Subject: bug#79131: 31.0.50; igc: nested signal, SIGSEGV

From: Eli Zaretskii <[email-masked]>
Date: Thu, 31 Jul 2025 08:11:00 +0300

> Cc: Pip Cet <[email-masked]>,
>  Gerd Möllmann <[email-masked]>
> Date: Wed, 30 Jul 2025 22:18:44 +0200
> From:  Óscar Fuentes via "Bug reports for GNU Emacs,
>  the Swiss army knife of text editors" <[email-masked]>
> 
> 
> This is a build of merging master's 6982dc460aa with current feature/igc
> HEAD (382123e69e2). I had to resolve some conflicts, so there is a
> possibility of the crash being caused by my mistake.
> 
> Backtrace from the coredump:
> 
> (gdb) bt full
> #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=11, no_tid=no_tid@entry=0)
>     at ./nptl/pthread_kill.c:44
>         tid = <optimized out>
>         ret = 0
>         pd = <optimized out>
>         old_mask = {__val = {94452575465120}}
>         ret = <optimized out>
> #1  0x00007f506ce9e9ff in __pthread_kill_internal (threadid=<optimized out>, signo=11)
>     at ./nptl/pthread_kill.c:89
> #2  0x00007f506ce49cc2 in __GI_raise (sig=sig@entry=11) at ../sysdeps/posix/raise.c:26
>         ret = <optimized out>
> #3  0x000055e773f12db8 in terminate_due_to_signal
>     (sig=sig@entry=11, backtrace_limit=backtrace_limit@entry=40) at ../../emacs/src/emacs.c:481
> #4  0x000055e773f132de in handle_fatal_signal (sig=sig@entry=11) at ../../emacs/src/sysdep.c:1793
> #5  0x000055e773f132e5 in deliver_thread_signal
>     (sig=sig@entry=11, handler=0x55e773f132d0 <handle_fatal_signal>) at ../../emacs/src/sysdep.c:1785
>         old_errno = <optimized out>
> #6  0x000055e774058dec in deliver_fatal_thread_signal (sig=11) at ../../emacs/src/sysdep.c:1805
> #7  handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>) at ../../emacs/src/sysdep.c:1943
>         fatal = <optimized out>
> #8  0x00007f506ce49df0 in <signal handler called> () at /lib/x86_64-linux-gnu/libc.so.6
> #9  0x00007f506ce4a007 in __GI_kill () at ../sysdeps/unix/syscall-template.S:120
> #10 0x000055e774215e44 in sigHandle ()
> #11 0x00007f506ce49df0 in <signal handler called> () at /lib/x86_64-linux-gnu/libc.so.6
> #12 add_text_properties_1 (start=<optimized out>, start@entry=0x1f06a, end=<optimized out>, 
>     end@entry=0x1f07a, properties=0x7f4fe3c2acc3, object=0x7f4fe645cfbd, 
>     object@entry=0x0, set_type=set_type@entry=TEXT_PROPERTY_REPLACE, destructive=destructive@entry=true)
> --Type <RET> for more, q to quit, c to continue without paging--c
>     at ../../emacs/src/textprop.c:1252
>         i = 0x0
>         unchanged = <optimized out>
>         s = 31770
>         len = 3
>         modified = <optimized out>
>         first_time = <optimized out>

Since this in code that is the result of your local merge, please be
sure to show the source lines corresponding to the call-stack frames
where the signal was raised.  Otherwise, we are left guessing what is
line 1252 in your version of textprop.c that could trigger SIGSEGV.
My guess is that it's here:

  /* We are at the beginning of interval I, with LEN chars to scan.  */
  for (;;)
    {
      eassert (i != 0);

      if (LENGTH (i) >= len) <<<<<<<<<<<<<<<<

but I shouldn't be guessing.  If my guess is correct, this is some
snafu with intervals in the buffer that happens to be the current one.

