From debbugs-submit-bounces@debbugs.gnu.org Tue Feb 25 12:33:15 2025 Received: (at submit) by debbugs.gnu.org; 25 Feb 2025 17:33:15 +0000 Received: from localhost ([127.0.0.1]:48284 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tmyny-0000Wd-O9 for submit@debbugs.gnu.org; Tue, 25 Feb 2025 12:33:15 -0500 Received: from lists.gnu.org ([2001:470:142::17]:41678) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1tmynv-0000WJ-71 for submit@debbugs.gnu.org; Tue, 25 Feb 2025 12:33:12 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tmynh-0004We-Pz for bug-gnu-emacs@gnu.org; Tue, 25 Feb 2025 12:32:58 -0500 Received: from mail-wr1-x42c.google.com ([2a00:1450:4864:20::42c]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1tmynf-0006A8-4F for bug-gnu-emacs@gnu.org; Tue, 25 Feb 2025 12:32:57 -0500 Received: by mail-wr1-x42c.google.com with SMTP id ffacd0b85a97d-388cae9eb9fso3184946f8f.3 for ; Tue, 25 Feb 2025 09:32:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740504771; x=1741109571; darn=gnu.org; h=cc:to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=a37LLQm/GqkwfL434rMFGNynOklkPTiGFqSvBTG2Cg0=; b=ZgsoZUF6qWmr0OE8qEcYkXPEFj+9huiDsYz33Op8zrd+4rHMjHIb2w81/80Rqtrqhj 6l6ExPUHuTsAWXCwT6AxsA7OAfWPUMAUt79yW4IrJRdUrNMxwxbicfXAM/FMuB9teRaA d6e/Vk8XUMGB07fHJAFFwJGnd8tYxLmZofxEfte44uIF+SfidMu2Zem8moE3xJ8aQg++ Sig1IOUV9nyaOEje0bp+EFW01Qwl/AXE7K5eV2QAsBDs4mICnBWX3vBvjzvFb2b6WqIc 8Q+uNxoM+tEvf9NQPQD0sm3I78uDq+R/HdZlREjwbbsgJL/2nlySkEM3ER3qTtM6H5db s5zA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740504771; x=1741109571; h=cc:to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=a37LLQm/GqkwfL434rMFGNynOklkPTiGFqSvBTG2Cg0=; b=Kq/SoHJRDs4puuFjNYRwv+jp8xt2iT4ygH3iFfH+vkNqX94IaBJ0xQrQ/zuDE4JKAl JuZZOw1W+VzcW+GQn8eQ1c3eNnW+NNCkzzILL0MI5b3ZPK/1i2SGCKDFbifLJb+3HuaE qZgCuxo49A4w4nnIRO5K16iwCHduGt+jlflaUeF6Qy/4v33N1P9x3kPV2aG3wp9wMMIf s051QkBCr6P716CTKwwXJL7QtMOdDk7Siyn7xgL2K/KgOSoVBmN8daDigpyVt2z6DIzr BZ0bMdHMEnWvE1L65J2ItLa6q7/v4l1ICowu17qmP51YkYL2yWufvNue//AokbpzqMN+ Ksdg== X-Gm-Message-State: AOJu0YysB7dqfGsEfwyuBM3O5S/WXDvikaqApQTyZU8dT+MCprAGWuFS YqzqkvDKsxcCEeovfsvBWSUSmK3iwfPbdgHHjp8EE9+OXtdfvXpVIAz6GagaozmRFHwWicOzn0Q wgwD6Mdlhyxt3v44lZA/kEZPcw1X/uOFIl9GBqQ== X-Gm-Gg: ASbGncu6ru/F0sSA6lT/lvVDD8x/72vLRuBuRwXVt2oLrB8+ssE6YRKfk2tRR3iaxeP ORjQ2CBOkk09kFFaWyLzGCVrgmoiFztOr7ZsT4SKuzmPid7K5Qzd30sgc524v4L4HReKaNFD/Lj UdnRPZcg== X-Google-Smtp-Source: AGHT+IFQhMK74vo7Cf8oyU0XV806DjAKnCqsM41TNoZK63XnNgGrsWxxaO0I7V+yj1WQ/CmlrSL6twOzFRGp3918JZQ= X-Received: by 2002:adf:e912:0:b0:38f:24f9:8bac with SMTP id ffacd0b85a97d-390cc60c1f9mr3253926f8f.23.1740504771014; Tue, 25 Feb 2025 09:32:51 -0800 (PST) MIME-Version: 1.0 From: Iurie Marian Date: Tue, 25 Feb 2025 18:32:39 +0100 X-Gm-Features: AQ5f1Jpo9xLhgTQ34Mda4MVrEnjPzOUKw__LniwKgteB0ytJMnMk1JXpc8UR6gI Message-ID: Subject: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' To: bug-gnu-emacs@gnu.org Content-Type: text/plain; charset="UTF-8" Received-SPF: pass client-ip=2a00:1450:4864:20::42c; envelope-from=marian.iurie@gmail.com; helo=mail-wr1-x42c.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-Spam-Score: 1.0 (+) X-Debbugs-Envelope-To: submit Cc: Michael Albinus X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) Dear Maintainers, Emacs is crashing while copying-as-kill/killing-word, only when compiled with -O3 optimizations. I am using PGTK (see the configure command below). I did a git bisect, and it seems that the commit below is triggering the bug. To reproduce it just compile with -O3 and PGTK, then simply hit M-. At the bottom you will also see the the stack trace, maybe it's useful. Kind Regards, Iurie ====================================================================== d41178368eb73873f34c15b58062a7447802c914 is the first bad commit commit d41178368eb73873f34c15b58062a7447802c914 Author: Michael Albinus Date: Fri Feb 7 12:04:05 2025 +0100 New function insert-special-event and special event sleep-event * doc/lispref/commands.texi (Misc Events): Add sleep-event. (Special Events): New function insert-special-event. * etc/NEWS: New function insert-special-event. New event 'sleep-event'. Fix typos. * src/keyboard.c (Finsert_special_event): New defun. (syms_of_keyboard): Declare Qsleep_event. Define subroutine Sinsert_special_event. Add sleep-event to Vspecial_event_map. (Bug#63620) (kbd_buffer_get_event, make_lispy_event) (init_while_no_input_ignore_events, is_ignored_event): * src/termhooks.h (event_kind): Add SLEEP_EVENT. doc/lispref/commands.texi | 32 ++++++++++++++++++++++ etc/NEWS | 19 +++++++++++--- src/keyboard.c | 67 +++++++++++++++++++++++++++++++++++++++++++++++ src/termhooks.h | 3 +++ 4 files changed, 117 insertions(+), 4 deletions(-) ====================================================================== In GNU Emacs 31.0.50 (build 35, x86_64-pc-linux-gnu, GTK+ Version 3.24.38, cairo version 1.16.0) of 2025-02-25 built on unit_xpchipbarcodereader Repository revision: d41178368eb73873f34c15b58062a7447802c914 Repository branch: HEAD System Description: Debian GNU/Linux 12 (bookworm) Configured using: 'configure 'CFLAGS= -g -Wall -Wextra -pedantic -O3' --prefix=/home/roche/.local/emacs/build_ --sysconfdir=/etc --libexecdir=/home/roche/.local/emacs/build_/usr/lib --localstatedir=/home/roche/.local/emacs/build_/var --with-modules --without-gconf --without-gsettings --enable-link-time-optimization --with-x-toolkit=yes --without-xaw3d --without-m17n-flt --with-cairo --without-compress-install --with-native-compilation=aot --with-mailutils --with-xft --with-rsvg --with-pgtk' Configured features: CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS HARFBUZZ JPEG LIBOTF LIBSELINUX LIBXML2 MODULES NATIVE_COMP NOTIFY INOTIFY PDUMPER PGTK PNG RSVG SECCOMP SOUND SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS TREE_SITTER WEBP XIM GTK3 ZLIB Important settings: value of $LC_ALL: C locale-coding-system: nil Major mode: Lisp Interaction Minor modes in effect: tooltip-mode: t global-eldoc-mode: t eldoc-mode: t show-paren-mode: t electric-indent-mode: t mouse-wheel-mode: t tool-bar-mode: t menu-bar-mode: t file-name-shadow-mode: t global-font-lock-mode: t font-lock-mode: t blink-cursor-mode: t minibuffer-regexp-mode: t line-number-mode: t indent-tabs-mode: t transient-mark-mode: t auto-composition-mode: t auto-encryption-mode: t auto-compression-mode: t Load-path shadows: None found. Features: (shadow sort mail-extr compile comint ansi-osc ansi-color ring comp-run bytecomp byte-compile comp-common rx emacsbug message mailcap yank-media puny dired dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg rfc6068 epg-config gnus-util text-property-search time-date subr-x mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader cl-loaddefs cl-lib sendmail rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils rmc iso-transl tooltip cconv eldoc paren electric uniquify ediff-hook vc-hooks lisp-float-type elisp-mode mwheel term/pgtk-win pgtk-win term/common-win touch-screen pgtk-dnd tool-bar dnd fontset image regexp-opt fringe tabulated-list replace newcomment text-mode lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow isearch easymenu timer select scroll-bar mouse jit-lock font-lock syntax font-core term/tty-colors frame minibuffer nadvice seq simple cl-generic indonesian philippine cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european ethiopic indian cyrillic chinese composite emoji-zwj charscript charprop case-table epa-hook jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button loaddefs theme-loaddefs faces cus-face macroexp files window text-properties overlay sha1 md5 base64 format env code-pages mule custom widget keymap hashtable-print-readable backquote threads dbusbind inotify dynamic-setting font-render-setting cairo gtk pgtk multi-tty move-toolbar make-network-process tty-child-frames native-compile emacs) ====================================================================== (gdb) bt #0 pgtk_handle_selection_request (event=0x7fffffffd810) at /home/rce/.local/emacs/sources/src/pgtkselect.c:571 #1 0x000055555569edd5 in pgtk_handle_selection_event (event=0x7fffffffd810) at /home/rce/.local/emacs/sources/src/pgtkselect.c:782 #2 process_special_events () at /home/rce/.local/emacs/sources/src/keyboard.c:4570 #3 0x00005555555b5424 in swallow_events (do_display=true) at /home/rce/.local/emacs/sources/src/keyboard.c:4610 #4 sit_for (timeout=0x7a, reading=, display_option=1) at /home/rce/.local/emacs/sources/src/dispnew.c:6867 #5 0x00005555556a7c34 in read_char (commandflag=1, map=0x7fffef23de23, prev_event=0x0, used_mouse_menu=0x7fffffffdfbb, end_time=0x0) at /home/rce/.local/emacs/sources/src/lisp.h:704 #6 0x000055555583fa7b in read_key_sequence.constprop.0 (keybuf=, prevent_redisplay=false, disable_text_conversion_p=false, fix_current_buffer=true, can_return_switch_frame=true, dont_downcase_last=false, prompt=0x0) at /home/rce/.local/emacs/sources/src/keyboard.c:10750 #7 0x000055555569ba51 in command_loop_1 () at /home/rce/.local/emacs/sources/src/keyboard.c:1424 #8 0x000055555573d9f7 in internal_condition_case (bfun=0x55555569b8b0 , handlers=, hfun=0x555555699790 ) at /home/rce/.local/emacs/sources/src/eval.c:1602 #9 0x0000555555699a46 in command_loop_2 (handlers=handlers@entry=0x90) at /home/rce/.local/emacs/sources/src/keyboard.c:1163 #10 0x000055555573d94c in internal_catch (tag=, func=0x555555699a20 , arg=0x90) at /home/rce/.local/emacs/sources/src/eval.c:1282 #11 0x000055555569b451 in command_loop () at /home/rce/.local/emacs/sources/src/keyboard.c:1141 #12 0x000055555586e628 in recursive_edit_1.isra.0 () at /home/rce/.local/emacs/sources/src/keyboard.c:749 #13 0x000055555569b88d in Frecursive_edit () at /home/rce/.local/emacs/sources/src/keyboard.c:832 #14 0x00005555555a8c94 in main (argc=2, argv=0x7fffffffe668) at /home/rce/.local/emacs/sources/src/emacs.c:2558 (gdb) list 566 pushed = false; 567 568 if (!dpyinfo) 569 goto DONE; 570 571 local_selection_data = LOCAL_SELECTION (selection_symbol, dpyinfo); 572 573 /* Decline if we don't own any selections. */ 574 if (NILP (local_selection_data)) goto DONE; 575 (gdb) fr 2 #2 process_special_events () at /home/rce/.local/emacs/sources/src/keyboard.c:4570 4570 pgtk_handle_selection_event (©); (gdb) list 4565 input_pending = readable_events (0); 4566 4567 #ifdef HAVE_X11 4568 x_handle_selection_event (©); 4569 #else 4570 pgtk_handle_selection_event (©); 4571 #endif 4572 #elif defined HAVE_HAIKU 4573 if (event->ie.kind != SELECTION_CLEAR_EVENT) 4574 emacs_abort (); (gdb) info locals event = 0x555555957a40 copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55cf0b00, requestor = 0x555555f97a80, selection = 0x45, target = 0x4d, property = 0x5e, time = 0} moved_events = (gdb) x/s 0x55cf0b00 0x55cf0b00: From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 08:10:45 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 13:10:45 +0000 Received: from localhost ([127.0.0.1]:51466 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnHBV-0000Di-Da for submit@debbugs.gnu.org; Wed, 26 Feb 2025 08:10:45 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:34372) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1tnHBS-0000DS-HO for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 08:10:43 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tnHBM-0007gB-Md; Wed, 26 Feb 2025 08:10:36 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=References:Subject:In-Reply-To:To:From:Date: mime-version; bh=/tMsLtpFezw6HWF+P8o/C6GUSYePqMB7wwXRMy6LZUk=; b=BkaSp07Ai7a5 Xi1DHFwVOcXybiR0rhgxaefEhybqIBt/lP8kPi1zz3r6B4SGJK0gk14L8sL/f3RYrXCcY4eXhMfVm 03gd4zNnisLYPyYt7kgENCpHWQIQiutEpfppaegR2XBeRtuJ6KBCUVhNTpoBylK87KuGE9dQGO42I 3wiJW1JkWfKwyPxVY1c+xh710xO8KOSNWMBKgGAiLEQibMk0lp3s5U1z5rhlDi7hu/jh+w7f+h7gG tY3BZu3Vl5bQ3pAyUfXVzDqlkolkTGWo9sVCzVvzeHDmVkgdtgqYyR0dsV2V37KG/+3aC/C3KlAXM x4DHH4co1hkV8j5fOWFUDA==; Date: Wed, 26 Feb 2025 15:10:33 +0200 Message-Id: <868qpsx35i.fsf@gnu.org> From: Eli Zaretskii To: Iurie Marian In-Reply-To: (message from Iurie Marian on Tue, 25 Feb 2025 18:32:39 +0100) Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' References: X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 76559 Cc: michael.albinus@gmx.de, 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > Cc: Michael Albinus > From: Iurie Marian > Date: Tue, 25 Feb 2025 18:32:39 +0100 > > Dear Maintainers, > > Emacs is crashing while copying-as-kill/killing-word, only when compiled > with -O3 optimizations. I am using PGTK (see the configure command > below). I did a git bisect, and it seems that the commit below is > triggering the bug. To reproduce it just compile with -O3 and PGTK, then > simply hit M-. > > At the bottom you will also see the the stack trace, maybe it's useful. Is this still in GDB, and you can answer some questions about it? Or, if not, then reproduce the crash and answer the questions then? > (gdb) info locals > event = 0x555555957a40 > copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55cf0b00, > requestor = 0x555555f97a80, selection = 0x45, target = 0x4d, property > = 0x5e, time = 0} > moved_events = > > (gdb) x/s 0x55cf0b00 > 0x55cf0b00: What does this produce: (gdb) p *event From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 10:21:48 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 15:21:48 +0000 Received: from localhost ([127.0.0.1]:54806 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnJEK-0008Nx-6k for submit@debbugs.gnu.org; Wed, 26 Feb 2025 10:21:48 -0500 Received: from mail-wr1-x431.google.com ([2a00:1450:4864:20::431]:49468) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1tnJEG-0008Ne-Vv for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 10:21:45 -0500 Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-38f488f3161so3874913f8f.3 for <76559@debbugs.gnu.org>; Wed, 26 Feb 2025 07:21:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740583299; x=1741188099; darn=debbugs.gnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=EyIeGL25+86OE2D8EhAQ5bM+gEKdvWU2B2DbNImUkmQ=; b=W5WD1J0TD+ZHjIK9P2uY4NZZt+ftMrX9rn8HWrb/WSlvAGwL3MMKs+PfIkv36Xo9j+ TCRQse5b3WuB7xHOIFoTe8qYdvAIYKoT5Q2Az+XIXhDTe7bqMBOqdnb9AnsHkorUhhnM uBsufrrN2Bhv2BEh2/naQEgOjwFw/EILTd1z2oXT3MbGjYwdudb66/q5ZP3BM/o5TWSa oIZ/lQGjWQ27QhZbMPm4+Ah+MmfSZTQX6Wp+ma6xp9GT1iupm+2hfSYzV0aIilkibR9W R3EKhpeUmM/jVVCGRBKaLnNEMaI7k2zG5hW2urVCAks6FVYVaT/yiFkD+26Na3GtqT7o x+3g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740583299; x=1741188099; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=EyIeGL25+86OE2D8EhAQ5bM+gEKdvWU2B2DbNImUkmQ=; b=r7GFdUI+AtKoIUe3DdcpwdaIeAMCXASiUaScoecVE2yy+6Jt2WCXrLfj/DnYtBAqN1 xk6fw6e5IwuhlG76OtpYQxOW926nIMmTjp7ryfJ4pXrUkkBs42Vk6Wey4JJ4YiKzyQkY H1oECWchXPzzgJqG7P/9CYgI87lmUrtclNo9ePqgvdS7tpia7MQBVXhnUsCGAYSFGWFJ efO+OgR/eTSyAHdqZ1fm6EOpeU3q7wNMnOqx5v6zoFRxrR8ofTS/0vwUy3K7r5QvpAGs 5zAzYmJQM38cM4wT1/4LFQJm+YfHckVbWnpZSFuHxLnX4wPfufoqCTogJdNol1XJ50tl uspQ== X-Gm-Message-State: AOJu0YzW7Bn5zmLknEfFn/q3opaXxCJGt6jBD9s07BsJEZY4zH4IAD25 iJ46wvKVT9qOOGKyufh7cD4Rh9U2nXlTCaftj6BQcF4d1fV468hN6eZRmOH/4RT+vOlmwjfhBVv X69N9aZNn9J2jwH0nd2yRflppbn4= X-Gm-Gg: ASbGnculShACWB2QLAQ3mH49P0IFTuJy67vfLyU/JkBVpZci7flTng0UOCvFjVHmSFn 1BmR6FDLmOGhNPoamD7NzNr7WuHT35x3rIkoDE771rMsa6ntNMpowj0Evlm5g9m1PgaKQ+FatTt iFpNc8fQ== X-Google-Smtp-Source: AGHT+IFECoyAFOX+5VlsCqR/yT9wptR6XXAaXcrcADWw0OGLRn0s/p6a5E8rusOsNs4nZw/T4fbBUa5PccMxKZykm/0= X-Received: by 2002:a5d:5f53:0:b0:38f:23f4:2d7a with SMTP id ffacd0b85a97d-38f70827f18mr18454509f8f.40.1740583298605; Wed, 26 Feb 2025 07:21:38 -0800 (PST) MIME-Version: 1.0 References: <868qpsx35i.fsf@gnu.org> In-Reply-To: <868qpsx35i.fsf@gnu.org> From: Iurie Marian Date: Wed, 26 