bug#37836: 27.0.50; Snake exit not save produces segfault

bug#37836: 27.0.50; Snake exit not save produces segfault

[Ergus via Bug reports for GNU Emacs, the Swiss army knife of text editors]

I was playing snake and when the game ended it asked to create a
directory. I replied no and a segfault was produced and closed emacs.

The bt in the core file was this:

#0  0x00005600e3fff6f3 in SYMBOL_NAME (sym=<optimized out>) at ../../src/lisp.h:1005
#1  0x00005600e3fff6f3 in oblookup (obarray=<optimized out>, ptr=0x5600e407d751 "auto-save-hook", size=14, size_byte=14) at ../../src/lread.c:4353
#2  0x00005600e3fff78a in intern_1 (str=str@entry=0x5600e407d751 "auto-save-hook", len=len@entry=14) at ../../src/lread.c:4162
#3  0x00005600e3f9b402 in intern (str=0x5600e407d751 "auto-save-hook") at ../../src/lisp.h:4107
#4  0x00005600e3f9b402 in Fdo_auto_save (no_message=<optimized out>, no_message@entry=0x30, current_only=current_only@entry=0x0) at ../../src/fileio.c:5830
#5  0x00005600e3f658a1 in shut_down_emacs (sig=sig@entry=11, stuff=stuff@entry=0x0) at ../../src/lisp.h:1032
#6  0x00005600e3e85c81 in terminate_due_to_signal (sig=sig@entry=11, backtrace_limit=backtrace_limit@entry=40) at ../../src/lisp.h:1032
#7  0x00005600e3e86105 in handle_fatal_signal (sig=sig@entry=11) at ../../src/sysdep.c:1790
#8  0x00005600e3f7d7cd in deliver_thread_signal (sig=sig@entry=11, handler=0x5600e3e860fa <handle_fatal_signal>) at ../../src/sysdep.c:1764
#9  0x00005600e3f7d849 in deliver_fatal_thread_signal (sig=11) at ../../src/sysdep.c:1887
#10 0x00005600e3f7d849 in handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>) at ../../src/sysdep.c:1887
#11 0x00007f849095c930 in <signal handler called> () at /usr/lib/libpthread.so.0
#12 0x00007f8490731a61 in __memmove_avx_unaligned_erms () at /usr/lib/libc.so.6
#13 0x00005600e3fbd058 in memcpy (__len=18446744073709551600, __src=0x5600e6e64528, __dest=<optimized out>) at /usr/include/bits/string_fortified.h:34
#14 0x00005600e3fbd058 in Fvector (nargs=-2, args=0x5600e6e64528) at ../../src/alloc.c:3308
#15 0x00005600e3fdbff3 in Ffuncall (nargs=1, args=args@entry=0x7ffd27382aa8) at ../../src/lisp.h:2109
#16 0x00005600e4011448 in exec_byte_code
    (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
    at ../../src/bytecode.c:633
#17 0x00005600e3fdbf57 in Ffuncall (nargs=1, args=args@entry=0x7ffd27382e18) at ../../src/eval.c:2808
#18 0x00005600e4011448 in exec_byte_code
    (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
    at ../../src/bytecode.c:633
#19 0x00005600e3fdbf57 in Ffuncall (nargs=1, args=0x7ffd27383338) at ../../src/eval.c:2808
#20 0x00005600e3fdc36c in Fapply (nargs=2, args=0x7ffd27383338) at ../../src/eval.c:2377
#21 0x00005600e3fdbff3 in Ffuncall (nargs=3, args=args@entry=0x7ffd27383330) at ../../src/lisp.h:2109
#22 0x00005600e4011448 in exec_byte_code
    (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=<optimized out>, args=<optimized out>)
    at ../../src/bytecode.c:633
#23 0x00005600e3fdbf57 in Ffuncall (nargs=2, args=0x7ffd273836e0) at ../../src/eval.c:2808
#24 0x00005600e3fdc0aa in call1 (fn=fn@entry=0xd1d0, arg1=arg1@entry=0x5600e65a1db5) at ../../src/eval.c:2654
#25 0x00005600e3f6bc2a in timer_check_2 (idle_timers=<optimized out>, timers=<optimized out>) at ../../src/lisp.h:1032
#26 0x00005600e3f6bc2a in timer_check () at ../../src/keyboard.c:4367
#27 0x00005600e3f6bef5 in readable_events (flags=flags@entry=1) at ../../src/keyboard.c:3366
#28 0x00005600e3f6c948 in get_input_pending (flags=flags@entry=1) at ../../src/keyboard.c:6786
#29 0x00005600e3f6f7c8 in detect_input_pending_run_timers (do_display=do_display@entry=true) at ../../src/keyboard.c:10332
#30 0x00005600e401b954 in wait_reading_process_output
    (time_limit=time_limit@entry=30, nsecs=nsecs@entry=0, read_kbd=read_kbd@entry=-1, do_display=do_display@entry=true, wait_for_cell=wait_for_cell@entry=0x0, wait_proc=w
ait_proc@entry=0x0, just_wait_proc=0) at ../../src/process.c:5655
#31 0x00005600e3e9654f in sit_for (timeout=timeout@entry=0x7a, reading=reading@entry=true, display_option=display_option@entry=1) at ../../src/lisp.h:1032
#32 0x00005600e3f7243a in read_char (commandflag=1, map=0x5600e717afd3, prev_event=0x0, used_mouse_menu=0x7ffd273842cb, end_time=0x0) at ../../src/lisp.h:1147
--Type <RET> for more, q to quit, c to continue without paging--
#33 0x00005600e3f7297a in read_key_sequence
    (keybuf=<optimized out>, prompt=0x0, dont_downcase_last=<optimized out>, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=<optimized out>)
    at ../../src/keyboard.c:9527
#34 0x00005600e3f7401c in command_loop_1 () at ../../src/lisp.h:1032
#35 0x00005600e3fdb287 in internal_condition_case
    (bfun=bfun@entry=0x5600e3f73e20 <command_loop_1>, handlers=handlers@entry=0x90, hfun=hfun@entry=0x5600e3f6afb0 <cmd_error>) at ../../src/eval.c:1355
#36 0x00005600e3f65d14 in command_loop_2 (ignore=ignore@entry=0x0) at ../../src/lisp.h:1032
#37 0x00005600e3fdb1e1 in internal_catch (tag=tag@entry=0xd4a0, func=func@entry=0x5600e3f65cf0 <command_loop_2>, arg=arg@entry=0x0) at ../../src/eval.c:1116
#38 0x00005600e3f65cbb in command_loop () at ../../src/lisp.h:1032
#39 0x00005600e3f6abc6 in recursive_edit_1 () at ../../src/keyboard.c:714
#40 0x00005600e3f6aef2 in Frecursive_edit () at ../../src/keyboard.c:786
#41 0x00005600e3e8c967 in main (argc=2, argv=<optimized out>) at ../../src/emacs.c:2055


