GNU bug report logs - #78473
30.1; feature/igc: multiple crashes with pgtk_handle_selection_*

Previous Next

Package: emacs;

Reported by: Oliver Reiter <oliver.reiter <at> snapdragon.cc>

Date: Sat, 17 May 2025 20:44:02 UTC

Severity: normal

Found in version 30.1

Done: Paul Eggert <eggert <at> cs.ucla.edu>

To reply to this bug, email your comments to 78473 AT debbugs.gnu.org.
There is no need to reopen the bug first.

Toggle the display of automated, internal messages from the tracker.

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Sat, 17 May 2025 20:44:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Oliver Reiter <oliver.reiter <at> snapdragon.cc>:
New bug report received and forwarded. Copy sent to bug-gnu-emacs <at> gnu.org. (Sat, 17 May 2025 20:44:02 GMT) Full text and rfc822 format available.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Oliver Reiter <oliver.reiter <at> snapdragon.cc>
To: bug-gnu-emacs <at> gnu.org
Subject: 30.1; feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Sat, 17 May 2025 22:43:08 +0200
Dear all,

I have encountered multiple crashes on feature/igc with pgtk when
copying from Emacs to somewhere else. All crashes seem to involve some
form of 'pgtk_handle_selection_*' function (xbacktrace is always empty).
These crashes appear to be reproducible for me, if you need further
info.

Best,

Oliver

- First crash:

#0  terminate_due_to_signal (sig=11, backtrace_limit=40)
    at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:443
#1  0x00005555555a2e2f in handle_fatal_signal (sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1793
#2  deliver_thread_signal (handler=<optimized out>, sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1785
#3  deliver_fatal_thread_signal (sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1805
#4  handle_sigsegv (sig=11, siginfo=0x555555acc4b0 <sigsegv_stack+64528>, arg=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1943
#5  <signal handler called>
#6  0x00007ffff34de0fb in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
#7  0x0000555555964d57 in sigHandle ()
#8  <signal handler called>
#9  pgtk_handle_selection_request (event=0x7fffffffc780)
    at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
#10 0x00005555556e4185 in pgtk_handle_selection_event (event=0x7fffffffc780)
    at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:796
#11 process_special_events () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4581
#12 0x00005555556e540e in swallow_events (do_display=true)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4621
#13 0x000055555583ecc2 in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, 
    nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=true, just_wait_proc=<optimized out>, 
    wait_proc=<optimized out>, wait_for_cell=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/process.c:5865
#14 0x00005555555c1f10 in sit_for (timeout=<optimized out>, reading=<optimized out>, 
    display_option=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/dispnew.c:7007
#15 0x00005555556e992d in read_char (commandflag=1, map=XIL(0x7fffb2970ebb), prev_event=XIL(0), 
    used_mouse_menu=0x7fffffffd34b, end_time=0x0)
    at /home/reitero/build/sources/emacs/emacs_debug/src/lisp.h:762
#16 0x0000555555701ed5 in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7fffffffd4f0, 
    prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, 
    fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, 
    dont_downcase_last=<optimized out>, prompt=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:10892
#17 0x00005555556ea097 in command_loop_1 ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1435
#18 0x00005555557a58f4 in internal_condition_case (bfun=0x5555556e9ed0 <command_loop_1>, 
    handlers=<optimized out>, hfun=0x5555556e0a10 <cmd_error>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1643
#19 0x00005555556e0d06 in command_loop_2 (handlers=XIL(0xa8))
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1174
#20 0x00005555557a579d in internal_catch (tag=<optimized out>, func=0x5555556e0ce0 <command_loop_2>, 
    arg=XIL(0xa8)) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1323
#21 0x00005555556e0da3 in command_loop ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1152
#22 0x00005555556e2bc4 in recursive_edit_1.isra.0 ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:760
#23 0x00005555556e9ea4 in Frecursive_edit ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:843
#24 0x00005555555b02a2 in main (argc=<optimized out>, argv=0x7fffffffdbe8)
    at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:2604
You can't do that without a process to debug.
(gdb) bt full
#0  terminate_due_to_signal (sig=11, backtrace_limit=40)
    at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:443
No locals.
#1  0x00005555555a2e2f in handle_fatal_signal (sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1793
No locals.
#2  deliver_thread_signal (handler=<optimized out>, sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1785
        old_errno = <optimized out>
#3  deliver_fatal_thread_signal (sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1805
No locals.
#4  handle_sigsegv (sig=11, siginfo=0x555555acc4b0 <sigsegv_stack+64528>, arg=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1943
        fatal = <optimized out>
#5  <signal handler called>
No locals.
#6  0x00007ffff34de0fb in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
No locals.
#7  0x0000555555964d57 in sigHandle ()
No symbol table info available.
#8  <signal handler called>
No locals.
#9  pgtk_handle_selection_request (event=0x7fffffffc780)
    at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
        local_selection_time = <optimized out>
        dpyinfo = 0x55dee7e0
        selection = 0x45
        selection_symbol = XIL(0x1c0)
        target = <optimized out>
        target_symbol = XIL(0x3f00)
        property = 0x5e
        local_selection_data = <optimized out>
        success = false
        count = <optimized out>
        pushed = false
        alias = <optimized out>
        tem = <optimized out>
        DONE = <optimized out>
#10 0x00005555556e4185 in pgtk_handle_selection_event (event=0x7fffffffc780)
    at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:796
No locals.
#11 process_special_events () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4581
        event = 0x555555a41580 <kbd_buffer+14080>
        copy = {
          kind = SELECTION_REQUEST_EVENT,
          dpyinfo = 0x55dee7e0,
          requestor = 0x555555e00b50,
          selection = 0x45,
          target = 0x4d,
          property = 0x5e,
          time = 0
        }
--Type <RET> for more, q to quit, c to continue without paging--
        moved_events = <optimized out>
#12 0x00005555556e540e in swallow_events (do_display=true)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4621
        old_timers_run = <optimized out>
#13 0x000055555583ecc2 in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, 
    nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=true, just_wait_proc=<optimized out>, 
    wait_proc=<optimized out>, wait_for_cell=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/process.c:5865
        leave = false
        wrapped = <optimized out>
        read_some_bytes = <optimized out>
        count = <optimized out>
        process_skipped = <optimized out>
        channel_start = <optimized out>
        child_fd = <optimized out>
        nread = <optimized out>
        channel = <optimized out>
        nfds = <optimized out>
        Available = {
          fds_bits = {0 <repeats 16 times>}
        }
        Writeok = {
          fds_bits = {0 <repeats 16 times>}
        }
        check_write = true
        check_delay = <optimized out>
        no_avail = true
        xerrno = 11
        proc = <optimized out>
        timeout = {
          tv_sec = 30,
          tv_nsec = 0
        }
        end_time = {
          tv_sec = 1747293027,
          tv_nsec = 422682986
        }
        timer_delay = <optimized out>
        got_output_end_time = <optimized out>
        wait = <optimized out>
        got_some_output = <optimized out>
        prev_wait_proc_nbytes_read = <optimized out>
        retry_for_async = <optimized out>
        count = <optimized out>
        now = <optimized out>
        last_read_channel = <optimized out>
        MINIMUM = MINIMUM
        TIMEOUT = TIMEOUT
        FOREVER = FOREVER
#14 0x00005555555c1f10 in sit_for (timeout=<optimized out>, reading=<optimized out>, 
    display_option=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/dispnew.c:7007
        sec = <optimized out>
        nsec = 0
--Type <RET> for more, q to quit, c to continue without paging--
        do_display = <optimized out>
        curbuf_eq_winbuf = true
        nbytes = <optimized out>
#15 0x00005555556e992d in read_char (commandflag=1, map=XIL(0x7fffb2970ebb), prev_event=XIL(0), 
    used_mouse_menu=0x7fffffffd34b, end_time=0x0)
    at /home/reitero/build/sources/emacs/emacs_debug/src/lisp.h:762
        tem0 = <optimized out>
        timeout = <optimized out>
        count1 = <optimized out>
        delay_level = <optimized out>
        buffer_size = <optimized out>
        c = <optimized out>
        local_getcjmp = {{
            __jmpbuf = {1, -582214358097902161, 1, 1, 140736156504144, 0, -582214357303081553, 
              -6719693885988977233},
            __mask_was_saved = 0,
            __saved_mask = {
              __val = {93824995415603, 0, 21, 0, 140737488343168, 55720, 0, 140736156504149, 0, 
                140736184043408, 20, 21, 1, 46909632806912, 13524637773301830912, 56}
            }
          }}
        save_jump = {{
            __jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0},
            __mask_was_saved = 0,
            __saved_mask = {
              __val = {0 <repeats 16 times>}
            }
          }}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = XIL(0)
        also_record = XIL(0)
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x555555d8fba0
        retry = <optimized out>
        jmpcount = <optimized out>
        c_volatile = XIL(0)
#16 0x0000555555701ed5 in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7fffffffd4f0, 
    prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, 
    fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, 
    dont_downcase_last=<optimized out>, prompt=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:10892
        interrupted_kboard = 0x555555d8fba0
        interrupted_frame = <optimized out>
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = <optimized out>
        keys_local_start = 0
        new_binding = <optimized out>
        count = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
        t = <optimized out>
        echo_start = 0
        keys_start = 0
        current_binding = XIL(0x7fffb2970ebb)
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        keytran = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        indec = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        shift_translated = <optimized out>
        delayed_switch_frame = <optimized out>
        original_uppercase = <optimized out>
        original_uppercase_position = <optimized out>
        starting_buffer = <optimized out>
        fake_prefixed_keys = XIL(0)
        first_event = XIL(0)
        second_event = <optimized out>
        replay_key = <optimized out>
#17 0x00005555556ea097 in command_loop_1 ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1435
        keybuf = {make_fixnum(121), make_fixnum(9), make_fixnum(49), XIL(0xbbb12a65f17c5500), 
          XIL(0x555555b51000), XIL(0x7fffffffd5f0), XIL(0x1), make_fixnum(1000), XIL(0x80), 
          XIL(0x5555557aaad4), XIL(0x555555c8c700), XIL(0x555555982b90), XIL(0x7fffe06a8e80), 
          XIL(0x7fffeb80528b), XIL(0x7fffffffd5a0), XIL(0), XIL(0x555555c8c830), 
          XIL(0xbbb12a65f17c5500), XIL(0x17040), XIL(0x5555559766a4), XIL(0x7fffffffd620), 
          XIL(0x7fffe09c5b5d), XIL(0), XIL(0x5555557b4e77), XIL(0x555555c8c700), XIL(0x7fffeb80528b), 
          XIL(0), XIL(0x60), XIL(0xc), XIL(0xd008)}
        i = <optimized out>
        last_pt = <optimized out>
        count = <optimized out>
        cmd = <optimized out>
        prev_modiff = 1174
        prev_buffer = 0x7fffb09d9050
#18 0x00005555557a58f4 in internal_condition_case (bfun=0x5555556e9ed0 <command_loop_1>, 
    handlers=<optimized out>, hfun=0x5555556e0a10 <cmd_error>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1643
        val = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
        c = 0x555555c8c700
#19 0x00005555556e0d06 in command_loop_2 (handlers=XIL(0xa8))
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1174
        val = <optimized out>
#20 0x00005555557a579d in internal_catch (tag=<optimized out>, func=0x5555556e0ce0 <command_loop_2>, 
    arg=XIL(0xa8)) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1323
        val = <optimized out>
        c = 0x555555c8c570
#21 0x00005555556e0da3 in command_loop ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1152
No locals.
#22 0x00005555556e2bc4 in recursive_edit_1.isra.0 ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:760
        count = <optimized out>
        val = <optimized out>
#23 0x00005555556e9ea4 in Frecursive_edit ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:843
        count = <optimized out>
        buffer = <optimized out>
#24 0x00005555555b02a2 in main (argc=<optimized out>, argv=0x7fffffffdbe8)
    at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:2604
        stack_bottom_variable = 0x0
        old_argc = <optimized out>
        dump_file = 0x0
        no_loadup = <optimized out>
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {
          rlim_cur = 10022912,
          rlim_max = 18446744073709551615
        }
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>
        

