bug#34762: 26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.

bug#34762: 26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.

[Caroptions Caroptions]

[-- Attachment #1: Type: text/plain, Size: 9940 bytes --]

Open any remote file over TRAMP (ssh), click any menu:


objc[33826]: Invalid or prematurely-freed autorelease pool 0x10300a208.
Process 33826 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fff68a3801e libsystem_kernel.dylib`__abort_with_payload + 10
libsystem_kernel.dylib`__abort_with_payload:
->  0x7fff68a3801e <+10>: jae    0x7fff68a38028            ; <+20>
    0x7fff68a38020 <+12>: movq   %rax, %rdi
    0x7fff68a38023 <+15>: jmp    0x7fff68a1a3b7            ; cerror_nocancel
    0x7fff68a38028 <+20>: retq
Target 0: (Emacs) stopped.


Compiled:
xcode 10.1, OSX Mojave
branch: emacs-emacs-26.1.92

./configure --with-ns --with-modules --with-wide-int --without-makeinfo
--without-sound  --without-x  --without-dbus  --without-gsettings
--without-selinux --without-gconf --without-libotf --without-m17n-flt
--disable-acl --with-file-notification=kqueue
--enable-checking='yes,glyphs' --enable-check-lisp-object-type
CFLAGS='-O0 -g3'

Backtrace:

(lldb) bt all
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fff68a3801e libsystem_kernel.dylib`__abort_with_payload + 10
    frame #1: 0x00007fff68a33541 libsystem_kernel.dylib`abort_with_payload_wrapper_internal + 82
    frame #2: 0x00007fff68a334ef libsystem_kernel.dylib`abort_with_reason + 22
    frame #3: 0x00007fff6781bd3d libobjc.A.dylib`_objc_fatalv(unsigned long long, unsigned long long, char const*, __va_list_tag*) + 108
    frame #4: 0x00007fff6781bbff libobjc.A.dylib`_objc_fatal(char const*, ...) + 127
    frame #5: 0x00007fff6780e8a9 libobjc.A.dylib`(anonymous namespace)::AutoreleasePoolPage::pop(void*) + 957
    frame #6: 0x00007fff3b5c8f32 CoreFoundation`_CFAutoreleasePoolPop + 22
    frame #7: 0x00007fff3d961c4e Foundation`-[NSAutoreleasePool release] + 144
    frame #8: 0x000000010048700c Emacs`ns_update_menubar(f=0x0000000104062c30, deep_p=true, submenu=0x0000000000000000) at nsmenu.m:462
    frame #9: 0x000000010048705e Emacs`x_activate_menubar(f=0x0000000104062c30) at nsmenu.m:481
    frame #10: 0x00000001001e0bbd Emacs`kbd_buffer_get_event(kbp=0x00007ffeefbfd8c0, used_mouse_menu=0x00007ffeefbfebff, end_time=0x0000000000000000) at keyboard.c:3955
    frame #11: 0x00000001001dfa44 Emacs`read_event_from_main_queue(end_time=0x0000000000000000, local_getcjmp=0x00007ffeefbfe580, used_mouse_menu=0x00007ffeefbfebff) at keyboard.c:2153
    frame #12: 0x00000001001ce0a9 Emacs`read_decoded_event_from_main_queue(end_time=0x0000000000000000, local_getcjmp=0x00007ffeefbfe580, prev_event=(i = 0), used_mouse_menu=0x00007ffeefbfebff) at keyboard.c:2217
    frame #13: 0x00000001001ca9af Emacs`read_char(commandflag=1, map=(i = 4382275843), prev_event=(i = 0), used_mouse_menu=0x00007ffeefbfebff, end_time=0x0000000000000000) at keyboard.c:2808
    frame #14: 0x00000001001c3d6a Emacs`read_key_sequence(keybuf=0x00007ffeefbff210, bufsize=30, prompt=(i = 0), dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:9157
    frame #15: 0x00000001001c23b6 Emacs`command_loop_1 at keyboard.c:1368
    frame #16: 0x00000001002fd9cf Emacs`internal_condition_case(bfun=(Emacs`command_loop_1 at keyboard.c:1259), handlers=(i = 18720), hfun=(Emacs`cmd_error at keyboard.c:938)) at eval.c:1336
    frame #17: 0x00000001001def21 Emacs`command_loop_2(ignore=(i = 0)) at keyboard.c:1110
    frame #18: 0x00000001002fcbc8 Emacs`internal_catch(tag=(i = 48048), func=(Emacs`command_loop_2 at keyboard.c:1106), arg=(i = 0)) at eval.c:1101
    frame #19: 0x00000001001c0f3d Emacs`command_loop at keyboard.c:1089
    frame #20: 0x00000001001c0d57 Emacs`recursive_edit_1 at keyboard.c:695
    frame #21: 0x00000001001c118a Emacs`Frecursive_edit at keyboard.c:766
    frame #22: 0x00000001001be7d1 Emacs`main(argc=1, argv=0x00007ffeefbff988) at emacs.c:1717
    frame #23: 0x00007fff688e0ed9 libdyld.dylib`start + 1
    frame #24: 0x00007fff688e0ed9 libdyld.dylib`start + 1
  thread #5
    frame #0: 0x00007fff68a1bb6a libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x00000000000186a6
    frame #2: 0x00007fff68ad3405 libsystem_pthread.dylib`start_wqthread + 13
  thread #6
    frame #0: 0x00007fff68a1bb6a libsystem_kernel.dylib`__workq_kernreturn + 10
    frame #1: 0x00007fff68ad3630 libsystem_pthread.dylib`_pthread_wqthread + 446
    frame #2: 0x00007fff68ad3405 libsystem_pthread.dylib`start_wqthread + 13
  thread #7
    frame #0: 0x00007fff68a215aa libsystem_kernel.dylib`__select + 10
    frame #1: 0x0000000100457cad Emacs`-[EmacsApp fd_handler:](self=0x000000010306ea00, _cmd="fd_handler:", unused=0x0000000000000000) at nsterm.m:5851
    frame #2: 0x00007fff3d970104 Foundation`__NSThread__start__ + 1218
    frame #3: 0x00007fff68ad4305 libsystem_pthread.dylib`_pthread_body + 126
    frame #4: 0x00007fff68ad726f libsystem_pthread.dylib`_pthread_start + 70
    frame #5: 0x00007fff68ad3415 libsystem_pthread.dylib`thread_start + 13
  thread #8, name = 'com.apple.NSEventThread'
    frame #0: 0x00007fff68a1a17a libsystem_kernel.dylib`mach_msg_trap + 10
    frame #1: 0x00007fff68a1a6d0 libsystem_kernel.dylib`mach_msg + 60
    frame #2: 0x00007fff3b5f7158 CoreFoundation`__CFRunLoopServiceMachPort + 336
    frame #3: 0x00007fff3b5f66a6 CoreFoundation`__CFRunLoopRun + 1661
    frame #4: 0x00007fff3b5f5dd6 CoreFoundation`CFRunLoopRunSpecific + 467
    frame #5: 0x00007fff38b42f89 AppKit`_NSEventThread + 160
    frame #6: 0x00007fff68ad4305 libsystem_pthread.dylib`_pthread_body + 126
    frame #7: 0x00007fff68ad726f libsystem_pthread.dylib`_pthread_start + 70
    frame #8: 0x00007fff68ad3415 libsystem_pthread.dylib`thread_start + 13


Configured using:
'configure --with-ns --with-modules --with-wide-int --without-makeinfo
--without-sound --without-x --without-dbus --without-gsettings
--without-selinux --without-gconf --without-libotf --without-m17n-flt
--disable-acl --with-file-notification=kqueue
--enable-checking=yes,glyphs --enable-check-lisp-object-type
'CFLAGS=-O0 -g3'
PKG_CONFIG_PATH=/opt/local/lib/pkgconfig:/usr/lib/pkgconfig:'

