Package: emacs;
Reported by: Zhengyi Fu <i <at> fuzy.me>
Date: Mon, 30 Dec 2024 13:04:02 UTC
Severity: normal
Found in version 30.0.93
Message #14 received at 75199 <at> debbugs.gnu.org (full text, mbox):
From: Zhengyi Fu <i <at> fuzy.me> To: Eli Zaretskii <eliz <at> gnu.org> Cc: Po Lu <luangruo <at> yahoo.com>, 75199 <at> debbugs.gnu.org Subject: Re: bug#75199: 30.0.93; Emacs crashes when completing with corfu Date: Mon, 30 Dec 2024 23:04:44 +0800
Eli Zaretskii <eliz <at> gnu.org> writes:
>> From: Zhengyi Fu <i <at> fuzy.me>
>> Date: Mon, 30 Dec 2024 21:02:59 +0800
>>
>> Emacs built without Cairo steadily crashes when trying to complete
>> symbols with Corfu.
>>
>> Steps to reproduce:
>>
>> 1. emacs -Q -l path/to/corfu.el
>> 2. M-x corfu-mode
>> 3. Try completing a simple by pressing C-M-i
>>
>> I got the following backtrace from GDB by reproducing the bug after
>> evaluating (x-synchronize t):
>>
>> (gdb) br x_error_quitter
>> Breakpoint 1 at 0x550530: file xterm.c, line 27111.
>> (gdb) r
>> Starting program: /home/zhengyi/src/emacs/src/emacs -Q -l \~/.emacs.d/straight/repos/corfu/corfu.el
>> [Thread debugging using libthread_db enabled]
>> Using host libthread_db library "/lib64/libthread_db.so.1".
>> [New Thread 0x7ffff13fe6c0 (LWP 15400)]
>> [New Thread 0x7ffff0a6e6c0 (LWP 15401)]
>> [New Thread 0x7fffebfff6c0 (LWP 15402)]
>> [New Thread 0x7fffeb66f6c0 (LWP 15403)]
>>
>> Thread 1 "emacs" hit Breakpoint 1, x_error_quitter (display=0xe19910, event=0x0) at xterm.c:27111
>> 27111 if (event->error_code == BadName)
>> (gdb) bt full
>> #0 x_error_quitter (display=0xe19910, event=0x0) at xterm.c:27111
>> buf = '\000' <repeats 255 times>
>> buf1 = '\000' <repeats 272 times>...
>> #1 0x000000000055076b in x_error_handler (display=0xe19910, event=0x7fffffffba70) at xterm.c:27090
>> stack = <optimized out>
>> dpyinfo = <optimized out>
>> fail = <optimized out>
>> last = <optimized out>
>
> I don't understand how 'event', which was 0x7fffffffba70 in
> x_error_handler became a NULL pointer inside x_error_quitter, which
> x_error_handler calls.
>
> Po Lu, any ideas?
>
> Zhengyi Fu, can you configure Emacs 30.0.93 with --enable-checking and
> compile it with -O0, and see if you get more detailed diagnostics?
>
> Also, does disabling the X input method help in any way? (I see you
> are using fcitx.)
This the backtrace I got after rebuilding Emacs with --enable-checking
and -O0 and disabling fcitx:
(gdb) r
Starting program: /home/zhengyi/src/emacs/src/emacs -Q -l \~/.emacs.d/straight/repos/corfu/corfu.el
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7ffff1bfe6c0 (LWP 58332)]
[New Thread 0x7ffff126e6c0 (LWP 58333)]
[New Thread 0x7fffebfff6c0 (LWP 58334)]
[New Thread 0x7fffeb66f6c0 (LWP 58335)]
[Detaching after vfork from child process 58338]
[Detaching after vfork from child process 58343]
[Detaching after vfork from child process 58350]
[Detaching after vfork from child process 58351]
[Detaching after vfork from child process 58352]
[Detaching after vfork from child process 58353]
[Detaching after vfork from child process 58357]
[Detaching after vfork from child process 58361]
[Detaching after vfork from child process 58366]
[Detaching after vfork from child process 58370]
[Detaching after vfork from child process 58374]
[Detaching after vfork from child process 58379]
Thread 1 "emacs" hit Breakpoint 1, x_error_quitter (display=0x104d5d0, event=0x7fffffffb8c0) at xterm.c:27111
27111 if (event->error_code == BadName)
(gdb) bt full
#0 x_error_quitter (display=0x104d5d0, event=0x7fffffffb8c0) at xterm.c:27111
buf = '\000' <repeats 16 times>, "P\267\377\377\377\177\000\000\001\000\000\000\000\000\000\000\240\267\377\377\377\177", '\000' <repeats 26 times>, "\001\001. \000\000\000\000 ", '\000' <repeats 15 times>, "/#\305\367\377\177\000\000d\372\004\001\000\000\000\000 ", '\000' <repeats 15 times>, "\300\n\005\001", '\000' <repeats 12 times>, "\362\321\361\363\377\177\000\000d\372\004\001\000\000\000\000\000-cYwQ6n\240\271\377\377\377\177\000\000\001\000\000\000\000\000\000\000\360\371\004\001", '\000' <repeats 20 times>...