- Second crash:

(gdb) bt
#0  terminate_due_to_signal (sig=11, backtrace_limit=40) at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:443
#1  0x00005555555a2e2f in handle_fatal_signal (sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1793
#2  deliver_thread_signal (handler=<optimized out>, sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1785
#3  deliver_fatal_thread_signal (sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1805
#4  handle_sigsegv (sig=11, siginfo=0x555555acc4b0 <sigsegv_stack+64528>, arg=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1943
#5  <signal handler called>
#6  0x00007ffff34de0fb in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
#7  0x0000555555964d57 in sigHandle ()
#8  <signal handler called>
#9  pgtk_handle_selection_request (event=0x7fffffffc780) at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
#10 0x00005555556e4185 in pgtk_handle_selection_event (event=0x7fffffffc780) at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:796
#11 process_special_events () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4581
#12 0x00005555556e540e in swallow_events (do_display=true) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4621
#13 0x000055555583ecc2 in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=true, just_wait_proc=<optimized out>, 
    wait_proc=<optimized out>, wait_for_cell=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/process.c:5865
#14 0x00005555555c1f10 in sit_for (timeout=<optimized out>, reading=<optimized out>, display_option=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/dispnew.c:7007
#15 0x00005555556e992d in read_char (commandflag=1, map=0x7fffb64f0143, prev_event=0x0, used_mouse_menu=0x7fffffffd34b, end_time=0x0) at /home/reitero/build/sources/emacs/emacs_debug/src/lisp.h:762
#16 0x0000555555701ed5 in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7fffffffd4f0, prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, 
    fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, dont_downcase_last=<optimized out>, prompt=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:10892
#17 0x00005555556ea097 in command_loop_1 () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1435
#18 0x00005555557a58f4 in internal_condition_case (bfun=0x5555556e9ed0 <command_loop_1>, handlers=<optimized out>, hfun=0x5555556e0a10 <cmd_error>) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1643
#19 0x00005555556e0d06 in command_loop_2 (handlers=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1174
#20 0x00005555557a579d in internal_catch (tag=<optimized out>, func=0x5555556e0ce0 <command_loop_2>, arg=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1323
#21 0x00005555556e0da3 in command_loop () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1152
#22 0x00005555556e2bc4 in recursive_edit_1.isra.0 () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:760
#23 0x00005555556e9ea4 in Frecursive_edit () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:843
#24 0x00005555555b02a2 in main (argc=<optimized out>, argv=0x7fffffffdbe8) at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:2604
(gdb) bt full
#0  terminate_due_to_signal (sig=11, backtrace_limit=40) at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:443
No locals.
#1  0x00005555555a2e2f in handle_fatal_signal (sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1793
No locals.
#2  deliver_thread_signal (handler=<optimized out>, sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1785
        old_errno = <optimized out>
#3  deliver_fatal_thread_signal (sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1805
No locals.
#4  handle_sigsegv (sig=11, siginfo=0x555555acc4b0 <sigsegv_stack+64528>, arg=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1943
        fatal = <optimized out>
#5  <signal handler called>
No locals.
#6  0x00007ffff34de0fb in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
No locals.
#7  0x0000555555964d57 in sigHandle ()
No symbol table info available.
#8  <signal handler called>
No locals.
#9  pgtk_handle_selection_request (event=0x7fffffffc780) at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
        local_selection_time = <optimized out>
        dpyinfo = 0x55ec28e0
        selection = 0x45
        selection_symbol = 0x1c0
        target = <optimized out>
        target_symbol = 0x3f00
        property = 0x5e
        local_selection_data = <optimized out>
        success = false
        count = <optimized out>
        pushed = false
        alias = <optimized out>
        tem = <optimized out>
        DONE = <optimized out>
#10 0x00005555556e4185 in pgtk_handle_selection_event (event=0x7fffffffc780) at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:796
No locals.
#11 process_special_events () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4581
        event = 0x555555a3ee80 <kbd_buffer+4096>
        copy = {kind = SELECTION_REQUEST_EVENT, dpyinfo = 0x55ec28e0, requestor = 0x555555dd7730, selection = 0x45, target = 0x4d, property = 0x5e, time = 0}
        moved_events = <optimized out>
#12 0x00005555556e540e in swallow_events (do_display=true) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4621
        old_timers_run = <optimized out>
#13 0x000055555583ecc2 in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=true, just_wait_proc=<optimized out>, 
    wait_proc=<optimized out>, wait_for_cell=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/process.c:5865
        leave = false
        wrapped = <optimized out>
        read_some_bytes = <optimized out>
        count = <optimized out>
        process_skipped = <optimized out>
        channel_start = <optimized out>
        child_fd = <optimized out>
        nread = <optimized out>
        channel = <optimized out>
        nfds = <optimized out>
        Available = {fds_bits = {0 <repeats 16 times>}}
--Type <RET> for more, q to quit, c to continue without paging--
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = true
        check_delay = <optimized out>
        no_avail = true
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 30, tv_nsec = 0}
        end_time = {tv_sec = 1747293907, tv_nsec = 792267659}
        timer_delay = <optimized out>
        got_output_end_time = <optimized out>
        wait = <optimized out>
        got_some_output = <optimized out>
        prev_wait_proc_nbytes_read = <optimized out>
        retry_for_async = <optimized out>
        count = <optimized out>
        now = <optimized out>
        last_read_channel = <optimized out>
        MINIMUM = MINIMUM
        TIMEOUT = TIMEOUT
        FOREVER = FOREVER
#14 0x00005555555c1f10 in sit_for (timeout=<optimized out>, reading=<optimized out>, display_option=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/dispnew.c:7007
        sec = <optimized out>
        nsec = 0
        do_display = <optimized out>
        curbuf_eq_winbuf = true
        nbytes = <optimized out>
#15 0x00005555556e992d in read_char (commandflag=1, map=0x7fffb64f0143, prev_event=0x0, used_mouse_menu=0x7fffffffd34b, end_time=0x0) at /home/reitero/build/sources/emacs/emacs_debug/src/lisp.h:762
        tem0 = <optimized out>
        timeout = <optimized out>
        count1 = <optimized out>
        delay_level = <optimized out>
        buffer_size = <optimized out>
        c = <optimized out>
        local_getcjmp = {{__jmpbuf = {1, -5836420809289825763, 1, 1, 140737020785336, 0, -5836420809044458979, -408267284823997923}, __mask_was_saved = 0, __saved_mask = {__val = {19934, 0, 140737020785336, 
                140737020785336, 0, 140737488343168, 0, 79734, 140737020785341, 140736250486800, 19932, 19934, 1, 46909632806912, 13347250942112852736, 140737488343248}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x555555d8f130
        retry = <optimized out>
        jmpcount = <optimized out>
        c_volatile = 0x0
#16 0x0000555555701ed5 in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7fffffffd4f0, prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, 
    fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, dont_downcase_last=<optimized out>, prompt=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:10892
        interrupted_kboard = 0x555555d8f130
        interrupted_frame = <optimized out>
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
--Type <RET> for more, q to quit, c to continue without paging--
        last_real_key_start = <optimized out>
        keys_local_start = 0
        new_binding = <optimized out>
        count = <optimized out>
        t = <optimized out>
        echo_start = 0
        keys_start = 0
        current_binding = 0x7fffb64f0143
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {parent = <optimized out>, map = <optimized out>, start = 0, end = 0}
        keytran = {parent = <optimized out>, map = <optimized out>, start = 0, end = 0}
        indec = {parent = <optimized out>, map = <optimized out>, start = 0, end = 0}
        shift_translated = <optimized out>
        delayed_switch_frame = <optimized out>
        original_uppercase = <optimized out>
        original_uppercase_position = <optimized out>
        starting_buffer = <optimized out>
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = <optimized out>
        replay_key = <optimized out>
#17 0x00005555556ea097 in command_loop_1 () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1435
        keybuf = {0x1e6, 0x196, 0x18a, 0xb93af603dca26b00, 0x555555b51000, 0x7fffffffd5f0, 0x1, 0xfa2, 0x80, 0x5555557aaad4 <eval_sub+1828>, 0x555555c8c700, 0x555555982b90, 0x7fffe06a8e80, 0x7fffe19f86ab, 
          0x7fffffffd5a0, 0x0, 0x555555c8c830, 0xb93af603dca26b00, 0x17040, 0x5555559766a4, 0x7fffffffd620, 0x7fffe09c5b5d, 0x0, 0x5555557b4e77 <unbind_to+775>, 0x555555c8c700, 0x7fffe19f86ab, 0x0, 0x60, 0xc, 
          0xd008}
        i = <optimized out>
        last_pt = <optimized out>
        count = <optimized out>
        cmd = <optimized out>
        prev_modiff = 2621
        prev_buffer = 0x7fffe42172b8
#18 0x00005555557a58f4 in internal_condition_case (bfun=0x5555556e9ed0 <command_loop_1>, handlers=<optimized out>, hfun=0x5555556e0a10 <cmd_error>) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1643
        val = <optimized out>
        c = 0x555555c8c700
#19 0x00005555556e0d06 in command_loop_2 (handlers=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1174
        val = <optimized out>
#20 0x00005555557a579d in internal_catch (tag=<optimized out>, func=0x5555556e0ce0 <command_loop_2>, arg=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1323
        val = <optimized out>
        c = 0x555555c8c570
#21 0x00005555556e0da3 in command_loop () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1152
No locals.
#22 0x00005555556e2bc4 in recursive_edit_1.isra.0 () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:760
        count = <optimized out>
        val = <optimized out>
#23 0x00005555556e9ea4 in Frecursive_edit () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:843
        count = <optimized out>
        buffer = <optimized out>
#24 0x00005555555b02a2 in main (argc=<optimized out>, argv=0x7fffffffdbe8) at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:2604
        stack_bottom_variable = 0x0
        old_argc = <optimized out>
        dump_file = 0x0
        no_loadup = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>

- Third crash:

(gdb) bt
#0  terminate_due_to_signal (sig=11, backtrace_limit=40)
    at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:443
#1  0x00005555555a2e2f in handle_fatal_signal (sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1793
#2  deliver_thread_signal (handler=<optimized out>, sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1785
#3  deliver_fatal_thread_signal (sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1805
#4  handle_sigsegv (sig=11, siginfo=0x555555acc4b0 <sigsegv_stack+64528>, arg=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1943
#5  <signal handler called>
#6  0x00007ffff34de0fb in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
#7  0x0000555555964d57 in sigHandle ()
#8  <signal handler called>
#9  pgtk_handle_selection_request (event=0x7fffffffc780)
    at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
#10 0x00005555556e4185 in pgtk_handle_selection_event (event=0x7fffffffc780)
    at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:796
#11 process_special_events () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4581
#12 0x00005555556e540e in swallow_events (do_display=true)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4621
#13 0x000055555583ecc2 in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, 
    nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=true, just_wait_proc=<optimized out>, 
    wait_proc=<optimized out>, wait_for_cell=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/process.c:5865
#14 0x00005555555c1f10 in sit_for (timeout=<optimized out>, reading=<optimized out>, 
    display_option=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/dispnew.c:7007
#15 0x00005555556e992d in read_char (commandflag=1, map=0x7fffe4833deb, prev_event=0x0, 
    used_mouse_menu=0x7fffffffd34b, end_time=0x0)
    at /home/reitero/build/sources/emacs/emacs_debug/src/lisp.h:762
#16 0x0000555555701ed5 in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7fffffffd4f0, 
    prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, 
    fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, 
    dont_downcase_last=<optimized out>, prompt=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:10892
#17 0x00005555556ea097 in command_loop_1 ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1435
#18 0x00005555557a58f4 in internal_condition_case (bfun=0x5555556e9ed0 <command_loop_1>, 
    handlers=<optimized out>, hfun=0x5555556e0a10 <cmd_error>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1643
#19 0x00005555556e0d06 in command_loop_2 (handlers=0xa8)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1174
#20 0x00005555557a579d in internal_catch (tag=<optimized out>, func=0x5555556e0ce0 <command_loop_2>, 
    arg=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1323
#21 0x00005555556e0da3 in command_loop ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1152
#22 0x00005555556e2bc4 in recursive_edit_1.isra.0 ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:760
#23 0x00005555556e9ea4 in Frecursive_edit ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:843
#24 0x00005555555b02a2 in main (argc=<optimized out>, argv=0x7fffffffdbe8)
    at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:2604
(gdb) bt full
#0  terminate_due_to_signal (sig=11, backtrace_limit=40)
    at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:443
No locals.
#1  0x00005555555a2e2f in handle_fatal_signal (sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1793
No locals.
#2  deliver_thread_signal (handler=<optimized out>, sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1785
        old_errno = <optimized out>
#3  deliver_fatal_thread_signal (sig=11)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1805
No locals.
#4  handle_sigsegv (sig=11, siginfo=0x555555acc4b0 <sigsegv_stack+64528>, arg=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1943
        fatal = <optimized out>
#5  <signal handler called>
No locals.
#6  0x00007ffff34de0fb in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
No locals.
#7  0x0000555555964d57 in sigHandle ()
No symbol table info available.
#8  <signal handler called>
No locals.
#9  pgtk_handle_selection_request (event=0x7fffffffc780)
    at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
        local_selection_time = <optimized out>
        dpyinfo = 0x55d88870
        selection = 0x45
        selection_symbol = 0x1c0
        target = <optimized out>
        target_symbol = 0x3f00
        property = 0x5e
        local_selection_data = <optimized out>
        success = false
        count = <optimized out>
        pushed = false
        alias = <optimized out>
        tem = <optimized out>
        DONE = <optimized out>
#10 0x00005555556e4185 in pgtk_handle_selection_event (event=0x7fffffffc780)
    at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:796
No locals.
#11 process_special_events () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4581
        event = 0x555555a3fac0 <kbd_buffer+7232>
        copy = {
          kind = SELECTION_REQUEST_EVENT,
          dpyinfo = 0x55d88870,
          requestor = 0x555555dfea60,
          selection = 0x45,
          target = 0x4d,
          property = 0x5e,
          time = 0
        }
--Type <RET> for more, q to quit, c to continue without paging--
        moved_events = <optimized out>
#12 0x00005555556e540e in swallow_events (do_display=true)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4621
        old_timers_run = <optimized out>
#13 0x000055555583ecc2 in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, 
    nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=true, just_wait_proc=<optimized out>, 
    wait_proc=<optimized out>, wait_for_cell=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/process.c:5865
        leave = false
        wrapped = <optimized out>
        read_some_bytes = <optimized out>
        count = <optimized out>
        process_skipped = <optimized out>
        channel_start = <optimized out>
        child_fd = <optimized out>
        nread = <optimized out>
        channel = <optimized out>
        nfds = <optimized out>
        Available = {
          fds_bits = {0 <repeats 16 times>}
        }
        Writeok = {
          fds_bits = {0 <repeats 16 times>}
        }
        check_write = true
        check_delay = <optimized out>
        no_avail = true
        xerrno = 11
        proc = <optimized out>
        timeout = {
          tv_sec = 30,
          tv_nsec = 0
        }
        end_time = {
          tv_sec = 1747512846,
          tv_nsec = 273431863
        }
        timer_delay = <optimized out>
        got_output_end_time = <optimized out>
        wait = <optimized out>
        got_some_output = <optimized out>
        prev_wait_proc_nbytes_read = <optimized out>
        retry_for_async = <optimized out>
        count = <optimized out>
        now = <optimized out>
        last_read_channel = <optimized out>
        MINIMUM = MINIMUM
        TIMEOUT = TIMEOUT
        FOREVER = FOREVER
#14 0x00005555555c1f10 in sit_for (timeout=<optimized out>, reading=<optimized out>, 
    display_option=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/dispnew.c:7007
        sec = <optimized out>
        nsec = 0
--Type <RET> for more, q to quit, c to continue without paging--
        do_display = <optimized out>
        curbuf_eq_winbuf = true
        nbytes = <optimized out>
#15 0x00005555556e992d in read_char (commandflag=1, map=0x7fffe4833deb, prev_event=0x0, 
    used_mouse_menu=0x7fffffffd34b, end_time=0x0)
    at /home/reitero/build/sources/emacs/emacs_debug/src/lisp.h:762
        tem0 = <optimized out>
        timeout = <optimized out>
        count1 = <optimized out>
        delay_level = <optimized out>
        buffer_size = <optimized out>
        c = <optimized out>
        local_getcjmp = {{
            __jmpbuf = {1, -5998025564981620853, 1, 1, 140736996195832, 0, -5998025564165828725, 
              -461638048342536309},
            __mask_was_saved = 0,
            __saved_mask = {
              __val = {2767, 0, 140736996195832, 140736996195832, 0, 140737488343168, 0, 11066, 
                140736996195837, 140736997292160, 2765, 2767, 1, 140733193388032, 1378613490129614848, 
                192}
            }
          }}
        save_jump = {{
            __jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0},
            __mask_was_saved = 0,
            __saved_mask = {
              __val = {0 <repeats 16 times>}
            }
          }}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x555555d8ebb0
        retry = <optimized out>
        jmpcount = <optimized out>
        c_volatile = 0x0
#16 0x0000555555701ed5 in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7fffffffd4f0, 
    prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, 
    fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, 
    dont_downcase_last=<optimized out>, prompt=<optimized out>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:10892
        interrupted_kboard = 0x555555d8ebb0
        interrupted_frame = <optimized out>
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = <optimized out>
        keys_local_start = 0
        new_binding = <optimized out>
--Type <RET> for more, q to quit, c to continue without paging--
        count = <optimized out>
        t = <optimized out>
        echo_start = 0
        keys_start = 0
        current_binding = 0x7fffe4833deb
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        keytran = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        indec = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        shift_translated = <optimized out>
        delayed_switch_frame = <optimized out>
        original_uppercase = <optimized out>
        original_uppercase_position = <optimized out>
        starting_buffer = <optimized out>
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = <optimized out>
        replay_key = <optimized out>
#17 0x00005555556ea097 in command_loop_1 ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1435
        keybuf = {0x192, 0xea, 0x1d2, 0x7fffe780d3e5, 0x0, 0x5555557b6137 <unbind_to.constprop.0+743>, 
          0x0, 0x1321d1aa41bcb800, 0xc, 0x13dd8, 0x38, 0x7fffe780d3e5, 0x0, 0x60, 0x1, 0xfa2, 0x0, 
          0x0, 0x0, 0x5555556e0c26 <cmd_error+534>, 0x0, 0x0, 0x0, 0x0, 0x2aaa92d81fb0, 
          0x7fffe3352f73, 0x7fffe8800004, 0x0, 0x0, 0xd008}
        i = <optimized out>
        last_pt = <optimized out>
        count = <optimized out>
        cmd = <optimized out>
        prev_modiff = 1100
        prev_buffer = 0x7fffe2aa3df8
#18 0x00005555557a58f4 in internal_condition_case (bfun=0x5555556e9ed0 <command_loop_1>, 
    handlers=<optimized out>, hfun=0x5555556e0a10 <cmd_error>)
    at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1643
        val = <optimized out>
        c = 0x555555c8c700
#19 0x00005555556e0d06 in command_loop_2 (handlers=0xa8)
--Type <RET> for more, q to quit, c to continue without paging--
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1174
        val = <optimized out>
#20 0x00005555557a579d in internal_catch (tag=<optimized out>, func=0x5555556e0ce0 <command_loop_2>, 
    arg=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1323
        val = <optimized out>
        c = 0x555555c8c570
#21 0x00005555556e0da3 in command_loop ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1152
No locals.
#22 0x00005555556e2bc4 in recursive_edit_1.isra.0 ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:760
        count = <optimized out>
        val = <optimized out>
#23 0x00005555556e9ea4 in Frecursive_edit ()
    at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:843
        count = <optimized out>
        buffer = <optimized out>
#24 0x00005555555b02a2 in main (argc=<optimized out>, argv=0x7fffffffdbe8)
    at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:2604
        stack_bottom_variable = 0x0
        old_argc = <optimized out>
        dump_file = 0x0
        no_loadup = <optimized out>
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {
          rlim_cur = 10022912,
          rlim_max = 18446744073709551615
        }
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>

- Fourth crash:

(gdb) bt
#0  terminate_due_to_signal (sig=11, backtrace_limit=40) at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:443
#1  0x00005555555a2e2f in handle_fatal_signal (sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1793
#2  deliver_thread_signal (handler=<optimized out>, sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1785
#3  deliver_fatal_thread_signal (sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1805
#4  handle_sigsegv (sig=11, siginfo=0x555555acc4b0 <sigsegv_stack+64528>, arg=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1943
#5  <signal handler called>
#6  0x00007ffff34de0fb in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
#7  0x0000555555964d57 in sigHandle ()
#8  <signal handler called>
#9  0x00005555558e3ff8 in pgtk_handle_selection_clear (event=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:754
#10 0x00005555556e416e in pgtk_handle_selection_event (event=0x7fffffffc780) at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:794
#11 process_special_events () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4581
#12 0x00005555556e540e in swallow_events (do_display=true) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4621
#13 0x000055555583ecc2 in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=true, just_wait_proc=<optimized out>, 
    wait_proc=<optimized out>, wait_for_cell=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/process.c:5865
#14 0x00005555555c1f10 in sit_for (timeout=<optimized out>, reading=<optimized out>, display_option=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/dispnew.c:7007
#15 0x00005555556e992d in read_char (commandflag=1, map=0x7fffb5b54d0b, prev_event=0x0, used_mouse_menu=0x7fffffffd34b, end_time=0x0) at /home/reitero/build/sources/emacs/emacs_debug/src/lisp.h:762
#16 0x0000555555701ed5 in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7fffffffd4f0, prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, 
    fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, dont_downcase_last=<optimized out>, prompt=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:10892
#17 0x00005555556ea097 in command_loop_1 () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1435
#18 0x00005555557a58f4 in internal_condition_case (bfun=0x5555556e9ed0 <command_loop_1>, handlers=<optimized out>, hfun=0x5555556e0a10 <cmd_error>) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1643
#19 0x00005555556e0d06 in command_loop_2 (handlers=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1174
#20 0x00005555557a579d in internal_catch (tag=<optimized out>, func=0x5555556e0ce0 <command_loop_2>, arg=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1323
#21 0x00005555556e0da3 in command_loop () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1152
#22 0x00005555556e2bc4 in recursive_edit_1.isra.0 () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:760
#23 0x00005555556e9ea4 in Frecursive_edit () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:843
#24 0x00005555555b02a2 in main (argc=<optimized out>, argv=0x7fffffffdbe8) at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:2604
(gdb) bt full
#0  terminate_due_to_signal (sig=11, backtrace_limit=40) at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:443
No locals.
#1  0x00005555555a2e2f in handle_fatal_signal (sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1793
No locals.
#2  deliver_thread_signal (handler=<optimized out>, sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1785
        old_errno = <optimized out>
#3  deliver_fatal_thread_signal (sig=11) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1805
No locals.
#4  handle_sigsegv (sig=11, siginfo=0x555555acc4b0 <sigsegv_stack+64528>, arg=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/sysdep.c:1943
        fatal = <optimized out>
#5  <signal handler called>
No locals.
#6  0x00007ffff34de0fb in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
No locals.
#7  0x0000555555964d57 in sigHandle ()
No symbol table info available.
#8  <signal handler called>
No locals.
#9  0x00005555558e3ff8 in pgtk_handle_selection_clear (event=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:754
        selection = <optimized out>
        changed_owner_time = 0
        selection_symbol = <optimized out>
        local_selection_data = <optimized out>
        local_selection_time = <optimized out>
        dpyinfo = <optimized out>
        Vselection_alist = <optimized out>
#10 0x00005555556e416e in pgtk_handle_selection_event (event=0x7fffffffc780) at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:794
No locals.
#11 process_special_events () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4581
        event = 0x555555a45700 <kbd_buffer+30848>
        copy = {
          kind = SELECTION_CLEAR_EVENT,
          dpyinfo = 0x55ec3a10,
          requestor = 0x0,
          selection = 0x1,
          target = 0x0,
          property = 0x0,
          time = 0
        }
        moved_events = <optimized out>
#12 0x00005555556e540e in swallow_events (do_display=true) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:4621
        old_timers_run = <optimized out>
#13 0x000055555583ecc2 in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=true, just_wait_proc=<optimized out>, 
    wait_proc=<optimized out>, wait_for_cell=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/process.c:5865
        leave = false
        wrapped = <optimized out>
        read_some_bytes = <optimized out>
        count = <optimized out>
        process_skipped = <optimized out>
        channel_start = <optimized out>
        child_fd = <optimized out>
        nread = <optimized out>
        channel = <optimized out>
        nfds = <optimized out>
        Available = {
          fds_bits = {16, 0 <repeats 15 times>}
        }
        Writeok = {
          fds_bits = {0 <repeats 16 times>}
        }
        check_write = true
        check_delay = <optimized out>
        no_avail = false
        xerrno = 11
        proc = <optimized out>
        timeout = {
          tv_sec = 0,
          tv_nsec = 0
        }
        end_time = {
          tv_sec = 1747513208,
          tv_nsec = 284070002
        }
        timer_delay = <optimized out>
        got_output_end_time = <optimized out>
        wait = <optimized out>
        got_some_output = <optimized out>
        prev_wait_proc_nbytes_read = <optimized out>
        retry_for_async = <optimized out>
        count = <optimized out>
        now = <optimized out>
        last_read_channel = <optimized out>
        MINIMUM = MINIMUM
        TIMEOUT = TIMEOUT
        FOREVER = FOREVER
#14 0x00005555555c1f10 in sit_for (timeout=<optimized out>, reading=<optimized out>, display_option=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/dispnew.c:7007
        sec = <optimized out>
        nsec = 0
        do_display = <optimized out>
        curbuf_eq_winbuf = true
        nbytes = <optimized out>
#15 0x00005555556e992d in read_char (commandflag=1, map=0x7fffb5b54d0b, prev_event=0x0, used_mouse_menu=0x7fffffffd34b, end_time=0x0) at /home/reitero/build/sources/emacs/emacs_debug/src/lisp.h:762
        tem0 = <optimized out>
        timeout = <optimized out>
        count1 = <optimized out>
        delay_level = <optimized out>
        buffer_size = <optimized out>
        c = <optimized out>
        local_getcjmp = {{
            __jmpbuf = {1, 3558834140431439861, 1, 1, 93824997414592, 0, 3558834140672612341, 7221189849292789749},
            __mask_was_saved = 0,
            __saved_mask = {
              __val = {336, 0, 140737015262712, 140737015262712, 0, 140737488343168, 0, 1342, 140737015262717, 140736438884208, 334, 336, 1, 46909632806912, 14698558908229720064, 192}
            }
          }}
        save_jump = {{
            __jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0},
            __mask_was_saved = 0,
            __saved_mask = {
              __val = {0 <repeats 16 times>}
            }
          }}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x555555d8f2e0
        retry = <optimized out>
        jmpcount = <optimized out>
        c_volatile = 0x0
#16 0x0000555555701ed5 in read_key_sequence.constprop.0 (keybuf=keybuf <at> entry=0x7fffffffd4f0, prevent_redisplay=prevent_redisplay <at> entry=false, disable_text_conversion_p=<optimized out>, 
    fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, dont_downcase_last=<optimized out>, prompt=<optimized out>) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:10892
        interrupted_kboard = 0x555555d8f2e0
        interrupted_frame = <optimized out>
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = <optimized out>
        keys_local_start = 0
        new_binding = <optimized out>
        count = <optimized out>
        t = <optimized out>
        echo_start = 0
        keys_start = 0
        current_binding = 0x7fffb5b54d0b
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        keytran = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        indec = {
          parent = <optimized out>,
          map = <optimized out>,
          start = 0,
          end = 0
        }
        shift_translated = <optimized out>
        delayed_switch_frame = <optimized out>
        original_uppercase = <optimized out>
        original_uppercase_position = <optimized out>
        starting_buffer = <optimized out>
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = <optimized out>
        replay_key = <optimized out>
#17 0x00005555556ea097 in command_loop_1 () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1435
        keybuf = {0x1aa, 0x82, 0x192, 0x7fffe78113e5, 0x0, 0x5555557b6137 <unbind_to.constprop.0+743>, 0x0, 0xcbfbc573632f9800, 0xc, 0x13dd8, 0x38, 0x7fffe78113e5, 0x0, 0x60, 0x1, 0xfa2, 0x0, 0x0, 0x0, 
          0x5555556e0c26 <cmd_error+534>, 0x0, 0x0, 0x0, 0x0, 0x2aaa92d81fb0, 0x7fffe5aaa5eb, 0x7fffe8800004, 0x0, 0x0, 0xd008}
        i = <optimized out>
        last_pt = <optimized out>
        count = <optimized out>
        cmd = <optimized out>
        prev_modiff = 1985
        prev_buffer = 0x7fffe3cd2df8
#18 0x00005555557a58f4 in internal_condition_case (bfun=0x5555556e9ed0 <command_loop_1>, handlers=<optimized out>, hfun=0x5555556e0a10 <cmd_error>) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1643
        val = <optimized out>
        c = 0x555555c8c700
#19 0x00005555556e0d06 in command_loop_2 (handlers=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1174
        val = <optimized out>
#20 0x00005555557a579d in internal_catch (tag=<optimized out>, func=0x5555556e0ce0 <command_loop_2>, arg=0xa8) at /home/reitero/build/sources/emacs/emacs_debug/src/eval.c:1323
        val = <optimized out>
        c = 0x555555c8c570
#21 0x00005555556e0da3 in command_loop () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:1152
No locals.
#22 0x00005555556e2bc4 in recursive_edit_1.isra.0 () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:760
        count = <optimized out>
        val = <optimized out>
#23 0x00005555556e9ea4 in Frecursive_edit () at /home/reitero/build/sources/emacs/emacs_debug/src/keyboard.c:843
        count = <optimized out>
        buffer = <optimized out>
#24 0x00005555555b02a2 in main (argc=<optimized out>, argv=0x7fffffffdbe8) at /home/reitero/build/sources/emacs/emacs_debug/src/emacs.c:2604
        stack_bottom_variable = 0x0
        old_argc = <optimized out>
        dump_file = 0x0
        no_loadup = <optimized out>
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = 0x0
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {
          rlim_cur = 10022912,
          rlim_max = 18446744073709551615
        }
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>