Feb 2025 16:21:27 +0100 X-Gm-Features: AQ5f1Jrh2o_i4q0lRtI56jcYfL3jOVJTjvjSZrRS-J4EmIieF0hl9fDtCHhffmE Message-ID: Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' To: Eli Zaretskii Content-Type: text/plain; charset="UTF-8" X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 Cc: michael.albinus@gmx.de, 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) > What does this produce: > > (gdb) p *event (gdb) p *event $1 = {kind = SELECTION_REQUEST_EVENT, ie = {kind = SELECTION_REQUEST_EVENT, part = scroll_bar_nowhere, code = 0, modifiers = 1439199584, x = 0x555555f95a80, y = 0x45, timestamp = 77, frame_or_window = 0x5e, arg = 0x0, device = 0x30}, sie = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c87160, requestor = 0x555555f95a80, selection = 0x45, target = 0x4d, property = 0x5e, time = 0}} On Wed, 26 Feb 2025 at 14:10, Eli Zaretskii wrote: > > > Cc: Michael Albinus > > From: Iurie Marian > > Date: Tue, 25 Feb 2025 18:32:39 +0100 > > > > Dear Maintainers, > > > > Emacs is crashing while copying-as-kill/killing-word, only when compiled > > with -O3 optimizations. I am using PGTK (see the configure command > > below). I did a git bisect, and it seems that the commit below is > > triggering the bug. To reproduce it just compile with -O3 and PGTK, then > > simply hit M-. > > > > At the bottom you will also see the the stack trace, maybe it's useful. > > Is this still in GDB, and you can answer some questions about it? Or, > if not, then reproduce the crash and answer the questions then? > > > (gdb) info locals > > event = 0x555555957a40 > > copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55cf0b00, > > requestor = 0x555555f97a80, selection = 0x45, target = 0x4d, property > > = 0x5e, time = 0} > > moved_events = > > > > (gdb) x/s 0x55cf0b00 > > 0x55cf0b00: > > What does this produce: > > (gdb) p *event > From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 10:48:57 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 15:48:57 +0000 Received: from localhost ([127.0.0.1]:54911 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnJea-0001Mp-Kv for submit@debbugs.gnu.org; Wed, 26 Feb 2025 10:48:56 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:46448) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1tnJeX-0001MX-Ra for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 10:48:54 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tnJeS-0003b5-H4; Wed, 26 Feb 2025 10:48:48 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=References:Subject:In-Reply-To:To:From:Date: mime-version; bh=f/VfH49ZGMQ4pZR93zlUqNyvUDxJJ8s59NTTJkfnumA=; b=haaJXa7MP5I2 NYkBOsLYv+WUn61wu3MO6UqbXYEAH5GgtBANLutQ7if0y3NdXbnSj1sSJ4mNpORc0B/vWSyueIgDW T1MH3QMe3ZLr/BYv2uyNHvJwpiRyFaxeZatOGo3YBz3QTq1dMglqEJflHJ+KR2neJF7KFB8ZDZ7Z4 GBN2EsKEn7R6RGZIyHddP8tfb4+6ChfIWjWURSeEKJYut3DPBOVMq4jT7PNwpWz0X2nXDo0LM/KXA 9XlKbpoQGX++KvkGAR4POcsQTyiSFXtEKGui7CqH7dg7AJFKFiH6YKgegtJxKxN5ZltzHq+OkSTSZ jS9hygEoa4PzPYJDtvI7Cw==; Date: Wed, 26 Feb 2025 17:48:45 +0200 Message-Id: <86o6yovh9e.fsf@gnu.org> From: Eli Zaretskii To: Iurie Marian In-Reply-To: (message from Iurie Marian on Wed, 26 Feb 2025 14:43:20 +0100) Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' References: <868qpsx35i.fsf@gnu.org> X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 76559 Cc: michael.albinus@gmx.de, marian.iurie@gmail.com, 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > From: Iurie Marian > Date: Wed, 26 Feb 2025 14:43:20 +0100 > Cc: Iurie Marian , 76559@debbugs.gnu.org, michael.albinus@gmx.de > > > What does this produce: > > > > (gdb) p *event > > (gdb) p *event > $1 = {kind = SELECTION_REQUEST_EVENT, ie = {kind = > SELECTION_REQUEST_EVENT, part = scroll_bar_nowhere, code = 0, > modifiers = 1439199584, x = 0x555555f95a80, y = 0x45, timestamp = 77, > frame_or_window = 0x5e, arg = 0x0, device = 0x30}, sie = {kind = > SELECTION_REQUEST_EVENT, dpyinfo = 0x55c87160, requestor = > 0x555555f95a80, selection = 0x45, target = 0x4d, property = 0x5e, time > = 0}} And this: (gdb) p event->dpyinfo->terminal (gdb) p event->dpyinfo->terminal->Vselection_list From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 11:03:53 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 16:03:53 +0000 Received: from localhost ([127.0.0.1]:54958 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnJt2-00029J-Lg for submit@debbugs.gnu.org; Wed, 26 Feb 2025 11:03:53 -0500 Received: from mail-wr1-x42a.google.com ([2a00:1450:4864:20::42a]:47593) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1tnJsx-00028l-9w for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 11:03:50 -0500 Received: by mail-wr1-x42a.google.com with SMTP id ffacd0b85a97d-38f6287649eso5499513f8f.3 for <76559@debbugs.gnu.org>; Wed, 26 Feb 2025 08:03:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740585821; x=1741190621; darn=debbugs.gnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=Qf4O01zWbckF9we4GJl7TkXCXs33JwPB7WWUUlqW19Q=; b=avErAErvWSASb6UsqGWYmlORW1cuXt8uffivgLj7YCVvd/9CiQB9Mldupx4fIe7XK6 LXTvNsT1evfhsbbkx9kEWtV59CWQNXo1jUvIsfFskYzm1WSTi1vp5zX5Yji5uO/gGrph 2UXFrCglRT7GH5lrBi66XmxxL745Rd6hmJYZMuLcDvAxqQG/DNUgCo/9ndEaxQx6egR2 jrSVekiG3VWEP2+5k9s7uinvjLLSXEga4DXaDlBar4w+FbI0ZPIrIZRMcQ44i1NWXzeE MZqzhxqNw6nTcBSKTUGAc9pPYP6mdwJEu0rfq2JA0/pDHAJteI+HHA+FQIdb8Gn2caG2 GVuA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740585821; x=1741190621; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Qf4O01zWbckF9we4GJl7TkXCXs33JwPB7WWUUlqW19Q=; b=t2AV1TllUg+7u3IhHXcjfT6Y6VK/ImpqVqmIu3Dcs4m3h2pkm3jtT7xnmRf2MRdeT3 OZSrKAKPbLagLb9iUYEJEp7brVUswboDTskdGKKE82pD089vNC2hzGcKIeAvaUOg+bBj X5KC5m+pG9qTtXf+euhxsF45PWA4FOwcvljeTamPtnJgWeUfnhP930Jb3v5bpp6a4eZ4 T+mwhd8JqMKcK/MGJ0y0kzf8byroFG+6uTpsaXiZok+JYAv6wSzVm++TyxFmC1h/MybV +0y/xBspvTYwpEQpVLG5ExjphqqTKGj11rqPFWXSyXge02/c7DpOgR+PhjI6If+krN3O ju2A== X-Forwarded-Encrypted: i=1; AJvYcCUOy42OYZrLU3iiWTWP10YoO7klrxc4AwfI5OT+5XtqqcRDkE+lsi9voHJpgoaWq+LA1xDTOA==@debbugs.gnu.org X-Gm-Message-State: AOJu0YxeYkXSzpjWh/T8TDcCVOqCgkwK5sLEsCRyWOusK6QrD8DRDh16 SgCvLzYXq7KG9gtiheyaP1iCi6v/LeleCiY8JA0nP93f8A9cO91ktSiHh/UVlDuYaEB9/oX/hGO nPJKI9oRsPYrO1wST9AHDSHZ/9N4= X-Gm-Gg: ASbGnct3kSLXo/UyHb+Zrq7vEg8Ltvfjl7vKxXyB7vbzzZ7fUeHO2Cumvp+TOV5+u1I o7nfVYwINxTG7bsCc01YAJl6UWwuI1AF6SOXfV1rgCHEByXQYccGnTfoZew0lESeGlANy8+bv5F cqP5DCpw== X-Google-Smtp-Source: AGHT+IGw2j6mMU4y3VcmyJt3nzPHzwNPXuoH6KJBFQYKdSObNm2kceln2AEolPSr1Q9GAsgKMdhWnJ8GI+CJgXAeYZ8= X-Received: by 2002:a5d:47c2:0:b0:38f:394f:d81 with SMTP id ffacd0b85a97d-38f7078453cmr15724107f8f.2.1740585820703; Wed, 26 Feb 2025 08:03:40 -0800 (PST) MIME-Version: 1.0 References: <868qpsx35i.fsf@gnu.org> <86o6yovh9e.fsf@gnu.org> In-Reply-To: <86o6yovh9e.fsf@gnu.org> From: Iurie Marian Date: Wed, 26 Feb 2025 17:03:29 +0100 X-Gm-Features: AQ5f1Jpxb6As6KNoFEWuLqcOnEdn6pErW_MATnEIwZMZ2UAGNrN2HIt3Oc91qUs Message-ID: Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' To: Eli Zaretskii Content-Type: text/plain; charset="UTF-8" X-Spam-Score: 1.0 (+) X-Debbugs-Envelope-To: 76559 Cc: michael.albinus@gmx.de, Iurie Marian , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) `dpyinfo` is actually invalid... (gdb) p *event $3 = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c83670, requestor = 0x555556035a80, selection = 0x45, target = 0x4d, property = 0x60, time = 0} (gdb) p *event->dpyinfo Cannot access memory at address 0x55c83670 (gdb) x/s 0x55c83670 0x55c83670: (gdb) p event->dpyinfo->terminal Cannot access memory at address 0x55c83678 On Wed, 26 Feb 2025 at 16:48, Eli Zaretskii wrote: > > > From: Iurie Marian > > Date: Wed, 26 Feb 2025 14:43:20 +0100 > > Cc: Iurie Marian , 76559@debbugs.gnu.org, michael.albinus@gmx.de > > > > > What does this produce: > > > > > > (gdb) p *event > > > > (gdb) p *event > > $1 = {kind = SELECTION_REQUEST_EVENT, ie = {kind = > > SELECTION_REQUEST_EVENT, part = scroll_bar_nowhere, code = 0, > > modifiers = 1439199584, x = 0x555555f95a80, y = 0x45, timestamp = 77, > > frame_or_window = 0x5e, arg = 0x0, device = 0x30}, sie = {kind = > > SELECTION_REQUEST_EVENT, dpyinfo = 0x55c87160, requestor = > > 0x555555f95a80, selection = 0x45, target = 0x4d, property = 0x5e, time > > = 0}} > > And this: > > (gdb) p event->dpyinfo->terminal > (gdb) p event->dpyinfo->terminal->Vselection_list From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 11:14:16 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 16:14:16 +0000 Received: from localhost ([127.0.0.1]:55019 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnK36-0002ic-28 for submit@debbugs.gnu.org; Wed, 26 Feb 2025 11:14:16 -0500 Received: from mail-qk1-x72b.google.com ([2607:f8b0:4864:20::72b]:46246) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1tnHhK-0001p3-Gk for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 08:43:39 -0500 Received: by mail-qk1-x72b.google.com with SMTP id af79cd13be357-7c0a4b030f2so877941385a.0 for <76559@debbugs.gnu.org>; Wed, 26 Feb 2025 05:43:38 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740577413; x=1741182213; darn=debbugs.gnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=xQ7rGTYWEOXU/UFmHzn4X9c4lRkrEITV2klMP7jLcgE=; b=KM9IGGPHMDlEY0BCDf9TEEXmqDrafMfNiBXZwASvMsKwdA/CKWGmA+7B8IDje4pc41 hPZBhmXzQSCH5+MZRCg4feibk10Wfn71ix6yC8Yp25wv5dNFjjjcxwBRkBfFeoldg6qY VApMcgCDAZOa/iMJCMapaYqBpXQEjfI57TIJosZdhiIneQ4MrRQiQEFwzDCEyGRUAcCv sxSUdfE1zTFps/91N7yAPjbFKBecCVHPN1HX+TysdDb6G9kClRzPLOvi+AHXbL79hC7k gY7NMsfOm14T2WREVLnxi+AFKgBoJYKgzTM4iVsreJbEHyibORe65eI9gnKjm8p5gW5j Qofw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740577413; x=1741182213; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=xQ7rGTYWEOXU/UFmHzn4X9c4lRkrEITV2klMP7jLcgE=; b=eNqnYrKGIiWUH8hVq8xc9i5FFP1M62LHnV24iFHcHFLn7mpxljzNeROsCYZrDrw+0i J5PF7Eh9vLwCQb0knc4s5/hGJmsTeef3cykB590EYcTgKjjb9uVdZnI2KU7yNiEVG95p 9lYIvsWIBzOjRBuMKM5FlFYeD/nwc+cd6FGO4YOlQ442flBZfglCfn6qWRjqc4mrO4Nr BLYY8W97dwg26fw85Ue+RhAgMGCjdctTX3QzK/5T8W6ch252s5EeXA9Dx/Lcjoz2WZQK hXlSU/J0VvLttFjfG84eInuyFYcFN3mZ9ZWbcyYqZoqPTAcsj/I+zhTQsYwZO+iWn+wB UAuw== X-Forwarded-Encrypted: i=1; AJvYcCXQPcBNOB/YQh+65iAyMDzr0q4So38CJjESWCeXFp8ubTYZ13qAgLbRoTZ6df+mdeAiIw4Atw==@debbugs.gnu.org X-Gm-Message-State: AOJu0Yz+gJ1J2is7o9Q9ZaTOIQ+uhaaS7Dxk3fqfjWH1oUtvm7hmTtnr 80jIQl/XlQsVrpCyLAiQO93IkSYwy6auDQdEvoh9ptXZCKFKQ/PHaFdRu3m95rexnJxt61rHy0E MIVw8BuowP9Ti4SoNWLJ+flLRamo= X-Gm-Gg: ASbGnct9d7FgAavx6bCu1EL5JrlVPMpAwAtPBUX1H1w0ZWJE72lEyTkN6aZi+nLZsF4 N086LSRsLI/0hyiyO79briFBUYdxIJp+v8OJPRjWeuEbmglobL06/5nlRJGU5qyzm09YSHaEfWW qt3eZ14w== X-Google-Smtp-Source: AGHT+IEQibdKHRP9kRs2jwgV57Q9OZJce1AMKh9wbVoI2A4cDg0vNm1GGc9DULBfeLHx1EmetpL1ZlJUCy/Szo24gQk= X-Received: by 2002:a05:622a:347:b0:471:fe62:9627 with SMTP id d75a77b69052e-47224716d1fmr320707241cf.3.1740577411890; Wed, 26 Feb 2025 05:43:31 -0800 (PST) MIME-Version: 1.0 References: <868qpsx35i.fsf@gnu.org> In-Reply-To: <868qpsx35i.fsf@gnu.org> From: Iurie Marian Date: Wed, 26 Feb 2025 14:43:20 +0100 X-Gm-Features: AWEUYZnNit8DmuyLhV-_1MbCjFeuR5BImgCZ0ha90ecT_NUudbTE3ha-M-iAsR0 Message-ID: Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' To: Eli Zaretskii Content-Type: text/plain; charset="UTF-8" X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 X-Mailman-Approved-At: Wed, 26 Feb 2025 11:13:52 -0500 Cc: michael.albinus@gmx.de, Iurie Marian , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) > What does this produce: > > (gdb) p *event (gdb) p *event $1 = {kind = SELECTION_REQUEST_EVENT, ie = {kind = SELECTION_REQUEST_EVENT, part = scroll_bar_nowhere, code = 0, modifiers = 1439199584, x = 0x555555f95a80, y = 0x45, timestamp = 77, frame_or_window = 0x5e, arg = 0x0, device = 0x30}, sie = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c87160, requestor = 0x555555f95a80, selection = 0x45, target = 0x4d, property = 0x5e, time = 0}} On Wed, 26 Feb 2025 at 14:10, Eli Zaretskii wrote: > > > Cc: Michael Albinus > > From: Iurie Marian > > Date: Tue, 25 Feb 2025 18:32:39 +0100 > > > > Dear Maintainers, > > > > Emacs is crashing while copying-as-kill/killing-word, only when compiled > > with -O3 optimizations. I am using PGTK (see the configure command > > below). I did a git bisect, and it seems that the commit below is > > triggering the bug. To reproduce it just compile with -O3 and PGTK, then > > simply hit M-. > > > > At the bottom you will also see the the stack trace, maybe it's useful. > > Is this still in GDB, and you can answer some questions about it? Or, > if not, then reproduce the crash and answer the questions then? > > > (gdb) info locals > > event = 0x555555957a40 > > copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55cf0b00, > > requestor = 0x555555f97a80, selection = 0x45, target = 0x4d, property > > = 0x5e, time = 0} > > moved_events = > > > > (gdb) x/s 0x55cf0b00 > > 0x55cf0b00: > > What does this produce: > > (gdb) p *event > From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 11:35:50 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 16:35:50 +0000 Received: from localhost ([127.0.0.1]:55099 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnKNy-0003wJ-5q for submit@debbugs.gnu.org; Wed, 26 Feb 2025 11:35:50 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:50420) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1tnKNu-0003vz-HC for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 11:35:47 -0500 Received: from fencepost.gnu.org ([2001:470:142:3::e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tnKNp-0001v0-2n; Wed, 26 Feb 2025 11:35:41 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gnu.org; s=fencepost-gnu-org; h=References:Subject:In-Reply-To:To:From:Date: mime-version; bh=cpNyHAWu5qbXXPHlyaF+EQAwMgWrlD3xHrQfzHloBT0=; b=Kj7oR6Yg7G9Z J6pyiriy5VMCKw1IhTq7iiw3ao9kwjitfOhyH88n/nNQhO/qvkEWsbnAei8S9lYncqj499M7ESad/ T8S73KOYzKiZ2Occk72KmcriMRJRTZ2A1sSUKbTeEt/0judcPiAhI+VeABvYI1EyM9B+s/njknjOn wYm75LTuD5xFazmaxcwoIbz+SP4G5C7b0GDdhcneXieyAhdWbGDLpvU33hvk9A5Wwn44tUb3K26xr 20lhi5MCkBd0coJfvIvtZXMoP7OcSFeH6KhhfK5tGVEotjbslV1eDfCGO5EIdLC40QAqcu+VVFGAf VRfSmf+FQK1ff73Jssd5LQ==; Date: Wed, 26 Feb 2025 18:35:37 +0200 Message-Id: <86h64gvf3a.fsf@gnu.org> From: Eli Zaretskii To: Iurie Marian , Po Lu In-Reply-To: (message from Iurie Marian on Wed, 26 Feb 2025 17:03:29 +0100) Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' References: <868qpsx35i.fsf@gnu.org> <86o6yovh9e.fsf@gnu.org> X-Spam-Score: -2.3 (--) X-Debbugs-Envelope-To: 76559 Cc: michael.albinus@gmx.de, iura.mail@gmail.com, 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -3.3 (---) > From: Iurie Marian > Date: Wed, 26 Feb 2025 17:03:29 +0100 > Cc: Iurie Marian , 76559@debbugs.gnu.org, michael.albinus@gmx.de > > `dpyinfo` is actually invalid... > > (gdb) p *event > $3 = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c83670, requestor > = 0x555556035a80, selection = 0x45, target = 0x4d, property = 0x60, > time = 0} > > (gdb) p *event->dpyinfo > Cannot access memory at address 0x55c83670 > > (gdb) x/s 0x55c83670 > 0x55c83670: > > (gdb) p event->dpyinfo->terminal > Cannot access memory at address 0x55c83678 So dpyinfo got freed somehow? Po Lu, any suggestions or ideas? From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 11:38:31 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 16:38:31 +0000 Received: from localhost ([127.0.0.1]:55113 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnKQY-00042b-SG for submit@debbugs.gnu.org; Wed, 26 Feb 2025 11:38:31 -0500 Received: from mail-wm1-x32d.google.com ([2a00:1450:4864:20::32d]:55750) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1tnKQV-00042I-T4 for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 11:38:28 -0500 Received: by mail-wm1-x32d.google.com with SMTP id 