> #13 0x000055e77414774b in Fadd_text_properties
>     (start=0x1f06a, end=0x1f07a, properties=<optimized out>, object=0x0) at ../../emacs/src/textprop.c:1308
> #14 Fput_text_property
>     (start=0x1f06a, end=0x1f07a, property=<optimized out>, value=<optimized out>, object=0x0)
>     at ../../emacs/src/textprop.c:1326
>         properties = <optimized out>
> #15 0x00007f505801aec2 in F747265657369742d2d666f6e742d6c6f636b2d6d61726b2d72616e6765732d746f2d666f6e74696679_treesit__font_lock_mark_ranges_to_fontify_0 ()
>     at /home/oscar/.emacs.d/eln-cache/31.0.50-3eae311e/treesit-37439c61-2c208e3a.eln
> #16 0x000055e7740c8e8c in Ffuncall (nargs=2, args=0x7ffd6a2b0e70) at ../../emacs/src/eval.c:3201
>         count = {bytes = <optimized out>}
>         val = <optimized out>
> #17 0x00007f505801b396 in F747265657369742d2d7072652d7265646973706c6179_treesit__pre_redisplay_0 ()
>     at /home/oscar/.emacs.d/eln-cache/31.0.50-3eae311e/treesit-37439c61-2c208e3a.eln
> #18 0x000055e7740c8e8c in Ffuncall (nargs=2, args=0x7ffd6a2b0f80) at ../../emacs/src/eval.c:3201
>         count = {bytes = <optimized out>}
>         val = <optimized out>
> #19 0x000055e7740c90e9 in funcall_nil (nargs=<optimized out>, args=<optimized out>)
>     at ../../emacs/src/eval.c:2884
> #20 0x000055e7740c643d in run_hook_with_args
>     (nargs=2, args=0x7ffd6a2b0f80, funcall=0x55e7740c90e0 <funcall_nil>) at ../../emacs/src/eval.c:3061
>         global_vals = <optimized out>
>         sym = 0x2968c2d2eba0
>         val = 0x7f4fe52f5c83
>         ret = 0x0
> #21 0x000055e7740c8e8c in Ffuncall (nargs=3, args=0x7ffd6a2b0f78) at ../../emacs/src/eval.c:3201
>         count = {bytes = <optimized out>}
>         val = <optimized out>
> #22 0x00007f505b7c1d34 in F7265646973706c61792d2d7072652d7265646973706c61792d66756e6374696f6e73_redisplay__pre_redisplay_functions_0 ()
>     at /home/oscar/dev/emacs/igc/build/src/../native-lisp/31.0.50-3eae311e/preloaded/simple-fab5b0cf-fea6411a.eln
> #23 0x000055e7740c8e8c in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7f505ad28040)
>     at ../../emacs/src/eval.c:3201
>         count = {bytes = <optimized out>}
>         val = <optimized out>
> #24 0x000055e7740c7742 in Fapply (nargs=2, args=0x7f505ad28040) at ../../emacs/src/eval.c:2830
>         i = <optimized out>
>         funcall_nargs = <optimized out>
>         funcall_args = 0x0
>         spread_arg = <optimized out>
>         fun = 0x2968f6dc91d8
>         sa_avail = 16384
>         sa_count = {bytes = <optimized out>}
>         numargs = <optimized out>
>         retval = <optimized out>
> #25 0x000055e77411753a in exec_byte_code
>     (fun=<optimized out>, args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
>     at ../../emacs/src/lisp.h:2306
>         call_nargs = 2
>         call_fun = <optimized out>
>         count1 = {bytes = <optimized out>}
>         val = <optimized out>
>         call_args = 0x7f505ad28040
>         original_fun = 0x43d0
>         op = 2
>         type = <optimized out>
