bug#11984: 24.1; segfault while deleting a window

bug#11984: 24.1; segfault while deleting a window

[Russell Sim]

Hi,

So I recently started playing around with the python-mode test cases and
during the batch mode execution I seem to be able to induce a segfault
every time.  I'm running a build of the emacs24.1 tag from the git
repository, the ref is d2ba302127b8dac9b3e02db5c403293982e60e84.


This isn't strictly run with -Q because there are a bunch of tests that
are loaded but it is a consistent case and I can easily gather more
information if needed.  Here is the core dump from one of the crashes
http://russellsim.org/emacs-24.d2ba302.core I made it with debug enabled
if you would like any more info i would be glad to provide it.

Cheers,
Russell



#0  0x000000000048c435 in Fdelete_other_windows_internal (window=24353749, root=24387925) at window.c:2649
#1  0x0000000000602831 in Ffuncall (nargs=3, args=0x7ffffffe3e30) at eval.c:3005
#2  0x000000000064dc18 in exec_byte_code (bytestr=9704177, vector=9704229, maxdepth=20, args_template=12726818, nargs=0, args=0x0) at bytecode.c:785
#3  0x000000000064d183 in Fbyte_code (bytestr=9704177, vector=9704229, maxdepth=20) at bytecode.c:423
#4  0x00000000006011ef in eval_sub (form=9704150) at eval.c:2356
#5  0x00000000005fee2b in internal_catch (tag=13220914, func=0x600b55 <eval_sub>, arg=9704150) at eval.c:1272
#6  0x000000000064e877 in exec_byte_code (bytestr=9703985, vector=9704021, maxdepth=16, args_template=12726818, nargs=0, args=0x0) at bytecode.c:966
#7  0x0000000000603231 in funcall_lambda (fun=9703925, nargs=0, arg_vector=0x7ffffffe48f0) at eval.c:3233
#8  0x0000000000602d38 in apply_lambda (fun=9703925, args=12726818) at eval.c:3110
#9  0x00000000006013b4 in eval_sub (form=22167222) at eval.c:2395
#10 0x00000000005fd383 in Fprogn (args=24543862) at eval.c:364
#11 0x00000000005fea78 in Flet (args=24543814) at eval.c:1120
#12 0x0000000000600eae in eval_sub (form=24543798) at eval.c:2298
#13 0x0000000000601488 in eval_sub (form=23627398) at eval.c:2411
#14 0x00000000005fd383 in Fprogn (args=23627494) at eval.c:364
#15 0x00000000005fea78 in Flet (args=23627382) at eval.c:1120
#16 0x0000000000600eae in eval_sub (form=23627318) at eval.c:2298
#17 0x00000000005fd383 in Fprogn (args=23627510) at eval.c:364
#18 0x00000000006031cc in funcall_lambda (fun=23627526, nargs=1, arg_vector=0x7ffffffe53d8) at eval.c:3226
#19 0x0000000000602acd in Ffuncall (nargs=2, args=0x7ffffffe53d0) at eval.c:3063
#20 0x00000000005fcaa6 in Fcall_interactively (function=22507826, record_flag=12726818, keys=12773141) at callint.c:852
#21 0x0000000000602860 in Ffuncall (nargs=4, args=0x7ffffffe56f0) at eval.c:3009
#22 0x0000000000602066 in call3 (fn=12867138, arg1=22507826, arg2=12726818, arg3=12726818) at eval.c:2802
#23 0x00000000005767d7 in Fcommand_execute (cmd=22507826, record_flag=12726818, keys=12726818, special=12726818) at keyboard.c:10330
#24 0x0000000000602893 in Ffuncall (nargs=2, args=0x7ffffffe5910) at eval.c:3013
#25 0x000000000064dc18 in exec_byte_code (bytestr=9958345, vector=9958381, maxdepth=88, args_template=1028, nargs=1, args=0x7ffffffe5e10) at bytecode.c:785
#26 0x0000000000602f5b in funcall_lambda (fun=9958293, nargs=1, arg_vector=0x7ffffffe5e08) at eval.c:3167
#27 0x0000000000602a19 in Ffuncall (nargs=2, args=0x7ffffffe5e00) at eval.c:3051
#28 0x000000000064dc18 in exec_byte_code (bytestr=9934113, vector=9934149, maxdepth=72, args_template=0, nargs=0, args=0x7ffffffe6350) at bytecode.c:785
#29 0x0000000000602f5b in funcall_lambda (fun=9934061, nargs=0, arg_vector=0x7ffffffe6350) at eval.c:3167
#30 0x0000000000602a19 in Ffuncall (nargs=1, args=0x7ffffffe6348) at eval.c:3051
#31 0x000000000064dc18 in exec_byte_code (bytestr=9928657, vector=9928693, maxdepth=32, args_template=0, nargs=0, args=0x7ffffffe6780) at bytecode.c:785
#32 0x0000000000602f5b in funcall_lambda (fun=9928605, nargs=0, arg_vector=0x7ffffffe6780) at eval.c:3167
#33 0x0000000000602d38 in apply_lambda (fun=9928605, args=12726818) at eval.c:3110
#34 0x00000000006013b4 in eval_sub (form=13141254) at eval.c:2395
#35 0x0000000000600b43 in Feval (form=13141254, lexical=12726818) at eval.c:2204
#36 0x0000000000563b51 in top_level_2 () at keyboard.c:1169
#37 0x00000000005ff4a1 in internal_condition_case (bfun=0x563b34 <top_level_2>, handlers=12779106, hfun=0x563710 <cmd_error>) at eval.c:1515
#38 0x0000000000563b8b in top_level_1 (ignore=12726818) at keyboard.c:1177
#39 0x00000000005fee2b in internal_catch (tag=12774850, func=0x563b53 <top_level_1>, arg=12726818) at eval.c:1272
#40 0x0000000000563aaf in command_loop () at keyboard.c:1132
#41 0x0000000000563254 in recursive_edit_1 () at keyboard.c:759
#42 0x00000000005633f7 in Frecursive_edit () at keyboard.c:823
#43 0x0000000000561494 in main (argc=1739, argv=0x7ffffffe71a8) at emacs.c:1715


In GNU Emacs 24.1.1 (x86_64-unknown-linux-gnu, GTK+ Version 2.24.10)
 of 2012-07-18 on marvin
Windowing system distributor `The X.Org Foundation', version 11.0.11104000
Configured using:
 `configure 'CFLAGS=-ggdb3 -O0' 'CXXFLAGS=-ggdb3 -O0' 'LDFLAGS=-ggdb3''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_AU.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Comint

Minor modes in effect:
  shell-dirtrack-mode: t
  compilation-shell-minor-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x r e p <tab> o r t <tab> <return>

Recent messages:
Saving file /home/russell/tmp/classblah.py...
Wrote /home/russell/tmp/classblah.py
Can't find completion for "CLASS_INS.someDe"
Scanning for dabbrevs...done
Expansion found in 'classblah.py'
pycomplete-same-folder-class-lp:889052-test passed
python-shell-complete-test passed
usr-bin-python2.7-shell-complete-test passed
progn: Wrong type argument: char-or-string-p, nil
Making completion list...

Load-path shadows:
None found.

Features:
(shadow sort gnus-util mail-extr emacsbug message byte-opt format-spec
rfc822 mml mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045 ietf-drums
mm-util mail-prsvr mail-utils help-mode view vc-git thingatpt dabbrev
noutline outline py-shell-completion-tests python-extended-executes-test
python-mode-test py-bug-numbered-tests pycomplete python-mode easymenu
easy-mmode edmacro kmacro imenu flymake rx shell pcomplete compile
skeleton bytecomp byte-compile cconv macroexp comint derived ansi-color
ring cl cc-cmds cc-engine cc-vars cc-defs regexp-opt cc-bytecomp pymacs
advice help-fns advice-preload time-date tooltip ediff-hook vc-hooks
lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image fringe
lisp-mode register page menu-bar rfn-eshadow timer select scroll-bar
mouse jit-lock font-lock syntax facemenu font-core frame cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev
minibuffer loaddefs button faces cus-face files text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process dbusbind
dynamic-setting system-font-setting font-render-setting move-toolbar gtk
x-toolkit x multi-tty emacs)

bug#11984: 24.1; segfault while deleting a window

[Eli Zaretskii]

> From: Russell Sim <russell.sim@gmail.com>
> Date: Thu, 19 Jul 2012 08:08:32 +1000
> 
> So I recently started playing around with the python-mode test cases and
> during the batch mode execution I seem to be able to induce a segfault
> every time.  I'm running a build of the emacs24.1 tag from the git
> repository, the ref is d2ba302127b8dac9b3e02db5c403293982e60e84.
> 
> 
> This isn't strictly run with -Q because there are a bunch of tests that
> are loaded but it is a consistent case and I can easily gather more
> information if needed.  Here is the core dump from one of the crashes
> http://russellsim.org/emacs-24.d2ba302.core I made it with debug enabled
> if you would like any more info i would be glad to provide it.
> 
> Cheers,
> Russell
> 
> 
> 
> #0  0x000000000048c435 in Fdelete_other_windows_internal (window=24353749, root=24387925) at window.c:2649
> #1  0x0000000000602831 in Ffuncall (nargs=3, args=0x7ffffffe3e30) at eval.c:3005

Please see if this isn't a duplicate of #11677.

bug#11984: 24.1; segfault while deleting a window

[Chong Yidong]

Eli Zaretskii <eliz@gnu.org> writes:

> Please see if this isn't a duplicate of #11677.

I think the fix for 11677 doesn't go far enough.  I can still produce a
crash on trunk by calling delete-other-windows-internal for a window on
a dead frame:

M-: (setq w (selected-window)) RET
M-: (setq f (selected-frame)) RET
C-x 5 2
M-: (delete-frame f) RET
M-: (delete-other-windows-internal w) RET
Fatal error (11)Segmentation fault (core dumped)

There's a similar problem with window-absolute-pixel-edges.

I committed a fix to the emacs-24 branch adding CHECK_LIVE_FRAME calls
to those two functions (patch below).  But for long-term safety, I think
decode_any_windows had better signal an error if the window's frame
isn't live.  But I'm not sure if there's any subtle reliance in existing
code on allowing window functions to be called for windows on dead
frames---anyone know?


