bug#7016: Bug in Speedbar

bug#7016: Bug in Speedbar

[Glenn Morris]

Prashant Sachdeva wrote:

> 1. Edit in C++ mode.
> 2. Open speedbar.
> 3. When the cursor is on the "Variables" section, press space to open
> the menu and then space to close. Emacs crashes with a segmentation
> fault.
>
> I might add I am using semantic in C++ mode and sr-speedbar is also being used.

Please describe *exactly* what you did, starting from `emacs -Q'.
I have no "Variables" section in my speedbar, and I do not know what
sr-speedbar is.

Please also include the information from M-x report-emacs-bug about
your system and Emacs.

If you can run Emacs under gdb, try to get a backtrace from the crash.

bug#7016: Bug in Speedbar

[Prashant Sachdeva]

The easiest way to reproduce the bug is as follows:
1. Load emacs with "emacs -Q"
2. Open the file with the above code.
3. semantic-mode
4. global-linum-mode
5. Open speedbar
6. Go to 'quick buffers' display in speedbar
7. Press space on the .cpp file opened and then press space twice on
the Variables section.

I'm trying to narrow down the problem further, but to no success yet.
But surely, it has something to do with global-linum-mode, semantic
and speedbar.

Here is the system config.

------------------------------------------------------------------------------------------------------
In GNU Emacs 23.2.1 (i486-pc-linux-gnu, GTK+ Version 2.20.1)
 of 2010-09-02 on rutherfordium, modified by Debian
Windowing system distributor `The X.Org Foundation', version 11.0.10706000
configured using `configure  '--build=i486-linux-gnu'
'--host=i486-linux-gnu' '--prefix=/usr' '--sharedstatedir=/var/lib'
'--libexecdir=/usr/lib' '--localstatedir=/var/lib'
'--infodir=/usr/share/info' '--mandir=/usr/share/man' '--with-pop=yes'
'--enable-locallisppath=/etc/emacs23:/etc/emacs:/usr/local/share/emacs/23.2/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/23.2/site-lisp:/usr/share/emacs/site-lisp:/usr/share/emacs/23.2/leim'
'--with-x=yes' '--with-x-toolkit=gtk' '--with-toolkit-scroll-bars'
'build_alias=i486-linux-gnu' 'host_alias=i486-linux-gnu'
'CFLAGS=-DDEBIAN -g -O2' 'LDFLAGS=-g' 'CPPFLAGS=''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_IN
  value of $XMODIFIERS: nil
  locale-coding-system: iso-latin-1-unix
  default enable-multibyte-characters: t

Major mode: C++/l

Minor modes in effect:
  global-semanticdb-minor-mode: t
  semantic-idle-scheduler-mode: t
  semantic-mode: t
  global-linum-mode: t
  linum-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t
  abbrev-mode: t

-----------------------------------------------------------------------------------------------------

Could you please give me instructions on how exactly to run in gdb and
to get the trace. I'll do it as soon as possible.

-Prashant

On 15 September 2010 05:05, Glenn Morris <rgm@gnu.org> wrote:
> Prashant Sachdeva wrote:
>
>> 1. Edit in C++ mode.
>> 2. Open speedbar.
>> 3. When the cursor is on the "Variables" section, press space to open
>> the menu and then space to close. Emacs crashes with a segmentation
>> fault.
>>
>> I might add I am using semantic in C++ mode and sr-speedbar is also being used.
>
> Please describe *exactly* what you did, starting from `emacs -Q'.
> I have no "Variables" section in my speedbar, and I do not know what
> sr-speedbar is.
>
> Please also include the information from M-x report-emacs-bug about
> your system and Emacs.
>
> If you can run Emacs under gdb, try to get a backtrace from the crash.
>

bug#7016: Bug in Speedbar

[Glenn Morris]

Thanks, now I can reproduce it (in both emacs-23 and the trunk).
Here is the backtrace, hopefully this is useful to someone:


Program received signal SIGSEGV, Segmentation fault.
0x0000000000432761 in handle_face_prop (it=0x7fffffff3a10) at xdisp.c:3452
3452               : Qnil);