>         targets = {0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e77411793f <exec_byte_code+2047>, 0x55e77411793a <exec_byte_code+2042>, 0x55e774117935 <exec_byte_code+2037>, 0x55e77411731d <exec_byte_code+477>, 0x55e77411731d <exec_byte_code+477>, 0x55e7741178f7 <exec_byte_code+1975>, 0x55e7741178b9 <exec_byte_code+1913>, 0x55e7741198e2 <exec_byte_code+10146>, 0x55e7741198dd <exec_byte_code+10141>, 0x55e7741198d8 <exec_byte_code+10136>, 0x55e7741198d3 <exec_byte_code+10131>, 0x55e774117357 <exec_byte_code+535>, 0x55e774117360 <exec_byte_code+544>, 0x55e7741198c6 <exec_byte_code+10118>, 0x55e7741198e7 <exec_byte_code+10151>, 0x55e77411976e <exec_byte_code+9774>, 0x55e774119769 <exec_byte_code+9769>, 0x55e774119764 <exec_byte_code+9764>, 0x55e77411975f <exec_byte_code+9759>, 0x55e7741172b9 <exec_byte_code+377>, 0x55e7741172c0 <exec_byte_code+384>, 0x55e774119745 <exec_byte_code+9733>, 0x55e774119752 <exec_byte_code+9746>, 0x55e7741196f3 <exec_byte_code+9651>, 0x55e7741196ee <exec_byte_code+9646>, 0x55e7741196e9 <exec_byte_code+9641>, 0x55e7741196e4 <exec_byte_code+9636>, 0x55e7741175ef <exec_byte_code+1199>, 0x55e7741175f0 <exec_byte_code+1200>, 0x55e774119705 <exec_byte_code+9669>, 0x55e7741196f8 <exec_byte_code+9656>, 0x55e7741196c5 <exec_byte_code+9605>, 0x55e7741196c0 <exec_byte_code+9600>, 0x55e7741196bb <exec_byte_code+9595>, 0x55e7741196b6 <exec_byte_code+9590>, 0x55e7741173bd <exec_byte_code+637>, 0x55e7741173c0 <exec_byte_code+640>, 0x55e7741196d7 <exec_byte_code+9623>, 0x55e7741196ca <exec_byte_code+9610>, 0x55e774119697 <exec_byte_code+9559>, 0x55e774119692 <exec_byte_code+9554>, 0x55e77411968d <exec_byte_code+9549>, 0x55e774119688 <exec_byte_code+9544>, 0x55e774117639 <exec_byte_code+1273>, 0x55e774117640 <exec_byte_code+1280>, 0x55e7741196a9 <exec_byte_code+9577>, 0x55e77411969c <exec_byte_code+9564>, 0x55e774119273 <exec_byte_code+8499>, 0x55e7741192a7 <exec_byte_code+8551>, 0x55e774119330 <exec_byte_code+8688>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e7741190c7 <exec_byte_code+8071>, 0x55e774119054 <exec_byte_code+7956>, 0x55e77411900d <exec_byte_code+7885>, 0x55e774118fc6 <exec_byte_code+7814>, 0x55e774118f81 <exec_byte_code+7745>, 0x55e7741197ef <exec_byte_code+9903>, 0x55e7741197af <exec_byte_code+9839>, 0x55e774118f4f <exec_byte_code+7695>, 0x55e77411984b <exec_byte_code+9995>, 0x55e774119773 <exec_byte_code+9779>, 0x55e774118f0f <exec_byte_code+7631>, 0x55e774118edf <exec_byte_code+7583>, 0x55e774118e9f <exec_byte_code+7519>, 0x55e774118e62 <exec_byte_code+7458>, 0x55e774118e21 <exec_byte_code+7393>, 0x55e774118dab <exec_byte_code+7275>, 0x55e774118d20 <exec_byte_code+7136>, 0x55e774118c8b <exec_byte_code+6987>, 0x55e774118c5b <exec_byte_code+6939>, 0x55e774118c2b <exec_byte_code+6891>, 0x55e774118beb <exec_byte_code+6827>, 0x55e774118bab <exec_byte_code+6763>, 0x55e774118b6b <exec_byte_code+6699>, 0x55e774118b27 <exec_byte_code+6631>, 0x55e774118aed <exec_byte_code+6573>, 0x55e774118ab3 <exec_byte_code+6515>, 0x55e774118a79 <exec_byte_code+6457>, 0x55e7741189d7 <exec_byte_code+6295>, 0x55e77411897b <exec_byte_code+6203>, 