In GNU Emacs 27.0.50 (build 3, x86_64-pc-linux-gnu, GTK+ Version 3.24.12)
 of 2019-10-20 built on Ergus
Repository revision: c2cd27bceb574b749a3de0629d915cb8afb4378e
Repository branch: master
System Description: Arch Linux

Recent messages:
Loading /home/ergo/.emacs.d/custom.el (source)...done
Starting new Ispell process /usr/bin/aspell with default dictionary...done
For information about GNU Emacs and the GNU system, type C-h C-a.
Load time 0.807473
funcall-interactively: End of buffer

Configured using:
 'configure --prefix=/mnt/casa/install_arch/emacs --with-x-toolkit=gtk3
 --with-xft --with-modules --with-mailutils'

Configured features:
XPM JPEG TIFF GIF PNG RSVG SOUND GPM DBUS GSETTINGS GLIB NOTIFY INOTIFY
ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE HARFBUZZ M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11 XDBE XIM MODULES THREADS LIBSYSTEMD JSON
PDUMPER LCMS2 GMP

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

bug#37836: 27.0.50; Snake exit not save produces segfault

[Eli Zaretskii]

> Date: Sun, 20 Oct 2019 21:54:48 +0200
> From: Ergus via "Bug reports for GNU Emacs,
>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
> 
> I was playing snake and when the game ended it asked to create a
> directory. I replied no and a segfault was produced and closed emacs.
> 
> The bt in the core file was this:

Can you show the output of xbacktrace?

The backtrace indicates that Emacs got a SIGSEGV inside Fvector that
was called from some timer function, but the function itself is not
shown, AFAICT.  It probably isn't related to snake at all.

bug#37836: 27.0.50; Snake exit not save produces segfault

[Stefan Kangas]

Eli Zaretskii <eliz@gnu.org> writes:

>> Date: Sun, 20 Oct 2019 21:54:48 +0200
>> From: Ergus via "Bug reports for GNU Emacs,
>>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
>> 
>> I was playing snake and when the game ended it asked to create a
>> directory. I replied no and a segfault was produced and closed emacs.
>> 
>> The bt in the core file was this:
>
> Can you show the output of xbacktrace?
>
> The backtrace indicates that Emacs got a SIGSEGV inside Fvector that
> was called from some timer function, but the function itself is not
> shown, AFAICT.  It probably isn't related to snake at all.

