOTIFY OLDXMENU PDUMPER
PNG RSVG SECCOMP SQLITE3 THREADS TIFF TREE_SITTER WEBP X11 XDBE XIM
XINPUT2 XPM ZLIB

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: journalctl

Minor modes in effect:
  notmuch-bookmarks-mode: t
  windmove-mode: t
  global-atomic-chrome-edit-mode: t
  iwd-agent-mode: t
  i3bar-mode: t
  ednc-mode: t
  exwm-xsettings-mode: t
  exwm-background-mode: t
  exwm-systemtray-mode: t
  exwm-randr-mode: t
  auto-compile-on-load-mode: t
  auto-compile-on-save-mode: t
  save-place-mode: t
  savehist-mode: t
  openwith-mode: t
  org-super-agenda-mode: t
  global-org-modern-mode: t
  eat-eshell-mode: t
  magit-todos-mode: t
  global-git-commit-mode: t
  magit-auto-revert-mode: t
  server-mode: t
  recentf-mode: t
  global-treesit-auto-mode: t
  editorconfig-mode: t
  yas-global-mode: t
  yas-minor-mode: t
  async-bytecomp-package-mode: t
  sudo-edit-indicator-mode: t
  global-auto-revert-mode: t
  vertico-mode: t
  corfu-popupinfo-mode: t
  global-corfu-mode: t
  corfu-mode: t
  minibuffer-depth-indicate-mode: t
  minibuffer-electric-default-mode: t
  isearch-mb-mode: t
  pixel-scroll-precision-mode: t
  global-hl-todo-mode: t
  all-the-icons-completion-mode: t
  marginalia-mode: t
  visual-replace-global-mode: t
  global-jinx-mode: t
  evil-goggles-mode: t
  global-evil-surround-mode: t
  evil-surround-mode: t
  global-evil-collection-unimpaired-mode: t
  evil-collection-unimpaired-mode: t
  evil-mode: t
  evil-local-mode: t
  desktop-environment-mode: t
  global-eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tab-bar-history-mode: t
  tab-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  window-divider-mode: t
  minibuffer-regexp-mode: t
  column-number-mode: t
  line-number-mode: t
  visual-line-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
/home/steb/.cache/emacs/elpa/filechooser-0.2.1/filechooser hides /usr/share/emacs/site-lisp/filechooser
/home/steb/.cache/emacs/elpa/filechooser-0.2.1/filechooser-autoloads hides /usr/share/emacs/site-lisp/filechooser-autoloads
/home/steb/.cache/emacs/elpa/protobuf-mode-20240823.1417/protobuf-mode hides /usr/share/emacs/site-lisp/protobuf-mode
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch hides /usr/share/emacs/site-lisp/notmuch
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-wash hides /usr/share/emacs/site-lisp/notmuch-wash
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-tree hides /usr/share/emacs/site-lisp/notmuch-tree
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-tag hides /usr/share/emacs/site-lisp/notmuch-tag
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-show hides /usr/share/emacs/site-lisp/notmuch-show
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-query hides /usr/share/emacs/site-lisp/notmuch-query
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-print hides /usr/share/emacs/site-lisp/notmuch-print
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-parser hides /usr/share/emacs/site-lisp/notmuch-parser
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-mua hides /usr/share/emacs/site-lisp/notmuch-mua
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-message hides /usr/share/emacs/site-lisp/notmuch-message
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-maildir-fcc hides /usr/share/emacs/site-lisp/notmuch-maildir-fcc
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-lib hides /usr/share/emacs/site-lisp/notmuch-lib
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-jump hides /usr/share/emacs/site-lisp/notmuch-jump
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-hello hides /usr/share/emacs/site-lisp/notmuch-hello
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-draft hides /usr/share/emacs/site-lisp/notmuch-draft
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-crypto hides /usr/share/emacs/site-lisp/notmuch-crypto
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-compat hides /usr/share/emacs/site-lisp/notmuch-compat
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-company hides /usr/share/emacs/site-lisp/notmuch-company
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-address hides /usr/share/emacs/site-lisp/notmuch-address
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/coolj hides /usr/share/emacs/site-lisp/coolj
/home/steb/.cache/emacs/elpa/modus-themes-4.6.0/theme-loaddefs hides /usr/share/emacs/31.0.50/lisp/theme-loaddefs