0x55e774118921 <exec_byte_code+6113>, 0x55e7741188c7 <exec_byte_code+6023>, 0x55e77411886d <exec_byte_code+5933>, 0x55e774118813 <exec_byte_code+5843>, 0x55e7741187b9 <exec_byte_code+5753>, 0x55e774118761 <exec_byte_code+5665>, 0x55e774118704 <exec_byte_code+5572>, 0x55e7741186ac <exec_byte_code+5484>, 0x55e774118654 <exec_byte_code+5396>, 0x55e7741185fc <exec_byte_code+5308>, 0x55e7741185a3 <exec_byte_code+5219>, 0x55e7741184b2 <exec_byte_code+4978>, 0x55e774117689 <exec_byte_code+1353>, 0x55e774118482 <exec_byte_code+4930>, 0x55e77411844d <exec_byte_code+4877>, 0x55e7741183bd <exec_byte_code+4733>, 0x55e774118373 <exec_byte_code+4659>, 0x55e774118343 <exec_byte_code+4611>, 0x55e774118311 <exec_byte_code+4561>, 0x55e7741182df <exec_byte_code+4511>, 0x55e7741182a5 <exec_byte_code+4453>, 0x55e774118273 <exec_byte_code+4403>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e774118241 <exec_byte_code+4353>, 0x55e77411820f <exec_byte_code+4303>, 0x55e7741181dd <exec_byte_code+4253>, 0x55e7741181ab <exec_byte_code+4203>, 0x55e774118179 <exec_byte_code+4153>, 0x55e774118149 <exec_byte_code+4105>, 0x55e774117689 <exec_byte_code+1353>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e774118105 <exec_byte_code+4037>, 0x55e7741180d4 <exec_byte_code+3988>, 0x55e7741180a3 <exec_byte_code+3939>, 0x55e774118062 <exec_byte_code+3874>, 0x55e774118021 <exec_byte_code+3809>, 0x55e774117ff0 <exec_byte_code+3760>, 0x55e774117fbf <exec_byte_code+3711>, 0x55e774117f7e <exec_byte_code+3646>, 0x55e774117f3d <exec_byte_code+3581>, 0x55e774117efc <exec_byte_code+3516>, 0x55e774117ec9 <exec_byte_code+3465>, 0x55e774117e98 <exec_byte_code+3416>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e77411943f <exec_byte_code+8959>, 0x55e774119615 <exec_byte_code+9429>, 0x55e774119887 <exec_byte_code+10055>, 0x55e7741195d6 <exec_byte_code+9366>, 0x55e77411959a <exec_byte_code+9306>, 0x55e77411955e <exec_byte_code+9246>, 0x55e77411949d <exec_byte_code+9053>, 0x55e774119478 <exec_byte_code+9016>, 0x55e774119712 <exec_byte_code+9682>, 0x55e77411941a <exec_byte_code+8922>, 0x55e7741193b7 <exec_byte_code+8823>, 0x55e774119382 <exec_byte_code+8770>, 0x55e77411933b <exec_byte_code+8699>, 0x55e77411921e <exec_byte_code+8414>, 0x55e7741191da <exec_byte_code+8346>, 0x55e774119190 <exec_byte_code+8272>, 0x55e774119125 <exec_byte_code+8165>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e774117e53 <exec_byte_code+3347>, 0x55e774117e22 <exec_byte_code+3298>, 0x55e774117df1 <exec_byte_code+3249>, 0x55e774117dc0 <exec_byte_code+3200>, 0x55e774117d8f <exec_byte_code+3151>, 0x55e774117d4e <exec_byte_code+3086>, 0x55e774117d0d <exec_byte_code+3021>, 0x55e774117ccc <exec_byte_code+2956>, 0x55e774117c8b <exec_byte_code+2891>, 0x55e774117c24 <exec_byte_code+2788>, 0x55e774117be3 <exec_byte_code+2723>, 0x55e774117ba2 <exec_byte_code+2658>, 0x55e774117b71 <exec_byte_code+2609>, 0x55e774117b25 <exec_byte_code+2533>, 0x55e774117ad9 <exec_byte_code+2457>, 0x55e774117a9b <exec_byte_code+2395>, 0x55e774117a5d <exec_byte_code+2333>, 0x55e774117a22 <exec_byte_code+2274>, 0x55e77411854b <exec_byte_code+5131>, 0x55e7741184fc <exec_byte_code+5052>, 0x55e7741179b2 <exec_byte_code+2162>, 0x55e774117944 <exec_byte_code+2052>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e774118ddb <exec_byte_code+7323>, 0x55e774118a33 <exec_byte_code+6387>, 0x55e774118407 <exec_byte_code+4807>, 0x55e774117873 <exec_byte_code+1843>, 0x55e77411782d <exec_byte_code+1773>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e7741177f4 <exec_byte_code+1716>, 0x55e774117790 <exec_byte_code+1616>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e773f17ee1 <exec_byte_code-2093663>, 0x55e774117756 <exec_byte_code+1558> <repeats 64 times>}
>         quitcounter = <optimized out>
>         bc = 0x55e7742cb858 <main_thread+312>
>         top = 0x7f505ad28038
>         pc = <optimized out>
>         bytestr = <optimized out>
>         vector = <optimized out>
>         maxdepth = <optimized out>
>         const_length = <optimized out>
>         bytestr_length = <optimized out>
>         vectorp = 0x7f506b0a53f0
>         max_stack = <optimized out>
>         frame_base = <optimized out>
>         fp = <optimized out>
>         bytestr_data = <optimized out>
>         rest = <optimized out>
>         mandatory = <optimized out>
>         nonrest = <optimized out>
>         pushedargs = <optimized out>
>         saved_quitcounter = 0 '\000'
>         saved_vectorp = 0xdd98
>         saved_bytestr_data = 0x7ffd00000002 <error: Cannot access memory at address 0x7ffd00000002>
>         result = <optimized out>
> #26 0x000055e7740c8e8c in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7ffd6a2b1290)
>     at ../../emacs/src/eval.c:3201
>         count = {bytes = <optimized out>}
>         val = <optimized out>
> #27 0x000055e7740c5dbe in internal_condition_case_n
>     (bfun=bfun@entry=0x55e7740c8d90 <Ffuncall>, nargs=nargs@entry=2, args=args@entry=0x7ffd6a2b1290, handlers=handlers@entry=0x38, hfun=hfun@entry=0x55e773f4e550 <dsafe_eval_handler>) at ../../emacs/src/eval.c:1793
>         val = <optimized out>
>         c = 0x55e77bd0b710
> #28 0x000055e773f3bc04 in dsafe__call
>     (inhibit_quit=inhibit_quit@entry=true, f=0x55e7740c8d90 <Ffuncall>, nargs=nargs@entry=2, args=args@entry=0x7ffd6a2b1290) at ../../emacs/src/xdisp.c:3106
>         count = {bytes = <optimized out>}
>         redisplay_counter_before = 939536
>         val = <optimized out>
> #29 0x000055e773f6efbe in dsafe__call (inhibit_quit=true, nargs=2, f=<optimized out>, args=0x7ffd6a2b1290)
>     at ../../emacs/src/xdisp.c:3094
>         val = <optimized out>
>         count = {bytes = <optimized out>}
>         redisplay_counter_before = <optimized out>
> #30 prepare_menu_bars () at ../../emacs/src/xdisp.c:14060

This tels me that the crash happened insider prepare_menu_bars, which
called pre-redisplay-function.  What is your value of
pre-redisplay-functions (note: "functions", plural)?  The backtrace
indicates that treesit--pre-redisplay is involved; is that true?

I added Yuan, in case this is some treesit-related issue.