buf1 = "p\350\004\001\000\000\000\000\300\n\005\001\000\000\000\000\360\371\004\001\000\000\000\000\377\377\377\377\377\377\377\377d\372\004\001\000\000\000\000\000\020", '\000' <repeats 22 times>, " \264\377\377\377\177\000\000\001\000\000\000\000\000\000\000p\264\377\377\377\177\000\000P", '\000' <repeats 15 times>, "\301\031\305\367\377\177\000\000 \v\005\001\000\000\000\000\360\371\004\001\000\000\000\000$ \000\000\000\000\000\000\260\265\377\377\377\177\000\000ะด\377\377\377\177\000\000\201\035\305\367\377\177\000\000\360\264\377\377\377\177\000\000\277.\305\367\377\177\000\000 \265\377\377\377\177\000\000\b\372\004\001\000\000\000\000\002\000\000\000\000\000\000\000\000"...
#1 0x00000000005d32de in x_error_handler (display=0x104d5d0, event=0x7fffffffb8c0) at xterm.c:27090
stack = 0x0
dpyinfo = 0x105f4d0
fail = 0x0
last = 0x104d5d0
#2 0x00007ffff7cc047b in _XError () at /lib64/libX11.so.6
#3 0x00007ffff7cc0577 in ??? () at /lib64/libX11.so.6
#4 0x00007ffff7cc062d in ??? () at /lib64/libX11.so.6
#5 0x00007ffff7cc22dd in _XReply () at /lib64/libX11.so.6
#6 0x00007ffff7cc265b in XSync () at /lib64/libX11.so.6
#7 0x00007ffff7cc26fb in ??? () at /lib64/libX11.so.6
#8 0x00007ffff7c9ae83 in XCreatePixmap () at /lib64/libX11.so.6
#9 0x00007ffff7c9f10b in XCreatePixmapFromBitmapData () at /lib64/libX11.so.6
#10 0x00000000005acef7 in x_draw_fringe_bitmap (w=0x1bf5f80, row=0x1c3c060, p=0x7fffffffbe60) at xterm.c:7993
clipmask = 0
image_rect = {x = 1, y = 18, width = 8, height = 0}
px = 0
pixmap = 4785737
gcv = {function = -227767256, plane_mask = 140737488338224, foreground = 7102373, background = 140737260588072, line_width = -17072, line_style = 32767, cap_style = 7102479, join_style = 0, fill_style = 7092985, fill_rule = 0, arc_mode = -227767256, tile = 140737488338560, stipple = 7114578, ts_x_origin = 0, ts_y_origin = 0, font = 0, subwindow_mode = 15924032, graphics_exposures = 0, clip_x_origin = 0, clip_y_origin = 0, clip_mask = 15924080, dash_offset = 48, dashes = 10 '\n'}
bg = {pixel = 4769435, red = 46245, green = 433, blue = 0, flags = 0 '\000', pad = 0 '\000'}
picture = 0
attrs = {repeat = 0, alpha_map = 0, alpha_x_origin = 0, alpha_y_origin = 0, clip_x_origin = 0, clip_y_origin = 0, clip_mask = 0, graphics_exposures = 0, subwindow_mode = 0, poly_edge = 0, poly_mode = 0, dither = 0, component_alpha = 0}
py = 0
drawable = 13631756
bits = 0x1bf4120 ""
depth = 32
background = 4290834431
dest = {x = 1, y = 18, width = 8, height = 0}
pwidth = 8
pheight = 0
f = 0x1b1b4a0
display = 0x104d5d0
gc = 0x1ad5840
face = 0x101b720
clip_rect = {x = 1, y = 1, width = 256, height = 35}
#11 0x00000000007d4009 in draw_fringe_bitmap_1 (w=0x1bf5f80, row=0x1c3c060, left_p=1, overlay=0, which=26) at fringe.c:711
f = 0x1b1b4a0
p = {which = 26, bits = 0x1bf4120, wd = 8, h = 0, dh = 0, x = 1, y = 18, bx = 1, nx = 8, by = 1, ny = 35, cursor_p = false, overlay_p = false, face = 0x101b720}