5b1f17b1804b1-4399ca9d338so110635e9.3 for <76559@debbugs.gnu.org>; Wed, 26 Feb 2025 08:38:27 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740587901; x=1741192701; darn=debbugs.gnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=uMuu9HrgmggXmZI/eTIi8/YO8/gOTGT5YMNPZ6Vfsqw=; b=mAzV1idqvTKyqKBA9bABOVNsuj0e0Hz5tGu2bcTtf3w1YDIkjSZs4NFlyKQ3uTd1hn 7E0vX2j6I182rQScOALc+1jUht+TZaggpK9YkDrTXlFlBFOWmCKJc37asJygeYEN7EKm cutnhTDW9kbv+3Bazg4PJZGwReJHOQOoiOGrN8TBKaHN1j8wTsdQ4T1FAbIxHDALgoxP EADh7OpTor8Opp3audMB4njdYtcCna788Oy4P0E3dhge0zdzn4uyJ0pSrA2SyxDETryw VVOc2kB1IIA1SEfArboJYpRt1UjO+8Qz8q9FVyWzK6E0DujAKt4gYr3BAysYU59/oL0v G9LA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740587901; x=1741192701; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=uMuu9HrgmggXmZI/eTIi8/YO8/gOTGT5YMNPZ6Vfsqw=; b=ZfmpwdCK5y5X9fBZzikvg5RmgYzid/PGwbtsqns6MQSPvbJsRchOod6WMR8ww29rZf 0BXNouBkweaiNQbEz68cyjBbqB/BOH2r0oZ8z5FExKZXhwShy7FE8aYd0Q7E547BYzr9 YX2ZxgduGJrjOJEZopbCnorZFqG+TdS7qow8Atz59dk3nXPTabTINoKEDz62y8rkM0CK QUUVt+TMCmVdSgIxHOnfmwrRwZ2vfrw+F6bFkVqgDrp6PHJtTBUN/s0Zn9+EoJwj93L3 RLEy2vH62HLsFr4e/V7f3YXDf1ioHCuAA/5wU/TbR/NM4cd5aEAvOW9nSe+7NZzIPdhn Dofw== X-Forwarded-Encrypted: i=1; AJvYcCUVfwtfods8cjiKYyt+hhmuJEtuVXRr1+wkZ3DBfe1eYUaZFtxSlzyWyzrU9XVNJywMUaQ3ZA==@debbugs.gnu.org X-Gm-Message-State: AOJu0YxYvtE4jZmbrDVIv22hnE+gROqN+j53Pmk+qbAYSIgS2ADKbbCB QKRbC/RZ1kU3jNq0kREv5ayKeiGYkOktWRWggE3bKkIDcesmj1U1o0gEYFwSfpd3/+BeGXGXCrl GH7IrEl9YdkzHSy8JRchl9FXs03g= X-Gm-Gg: ASbGncuCcAcUg3T26xNgJ+uzcPHkXRbag/ZV15Lp7G9E112Qpv8LBWJ+oZt/SUHJP0H cVS1jieNtesu1FferZdLLxF2eMtAK55/nHMw2ISl6Iy0wTBmUDXuDmxtNs08hQpK2OXVg773zHI gqtvdg6w== X-Google-Smtp-Source: AGHT+IFIp7jU30JSe8uVpgkhaspxUCR/ivQo/h1zCbgmTsJ5gkoEOv5+1p9zfJD0O5FJXG9uiIUM+DDBIg2FeiMCVYU= X-Received: by 2002:a5d:588b:0:b0:38c:5dcb:312e with SMTP id ffacd0b85a97d-390cc3aff06mr7050422f8f.0.1740587901506; Wed, 26 Feb 2025 08:38:21 -0800 (PST) MIME-Version: 1.0 References: <868qpsx35i.fsf@gnu.org> <86o6yovh9e.fsf@gnu.org> In-Reply-To: From: Iurie Marian Date: Wed, 26 Feb 2025 17:38:10 +0100 X-Gm-Features: AQ5f1Joiiufq1sy980lOo1ivKXoRiInEwOk3t9IqNbnaQaOlXlD3l78Fltan5lQ Message-ID: Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' To: Eli Zaretskii Content-Type: text/plain; charset="UTF-8" X-Spam-Score: 1.0 (+) X-Debbugs-Envelope-To: 76559 Cc: michael.albinus@gmx.de, Iurie Marian , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) btw, just by commenting the line src/keyboard.c:11697, it is not crashing anymore; maybe this could be a hint. https://git.savannah.gnu.org/cgit/emacs.git/tree/src/keyboard.c?h=master#n11697 /* Store it into the input event queue. */ /* kbd_buffer_store_event (&ie); */ On Wed, 26 Feb 2025 at 17:03, Iurie Marian wrote: > > `dpyinfo` is actually invalid... > > (gdb) p *event > $3 = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c83670, requestor > = 0x555556035a80, selection = 0x45, target = 0x4d, property = 0x60, > time = 0} > > (gdb) p *event->dpyinfo > Cannot access memory at address 0x55c83670 > > (gdb) x/s 0x55c83670 > 0x55c83670: > > (gdb) p event->dpyinfo->terminal > Cannot access memory at address 0x55c83678 > > On Wed, 26 Feb 2025 at 16:48, Eli Zaretskii wrote: > > > > > From: Iurie Marian > > > Date: Wed, 26 Feb 2025 14:43:20 +0100 > > > Cc: Iurie Marian , 76559@debbugs.gnu.org, michael.albinus@gmx.de > > > > > > > What does this produce: > > > > > > > > (gdb) p *event > > > > > > (gdb) p *event > > > $1 = {kind = SELECTION_REQUEST_EVENT, ie = {kind = > > > SELECTION_REQUEST_EVENT, part = scroll_bar_nowhere, code = 0, > > > modifiers = 1439199584, x = 0x555555f95a80, y = 0x45, timestamp = 77, > > > frame_or_window = 0x5e, arg = 0x0, device = 0x30}, sie = {kind = > > > SELECTION_REQUEST_EVENT, dpyinfo = 0x55c87160, requestor = > > > 0x555555f95a80, selection = 0x45, target = 0x4d, property = 0x5e, time > > > = 0}} > > > > And this: > > > > (gdb) p event->dpyinfo->terminal > > (gdb) p event->dpyinfo->terminal->Vselection_list From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 12:09:07 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 17:09:07 +0000 Received: from localhost ([127.0.0.1]:55209 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnKuB-0005Za-F8 for submit@debbugs.gnu.org; Wed, 26 Feb 2025 12:09:07 -0500 Received: from mail-4316.protonmail.ch ([185.70.43.16]:63011) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1tnKu5-0005Yc-2U for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 12:09:02 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail3; t=1740589734; x=1740848934; bh=hNOPwhn62CEaaOphFR4dRLbNan45j1i4RfLqyfSPDWk=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector:List-Unsubscribe:List-Unsubscribe-Post; b=bctzzpEdi5pKXIFV/UNsHlNM1sUmNBKx5g6EtQbSYMYl0almeus9rg3V7LQfeKYbT do3x9lbao6x1BcZNIiQOyqc655X21mppm8LzNanb0ODAOOtsJkbZXWt6R6Z8HhgiXr t4rh+2iHfx9Ojn455A63Rq4jz8L805oIBGl7Wvk1lcP5AjRVdfVniuNgKiiNW48zKJ 5fuHD7H0RDgUBRAGu5E9oXVxDqG0zg2yqq90tn1M0Lei6hNeh8fqao0udEtmSTRAk5 aSAhcniq3jD5qnPk/fEN3ESaB3N1ltZ7DKoS2MFcKKmjZ+jIINUBWoll3Z61GV8gTz 1cBRDt4TQKY3Q== Date: Wed, 26 Feb 2025 17:08:40 +0000 To: Iurie Marian From: Pip Cet Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' Message-ID: <87wmdc4osq.fsf@protonmail.com> In-Reply-To: References: Feedback-ID: 112775352:user:proton X-Pm-Message-ID: 17067319cf983f5e1301ce61cc4ca1661011dc50 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 Cc: Michael Albinus , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) "Iurie Marian" writes: > Dear Maintainers, > > Emacs is crashing while copying-as-kill/killing-word, only when compiled > with -O3 optimizations. I am using PGTK (see the configure command > below). I did a git bisect, and it seems that the commit below is > triggering the bug. To reproduce it just compile with -O3 and PGTK, then > simply hit M-. Just for completeness, you're using lto as well as -O3, which seems more likely to trigger this bug than Michael's change below. And I can't reproduce it here. Which precise compiler are you using? gcc --version would be very helpful here. > (gdb) list > 566 pushed =3D false; > 567 > 568 if (!dpyinfo) > 569 goto DONE; > 570 > 571 local_selection_data =3D LOCAL_SELECTION (selection_symbol, dpy= info); > 572 > 573 /* Decline if we don't own any selections. */ > 574 if (NILP (local_selection_data)) goto DONE; > 575 > > (gdb) fr 2 > #2 process_special_events () at > /home/rce/.local/emacs/sources/src/keyboard.c:4570 > 4570 pgtk_handle_selection_event (©); > (gdb) list > 4565 input_pending =3D readable_events (0); > 4566 > 4567 #ifdef HAVE_X11 > 4568 x_handle_selection_event (©); > 4569 #else > 4570 pgtk_handle_selection_event (©); > 4571 #endif > 4572 #elif defined HAVE_HAIKU > 4573 if (event->ie.kind !=3D SELECTION_CLEAR_EVENT) > 4574 emacs_abort (); > (gdb) info locals > event =3D 0x555555957a40 > copy =3D {kind =3D SELECTION_REQUEST_EVENT, dpyinfo =3D 0x55cf0b00, dypinfo looks like it was truncated to 32 bits. Can you check that 0x555555cf0b00 is a valid dpyinfo structure? The definition in question is: struct selection_input_event { ENUM_BF (event_kind) kind : EVENT_KIND_WIDTH; struct pgtk_display_info *dpyinfo; /* We spell it with an "o" here because X does. */ GdkWindow *requestor; GdkAtom selection, target, property; guint32 time; }; Can you run "ptype/o struct selection_input_event" and "ptype/o struct input_event" to see what might be going on? "ptype/o union buffered_input_event" would also be interesting, to see whether our union trick might no longer be working. Pip From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 12:25:35 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 17:25:35 +0000 Received: from localhost ([127.0.0.1]:55255 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnLA6-0006T9-Ph for submit@debbugs.gnu.org; Wed, 26 Feb 2025 12:25:35 -0500 Received: from mail-wr1-x430.google.com ([2a00:1450:4864:20::430]:52735) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1tnLA3-0006Sq-3t for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 12:25:32 -0500 Received: by mail-wr1-x430.google.com with SMTP id ffacd0b85a97d-38f378498c9so7161676f8f.1 for <76559@debbugs.gnu.org>; Wed, 26 Feb 2025 09:25:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740590725; x=1741195525; darn=debbugs.gnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=Ib/fswb1EBfhfj18LgQT4yubuHzut4WnHQRq7znIo7c=; b=hblomVk4wIjCh8JvFwy540/iU/7zS6r61woYwe8SIxk3W+AALNMpntHFXbht6qnj0K 0FgdkeiRSBny7A+GIc/m0JZA3MfMiroQFQA2L3POwMd5LOZdtn664pZR22xnIzkBeMtC Vis0ozojVKG82rxmFKvcQPHXCHqfFBdIoSb7Nuzdh89PcfVOetLydoc4iDLzHPcll+v1 unWeAALneB/n8pb7BhecWQ22JM2smyJefh8bAWB+ky6BRHlZjOg8oxaukwSyWwrrgl4J 4qX7o7rm6cBVL9lVoMmwy8cbC7yb54AC/4MbftGkJJrQOI7j7lpU46Gf5GkvM6Pr3RnT rqZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740590725; x=1741195525; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=Ib/fswb1EBfhfj18LgQT4yubuHzut4WnHQRq7znIo7c=; b=h7N85KYSxKUYLndYpR6PgKYKJZUGySEn1ibdgrsTrxc9BVBgo2dIiPSf5BT4MZCbiT sDtVaFZleNrDVnMBnDq/SZJX6yu9hlAZW2N+dWgPulq4aWSy5FUz5I6YYM+XcE3NbLVa BSh95P9g9bGx7vOhFzDZQ5iPo6D7UN7sQNB20RRnEKTfwlbQxzVOSeHkDk5ULAwJfivq nbOX2HCHi/BjTlAqWZ7JGucfPFPQfS+MYvVL3fyW464PDOn2gLtGrFb9iYp2KGAbUfn3 3hJ56eIlyn38lWdsV5wbNclGLOfGeZo59gyL7THZ+Ew0Xc1mO0T1IuGmfMRrZsK6ynse oj2g== X-Gm-Message-State: AOJu0YxIR17XpeHaXDni0fwSLcLuWWU985yCxeIP0CurP0S6SgCBBCqF pnxdiLHftO4z5PVHYq1B6fniOArs9eMhx7Jo1Z05jIL3BMAs8sHiBzuzqV0ZGcKrUi4myFBsKaH 2DCp24aRqyt7oDbGegcQfvtyEVZY= X-Gm-Gg: ASbGncuB2V2XXduiSAhTBtwhodQbXtBA4wlwXeD2cK0fOqvF00LsqJoTkxXczVxx/MK 3nhYxn715tO3Jg8MISlKGmikv4kLYiVhUppPo/jCX7zUMYFX06e0ZtGmePLyDwJ+MEHhsnFVA1D tYgqdeWg== X-Google-Smtp-Source: AGHT+IHjQq5zHaWfBD542mekCou2F3FYiv42pVQB2ATSlQI6TQFhngP7FBh01yw7uRM/3kefGuLPbNrmyIuQxveugtQ= X-Received: by 2002:a05:6000:1373:b0:38f:43c8:f766 with SMTP id ffacd0b85a97d-390cc60bb96mr8110095f8f.31.1740590724507; Wed, 26 Feb 2025 09:25:24 -0800 (PST) MIME-Version: 1.0 References: <87wmdc4osq.fsf@protonmail.com> In-Reply-To: <87wmdc4osq.fsf@protonmail.com> From: Iurie Marian Date: Wed, 26 Feb 2025 18:25:12 +0100 X-Gm-Features: AQ5f1JqiUtR_lSk1w2w5HjNxqS1onyX0GUfGHPiIz8bo37NhKSKnKq5FyjKs91A Message-ID: Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' To: Pip Cet Content-Type: multipart/alternative; boundary="000000000000d57045062f0edb0b" X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 Cc: Michael Albinus , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --000000000000d57045062f0edb0b Content-Type: text/plain; charset="UTF-8" Yes, it looks like Michael's changes have nothing to do with this bug, but these seem just to reveal some undefined behavior... idk. Btw, just by commenting the line src/keyboard.c:11697, it is not crashing anymore; maybe this could be a hint. > gcc --version gcc (Debian 12.2.0-14) 12.2.0 > Can you check that 0x555555cf0b00 is a valid dpyinfo structure? (gdb) info locals event = 0x555555953aa0 copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c82260, requestor = 0x555555f93a80, selection = 0x45, target = 0x4d, property = 0x5e, time = 0} moved_events = (gdb) x 0x555555c82260 0x555555c82260: 0x00 > Can you run "ptype/o struct selection_input_event" [...] (gdb) ptype/o struct selection_input_event /* offset | size */ type = struct selection_input_event { /* 0: 0 | 4 */ enum event_kind kind : 16; /* XXX 6-byte hole */ /* 8 | 8 */ struct pgtk_display_info *dpyinfo; /* 16 | 8 */ GdkWindow *requestor; /* 24 | 8 */ GdkAtom selection; /* 32 | 8 */ GdkAtom target; /* 40 | 8 */ GdkAtom property; /* 48 | 4 */ guint32 time; /* XXX 4-byte padding */ /* total size (bytes): 56 */ } (gdb) ptype/o struct input_event /* offset | size */ type = struct input_event { /* 0: 0 | 4 */ enum event_kind kind : 16; /* 2: 0 | 4 */ enum scroll_bar_part part : 16; /* 4 | 4 */ unsigned int code; /* 8 | 4 */ unsigned int modifiers; /* XXX 4-byte hole */ /* 16 | 8 */ Lisp_Object x; /* 24 | 8 */ Lisp_Object y; /* 32 | 8 */ Time timestamp; /* 40 | 8 */ Lisp_Object frame_or_window; /* 48 | 8 */ Lisp_Object arg; /* 56 | 8 */ Lisp_Object device; /* total size (bytes): 64 */ } (gdb) ptype/o union buffered_input_event /* offset | size */ type = union buffered_input_event { /* 4 */ enum event_kind kind : 16; /* 64 */ struct input_event { /* 0: 0 | 4 */ enum event_kind kind : 16; /* 2: 0 | 4 */ enum scroll_bar_part part : 16; /* 4 | 4 */ unsigned int code; /* 8 | 4 */ unsigned int modifiers; /* XXX 4-byte hole */ /* 16 | 8 */ Lisp_Object x; /* 24 | 8 */ Lisp_Object y; /* 32 | 8 */ Time timestamp; /* 40 | 8 */ Lisp_Object frame_or_window; /* 48 | 8 */ Lisp_Object arg; /* 56 | 8 */ Lisp_Object device; /* total size (bytes): 64 */ } ie; /* 56 */ struct selection_input_event { /* 0: 0 | 4 */ enum event_kind kind : 16; /* XXX 6-byte hole */ /* 8 | 8 */ struct pgtk_display_info *dpyinfo; /* 16 | 8 */ GdkWindow *requestor; /* 24 | 8 */ GdkAtom selection; /* 32 | 8 */ GdkAtom target; --Type for more, q to quit, c to continue without paging-- /* 40 | 8 */ GdkAtom property; /* 48 | 4 */ guint32 time; /* XXX 4-byte padding */ /* total size (bytes): 56 */ } sie; /* total size (bytes): 64 */ } On Wed, 26 Feb 2025 at 18:08, Pip Cet wrote: > "Iurie Marian" writes: > > > Dear Maintainers, > > > > Emacs is crashing while copying-as-kill/killing-word, only when compiled > > with -O3 optimizations. I am using PGTK (see the configure command > > below). I did a git bisect, and it seems that the commit below is > > triggering the bug. To reproduce it just compile with -O3 and PGTK, then > > simply hit M-. > > Just for completeness, you're using lto as well as -O3, which seems more > likely to trigger this bug than Michael's change below. > > And I can't reproduce it here. > > Which precise compiler are you using? gcc --version would be very > helpful here. > > > (gdb) list > > 566 pushed = false; > > 567 > > 568 if (!dpyinfo) > > 569 goto DONE; > > 570 > > 571 local_selection_data = LOCAL_SELECTION (selection_symbol, > dpyinfo); > > 572 > > 573 /* Decline if we don't own any selections. */ > > 574 if (NILP (local_selection_data)) goto DONE; > > 575 > > > > (gdb) fr 2 > > #2 process_special_events () at > > /home/rce/.local/emacs/sources/src/keyboard.c:4570 > > 4570 pgtk_handle_selection_event (©); > > (gdb) list > > 4565 input_pending = readable_events (0); > > 4566 > > 4567 #ifdef HAVE_X11 > > 4568 x_handle_selection_event (©); > > 4569 #else > > 4570 pgtk_handle_selection_event (©); > > 4571 #endif > > 4572 #elif defined HAVE_HAIKU > > 4573 if (event->ie.kind != SELECTION_CLEAR_EVENT) > > 4574 emacs_abort (); > > (gdb) info locals > > event = 0x555555957a40 > > copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55cf0b00, > > dypinfo looks like it was truncated to 32 bits. Can you check that > 0x555555cf0b00 is a valid dpyinfo structure? > > The definition in question is: > > struct selection_input_event > { > ENUM_BF (event_kind) kind : EVENT_KIND_WIDTH; > struct pgtk_display_info *dpyinfo; > /* We spell it with an "o" here because X does. */ > GdkWindow *requestor; > GdkAtom selection, target, property; > guint32 time; > }; > > Can you run "ptype/o struct selection_input_event" and "ptype/o struct > input_event" to see what might be going on? "ptype/o union > buffered_input_event" would also be interesting, to see whether our > union trick might no longer be working. > > Pip > > --000000000000d57045062f0edb0b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Yes, it looks like Michael's changes have nothing to d= o with this bug,
but these seem just to reveal some undefined behavior..= . idk. Btw,=C2=A0
just by commenting the line src/keyboard.c:11697, it = is not crashing=C2=A0
anymore; maybe this could be a hint.