It seems like we need more info here to make any progress.  Could you
try to produce the output that Eli is looking for?  Thanks.

Best regards,
Stefan Kangas

bug#37836: 27.0.50; Snake exit not save produces segfault

[Ergus via Bug reports for GNU Emacs, the Swiss army knife of text editors]

On Thu, Jan 16, 2020 at 03:26:00PM +0100, Stefan Kangas wrote:
>Eli Zaretskii <eliz@gnu.org> writes:
>
>>> Date: Sun, 20 Oct 2019 21:54:48 +0200
>>> From: Ergus via "Bug reports for GNU Emacs,
>>>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
>>>
>>> I was playing snake and when the game ended it asked to create a
>>> directory. I replied no and a segfault was produced and closed emacs.
>>>
>>> The bt in the core file was this:
>>
>> Can you show the output of xbacktrace?
>>
>> The backtrace indicates that Emacs got a SIGSEGV inside Fvector that
>> was called from some timer function, but the function itself is not
>> shown, AFAICT.  It probably isn't related to snake at all.
>
>It seems like we need more info here to make any progress.  Could you
>try to produce the output that Eli is looking for?  Thanks.
>
Hi Stefan:

I haven't try snake anymore for a while. I Just tried it again and the
segfault is not there anymore (on master with my config and with
emacs -Q). This is mainly because it always creates the directory
~/.emacs.d/games independently of my answer when it asks. Is this
somehow intended or just an issue hiding the other?

Thanks for looking into this,
Ergus

>Best regards,
>Stefan Kangas

bug#37836: 27.0.50; Snake exit not save produces segfault

[Stefan Kangas]

Ergus <spacibba@aol.com> writes:

> I haven't try snake anymore for a while. I Just tried it again and the
> segfault is not there anymore (on master with my config and with
> emacs -Q).

Thanks.  Do you have a recipe for how you try to reproduce this?

Have you seen this crash since?

> This is mainly because it always creates the directory
> ~/.emacs.d/games independently of my answer when it asks. Is this
> somehow intended or just an issue hiding the other?

Are you saying that the reason for the crash was a missing directory?
If so, could you please explain how you have arrived at this
conclusion?

Best regards,
Stefan Kangas

bug#37836: 27.0.50; Snake exit not save produces segfault

[Stefan Kangas]

Stefan Kangas <stefan@marxist.se> writes:

> Are you saying that the reason for the crash was a missing directory?
> If so, could you please explain how you have arrived at this
> conclusion?

I took another look at the back trace, and what Eli writes:

> The backtrace indicates that Emacs got a SIGSEGV inside Fvector that
> was called from some timer function, but the function itself is not
> shown, AFAICT.  It probably isn't related to snake at all.

I think one way of making progress here is trying to figure out which
timer function was being run at the time.  Do you have any idea what
that could have been?  Do you have any timer functions of your own
running?  Were you doing something else in this Emacs session which it
could have been related to?

Best regards,
Stefan Kangas

bug#37836: 27.0.50; Snake exit not save produces segfault

[Jimmy Aguilar Mena]

On Mon, Jan 20, 2020 at 12:48:38PM +0100, Stefan Kangas wrote:
>Ergus <spacibba@aol.com> writes:
>
>> I haven't try snake anymore for a while. I Just tried it again and the
>> segfault is not there anymore (on master with my config and with
>> emacs -Q).
>
>Thanks.  Do you have a recipe for how you try to reproduce this?
>
rm -rf ~/.emacs.d/games
emacs -Q
M-x snake
(wait until it looses and asks to create directory)
reply: n

Now there is a message (when previously there was a segfault):
Error running timer ‘snake-update-game’: (error "Canceled")

>Have you seen this crash since?
>
Since I reported the issue more or less.

>> This is mainly because it always creates the directory
>> ~/.emacs.d/games independently of my answer when it asks. Is this
>> somehow intended or just an issue hiding the other?
>
>Are you saying that the reason for the crash was a missing directory?
>If so, could you please explain how you have arrived at this
>conclusion?
>
Because the error was triggered when I used to reply no to the create
question.

When I said yes there was not segfault anymore.

