Subject: bug#76559: 31.0.50; [-O3 + PGTK] Crash when 'copying as kill'/'killing word'

From: Iurie Marian <[email-masked]>
Date: Tue, 25 Feb 2025 18:32:39 +0100

Dear Maintainers,

Emacs is crashing while copying-as-kill/killing-word, only when compiled
with -O3 optimizations. I am using PGTK (see the configure command
below). I did a git bisect, and it seems that the commit below is
triggering the bug. To reproduce it just compile with -O3 and PGTK, then
simply hit M-<backspace>.

At the bottom you will also see the the stack trace, maybe it's useful.

Kind Regards,
Iurie

======================================================================

d41178368eb73873f34c15b58062a7447802c914 is the first bad commit
commit d41178368eb73873f34c15b58062a7447802c914
Author: Michael Albinus <[email-masked]>
Date:   Fri Feb 7 12:04:05 2025 +0100
    New function insert-special-event and special event sleep-event

    * doc/lispref/commands.texi (Misc Events): Add sleep-event.
    (Special Events): New function insert-special-event.

    * etc/NEWS: New function insert-special-event.  New event 'sleep-event'.
    Fix typos.

    * src/keyboard.c (Finsert_special_event): New defun.
    (syms_of_keyboard): Declare Qsleep_event.  Define subroutine
    Sinsert_special_event.  Add sleep-event to Vspecial_event_map.
    (Bug#63620)
    (kbd_buffer_get_event, make_lispy_event)
    (init_while_no_input_ignore_events, is_ignored_event):
    * src/termhooks.h (event_kind): Add SLEEP_EVENT.
 doc/lispref/commands.texi | 32 ++++++++++++++++++++++
 etc/NEWS                  | 19 +++++++++++---
 src/keyboard.c            | 67 +++++++++++++++++++++++++++++++++++++++++++++++
 src/termhooks.h           |  3 +++
 4 files changed, 117 insertions(+), 4 deletions(-)

======================================================================

In GNU Emacs 31.0.50 (build 35, x86_64-pc-linux-gnu, GTK+ Version
 3.24.38, cairo version 1.16.0) of 2025-02-25 built on
 unit_xpchipbarcodereader
Repository revision: d41178368eb73873f34c15b58062a7447802c914
Repository branch: HEAD
System Description: Debian GNU/Linux 12 (bookworm)

Configured using:
 'configure 'CFLAGS= -g -Wall -Wextra -pedantic -O3'
 --prefix=/home/roche/.local/emacs/build_ --sysconfdir=/etc
 --libexecdir=/home/roche/.local/emacs/build_/usr/lib
 --localstatedir=/home/roche/.local/emacs/build_/var --with-modules
 --without-gconf --without-gsettings --enable-link-time-optimization
 --with-x-toolkit=yes --without-xaw3d --without-m17n-flt --with-cairo
 --without-compress-install --with-native-compilation=aot
 --with-mailutils --with-xft --with-rsvg --with-pgtk'

Configured features:
CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS HARFBUZZ JPEG LIBOTF LIBSELINUX
LIBXML2 MODULES NATIVE_COMP NOTIFY INOTIFY PDUMPER PGTK PNG RSVG SECCOMP
SOUND SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS TREE_SITTER WEBP XIM GTK3
ZLIB

Important settings:
  value of $LC_ALL: C
  locale-coding-system: nil

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  minibuffer-regexp-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr compile comint ansi-osc ansi-color ring comp-run
bytecomp byte-compile comp-common rx emacsbug message mailcap yank-media
puny dired dired-loaddefs rfc822 mml mml-sec password-cache epa derived
epg rfc6068 epg-config gnus-util text-property-search time-date subr-x
mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils
mailheader cl-loaddefs cl-lib sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils rmc iso-transl tooltip cconv eldoc paren
electric uniquify ediff-hook vc-hooks lisp-float-type elisp-mode mwheel
term/pgtk-win pgtk-win term/common-win touch-screen pgtk-dnd tool-bar
dnd fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow
isearch easymenu timer select scroll-bar mouse jit-lock font-lock syntax
font-core term/tty-colors frame minibuffer nadvice seq simple cl-generic
indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
composite emoji-zwj charscript charprop case-table epa-hook
jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button loaddefs
theme-loaddefs faces cus-face macroexp files window text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget keymap
hashtable-print-readable backquote threads dbusbind inotify
dynamic-setting font-render-setting cairo gtk pgtk multi-tty
move-toolbar make-network-process tty-child-frames native-compile emacs)