> gcc --version
gcc (Debian 12.2.0-14) 12.2.0

> Can y= ou check that 0x555555cf0b00 is a valid dpyinfo structure?
(gdb) in= fo locals
event =3D 0x555555953aa0 <kbd_buffer+384>
copy =3D {k= ind =3D SELECTION_REQUEST_EVENT, dpyinfo =3D 0x55c82260, requestor =3D 0x55= 5555f93a80, selection =3D 0x45, target =3D 0x4d, property =3D 0x5e, time = =3D 0}
moved_events =3D <optimized out>

(gdb) x = 0x555555c82260
0x555555c82260: 0x00

> Can you run "ptype/= o struct selection_input_event" [...]

(gdb) p= type/o struct selection_input_event
/* offset =C2=A0 =C2=A0 =C2=A0| =C2= =A0 =C2=A0size */ =C2=A0type =3D struct selection_input_event {
/* =C2= =A0 =C2=A0 =C2=A00: 0 =C2=A0 | =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0 =C2=A0enum = event_kind kind : 16;
/* XXX =C2=A06-byte hole =C2=A0 =C2=A0 =C2=A0*//* =C2=A0 =C2=A0 =C2=A08 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ = =C2=A0 =C2=A0struct pgtk_display_info *dpyinfo;
/* =C2=A0 =C2=A0 16 =C2= =A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0GdkWindow *reques= tor;
/* =C2=A0 =C2=A0 24 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */= =C2=A0 =C2=A0GdkAtom selection;
/* =C2=A0 =C2=A0 32 =C2=A0 =C2=A0 =C2= =A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0GdkAtom target;
/* =C2=A0 = =C2=A0 40 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0GdkA= tom property;
/* =C2=A0 =C2=A0 48 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 = =C2=A0 4 */ =C2=A0 =C2=A0guint32 time;
/* XXX =C2=A04-byte padding =C2= =A0 */

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* total size (bytes): = =C2=A0 56 */
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0}

(gdb) ptype/o = struct input_event
/* offset =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0size */ = =C2=A0type =3D struct input_event {
/* =C2=A0 =C2=A0 =C2=A00: 0 =C2=A0 |= =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0 =C2=A0enum event_kind kind : 16;
/* = =C2=A0 =C2=A0 =C2=A02: 0 =C2=A0 | =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0 =C2=A0en= um scroll_bar_part part : 16;
/* =C2=A0 =C2=A0 =C2=A04 =C2=A0 =C2=A0 =C2= =A0| =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0 =C2=A0unsigned int code;
/* =C2=A0= =C2=A0 =C2=A08 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0 =C2= =A0unsigned int modifiers;
/* XXX =C2=A04-byte hole =C2=A0 =C2=A0 =C2=A0= */
/* =C2=A0 =C2=A0 16 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ = =C2=A0 =C2=A0Lisp_Object x;
/* =C2=A0 =C2=A0 24 =C2=A0 =C2=A0 =C2=A0| = =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0Lisp_Object y;
/* =C2=A0 =C2=A0 3= 2 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0Time timesta= mp;
/* =C2=A0 =C2=A0 40 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ = =C2=A0 =C2=A0Lisp_Object frame_or_window;
/* =C2=A0 =C2=A0 48 =C2=A0 =C2= =A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0Lisp_Object arg;
/* = =C2=A0 =C2=A0 56 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2= =A0Lisp_Object device;

=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* total = size (bytes): =C2=A0 64 */
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0}