Features:
(shadow sort mail-extr emacsbug mule-util tramp-cmds cc-mode cc-fonts
cc-guess cc-menus cc-cmds consult-xref evil-collection-eglot eglot
external-completion jsonrpc evil-collection-ert ert ewoc
evil-collection-debug debug backtrace rainbow-delimiters vc
evil-collection-flymake flymake c++-ts-mode c-ts-mode c-ts-common
evil-collection-consult consult magit-bookmark org-bookmark-heading
notmuch-bookmarks evil-collection-bookmark bookmark texinfo
texinfo-loaddefs evil-collection-vc-git vc-git vc-dispatcher misearch
multi-isearch vertico-repeat windmove journalctl bash-completion
eshell-syntax-highlighting em-elecslash em-glob em-extpipe em-basic
em-alias pinentry evil-collection-atomic-chrome atomic-chrome websocket
bindat let-alist iwd i3bar ednc filechooser dbus exwm-xsettings
xcb-xsettings exwm-background exwm-systemtray xcb-systemtray xcb-xembed
exwm-randr xcb-randr exwm exwm-input xcb-keysyms xcb-xkb exwm-manage
exwm-floating xcb-cursor xcb-render exwm-layout exwm-workspace exwm-core
xcb-ewmh xcb-icccm xcb xcb-xproto xcb-types xcb-debug cus-start posframe
visual-wrap face-remap visual-fill-column ligature evil-org corg
org-appear ws-butler oc-basic bibtex ol-man ol-info ol-docview
evil-collection-doc-view doc-view jka-compr evil-collection-image
image-mode exif auto-compile show-font saveplace tramp-cache time-stamp
savehist openwith org-super-agenda ts ht org-habit org-crypt
org-protocol ox-typst ox-odt rng-loc rng-uri rng-parse rng-match rng-dt
rng-util rng-pttrn nxml-parse nxml-ns nxml-enc xmltok nxml-util ox-latex
ox-icalendar evil-org-agenda org-agenda ox-html table ox-ascii
ox-publish ox org-attach org-element org-persist org-id org-refile
org-element-ast inline avl-tree ob-http ob-http-mode org-modern ob-dot
ob-latex ob-python evil-collection-python python ob-gnuplot ob-calc
calc-store calc-trail calc-ext evil-collection-calc calc calc-loaddefs
calc-macs ob-shell evil-collection-org org ob ob-tangle ob-ref ob-lob
ob-table ob-exp org-macro evil-collection-xref xref org-src
evil-collection-sh-script sh-script smie executable ob-comint
org-pcomplete org-list org-footnote org-faces org-entities
evil-collection-outline noutline outline ob-emacs-lisp ob-core ob-eval
org-cycle org-table ol org-fold org-fold-core org-keys oc org-loaddefs
org-compat org-version org-macs notmuch-addr evil-collection-notmuch
notmuch notmuch-tree notmuch-jump notmuch-hello notmuch-show
notmuch-print notmuch-crypto notmuch-mua notmuch-message notmuch-draft
notmuch-maildir-fcc notmuch-address notmuch-company notmuch-parser
notmuch-wash coolj goto-addr icalendar diary-lib diary-loaddefs
evil-collection-calendar cal-menu calendar cal-loaddefs notmuch-tag
notmuch-lib notmuch-compat hl-line mm-view mml-smime smime gnutls dig
eshell-prompt-extras em-dirs em-ls em-prompt em-hist em-unix em-pred
esh-mode esh-var evil-collection-eat eat evil-collection-term term
disp-table ehelp eshell esh-cmd generator esh-ext esh-proc esh-opt
esh-io esh-arg esh-module esh-module-loaddefs esh-util forge-core
forge-db closql emacsql-sqlite emacsql emacsql-compiler eieio-base
evil-collection-magit-todos magit-todos pcre2el rxt advice re-builder
evil-collection-grep grep evil-collection-compile compile pcase
evil-collection-magit magit-submodule magit-blame magit-stash
magit-reflog magit-bisect magit-push magit-pull magit-fetch magit-clone
magit-remote magit-commit magit-sequence magit-notes magit-worktree
magit-tag magit-merge magit-branch magit-reset magit-files magit-refs
magit-status magit evil-collection-magit-repos magit-repos magit-apply
magit-wip magit-log which-func evil-collection-imenu imenu magit-diff
evil-collection-smerge-mode smerge-mode diff diff-mode track-changes
git-commit evil-collection-log-edit log-edit message sendmail yank-media
puny evil-collection-dired dired dired-loaddefs rfc822 mml mml-sec
evil-collection-epa epa derived epg rfc6068 epg-config gnus-util
text-property-search mm-decode mm-bodies mm-encode mail-parse rfc2231
rfc2047 rfc2045 mm-util ietf-drums mail-prsvr mailabbrev mail-utils
gmm-utils mailheader pcvs-util add-log magit-core magit-autorevert
magit-margin magit-transient magit-process evil-collection-with-editor
with-editor server magit-mode transient benchmark magit-git magit-base
evil-collection-magit-section magit-section cursor-sensor crm tramp-sh
recentf tree-widget easy-mmode treesit-auto editorconfig
editorconfig-core editorconfig-core-handle editorconfig-fnmatch
yasnippet async-bytecomp async sudo-edit tramp trampver
tramp-integration files-x tramp-message tramp-compat shell pcomplete
evil-collection-comint comint ansi-osc parse-time iso8601 time-date
format-spec ansi-color tramp-loaddefs autorevert filenotify project
vertico corfu-popupinfo evil-collection-corfu corfu orderless mb-depth
minibuf-eldef isearch-mb pixel-scroll cua-base hl-todo
all-the-icons-completion all-the-icons all-the-icons-faces
all-the-icons-data-material-icons
all-the-icons-data-fluentui-system-icons
all-the-icons-data-fontawesome-4 all-the-icons-data-weather-icons
all-the-icons-data-vscode-codicons all-the-icons-data-octicons
all-the-icons-data-mfixx all-the-icons-data-file-icons
all-the-icons-data-devopicons all-the-icons-data-alltheicons svg dom xml
marginalia modus-vivendi-theme modus-themes visual-replace ispell jinx
evil-goggles pulse color evil-textobj-tree-sitter
evil-textobj-tree-sitter-thing-at-point evil-textobj-tree-sitter-core
treesit evil-args evil-surround evil-collection-unimpaired
evil-collection-tabulated-list evil-collection-tab-bar
evil-collection-simple evil-collection-replace