Configured features:
NOTIFY GNUTLS LIBXML2 ZLIB TOOLKIT_SCROLL_BARS NS MODULES THREADS

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  ivy-mode: t
  global-company-mode: t
  company-mode: t
  dumb-jump-mode: t
  projectile-mode: t
  savehist-mode: t
  show-paren-mode: t
  delete-selection-mode: t
  global-display-line-numbers-mode: t
  display-line-numbers-mode: t
  shell-dirtrack-mode: t
  smooth-scrolling-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
/Users/.emacs.d/elpa/lv-20181110.1740/lv hides /Users/bc/.emacs.d/elpa/hydra-20190213.1849/lv

Features:
(shadow sort mail-extr emacsbug message rmc puny rfc822 mml mml-sec epa
derived epg gnus-util rmail rmail-loaddefs mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mm-util mail-prsvr mail-utils cl-extra help-mode
counsel xdg dired dired-loaddefs swiper ivy colir color ivy-overlay ffap
elec-pair company-oddmuse company-keywords company-etags company-gtags
company-dabbrev-code company-dabbrev company-files company-capf
company-cmake company-xcode company-clang company-semantic company-eclim
company-template company-bbdb company-anaconda company pcase
anaconda-mode url url-proxy url-privacy url-expand url-methods
url-history url-cookie url-domsuf url-util mailcap pythonic python json
map paradox paradox-menu paradox-commit-list hydra lv cus-edit wid-edit
paradox-execute paradox-github paradox-core spinner subr-x dumb-jump
popup f dash s etags xref project tramp-cache tramp-sh projectile grep
compile ibuf-ext ibuffer ibuffer-loaddefs thingatpt savehist paren
delsel display-line-numbers cus-start cus-load dracula-theme rx tramp
tramp-compat tramp-loaddefs trampver shell pcomplete comint ansi-color
ring parse-time format-spec smooth-scrolling advice finder-inf edmacro
kmacro info package easymenu epg-config url-handlers url-parse
auth-source cl-seq eieio eieio-core cl-macs eieio-loaddefs
password-cache url-vars seq byte-opt gv bytecomp byte-compile cconv
cl-loaddefs cl-lib time-date tooltip eldoc electric uniquify ediff-hook
vc-hooks lisp-float-type mwheel term/ns-win ns-win ucs-normalize
mule-util term/common-win tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode elisp-mode lisp-mode
prog-mode register page menu-bar rfn-eshadow isearch timer select
scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame cl-generic cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932
hebrew greek romanian slovak czech european ethiopic indian cyrillic
chinese composite charscript charprop case-table epa-hook jka-cmpr-hook
help simple abbrev obarray minibuffer cl-preloaded nadvice loaddefs
button faces cus-face macroexp files text-properties overlay sha1 md5
base64 format env code-pages mule custom widget hashtable-print-readable
backquote threads kqueue cocoa ns multi-tty make-network-process emacs)

Memory information:
((conses 16 329036 10859)
(symbols 48 31676 1)
(miscs 40 64 197)
(strings 32 72037 1681)
(string-bytes 1 2045007)
(vectors 16 51624)
(vector-slots 8 894652 12280)
(floats 8 263 209)
(intervals 56 662 16)
(buffers 992 11))

[-- Attachment #2: Type: text/html, Size: 56154 bytes --]

bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

[Caroptions Caroptions]

[-- Attachment #1: Type: text/plain, Size: 1304 bytes --]

The bug reproduced on any compiled emacs.

26.1.92 has it, latest master branch has it... Do not understand why nobody else hit it as yet ..

I think the problem somehow related to NSAutoreleasePool and pthreads : https://kenji.sx/posts/nsautoreleasepooldebian

Thanks,
Caroptions

________________________________
From: GNU bug Tracking System <help-debbugs@gnu.org>
Sent: Tuesday, March 5, 2019 1:17 PM
To: Caroptions Caroptions
Subject: bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

Thank you for filing a new bug report with debbugs.gnu.org.