In GNU Emacs 31.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version
 3.24.49, cairo version 1.18.4) of 2025-05-14 built on wilap
Repository revision: 2ef5b055f50d61fea59b54f87dbfd548e7a8b53d
Repository branch: feature/igc
System Description: Arch Linux

Configured using:
 'configure 'CFLAGS=-g3 -ggdb -O3 -mtune=native -march=native
 -fomit-frame-pointer' CPPFLAGS=-I/home/reitero/.local/lib/mps
 LDFLAGS=-L/home/reitero/.local/lib/mps --prefix=/usr --sysconfdir=/etc
 --libexecdir=/usr/lib --localstatedir=/var --with-mps=yes
 --with-gameuser=root:games --with-pgtk --with-xft --with-harfbuzz
 --with-modules --without-compress-install --without-m17n-flt
 --with-libotf --without-imagemagick --without-gsettings --without-gconf
 --with-native-compilation=aot --with-tree-sitter
 --enable-link-time-optimization'

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM HARFBUZZ JPEG LCMS2
LIBOTF LIBSYSTEMD LIBXML2 MODULES MPS NATIVE_COMP NOTIFY INOTIFY PDUMPER
PGTK PNG RSVG SECCOMP SOUND SQLITE3 THREADS TIFF TOOLKIT_SCROLL_BARS
TREE_SITTER WEBP XIM GTK3 ZLIB

Important settings:
  value of $LANG: de_AT.UTF-8
  locale-coding-system: utf-8-unix

Major mode: DOOM v3.0.0-pre

Minor modes in effect:
  which-key-mode: t
  savehist-mode: t
  server-mode: t
  better-jumper-mode: t
  better-jumper-local-mode: t
  corfu-terminal-mode: t
  corfu-history-mode: t
  corfu-popupinfo-mode: t
  global-corfu-mode: t
  corfu-mode: t
  vertico-multiform-mode: t
  vertico-mode: t
  nerd-icons-completion-mode: t
  marginalia-mode: t
  evil-goggles-mode: t
  evil-escape-mode: t
  evil-snipe-override-mode: t
  evil-snipe-mode: t
  evil-snipe-override-local-mode: t
  evil-snipe-local-mode: t
  gcmh-mode: t
  global-hl-line-mode: t
  hl-line-mode: t
  winner-mode: t
  smartparens-global-mode: t
  ws-butler-global-mode: t
  undo-fu-session-global-mode: t
  undo-fu-mode: t
  persp-mode: t
  doom-modeline-mode: t
  override-global-mode: t
  global-subword-mode: t
  subword-mode: t
  evil-mode: t
  evil-local-mode: t
  +popup-mode: t
  general-override-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  window-divider-mode: t
  minibuffer-regexp-mode: t
  buffer-read-only: t
  size-indication-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t





Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Sat, 17 May 2025 21:00:02 GMT) Full text and rfc822 format available.

Message #8 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Pip Cet <pipcet <at> protonmail.com>
To: 78473 <at> debbugs.gnu.org, Oliver Reiter <oliver.reiter <at> snapdragon.cc>
Subject: Re: bug#78473: 30.1;
 feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Sat, 17 May 2025 20:58:49 +0000
"Oliver Reiter via \"Bug reports for GNU Emacs, the Swiss army knife of text editors\"" <bug-gnu-emacs <at> gnu.org> writes:

> Dear all,
>
> I have encountered multiple crashes on feature/igc with pgtk when
> copying from Emacs to somewhere else. All crashes seem to involve some
> form of 'pgtk_handle_selection_*' function (xbacktrace is always empty).
> These crashes appear to be reproducible for me, if you need further
> info.

Thanks for the report!  Can you try adding -fno-tree-sra to your CFLAGS
and recompiling?  This looks like
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117423

> #9  pgtk_handle_selection_request (event=0x7fffffffc780)
>     at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
>         local_selection_time = <optimized out>
>         dpyinfo = 0x55dee7e0

This pointer has been truncated to 32 bits; it should be 0x555555dee7e0.
That's consistent with the gcc bug above (and
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119085, which has been
correctly marked as a duplicate).

>         selection = 0x45
>         selection_symbol = XIL(0x1c0)
>         target = <optimized out>
>         target_symbol = XIL(0x3f00)
>         property = 0x5e
>         local_selection_data = <optimized out>
>         success = false
>         count = <optimized out>
>         pushed = false
>         alias = <optimized out>
>         tem = <optimized out>
>         DONE = <optimized out>

> Configured using:
>  'configure 'CFLAGS=-g3 -ggdb -O3 -mtune=native -march=native
>  -fomit-frame-pointer' CPPFLAGS=-I/home/reitero/.local/lib/mps

Using -fomit-frame-pointer will result in the compiler putting
references to GC-able objects in %rbp; since MPS usually uses setjmp to
spill the registers to the stack, and setjmp "scrambles" %rbp for
security reasons, that will result in references which are invisible to
MPS, which will cause other crashes.

Pip





Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Sun, 18 May 2025 05:00:03 GMT) Full text and rfc822 format available.

Message #11 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Pip Cet <pipcet <at> protonmail.com>
Cc: oliver.reiter <at> snapdragon.cc, 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1;
 feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Sun, 18 May 2025 07:59:48 +0300
> Date: Sat, 17 May 2025 20:58:49 +0000
> From:  Pip Cet via "Bug reports for GNU Emacs,
>  the Swiss army knife of text editors" <bug-gnu-emacs <at> gnu.org>
> 
> "Oliver Reiter via \"Bug reports for GNU Emacs, the Swiss army knife of text editors\"" <bug-gnu-emacs <at> gnu.org> writes:
> 
> > Dear all,
> >
> > I have encountered multiple crashes on feature/igc with pgtk when
> > copying from Emacs to somewhere else. All crashes seem to involve some
> > form of 'pgtk_handle_selection_*' function (xbacktrace is always empty).
> > These crashes appear to be reproducible for me, if you need further
> > info.
> 
> Thanks for the report!  Can you try adding -fno-tree-sra to your CFLAGS
> and recompiling?  This looks like
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117423
> 
> > #9  pgtk_handle_selection_request (event=0x7fffffffc780)
> >     at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
> >         local_selection_time = <optimized out>
> >         dpyinfo = 0x55dee7e0
> 
> This pointer has been truncated to 32 bits; it should be 0x555555dee7e0.
> That's consistent with the gcc bug above (and
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119085, which has been
> correctly marked as a duplicate).

Is there any way we could change our code to avoid bumping into this
problem?  The bug exists in a relatively new version of GCC, so more
users will hit it in the years to come.  One way is to force the use
of -fno-tree-sra (for the affected versions of GCC, if we can identify
them), but is there maybe a less blunt instrument?