*** src/ChangeLog	2012-07-14 10:46:56 +0000
--- src/ChangeLog	2012-07-19 03:33:08 +0000
***************
*** 1,3 ****
--- 1,9 ----
+ 2012-07-19  Chong Yidong  <cyd@gnu.org>
+ 
+ 	* window.c (Fwindow_absolute_pixel_edges)
+ 	(Fdelete_other_windows_internal): Signal an error if the window is
+ 	on a dead frame (Bug#11984).
+ 
  2012-07-14  Eli Zaretskii  <eliz@gnu.org>
  
  	Remove FILE_SYSTEM_CASE.

=== modified file 'src/window.c'
*** src/window.c	2012-04-23 16:22:23 +0000
--- src/window.c	2012-07-19 03:33:08 +0000
***************
*** 484,492 ****
    (Lisp_Object window, Lisp_Object limit)
  {
    register struct window *w = decode_any_window (window);
- 
    w->combination_limit = limit;
- 
    return w->combination_limit;
  }
  
--- 484,490 ----
***************
*** 800,805 ****
--- 798,805 ----
  {
    register struct window *w = decode_any_window (window);
    int add_x, add_y;
+ 
+   CHECK_LIVE_FRAME (w->frame);
    calc_absolute_offset (w, &add_x, &add_y);
  
    return Fcons (make_number (WINDOW_LEFT_EDGE_X (w) + add_x),
***************
*** 2568,2573 ****
--- 2568,2574 ----
    Mouse_HLInfo *hlinfo;
  
    w = decode_any_window (window);
+   CHECK_LIVE_FRAME (w->frame);
    XSETWINDOW (window, w);
    f = XFRAME (w->frame);
  
***************
*** 2581,2586 ****
--- 2582,2588 ----
      /* ROOT must be an ancestor of WINDOW.  */
      {
        r = decode_any_window (root);
+       CHECK_LIVE_FRAME (r->frame);
        pwindow = XWINDOW (window)->parent;
        while (!NILP (pwindow))
  	if (EQ (pwindow, root))

bug#11984: 24.1; segfault while deleting a window

[martin rudalics]

 > But for long-term safety, I think
 > decode_any_windows had better signal an error if the window's frame
 > isn't live.  But I'm not sure if there's any subtle reliance in existing
 > code on allowing window functions to be called for windows on dead
 > frames---anyone know?

Maybe the best way to find out is to install such a change?

martin

bug#11984: 24.1; segfault while deleting a window

[Russell Sim]

Chong Yidong <cyd@gnu.org> writes:

> Eli Zaretskii <eliz@gnu.org> writes:
>
>> Please see if this isn't a duplicate of #11677.
>
> I think the fix for 11677 doesn't go far enough.  I can still produce a
> crash on trunk by calling delete-other-windows-internal for a window on
> a dead frame:
>
> M-: (setq w (selected-window)) RET
> M-: (setq f (selected-frame)) RET
> C-x 5 2
> M-: (delete-frame f) RET
> M-: (delete-other-windows-internal w) RET
> Fatal error (11)Segmentation fault (core dumped)
>
> There's a similar problem with window-absolute-pixel-edges.
>
> I committed a fix to the emacs-24 branch adding CHECK_LIVE_FRAME calls
> to those two functions (patch below).  But for long-term safety, I think
> decode_any_windows had better signal an error if the window's frame
> isn't live.  But I'm not sure if there's any subtle reliance in existing
> code on allowing window functions to be called for windows on dead
> frames---anyone know?

Thanks for the champion effort, but I can still create the bug on
emacs-24 3770cb4 which includes Chongs patch.

Here is a full backtrace, and another core
http://russellsim.org/emacs-24.3770cb4.core