This is an automatically generated reply to let you know your message
has been received.

Your message is being forwarded to the package maintainers and other
interested parties for their attention; they will reply in due course.

Your message has been sent to the package maintainer(s):
 bug-gnu-emacs@gnu.org

If you wish to submit further information on this problem, please
send it to 34762@debbugs.gnu.org.

Please do not send mail to help-debbugs@gnu.org unless you wish
to report a problem with the Bug-tracking system.

--
34762: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=34762
GNU Bug Tracking System
Contact help-debbugs@gnu.org with problems

[-- Attachment #2: Type: text/html, Size: 4148 bytes --]

bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

[Alan Third]

On Fri, Mar 15, 2019 at 08:55:49PM +0000, Caroptions Caroptions wrote:
> The bug reproduced on any compiled emacs.
> 
> 26.1.92 has it, latest master branch has it... Do not understand why
> nobody else hit it as yet ..
> 
> I think the problem somehow related to NSAutoreleasePool and
> pthreads : https://kenji.sx/posts/nsautoreleasepooldebian

Hi, thanks for reporting this. I didn’t get the previous email for
some reason, so I missed it.

This is an odd one. I don’t think it has anything to do with pthreads,
but I don’t really understand what’s going on. My best guess is that
somehow the autorelease pools are being drained out of order. I don’t
know why using tramp would cause that to happen.

One solution would be to remove the pool from ns_update_menubar
completely, but I assume it’s there for a good reason.
-- 
Alan Third

bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

[Caroptions Caroptions]

[-- Attachment #1: Type: text/plain, Size: 2731 bytes --]

Thank you for coming back on this! I agree it is very odd, otherwise many people would experience it..

What I did, I have commented out:


  /* set main menu */

  if (needsSet)

    [NSApp setMainMenu: menu];


  // [pool release];

  unblock_input ();


}

as expected it start working fine, but not sure if it leads to memory leak ..

Also If run debug in Xcode and do step by step debugging Emacs hang this call:



          /* FIXME: we'd like to only parse the needed submenu, but this

               was causing crashes in the _common parsing code.. need to make

               sure proper initialization done.. */

/*        if (submenu && strcmp ([[submenu title] UTF8String], SSDATA (string)))

             continue; */


  submenu_start[i] = menu_items_used;


  menu_items_n_panes = 0;

  *hang*--> submenu_top_level_items[i] = parse_single_submenu (key, string, maps);

  submenu_n_panes[i] = menu_items_n_panes;

  submenu_end[i] = menu_items_used;

          n++;


  1.  In my understanding TRAMP to work with remote files starts separate thread and this thread prematurely release pool.
  2.  Another "theory" remote operations is naturally longer and file read/write much longer after 64 encode/decode, network transfer, opening local temp file and this lead to race conditions?
  3.  Or tramp include new menu item, which outside of standard event loop?

Anyway I am ready to troubleshoot and apply any patches/check code if needed.

Thanks,
Caroptions


________________________________
From: Alan Third <athird@googlemail.com> on behalf of Alan Third <alan@idiocy.org>
Sent: Monday, March 18, 2019 5:09 AM
To: Caroptions Caroptions
Cc: 34762@debbugs.gnu.org
Subject: Re: bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

On Fri, Mar 15, 2019 at 08:55:49PM +0000, Caroptions Caroptions wrote:
> The bug reproduced on any compiled emacs.
>
> 26.1.92 has it, latest master branch has it... Do not understand why
> nobody else hit it as yet ..
>
> I think the problem somehow related to NSAutoreleasePool and
> pthreads : https://kenji.sx/posts/nsautoreleasepooldebian

Hi, thanks for reporting this. I didn’t get the previous email for
some reason, so I missed it.