======================================================================

(gdb) bt
#0  pgtk_handle_selection_request (event=0x7fffffffd810) at
/home/rce/.local/emacs/sources/src/pgtkselect.c:571
#1  0x000055555569edd5 in pgtk_handle_selection_event
(event=0x7fffffffd810) at
/home/rce/.local/emacs/sources/src/pgtkselect.c:782
#2  process_special_events () at
/home/rce/.local/emacs/sources/src/keyboard.c:4570
#3  0x00005555555b5424 in swallow_events (do_display=true) at
/home/rce/.local/emacs/sources/src/keyboard.c:4610
#4  sit_for (timeout=0x7a, reading=<optimized out>, display_option=1)
at /home/rce/.local/emacs/sources/src/dispnew.c:6867
#5  0x00005555556a7c34 in read_char (commandflag=1,
map=0x7fffef23de23, prev_event=0x0, used_mouse_menu=0x7fffffffdfbb,
end_time=0x0) at /home/rce/.local/emacs/sources/src/lisp.h:704
#6  0x000055555583fa7b in read_key_sequence.constprop.0
(keybuf=<optimized out>, prevent_redisplay=false,
disable_text_conversion_p=false, fix_current_buffer=true,
can_return_switch_frame=true, dont_downcase_last=false, prompt=0x0) at
/home/rce/.local/emacs/sources/src/keyboard.c:10750
#7  0x000055555569ba51 in command_loop_1 () at
/home/rce/.local/emacs/sources/src/keyboard.c:1424
#8  0x000055555573d9f7 in internal_condition_case (bfun=0x55555569b8b0
<command_loop_1>, handlers=<optimized out>, hfun=0x555555699790
<cmd_error>) at /home/rce/.local/emacs/sources/src/eval.c:1602
#9  0x0000555555699a46 in command_loop_2
(handlers=handlers@entry=0x90) at
/home/rce/.local/emacs/sources/src/keyboard.c:1163
#10 0x000055555573d94c in internal_catch (tag=<optimized out>,
func=0x555555699a20 <command_loop_2>, arg=0x90) at
/home/rce/.local/emacs/sources/src/eval.c:1282
#11 0x000055555569b451 in command_loop () at
/home/rce/.local/emacs/sources/src/keyboard.c:1141
#12 0x000055555586e628 in recursive_edit_1.isra.0 () at
/home/rce/.local/emacs/sources/src/keyboard.c:749
#13 0x000055555569b88d in Frecursive_edit () at
/home/rce/.local/emacs/sources/src/keyboard.c:832
#14 0x00005555555a8c94 in main (argc=2, argv=0x7fffffffe668) at
/home/rce/.local/emacs/sources/src/emacs.c:2558

(gdb) list
566       pushed = false;
567
568       if (!dpyinfo)
569         goto DONE;
570
571       local_selection_data = LOCAL_SELECTION (selection_symbol, dpyinfo);
572
573       /* Decline if we don't own any selections.  */
574       if (NILP (local_selection_data)) goto DONE;
575

(gdb) fr 2
#2  process_special_events () at
/home/rce/.local/emacs/sources/src/keyboard.c:4570
4570              pgtk_handle_selection_event (&copy);
(gdb) list
4565              input_pending = readable_events (0);
4566
4567    #ifdef HAVE_X11
4568              x_handle_selection_event (&copy);
4569    #else
4570              pgtk_handle_selection_event (&copy);
4571    #endif
4572    #elif defined HAVE_HAIKU
4573              if (event->ie.kind != SELECTION_CLEAR_EVENT)
4574                emacs_abort ();
(gdb) info locals
event = 0x555555957a40 <kbd_buffer+384>
copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55cf0b00,
requestor = 0x555555f97a80, selection = 0x45, target = 0x4d, property
= 0x5e, time = 0}
moved_events = <optimized out>

(gdb) x/s 0x55cf0b00
0x55cf0b00:     <error: Cannot access memory at address 0x55cf0b00>