Cheers,
Russell


#0  0x000000000048c56f in Fdelete_other_windows_internal (window=23377989, root=24273109) at window.c:2651
        w = 0x164b840
        r = 0x17260d0
        s = 0xc59212
        f = 0xc390d0
        sibling = 812
        pwindow = 23377989
        swindow = 13333010
        delta = 12726818
        startpos = 1
        top = 4
        new_top = 32767
        resize_failed = -115344
        hlinfo = 0xc23222
#1  0x00000000006029a1 in Ffuncall (nargs=3, args=0x7ffffffe3e30) at eval.c:3005
        fun = 9345349
        original_fun = 12950978
        funcar = 103079215107
        numargs = 2
        lisp_numargs = 12782626
        val = 12726818
        backtrace = {next = 0x7ffffffe42e0, function = 0x7ffffffe3e30, args = 0x7ffffffe3e38, nargs = 2, debug_on_exit = 0}
        internal_args = 0x7ffffffe3e38
        i = 12726818
#2  0x000000000064dd88 in exec_byte_code (bytestr=9699617, vector=9699669, maxdepth=20, args_template=12726818, nargs=0, args=0x0) at bytecode.c:785
        count = 25
        op = 2
        vectorp = 0x940160
        stack = {pc = 0xb6f0b9 "\210\323\r!\210\324\r!\210Շ", byte_string = 9699617, byte_string_start = 0xb6f058 "\b\204U", constants = 9699669, next = 0x7ffffffe4540}
        top = 0x7ffffffe3e30
        result = 140737488241984
#3  0x000000000064d2f3 in Fbyte_code (bytestr=9699617, vector=9699669, maxdepth=20) at bytecode.c:423
No locals.
#4  0x000000000060135f in eval_sub (form=9699590) at eval.c:2356
        numargs = 12
        args_left = 12726818
        i = 3
        maxargs = 3
        argvals = {9699617, 9699669, 20, 140737488241376, 140737488241384, 1, 140737488241296, 5816636}
        fun = 12107941
        val = 12816597
        original_fun = 12866754
        original_args = 9699606
        funcar = 5815311
        backtrace = {next = 0x7ffffffe4a80, function = 0x7ffffffe4310, args = 0x7ffffffe4240, nargs = 3, debug_on_exit = 0}
        gcpro1 = {next = 0x7ffffffe4310, var = 0x60212c, nvars = 12864482}
        gcpro2 = {next = 0xc23222, var = 0xc23222, nvars = 12726818}
        gcpro3 = {next = 0x1, var = 0x7ffffffe4240, nvars = 3}
#5  0x00000000005fef9b in internal_catch (tag=13220914, func=0x600cc5 <eval_sub>, arg=9699590) at eval.c:1272
        c = {tag = 13220914, val = 12726818, next = 0x7ffffffe6a50, gcpro = 0x0, jmp = {{__jmpbuf = {140737488242928, -6975756009278694919, 140737488242928, 140737488243584, 0, 0, -6975756009104631303, 
                6975756540123650553}, __mask_was_saved = 0, __saved_mask = {__val = {6302601, 140737488241872, 16, 12726818, 94489280514, 140737488241872, 2, 140737488243328, 140737488241872, 140737488241880, 
                  1, 24501732, 12769218, 12726818, 13453714, 1}}}}, backlist = 0x7ffffffe4a80, handlerlist = 0x7ffffffe6a20, lisp_eval_depth = 10, pdlcount = 25, poll_suppress_count = 1, 
          interrupt_input_blocked = 0, byte_stack = 0x7ffffffe4540}
#6  0x000000000064e9e7 in exec_byte_code (bytestr=9699425, vector=9699461, maxdepth=16, args_template=12726818, nargs=0, args=0x0) at bytecode.c:966
        v1 = 9699590
        count = 20
        op = 141
        vectorp = 0x940090
        stack = {pc = 0xb6f0e2 "-\207", byte_string = 9699425, byte_string_start = 0xb6f0c5 "\306\b!\020\307\b!\031\310\b\311\"\032\310\b\303\"\033ʉ\034\035\313\t!\210\314͍-\207", constants = 9699461, 
          next = 0x7ffffffe59a0}
        top = 0x7ffffffe44d0
        result = 9465332
#7  0x00000000006033a1 in funcall_lambda (fun=9699365, nargs=0, arg_vector=0x7ffffffe48f0) at eval.c:3233
        val = 24501733
        syms_left = 12726818
        next = 12782626
        lexenv = 12726818
        count = 19
        i = 0
        optional = 1
        rest = 0
#8  0x0000000000602ea8 in apply_lambda (fun=9699365, args=12726818) at eval.c:3110
        args_left = 12726818
        i = 0
        numargs = 0
        arg_vector = 0x7ffffffe48f0
        gcpro1 = {next = 0x7ffffffe49b0, var = 0x5fd422, nvars = 0}
        gcpro2 = {next = 0xc40d72, var = 0xc23222, nvars = 12726818}
        gcpro3 = {next = 0x7ffffffe49b0, var = 0xc23222, nvars = 9469820}
        tem = 24501733
        sa_count = 19
        sa_must_free = 0
#9  0x0000000000601524 in eval_sub (form=22141830) at eval.c:2395
        fun = 9699365
        val = 24501733
        original_fun = 13582674
        original_args = 12726818
        funcar = 4307814658
        backtrace = {next = 0x7ffffffe4d50, function = 0x7ffffffe4ab0, args = 0x7ffffffe48f0, nargs = 0, debug_on_exit = 0}
        gcpro1 = {next = 0xc23222, var = 0x7ffffffe4b80, nvars = 140737488243344}
        gcpro2 = {next = 0x16e1ee0, var = 0xbfbf10, nvars = 83}
        gcpro3 = {next = 0xbfbf10, var = 0xc23252, nvars = 2}
#10 0x00000000005fd4f3 in Fprogn (args=24304358) at eval.c:364
        val = 24501733
        gcpro1 = {next = 0x14ca9d2, var = 0xc23222, nvars = 0}
#11 0x00000000005febe8 in Flet (args=24304310) at eval.c:1120
        temps = 0x7ffffffe4b80
        tem = 12726818
        lexenv = 12726818
        elt = 19830738
        varlist = 12726818
        count = 11
        argnum = 8
        gcpro1 = {next = 0xc23222, var = 0x172daa6, nvars = 140737488243824}
        gcpro2 = {next = 0xc23222, var = 0x100000000, nvars = 8}
        sa_count = 11
        sa_must_free = 0
#12 0x000000000060101e in eval_sub (form=24304294) at eval.c:2298
        numargs = 48
        args_left = 24304310
        i = 23618246
        maxargs = 12726818
        argvals = {24304294, 22139094, 23038731, 140737488243936, 140737488244112, 6298491, 22139094, 23618230}
        fun = 12098237
        val = 2
        original_fun = 12849106
        original_args = 24304310
        funcar = 12726818
        backtrace = {next = 0x7ffffffe4ec0, function = 0x7ffffffe4d80, args = 0x7ffffffe4d78, nargs = -1, debug_on_exit = 0}
        gcpro1 = {next = 0x12c, var = 0x602d3a, nvars = 4}
        gcpro2 = {next = 0x7ffffffe4df0, var = 0x10, nvars = 140737488244144}
        gcpro3 = {next = 0xc860c2, var = 0x14caa02, nvars = 140737488244112}
#13 0x00000000006015f8 in eval_sub (form=23618198) at eval.c:2411
        fun = 22139110
        val = 21801474
        original_fun = 21801378
        original_args = 23618246
        funcar = 12847362
        backtrace = {next = 0x7ffffffe5160, function = 0x7ffffffe4ef0, args = 0x7ffffffe4ee8, nargs = -1, debug_on_exit = 0}
        gcpro1 = {next = 0x7ffffffe4ed0, var = 0x123b6a6, nvars = 19886944}
        gcpro2 = {next = 0x7ffffffe4ff0, var = 0x60101e, nvars = 0}
        gcpro3 = {next = 0x10, var = 0x168cae1, nvars = 140737488253344}
#14 0x00000000005fd4f3 in Fprogn (args=23618294) at eval.c:364
        val = 12726818
        gcpro1 = {next = 0x7ffffffe4e40, var = 0xc23222, nvars = 23596737}
#15 0x00000000005febe8 in Flet (args=23618182) at eval.c:1120
        temps = 0x7ffffffe4fc0
        tem = 23644897
        lexenv = 12726818
        elt = 23618134
        varlist = 12726818
        count = 10
        argnum = 1
        gcpro1 = {next = 0xc23222, var = 0xc1e0d6, nvars = 23487648}
        gcpro2 = {next = 0x7ffffffe5040, var = 0x5fd4f3, nvars = 1}
        sa_count = 10
        sa_must_free = 0
#16 0x000000000060101e in eval_sub (form=23618118) at eval.c:2298
        numargs = 8
        args_left = 23618182
        i = 12726818
        maxargs = 12778914
        argvals = {1040, 4294967298, 140737263341256, 4294967297, 140737488241632, 20, 3, 3}
        fun = 12098237
        val = 12726818
        original_fun = 12849106
        original_args = 23618182
        funcar = 6097238
        backtrace = {next = 0x7ffffffe5300, function = 0x7ffffffe5190, args = 0x7ffffffe5188, nargs = -1, debug_on_exit = 0}
        gcpro1 = {next = 0x7ffffffe5190, var = 0x5d, nvars = 45}
        gcpro2 = {next = 0x7ffffffe71a0, var = 0x0, nvars = 0}
        gcpro3 = {next = 0x17b3b00, var = 0x7ffffffe57d0, nvars = 140737263341152}
#17 0x00000000005fd4f3 in Fprogn (args=23618310) at eval.c:364
        val = 12726818
        gcpro1 = {next = 0xbfbe50, var = 0x1, nvars = 14170053}
#18 0x000000000060333c in funcall_lambda (fun=23618326, nargs=1, arg_vector=0x7ffffffe53d8) at eval.c:3226
        val = 6187332
        syms_left = 12726818
        next = 22878050
        lexenv = 12726818
        count = 8
        i = 1
        optional = 1
        rest = 0
#19 0x0000000000602c3d in Ffuncall (nargs=2, args=0x7ffffffe53d0) at eval.c:3063
        fun = 23618326
        original_fun = 22815506
        funcar = 12778914
        numargs = 1
        lisp_numargs = 12726818
        val = 0
        backtrace = {next = 0x7ffffffe5650, function = 0x7ffffffe53d0, args = 0x7ffffffe53d8, nargs = 1, debug_on_exit = 0}
        internal_args = 0x7ffffffe53d8
        i = 5650438
#20 0x00000000005fcc16 in Fcall_interactively (function=22815506, record_flag=12726818, keys=12773141) at callint.c:852
        val = 140737488246352
        args = 0x7ffffffe53d0
        visargs = 0x7ffffffe53b0
        specs = 23644801
        filter_specs = 23644801
        teml = 3
        up_event = 12726818
        enable = 12726818
        speccount = 6
        next_event = 0
        prefix_arg = 12726818
        string = 0x7ffffffe53f0 "p"
        tem = 0x6b49cc ""
        varies = 0x7ffffffe5390 ""
        i = 2
        nargs = 2
        foo = 0
        arg_from_tty = 0
        gcpro1 = {next = 0x18, var = 0x16693d0, nvars = 140737488246000}
        gcpro2 = {next = 0x1669588, var = 0xc2fda2, nvars = 0}
        gcpro3 = {next = 0x7ffffffe5d80, var = 0x9, nvars = 2}
        gcpro4 = {next = 0x7ffffffe54e0, var = 0x5e2ae8, nvars = 2}
        gcpro5 = {next = 0x7ffffffe54e0, var = 0x602c3d, nvars = 256}
        key_count = 0
        record_then_fail = 0
        save_this_command = 12726818
        save_last_command = 12726818
        save_this_original_command = 12726818
        save_real_this_command = 12726818
#21 0x00000000006029d0 in Ffuncall (nargs=4, args=0x7ffffffe56f0) at eval.c:3009
        fun = 12097229
        original_fun = 12867138
        funcar = 15073441
        numargs = 3
        lisp_numargs = 140737488246704
        val = 0
        backtrace = {next = 0x7ffffffe5820, function = 0x7ffffffe56f0, args = 0x7ffffffe56f8, nargs = 3, debug_on_exit = 0}
        internal_args = 0x7ffffffe56f8
        i = 140737488253344
#22 0x00000000006021d6 in call3 (fn=12867138, arg1=22815506, arg2=12726818, arg3=12726818) at eval.c:2802
        ret_ungc_val = 140737488246736
        gcpro1 = {next = 0x7ffffffe5730, var = 0x1686316, nvars = 4}
        args = {12867138, 22815506, 12726818, 12726818}
#23 0x0000000000576933 in Fcommand_execute (cmd=22815506, record_flag=12726818, keys=12726818, special=12726818) at keyboard.c:10330
        final = 23618326
        tem = 12778914
        prefixarg = 12726818
#24 0x0000000000602a03 in Ffuncall (nargs=2, args=0x7ffffffe5910) at eval.c:3013
        fun = 9363453
        original_fun = 12774274
        funcar = 9955025
        numargs = 1
        lisp_numargs = 140737488246928
        val = 12726866
        backtrace = {next = 0x7ffffffe5d80, function = 0x7ffffffe5910, args = 0x7ffffffe5918, nargs = 1, debug_on_exit = 0}
        internal_args = 0x7ffffffe57d0
        i = 4
#25 0x000000000064dd88 in exec_byte_code (bytestr=9953465, vector=9953501, maxdepth=88, args_template=1028, nargs=1, args=0x7ffffffe5e10) at bytecode.c:785
        count = 4
        op = 1
        vectorp = 0x97e0e8
        stack = {
          pc = 0xb5ae54 "\210\202\201\003\006\b \210\202\201\003\016A❃V\001\331\026B\343\344\003\206P\001\n\211A\022@!!\210\202\201\003\016A坃\220\001\346\347\003\206h\001\n\211A\022@!!\262\t\006\a\203\203\001\006\a\006\t\006\tAB\241\210\006\aA\262\b\202\201\003\006\b\016CB\211\026C\262\b\202\201\003\016A蝃\270\001\347\002\206\241\001\n\211A\022@!\346\001!\351\001!\203\256\001\211\262\002\352\002\314\331#\266\003\202\201\003\016A띃\330\001\347\002\206\311\001\n\211A\022@!\346\001!\352\001\314ى$\266\003\202\201\003\016A욃\001\002\331\026B\001\206\353\001\n\211A\022@\262\t\006\b;\204\367\001\332\355!\210", <incomplete sequence \356>..., byte_string = 9953465, byte_string_start = 0xb5ad24 "\306 \210\b\203\021", constants = 9953501, next = 0x7ffffffe5ee0}
        top = 0x7ffffffe5910
        result = 140737488253344
#26 0x00000000006030cb in funcall_lambda (fun=9953413, nargs=1, arg_vector=0x7ffffffe5e08) at eval.c:3167
        val = 16336112
        syms_left = 1028
        next = 5
        lexenv = 12565392
        count = 4
        i = 12754864
        optional = 0
        rest = 15091217
#27 0x0000000000602b89 in Ffuncall (nargs=2, args=0x7ffffffe5e00) at eval.c:3051
        fun = 9953413
        original_fun = 13735682
        funcar = 12889074
        numargs = 1
        lisp_numargs = 140737488253344
        val = 18937910
        backtrace = {next = 0x7ffffffe62c0, function = 0x7ffffffe5e00, args = 0x7ffffffe5e08, nargs = 1, debug_on_exit = 0}
        internal_args = 0xa0
        i = 6185953
#28 0x000000000064dd88 in exec_byte_code (bytestr=9929121, vector=9929157, maxdepth=72, args_template=0, nargs=0, args=0x7ffffffe6350) at bytecode.c:785
        count = 4
        op = 1
        vectorp = 0x9781d0
        stack = {pc = 0xb5d7f8 "\210\016H\203\224\006\201", <incomplete sequence \330>, byte_string = 9929121, byte_string_start = 0xb5d170 "\306 \020\307\021\n\023\307\024\310\311!\211\307=\204\060", 
          constants = 9929157, next = 0x7ffffffe63d0}
        top = 0x7ffffffe5e00
        result = 64
#29 0x00000000006030cb in funcall_lambda (fun=9929069, nargs=0, arg_vector=0x7ffffffe6350) at eval.c:3167
        val = 5
        syms_left = 0
        next = 140737488250752
        lexenv = 5
        count = 4
        i = 140737488249688
        optional = 0
        rest = 6156621
#30 0x0000000000602b89 in Ffuncall (nargs=1, args=0x7ffffffe6348) at eval.c:3051
        fun = 9929069
        original_fun = 13184834
        funcar = 12760706
        numargs = 0
        lisp_numargs = 140737488250752
        val = 12726818
        backtrace = {next = 0x7ffffffe6910, function = 0x7ffffffe6348, args = 0x7ffffffe6350, nargs = 0, debug_on_exit = 0}
        internal_args = 0x80
        i = 6185953
#31 0x000000000064dd88 in exec_byte_code (bytestr=9923665, vector=9923701, maxdepth=32, args_template=0, nargs=0, args=0x7ffffffe6780) at bytecode.c:785
        count = 3
        op = 0
        vectorp = 0x976c80
        stack = {pc = 0xb5e13d "\210)\210\346\347\350\"\210\351\317\352\"\211;\203\240", byte_string = 9923665, byte_string_start = 0xb5e0b6 "\b\203\b", constants = 9923701, next = 0x0}
        top = 0x7ffffffe6348
        result = 140737488250848
#32 0x00000000006030cb in funcall_lambda (fun=9923613, nargs=0, arg_vector=0x7ffffffe6780) at eval.c:3167
        val = 140737353853576
        syms_left = 0
        next = 8227920807149371393
        lexenv = 16
        count = 3
        i = 140737259718280
        optional = 32767
        rest = 2
#33 0x0000000000602ea8 in apply_lambda (fun=9923613, args=12726818) at eval.c:3110
        args_left = 12726818
        i = 0
        numargs = 0
        arg_vector = 0x7ffffffe6780
        gcpro1 = {next = 0x8, var = 0x7ffff26f1cc0, nvars = 0}
        gcpro2 = {next = 0xffffffffffffff00, var = 0x7, nvars = 140737488251280}
        gcpro3 = {next = 0x8, var = 0x7fffee437000, nvars = 888944}
        tem = 0
        sa_count = 3
        sa_must_free = 0
#34 0x0000000000601524 in eval_sub (form=13140662) at eval.c:2395
        fun = 9923613
        val = 140737488251672
        original_fun = 13834530
        args_left = 12726818
        i = 0
        numargs = 0
        arg_vector = 0x7ffffffe6780
        gcpro1 = {next = 0x8, var = 0x7ffff26f1cc0, nvars = 0}
        gcpro2 = {next = 0xffffffffffffff00, var = 0x7, nvars = 140737488251280}
        gcpro3 = {next = 0x8, var = 0x7fffee437000, nvars = 888944}
        tem = 0
        sa_count = 3
        sa_must_free = 0
#34 0x0000000000601524 in eval_sub (form=13140662) at eval.c:2395
        fun = 9923613
        val = 140737488251672
        original_fun = 13834530
        original_args = 12726818
        funcar = 0
        backtrace = {next = 0x0, function = 0x7ffffffe6940, args = 0x7ffffffe6780, nargs = 0, debug_on_exit = 0}
        gcpro1 = {next = 0x7fff00000017, var = 0x102a10a06, nvars = 140737259669880}
        gcpro2 = {next = 0xa8428197, var = 0xc23222, nvars = 140737488251232}
        gcpro3 = {next = 0x10822fdb, var = 0x7ffffffe6930, nvars = 140737353853264}
#35 0x0000000000600cb3 in Feval (form=13140662, lexical=12726818) at eval.c:2204
        count = 2
#36 0x0000000000563cad in top_level_2 () at keyboard.c:1169
No locals.
#37 0x00000000005ff611 in internal_condition_case (bfun=0x563c90 <top_level_2>, handlers=12779106, hfun=0x56386c <cmd_error>) at eval.c:1515
        val = 5651631
        c = {tag = 12726818, val = 12726818, next = 0x7ffffffe6bc0, gcpro = 0x0, jmp = {{__jmpbuf = {0, -6975756009930909191, 4278368, 140737488253344, 0, 0, -6975756009891063303, 6975756539251497465}, 
              __mask_was_saved = 0, __saved_mask = {__val = {4294967295, 13595766, 1, 9336904, 0, 0, 0, 0, 140737351952882, 1, 0, 0, 140737259697808, 0, 0, 140737488252112}}}}, backlist = 0x0, 
          handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2, poll_suppress_count = 1, interrupt_input_blocked = 0, byte_stack = 0x0}
        h = {handler = 12779106, var = 12726818, chosen_clause = 48, tag = 0x7ffffffe6a50, next = 0x0}
#38 0x0000000000563ce7 in top_level_1 (ignore=12726818) at keyboard.c:1177
No locals.
#39 0x00000000005fef9b in internal_catch (tag=12774850, func=0x563caf <top_level_1>, arg=12726818) at eval.c:1272
        c = {tag = 12774850, val = 12726818, next = 0x0, gcpro = 0x0, jmp = {{__jmpbuf = {0, -6975756010086098439, 4278368, 140737488253344, 0, 0, -6975756009903646215, 6975756540123650553}, 
              __mask_was_saved = 0, __saved_mask = {__val = {6187332, 100, 4294967296, 352, 30064771072, 12121664, 12754864, 344, 0, 140737488252064, 12952912, 14, 0, 4278368, 140737488253344, 
                  140737488252144}}}}, backlist = 0x0, handlerlist = 0x0, lisp_eval_depth = 0, pdlcount = 2, poll_suppress_count = 1, interrupt_input_blocked = 0, byte_stack = 0x0}
#40 0x0000000000563c0b in command_loop () at keyboard.c:1132
No locals.
#41 0x00000000005633b0 in recursive_edit_1 () at keyboard.c:759
        count = 1
        val = 12726818
#42 0x0000000000563553 in Frecursive_edit () at keyboard.c:823
        count = 0
        buffer = 12726818
#43 0x00000000005615f0 in main (argc=1739, argv=0x7ffffffe71a8) at emacs.c:1715
        dummy = 4239669
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = 1
        skip_args = 1
        rlim = {rlim_cur = 8720000, rlim_max = 18446744073709551615}
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x7ffff7fc8d38 "\200\344\377\367\377\177"