This is an odd one. I don’t think it has anything to do with pthreads,
but I don’t really understand what’s going on. My best guess is that
somehow the autorelease pools are being drained out of order. I don’t
know why using tramp would cause that to happen.

One solution would be to remove the pool from ns_update_menubar
completely, but I assume it’s there for a good reason.
--
Alan Third

[-- Attachment #2: Type: text/html, Size: 10586 bytes --]

bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

[Fan Yang]

I met this bug too.  I triggered this bug when I was clicking an YASnippet menu while editing a remove (TRAMP) file via scp.

Information:

- Emacs: at commit 9ee5af315098245d9f58eb5562dca6997cab4426 Dec 14, 2019.  Built by “./configure CPPFLAGS="-I/usr/local/opt/libxml2/include/libxml2/" LDFLAGS="-L/usr/local/opt/libxml2/lib" --with-ns && make && make install”
- macOS Catalina 10.15.2

Backtrace:

(lldb) target create "/Applications/Emacs.app/Contents/MacOS/Emacs"
Current executable set to '/Applications/Emacs.app/Contents/MacOS/Emacs' (x86_64).
(lldb) r
Process 3309 launched: '/Applications/Emacs.app/Contents/MacOS/Emacs' (x86_64)
2019-12-16 15:16:31.392937+0800 Emacs[3309:113095] Failed to initialize color list unarchiver: Error Domain=NSCocoaErrorDomain Code=4864 "*** -[NSKeyedUnarchiver _initForReadingFromData:error:throwLegacyExceptions:]: non-keyed archive cannot be decoded by NSKeyedUnarchiver" UserInfo={NSDebugDescription=*** -[NSKeyedUnarchiver _initForReadingFromData:error:throwLegacyExceptions:]: non-keyed archive cannot be decoded by NSKeyedUnarchiver}
2019-12-16 15:16:31.405997+0800 Emacs[3309:113095] SecTaskLoadEntitlements failed error=22 cs_flags=20, pid=3309
2019-12-16 15:16:31.406126+0800 Emacs[3309:113095] SecTaskCopyDebugDescription: Emacs[3309]/0#-1 LF=0
objc[3309]: Invalid or prematurely-freed autorelease pool 0x1020031e0.
Process 3309 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
    frame #0: 0x00007fff67bb0bea libsystem_kernel.dylib`__abort_with_payload + 10
libsystem_kernel.dylib`__abort_with_payload:
->  0x7fff67bb0bea <+10>: jae    0x7fff67bb0bf4            ; <+20>
    0x7fff67bb0bec <+12>: movq   %rax, %rdi
    0x7fff67bb0bef <+15>: jmp    0x7fff67b91a89            ; cerror_nocancel
    0x7fff67bb0bf4 <+20>: retq   
Target 0: (Emacs) stopped.
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGABRT
  * frame #0: 0x00007fff67bb0bea libsystem_kernel.dylib`__abort_with_payload + 10
    frame #1: 0x00007fff67bb24f3 libsystem_kernel.dylib`abort_with_payload_wrapper_internal + 80
    frame #2: 0x00007fff67bb24a3 libsystem_kernel.dylib`abort_with_reason + 19