= (gdb) ptype/o union buffered_input_event
/* offset =C2=A0 =C2=A0 =C2=A0|= =C2=A0 =C2=A0size */ =C2=A0type =3D union buffered_input_event {
/* =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 4 */ =C2= =A0 =C2=A0enum event_kind kind : 16;
/* =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A064 */ =C2=A0 =C2=A0struct input_event= {
/* =C2=A0 =C2=A0 =C2=A00: 0 =C2=A0 | =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0= =C2=A0 =C2=A0 =C2=A0enum event_kind kind : 16;
/* =C2=A0 =C2=A0 =C2=A02= : 0 =C2=A0 | =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0enum scro= ll_bar_part part : 16;
/* =C2=A0 =C2=A0 =C2=A04 =C2=A0 =C2=A0 =C2=A0| = =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0unsigned int code;
= /* =C2=A0 =C2=A0 =C2=A08 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 4 */ = =C2=A0 =C2=A0 =C2=A0 =C2=A0unsigned int modifiers;
/* XXX =C2=A04-byte h= ole =C2=A0 =C2=A0 =C2=A0*/
/* =C2=A0 =C2=A0 16 =C2=A0 =C2=A0 =C2=A0| =C2= =A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0Lisp_Object x;
/* =C2= =A0 =C2=A0 24 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0= =C2=A0 =C2=A0Lisp_Object y;
/* =C2=A0 =C2=A0 32 =C2=A0 =C2=A0 =C2=A0| = =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0Time timestamp;
/* = =C2=A0 =C2=A0 40 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2= =A0 =C2=A0 =C2=A0Lisp_Object frame_or_window;
/* =C2=A0 =C2=A0 48 =C2=A0= =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0Lisp_O= bject arg;
/* =C2=A0 =C2=A0 56 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2= =A0 8 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0Lisp_Object device;

=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* total size (bytes): =C2=A0 64 *= /
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0} ie;
/* =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A056 */ =C2=A0 =C2=A0struct s= election_input_event {
/* =C2=A0 =C2=A0 =C2=A00: 0 =C2=A0 | =C2=A0 =C2= =A0 =C2=A0 4 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0enum event_kind kind : 16;
/*= XXX =C2=A06-byte hole =C2=A0 =C2=A0 =C2=A0*/
/* =C2=A0 =C2=A0 =C2=A08 = =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0= struct pgtk_display_info *dpyinfo;
/* =C2=A0 =C2=A0 16 =C2=A0 =C2=A0 =C2= =A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0GdkWindow *reques= tor;
/* =C2=A0 =C2=A0 24 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */= =C2=A0 =C2=A0 =C2=A0 =C2=A0GdkAtom selection;
/* =C2=A0 =C2=A0 32 =C2= =A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 8 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0Gdk= Atom target;
--Type <RET> for more, q to quit, c to continue witho= ut paging--
/* =C2=A0 =C2=A0 40 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2= =A0 8 */ =C2=A0 =C2=A0 =C2=A0 =C2=A0GdkAtom property;
/* =C2=A0 =C2=A0 4= 8 =C2=A0 =C2=A0 =C2=A0| =C2=A0 =C2=A0 =C2=A0 4 */ =C2=A0 =C2=A0 =C2=A0 =C2= =A0guint32 time;
/* XXX =C2=A04-byte padding =C2=A0 */

=C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0/* total size (bytes): =C2=A0 56 *= /
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0} sie;

=C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0/* total size (bytes): =C2=A0 64 */
=C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0}



On Wed, 26 Feb 2025 at 18:08, Pip Cet <pipcet@protonmail.com> wrote:
"Iurie Marian" <= marian.iurie@gm= ail.com> writes:

> Dear Maintainers,
>
> Emacs is crashing while copying-as-kill/killing-word, only when compil= ed
> with -O3 optimizations. I am using PGTK (see the configure command
> below). I did a git bisect, and it seems that the commit below is
> triggering the bug. To reproduce it just compile with -O3 and PGTK, th= en
> simply hit M-<backspace>.

Just for completeness, you're using lto as well as -O3, which seems mor= e
likely to trigger this bug than Michael's change below.

And I can't reproduce it here.

Which precise compiler are you using?=C2=A0 gcc --version would be very
helpful here.

> (gdb) list
> 566=C2=A0 =C2=A0 =C2=A0 =C2=A0pushed =3D false;
> 567
> 568=C2=A0 =C2=A0 =C2=A0 =C2=A0if (!dpyinfo)
> 569=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0goto DONE;
> 570
> 571=C2=A0 =C2=A0 =C2=A0 =C2=A0local_selection_data =3D LOCAL_SELECTION= (selection_symbol, dpyinfo);
> 572
> 573=C2=A0 =C2=A0 =C2=A0 =C2=A0/* Decline if we don't own any selec= tions.=C2=A0 */
> 574=C2=A0 =C2=A0 =C2=A0 =C2=A0if (NILP (local_selection_data)) goto DO= NE;
> 575
>
> (gdb) fr 2
> #2=C2=A0 process_special_events () at
> /home/rce/.local/emacs/sources/src/keyboard.c:4570
> 4570=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pgtk_handle_selec= tion_event (&copy);
> (gdb) list
> 4565=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 input_pending =3D= readable_events (0);
> 4566
> 4567=C2=A0 =C2=A0 #ifdef HAVE_X11
> 4568=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 x_handle_selectio= n_event (&copy);
> 4569=C2=A0 =C2=A0 #else
> 4570=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 pgtk_handle_selec= tion_event (&copy);
> 4571=C2=A0 =C2=A0 #endif
> 4572=C2=A0 =C2=A0 #elif defined HAVE_HAIKU
> 4573=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 if (event->ie.= kind !=3D SELECTION_CLEAR_EVENT)
> 4574=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 emacs_abor= t ();
> (gdb) info locals
> event =3D 0x555555957a40 <kbd_buffer+384>
> copy =3D {kind =3D SELECTION_REQUEST_EVENT, dpyinfo =3D 0x55cf0b00,
dypinfo looks like it was truncated to 32 bits.=C2=A0 Can you check that 0x555555cf0b00 is a valid dpyinfo structure?

The definition in question is:

struct selection_input_event
{
=C2=A0 ENUM_BF (event_kind) kind : EVENT_KIND_WIDTH;
=C2=A0 struct pgtk_display_info *dpyinfo;
=C2=A0 /* We spell it with an "o" here because X does.=C2=A0 */ =C2=A0 GdkWindow *requestor;
=C2=A0 GdkAtom selection, target, property;
=C2=A0 guint32 time;
};

Can you run "ptype/o struct selection_input_event" and "ptyp= e/o struct
input_event" to see what might be going on?=C2=A0 "ptype/o union<= br> buffered_input_event" would also be interesting, to see whether our union trick might no longer be working.

Pip

--000000000000d57045062f0edb0b-- From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 13:48:08 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 18:48:08 +0000 Received: from localhost ([127.0.0.1]:55476 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnMRz-00025W-W4 for submit@debbugs.gnu.org; Wed, 26 Feb 2025 13:48:08 -0500 Received: from mail-40131.protonmail.ch ([185.70.40.131]:22767) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1tnMRu-00024q-DH for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 13:48:06 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail3; t=1740595675; x=1740854875; bh=a4Lt+clFj7q4SftSc7cWddZAoSnB5mMDwmDBo88vM5c=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector:List-Unsubscribe:List-Unsubscribe-Post; b=c2XA91ueyNFqwG2Pn3yUZ5sP+FeZ7Zs4MYNRO8jieEOc4zYa2/5SUFiMkH2K6siKo nxYyxAT6/9U9neYaX+yH/GDJ8D61+cWBUvIin3Xd5ooHoJjtPrqlPtyTuET1q9viUT Av3gqY3PrULPxxVis9jkNRhZFSb29o4JUNgZ+A7Z3lGVMfFcX1XdwLMTASK5STPJSs xfIPHVlPueoT1Inv0LejAz87hLMQA9MVxGjAoo7rLm/CQWScEShW5OznD+iTkXlsGr W+fuvZHiUd8RI2bdRdTnrRY71JMUI20c66eg1NVBp5cuQxb5uoTkVqDyzXgvbj+0jt YM7q0D+CC6Dgg== Date: Wed, 26 Feb 2025 18:47:51 +0000 To: Iurie Marian From: Pip Cet Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' Message-ID: <87cyf44k7h.fsf@protonmail.com> In-Reply-To: References: <87wmdc4osq.fsf@protonmail.com> Feedback-ID: 112775352:user:proton X-Pm-Message-ID: 14618ebcf92967efbce4151dc272ded249088532 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 Cc: Michael Albinus , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) "Iurie Marian" writes: > Yes, it looks like Michael's changes have nothing to do with this bug, > but these seem just to reveal some undefined behavior... idk. Btw,=20 > just by commenting the line src/keyboard.c:11697, it is not crashing=20 > anymore; maybe this could be a hint. > >> gcc --version > gcc (Debian 12.2.0-14) 12.2.0 > >> Can you check that 0x555555cf0b00 is a valid dpyinfo structure? > (gdb) info locals > event =3D 0x555555953aa0 > copy =3D {kind =3D SELECTION_REQUEST_EVENT, dpyinfo =3D 0x55c82260, reque= stor =3D 0x555555f93a80, selection =3D 0x45, target =3D 0x4d, property =3D > 0x5e, time =3D 0} > moved_events =3D > > (gdb) x 0x555555c82260 > 0x555555c82260: 0x00 Well, that only tells us the first byte is 0, which is probably correct. Can you retry with x/64gx 0x555555c82260 (or the new address) so we see some more data? >> Can you run "ptype/o struct selection_input_event" [...] > > (gdb) ptype/o struct selection_input_event > /* offset | size */ type =3D struct selection_input_event { > /* 0: 0 | 4 */ enum event_kind kind : 16; > /* XXX 6-byte hole */ This is strange, but it looks like this may be a C undefined behavior bug (or, less likely, an actual GCC bug). If the event_kind bitfield is listed with size 4, shouldn't the hole after it be listed with size 4, not size 6? Here's the code obtained by disass/s evq_flush which copies the relevant part of the header: 3810=09 *kbd_store_ptr =3D *event; 0x00000000002f9f4c <+108>:=09movd %xmm0,(%rdx) 0x00000000002f9f50 <+112>:=09movdqa 0x20(%rsp),%xmm4 0x00000000002f9f56 <+118>:=09movdqa 0x10(%rsp),%xmm5 0x00000000002f9f5c <+124>:=09movq %xmm1,0x4(%rdx) The first movd (not movq or movdq!) copies four bytes containing the event_kind. The unaligned movq at +124 copies 8 bytes to bytes 4-11 of the struct, which copies the low-order 4 bytes of the dpyinfo. the code continues with: 0x00000000002f9f61 <+129>:=09mov %rax,0x1094e0(%rip) # 0x40344= 8 0x00000000002f9f68 <+136>:=09sub %rcx,%rax 0x00000000002f9f6b <+139>:=09sar $0x6,%rax 0x00000000002f9f6f <+143>:=09mov %r12,0x20(%rdx) 0x00000000002f9f73 <+147>:=09mov %rbp,0x38(%rdx) 0x00000000002f9f77 <+151>:=09movups %xmm4,0x10(%rdx) 0x00000000002f9f7b <+155>:=09movups %xmm5,0x28(%rdx) but, as far as I can tell, bytes 12-15 are never touched by this code. Here's the corresponding code which copies the event structure: 327=09 union buffered_input_event ev =3D evq->q[0]; 0x00000000002f9fee <+270>:=09lea 0x19a64b(%rip),%rcx # 0x49464= 0 0x00000000002f9ff5 <+277>:=09mov (%rcx),%rdi 0x00000000002f9ff8 <+280>:=09movd (%rdi),%xmm0 0x00000000002f9ffc <+284>:=09movdqu 0x10(%rdi),%xmm2 0x00000000002fa001 <+289>:=09movdqu 0x28(%rdi),%xmm3 0x00000000002fa006 <+294>:=09movq 0x4(%rdi),%xmm1 0x00000000002fa00b <+299>:=09mov 0x20(%rdi),%r12 0x00000000002fa00f <+303>:=09mov 0x38(%rdi),%rbp 0x00000000002fa013 <+307>:=09pextrw $0x0,%xmm0,%r13d 0x00000000002fa019 <+313>:=09movaps %xmm2,0x20(%rsp) 0x00000000002fa01e <+318>:=09movaps %xmm3,0x10(%rsp) Again, I see no code here which touches 0xc(%rdi) or the three bytes after it. But union buffered_input_event has no hole at bytes 12-15, only two of its union members do. So it seems this may be a bug with bitfield enums; it's not quite clear to me why we're using one here, but it doesn't seem to be working as intended. Pip From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 15:13:07 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 20:13:07 +0000 Received: from localhost ([127.0.0.1]:55604 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnNmE-0006D0-J6 for submit@debbugs.gnu.org; Wed, 26 Feb 2025 15:13:07 -0500 Received: from mail-wm1-x32e.google.com ([2a00:1450:4864:20::32e]:57823) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1tnNlP-0006BL-Vb for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 15:12:16 -0500 Received: by mail-wm1-x32e.google.com with SMTP id 5b1f17b1804b1-439a331d981so1905925e9.3 for <76559@debbugs.gnu.org>; Wed, 26 Feb 2025 12:12:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740600729; x=1741205529; darn=debbugs.gnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=iGXE7p1V0Fk/VkFF63AxIy8uv1qIZ9Pt53KHh1OZU9c=; b=W5tGko09or2nFcn6pDY/Hjf9wgBPT4JRJclYosfdjwji1DDKL7bvl0cK7chVt6nV+Z rIwTgVYkFOJKaRoPHYDUPOcozmyx7NfItOFRcoJpeyDaSwcCT3v5p/4Ok61Z3COO9oya d6UcPj9lWOK8Z99PjjZWMT5MOCJcNZWVIk3mbiq0Ai6JaEgKCCRY9cWlWi2Kz0+uF5W/ vewo0c6FvxYKT/2PQIPzAoHOM4i5CoKOXZoN71PjcLl2aZ4eg0xMv8EIiokzDs1YFXeQ TTXPudTiY6CUdzc5RVlH5M6Wd5H9FH4q4E+63qgonIeWBxZg2DjZx3PJ5RvijpxvrMtu Sr2w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740600729; x=1741205529; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=iGXE7p1V0Fk/VkFF63AxIy8uv1qIZ9Pt53KHh1OZU9c=; b=Rc31fMpAp5cK2df5Wm0YI7KgCDbm0a04moWBp7FOiBngAO0pzFcruMbWe0sdxn1xeV KIYp/sHFP6vkADnuWaKVwzZP3aq56ccFRsbhyLbfmhFnzcKi45b++InOmHBesZoWcj0s EYlgETxrTaPIWIjb4CDOps2aSAEzrarzDKDWDK0t6lIHKrsH4JtOZgJrt5sD7F5usVpe OfCtMsrjxB0RDg9ZEkK7BBIpjquaLnEjcN+0Pjlo1Y2oZ1XItFjXAVDbVA26r04B0vk8 2CcG5OxJdFtVLKMz/TG0XACGRGw5cG3uQ1DpvryzdjkGvm0ZXGmG4SzVIQRFeVwUzbTu OJ1Q== X-Gm-Message-State: AOJu0YwlEfh2qlxwPhAGrC2p2oGDTetsGyEL/yFY63eSj1wYG2FN2Gvs FaZYuIrJG1EkDjdTO/KdBhFfxTkJngJsxL6KUJJa7+UZHYcIo+ay3a7nwms8FEK96THazFP1DVD z21OGagSg/Amrn3kuzzEhiGvcFGupr62tqyEovSIr X-Gm-Gg: ASbGnctGvg8bFir3lDkLXbtN9TtwNiccZjErymeirdKVT2VNYSEAIDOPlV9wOP+PrNk AYSaaQSgCuFmJJVbLaZNjNPpbEqlgO5JEqC9cwVFA3IpLftQ1mF+I9lP3djenEab8OPQBJgD0i4 ggQf8IgNSU2I/dJA/eFGZgo+mXTlmdhTiF7KWFA95nwg== X-Google-Smtp-Source: AGHT+IGxLOvyyL+1Z91sx1gfBLeABEh0xzVVj7kc0QgaEKW1siZhCv9ULfFpBcF9NE1lval9Bah33VBWW1hidJGWb18= X-Received: by 2002:a5d:47af:0:b0:38f:4f07:fab7 with SMTP id ffacd0b85a97d-390d4f37902mr3961143f8f.8.1740600729055; Wed, 26 Feb 2025 12:12:09 -0800 (PST) MIME-Version: 1.0 References: <87wmdc4osq.fsf@protonmail.com> <87cyf44k7h.fsf@protonmail.com> In-Reply-To: <87cyf44k7h.fsf@protonmail.com> From: Iurie Marian Date: Wed, 26 Feb 2025 21:11:57 +0100 X-Gm-Features: AQ5f1JqHhTgvx8_XkaixDcdZsqUaQnHJh_vgGhynu2WFR0g_Pwlx_h6ceoAevpI Message-ID: Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' To: Pip Cet Content-Type: multipart/alternative; boundary="00000000000026bbfe062f113078" X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 Cc: 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --00000000000026bbfe062f113078 Content-Type: text/plain; charset="UTF-8" > Can you retry with x/64gx [...] (gdb) info locals event = 0x555555953aa0 copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c84660, requestor = 0x555556038a80, selection = 0x45, target = 0x4d, property = 0x5e, time = 0} moved_events = (gdb) x/64gx 0x555555c84660 0x555555c84660: 0x0000000000000000 0x0000555555b05f28 0x555555c84670: 0x0000555555b7a000 0x0000000000000000 0x555555c84680: 0x00007fffef274083 0x0000000100000001 0x555555c84690: 0x0000555555c6d750 0x0000000300000006 0x555555c846a0: 0x0000000000000011 0x0000000000000000 0x555555c846b0: 0x0000000000000000 0x0000000000000000 0x555555c846c0: 0x4058000000000000 0x4058000000000000 0x555555c846d0: 0x0000002000000000 0x0000000000000001 0x555555c846e0: 0xffffffffffffffff 0x000000000000002a 0x555555c846f0: 0x0000000000000000 0x0000555555da3120 0x555555c84700: 0x0000555555da0d20 0xffffffffffffffff 0x555555c84710: 0xffffffff00000000 0x00000000ffffffff 0x555555c84720: 0x0000000000000000 0x0000000000000000 0x555555c84730: 0x0000000000000000 0x0000000000000000 0x555555c84740: 0x0000000000000000 0x0000000000000000 0x555555c84750: 0x0000555555b06178 0x0000555555b06178 0x555555c84760: 0x0000555555b06178 0x0000000000000000 0x555555c84770: 0x0000000000000000 0x0000000000000000 0x555555c84780: 0x0000000000000000 0x0000000000000000 0x555555c84790: 0x0000000000000000 0x000000000221256a 0x555555c847a0: 0x0000000000000000 0x0000555555d6ce40 0x555555c847b0: 0x0000555555c12aa0 0x0000555555c6dce0 0x555555c847c0: 0x0000000000000000 0x0000000000000000 0x555555c847d0: 0x0000555555e75b90 0x0000555555b06178 0x555555c847e0: 0x0000000000000000 0x0000000000000000 0x555555c847f0: 0x3ff0000000000000 0x3ff0000000000000 0x555555c84800: 0x0000000000000004 0x0000000000000021 0x555555c84810: 0x0000555555c0c360 0x00007ffff7fade20 0x555555c84820: 0x0000000000000000 0x0000000000000041 0x555555c84830: 0x0000555555c0fb00 0x0000555555c7bb40 0x555555c84840: 0x0000000000000000 0x0000555555c0faa0 0x555555c84850: 0x0000555555c80220 0x0000000000000000 I have just tried with gcc 14.2 and it works well - NO crash, although it shows the same "6-byte hole" for `ptype/o struct selection_input_event`. Kind Regards Iurie On Wed, 26 Feb 2025 at 19:47, Pip Cet wrote: > "Iurie Marian" writes: > > > Yes, it looks like Michael's changes have nothing to do with this bug, > > but these seem just to reveal some undefined behavior... idk. Btw, > > just by commenting the line src/keyboard.c:11697, it is not crashing > > anymore; maybe this could be a hint. > > > >> gcc --version > > gcc (Debian 12.2.0-14) 12.2.0 > > > >> Can you check that 0x555555cf0b00 is a valid dpyinfo structure? > > (gdb) info locals > > event = 0x555555953aa0 > > copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c82260, requestor > = 0x555555f93a80, selection = 0x45, target = 0x4d, property = > > 0x5e, time = 0} > > moved_events = > > > > (gdb) x 0x555555c82260 > > 0x555555c82260: 0x00 > > Well, that only tells us the first byte is 0, which is probably correct. > Can you retry with x/64gx 0x555555c82260 (or the new address) so we see > some more data? > > >> Can you run "ptype/o struct selection_input_event" [...] > > > > (gdb) ptype/o struct selection_input_event > > /* offset | size */ type = struct selection_input_event { > > /* 0: 0 | 4 */ enum event_kind kind : 16; > > /* XXX 6-byte hole */ > > This is strange, but it looks like this may be a C undefined behavior > bug (or, less likely, an actual GCC bug). If the event_kind bitfield is > listed with size 4, shouldn't the hole after it be listed with size 4, > not size 6? > > Here's the code obtained by disass/s evq_flush which copies the relevant > part of the header: > > 3810 *kbd_store_ptr = *event; > 0x00000000002f9f4c <+108>: movd %xmm0,(%rdx) > 0x00000000002f9f50 <+112>: movdqa 0x20(%rsp),%xmm4 > 0x00000000002f9f56 <+118>: movdqa 0x10(%rsp),%xmm5 > 0x00000000002f9f5c <+124>: movq %xmm1,0x4(%rdx) > > The first movd (not movq or movdq!) copies four bytes containing the > event_kind. The unaligned movq at +124 copies 8 bytes to bytes 4-11 of > the struct, which copies the low-order 4 bytes of the dpyinfo. > > the code continues with: > > 0x00000000002f9f61 <+129>: mov %rax,0x1094e0(%rip) # > 0x403448 > 0x00000000002f9f68 <+136>: sub %rcx,%rax > 0x00000000002f9f6b <+139>: sar $0x6,%rax > 0x00000000002f9f6f <+143>: mov %r12,0x20(%rdx) > 0x00000000002f9f73 <+147>: mov %rbp,0x38(%rdx) > 0x00000000002f9f77 <+151>: movups %xmm4,0x10(%rdx) > 0x00000000002f9f7b <+155>: movups %xmm5,0x28(%rdx) > > but, as far as I can tell, bytes 12-15 are never touched by this code. > > Here's the corresponding code which copies the event structure: > > 327 union buffered_input_event ev = evq->q[0]; > 0x00000000002f9fee <+270>: lea 0x19a64b(%rip),%rcx # > 0x494640 > 0x00000000002f9ff5 <+277>: mov (%rcx),%rdi > 0x00000000002f9ff8 <+280>: movd (%rdi),%xmm0 > 0x00000000002f9ffc <+284>: movdqu 0x10(%rdi),%xmm2 > 0x00000000002fa001 <+289>: movdqu 0x28(%rdi),%xmm3 > 0x00000000002fa006 <+294>: movq 0x4(%rdi),%xmm1 > 0x00000000002fa00b <+299>: mov 0x20(%rdi),%r12 > 0x00000000002fa00f <+303>: mov 0x38(%rdi),%rbp > 0x00000000002fa013 <+307>: pextrw $0x0,%xmm0,%r13d > 0x00000000002fa019 <+313>: movaps %xmm2,0x20(%rsp) > 0x00000000002fa01e <+318>: movaps %xmm3,0x10(%rsp) > > > Again, I see no code here which touches 0xc(%rdi) or the three bytes > after it. > > But union buffered_input_event has no hole at bytes 12-15, only two of > its union members do. > > So it seems this may be a bug with bitfield enums; it's not quite clear > to me why we're using one here, but it doesn't seem to be working as > intended. > > Pip > > --00000000000026bbfe062f113078 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
> Can you retry with x/64gx [...]