bug#11984: 24.1; segfault while deleting a window

[Russell Sim]

Russell Sim <russell.sim@gmail.com> writes:

> Chong Yidong <cyd@gnu.org> writes:
>> I committed a fix to the emacs-24 branch adding CHECK_LIVE_FRAME calls
>> to those two functions (patch below).  But for long-term safety, I think
>> decode_any_windows had better signal an error if the window's frame
>> isn't live.  But I'm not sure if there's any subtle reliance in existing
>> code on allowing window functions to be called for windows on dead
>> frames---anyone know?
>
> Thanks for the champion effort, but I can still create the bug on
> emacs-24 3770cb4 which includes Chongs patch.
>
> Here is a full backtrace, and another core
> http://russellsim.org/emacs-24.3770cb4.core

Oh crap, I just realised that you didn't add you full patch in the
commit.  I have re-compiled and included the extra in
window-absolute-pixel-edges and delete-other-windows-internal changes.
Unfortunately I still get the error.

I here is an updated core
file. http://russellsim.org/emacs-24.3770cb4-patch.core

This may or may not help since I have no idea what extra would be
included in a core file, line 2653 has the contents:

  hlinfo = MOUSE_HL_INFO (f);

Thanks,
Russell


#0  0x000000000048c5cc in Fdelete_other_windows_internal (window=24470869, root=24128309) at window.c:2653
        w = 0x1756550
        r = 0x1702b30
        s = 0xc59212
        f = 0xc390d0
        sibling = 812
        pwindow = 24470869
        swindow = 13333010
        delta = 12726818
        startpos = 1
        top = 4
        new_top = 32767
        resize_failed = -115344
        hlinfo = 0xc23222
#1  0x0000000000602a69 in Ffuncall (nargs=3, args=0x7ffffffe3e30) at eval.c:3005
        fun = 9345541
        original_fun = 12950978
        funcar = 103079215107
        numargs = 2
        lisp_numargs = 12782626
        val = 12726818
        backtrace = {next = 0x7ffffffe42e0, function = 0x7ffffffe3e30, args = 0x7ffffffe3e38, nargs = 2, debug_on_exit = 0}
        internal_args = 0x7ffffffe3e38
        i = 12726818
#2  0x000000000064de50 in exec_byte_code (bytestr=9699809, vector=9699861, maxdepth=20, args_template=12726818, nargs=0, args=0x0) at bytecode.c:785
        count = 25
        op = 2
        vectorp = 0x940220
        stack = {pc = 0xb6f179 "\210\323\r!\210\324\r!\210Շ", byte_string = 9699809, byte_string_start = 0xb6f118 "\b\204U", constants = 9699861, next = 0x7ffffffe4540}
        top = 0x7ffffffe3e30
        result = 140737488241984
#3  0x000000000064d3bb in Fbyte_code (bytestr=9699809, vector=9699861, maxdepth=20) at bytecode.c:423
No locals.
#4  0x0000000000601427 in eval_sub (form=9699782) at eval.c:2356
        numargs = 12
        args_left = 12726818
        i = 3
        maxargs = 3
        argvals = {9699809, 9699861, 20, 140737488241376, 140737488241384, 1, 140737488241296, 5816836}
        fun = 12108133
        val = 12816597
        original_fun = 12866754
        original_args = 9699798
        funcar = 5815511
        backtrace = {next = 0x7ffffffe4a80, function = 0x7ffffffe4310, args = 0x7ffffffe4240, nargs = 3, debug_on_exit = 0}
        gcpro1 = {next = 0x7ffffffe4310, var = 0x6021f4, nvars = 12864482}
        gcpro2 = {next = 0xc23222, var = 0xc23222, nvars = 12726818}
        gcpro3 = {next = 0x1, var = 0x7ffffffe4240, nvars = 3}
#5  0x00000000005ff063 in internal_catch (tag=13220914, func=0x600d8d <eval_sub>, arg=9699782) at eval.c:1272
        c = {tag = 13220914, val = 12726818, next = 0x7ffffffe6a50, gcpro = 0x0, jmp = {{__jmpbuf = {140737488242928, 1568579509601815893, 140737488242928, 140737488243584, 0, 0, 1568579509629078869, 
                -1568579215016735403}, __mask_was_saved = 0, __saved_mask = {__val = {6302801, 140737488241872, 16, 12726818, 94489280514, 140737488241872, 2, 140737488243328, 140737488241872, 140737488241880, 
                  1, 24566916, 12769218, 12726818, 13453714, 1}}}}, backlist = 0x7ffffffe4a80, handlerlist = 0x7ffffffe6a20, lisp_eval_depth = 10, pdlcount = 25, poll_suppress_count = 1, 
          interrupt_input_blocked = 0, byte_stack = 0x7ffffffe4540}
#6  0x000000000064eaaf in exec_byte_code (bytestr=9699617, vector=9699653, maxdepth=16, args_template=12726818, nargs=0, args=0x0) at bytecode.c:966
        v1 = 9699782
        count = 20
        op = 141
        vectorp = 0x940150
        stack = {pc = 0xb6f1a2 "-\207", byte_string = 9699617, byte_string_start = 0xb6f185 "\306\b!\020\307\b!\031\310\b\311\"\032\310\b\303\"\033ʉ\034\035\313\t!\210\314͍-\207", constants = 9699653, 
          next = 0x7ffffffe59a0}
        top = 0x7ffffffe44d0
        result = 9465524
#7  0x0000000000603469 in funcall_lambda (fun=9699557, nargs=0, arg_vector=0x7ffffffe48f0) at eval.c:3233
        val = 24566917
        syms_left = 12726818
        next = 12782626
        lexenv = 12726818
        count = 19
        i = 0
        optional = 1
        rest = 0
#8  0x0000000000602f70 in apply_lambda (fun=9699557, args=12726818) at eval.c:3110
        args_left = 12726818
        i = 0
        numargs = 0
        arg_vector = 0x7ffffffe48f0
        gcpro1 = {next = 0x7ffffffe49b0, var = 0x5fd4ea, nvars = 0}
        gcpro2 = {next = 0xc40d72, var = 0xc23222, nvars = 12726818}
        gcpro3 = {next = 0x7ffffffe49b0, var = 0xc23222, nvars = 9470012}
        tem = 24566917
        sa_count = 19
        sa_must_free = 0
#9  0x00000000006015ec in eval_sub (form=22159046) at eval.c:2395
        fun = 9699557
        val = 24566917
        original_fun = 13582674
        original_args = 12726818
        funcar = 4307814658
        backtrace = {next = 0x7ffffffe4d50, function = 0x7ffffffe4ab0, args = 0x7ffffffe48f0, nargs = 0, debug_on_exit = 0}
        gcpro1 = {next = 0xc23222, var = 0x7ffffffe4b80, nvars = 140737488243344}
        gcpro2 = {next = 0x16f1e00, var = 0xbfbfd0, nvars = 1}
        gcpro3 = {next = 0xbfbfd0, var = 0xc23252, nvars = 2}
#10 0x00000000005fd5bb in Fprogn (args=24433798) at eval.c:364
        val = 24566917
        gcpro1 = {next = 0x14bcf42, var = 0xc23222, nvars = 0}