    frame #3: 0x00007fff666f2c1b libobjc.A.dylib`_objc_fatalv(unsigned long long, unsigned long long, char const*, __va_list_tag*) + 114
    frame #4: 0x00007fff666f2ba9 libobjc.A.dylib`_objc_fatal(char const*, ...) + 135
    frame #5: 0x00007fff666f3741 libobjc.A.dylib`AutoreleasePoolPage::badPop(void*) + 139
    frame #6: 0x00007fff303b2eb5 CoreFoundation`_CFAutoreleasePoolPop + 22
    frame #7: 0x00007fff32a54e95 Foundation`-[NSAutoreleasePool release] + 129
    frame #8: 0x00000001001e984e Emacs`ns_update_menubar(f=0x0000000102834030, deep_p=<unavailable>, submenu=0x0000000000000000) at nsmenu.m:0 [opt]
    frame #9: 0x00000001001e988e Emacs`ns_activate_menubar(f=<unavailable>) at nsmenu.m:476:3 [opt]
    frame #10: 0x00000001000c7c3e Emacs`read_char at keyboard.c:3910:6 [opt]
    frame #11: 0x00000001000c7500 Emacs`read_char [inlined] read_event_from_main_queue(end_time=0x0000000000000000, local_getcjmp=0x0000000103a154a0, used_mouse_menu=0x00007ffeefbff47b) at keyboard.c:2151 [opt]
    frame #12: 0x00000001000c73de Emacs`read_char at keyboard.c:2215 [opt]
    frame #13: 0x00000001000c73de Emacs`read_char(commandflag=1, map=0x0000000102aa65a3, prev_event=0x0000000000000000, used_mouse_menu=0x00007ffeefbff47b, end_time=0x0000000000000000) at keyboard.c:2825 [opt]
    frame #14: 0x00000001000c3e1a Emacs`read_key_sequence(keybuf=<unavailable>, prompt=0x0000000000000000, dont_downcase_last=<unavailable>, can_return_switch_frame=<unavailable>, fix_current_buffer=<unavailable>, prevent_redisplay=<unavailable>) at keyboard.c:9536:12 [opt]
    frame #15: 0x00000001000c261c Emacs`command_loop_1 at keyboard.c:1345:15 [opt]
    frame #16: 0x00000001001493b7 Emacs`internal_condition_case(bfun=(Emacs`command_loop_1 at keyboard.c:1236), handlers=0x0000000000000090, hfun=(Emacs`cmd_error at keyboard.c:919)) at eval.c:1355:25 [opt]
    frame #17: 0x00000001000d26d0 Emacs`command_loop_2(ignore=<unavailable>) at keyboard.c:1091:11 [opt]
    frame #18: 0x0000000100148bcb Emacs`internal_catch(tag=0x000000000000c4b0, func=(Emacs`command_loop_2 at keyboard.c:1087), arg=0x0000000000000000) at eval.c:1116:25 [opt]
    frame #19: 0x00000001002071d5 Emacs`command_loop.cold.1 + 69
    frame #20: 0x00000001000c1703 Emacs`command_loop at keyboard.c:1069:2 [opt]
    frame #21: 0x00000001000c1633 Emacs`recursive_edit_1 at keyboard.c:714:9 [opt]
    frame #22: 0x00000001000c188b Emacs`Frecursive_edit at keyboard.c:786:3 [opt]
    frame #23: 0x00000001000c046c Emacs`main(argc=<unavailable>, argv=0x00007ffeefbff918) at emacs.c:2054:3 [opt]
    frame #24: 0x00007fff67a507fd libdyld.dylib`start + 1
    frame #25: 0x00007fff67a507fd libdyld.dylib`start + 1

bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

[Win Treese]

[-- Attachment #1: Type: text/plain, Size: 2502 bytes --]

[This is the first time I have submitted a patch, so please let me know if I should do something differently.]

This message includes a patch for bug#34762. I think that this is also the problem for bug#26982, previously marked wontfix.

The problem seems to be with the memory management for the EmacsMenu object. Here's what I think is going on with memory management in ns_update_panel:

1. The code sets up an autorelease pool at line 125
2. The only NS object allocated is an EmacsMenu at line 136
3. If that allocation happens, the new object is set as the application main menu at line 455

So the allocated menu object lasts beyond the life of the pool.

The pool seems to be pretty much irrelevant in this particular case. Since the menu is given to the app, and might be deallocated under some circumstances if it's passed back to ns_update_menu, it seems like simply removing the pool code is sufficient without causing a memory leak.

I have attached a patch against Emacs head for it, although the same patch applies to the Emacs 26 code in Aquamacs.

An Aquamacs user provided a test case, with some help from the team that does the poly-R package. I reduced the test case to a standalone piece of elisp that can be loaded. It installs packages for demonstrating the bug, but it does in /tmp so it doesn't interfere with actual configuration.

;; Set up to reproduce a crash in the Mac menu code
;; Load/evaluate this file in Emacs started with -q, then click on the menu bar.
;; This code installs some packages in a temporary user-package-dir.

(if (boundp 'aquamacs-version)
    (setq package-user-dir "/tmp/emacs-bug-test-packages-aquamacs")
  (setq package-user-dir "/tmp/emacs-bug-test-packages"))

(make-directory package-user-dir t)

(setq package-archives '(("melpa-stable" . "https://stable.melpa.org/packages/")
                         ("gnu" . "https://elpa.gnu.org/packages/")))
(package-initialize)
(package-refresh-contents)

(dolist (pkg '(ess poly-R))
  (unless (package-installed-p pkg)
    (package-install pkg)))

(require 'poly-R)
(message "Run 'M-x R', then try clicking on the menu bar")
;; End test code

The crash is immediate when you click on the menu bar, and does not happen with the patch applied. There is some chance of a memory leak if I didn't fully understand the object lifecycles.

This is also tracked as Aquamacs bug #180 on github: https://github.com/aquamacs-emacs/aquamacs-emacs/issues/180

- Win


[-- Attachment #2: 0001-nsmenu.m.patch --]
[-- Type: application/octet-stream, Size: 1859 bytes --]

diff --git a/ChangeLog.3 b/ChangeLog.3
index 1a53011899..5d16bbf66b 100644
--- a/ChangeLog.3
+++ b/ChangeLog.3
@@ -1,3 +1,10 @@
+2020-09-03 Win Treese <treese@acm.org>
+
+	Fix crash from clicking on menu bar (bug#34762, bug#26982).
+
+	* src/nsmenu.m (ns_update_menubar): Remove extraneous use of
+	autorelease pool.
+
 2020-08-03  Phil Sainty  <psainty@orcon.net.nz>
 
 	lisp/so-long.el: Improve support for major mode hooks
diff --git a/src/nsmenu.m b/src/nsmenu.m
index e313fc03f4..a286a80da1 100644
--- a/src/nsmenu.m
+++ b/src/nsmenu.m
@@ -122,7 +122,6 @@
 /*fprintf (stderr, "ns_update_menubar: frame: %p\tdeep: %d\tsub: %p\n", f, deep_p, submenu); */
 
   block_input ();
-  pool = [[NSAutoreleasePool alloc] init];
 
   /* Menu may have been created automatically; if so, discard it.  */
   if ([menu isKindOfClass: [EmacsMenu class]] == NO)
@@ -240,7 +239,6 @@
                   [[submenu title] UTF8String]);
 	  discard_menu_items ();
 	  unbind_to (specpdl_count, Qnil);
-          [pool release];
           unblock_input ();
 	  return;
         }
@@ -298,7 +296,6 @@
               free_menubar_widget_value_tree (first_wv);
               discard_menu_items ();
               unbind_to (specpdl_count, Qnil);
-              [pool release];
               unblock_input ();
               return;
             }
@@ -364,7 +361,6 @@
       if (NILP (items))
         {
           free_menubar_widget_value_tree (first_wv);
-          [pool release];
           unblock_input ();
           return;
         }
@@ -395,7 +391,6 @@
           if (i == n)
             {
               free_menubar_widget_value_tree (first_wv);
-              [pool release];
               unblock_input ();
               return;
             }
@@ -454,7 +449,6 @@
   if (needsSet)
     [NSApp setMainMenu: menu];
 
-  [pool release];
   unblock_input ();
 
 }

[-- Attachment #3: Type: text/plain, Size: 2 bytes --]

bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

[Alan Third]

On Thu, Sep 03, 2020 at 09:44:57PM -0400, Win Treese wrote:
> The pool seems to be pretty much irrelevant in this particular case.
> Since the menu is given to the app, and might be deallocated under
> some circumstances if it's passed back to ns_update_menu, it seems
> like simply removing the pool code is sufficient without causing a
> memory leak.