(gdb) info locals
event =3D 0x555555953aa0 = <kbd_buffer+384>
copy =3D {kind =3D SELECTION_REQUEST_EVENT, dpyin= fo =3D 0x55c84660, requestor =3D 0x555556038a80, selection =3D 0x45, target= =3D 0x4d, property =3D 0x5e, time =3D 0}
moved_events =3D <optimized= out>

(gdb) x/64gx 0x555555c8466= 0
0x555555c84660: 0x0000000000000000 =C2=A0 =C2=A0 =C2=A00x0000555555b05= f28
0x555555c84670: 0x0000555555b7a000 =C2=A0 =C2=A0 =C2=A00x00000000000= 00000
0x555555c84680: 0x00007fffef274083 =C2=A0 =C2=A0 =C2=A00x000000010= 0000001
0x555555c84690: 0x0000555555c6d750 =C2=A0 =C2=A0 =C2=A00x0000000= 300000006
0x555555c846a0: 0x0000000000000011 =C2=A0 =C2=A0 =C2=A00x00000= 00000000000
0x555555c846b0: 0x0000000000000000 =C2=A0 =C2=A0 =C2=A00x000= 0000000000000
0x555555c846c0: 0x4058000000000000 =C2=A0 =C2=A0 =C2=A00x4= 058000000000000
0x555555c846d0: 0x0000002000000000 =C2=A0 =C2=A0 =C2=A00= x0000000000000001
0x555555c846e0: 0xffffffffffffffff =C2=A0 =C2=A0 =C2= =A00x000000000000002a
0x555555c846f0: 0x0000000000000000 =C2=A0 =C2=A0 = =C2=A00x0000555555da3120
0x555555c84700: 0x0000555555da0d20 =C2=A0 =C2= =A0 =C2=A00xffffffffffffffff
0x555555c84710: 0xffffffff00000000 =C2=A0 = =C2=A0 =C2=A00x00000000ffffffff
0x555555c84720: 0x0000000000000000 =C2= =A0 =C2=A0 =C2=A00x0000000000000000
0x555555c84730: 0x0000000000000000 = =C2=A0 =C2=A0 =C2=A00x0000000000000000
0x555555c84740: 0x000000000000000= 0 =C2=A0 =C2=A0 =C2=A00x0000000000000000
0x555555c84750: 0x0000555555b06= 178 =C2=A0 =C2=A0 =C2=A00x0000555555b06178
0x555555c84760: 0x0000555555b= 06178 =C2=A0 =C2=A0 =C2=A00x0000000000000000
0x555555c84770: 0x000000000= 0000000 =C2=A0 =C2=A0 =C2=A00x0000000000000000
0x555555c84780: 0x0000000= 000000000 =C2=A0 =C2=A0 =C2=A00x0000000000000000
0x555555c84790: 0x00000= 00000000000 =C2=A0 =C2=A0 =C2=A00x000000000221256a
0x555555c847a0: 0x000= 0000000000000 =C2=A0 =C2=A0 =C2=A00x0000555555d6ce40
0x555555c847b0: 0x0= 000555555c12aa0 =C2=A0 =C2=A0 =C2=A00x0000555555c6dce0
0x555555c847c0: 0= x0000000000000000 =C2=A0 =C2=A0 =C2=A00x0000000000000000
0x555555c847d0:= 0x0000555555e75b90 =C2=A0 =C2=A0 =C2=A00x0000555555b06178
0x555555c847e= 0: 0x0000000000000000 =C2=A0 =C2=A0 =C2=A00x0000000000000000
0x555555c84= 7f0: 0x3ff0000000000000 =C2=A0 =C2=A0 =C2=A00x3ff0000000000000
0x555555c= 84800: 0x0000000000000004 =C2=A0 =C2=A0 =C2=A00x0000000000000021
0x55555= 5c84810: 0x0000555555c0c360 =C2=A0 =C2=A0 =C2=A00x00007ffff7fade20
0x555= 555c84820: 0x0000000000000000 =C2=A0 =C2=A0 =C2=A00x0000000000000041
0x5= 55555c84830: 0x0000555555c0fb00 =C2=A0 =C2=A0 =C2=A00x0000555555c7bb40
0= x555555c84840: 0x0000000000000000 =C2=A0 =C2=A0 =C2=A00x0000555555c0faa00x555555c84850: 0x0000555555c80220 =C2=A0 =C2=A0 =C2=A00x0000000000000000<= /font>


I have just tried with gcc 14.2 and= it works well - NO crash, although it shows the same "6-byte hole&quo= t; for `ptype/o struct selection_input_event`.

Kin= d Regards
Iurie


On Wed,= 26 Feb 2025 at 19:47, Pip Cet <pipcet@protonmail.com> wrote:
"Iurie Marian" <marian.iurie@gmail.com> writes:<= br>
> Yes, it looks like Michael's changes have nothing to do with this = bug,
> but these seem just to reveal some undefined behavior... idk. Btw, > just by commenting the line src/keyboard.c:11697, it is not crashing <= br> > anymore; maybe this could be a hint.
>
>> gcc --version
> gcc (Debian 12.2.0-14) 12.2.0
>
>> Can you check that 0x555555cf0b00 is a valid dpyinfo structure? > (gdb) info locals
> event =3D 0x555555953aa0 <kbd_buffer+384>
> copy =3D {kind =3D SELECTION_REQUEST_EVENT, dpyinfo =3D 0x55c82260, re= questor =3D 0x555555f93a80, selection =3D 0x45, target =3D 0x4d, property = =3D
> 0x5e, time =3D 0}
> moved_events =3D <optimized out>
>
> (gdb) x 0x555555c82260
> 0x555555c82260: 0x00

Well, that only tells us the first byte is 0, which is probably correct. Can you retry with x/64gx 0x555555c82260 (or the new address) so we see
some more data?

>> Can you run "ptype/o struct selection_input_event" [...]=
>
> (gdb) ptype/o struct selection_input_event
> /* offset=C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 size */=C2=A0 type =3D st= ruct selection_input_event {
> /*=C2=A0 =C2=A0 =C2=A0 0: 0=C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2=A04 = */=C2=A0 =C2=A0 enum event_kind kind : 16;
> /* XXX=C2=A0 6-byte hole=C2=A0 =C2=A0 =C2=A0 */

This is strange, but it looks like this may be a C undefined behavior
bug (or, less likely, an actual GCC bug).=C2=A0 If the event_kind bitfield = is
listed with size 4, shouldn't the hole after it be listed with size 4,<= br> not size 6?

Here's the code obtained by disass/s evq_flush which copies the relevan= t
part of the header:

3810=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 *kbd_store_ptr =3D *event;
=C2=A0 =C2=A00x00000000002f9f4c <+108>:=C2=A0 =C2=A0movd=C2=A0 =C2=A0= %xmm0,(%rdx)
=C2=A0 =C2=A00x00000000002f9f50 <+112>:=C2=A0 =C2=A0movdqa 0x20(%rsp)= ,%xmm4
=C2=A0 =C2=A00x00000000002f9f56 <+118>:=C2=A0 =C2=A0movdqa 0x10(%rsp)= ,%xmm5
=C2=A0 =C2=A00x00000000002f9f5c <+124>:=C2=A0 =C2=A0movq=C2=A0 =C2=A0= %xmm1,0x4(%rdx)

The first movd (not movq or movdq!) copies four bytes containing the
event_kind.=C2=A0 The unaligned movq at +124 copies 8 bytes to bytes 4-11 o= f
the struct, which copies the low-order 4 bytes of the dpyinfo.

the code continues with:

=C2=A0 =C2=A00x00000000002f9f61 <+129>:=C2=A0 =C2=A0mov=C2=A0 =C2=A0 = %rax,0x1094e0(%rip)=C2=A0 =C2=A0 =C2=A0 =C2=A0 # 0x403448 <kbd_store_ptr= >
=C2=A0 =C2=A00x00000000002f9f68 <+136>:=C2=A0 =C2=A0sub=C2=A0 =C2=A0 = %rcx,%rax
=C2=A0 =C2=A00x00000000002f9f6b <+139>:=C2=A0 =C2=A0sar=C2=A0 =C2=A0 = $0x6,%rax
=C2=A0 =C2=A00x00000000002f9f6f <+143>:=C2=A0 =C2=A0mov=C2=A0 =C2=A0 = %r12,0x20(%rdx)
=C2=A0 =C2=A00x00000000002f9f73 <+147>:=C2=A0 =C2=A0mov=C2=A0 =C2=A0 = %rbp,0x38(%rdx)
=C2=A0 =C2=A00x00000000002f9f77 <+151>:=C2=A0 =C2=A0movups %xmm4,0x10= (%rdx)
=C2=A0 =C2=A00x00000000002f9f7b <+155>:=C2=A0 =C2=A0movups %xmm5,0x28= (%rdx)

but, as far as I can tell, bytes 12-15 are never touched by this code.