>Best regards,
>Stefan Kangas

Best,
Ergus

bug#37836: 27.0.50; Snake exit not save produces segfault

[Stefan Kangas]

Jimmy Aguilar Mena <kratsbinovish@gmail.com> writes:

> rm -rf ~/.emacs.d/games
> emacs -Q
> M-x snake
> (wait until it looses and asks to create directory)
> reply: n
>
> Now there is a message (when previously there was a segfault):
> Error running timer .snake-update-game.: (error "Canceled")

Thanks, yes, I get the same message.

Your bug report was sent using revision c2cd27bce.

Between that revision and HEAD as of today, there has been no change
to any code in the play/ directory AFAICT.

This makes me suspect that the crash is in fact not related to snake,
as Eli suggested may be the case.  Which leads me to the below question:

> When I said yes there was not segfault anymore.

When you saw it, were you able to reproduce it consistently using the
recipe you gave above?

Best regards,
Stefan Kangas

bug#37836: 27.0.50; Snake exit not save produces segfault

[Ergus via Bug reports for GNU Emacs, the Swiss army knife of text editors]

On Wed, Jan 22, 2020 at 10:22:38AM +0100, Stefan Kangas wrote:
>Jimmy Aguilar Mena <kratsbinovish@gmail.com> writes:
>
>> rm -rf ~/.emacs.d/games
>> emacs -Q
>> M-x snake
>> (wait until it looses and asks to create directory)
>> reply: n
>>
>> Now there is a message (when previously there was a segfault):
>> Error running timer .snake-update-game.: (error "Canceled")
>
>Thanks, yes, I get the same message.
>
>Your bug report was sent using revision c2cd27bce.
>
>Between that revision and HEAD as of today, there has been no change
>to any code in the play/ directory AFAICT.
>
>This makes me suspect that the crash is in fact not related to snake,
>as Eli suggested may be the case.  Which leads me to the below question:
>
>> When I said yes there was not segfault anymore.
>
>When you saw it, were you able to reproduce it consistently using the
>recipe you gave above?
>
Yes, but I can't reproduce it now doing a checkout to c2cd27bce.

>Best regards,
>Stefan Kangas

bug#37836: 27.0.50; Snake exit not save produces segfault

[Stefan Kangas]

tags 37836 + unreproducible
thanks

Ergus <spacibba@aol.com> writes:

>>> When I said yes there was not segfault anymore.
>>
>>When you saw it, were you able to reproduce it consistently using the
>>recipe you gave above?
>>
> Yes, but I can't reproduce it now doing a checkout to c2cd27bce.

I tried that too, and I can't reproduce it either.  Strange.

Do you have any idea about what could have been different with your
old build?  Any changes in your environment perhaps?

I'm not really sure how to investigate this beyond that.  Does anyone
else have any ideas here?

Best regards,
Stefan Kangas

bug#37836: 27.0.50; Snake exit not save produces segfault

[Ergus via Bug reports for GNU Emacs, the Swiss army knife of text editors]

On Wed, Jan 22, 2020 at 07:39:19PM +0100, Stefan Kangas wrote:
>tags 37836 + unreproducible
>thanks
>
>Ergus <spacibba@aol.com> writes:
>
>>>> When I said yes there was not segfault anymore.
>>>
>>>When you saw it, were you able to reproduce it consistently using the
>>>recipe you gave above?
>>>
>> Yes, but I can't reproduce it now doing a checkout to c2cd27bce.
>
>I tried that too, and I can't reproduce it either.  Strange.
>
>Do you have any idea about what could have been different with your
>old build?  Any changes in your environment perhaps?
>
>I'm not really sure how to investigate this beyond that.  Does anyone
>else have any ideas here?
>
>Best regards,
>Stefan Kangas


Hi Stefan:

Probably the message:

Error running timer .snake-update-game.: (error "Canceled")

is related with this. Maybe we should investigate in that direction?
What do you think?

Best
Ergus

bug#37836: 27.0.50; Snake exit not save produces segfault

[Lars Ingebrigtsen]

Jimmy Aguilar Mena <kratsbinovish@gmail.com> writes:

> rm -rf ~/.emacs.d/games
> emacs -Q
> M-x snake
> (wait until it looses and asks to create directory)
> reply: n
>
> Now there is a message (when previously there was a segfault):
> Error running timer ‘snake-update-game’: (error "Canceled")

I've now fixed this (by making it ensure that the directory exists).

There was also an unreproducible segfault in this bug report that
sounded like it had gone away, so I'm closing this bug report.  If the
problem still persists, please send a gdb xbacktrace to the debbugs
address, and we'll reopen.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no