evil-collection-process-menu evil-collection-package-menu
evil-collection-kmacro evil-collection-info evil-collection-indent
evil-collection-help evil-collection-elisp-mode evil-collection-eldoc
evil-collection-custom evil-collection-buff-menu evil-collection
annalist evil evil-integration evil-maps evil-commands reveal evil-jumps
evil-command-window evil-types evil-search evil-ex evil-macros
evil-repeat evil-states evil-core comp-run evil-common thingatpt rect
evil-vars ring edmacro kmacro general f dash s mode-local find-func
no-littering compat finder-inf notmuch-version info
all-the-icons-completion-autoloads all-the-icons-dired-autoloads
all-the-icons-ibuffer-autoloads all-the-icons-autoloads
app-launcher-autoloads aria2-autoloads atomic-chrome-autoloads
auto-compile-autoloads bash-completion-autoloads bluetooth-autoloads
buffer-move-autoloads calibre-autoloads cape-autoloads casual-autoloads
clojure-mode-autoloads comint-mime-autoloads consult-eglot-autoloads
consult-project-extra-autoloads corfu-autoloads corg-autoloads
csv-mode-autoloads dape-autoloads devdocs-autoloads
dired-filter-autoloads dired-hacks-utils-autoloads dired-k-autoloads
discomfort-autoloads debase-autoloads disk-usage-autoloads eat-autoloads
edit-indirect-autoloads ednc-autoloads eff-autoloads
embark-consult-autoloads consult-autoloads embark-autoloads
ement-autoloads eshell-prompt-extras-autoloads
eshell-syntax-highlighting-autoloads evil-args-autoloads
evil-collection-autoloads annalist-autoloads evil-goggles-autoloads
evil-nerd-commenter-autoloads evil-org-autoloads evil-surround-autoloads
evil-textobj-tree-sitter-autoloads evm-mode-autoloads
expand-region-autoloads exwm-autoloads filechooser-autoloads
flymake-ruff-autoloads forge-search-autoloads general-autoloads
git-link-autoloads git-modes-autoloads gnuplot-autoloads gptel-autoloads
graphviz-dot-mode-autoloads helpful-autoloads elisp-refs-autoloads
htmlize-autoloads i3bar-autoloads igist-autoloads info-colors-autoloads
isearch-mb-autoloads iwd-autoloads iwindow-autoloads jinx-autoloads
journalctl-autoloads kotlin-mode-autoloads kubernetes-evil-autoloads
evil-autoloads goto-chg-autoloads kubernetes-autoloads
ligature-autoloads link-hint-autoloads avy-autoloads
magit-popup-autoloads magit-todos-autoloads hl-todo-autoloads
f-autoloads marginalia-autoloads mastodon-autoloads mathjax-autoloads
microdata-autoloads modus-themes-autoloads named-pipe-autoloads
nftables-mode-autoloads no-littering-autoloads notmuch-addr-autoloads
notmuch-transient-autoloads nov-autoloads esxml-autoloads kv-autoloads
ob-http-autoloads ol-notmuch-autoloads notmuch-autoloads
openwith-autoloads orderless-autoloads org-appear-autoloads
org-bookmark-heading-autoloads org-download-autoloads async-autoloads
org-modern-autoloads org-super-agenda-autoloads ht-autoloads
orgit-forge-autoloads orgit-autoloads forge-autoloads
markdown-mode-autoloads magit-autoloads ghub-autoloads closql-autoloads
emacsql-autoloads ox-typst-autoloads package-lint-flymake-autoloads
package-lint-autoloads password-store-autoloads pcre2el-autoloads
pdf-tools-autoloads persist-autoloads pinentry-autoloads
pkgbuild-mode-autoloads playerctl-autoloads plz-autoloads
posframe-autoloads proced-narrow-autoloads protobuf-mode-autoloads
pulseaudio-control-autoloads qrencode-autoloads
rainbow-delimiters-autoloads rainbow-mode-autoloads request-autoloads
rg-autoloads rmsbolt-autoloads rust-playground-autoloads
show-font-autoloads solidity-mode-autoloads ssh-config-mode-autoloads
sudo-edit-autoloads svg-lib-autoloads syncthing-autoloads
systemctl-autoloads systemd-autoloads tablist-autoloads
taxy-magit-section-autoloads taxy-autoloads magit-section-autoloads
tmr-autoloads tp-autoloads treepy-autoloads treesit-auto-autoloads
ts-autoloads s-autoloads dash-autoloads tzc-autoloads
udev-mode-autoloads vala-mode-autoloads cc-styles cc-align cc-engine
cc-vars cc-defs varuga-autoloads vertico-autoloads vimrc-mode-autoloads
visual-fill-column-autoloads visual-replace-autoloads vundo-autoloads
wat-ts-mode-autoloads watch-autoloads web-mode-autoloads
websocket-autoloads wgrep-autoloads whisper-autoloads
with-editor-autoloads ws-butler-autoloads xelb-autoloads yaml-autoloads
yasnippet-autoloads comp comp-cstr cl-extra help-mode comp-common
warnings rx xdg package browse-url url url-proxy url-privacy url-expand
url-methods url-history url-cookie generate-lisp-file url-domsuf
url-util mailcap url-handlers url-parse auth-source cl-seq eieio
eieio-core cl-macs password-cache json subr-x map byte-opt gv bytecomp
byte-compile url-vars cus-edit pp cus-load icons wid-edit cl-loaddefs
cl-lib rmc iso-transl tooltip cconv eldoc paren electric uniquify
ediff-hook vc-hooks lisp-float-type elisp-mode mwheel term/x-win x-win
term/common-win x-dnd touch-screen tool-bar dnd fontset image regexp-opt
fringe tabulated-list replace newcomment text-mode lisp-mode prog-mode
register page tab-bar menu-bar rfn-eshadow isearch easymenu timer select
scroll-bar mouse jit-lock font-lock syntax font-core term/tty-colors
frame minibuffer nadvice seq simple cl-generic indonesian philippine
cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese composite emoji-zwj charscript
charprop case-table epa-hook jka-cmpr-hook help abbrev obarray oclosure
cl-preloaded button loaddefs theme-loaddefs faces cus-face macroexp
files window text-properties overlay sha1 md5 base64 format env
code-pages mule custom widget keymap hashtable-print-readable backquote
threads dbusbind inotify lcms2 dynamic-setting font-render-setting cairo
xinput2 x multi-tty move-toolbar make-network-process native-compile
emacs)