fb = 0x1bf4110
period = 0
face_id = 21
offset = 0
header_line_height = 0
#12 0x00000000007d471d in draw_fringe_bitmap (w=0x1bf5f80, row=0x1c3c060, left_p=1) at fringe.c:880
overlay = 0
#13 0x00000000007d4829 in draw_row_fringe_bitmaps (w=0x1bf5f80, row=0x1c3c060) at fringe.c:901
#14 0x00000000007d4a6e in draw_window_fringes (w=0x1bf5f80, no_fringe_p=true) at fringe.c:949
row = 0x1c3c060
yb = 350
nrows = 18
y = 0
rn = 0
updated_p = false
window_buffer = 0xfe567d
oldbuf = 0x7ffff2856418
#15 0x000000000046dcad in gui_update_window_end (w=0x1bf5f80, cursor_on_p=true, mouse_face_overwritten_p=false) at dispnew.c:3948
f = 0x1b1b4a0
#16 0x000000000046da27 in update_window (w=0x1bf5f80, force_p=true) at dispnew.c:3869
end = 0x1af1820
tab_line_row = 0x0
mouse_face_overwritten_p = false
n_updated = 0
mode_line_row = 0x1af1820
changed_p = true
invisible_rows_marked = true
row = 0x1af1820
header_line_row = 0x0
yb = 350
desired_matrix = 0x1b191e0
paused_p = false
preempt_count = 9
rif = 0x8df2a0 <x_redisplay_interface>
#17 0x000000000046cc71 in update_window_tree (w=0x1bf5f80, force_p=true) at dispnew.c:3491
paused_p = false
#18 0x000000000046c61b in update_frame (f=0x1b1b4a0, force_p=true, inhibit_hairy_id_p=false) at dispnew.c:3326
paused_p = false
root_window = 0x1bf5f80
#19 0x00000000004c51b1 in redisplay_internal () at xdisp.c:17468
gcscrollbars = true
f_redisplay_flag = true
f = 0x1b1b4a0
w = 0x11d1690
sw = 0x11d1690
fr = 0x11d13e0
pending = false
must_finish = false
match_p = true
tlbufpos = {charpos = 180, bytepos = 184}
tlendpos = {charpos = 0, bytepos = 0}
number_of_visible_frames = 2
sf = 0x11d13e0
polling_stopped_here = true
tail = 0x1a17043
frame = 0x1b1b4a5
hscroll_retries = 0
garbaged_frame_retries = 0
consider_all_windows_p = true
update_miniwindow_p = false
count = {bytes = 128}
#20 0x00000000004c2bab in redisplay () at xdisp.c:16563
#21 0x0000000000616041 in read_char (commandflag=1, map=0x1ba88f3, prev_event=0x0, used_mouse_menu=0x7fffffffd9ef, end_time=0x0) at keyboard.c:2678
echo_current = true
c = 0x0
local_getcjmp = {{__jmpbuf = {140737259281624, 140737259281667, 140737488345056, 7102846, 48, 140737259281624, 15924032, 0}, __mask_was_saved = 0, __saved_mask = {__val = {140737488345104, 6496078, 140737267083907, 140737488345264, 6517891, 15924032, 0, 0, 140737488345168, 7233523, 26984432, 140737488345264, 7277134, 29001987, 128, 140737488345264}}}}
save_jump = {{__jmpbuf = {140737488344944, 7120998, 140737262216221, 12658762781, 0, 44256, 140737488345136, 140737267219456}, __mask_was_saved = -226139107, __saved_mask = {__val = {746, 0, 44256, 15968288, 44256, 140737488344944, 55850543136, 140737262216221, 140737488344960, 7101566, 140737262216221, 140737488344992, 7101662, 7092985, 140737262216221, 140737488345056}}}}
tem = 0x1a77dd0
save = 0x1ba88f3
previous_echo_area_message = 0x0