bug#11984: 24.1; segfault while deleting a window

[Chong Yidong]

martin rudalics <rudalics@gmx.at> writes:

>> But for long-term safety, I think
>> decode_any_windows had better signal an error if the window's frame
>> isn't live.  But I'm not sure if there's any subtle reliance in existing
>> code on allowing window functions to be called for windows on dead
>> frames---anyone know?
>
> Maybe the best way to find out is to install such a change?

Done in the trunk.

bug#11984: 24.1; segfault while deleting a window

[Chong Yidong]

Russell Sim <russell.sim@gmail.com> writes:

> Oh crap, I just realised that you didn't add you full patch in the
> commit.  I have re-compiled and included the extra in
> window-absolute-pixel-edges and delete-other-windows-internal changes.
> Unfortunately I still get the error.
>
> I here is an updated core
> file. http://russellsim.org/emacs-24.3770cb4-patch.core

Hmm, I'm not sure the core file loaded properly for me.  Can you trigger
the crash with Emacs running in gdb?  Do you get the following strange
result from printing f->output_data?

(gdb) p f->output_data
$4 = {
  tty = 0xc2, 
  x = 0xc2, 
  w32 = 0xc2, 
  ns = 0xc2, 
  nothing = 194
}

Also, please provide the step-by-step recipe that you are using to run
the tests?  If I can try to reproduce the crash myself, debugging will
go faster.

bug#11984: 24.1; segfault while deleting a window

[Eli Zaretskii]

> From: Russell Sim <russell.sim@gmail.com>
> Cc: Eli Zaretskii <eliz@gnu.org>,  11984@debbugs.gnu.org
> Date: Sat, 21 Jul 2012 10:12:42 +1000
> 
> Oh crap, I just realised that you didn't add you full patch in the
> commit.  I have re-compiled and included the extra in
> window-absolute-pixel-edges and delete-other-windows-internal changes.
> Unfortunately I still get the error.

Please show the "extra" you included.  In particular, please show
window.c around line 2653, plus/minus 20 lines.

bug#11984: 24.1; segfault while deleting a window

[Russell Sim]

Chong Yidong <cyd@gnu.org> writes:

> Russell Sim <russell.sim@gmail.com> writes:
>
>> Oh crap, I just realised that you didn't add you full patch in the
>> commit.  I have re-compiled and included the extra in
>> window-absolute-pixel-edges and delete-other-windows-internal changes.
>> Unfortunately I still get the error.
>>
>> I here is an updated core
>> file. http://russellsim.org/emacs-24.3770cb4-patch.core
>
> Hmm, I'm not sure the core file loaded properly for me.  Can you trigger
> the crash with Emacs running in gdb?  Do you get the following strange
> result from printing f->output_data?
>
> (gdb) p f->output_data
> $4 = {
>   tty = 0xc2, 
>   x = 0xc2, 
>   w32 = 0xc2, 
>   ns = 0xc2, 
>   nothing = 194
> }

(gdb) p f->output_data
$1 = {tty = 0x0, x = 0x0, w32 = 0x0, ns = 0x0, nothing = 0}

Be aware that I am running in batch mode.

> Also, please provide the step-by-step recipe that you are using to run
> the tests?  If I can try to reproduce the crash myself, debugging will
> go faster.

I wish I could offer some simple recipe, I'll see if I can narrow it
down to one test case, but because this is the test runner for the whole
python-mode you need a heap of 3rd party Python stuff to get far enough
along to cause the crash.  If this is too painful, I can setup a VM with
the appropriate environment for you to access.

I'll be on IRC in the #emacs channel for a while and my handle is
arrsim, or jabber at my email address.

I have included the whole function that I am using, which is the
emacs-24 branch + your extra CHECK_LIVE_FRAME chuncks.