Memory information:
((conses 16 1395639 980414) (symbols 48 71688 3) (strings 32 377983 67952) (string-bytes 1 11865296)
 (vectors 16 132134) (vector-slots 8 1522623 421201) (floats 8 742 4321) (intervals 56 43580 33010)
 (buffers 992 35))

Message #8 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Steven Allen <steven <at> stebalien.com>
Cc: 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Mon, 16 Dec 2024 17:50:01 +0200

> Date: Sun, 15 Dec 2024 14:01:17 -0800
> From:  Steven Allen via "Bug reports for GNU Emacs,
>  the Swiss army knife of text editors" <bug-gnu-emacs <at> gnu.org>
> 
> 
> I use EXWM and, Emacs very occasionally seems to crash when closing
> floating windows. Specifically, it crashes when deleting the frame
> wrapping the floating window. Unfortunately, I don't have a great way to
> reproduce it with a minimal setup or to reproduce it reliably enough to
> grab a trace with GDB.
> 
> As far as I can tell, this is because `delete-frame' calls `delq' (from
> C) which then handles a signal (not sure what signal) via the
> `FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
> eventually calls `gobble_input' which operates on frames.
> 
> 
> Backtrace:
> 
>     /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
>     /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
>     /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
>     /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
>     /usr/bin/emacs(+0xeff78) [0x61e779237f78]
>     /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
>     /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
>     /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
>     /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
>     /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
>     /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
>     /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
>     /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
>     /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]

This is less useful than a backtrace could be.  Can you run Emacs
under GDB, and when it crashes, type

  (gdb) thread apply all bt

and post here everything GDB produces as result?

Message #11 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Steven Allen <steven <at> stebalien.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Mon, 16 Dec 2024 08:12:46 -0800

Eli Zaretskii <eliz <at> gnu.org> writes:

>> Date: Sun, 15 Dec 2024 14:01:17 -0800
>> From:  Steven Allen via "Bug reports for GNU Emacs,
>>  the Swiss army knife of text editors" <bug-gnu-emacs <at> gnu.org>
>> 
>> 
>> I use EXWM and, Emacs very occasionally seems to crash when closing
>> floating windows. Specifically, it crashes when deleting the frame
>> wrapping the floating window. Unfortunately, I don't have a great way to
>> reproduce it with a minimal setup or to reproduce it reliably enough to
>> grab a trace with GDB.
>> 
>> As far as I can tell, this is because `delete-frame' calls `delq' (from
>> C) which then handles a signal (not sure what signal) via the
>> `FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
>> eventually calls `gobble_input' which operates on frames.
>> 
>> 
>> Backtrace:
>> 
>>     /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
>>     /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
>>     /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
>>     /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
>>     /usr/bin/emacs(+0xeff78) [0x61e779237f78]
>>     /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
>>     /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
>>     /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
>>     /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
>>     /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
>>     /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
>>     /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
>>     /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
>>     /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]
>
> This is less useful than a backtrace could be.  Can you run Emacs
> under GDB, and when it crashes, type
>
>   (gdb) thread apply all bt
>
> and post here everything GDB produces as result?

Yeah, I agree. I'll do that if I can find a reliable way to reproduce
it. At the moment it happens once every few months.

Message #14 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Robert Pluim <rpluim <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: Steven Allen <steven <at> stebalien.com>, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Mon, 16 Dec 2024 18:20:34 +0100

>>>>> On Mon, 16 Dec 2024 08:12:46 -0800, Steven Allen via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs <at> gnu.org> said:

    Steven> Eli Zaretskii <eliz <at> gnu.org> writes:
    >>> As far as I can tell, this is because `delete-frame' calls `delq' (from
    >>> C) which then handles a signal (not sure what signal) via the
    >>> `FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
    >>> eventually calls `gobble_input' which operates on frames.
    >>> 
    >>> 
    >>> Backtrace:
    >>> 
    >>> /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
    >>> /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
    >>> /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
    >>> /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
    >>> /usr/bin/emacs(+0xeff78) [0x61e779237f78]
    >>> /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
    >>> /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
    >>> /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
    >>> /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
    >>> /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
    >>> /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
    >>> /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
    >>> /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
    >>> /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]
    >> 
    >> This is less useful than a backtrace could be.  Can you run Emacs
    >> under GDB, and when it crashes, type
    >> 
    >> (gdb) thread apply all bt
    >> 
    >> and post here everything GDB produces as result?