> > Configured using:
> >  'configure 'CFLAGS=-g3 -ggdb -O3 -mtune=native -march=native
> >  -fomit-frame-pointer' CPPFLAGS=-I/home/reitero/.local/lib/mps
> 
> Using -fomit-frame-pointer will result in the compiler putting
> references to GC-able objects in %rbp; since MPS usually uses setjmp to
> spill the registers to the stack, and setjmp "scrambles" %rbp for
> security reasons, that will result in references which are invisible to
> MPS, which will cause other crashes.

But configure.ac on the branch forces -fno-omit-frame-pointer.  Is
that not working for some reason?




Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Sun, 18 May 2025 11:21:02 GMT) Full text and rfc822 format available.

Message #14 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Pip Cet <pipcet <at> protonmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: oliver.reiter <at> snapdragon.cc, 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1;
 feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Sun, 18 May 2025 11:20:00 +0000
"Eli Zaretskii" <eliz <at> gnu.org> writes:

>> Date: Sat, 17 May 2025 20:58:49 +0000
>> From:  Pip Cet via "Bug reports for GNU Emacs,
>>  the Swiss army knife of text editors" <bug-gnu-emacs <at> gnu.org>
>>
>> "Oliver Reiter via \"Bug reports for GNU Emacs, the Swiss army knife of text editors\"" <bug-gnu-emacs <at> gnu.org> writes:
>>
>> > Dear all,
>> >
>> > I have encountered multiple crashes on feature/igc with pgtk when
>> > copying from Emacs to somewhere else. All crashes seem to involve some
>> > form of 'pgtk_handle_selection_*' function (xbacktrace is always empty).
>> > These crashes appear to be reproducible for me, if you need further
>> > info.
>>
>> Thanks for the report!  Can you try adding -fno-tree-sra to your CFLAGS
>> and recompiling?  This looks like
>> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117423
>>
>> > #9  pgtk_handle_selection_request (event=0x7fffffffc780)
>> >     at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
>> >         local_selection_time = <optimized out>
>> >         dpyinfo = 0x55dee7e0
>>
>> This pointer has been truncated to 32 bits; it should be 0x555555dee7e0.
>> That's consistent with the gcc bug above (and
>> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119085, which has been
>> correctly marked as a duplicate).
>
> Is there any way we could change our code to avoid bumping into this
> problem?

I thought we had, to be honest.  Let's confirm this is 117423 first,
then we can figure out how to work around that.

> The bug exists in a relatively new version of GCC, so more
> users will hit it in the years to come.

Indeed, and that's if it is fixed at all.

> One way is to force the use of -fno-tree-sra (for the affected
> versions of GCC, if we can identify them), but is there maybe a less
> blunt instrument?

That'd be great, but I don't know how to do it.

>> > Configured using:
>> >  'configure 'CFLAGS=-g3 -ggdb -O3 -mtune=native -march=native
>> >  -fomit-frame-pointer' CPPFLAGS=-I/home/reitero/.local/lib/mps
>>
>> Using -fomit-frame-pointer will result in the compiler putting
>> references to GC-able objects in %rbp; since MPS usually uses setjmp to
>> spill the registers to the stack, and setjmp "scrambles" %rbp for
>> security reasons, that will result in references which are invisible to
>> MPS, which will cause other crashes.
>
> But configure.ac on the branch forces -fno-omit-frame-pointer.  Is
> that not working for some reason?

Both options are passed to GCC, and -fomit-frame-pointer wins because
it's last.

Pip





Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Sun, 18 May 2025 11:27:02 GMT) Full text and rfc822 format available.

Message #17 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Oliver Reiter <oliver.reiter <at> snapdragon.cc>
To: Pip Cet <pipcet <at> protonmail.com>
Cc: 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1; feature/igc: multiple crashes with
 pgtk_handle_selection_*
Date: Sun, 18 May 2025 13:26:42 +0200
[Message part 1 (text/plain, inline)]
Pip Cet <pipcet <at> protonmail.com> writes:

> "Oliver Reiter via \"Bug reports for GNU Emacs, the Swiss army knife of text editors\"" <bug-gnu-emacs <at> gnu.org> writes:
>
>> Dear all,
>>
>> I have encountered multiple crashes on feature/igc with pgtk when
>> copying from Emacs to somewhere else. All crashes seem to involve some
>> form of 'pgtk_handle_selection_*' function (xbacktrace is always empty).
>> These crashes appear to be reproducible for me, if you need further
>> info.
>
> Thanks for the report!  Can you try adding -fno-tree-sra to your CFLAGS
> and recompiling?  This looks like
> <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117423>
>

I can confirm that adding this flag solves it, no more crashes when
copying stuff from Emacs.

>> #9  pgtk_handle_selection_request (event=0x7fffffffc780)
>>     at /home/reitero/build/sources/emacs/emacs_debug/src/pgtkselect.c:585
>>         local_selection_time = <optimized out>
>>         dpyinfo = 0x55dee7e0
>
> This pointer has been truncated to 32 bits; it should be 0x555555dee7e0.
> That's consistent with the gcc bug above (and
> <https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119085>, which has been
> correctly marked as a duplicate).
>
>>         selection = 0x45
>>         selection_symbol = XIL(0x1c0)
>>         target = <optimized out>
>>         target_symbol = XIL(0x3f00)
>>         property = 0x5e
>>         local_selection_data = <optimized out>
>>         success = false
>>         count = <optimized out>
>>         pushed = false
>>         alias = <optimized out>
>>         tem = <optimized out>
>>         DONE = <optimized out>
>
>> Configured using:
>>  'configure 'CFLAGS=-g3 -ggdb -O3 -mtune=native -march=native
>>  -fomit-frame-pointer' CPPFLAGS=-I/home/reitero/.local/lib/mps
>
> Using -fomit-frame-pointer will result in the compiler putting
> references to GC-able objects in %rbp; since MPS usually uses setjmp to
> spill the registers to the stack, and setjmp "scrambles" %rbp for
> security reasons, that will result in references which are invisible to
> MPS, which will cause other crashes.
>
> Pip

Thanks, I'll use -fno-omit-frame-pointer for now.

Oliver

Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Sun, 18 May 2025 11:38:03 GMT) Full text and rfc822 format available.

Message #20 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Pip Cet <pipcet <at> protonmail.com>
Cc: oliver.reiter <at> snapdragon.cc, 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1;
 feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Sun, 18 May 2025 14:37:49 +0300
> Date: Sun, 18 May 2025 11:20:00 +0000
> From: Pip Cet <pipcet <at> protonmail.com>
> Cc: 78473 <at> debbugs.gnu.org, oliver.reiter <at> snapdragon.cc
> 
> "Eli Zaretskii" <eliz <at> gnu.org> writes:
> 
> >> This pointer has been truncated to 32 bits; it should be 0x555555dee7e0.
> >> That's consistent with the gcc bug above (and
> >> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119085, which has been
> >> correctly marked as a duplicate).
> >
> > Is there any way we could change our code to avoid bumping into this
> > problem?
> 
> I thought we had, to be honest.  Let's confirm this is 117423 first,
> then we can figure out how to work around that.

OK.

> > One way is to force the use of -fno-tree-sra (for the affected
> > versions of GCC, if we can identify them), but is there maybe a less
> > blunt instrument?
> 
> That'd be great, but I don't know how to do it.

If worse comes to worst, we could use "#pragma GCC optimize" around
the affected code, I guess?

> >> > Configured using:
> >> >  'configure 'CFLAGS=-g3 -ggdb -O3 -mtune=native -march=native
> >> >  -fomit-frame-pointer' CPPFLAGS=-I/home/reitero/.local/lib/mps
> >>
> >> Using -fomit-frame-pointer will result in the compiler putting
> >> references to GC-able objects in %rbp; since MPS usually uses setjmp to
> >> spill the registers to the stack, and setjmp "scrambles" %rbp for
> >> security reasons, that will result in references which are invisible to
> >> MPS, which will cause other crashes.
> >
> > But configure.ac on the branch forces -fno-omit-frame-pointer.  Is
> > that not working for some reason?
> 
> Both options are passed to GCC, and -fomit-frame-pointer wins because
> it's last.

Then I guess we should filter out -fomit-frame-pointer from CFLAGS in
configure?




Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Tue, 20 May 2025 16:22:02 GMT) Full text and rfc822 format available.