Here's the corresponding code which copies the event structure:

327=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0union buffered_input_event ev = =3D evq->q[0];
=C2=A0 =C2=A00x00000000002f9fee <+270>:=C2=A0 =C2=A0lea=C2=A0 =C2=A0 = 0x19a64b(%rip),%rcx=C2=A0 =C2=A0 =C2=A0 =C2=A0 # 0x494640 <event_q.lto_p= riv.0>
=C2=A0 =C2=A00x00000000002f9ff5 <+277>:=C2=A0 =C2=A0mov=C2=A0 =C2=A0 = (%rcx),%rdi
=C2=A0 =C2=A00x00000000002f9ff8 <+280>:=C2=A0 =C2=A0movd=C2=A0 =C2=A0= (%rdi),%xmm0
=C2=A0 =C2=A00x00000000002f9ffc <+284>:=C2=A0 =C2=A0movdqu 0x10(%rdi)= ,%xmm2
=C2=A0 =C2=A00x00000000002fa001 <+289>:=C2=A0 =C2=A0movdqu 0x28(%rdi)= ,%xmm3
=C2=A0 =C2=A00x00000000002fa006 <+294>:=C2=A0 =C2=A0movq=C2=A0 =C2=A0= 0x4(%rdi),%xmm1
=C2=A0 =C2=A00x00000000002fa00b <+299>:=C2=A0 =C2=A0mov=C2=A0 =C2=A0 = 0x20(%rdi),%r12
=C2=A0 =C2=A00x00000000002fa00f <+303>:=C2=A0 =C2=A0mov=C2=A0 =C2=A0 = 0x38(%rdi),%rbp
=C2=A0 =C2=A00x00000000002fa013 <+307>:=C2=A0 =C2=A0pextrw $0x0,%xmm0= ,%r13d
=C2=A0 =C2=A00x00000000002fa019 <+313>:=C2=A0 =C2=A0movaps %xmm2,0x20= (%rsp)
=C2=A0 =C2=A00x00000000002fa01e <+318>:=C2=A0 =C2=A0movaps %xmm3,0x10= (%rsp)


Again, I see no code here which touches 0xc(%rdi) or the three bytes
after it.

But union buffered_input_event has no hole at bytes 12-15, only two of
its union members do.

So it seems this may be a bug with bitfield enums; it's not quite clear=
to me why we're using one here, but it doesn't seem to be working a= s
intended.

Pip

--00000000000026bbfe062f113078-- From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 15:24:28 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 20:24:28 +0000 Received: from localhost ([127.0.0.1]:55639 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnNxE-0006ks-8u for submit@debbugs.gnu.org; Wed, 26 Feb 2025 15:24:28 -0500 Received: from mail-4316.protonmail.ch ([185.70.43.16]:61103) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1tnNxB-0006ka-7s for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 15:24:26 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail3; t=1740601458; x=1740860658; bh=MdpUHtckMnj79An2aYeblha3v369+fvUt3bhTM0W+ys=; h=Date:To:From:Cc:Subject:Message-ID:In-Reply-To:References: Feedback-ID:From:To:Cc:Date:Subject:Reply-To:Feedback-ID: Message-ID:BIMI-Selector:List-Unsubscribe:List-Unsubscribe-Post; b=fjKIseUP9doTqXvmCk+auO9Q4TC/Vogbjri90gJFbfI6dPRtgpXCE3U1PrvDUtC8F lHH2kmhuBGhbWnmvOipvb57jNW/pPcDxL7HY0M8LNJITk6FoxkjfA0uMzrU7WnagoN q0W9/iWRJBZagLRLgCWXVslLXi/AjdwAdsYJy3Y+zs4JvEpBHWOWuQnnqfNp9q86HK R1bnNKs35pmS/ieyRcIrabPxj9N71o3bJIzyQvhD1MzwJbRvYaeoMaKYK1R1mnvRwV VFdaZ5rUiOdwRZEWewTQscdW3BXGWT7TYS0GvhLBVH6V2oeILecHqnfYmPSot/Gh9K LtJZj4wZMYC2g== Date: Wed, 26 Feb 2025 20:24:14 +0000 To: Iurie Marian From: Pip Cet Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' Message-ID: <871pvk4fqt.fsf@protonmail.com> In-Reply-To: References: <87wmdc4osq.fsf@protonmail.com> Feedback-ID: 112775352:user:proton X-Pm-Message-ID: 4968e56deacdb8b68b126065f2175d932f644728 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 Cc: Michael Albinus , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Pip Cet writes: > "Iurie Marian" writes: > >> Yes, it looks like Michael's changes have nothing to do with this bug, >> but these seem just to reveal some undefined behavior... idk. Btw,=20 >> just by commenting the line src/keyboard.c:11697, it is not crashing=20 >> anymore; maybe this could be a hint. >> >>> gcc --version >> gcc (Debian 12.2.0-14) 12.2.0 >> >>> Can you check that 0x555555cf0b00 is a valid dpyinfo structure? >> (gdb) info locals >> event =3D 0x555555953aa0 >> copy =3D {kind =3D SELECTION_REQUEST_EVENT, dpyinfo =3D 0x55c82260, requ= estor =3D 0x555555f93a80, selection =3D 0x45, target =3D 0x4d, property =3D >> 0x5e, time =3D 0} >> moved_events =3D >> >> (gdb) x 0x555555c82260 >> 0x555555c82260: 0x00 > > Well, that only tells us the first byte is 0, which is probably correct. > Can you retry with x/64gx 0x555555c82260 (or the new address) so we see > some more data? > >>> Can you run "ptype/o struct selection_input_event" [...] >> >> (gdb) ptype/o struct selection_input_event >> /* offset | size */ type =3D struct selection_input_event { >> /* 0: 0 | 4 */ enum event_kind kind : 16; >> /* XXX 6-byte hole */ > > This is strange, but it looks like this may be a C undefined behavior > bug (or, less likely, an actual GCC bug). If the event_kind bitfield is > listed with size 4, shouldn't the hole after it be listed with size 4, > not size 6? Investigating the undefined behavior bug theory further, I find that applying this patch changes the code emitted for evq_flush (I think this is strange, since evq_flush doesn't call kbd_buffer_store_event, it calls kbd_buffer_store_buffered_event!). diff --git a/src/keyboard.h b/src/keyboard.h index 5e04b54eb74..c1c75cc7ea5 100644 --- a/src/keyboard.h +++ b/src/keyboard.h @@ -505,10 +505,9 @@ #define EVENT_HEAD_KIND(event_head) \ kbd_buffer_store_event_hold (struct input_event *event, =09=09=09 struct input_event *hold_quit) { - static_assert (alignof (struct input_event) =3D=3D alignof (union buffer= ed_input_event) -=09=09 && sizeof (struct input_event) =3D=3D sizeof (union buffered_input_= event)); - kbd_buffer_store_buffered_event ((union buffered_input_event *) event, -=09=09=09=09 hold_quit); + union buffered_input_event bie; + bie.ie =3D *event; + kbd_buffer_store_buffered_event (&bie, hold_quit); } extern void poll_for_input_1 (void); extern void show_help_echo (Lisp_Object, Lisp_Object, Lisp_Object, Can you confirm whether it changes anything for you? Pip From debbugs-submit-bounces@debbugs.gnu.org Wed Feb 26 15:37:22 2025 Received: (at 76559) by debbugs.gnu.org; 26 Feb 2025 20:37:22 +0000 Received: from localhost ([127.0.0.1]:55659 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnO9d-0007Pl-Q0 for submit@debbugs.gnu.org; Wed, 26 Feb 2025 15:37:22 -0500 Received: from mail-wr1-x434.google.com ([2a00:1450:4864:20::434]:51678) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1tnO9Z-0007PM-Cz for 76559@debbugs.gnu.org; Wed, 26 Feb 2025 15:37:16 -0500 Received: by mail-wr1-x434.google.com with SMTP id ffacd0b85a97d-388cae9eb9fso85650f8f.3 for <76559@debbugs.gnu.org>; Wed, 26 Feb 2025 12:37:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1740602227; x=1741207027; darn=debbugs.gnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=SIyEGpXn7dyE4OMV82069371ouGoSze9FrE4BmQKnZ4=; b=Bz6gmfR3UpL0wA/2Hnvqy9Nul22FNv8vJf3xYcobv5Vh0ISbDWZkf8grH+xjbgd5dy e/WAZzjpvDUjxNW/wKpoQzkL3JMiHz3yXZ0ZpD07lO4uY85Cj1y7ibNCXGTPNSPDS6vb GJVl5QCAzcqKDiwvNos8NJIMk7tp49qPbPQvAti55DdfAwb2S7n4zO1LZ7ON8eNAOtAt tfQm4GsD8c2hNDZPso9PaZHS+BZdrvnvpcJ/o9KjLMY03AdZztzrPSxxsB37UvdVOZtN icP/r/93Ssjj7aFEsqY0iEBQEqY7Pl7sUqea77a9+g393dDnU4qfAQuK6Mt7nYq+Kk/U ov7A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1740602227; x=1741207027; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=SIyEGpXn7dyE4OMV82069371ouGoSze9FrE4BmQKnZ4=; b=rHSHUzhMVVUKx2kZUhwaFYwUZ77ZaklD5Ovi6F+mJXOqr07XNzBNcXWZcLPXSp1ix+ OD1NUNpVUNnWSJ0N8Uc5+udjftSYYYCTGcSeuaa+R4nhyCxFWg1lde1wB1igq4bJ50rc MZJAZs7M02yADecARy/ARRbe7Qq0yOtloW+xMRP0Bx1x4crVxE1/629kKVY0wo15gySM 7v8SZjZUqntlPxj3QNQLd3PD09vbJug8WCsEH/rgpTr6xas0gXC7J+4ScfGYZqGKI5/F gSS1vev135OcppKrTApy9vLUc4m5AQV3nHSILtRzcO0FxVPLnKPfDQqsrfZ07XaIwKzj OpcA== X-Gm-Message-State: AOJu0YyybLWDouK7J/8g4fWExMcxnBiciv3Ii1Sp5165kXzjUDVMr2p1 u0LbxhE/PBA7BIY7qdvJRCerS4r5hjXf4xgCCllIQDdH5CPrqX9XD4NamHAyVDEqoKlQtZ4NksN V1u3ALvhVxZ7sR9rTqgwMKCxBOIZNLP8SLzkmeA== X-Gm-Gg: ASbGncs/WtW+FtEtHpLtj8MlalUnGLHkhX69/0Ddc4Pl8OVuP+DzNOBmeQXPiJvF6xL OA7u5lk0hVTACidDyKvedY79gRe15wKwzUqnriggwwQYZZnT4/616z+SiFvq1o06RLeqDAczm1z XDerCXM+DAk5dVgj811jhMDRDH7NKKU6rTKQwhKV6bnQ== X-Google-Smtp-Source: AGHT+IEzlNW3COVY6ASdxVF1TV8p9mJgeYhXqMtwfSnf3InyPbn+DW70sl/WTcwl70aHxcPnG7ryVl4ccLRu4N+oCFE= X-Received: by 2002:a05:6000:1548:b0:38d:daf3:be60 with SMTP id ffacd0b85a97d-390cc63ccf0mr8551849f8f.48.1740602226841; Wed, 26 Feb 2025 12:37:06 -0800 (PST) MIME-Version: 1.0 References: <87wmdc4osq.fsf@protonmail.com> <871pvk4fqt.fsf@protonmail.com> In-Reply-To: <871pvk4fqt.fsf@protonmail.com> From: Iurie Marian Date: Wed, 26 Feb 2025 21:36:55 +0100 X-Gm-Features: AQ5f1Jq2d_DkgLKrCQCcbceVpckFUCmx0lfJUNVjRf1388HBtBgxUmGAimkz5cI Message-ID: Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' To: Pip Cet Content-Type: multipart/alternative; boundary="0000000000006d21b3062f1189fa" X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 Cc: Michael Albinus , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) --0000000000006d21b3062f1189fa Content-Type: text/plain; charset="UTF-8" Alright! This change fixes the issue! It works with gcc 12.2 as well! Thank you very much, Pip! KR, Iurie On Wed, 26 Feb 2025 at 21:24, Pip Cet wrote: > Pip Cet writes: > > > "Iurie Marian" writes: > > > >> Yes, it looks like Michael's changes have nothing to do with this bug, > >> but these seem just to reveal some undefined behavior... idk. Btw, > >> just by commenting the line src/keyboard.c:11697, it is not crashing > >> anymore; maybe this could be a hint. > >> > >>> gcc --version > >> gcc (Debian 12.2.0-14) 12.2.0 > >> > >>> Can you check that 0x555555cf0b00 is a valid dpyinfo structure? > >> (gdb) info locals > >> event = 0x555555953aa0 > >> copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55c82260, requestor > = 0x555555f93a80, selection = 0x45, target = 0x4d, property = > >> 0x5e, time = 0} > >> moved_events = > >> > >> (gdb) x 0x555555c82260 > >> 0x555555c82260: 0x00 > > > > Well, that only tells us the first byte is 0, which is probably correct. > > Can you retry with x/64gx 0x555555c82260 (or the new address) so we see > > some more data? > > > >>> Can you run "ptype/o struct selection_input_event" [...] > >> > >> (gdb) ptype/o struct selection_input_event > >> /* offset | size */ type = struct selection_input_event { > >> /* 0: 0 | 4 */ enum event_kind kind : 16; > >> /* XXX 6-byte hole */ > > > > This is strange, but it looks like this may be a C undefined behavior > > bug (or, less likely, an actual GCC bug). If the event_kind bitfield is > > listed with size 4, shouldn't the hole after it be listed with size 4, > > not size 6? > > Investigating the undefined behavior bug theory further, I find that > applying this patch changes the code emitted for evq_flush (I think this > is strange, since evq_flush doesn't call kbd_buffer_store_event, it > calls kbd_buffer_store_buffered_event!). > > diff --git a/src/keyboard.h b/src/keyboard.h > index 5e04b54eb74..c1c75cc7ea5 100644 > --- a/src/keyboard.h > +++ b/src/keyboard.h > @@ -505,10 +505,9 @@ #define EVENT_HEAD_KIND(event_head) \ > kbd_buffer_store_event_hold (struct input_event *event, > struct input_event *hold_quit) > { > - static_assert (alignof (struct input_event) == alignof (union > buffered_input_event) > - && sizeof (struct input_event) == sizeof (union > buffered_input_event)); > - kbd_buffer_store_buffered_event ((union buffered_input_event *) event, > - hold_quit); > + union buffered_input_event bie; > + bie.ie = *event; > + kbd_buffer_store_buffered_event (&bie, hold_quit); > } > extern void poll_for_input_1 (void); > extern void show_help_echo (Lisp_Object, Lisp_Object, Lisp_Object, > > Can you confirm whether it changes anything for you? > > Pip > > --0000000000006d21b3062f1189fa Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Alright! This change fixes the issue!
It works with gc= c 12.2 as well!

Thank you very much, Pip!