    Steven> Yeah, I agree. I'll do that if I can find a reliable way to reproduce
    Steven> it. At the moment it happens once every few months.

If you do find a reproducer, then based on the trace above I think the
following should fix it:

diff --git a/src/frame.c b/src/frame.c
index f6053fca3ef..ff9e1d24ea1 100644
--- a/src/frame.c
+++ b/src/frame.c
@@ -2281,7 +2281,9 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
   delete_all_child_windows (f->root_window);
   fset_root_window (f, Qnil);
 
+  block_input();
   Vframe_list = Fdelq (frame, Vframe_list);
+  unblock_input();
   SET_FRAME_VISIBLE (f, 0);
 
   /* Allow the vector of menu bar contents to be freed in the next





Robert
-- 

Message #17 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Robert Pluim <rpluim <at> gmail.com>
Cc: steven <at> stebalien.com, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Sat, 28 Dec 2024 13:35:41 +0200

> From: Robert Pluim <rpluim <at> gmail.com>
> Cc: Steven Allen <steven <at> stebalien.com>,  74902 <at> debbugs.gnu.org
> Date: Mon, 16 Dec 2024 18:20:34 +0100
> 
> >>>>> On Mon, 16 Dec 2024 08:12:46 -0800, Steven Allen via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs <at> gnu.org> said:
> 
>     Steven> Eli Zaretskii <eliz <at> gnu.org> writes:
>     >>> As far as I can tell, this is because `delete-frame' calls `delq' (from
>     >>> C) which then handles a signal (not sure what signal) via the
>     >>> `FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
>     >>> eventually calls `gobble_input' which operates on frames.
>     >>> 
>     >>> 
>     >>> Backtrace:
>     >>> 
>     >>> /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
>     >>> /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
>     >>> /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
>     >>> /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
>     >>> /usr/bin/emacs(+0xeff78) [0x61e779237f78]
>     >>> /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
>     >>> /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
>     >>> /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
>     >>> /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
>     >>> /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
>     >>> /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
>     >>> /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
>     >>> /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
>     >>> /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]
>     >> 
>     >> This is less useful than a backtrace could be.  Can you run Emacs
>     >> under GDB, and when it crashes, type
>     >> 
>     >> (gdb) thread apply all bt
>     >> 
>     >> and post here everything GDB produces as result?
> 
>     Steven> Yeah, I agree. I'll do that if I can find a reliable way to reproduce
>     Steven> it. At the moment it happens once every few months.
> 
> If you do find a reproducer, then based on the trace above I think the
> following should fix it:
> 
> diff --git a/src/frame.c b/src/frame.c
> index f6053fca3ef..ff9e1d24ea1 100644
> --- a/src/frame.c
> +++ b/src/frame.c
> @@ -2281,7 +2281,9 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
>    delete_all_child_windows (f->root_window);
>    fset_root_window (f, Qnil);
>  
> +  block_input();
>    Vframe_list = Fdelq (frame, Vframe_list);
> +  unblock_input();
>    SET_FRAME_VISIBLE (f, 0);
>  
>    /* Allow the vector of menu bar contents to be freed in the next

Robert, I think you should install this on the master branch.

Thanks.

Message #20 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Steven Allen <steven <at> stebalien.com>
To: Eli Zaretskii <eliz <at> gnu.org>, Robert Pluim <rpluim <at> gmail.com>
Cc: 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Sat, 28 Dec 2024 15:23:12 -0800

[Message part 1 (text/plain, inline)]

I was able to get a GDB backtrace after some button mashing. Let me know
if you need anything else.

[gdb.txt (text/plain, inline)]