also_record = 0x0
reread = false
recorded = false
polling_stopped_here = false
orig_kboard = 0x104f640
jmpcount = {bytes = 0}
#22 0x000000000062a235 in read_key_sequence (keybuf=0x7fffffffdc10, prompt=0x0, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false, disable_text_conversion_p=false) at keyboard.c:10743
interrupted_kboard = 0x104f640
interrupted_frame = 0x11d13e0
key = 0x30
used_mouse_menu = false
echo_local_start = 0
last_real_key_start = 0
keys_local_start = 0
new_binding = 0xba
count = {bytes = 96}
t = 0
echo_start = 0
keys_start = 0
current_binding = 0x1ba88f3
first_unbound = 31
mock_input = 0
used_mouse_menu_history = {false <repeats 30 times>}
fkey = {parent = 0x7ffff24c7983, map = 0x7ffff24c7983, start = 0, end = 0}
keytran = {parent = 0x7ffff2cef743, map = 0x7ffff2cef743, start = 0, end = 0}
indec = {parent = 0x7ffff24c7973, map = 0x7ffff24c7973, start = 0, end = 0}
shift_translated = false
delayed_switch_frame = 0x0
original_uppercase = 0x0
original_uppercase_position = -1
disabled_conversion = false
starting_buffer = 0x7ffff2856418
fake_prefixed_keys = 0x0
first_event = 0x0
second_event = 0x0
#23 0x0000000000612514 in command_loop_1 () at keyboard.c:1429
cmd = 0x7ffff175a428
keybuf = {0x20000026, 0x16, 0x2ffffdca0, 0x0, 0x0, 0xb2b0, 0x7ffff3e0b018, 0x7ffff2d1bc30, 0x0, 0xb2b0, 0x7ffff2856418, 0x0, 0x0, 0xf3adf0 <lispsym+45744>, 0x6c3af9 <builtin_lisp_symbol+44>, 0x0, 0x7fffffffdd20, 0x6ca866 <set_default_internal+914>, 0x7ffff285641d, 0x2006ed6c1, 0x0, 0xb2b0, 0x7ffff2d1bc30, 0x7ffff2d1bc30, 0x0, 0x0, 0x7fffffffdd60, 0xb2b0, 0xf3adf0 <lispsym+45744>, 0xb2b0}
i = 1
last_pt = 184
prev_modiff = 110
prev_buffer = 0x7ffff2856418
#24 0x00000000006eac73 in internal_condition_case (bfun=0x6120ef <command_loop_1>, handlers=0x90, hfun=0x6115f7 <cmd_error>) at eval.c:1613
val = 0x60e5cf <builtin_lisp_symbol+44>
c = 0x102b850
#25 0x0000000000611cf7 in command_loop_2 (handlers=0x90) at keyboard.c:1168
val = 0x90
#26 0x00000000006ea0cb in internal_catch (tag=0x12270, func=0x611cd4 <command_loop_2>, arg=0x90) at eval.c:1292
val = 0x7fffffffdf20
c = 0x102b710
#27 0x0000000000611c90 in command_loop () at keyboard.c:1146
#28 0x00000000006110d0 in recursive_edit_1 () at keyboard.c:754
count = {bytes = 32}
val = 0x6f02e8 <record_unwind_protect+114>
#29 0x00000000006112e3 in Frecursive_edit () at keyboard.c:837
count = {bytes = 0}
buffer = 0x0
#30 0x000000000060cf48 in main (argc=4, argv=0x7fffffffe238) at emacs.c:2635
stack_bottom_variable = 0x53
old_argc = 4
dump_file = 0x0
no_loadup = false
junk = 0x0
dname_arg = 0x0
ch_to_dir = 0x0
original_pwd = 0x0
dump_mode = 0x0
skip_args = 0
temacs = 0x0
attempt_load_pdump = true
only_version = false
rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
lc_all = 0x0
sockfd = -1
module_assertions = false
(gdb)
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.