bug#1052: segfault when resuming emacsclient -t in an xterm

bug#1052: segfault when resuming emacsclient -t in an xterm

[Dan Nicolaescu]

This change:

2008-03-29  Stefan Monnier  <monnier@iro.umontreal.ca>

            * xt-mouse.el (xterm-mouse-mode): Use delete-terminal-functions.
            (xterm-mouse-handle-delete-frame): Delete.

            * term/xterm.el (terminal-init-xterm): Use delete-terminal-functions.
            (xterm-turn-on-modify-other-keys, xterm-turn-off-modify-other-keys)
            (xterm-remove-modify-other-keys): Lookup terminal rather than frame
            in xterm-modify-other-keys-terminal-list.

causes the following:

emacs -Q -f server-start RET

in another xterm do:

emacsclient -t RET
C-z
emacsclient -t RET
C-z
fg
C-x C-c

at this point emacs segfaults with the following backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x007c3c81 in fwrite () from /lib/libc.so.6
Missing separate debuginfos, use: debuginfo-install Xaw3d.i386 e2fsprogs.i386 giflib.i386 glibc.i686 gpm.i386 libICE.i386 libSM.i386 libX11.i386 libXau.i386 libXcursor.i386 libXdmcp.i386 libXext.i386 libXfixes.i386 libXmu.i386 libXpm.i386 libXrender.i386 libXt.i386 libjpeg.i386 libpng.i386 libtiff.i386 libxcb.i386 ncurses.i386 zlib.i386
(gdb) bt
#0  0x007c3c81 in fwrite () from /lib/libc.so.6
#1  0x08052f7a in Fsend_string_to_terminal (string=143248211, terminal=137808073)
    at /tmp/emacs/src/dispnew.c:6473
#2  0x0816ed97 in Ffuncall (nargs=2, args=0xbf8e3b00)
    at /tmp/emacs/src/eval.c:3047
#3  0x081a3680 in Fbyte_code (bytestr=143248515, vector=146901764, maxdepth=<value optimized out>)
    at /tmp/emacs/src/bytecode.c:678
#4  0x08170b73 in funcall_lambda (fun=146932996, nargs=1, arg_vector=0xbf8e3df4)
    at /tmp/emacs/src/eval.c:3231
#5  0x0816ea9b in Ffuncall (nargs=2, args=0xbf8e3df0)
    at /tmp/emacs/src/eval.c:3101
#6  0x0816fe01 in run_hook_with_args (nargs=2, args=0xbf8e3df0, cond=to_completion)
    at /tmp/emacs/src/eval.c:2703
#7  0x0816ec36 in Ffuncall (nargs=3, args=0xbf8e3dec)
    at /tmp/emacs/src/eval.c:3025
#8  0x0816dd6d in internal_condition_case_2 (bfun=0x816e8f0 <Ffuncall>, nargs=3, args=0xbf8e3dec, 
    handlers=137808121, hfun=0x8076a40 <safe_eval_handler>)
    at /tmp/emacs/src/eval.c:1610
#9  0x0807f2aa in safe_call (nargs=3, args=0xbf8e3dec)
    at /tmp/emacs/src/xdisp.c:2379
#10 0x0807f2fb in safe_call2 (fn=137949729, arg1=138024513, arg2=144406428)
    at /tmp/emacs/src/xdisp.c:2420
#11 0x080cac9d in Fdelete_terminal (terminal=144406428, force=137808121)
    at /tmp/emacs/src/terminal.c:331
#12 0x0805e8b3 in Fdelete_frame (frame=147003460, force=137808121)
    at /tmp/emacs/src/frame.c:1525
#13 0x0816ed97 in Ffuncall (nargs=2, args=0xbf8e3f00)
    at /tmp/emacs/src/eval.c:3047
#14 0x081a3680 in Fbyte_code (bytestr=143528187, vector=146950748, maxdepth=<value optimized out>)
    at /tmp/emacs/src/bytecode.c:678
#15 0x08170b73 in funcall_lambda (fun=147009116, nargs=1, arg_vector=0xbf8e4044)
    at /tmp/emacs/src/eval.c:3231
#16 0x0816ea9b in Ffuncall (nargs=2, args=0xbf8e4040)
    at /tmp/emacs/src/eval.c:3101
#17 0x081a3680 in Fbyte_code (bytestr=137997267, vector=144196452, maxdepth=<value optimized out>)
    at /tmp/emacs/src/bytecode.c:678
#18 0x08170b73 in funcall_lambda (fun=144184804, nargs=2, arg_vector=0xbf8e4174)
    at /tmp/emacs/src/eval.c:3231
#19 0x0816ea9b in Ffuncall (nargs=3, args=0xbf8e4170)
    at /tmp/emacs/src/eval.c:3101
#20 0x081a3680 in Fbyte_code (bytestr=136424043, vector=136424060, maxdepth=<value optimized out>)
    at /tmp/emacs/src/bytecode.c:678
#21 0x08170b73 in funcall_lambda (fun=136423996, nargs=1, arg_vector=0xbf8e42f4)
    at /tmp/emacs/src/eval.c:3231
#22 0x0816ea9b in Ffuncall (nargs=2, args=0xbf8e42f0)
    at /tmp/emacs/src/eval.c:3101
#23 0x0816c9ac in Fcall_interactively (function=143157089, record_flag=137808073, keys=137846508)
    at /tmp/emacs/src/callint.c:857
#24 0x0816ed7b in Ffuncall (nargs=4, args=0xbf8e44b0)
    at /tmp/emacs/src/eval.c:3050
#25 0x0816eec9 in call3 (fn=137972297, arg1=143157089, arg2=137808073, arg3=137808073)
    at /tmp/emacs/src/emacs.c:1724