#0  format_mode_line_unwind_data (target_frame=target_frame <at> entry=0x58a7d5394680, obuf=<optimized out>, owin=<optimized out>, save_proptrans=save_proptrans <at> entry=false) at ../../src/xdisp.c:13716
#1  0x000058a7c8feb3c6 in gui_consider_frame_title (frame=XIL(0x58a7d5394685)) at ../../src/xdisp.c:13910
#2  0x000058a7c90d6b89 in SET_FRAME_ICONIFIED (f=0x58a7d5394680, i=1) at ../../src/frame.h:1468
#3  handle_one_xevent (dpyinfo=<optimized out>, event=<optimized out>, finish=0x7ffe4f3c8c3c, hold_quit=<optimized out>) at ../../src/xterm.c:20090
#4  0x000058a7c90e40b8 in XTread_socket (terminal=<optimized out>, hold_quit=0x7ffe4f3c8d60) at ../../src/xterm.c:25738
#5  0x000058a7c912a962 in gobble_input () at ../../src/keyboard.c:7922
#6  0x000058a7c91d7da6 in handle_async_input () at ../../src/keyboard.c:8161
#7  process_pending_signals () at ../../src/keyboard.c:8175
#8  probably_quit () at ../../src/eval.c:1788
#9  0x000058a7c91f7826 in maybe_quit () at ../../src/lisp.h:3956
#10 Fdelq (elt=XIL(0x58a7d5394685), list=<optimized out>) at ../../src/fns.c:2098
#11 0x000058a7c8fbd444 in delete_frame (frame=XIL(0x58a7d5394685), force=XIL(0)) at ../../src/frame.c:2500
#12 0x000058a7c8fbe6c7 in Fdelete_frame (frame=<optimized out>, force=<optimized out>) at ../../src/frame.c:2743
#13 0x000071768fefb9e6 in F77696e646f772d2d64656c657465_window__delete_0 () from /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-523952f2/preloaded/window-0d1b8b93-d9709ebc.eln
#14 0x000058a7c91e6d57 in Ffuncall (nargs=4, args=0x7ffe4f3c90f0) at ../../src/eval.c:3079
#15 0x000071768fefc93b in F7265706c6163652d6275666665722d696e2d77696e646f7773_replace_buffer_in_windows_0 () from /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-523952f2/preloaded/window-0d1b8b93-d9709ebc.eln
#16 0x000058a7c91e6d57 in Ffuncall (nargs=2, args=0x7ffe4f3c91b0) at ../../src/eval.c:3079
#17 0x000058a7c91528e9 in replace_buffer_in_windows (buffer=XIL(0x58a7d89b4565)) at ../../src/window.c:3647
#18 replace_buffer_in_windows (buffer=XIL(0x58a7d89b4565)) at ../../src/window.c:3642
#19 Fkill_buffer (buffer_or_name=<optimized out>) at ../../src/buffer.c:2012
#20 0x000071768b655462 in F616e6f6e796d6f75732d6c616d626461_anonymous_lambda_20 () from /home/steb/.config/emacs/eln-cache/31.0.50-523952f2/exwm-manage-481a2a54-1f060da2.eln
#21 0x000058a7c91e6d57 in Ffuncall (nargs=2, args=0x7ffe4f3c9360) at ../../src/eval.c:3079
#22 0x000058a7c91d7834 in Fapply (nargs=2, args=0x7ffe4f3c9360) at ../../src/eval.c:2708
#23 0x000058a7c91e6d57 in Ffuncall (nargs=3, args=0x7ffe4f3c9358) at ../../src/eval.c:3079
#24 0x000071768e47b468 in F74696d65722d6576656e742d68616e646c6572_timer_event_handler_0 () from /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-523952f2/preloaded/timer-3ee7cfd9-4017b895.eln
#25 0x000058a7c91e6d57 in Ffuncall (nargs=2, args=0x7ffe4f3c94a0) at ../../src/eval.c:3079
#26 0x000058a7c911d1ce in timer_check_2 (timers=<optimized out>, idle_timers=<optimized out>) at ../../src/keyboard.c:4804
#27 timer_check () at ../../src/keyboard.c:4869
#28 0x000058a7c930661b in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, nsecs=<optimized out>, read_kbd=-1, do_display=true, just_wait_proc=<optimized out>, wait_proc=<optimized out>, wait_for_cell=<optimized out>) at ../../src/process.c:5446
#29 0x000058a7c8fb60e0 in sit_for (timeout=<optimized out>, reading=<optimized out>, display_option=<optimized out>) at ../../src/dispnew.c:6889
#30 0x000058a7c9127880 in read_char (commandflag=1, map=XIL(0x58a7d5e4b153), prev_event=make_fixnum(27), used_mouse_menu=0x7ffe4f3ca0eb, end_time=0x0) at ../../src/keyboard.c:2925
#31 0x000058a7c92f837e in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7ffe4f3ca270, prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, dont_downcase_last=<optimized out>, prompt=<optimized out>) at ../../src/keyboard.c:10746
#32 0x000058a7c91196e3 in command_loop_1 () at ../../src/keyboard.c:1424
#33 0x000058a7c91d6977 in internal_condition_case (bfun=0x58a7c91194c0 <command_loop_1>, handlers=<optimized out>, hfun=0x58a7c91166e0 <cmd_error>) at ../../src/eval.c:1607
#34 0x000058a7c9118a5f in command_loop_2 (handlers=handlers <at> entry=XIL(0x90)) at ../../src/keyboard.c:1163
#35 0x000058a7c91d68b6 in internal_catch (tag=<optimized out>, func=0x58a7c9118a30 <command_loop_2>, arg=XIL(0x90)) at ../../src/eval.c:1286
#36 0x000058a7c9118ecb in command_loop () at ../../src/keyboard.c:1141
#37 0x000058a7c9119086 in recursive_edit_1 () at ../../src/keyboard.c:749
#38 0x000058a7c9119330 in Frecursive_edit () at ../../src/keyboard.c:832
#39 0x000058a7c8fa3f8b in main (argc=<optimized out>, argv=<optimized out>) at ../../src/emacs.c:2625

Lisp Backtrace:
"window--delete" (0x4f3c90f8)
"replace-buffer-in-windows" (0x4f3c91b8)
0xcf2129c0 PVEC_SUBR
"apply" (0x4f3c9360)
"timer-event-handler" (0x4f3c94a8)
Detaching from program: /usr/bin/emacs-31.0.50, process 53461
[Inferior 1 (process 53461) detached]

Message #23 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Steven Allen <steven <at> stebalien.com>
Cc: rpluim <at> gmail.com, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Sun, 29 Dec 2024 08:50:57 +0200