2548: DEFUN ("delete-other-windows-internal", Fdelete_other_windows_internal,
2549:        Sdelete_other_windows_internal, 0, 2, "",
2550:        doc: /* Make WINDOW fill its frame.
2551: Only the frame WINDOW is on is affected.  WINDOW may be any window and
2552: defaults to the selected one.
2553: 
2554: Optional argument ROOT, if non-nil, must specify an internal window such
2555: that WINDOW is in its window subtree.  If this is the case, replace ROOT
2556: by WINDOW and leave alone any windows not part of ROOT's subtree.
2557: 
2558: When WINDOW is live try to reduce display jumps by keeping the text
2559: previously visible in WINDOW in the same place on the frame.  Doing this
2560: depends on the value of (window-start WINDOW), so if calling this
2561: function in a program gives strange scrolling, make sure the
2562: window-start value is reasonable when this function is called.  */)
2563:      (Lisp_Object window, Lisp_Object root)
2564: {
2565:   struct window *w, *r, *s;
2566:   struct frame *f;
2567:   Lisp_Object sibling, pwindow, swindow IF_LINT (= Qnil), delta;
2568:   EMACS_INT startpos IF_LINT (= 0);
2569:   int top IF_LINT (= 0), new_top, resize_failed;
2570:   Mouse_HLInfo *hlinfo;
2571: 
2572:   w = decode_any_window (window);
2573:   CHECK_LIVE_FRAME (w->frame);
2574:   XSETWINDOW (window, w);
2575:   f = XFRAME (w->frame);
2576: 
2577:   if (NILP (root))
2578:     /* ROOT is the frame's root window.  */
2579:     {
2580:       root = FRAME_ROOT_WINDOW (f);
2581:       r = XWINDOW (root);
2582:     }
2583:   else
2584:     /* ROOT must be an ancestor of WINDOW.  */
2585:     {
2586:       r = decode_any_window (root);
2587:       CHECK_LIVE_FRAME (r->frame);
2588:       pwindow = XWINDOW (window)->parent;
2589:       while (!NILP (pwindow))
2590: 	if (EQ (pwindow, root))
2591: 	  break;
2592: 	else
2593: 	  pwindow = XWINDOW (pwindow)->parent;
2594:       if (!EQ (pwindow, root))
2595: 	error ("Specified root is not an ancestor of specified window");
2596:     }
2597: 
2598:   if (EQ (window, root))
2599:     /* A noop.  */
2600:     return Qnil;
2601:   /* I don't understand the "top > 0" part below.  If we deal with a
2602:      standalone minibuffer it would have been caught by the preceding
2603:      test.  */
2604:   else if (MINI_WINDOW_P (w)) /* && top > 0) */
2605:     error ("Can't expand minibuffer to full frame");
2606: 
2607:   if (!NILP (w->buffer))
2608:     {
2609:       startpos = marker_position (w->start);
2610:       top = WINDOW_TOP_EDGE_LINE (w)
2611: 	- FRAME_TOP_MARGIN (XFRAME (WINDOW_FRAME (w)));
2612:       /* Make sure WINDOW is the frame's selected window.  */
2613:       if (!EQ (window, FRAME_SELECTED_WINDOW (f)))
2614: 	{
2615: 	  if (EQ (selected_frame, w->frame))
2616: 	    Fselect_window (window, Qnil);
2617: 	  else
2618: 	    FRAME_SELECTED_WINDOW (f) = window;
2619: 	}
2620:     }
2621:   else
2622:     {
2623:       /* See if the frame's selected window is a part of the window
2624: 	 subtree rooted at WINDOW, by finding all the selected window's
2625: 	 parents and comparing each one with WINDOW.  If it isn't we
2626: 	 need a new selected window for this frame.  */
2627:       swindow = FRAME_SELECTED_WINDOW (f);
2628:       while (1)
2629: 	{
2630: 	  pwindow = swindow;
2631: 	  while (!NILP (pwindow) && !EQ (window, pwindow))
2632: 	    pwindow = XWINDOW (pwindow)->parent;
2633: 
2634: 	  if (EQ (window, pwindow))
2635: 	    /* If WINDOW is an ancestor of SWINDOW, then SWINDOW is ok
2636: 	       as the new selected window.  */
2637: 	    break;
2638: 	  else
2639: 	    /* Else try the previous window of SWINDOW.  */
2640: 	    swindow = Fprevious_window (swindow, Qlambda, Qnil);
2641: 	}
2642: 
2643:       if (!EQ (swindow, FRAME_SELECTED_WINDOW (f)))
2644: 	{
2645: 	  if (EQ (selected_frame, w->frame))
2646: 	    Fselect_window (swindow, Qnil);
2647: 	  else
2648: 	    FRAME_SELECTED_WINDOW (f) = swindow;
2649: 	}
2650:     }
2651: 
2652:   BLOCK_INPUT;
2653:   hlinfo = MOUSE_HL_INFO (f);
2654:   /* We are going to free the glyph matrices of WINDOW, and with that
2655:      we might lose any information about glyph rows that have some of
2656:      their glyphs highlighted in mouse face.  (These rows are marked
2657:      with a non-zero mouse_face_p flag.)  If WINDOW indeed has some
2658:      glyphs highlighted in mouse face, signal to frame's up-to-date
2659:      hook that mouse highlight was overwritten, so that it will
2660:      arrange for redisplaying the highlight.  */
2661:   if (EQ (hlinfo->mouse_face_window, window))
2662:     {
2663:       hlinfo->mouse_face_beg_row = hlinfo->mouse_face_beg_col = -1;
2664:       hlinfo->mouse_face_end_row = hlinfo->mouse_face_end_col = -1;
2665:       hlinfo->mouse_face_window = Qnil;
2666:     }
2667:   free_window_matrices (r);
2668: 
2669:   windows_or_buffers_changed++;
2670:   Vwindow_list = Qnil;
2671:   FRAME_WINDOW_SIZES_CHANGED (f) = 1;
2672:   resize_failed = 0;
2673: 
2674:   if (NILP (w->buffer))
2675:     {
2676:       /* Resize child windows vertically.  */
2677:       XSETINT (delta, XINT (r->total_lines) - XINT (w->total_lines));
2678:       w->top_line = r->top_line;
2679:       resize_root_window (window, delta, Qnil, Qnil);
2680:       if (window_resize_check (w, 0))
2681: 	window_resize_apply (w, 0);
2682:       else
2683: 	{
2684: 	  resize_root_window (window, delta, Qnil, Qt);
2685: 	  if (window_resize_check (w, 0))
2686: 	    window_resize_apply (w, 0);
2687: 	  else
2688: 	    resize_failed = 1;
2689: 	}
2690: 
2691:       /* Resize child windows horizontally.  */
2692:       if (!resize_failed)
2693: 	{
2694: 	  w->left_col = r->left_col;
2695: 	  XSETINT (delta, XINT (r->total_cols) - XINT (w->total_cols));
2696: 	  w->left_col = r->left_col;
2697: 	  resize_root_window (window, delta, Qt, Qnil);
2698: 	  if (window_resize_check (w, 1))
2699: 	    window_resize_apply (w, 1);
2700: 	  else
2701: 	    {
2702: 	      resize_root_window (window, delta, Qt, Qt);
2703: 	      if (window_resize_check (w, 1))
2704: 		window_resize_apply (w, 1);
2705: 	      else
2706: 		resize_failed = 1;
2707: 	    }
2708: 	}
2709: 
2710:       if (resize_failed)
2711: 	/* Play safe, if we still can ...  */
2712: 	{
2713: 	  window = swindow;
2714: 	  w = XWINDOW (window);
2715: 	}
2716:     }
2717: 
2718:   /* Cleanly unlink WINDOW from window-tree.  */
2719:   if (!NILP (w->prev))
2720:     /* Get SIBLING above (on the left of) WINDOW.  */
2721:     {
2722:       sibling = w->prev;
2723:       s = XWINDOW (sibling);
2724:       s->next = w->next;
2725:       if (!NILP (s->next))
2726: 	XWINDOW (s->next)->prev = sibling;
2727:     }
2728:   else
2729:     /* Get SIBLING below (on the right of) WINDOW.  */
2730:     {
2731:       sibling = w->next;
2732:       s = XWINDOW (sibling);
2733:       s->prev = Qnil;
2734:       if (!NILP (XWINDOW (w->parent)->vchild))
2735: 	XWINDOW (w->parent)->vchild = sibling;
2736:       else
2737: 	XWINDOW (w->parent)->hchild = sibling;
2738:     }
2739: 
2740:   /* Delete ROOT and all child windows of ROOT.  */
2741:   if (!NILP (r->vchild))
2742:     {
2743:       delete_all_child_windows (r->vchild);
2744:       r->vchild = Qnil;
2745:     }
2746:   else if (!NILP (r->hchild))
2747:     {
2748:       delete_all_child_windows (r->hchild);
2749:       r->hchild = Qnil;
2750:     }
2751: 
2752:   replace_window (root, window, 1);
2753: 
2754:   /* This must become SWINDOW anyway ....... */
2755:   if (!NILP (w->buffer) && !resize_failed)
2756:     {
2757:       /* Try to minimize scrolling, by setting the window start to the
2758: 	 point will cause the text at the old window start to be at the
2759: 	 same place on the frame.  But don't try to do this if the
2760: 	 window start is outside the visible portion (as might happen
2761: 	 when the display is not current, due to typeahead).  */
2762:       new_top = WINDOW_TOP_EDGE_LINE (w) - FRAME_TOP_MARGIN (XFRAME (WINDOW_FRAME (w)));
2763:       if (new_top != top
2764: 	  && startpos >= BUF_BEGV (XBUFFER (w->buffer))
2765: 	  && startpos <= BUF_ZV (XBUFFER (w->buffer)))
2766: 	{
2767: 	  struct position pos;
2768: 	  struct buffer *obuf = current_buffer;
2769: 
2770: 	  Fset_buffer (w->buffer);
2771: 	  /* This computation used to temporarily move point, but that
2772: 	     can have unwanted side effects due to text properties.  */
2773: 	  pos = *vmotion (startpos, -top, w);
2774: 
2775: 	  set_marker_both (w->start, w->buffer, pos.bufpos, pos.bytepos);
2776: 	  w->window_end_valid = Qnil;
2777: 	  w->start_at_line_beg = ((pos.bytepos == BEGV_BYTE
2778: 				   || FETCH_BYTE (pos.bytepos - 1) == '\n') ? Qt
2779: 				  : Qnil);
2780: 	  /* We need to do this, so that the window-scroll-functions
2781: 	     get called.  */
2782: 	  w->optional_new_start = Qt;
2783: 
2784: 	  set_buffer_internal (obuf);
2785: 	}
2786:     }
2787: 
2788:   adjust_glyphs (f);
2789:   UNBLOCK_INPUT;
2790: 
2791:   run_window_configuration_change_hook (f);
2792: 
2793:   return Qnil;
2794: }

bug#11984: 24.1; segfault while deleting a window

[Russell Sim]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Russell Sim <russell.sim@gmail.com>
>> Cc: Eli Zaretskii <eliz@gnu.org>,  11984@debbugs.gnu.org
>> Date: Sat, 21 Jul 2012 10:12:42 +1000
>> 
>> Oh crap, I just realised that you didn't add you full patch in the
>> commit.  I have re-compiled and included the extra in
>> window-absolute-pixel-edges and delete-other-windows-internal changes.
>> Unfortunately I still get the error.
>
> Please show the "extra" you included.  In particular, please show
> window.c around line 2653, plus/minus 20 lines.

I have push the code I am running here.
https://github.com/russell/emacs/tree/bug-11984

bug#11984: 24.1; segfault while deleting a window

[Eli Zaretskii]

> From: Russell Sim <russell.sim@gmail.com>
> Cc: Eli Zaretskii <eliz@gnu.org>,  11984@debbugs.gnu.org
> Date: Sat, 21 Jul 2012 19:00:36 +1000
> 
> > Hmm, I'm not sure the core file loaded properly for me.  Can you trigger
> > the crash with Emacs running in gdb?  Do you get the following strange
> > result from printing f->output_data?
> >
> > (gdb) p f->output_data
> > $4 = {
> >   tty = 0xc2, 
> >   x = 0xc2, 
> >   w32 = 0xc2, 
> >   ns = 0xc2, 
> >   nothing = 194
> > }
> 
> (gdb) p f->output_data
> $1 = {tty = 0x0, x = 0x0, w32 = 0x0, ns = 0x0, nothing = 0}

This is a FRAME_INITIAL_P frame.

> 2652:   BLOCK_INPUT;
> 2653:   hlinfo = MOUSE_HL_INFO (f);
> 2654:   /* We are going to free the glyph matrices of WINDOW, and with that
> 2655:      we might lose any information about glyph rows that have some of
> 2656:      their glyphs highlighted in mouse face.  (These rows are marked
> 2657:      with a non-zero mouse_face_p flag.)  If WINDOW indeed has some
> 2658:      glyphs highlighted in mouse face, signal to frame's up-to-date
> 2659:      hook that mouse highlight was overwritten, so that it will
> 2660:      arrange for redisplaying the highlight.  */
> 2661:   if (EQ (hlinfo->mouse_face_window, window))
> 2662:     {
> 2663:       hlinfo->mouse_face_beg_row = hlinfo->mouse_face_beg_col = -1;
> 2664:       hlinfo->mouse_face_end_row = hlinfo->mouse_face_end_col = -1;
> 2665:       hlinfo->mouse_face_window = Qnil;
> 2666:     }

That's it your problem: you didn't include the changes below, which
make sure mouse-highlight info is never accessed for 'initial' frame
types.  The changes below were only done on the trunk, they aren't in
the emacs-24 branch.

--- src/window.c	2012-06-01 03:41:03 +0000
+++ src/window.c	2012-06-16 07:18:44 +0000
@@ -2566,7 +2566,6 @@ window-start value is reasonable when th
   Lisp_Object sibling, pwindow, swindow IF_LINT (= Qnil), delta;
   ptrdiff_t startpos IF_LINT (= 0);
   int top IF_LINT (= 0), new_top, resize_failed;
-  Mouse_HLInfo *hlinfo;
 
   w = decode_any_window (window);
   XSETWINDOW (window, w);
@@ -2647,19 +2646,23 @@ window-start value is reasonable when th
     }
 
   BLOCK_INPUT;
-  hlinfo = MOUSE_HL_INFO (f);
-  /* We are going to free the glyph matrices of WINDOW, and with that
-     we might lose any information about glyph rows that have some of
-     their glyphs highlighted in mouse face.  (These rows are marked
-     with a non-zero mouse_face_p flag.)  If WINDOW indeed has some
-     glyphs highlighted in mouse face, signal to frame's up-to-date
-     hook that mouse highlight was overwritten, so that it will
-     arrange for redisplaying the highlight.  */
-  if (EQ (hlinfo->mouse_face_window, window))
-    {
-      hlinfo->mouse_face_beg_row = hlinfo->mouse_face_beg_col = -1;
-      hlinfo->mouse_face_end_row = hlinfo->mouse_face_end_col = -1;
-      hlinfo->mouse_face_window = Qnil;
+  if (!FRAME_INITIAL_P (f))
+    {
+        Mouse_HLInfo *hlinfo = MOUSE_HL_INFO (f);
+
+      /* We are going to free the glyph matrices of WINDOW, and with
+	 that we might lose any information about glyph rows that have
+	 some of their glyphs highlighted in mouse face.  (These rows
+	 are marked with a non-zero mouse_face_p flag.)  If WINDOW
+	 indeed has some glyphs highlighted in mouse face, signal to
+	 frame's up-to-date hook that mouse highlight was overwritten,
+	 so that it will arrange for redisplaying the highlight.  */
+      if (EQ (hlinfo->mouse_face_window, window))
+	{
+	  hlinfo->mouse_face_beg_row = hlinfo->mouse_face_beg_col = -1;
+	  hlinfo->mouse_face_end_row = hlinfo->mouse_face_end_col = -1;
+	  hlinfo->mouse_face_window = Qnil;
+	}
     }
   free_window_matrices (r);
 