KR,
Iurie

On Wed, 26 = Feb 2025 at 21:24, Pip Cet <pip= cet@protonmail.com> wrote:
Pip Cet <pipcet@protonmail.com> writes:

> "Iurie Marian" <marian.iurie@gmail.com> writes:
>
>> Yes, it looks like Michael's changes have nothing to do with t= his bug,
>> but these seem just to reveal some undefined behavior... idk. Btw,=
>> just by commenting the line src/keyboard.c:11697, it is not crashi= ng
>> anymore; maybe this could be a hint.
>>
>>> gcc --version
>> gcc (Debian 12.2.0-14) 12.2.0
>>
>>> Can you check that 0x555555cf0b00 is a valid dpyinfo structure= ?
>> (gdb) info locals
>> event =3D 0x555555953aa0 <kbd_buffer+384>
>> copy =3D {kind =3D SELECTION_REQUEST_EVENT, dpyinfo =3D 0x55c82260= , requestor =3D 0x555555f93a80, selection =3D 0x45, target =3D 0x4d, proper= ty =3D
>> 0x5e, time =3D 0}
>> moved_events =3D <optimized out>
>>
>> (gdb) x 0x555555c82260
>> 0x555555c82260: 0x00
>
> Well, that only tells us the first byte is 0, which is probably correc= t.
> Can you retry with x/64gx 0x555555c82260 (or the new address) so we se= e
> some more data?
>
>>> Can you run "ptype/o struct selection_input_event" [= ...]
>>
>> (gdb) ptype/o struct selection_input_event
>> /* offset=C2=A0 =C2=A0 =C2=A0 |=C2=A0 =C2=A0 size */=C2=A0 type = =3D struct selection_input_event {
>> /*=C2=A0 =C2=A0 =C2=A0 0: 0=C2=A0 =C2=A0|=C2=A0 =C2=A0 =C2=A0 =C2= =A04 */=C2=A0 =C2=A0 enum event_kind kind : 16;
>> /* XXX=C2=A0 6-byte hole=C2=A0 =C2=A0 =C2=A0 */
>
> This is strange, but it looks like this may be a C undefined behavior<= br> > bug (or, less likely, an actual GCC bug).=C2=A0 If the event_kind bitf= ield is
> listed with size 4, shouldn't the hole after it be listed with siz= e 4,
> not size 6?

Investigating the undefined behavior bug theory further, I find that
applying this patch changes the code emitted for evq_flush (I think this is strange, since evq_flush doesn't call kbd_buffer_store_event, it
calls kbd_buffer_store_buffered_event!).

diff --git a/src/keyboard.h b/src/keyboard.h
index 5e04b54eb74..c1c75cc7ea5 100644
--- a/src/keyboard.h
+++ b/src/keyboard.h
@@ -505,10 +505,9 @@ #define EVENT_HEAD_KIND(event_head) \
=C2=A0kbd_buffer_store_event_hold (struct input_event *event,
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0struct input_event *hold_quit)
=C2=A0{
-=C2=A0 static_assert (alignof (struct input_event) =3D=3D alignof (union b= uffered_input_event)
-=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 && sizeof = (struct input_event) =3D=3D sizeof (union buffered_input_event));
-=C2=A0 kbd_buffer_store_buffered_event ((union buffered_input_event *) eve= nt,
-=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 hold_quit);
+=C2=A0 union buffered_input_event bie;
+=C2=A0 bie.= ie =3D *event;
+=C2=A0 kbd_buffer_store_buffered_event (&bie, hold_quit);
=C2=A0}
=C2=A0extern void poll_for_input_1 (void);
=C2=A0extern void show_help_echo (Lisp_Object, Lisp_Object, Lisp_Object,
Can you confirm whether it changes anything for you?

Pip

--0000000000006d21b3062f1189fa-- From debbugs-submit-bounces@debbugs.gnu.org Thu Feb 27 00:35:37 2025 Received: (at 76559) by debbugs.gnu.org; 27 Feb 2025 05:35:38 +0000 Received: from localhost ([127.0.0.1]:57576 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1tnWYb-0007RZ-Dq for submit@debbugs.gnu.org; Thu, 27 Feb 2025 00:35:37 -0500 Received: from sonic314-22.consmr.mail.ne1.yahoo.com ([66.163.189.148]:42756) by debbugs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from ) id 1tnWYY-0007RB-BA for 76559@debbugs.gnu.org; Thu, 27 Feb 2025 00:35:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1740634527; bh=/dLxoAbvAzZcv4KAKzOmMa4yvsOSUlAyzL8AISQR50k=; h=From:To:Cc:Subject:In-Reply-To:References:Date:From:Subject:Reply-To; b=Z3WFHqd+sbmoAcmwjZxlOiTW5Boq/6FFWcaLXbB6+BFe+EvAZh0UtJeY78BEp9iEa2ITvhRJY5hts8s7eJZaJxdLbz6mBRtsmvl0DLXJ4r9GYBx9Y/7xy30gTdzMKLIh/ouEbqfe8tmiY3k2hX5o5iZ8/e/e9GyIcpBiXekhWyl/lMERDRo+a7FbVTNlIRimsBXOfEDsW5rU9cBgU04R1ANImcl7QKdKNy4X/o27dYVnSRYE9FOo7zEVSY2n5IqSFMDakhLjZtM8/w/YE2qHq65lcV7vGrWDlAhNuTSnNcygOSlrNT6BqiEZ7h3bJ2JSwUzM0N8+r207mHqIc2o60w== X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1740634527; bh=YARxwB7Q8upeP9FBtCzaR+lDW/Ha7OMwnj/Wmw2Fv5v=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=LdfI3s+JevweyFTFasNlgZ0SCg5kgWM43i003bLRabpv0NwNYbHCQy6sfISCARueWqjrRFO6hgLL5BI0v+RGmMv7W2sSZltfS2scaEKMKfIiLJ9iTR8glDzb/GpKf6v8rHsXVVwnuICzkr+lTU9PXj06BzpMRG77oKJ2oxfOXVKneaZW9/kBA1JNWMT3Uqb4KtmPtUVOlfQhQN2FYj/I36Fdk/hb/Nfrjy7xKbFcXD3xV/1Rvx6WUCSK71WveUzC0gs4jt1DVijSMQvigBJSzGFNSu2+XIdQfwyeUaiZP/5VM18k4S5IIxCshO/937ghExMq+qsRFmdfw11xEmWkoA== X-YMail-OSG: .KLoZ4EVM1khDPLS9zg9gSGCH.Eh01_ASAihQgENEw_OmwxoQIGIkm4U8Co1ahL 9wvduEz5wyK4kPsFpbZml4_vHhsF3.0SH4T.gjzVLyGLjz1EXqezAABxFyjmC5YFbcHhk3eU0TN7 rnlnWKiK.q6WjSNwdBP29cJoQl0.qSM8xHZkM0yWZqn2QuHZXGT0fqLx20CKSdCW7ORY.2SFvi_4 iIBSJhuz.P5et51hh.wgcJrtFcI1M31RlrLvQV1SH9br_ptLGAe2bNhmJHgjpYH.2cvTKSGfxRs8 TKgrg7.o32JXZMhFDbOAn5d4twoo1rXWF5AjJaBDfNO5vUvc7IbS4wy8txWlxwXf3fB3Wq1VaK5g nmFeu.6C4ddl1ota24TH99_2B1y789CiCAO.S8ux04ncolNiYweFyBjllBSAPRdXDRC5pCoHUTWy L0RsP2FXqrIsDoj16b6qj1JgYY0vsWqyuGP4ZYrHC4zp7vbBtWWtttq4E4Cv8txnRrIl4UNBOK6j m.iLBLWOUjbk8udPZCcJVtR7qxED.SXc_BG01YnZK6cYxQiEl4EXiG2Pc9Vj7ibFvolNlHjAe1hJ gbbDusWOzU9I62R4k.Poq4z4npRAmltyu60_07lxVh0q5S_yRSkMK4Ye8QrGdvuwQcjvw7YO_Ghk 07ZXZcfZRousvnH6G_hxFsHlkZuuuvle7cwk6MpXGEx9npvV04ymW0_C1DfzIPK5arIB1vC2B5GS f9aKQig2jQ6xLUi__6yvahh2ENx3AaV._3eXpqmxzoddqB.yw9RH_bIBHfDhjYkCmwseLVzy42wA 9eRpYqczMbN.ZSguUMFjCKcWUd4VkgFTgI10h4pU_jTRW.s8qFCv30onDFZe35vJfJwZu0AZSSj_ iasdi553Sb1c5r.lqapl7Jd2jYyLAqqsfNPFjsLx_Hyh61DIXKEliqXiG5DDCRF1vnZG287QwGLF U7jRLwY199duz2BZxd8yfMFRS4bZkkoElqNcOyoGyQJkoTgyQqz61BHt6z77clhl_6vF8VOY2iOq bIYWidRe.A0LDkcjbv6vqySKdC7mWcjXv3aomOjzydNYuUuNo.BU9HQKZIRMqskyrJYL1xCAMVZN Q8hw5L1SlQjQF5DGe3LSc6_rTVIEVaX0nMTMNHPXKV0uUAtLUpVN8xy2Ko0LQOCXi3JOqkILrCxZ gvAtKkcgcw7tIO2B2qHSnGMhPWtkW8BX8_c65E.HbrG8L_VpM9Wk0fpxq63cyvPm8mh5RtpTYxaZ rx1G4QZAlbnNz4eTMh_X_SyceIkkOFKkl4rNbzESQelEzrh7B5VJB9EA4jqA8FFcnxTN7111._nS VnBXwYjaEnzjcrEKrR8UUrDTAVso2wSmmk5xJENm1Q8OJsogGaxyJWM0h38mGRarhWKUAIvjnAVx RiDGPaYvVCWNRHttJCUQM2wst5xSRmPuK58pjRlBpRhaNqecdhlArhOxKTsNJ.SI_q54VpFDkQj. K_LOMWO4m_2x4G5pdgucSbrsCqr0OduC1r9vrxZULLiOJoB245QEjCuFHB7Eem3LtYIufZx9AcYk BkF.L.cwJDE0TGo5XyhBX4Bf9QlcyvNWpHz9CXiupAvh0p3bhKK0sfiwSGC9cjML24e5YVyKgEaH EnsXQyiQ1JQBgxUHOtt8yghqNZG8Xg64HELKe4XXvlKSzfscy2jcX4ufLMNr7MtL9cETsg.y7KIP yyPbQ1pXr7.THHPWn525Zczg0ylqf.Hht2zu3F4j5ydFlSPOYnkyq.BfzKlFqB4AFfPJvkeao55j YFKIebslQPc.Ri7NHsRaK0bGPLSBY4Wo76GADXUMlMnTXRNeMTCZNsQiL5Qu5fEpyEWK2WLcQTXq BeKvkq_ftadCvRXU1f9KDsKdBI1GO2HHU.5JXF34Ql_3L9oRDLLHRk3kC3H.G4yq.N74gLYjIpcV L5rxGdUWFleZJcYPyThLGj9QbdIkA1W2P_7ymgIB4eoGrC7Hrk11pfFW7m2bkzW7Vw03R4UBDNnv Nosl93v7lHvMEYmlVapElUHjsWv5ryqLqUO7kvQz86m4xoD4DNdEL2RvNH4wLdVshridZSDWlF.p IYFepRDC8ayAP6mxibWsYyXrfJF.iX4A38FuJBBFj_UTaTVZekNOYu0ZCTd.FbEUVZOECwiCq9lY vZI6zJH2.uzY.iO64EruAOq8g5.iO5Rt1AAp7LFu5Rbo21cZnwu2dEqq7pV3DwQxBioydmEXvQER G96lZY2XRc468.e3HPKSyAciapj7iIaQtoHTh7FWSJ8f8UAJRdrDs8A-- X-Sonic-MF: X-Sonic-ID: d3effe89-33e2-47e4-8af9-810789ec7ab9 Received: from sonic.gate.mail.ne1.yahoo.com by sonic314.consmr.mail.ne1.yahoo.com with HTTP; Thu, 27 Feb 2025 05:35:27 +0000 Received: by hermes--production-sg3-9fc94b8df-cmcq2 (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 881516be401ae9153cad031015dfb730; Thu, 27 Feb 2025 05:35:22 +0000 (UTC) From: Po Lu To: Pip Cet Subject: Re: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word' In-Reply-To: <87cyf44k7h.fsf@protonmail.com> (Pip Cet's message of "Wed, 26 Feb 2025 18:47:51 +0000") References: <87wmdc4osq.fsf@protonmail.com> <87cyf44k7h.fsf@protonmail.com> Date: Thu, 27 Feb 2025 13:35:17 +0800 Message-ID: <87o6yoar1m.fsf@yahoo.com> User-Agent: Gnus/5.13 (Gnus v5.13) MIME-Version: 1.0 Content-Type: text/plain X-Mailer: WebService/1.1.23369 mail.backend.jedi.jws.acl:role.jedi.acl.token.atz.jws.hermes.yahoo Content-Length: 5146 X-Spam-Score: 0.0 (/) X-Debbugs-Envelope-To: 76559 Cc: Michael Albinus , Iurie Marian , 76559@debbugs.gnu.org X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -1.0 (-) Pip Cet writes: > This is strange, but it looks like this may be a C undefined behavior > bug (or, less likely, an actual GCC bug). If the event_kind bitfield is > listed with size 4, shouldn't the hole after it be listed with size 4, > not size 6? I'm afraid that must be a Gdb or GCC debuginfo generation bug, since the total size of the structure is 56. Whereas the aggregate of the values printed by GDB is 58. > Here's the code obtained by disass/s evq_flush which copies the relevant > part of the header: > > 3810 *kbd_store_ptr = *event; > 0x00000000002f9f4c <+108>: movd %xmm0,(%rdx) > 0x00000000002f9f50 <+112>: movdqa 0x20(%rsp),%xmm4 > 0x00000000002f9f56 <+118>: movdqa 0x10(%rsp),%xmm5 > 0x00000000002f9f5c <+124>: movq %xmm1,0x4(%rdx) If kbd_buffer_store_buffered_event is forcibly inlined, my GCC 12.2.0 generates virtually identical machine code to yours: 0x000000000067fd8c <+188>: mov 0x1f653d(%rip),%rdi # 0x8762d0 0x000000000067fd93 <+195>: movd (%rdi),%xmm0 0x000000000067fd97 <+199>: movdqu 0x10(%rdi),%xmm2 0x000000000067fd9c <+204>: movdqu 0x28(%rdi),%xmm3 0x000000000067fda1 <+209>: movq 0x4(%rdi),%xmm1 0x000000000067fda6 <+214>: mov 0x20(%rdi),%r14 0x000000000067fdaa <+218>: mov 0x38(%rdi),%r13 [...] 0x000000000067fdb4 <+228>: movaps %xmm2,0x20(%rsp) 0x000000000067fdb9 <+233>: movaps %xmm3,0x10(%rsp) [...] 0x000000000067fd27 <+87>: movd %xmm0,(%rdx) ;; bytes 0-3 0x000000000067fd2b <+91>: movdqa 0x20(%rsp),%xmm4 0x000000000067fd31 <+97>: movdqa 0x10(%rsp),%xmm5 0x000000000067fd37 <+103>: movq %xmm1,0x4(%rdx) ;; bytes 4-11 0x000000000067fd4a <+122>: mov %r14,0x20(%rdx) ;; bytes 32-39 0x000000000067fd4e <+126>: mov %r13,0x38(%rdx) ;; bytes 56-63 0x000000000067fd52 <+130>: movups %xmm4,0x10(%rdx) ;; bytes 16-31 0x000000000067fd56 <+134>: movups %xmm5,0x28(%rdx) ;; bytes 40-55 You'll observe that the gap coincides exactly with the padding in struct input_event. This is the RTL GCC produces just as it is lowered from optimized expression trees: (insn 582 581 583 62 (set (mem:V2HI (reg/f:DI 106 [ _68 ]) [66 MEM [(union buffered_input_event *)_68]+0 S4 A32]) (reg:V2HI 170 [ vect_ev_kind_24.71 ])) "keyboard.c":3810:22 -1 (nil)) ;; bytes 0-3 (insn 583 582 584 62 (set (mem:V2SI (plus:DI (reg/f:DI 106 [ _68 ]) (const_int 4 [0x4])) [66 MEM [(union buffered_input_event *)_68 + 4B]+0 S8 A32]) (reg:V2SI 167 [ vect_ev_ie_code_157.76 ])) "keyboard.c":3810:22 -1 (nil)) ;; bytes 4-11 (insn 584 583 585 62 (set (mem:V2DI (plus:DI (reg/f:DI 106 [ _68 ]) (const_int 16 [0x10])) [66 MEM [(union buffered_input_event *)_68 + 16B]+0 S16 A64]) (reg:V2DI 164 [ vect_ev_ie_x_134.83 ])) "keyboard.c":3810:22 -1 (nil)) ;; bytes 16-31 (insn 585 584 586 62 (set (mem:DI (plus:DI (reg/f:DI 106 [ _68 ]) (const_int 32 [0x20])) [66 MEM