> From: Steven Allen <steven <at> stebalien.com>
> Cc: 74902 <at> debbugs.gnu.org
> Date: Sat, 28 Dec 2024 15:23:12 -0800
> 
> I was able to get a GDB backtrace after some button mashing. Let me know
> if you need anything else.
> 
> #0  format_mode_line_unwind_data (target_frame=target_frame <at> entry=0x58a7d5394680, obuf=<optimized out>, owin=<optimized out>, save_proptrans=save_proptrans <at> entry=false) at ../../src/xdisp.c:13716
> #1  0x000058a7c8feb3c6 in gui_consider_frame_title (frame=XIL(0x58a7d5394685)) at ../../src/xdisp.c:13910
> #2  0x000058a7c90d6b89 in SET_FRAME_ICONIFIED (f=0x58a7d5394680, i=1) at ../../src/frame.h:1468
> #3  handle_one_xevent (dpyinfo=<optimized out>, event=<optimized out>, finish=0x7ffe4f3c8c3c, hold_quit=<optimized out>) at ../../src/xterm.c:20090
> #4  0x000058a7c90e40b8 in XTread_socket (terminal=<optimized out>, hold_quit=0x7ffe4f3c8d60) at ../../src/xterm.c:25738
> #5  0x000058a7c912a962 in gobble_input () at ../../src/keyboard.c:7922
> #6  0x000058a7c91d7da6 in handle_async_input () at ../../src/keyboard.c:8161
> #7  process_pending_signals () at ../../src/keyboard.c:8175
> #8  probably_quit () at ../../src/eval.c:1788
> #9  0x000058a7c91f7826 in maybe_quit () at ../../src/lisp.h:3956
> #10 Fdelq (elt=XIL(0x58a7d5394685), list=<optimized out>) at ../../src/fns.c:2098
> #11 0x000058a7c8fbd444 in delete_frame (frame=XIL(0x58a7d5394685), force=XIL(0)) at ../../src/frame.c:2500

Thanks.  I guess we also need a FRAME_LIVE_P test in
gui_consider_frame_title?

Message #26 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Steven Allen <steven <at> stebalien.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: rpluim <at> gmail.com, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Tue, 31 Dec 2024 08:31:04 -0800

[Message part 1 (text/plain, inline)]

Eli Zaretskii <eliz <at> gnu.org> writes:
> Thanks.  I guess we also need a FRAME_LIVE_P test in
> gui_consider_frame_title?

I've attached a patch for that but note that it doesn't actually help in
this situation because the frame isn't deleted until:

https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2536

Whereas the crash happens here, 36 lines above:

https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2500

[0001-Avoid-operating-on-dead-frames-when-updating-titles.patch (text/x-patch, attachment)]

Message #29 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Steven Allen <steven <at> stebalien.com>
To: Robert Pluim <rpluim <at> gmail.com>, Eli Zaretskii <eliz <at> gnu.org>
Cc: 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Tue, 31 Dec 2024 08:53:23 -0800

Robert Pluim <rpluim <at> gmail.com> writes:
> If you do find a reproducer, then based on the trace above I think the
> following should fix it:
>
> diff --git a/src/frame.c b/src/frame.c
> index f6053fca3ef..ff9e1d24ea1 100644
> --- a/src/frame.c
> +++ b/src/frame.c
> @@ -2281,7 +2281,9 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
>    delete_all_child_windows (f->root_window);
>    fset_root_window (f, Qnil);
>  
> +  block_input();
>    Vframe_list = Fdelq (frame, Vframe_list);
> +  unblock_input();
>    SET_FRAME_VISIBLE (f, 0);
>  
>    /* Allow the vector of menu bar contents to be freed in the next

From what I can tell (my reproducer isn't 100% effective), this does
indeed fix the issue. Thanks!

Message #32 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Steven Allen <steven <at> stebalien.com>
Cc: rpluim <at> gmail.com, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Sat, 04 Jan 2025 14:02:28 +0200

> From: Steven Allen <steven <at> stebalien.com>
> Cc: 74902 <at> debbugs.gnu.org
> Date: Tue, 31 Dec 2024 08:53:23 -0800
> 
> 
> Robert Pluim <rpluim <at> gmail.com> writes:
> > If you do find a reproducer, then based on the trace above I think the
> > following should fix it:
> >
> > diff --git a/src/frame.c b/src/frame.c
> > index f6053fca3ef..ff9e1d24ea1 100644
> > --- a/src/frame.c
> > +++ b/src/frame.c
> > @@ -2281,7 +2281,9 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
> >    delete_all_child_windows (f->root_window);
> >    fset_root_window (f, Qnil);
> >  
> > +  block_input();
> >    Vframe_list = Fdelq (frame, Vframe_list);
> > +  unblock_input();
> >    SET_FRAME_VISIBLE (f, 0);
> >  
> >    /* Allow the vector of menu bar contents to be freed in the next
> 
> >From what I can tell (my reproducer isn't 100% effective), this does
> indeed fix the issue. Thanks!

Robert, please install, and thanks.

Message #35 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Robert Pluim <rpluim <at> gmail.com>
To: Steven Allen <steven <at> stebalien.com>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Tue, 07 Jan 2025 10:43:32 +0100

>>>>> On Tue, 31 Dec 2024 08:31:04 -0800, Steven Allen <steven <at> stebalien.com> said:

    Steven> Eli Zaretskii <eliz <at> gnu.org> writes:
    >> Thanks.  I guess we also need a FRAME_LIVE_P test in
    >> gui_consider_frame_title?