@@ -3903,7 +3906,6 @@ Signal an error when WINDOW is the only 
       && EQ (r->new_total, (horflag ? r->total_cols : r->total_lines)))
     /* We can delete WINDOW now.  */
     {
-      Mouse_HLInfo *hlinfo;
 
       /* Block input.  */
       BLOCK_INPUT;
@@ -3911,9 +3913,13 @@ Signal an error when WINDOW is the only 
 
       /* If this window is referred to by the dpyinfo's mouse
 	 highlight, invalidate that slot to be safe (Bug#9904).  */
-      hlinfo = MOUSE_HL_INFO (XFRAME (w->frame));
-      if (EQ (hlinfo->mouse_face_window, window))
-	hlinfo->mouse_face_window = Qnil;
+      if (!FRAME_INITIAL_P (f))
+	{
+	  Mouse_HLInfo *hlinfo = MOUSE_HL_INFO (f);
+
+	  if (EQ (hlinfo->mouse_face_window, window))
+	    hlinfo->mouse_face_window = Qnil;
+	}
 
       windows_or_buffers_changed++;
       Vwindow_list = Qnil;

bug#11984: 24.1; segfault while deleting a window

[Russell Sim]

Eli Zaretskii <eliz@gnu.org> writes:

> That's it your problem: you didn't include the changes below, which
> make sure mouse-highlight info is never accessed for 'initial' frame
> types.  The changes below were only done on the trunk, they aren't in
> the emacs-24 branch.

Worked like a charm. :)

Thanks,
Russell

bug#11984: 24.1; segfault while deleting a window

[martin rudalics]

 >>> But for long-term safety, I think
 >>> decode_any_windows had better signal an error if the window's frame
 >>> isn't live.  But I'm not sure if there's any subtle reliance in existing
 >>> code on allowing window functions to be called for windows on dead
 >>> frames---anyone know?
 >> Maybe the best way to find out is to install such a change?
 >
 > Done in the trunk.

I must admit that I never looked at the definition of decode_any_window.
I always assumed that it _does_ check whether the window either has a
buffer or is in a window tree.  So I think behavior is still broken
because a window can have been deleted while its frame is still alive.

IMHO the right fix is to throw an error for

   if (NILP (w->buffer) && NILP (w->hchild) && NILP (w->vchild))

which means that some functions when called on dead windows (like
`delete-window') will now throw an error.  These will have to be caught
on the Elisp level.

martin

bug#11984: 24.1; segfault while deleting a window

[Eli Zaretskii]

> From: Russell Sim <russell.sim@gmail.com>
> Cc: cyd@gnu.org,  11984@debbugs.gnu.org
> Date: Sat, 21 Jul 2012 19:45:08 +1000
> 
> Eli Zaretskii <eliz@gnu.org> writes:
> 
> > That's it your problem: you didn't include the changes below, which
> > make sure mouse-highlight info is never accessed for 'initial' frame
> > types.  The changes below were only done on the trunk, they aren't in
> > the emacs-24 branch.
> 
> Worked like a charm. :)

Thanks, I'm closing this bug, then.

bug#11984: 24.1; segfault while deleting a window

[martin rudalics]

[-- Attachment #1: Type: text/plain, Size: 526 bytes --]

 > IMHO the right fix is to throw an error for
 >
 >   if (NILP (w->buffer) && NILP (w->hchild) && NILP (w->vchild))
 >
 > which means that some functions when called on dead windows (like
 > `delete-window') will now throw an error.  These will have to be caught
 > on the Elisp level.

I think `delete-window-internal' can keep its decode_any_window.  I'm
not sure about `window-buffer'.  For the remainder, the attached patch
should be applied IMO.  Eli can you check whether this interferes with
tooltip creation?

martin

[-- Attachment #2: window.diff --]
[-- Type: text/plain, Size: 9981 bytes --]

=== modified file 'src/lisp.h'
--- src/lisp.h	2012-07-24 06:45:44 +0000
+++ src/lisp.h	2012-07-24 08:32:47 +0000
@@ -1732,6 +1732,13 @@
 #define CHECK_LIVE_WINDOW(x) \
   CHECK_TYPE (WINDOWP (x) && !NILP (XWINDOW (x)->buffer), Qwindow_live_p, x)
 
+#define CHECK_VALID_WINDOW(x) \
+  CHECK_TYPE (WINDOWP (x)				\
+	      && (!NILP (XWINDOW (x)->buffer)		\
+		  || !NILP (XWINDOW (x)->vchild)	\
+		  || !NILP (XWINDOW (x)->hchild)),	\
+	      Qwindow_valid_p, x)
+
 #define CHECK_PROCESS(x) \
   CHECK_TYPE (PROCESSP (x), Qprocessp, x)
 

=== modified file 'src/window.c'
--- src/window.c	2012-07-23 16:57:20 +0000
+++ src/window.c	2012-07-24 10:33:45 +0000
@@ -51,7 +51,7 @@
 #include "nsterm.h"
 #endif
 
-Lisp_Object Qwindowp, Qwindow_live_p;
+Lisp_Object Qwindowp, Qwindow_live_p, Qwindow_valid_p;
 static Lisp_Object Qwindow_configuration_p, Qrecord_window_buffer;
 static Lisp_Object Qwindow_deletable_p, Qdelete_window, Qdisplay_buffer;
 static Lisp_Object Qreplace_buffer_in_windows, Qget_mru_window;
@@ -156,6 +156,19 @@
   return w;
 }
 
+static struct window *
+decode_valid_window (register Lisp_Object window)
+{
+  struct window *w;
+
+  if (NILP (window))
+    return XWINDOW (selected_window);
+
+  CHECK_VALID_WINDOW (window);
+  w = XWINDOW (window);
+  return w;
+}
+
 DEFUN ("windowp", Fwindowp, Swindowp, 1, 1, 0,
        doc: /* Return t if OBJECT is a window and nil otherwise.  */)
   (Lisp_Object object)
@@ -178,7 +191,7 @@
 If WINDOW is omitted or nil, it defaults to the selected window.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->frame;
+  return decode_valid_window (window)->frame;
 }
 
 DEFUN ("frame-root-window", Fframe_root_window, Sframe_root_window, 0, 1, 0,
@@ -193,7 +206,10 @@
   if (NILP (frame_or_window))
     window = SELECTED_FRAME ()->root_window;
   else if (WINDOWP (frame_or_window))
-    window = XFRAME (WINDOW_FRAME (XWINDOW (frame_or_window)))->root_window;
+    {
+      CHECK_VALID_WINDOW (frame_or_window);
+      window = XFRAME (XWINDOW (frame_or_window)->frame)->root_window;
+    }
   else
     {
       CHECK_LIVE_FRAME (frame_or_window);
@@ -220,7 +236,7 @@
 If WINDOW is omitted or nil, it defaults to the selected window.  */)
   (Lisp_Object window)
 {
-  return MINI_WINDOW_P (decode_any_window (window)) ? Qt : Qnil;
+  return MINI_WINDOW_P (decode_valid_window (window)) ? Qt : Qnil;
 }
 
 /* Don't move this to window.el - this must be a safe routine.  */
@@ -427,7 +443,7 @@
 Return nil for a window with no parent (e.g. a root window).  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->parent;
+  return decode_valid_window (window)->parent;
 }
 
 DEFUN ("window-top-child", Fwindow_top_child, Swindow_top_child, 1, 1, 0,
@@ -438,7 +454,7 @@
   (Lisp_Object window)
 {
   CHECK_WINDOW (window);
-  return decode_any_window (window)->vchild;
+  return decode_valid_window (window)->vchild;
 }
 
 DEFUN ("window-left-child", Fwindow_left_child, Swindow_left_child, 1, 1, 0,
@@ -449,7 +465,7 @@
   (Lisp_Object window)
 {
   CHECK_WINDOW (window);
-  return decode_any_window (window)->hchild;
+  return decode_valid_window (window)->hchild;
 }
 
 DEFUN ("window-next-sibling", Fwindow_next_sibling, Swindow_next_sibling, 0, 1, 0,
@@ -458,7 +474,7 @@
 Return nil if WINDOW has no next sibling.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->next;
+  return decode_valid_window (window)->next;
 }
 
 DEFUN ("window-prev-sibling", Fwindow_prev_sibling, Swindow_prev_sibling, 0, 1, 0,
@@ -467,7 +483,7 @@
 Return nil if WINDOW has no previous sibling.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->prev;
+  return decode_valid_window (window)->prev;
 }
 
 DEFUN ("window-combination-limit", Fwindow_combination_limit, Swindow_combination_limit, 1, 1, 0,
@@ -477,7 +493,7 @@
 WINDOW are never \(re-)combined with WINDOW's siblings.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->combination_limit;
+  return decode_valid_window (window)->combination_limit;
 }
 
 DEFUN ("set-window-combination-limit", Fset_window_combination_limit, Sset_window_combination_limit, 2, 2, 0,
@@ -488,7 +504,7 @@
 for future use.  */)
   (Lisp_Object window, Lisp_Object limit)
 {
-  register struct window *w = decode_any_window (window);
+  register struct window *w = decode_valid_window (window);
   w->combination_limit = limit;
   return w->combination_limit;
 }
@@ -516,7 +532,7 @@
 integer multiple of the default character height.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->total_lines;
+  return decode_valid_window (window)->total_lines;
 }
 
 DEFUN ("window-total-width", Fwindow_total_width, Swindow_total_width, 0, 1, 0,
@@ -531,7 +547,7 @@
 integer multiple of the default character width.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->total_cols;
+  return decode_valid_window (window)->total_cols;
 }
 