Lisp Backtrace:
"send-string-to-terminal" (0xbf8e3b04)
"xterm-remove-modify-other-keys" (0xbf8e3df4)
"run-hook-with-args" (0xbf8e3df0)
"delete-frame" (0xbf8e3f04)
"server-delete-client" (0xbf8e4044)
"server-save-buffers-kill-terminal" (0xbf8e4174)
"save-buffers-kill-terminal" (0xbf8e42f4)
"call-interactively" (0xbf8e44b4)

The reason is:

(gdb) frame 1
#1  0x08052f7a in Fsend_string_to_terminal (string=143248211, terminal=137808073)
    at /tmp/emacs/src/dispnew.c:6473
6473      fwrite (SDATA (string), 1, SBYTES (string), tty->output);
(gdb) p tty->output
$1 = (FILE *) 0x0


The problem is that after the cited change
`xterm-remove-modify-other-keys' calls `terminal-live-p' (it was
previously using `frame-live-p') before calling
`send-string-to-terminal'.

`terminal-live-p' does not return false when tty->output is NULL ---> KABOOM.

BTW, unlike what the cited ChangeLog says,
`xterm-turn-off-modify-other-keys' still uses `frame-live-p'.

bug#1052: segfault when resuming emacsclient -t in an xterm

[Chong Yidong]

> The problem is that after the cited change
> `xterm-remove-modify-other-keys' calls `terminal-live-p' (it was
> previously using `frame-live-p') before calling
> `send-string-to-terminal'.
>
> `terminal-live-p' does not return false when tty->output is NULL --->
> KABOOM.

Looks like it's just a matter of checking tty->output, then.  WDYT?

*** trunk/src/dispnew.c.~1.419.~	2008-09-28 16:09:43.000000000 -0400
--- trunk/src/dispnew.c	2008-09-30 13:02:21.000000000 -0400
***************
*** 6470,6477 ****
        fwrite (SDATA (string), 1, SBYTES (string), tty->termscript);
        fflush (tty->termscript);
      }
!   fwrite (SDATA (string), 1, SBYTES (string), tty->output);
!   fflush (tty->output);
    UNBLOCK_INPUT;
    return Qnil;
  }
--- 6470,6480 ----
        fwrite (SDATA (string), 1, SBYTES (string), tty->termscript);
        fflush (tty->termscript);
      }
!   if (tty->output)
!     {
!       fwrite (SDATA (string), 1, SBYTES (string), tty->output);
!       fflush (tty->output);
!     }
    UNBLOCK_INPUT;
    return Qnil;
  }

bug#1052: segfault when resuming emacsclient -t in an xterm

[Dan Nicolaescu]

Chong Yidong <cyd@stupidchicken.com> writes:

  > > The problem is that after the cited change
  > > `xterm-remove-modify-other-keys' calls `terminal-live-p' (it was
  > > previously using `frame-live-p') before calling
  > > `send-string-to-terminal'.
  > >
  > > `terminal-live-p' does not return false when tty->output is NULL --->
  > > KABOOM.
  > 
  > Looks like it's just a matter of checking tty->output, then.  WDYT?

Not sure it's a good idea.
The test for `frame-live-p' was trying to make sure that the frame is OK
and `send-string-to-terminal' would work.  

Not sure
 1.  why was it replaced with `terminal-live-p'
 2.  maybe `terminal-live-p' needs to be changed to detect this condition

  > *** trunk/src/dispnew.c.~1.419.~	2008-09-28 16:09:43.000000000 -0400
  > --- trunk/src/dispnew.c	2008-09-30 13:02:21.000000000 -0400
  > ***************
  > *** 6470,6477 ****
  >         fwrite (SDATA (string), 1, SBYTES (string), tty->termscript);
  >         fflush (tty->termscript);
  >       }
  > !   fwrite (SDATA (string), 1, SBYTES (string), tty->output);
  > !   fflush (tty->output);
  >     UNBLOCK_INPUT;
  >     return Qnil;
  >   }
  > --- 6470,6480 ----
  >         fwrite (SDATA (string), 1, SBYTES (string), tty->termscript);
  >         fflush (tty->termscript);
  >       }
  > !   if (tty->output)
  > !     {
  > !       fwrite (SDATA (string), 1, SBYTES (string), tty->output);
  > !       fflush (tty->output);
  > !     }
  >     UNBLOCK_INPUT;
  >     return Qnil;
  >   }

bug#1052: segfault when resuming emacsclient -t in an xterm

[Stefan Monnier]

>> > The problem is that after the cited change
>> > `xterm-remove-modify-other-keys' calls `terminal-live-p' (it was
>> > previously using `frame-live-p') before calling
>> > `send-string-to-terminal'.
>> >
>> > `terminal-live-p' does not return false when tty->output is NULL --->
>> > KABOOM.
>> 
>> Looks like it's just a matter of checking tty->output, then.  WDYT?

> Not sure it's a good idea.
> The test for `frame-live-p' was trying to make sure that the frame is OK
> and `send-string-to-terminal' would work.  

> Not sure
>  1.  why was it replaced with `terminal-live-p'

Because the function receives a `terminal' argument.

>  2.  maybe `terminal-live-p' needs to be changed to detect this condition

I think there are 2 problems:
1- xterm-remove-modify-other-keys forgets to pass `terminal' 
   to `send-string-to-terminal'.  Hopefully, I've just fixed it, so that
   your recipe should not causes a segfault any more.

2- send-string-to-terminal causes a segfault is called for a terminal
   that is suspended.  I've made it signal an error.


        Stefan