    Steven> I've attached a patch for that but note that it doesn't actually help in
    Steven> this situation because the frame isn't deleted until:

    Steven> https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2536

    Steven> Whereas the crash happens here, 36 lines above:

    Steven> https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2500

gui_consider_frame_title looks at Vframe_list, so removing the
to-be-deleted frame from it should be enough (unless this crash was
with my patch applied?)

Robert
-- 

Message #38 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Robert Pluim <rpluim <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>,
Cc: Steven Allen <steven <at> stebalien.com>, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Fri, 10 Jan 2025 12:26:50 +0100

>>>>> On Tue, 07 Jan 2025 10:43:32 +0100, Robert Pluim <rpluim <at> gmail.com> said:

>>>>> On Tue, 31 Dec 2024 08:31:04 -0800, Steven Allen <steven <at> stebalien.com> said:
    Steven> Eli Zaretskii <eliz <at> gnu.org> writes:
    >>> Thanks.  I guess we also need a FRAME_LIVE_P test in
    >>> gui_consider_frame_title?

    Steven> I've attached a patch for that but note that it doesn't actually help in
    Steven> this situation because the frame isn't deleted until:

    Steven> https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2536

    Steven> Whereas the crash happens here, 36 lines above:

    Steven> https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2500

    Robert> gui_consider_frame_title looks at Vframe_list, so removing the
    Robert> to-be-deleted frame from it should be enough (unless this crash was
    Robert> with my patch applied?)

Eli, did you still want me to push the change to master?

Robert
-- 

Message #41 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Robert Pluim <rpluim <at> gmail.com>
Cc: steven <at> stebalien.com, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Fri, 10 Jan 2025 14:44:13 +0200

> From: Robert Pluim <rpluim <at> gmail.com>
> Cc: Steven Allen <steven <at> stebalien.com>,  74902 <at> debbugs.gnu.org
> Date: Fri, 10 Jan 2025 12:26:50 +0100
> 
> >>>>> On Tue, 07 Jan 2025 10:43:32 +0100, Robert Pluim <rpluim <at> gmail.com> said:
> 
> >>>>> On Tue, 31 Dec 2024 08:31:04 -0800, Steven Allen <steven <at> stebalien.com> said:
>     Steven> Eli Zaretskii <eliz <at> gnu.org> writes:
>     >>> Thanks.  I guess we also need a FRAME_LIVE_P test in
>     >>> gui_consider_frame_title?
> 
>     Steven> I've attached a patch for that but note that it doesn't actually help in
>     Steven> this situation because the frame isn't deleted until:
> 
>     Steven> https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2536
> 
>     Steven> Whereas the crash happens here, 36 lines above:
> 
>     Steven> https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2500
> 
>     Robert> gui_consider_frame_title looks at Vframe_list, so removing the
>     Robert> to-be-deleted frame from it should be enough (unless this crash was
>     Robert> with my patch applied?)
> 
> Eli, did you still want me to push the change to master?

Yes, why not?

I don't really understand the last 2 exchanges.

Message #44 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Robert Pluim <rpluim <at> gmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: steven <at> stebalien.com, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Fri, 10 Jan 2025 16:10:29 +0100

tags 74902 fixed
close 74902 31.1
quit

>>>>> On Fri, 10 Jan 2025 14:44:13 +0200, Eli Zaretskii <eliz <at> gnu.org> said:
    >> 
    >> Eli, did you still want me to push the change to master?

    Eli> Yes, why not?

Closing.
Committed as 8e9ad92a140
          
Robert
-- 

Message #51 received at 74902 <at> debbugs.gnu.org (full text, mbox):

From: Steven Allen <steven <at> stebalien.com>
To: Robert Pluim <rpluim <at> gmail.com>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 74902 <at> debbugs.gnu.org
Subject: Re: bug#74902: 31.0.50; Segfault when deleting frames
Date: Fri, 10 Jan 2025 08:19:08 -0800

Robert Pluim <rpluim <at> gmail.com> writes:

>>>>>> On Tue, 31 Dec 2024 08:31:04 -0800, Steven Allen <steven <at> stebalien.com> said:
>
>     Steven> Eli Zaretskii <eliz <at> gnu.org> writes:
>     >> Thanks.  I guess we also need a FRAME_LIVE_P test in
>     >> gui_consider_frame_title?
>
>     Steven> I've attached a patch for that but note that it doesn't actually help in
>     Steven> this situation because the frame isn't deleted until:
>
>     Steven> https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2536
>
>     Steven> Whereas the crash happens here, 36 lines above:
>
>     Steven> https://git.savannah.gnu.org/cgit/emacs.git/tree/src/frame.c?h=2f1052d9b0de551dc3a463ed54e21c63517497ab#n2500
>
> gui_consider_frame_title looks at Vframe_list, so removing the
> to-be-deleted frame from it should be enough (unless this crash was
> with my patch applied?)

The crash was fixed with your patch. Removing the to-be-deleted frame
from the frame list earlier sounds like the best approach (maintain an
invariant that the frame list will never reference a dead frame) but I
don't know if that'll cause other issues.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.