Hi Win,

Thanks for looking at this. I'm not super clear about how and why the
pools work myself, but I think you're probably right.

Can you please remove the changelog entry (the changelog files are
automatically generated now), and put it in the git commit message
instead, then use 'git format-patch' as described in CONTRIBUTE?

Have you completed the copyright paperwork?
-- 
Alan Third

bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

[Win Treese]

[-- Attachment #1: Type: text/plain, Size: 661 bytes --]


> On Sep 5, 2020, at 4:02 PM, Alan Third <alan@idiocy.org> wrote:
> 
> Thanks for looking at this. I'm not super clear about how and why the
> pools work myself, but I think you're probably right.
> 
> Can you please remove the changelog entry (the changelog files are
> automatically generated now), and put it in the git commit message
> instead, then use 'git format-patch' as described in CONTRIBUTE?
> 
> Have you completed the copyright paperwork?

Sorry, read the wrong info about submitting it!

Here’s a second attempt. Let me know if it’s not quite right.

Yes, I submitted copyright paperwork for Emacs a while back.

- Win


[-- Attachment #2: 0001-Fix-crash-from-clicking-on-menu-bar-bug-34762-bug-26.patch --]
[-- Type: application/octet-stream, Size: 1890 bytes --]

From 35e33ee7b283b831598224f150b9c7a402d28b22 Mon Sep 17 00:00:00 2001
From: Win Treese <treese@acm.org>
Date: Tue, 8 Sep 2020 15:32:15 -0400
Subject: [PATCH] Fix crash from clicking on menu bar (bug#34762, bug#26982).

* src/nsmenu.m (ns_update_menubar): Remove extraneous use of
autorelease pool.
---
 src/nsmenu.m | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/src/nsmenu.m b/src/nsmenu.m
index e313fc03f4..a286a80da1 100644
--- a/src/nsmenu.m
+++ b/src/nsmenu.m
@@ -122,7 +122,6 @@
 /*fprintf (stderr, "ns_update_menubar: frame: %p\tdeep: %d\tsub: %p\n", f, deep_p, submenu); */
 
   block_input ();
-  pool = [[NSAutoreleasePool alloc] init];
 
   /* Menu may have been created automatically; if so, discard it.  */
   if ([menu isKindOfClass: [EmacsMenu class]] == NO)
@@ -240,7 +239,6 @@
                   [[submenu title] UTF8String]);
 	  discard_menu_items ();
 	  unbind_to (specpdl_count, Qnil);
-          [pool release];
           unblock_input ();
 	  return;
         }
@@ -298,7 +296,6 @@
               free_menubar_widget_value_tree (first_wv);
               discard_menu_items ();
               unbind_to (specpdl_count, Qnil);
-              [pool release];
               unblock_input ();
               return;
             }
@@ -364,7 +361,6 @@
       if (NILP (items))
         {
           free_menubar_widget_value_tree (first_wv);
-          [pool release];
           unblock_input ();
           return;
         }
@@ -395,7 +391,6 @@
           if (i == n)
             {
               free_menubar_widget_value_tree (first_wv);
-              [pool release];
               unblock_input ();
               return;
             }
@@ -454,7 +449,6 @@
   if (needsSet)
     [NSApp setMainMenu: menu];
 
-  [pool release];
   unblock_input ();
 
 }
-- 
2.21.1 (Apple Git-122.3)

bug#34762: Acknowledgement (26.1.92; objc[27300]: Invalid or prematurely-freed autorelease pool 0x1040021e0.)

[Alan Third]

On Tue, Sep 08, 2020 at 03:38:08PM -0400, Win Treese wrote:
> Here’s a second attempt. Let me know if it’s not quite right.

The only thing is a bit funny. The first line of the commit message
shouldn't end in a full stop (period). I've fixed it and pushed it to
master, so I think we can close this bug report.

Thank you!

-- 
Alan Third