 DEFUN ("window-new-total", Fwindow_new_total, Swindow_new_total, 0, 1, 0,
@@ -539,7 +555,7 @@
 If WINDOW is omitted or nil, it defaults to the selected window.   */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->new_total;
+  return decode_valid_window (window)->new_total;
 }
 
 DEFUN ("window-normal-size", Fwindow_normal_size, Swindow_normal_size, 0, 2, 0,
@@ -549,9 +565,9 @@
   (Lisp_Object window, Lisp_Object horizontal)
 {
   if (NILP (horizontal))
-    return decode_any_window (window)->normal_lines;
+    return decode_valid_window (window)->normal_lines;
   else
-    return decode_any_window (window)->normal_cols;
+    return decode_valid_window (window)->normal_cols;
 }
 
 DEFUN ("window-new-normal", Fwindow_new_normal, Swindow_new_normal, 0, 1, 0,
@@ -559,7 +575,7 @@
 If WINDOW is omitted or nil, it defaults to the selected window.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->new_normal;
+  return decode_valid_window (window)->new_normal;
 }
 
 DEFUN ("window-left-column", Fwindow_left_column, Swindow_left_column, 0, 1, 0,
@@ -571,7 +587,7 @@
 If WINDOW is omitted or nil, it defaults to the selected window.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->left_col;
+  return decode_valid_window (window)->left_col;
 }
 
 DEFUN ("window-top-line", Fwindow_top_line, Swindow_top_line, 0, 1, 0,
@@ -583,7 +599,7 @@
 If WINDOW is omitted or nil, it defaults to the selected window.  */)
   (Lisp_Object window)
 {
-  return decode_any_window (window)->top_line;
+  return decode_valid_window (window)->top_line;
 }
 
 /* Return the number of lines of W's body.  Don't count any mode or
@@ -751,7 +767,7 @@
 just the text area, use `window-inside-edges'.  */)
   (Lisp_Object window)
 {
-  register struct window *w = decode_any_window (window);
+  register struct window *w = decode_valid_window (window);
 
   return Fcons (make_number (WINDOW_LEFT_EDGE_COL (w)),
 	 Fcons (make_number (WINDOW_TOP_EDGE_LINE (w)),
@@ -772,7 +788,7 @@
 of just the text area, use `window-inside-pixel-edges'.  */)
   (Lisp_Object window)
 {
-  register struct window *w = decode_any_window (window);
+  register struct window *w = decode_valid_window (window);
 
   return Fcons (make_number (WINDOW_LEFT_EDGE_X (w)),
 	 Fcons (make_number (WINDOW_TOP_EDGE_Y (w)),
@@ -816,7 +832,7 @@
 of just the text area, use `window-inside-absolute-pixel-edges'.  */)
   (Lisp_Object window)
 {
-  register struct window *w = decode_any_window (window);
+  register struct window *w = decode_valid_window (window);
   int add_x, add_y;
   calc_absolute_offset (w, &add_x, &add_y);
 
@@ -1700,7 +1716,7 @@
 elements of the form (PARAMETER . VALUE).  */)
   (Lisp_Object window)
 {
-  return Fcopy_alist (decode_any_window (window)->window_parameters);
+  return Fcopy_alist (decode_valid_window (window)->window_parameters);
 }
 
 DEFUN ("window-parameter", Fwindow_parameter, Swindow_parameter,
@@ -1711,7 +1727,7 @@
 {
   Lisp_Object result;
 
-  result = Fassq (parameter, decode_any_window (window)->window_parameters);
+  result = Fassq (parameter, decode_valid_window (window)->window_parameters);
   return CDR_SAFE (result);
 }
 
@@ -1721,7 +1737,7 @@
 WINDOW defaults to the selected window.  Return VALUE.  */)
   (Lisp_Object window, Lisp_Object parameter, Lisp_Object value)
 {
-  register struct window *w = decode_any_window (window);
+  register struct window *w = decode_valid_window (window);
   Lisp_Object old_alist_elt;
 
   old_alist_elt = Fassq (parameter, w->window_parameters);
@@ -2585,7 +2601,7 @@
   ptrdiff_t startpos IF_LINT (= 0);
   int top IF_LINT (= 0), new_top, resize_failed;
 
-  w = decode_any_window (window);
+  w = decode_valid_window (window);
   XSETWINDOW (window, w);
   f = XFRAME (w->frame);
 
@@ -2598,7 +2614,7 @@
   else
     /* ROOT must be an ancestor of WINDOW.  */
     {
-      r = decode_any_window (root);
+      r = decode_valid_window (root);
       pwindow = XWINDOW (window)->parent;
       while (!NILP (pwindow))
 	if (EQ (pwindow, root))
@@ -3325,7 +3341,7 @@
 Note: This function does not operate on any child windows of WINDOW.  */)
      (Lisp_Object window, Lisp_Object size, Lisp_Object add)
 {
-  struct window *w = decode_any_window (window);
+  struct window *w = decode_valid_window (window);
 
   CHECK_NUMBER (size);
   if (NILP (add))
@@ -3343,7 +3359,7 @@
 Note: This function does not operate on any child windows of WINDOW.  */)
      (Lisp_Object window, Lisp_Object size)
 {
-  struct window *w = decode_any_window (window);
+  struct window *w = decode_valid_window (window);
 
   w->new_normal = size;
   return w->new_normal;
@@ -6491,6 +6507,7 @@
   DEFSYM (Qwindowp, "windowp");
   DEFSYM (Qwindow_configuration_p, "window-configuration-p");
   DEFSYM (Qwindow_live_p, "window-live-p");
+  DEFSYM (Qwindow_valid_p, "window-valid-p");
   DEFSYM (Qwindow_deletable_p, "window-deletable-p");
   DEFSYM (Qdelete_window, "delete-window");
   DEFSYM (Qwindow_resize_root_window, "window--resize-root-window");

bug#11984: 24.1; segfault while deleting a window

[Eli Zaretskii]

> Date: Tue, 24 Jul 2012 14:46:46 +0200
> From: martin rudalics <rudalics@gmx.at>
> CC: Russell Sim <russell.sim@gmail.com>, 11984@debbugs.gnu.org, 
>  "eliz@gnu.org" <eliz@gnu.org>
> 
> I think `delete-window-internal' can keep its decode_any_window.  I'm
> not sure about `window-buffer'.  For the remainder, the attached patch
> should be applied IMO.  Eli can you check whether this interferes with
> tooltip creation?

If you built Emacs with the change, and tooltips work for you, then I
see no reason why they won't for me.

bug#11984: 24.1; segfault while deleting a window

[martin rudalics]

 > If you built Emacs with the change, and tooltips work for you,

How do I test it?  Is evaluating

(x-show-tip "???")

enough?

 > then I
 > see no reason why they won't for me.

Because tooltip frames appear fragile.  x_create_tip_frame uses

   Fset_window_buffer (FRAME_ROOT_WINDOW (f), buffer, Qnil);

while make_frame has

     /* Use set_window_buffer, not Fset_window_buffer, and don't let
        hooks be run by it.  The reason is that the whole frame/window
        arrangement is not yet fully initialized at this point.  Windows
        don't have the right size, glyph matrices aren't initialized
        etc.  Running Lisp functions at this point surely ends in a
        SEGV.  */
     set_window_buffer (root_window, buf, 0, 0);

Wouldn't the fact that the frame has not been set up completely when
assigning a buffer to its root window suggest that Fset_window_buffer
should not be used here either?

martin

bug#11984: 24.1; segfault while deleting a window

[Eli Zaretskii]

> Date: Wed, 25 Jul 2012 09:15:03 +0200
> From: martin rudalics <rudalics@gmx.at>
> CC: cyd@gnu.org, russell.sim@gmail.com, 11984@debbugs.gnu.org
> 
>  > If you built Emacs with the change, and tooltips work for you,
> 
> How do I test it?  Is evaluating
> 
> (x-show-tip "???")
> 
> enough?

Probably, but I find it easier to move the mouse pointer over some of
the mouse-sensitive areas of the display (tool bar, menu items, mode
line), each time waiting for the tooltip to pop up and then pop down
after a few seconds.

> Because tooltip frames appear fragile.  x_create_tip_frame uses
> 
>    Fset_window_buffer (FRAME_ROOT_WINDOW (f), buffer, Qnil);
> 
> while make_frame has
> 
>      /* Use set_window_buffer, not Fset_window_buffer, and don't let
>         hooks be run by it.  The reason is that the whole frame/window
>         arrangement is not yet fully initialized at this point.  Windows
>         don't have the right size, glyph matrices aren't initialized
>         etc.  Running Lisp functions at this point surely ends in a
>         SEGV.  */
>      set_window_buffer (root_window, buf, 0, 0);
> 
> Wouldn't the fact that the frame has not been set up completely when
> assigning a buffer to its root window suggest that Fset_window_buffer
> should not be used here either?

I know almost nothing about these intimate details.  Exactly what is
it that makes running the hooks safe, and when does it happen during
frame creation, is not documented anywhere, AFAICS.

So feel free to replace the call to Fset_window_buffer with
set_window_buffer, if you think that's more appropriate.

bug#11984: 24.1; segfault while deleting a window

[martin rudalics]

 > Probably, but I find it easier to move the mouse pointer over some of
 > the mouse-sensitive areas of the display (tool bar, menu items, mode
 > line), each time waiting for the tooltip to pop up and then pop down
 > after a few seconds.

OK.  I asked because in your report you didn't give a detailed scenario
for how to reproduce the crash.

 > So feel free to replace the call to Fset_window_buffer with
 > set_window_buffer, if you think that's more appropriate.

I intend to replace all instances wherever I find them in C code.  Since
set_window_buffer does run_window_configuration_change_hook anyway and
IIUC we don't forbid that, the change won't fix much of the dilemma that
we run Lisp code on unfinished frames.  But Fset_window_buffer's extra
work is only wasted for minibuffers.

martin

bug#11984: 24.1; segfault while deleting a window

[martin rudalics]

 > I intend to replace all instances wherever I find them in C code.  Since
 > set_window_buffer does run_window_configuration_change_hook anyway and
 > IIUC we don't forbid that,

At least this remark is incorrect.  All Fset_window_buffer calls I found
forbid to run hooks.

 > the change won't fix much of the dilemma that
 > we run Lisp code on unfinished frames.

martin

bug#11984: 24.1; segfault while deleting a window

[martin rudalics]

> So feel free to replace the call to Fset_window_buffer with
> set_window_buffer, if you think that's more appropriate.

I've done that now.  Let's look at the consequences.

martin