Message #23 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Pip Cet <pipcet <at> protonmail.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: Po Lu <luangruo <at> yahoo.com>, Paul Eggert <eggert <at> cs.ucla.edu>,
 oliver.reiter <at> snapdragon.cc, 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1;
 feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Tue, 20 May 2025 16:20:51 +0000
"Eli Zaretskii" <eliz <at> gnu.org> writes:

>> Date: Sun, 18 May 2025 11:20:00 +0000
>> From: Pip Cet <pipcet <at> protonmail.com>
>> Cc: 78473 <at> debbugs.gnu.org, oliver.reiter <at> snapdragon.cc
>>
>> "Eli Zaretskii" <eliz <at> gnu.org> writes:
>>
>> >> This pointer has been truncated to 32 bits; it should be 0x555555dee7e0.
>> >> That's consistent with the gcc bug above (and
>> >> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=119085, which has been
>> >> correctly marked as a duplicate).
>> >
>> > Is there any way we could change our code to avoid bumping into this
>> > problem?
>>
>> I thought we had, to be honest.  Let's confirm this is 117423 first,
>> then we can figure out how to work around that.
>
> OK.

Thanks for confirming this, Oliver.  I've added Paul Eggert and Po Lu to
CC.

>> > One way is to force the use of -fno-tree-sra (for the affected
>> > versions of GCC, if we can identify them), but is there maybe a less
>> > blunt instrument?
>>
>> That'd be great, but I don't know how to do it.
>
> If worse comes to worst, we could use "#pragma GCC optimize" around
> the affected code, I guess?

Would that be feasible here?

>> >> > Configured using:
>> >> >  'configure 'CFLAGS=-g3 -ggdb -O3 -mtune=native -march=native
>> >> >  -fomit-frame-pointer' CPPFLAGS=-I/home/reitero/.local/lib/mps
>> >>
>> >> Using -fomit-frame-pointer will result in the compiler putting
>> >> references to GC-able objects in %rbp; since MPS usually uses setjmp to
>> >> spill the registers to the stack, and setjmp "scrambles" %rbp for
>> >> security reasons, that will result in references which are invisible to
>> >> MPS, which will cause other crashes.
>> >
>> > But configure.ac on the branch forces -fno-omit-frame-pointer.  Is
>> > that not working for some reason?
>>
>> Both options are passed to GCC, and -fomit-frame-pointer wins because
>> it's last.
>
> Then I guess we should filter out -fomit-frame-pointer from CFLAGS in
> configure?

An error message might be appropriate here, to avoid further confusion
about CFLAGS not taking effect.

Pip





Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Tue, 20 May 2025 18:32:02 GMT) Full text and rfc822 format available.

Message #26 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Pip Cet <pipcet <at> protonmail.com>
Cc: Po Lu <luangruo <at> yahoo.com>, Eli Zaretskii <eliz <at> gnu.org>,
 oliver.reiter <at> snapdragon.cc, 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1; feature/igc: multiple crashes with
 pgtk_handle_selection_*
Date: Tue, 20 May 2025 11:31:04 -0700
[Message part 1 (text/plain, inline)]
On 2025-05-20 09:20, Pip Cet wrote:
> Thanks for confirming this, Oliver.  I've added Paul Eggert and Po Lu to
> CC.

Thanks, this looks pretty serious and I see no easy workaround in Emacs. 
Let's disable tree-sra in GCC until the GCC bug is fixed. Proposed patch 
to Emacs master attached.
[0001-Work-around-GCC-bug-117423.patch (text/x-patch, attachment)]

Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Wed, 21 May 2025 11:17:01 GMT) Full text and rfc822 format available.

Message #29 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: luangruo <at> yahoo.com, pipcet <at> protonmail.com, oliver.reiter <at> snapdragon.cc,
 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1; feature/igc: multiple crashes with
 pgtk_handle_selection_*
Date: Wed, 21 May 2025 14:16:36 +0300
> Date: Tue, 20 May 2025 11:31:04 -0700
> Cc: 78473 <at> debbugs.gnu.org, oliver.reiter <at> snapdragon.cc,
>  Po Lu <luangruo <at> yahoo.com>, Eli Zaretskii <eliz <at> gnu.org>
> From: Paul Eggert <eggert <at> cs.ucla.edu>
> 
> On 2025-05-20 09:20, Pip Cet wrote:
> > Thanks for confirming this, Oliver.  I've added Paul Eggert and Po Lu to
> > CC.
> 
> Thanks, this looks pretty serious and I see no easy workaround in Emacs. 
> Let's disable tree-sra in GCC until the GCC bug is fixed. Proposed patch 
> to Emacs master attached.

Thanks, feel free to install on the master branch.




Reply sent to Paul Eggert <eggert <at> cs.ucla.edu>:
You have taken responsibility. (Wed, 21 May 2025 17:13:02 GMT) Full text and rfc822 format available.

Notification sent to Oliver Reiter <oliver.reiter <at> snapdragon.cc>:
bug acknowledged by developer. (Wed, 21 May 2025 17:13:03 GMT) Full text and rfc822 format available.

Message #34 received at 78473-done <at> debbugs.gnu.org (full text, mbox):

From: Paul Eggert <eggert <at> cs.ucla.edu>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: luangruo <at> yahoo.com, pipcet <at> protonmail.com, oliver.reiter <at> snapdragon.cc,
 78473-done <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1; feature/igc: multiple crashes with
 pgtk_handle_selection_*
Date: Wed, 21 May 2025 10:12:34 -0700
On 2025-05-21 04:16, Eli Zaretskii wrote:
> feel free to install on the master branch.

Thanks, done, and boldly closing the bug report as I assume this'll be 
merged into feature/igc in due course.




Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Fri, 23 May 2025 09:06:02 GMT) Full text and rfc822 format available.

Message #37 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Richard Stallman <rms <at> gnu.org>
To: Paul Eggert <eggert <at> cs.ucla.edu>
Cc: luangruo <at> yahoo.com, pipcet <at> protonmail.com, oliver.reiter <at> snapdragon.cc,
 eliz <at> gnu.org, 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1;
 feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Fri, 23 May 2025 05:05:04 -0400
[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > Thanks, this looks pretty serious and I see no easy workaround in Emacs. 
  > Let's disable tree-sra in GCC until the GCC bug is fixed. Proposed patch 
  > to Emacs master attached.

What sort of thing are we talking about disabling?
Is it a feature?
An optimization?
A test?

-- 
Dr Richard Stallman (https://stallman.org)
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)






Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Fri, 23 May 2025 10:38:01 GMT) Full text and rfc822 format available.

Message #40 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: rms <at> gnu.org
Cc: luangruo <at> yahoo.com, pipcet <at> protonmail.com, eggert <at> cs.ucla.edu,
 oliver.reiter <at> snapdragon.cc, 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1;
 feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Fri, 23 May 2025 13:36:25 +0300
> From: Richard Stallman <rms <at> gnu.org>
> Cc: pipcet <at> protonmail.com, luangruo <at> yahoo.com, eliz <at> gnu.org,
> 	oliver.reiter <at> snapdragon.cc, 78473 <at> debbugs.gnu.org
> Date: Fri, 23 May 2025 05:05:04 -0400
> 
>   > Thanks, this looks pretty serious and I see no easy workaround in Emacs. 
>   > Let's disable tree-sra in GCC until the GCC bug is fixed. Proposed patch 
>   > to Emacs master attached.
> 
> What sort of thing are we talking about disabling?
> Is it a feature?
> An optimization?
> A test?

It's an optimization.  For (some) details, see the description of the
'-ftree-sra' option in the "Optimize Options" node of the GCC manual.




Information forwarded to bug-gnu-emacs <at> gnu.org:
bug#78473; Package emacs. (Wed, 28 May 2025 12:47:03 GMT) Full text and rfc822 format available.

Message #43 received at 78473 <at> debbugs.gnu.org (full text, mbox):

From: Richard Stallman <rms <at> gnu.org>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 78473 <at> debbugs.gnu.org
Subject: Re: bug#78473: 30.1;
 feature/igc: multiple crashes with pgtk_handle_selection_*
Date: Wed, 28 May 2025 08:46:42 -0400
[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

  > > 
  > > What sort of thing are we talking about disabling?
  > > Is it a feature?
  > > An optimization?
  > > A test?

  > It's an optimization.

Thanks.  There can't be any deep issue in disablong an optimization
for practical reasons.

-- 
Dr Richard Stallman (https://stallman.org)
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)






This bug report was last modified 23 days ago.

Previous Next


GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.