#0  0x0000000000432761 in handle_face_prop (it=0x7fffffff3a10) at xdisp.c:3452
#1  0x0000000000431c9c in handle_stop (it=0x7fffffff3a10) at xdisp.c:3098
#2  0x000000000043abb9 in next_element_from_string (it=0x7fffffff3a10)
    at xdisp.c:6238
#3  0x0000000000438a39 in get_next_display_element (it=0x7fffffff3a10)
    at xdisp.c:5649
#4  0x000000000043bd34 in move_it_in_display_line_to (it=0x7fffffff3a10, 
    to_charpos=326, to_x=0, op=9) at xdisp.c:6718
#5  0x000000000043d08e in move_it_to (it=0x7fffffff3a10, to_charpos=326, 
    to_x=-1, to_y=629, to_vpos=-1, op=10) at xdisp.c:7139
#6  0x000000000043dd0d in move_it_vertically (it=0x7fffffff3a10, dy=629)
    at xdisp.c:7450
#7  0x000000000047ad42 in Fwindow_end (window=24073989, update=12566274)
    at window.c:1228
#8  0x00000000005f8699 in Ffuncall (nargs=3, args=0x7fffffff42b8)
    at eval.c:3034
#9  0x0000000000650772 in Fbyte_code (bytestr=22627393, vector=23999493, 
    maxdepth=36) at bytecode.c:680
#10 0x00000000005f903b in funcall_lambda (fun=24000117, nargs=1, 
    arg_vector=0x7fffffff4828) at eval.c:3220
#11 0x00000000005f8985 in Ffuncall (nargs=2, args=0x7fffffff4820)
    at eval.c:3077
#12 0x00000000005f8021 in call1 (fn=23486466, arg1=24073989) at eval.c:2812
#13 0x0000000000604085 in mapcar1 (leni=1, vals=0x0, fn=23486466, seq=23769750)
    at fns.c:2472
#14 0x00000000006044f9 in Fmapc (function=23486466, sequence=23769750)
    at fns.c:2564
#15 0x00000000005f8699 in Ffuncall (nargs=3, args=0x7fffffff4a40)
    at eval.c:3034
#16 0x0000000000650772 in Fbyte_code (bytestr=22628097, vector=23972789, 
    maxdepth=24) at bytecode.c:680
#17 0x00000000005f903b in funcall_lambda (fun=23999061, nargs=1, 
    arg_vector=0x7fffffff4f88) at eval.c:3220
#18 0x00000000005f8985 in Ffuncall (nargs=2, args=0x7fffffff4f80)
    at eval.c:3077
#19 0x0000000000650772 in Fbyte_code (bytestr=22628833, vector=23764245, 
    maxdepth=8) at bytecode.c:680
#20 0x00000000005f903b in funcall_lambda (fun=23972549, nargs=0, 
    arg_vector=0x7fffffff5588) at eval.c:3220
#21 0x00000000005f8985 in Ffuncall (nargs=1, args=0x7fffffff5580)
    at eval.c:3077
#22 0x00000000005f7d9c in run_hook_with_args (nargs=1, args=0x7fffffff5580, 
    cond=to_completion) at eval.c:2690
#23 0x00000000005f7aca in Frun_hooks (nargs=1, args=0x7fffffff5678)
    at eval.c:2544
#24 0x00000000005f8509 in Ffuncall (nargs=2, args=0x7fffffff5670)
    at eval.c:3012
#25 0x00000000005f8021 in call1 (fn=12733730, arg1=12618130) at eval.c:2812
#26 0x00000000005513d9 in safe_run_hooks_1 (hook=140737488312128)
    at keyboard.c:2175
#27 0x00000000005f577d in internal_condition_case (
    bfun=0x55139a <safe_run_hooks_1>, handlers=12566274, 
    hfun=0x5513e3 <safe_run_hooks_error>) at eval.c:1492
#28 0x0000000000551486 in safe_run_hooks (hook=12618130) at keyboard.c:2203
#29 0x0000000000550571 in command_loop_1 () at keyboard.c:1922
#30 0x00000000005f577d in internal_condition_case (
    bfun=0x54e863 <command_loop_1>, handlers=12633362, 
    hfun=0x54e190 <cmd_error>) at eval.c:1492
#31 0x000000000054e582 in command_loop_2 () at keyboard.c:1359
#32 0x00000000005f512f in internal_catch (tag=12626178, 
    func=0x54e568 <command_loop_2>, arg=12566178) at eval.c:1228
#33 0x000000000054e53c in command_loop () at keyboard.c:1338
#34 0x000000000054dcd6 in recursive_edit_1 () at keyboard.c:953
#35 0x000000000054de79 in Frecursive_edit () at keyboard.c:1015
#36 0x000000000054c28e in main (argc=2, argv=0x7fffffff6398) at emacs.c:1833

Lisp Backtrace:
  "window-end" (0xffff42c0)
  "linum-update-window" (0xffff4828)
  "mapc" (0xffff4a48)
  "linum-update" (0xffff4f88)
  "linum-update-current" (0xffff5588)
  "run-hooks" (0xffff5678)



start of bt full:

#0  0x0000000000432761 in handle_face_prop (it=0x7fffffff3a10) at xdisp.c:3452
        base_face_id = 0
        bufpos = 12566178
        i = 0
        from_overlay = 0
        new_face_id = 1
        next_stop = 4407305
#1  0x0000000000431c9c in handle_stop (it=0x7fffffff3a10) at xdisp.c:3098
        handled = HANDLED_NORMALLY
        handle_overlay_change_p = 1
        p = 0x8e3c18
#2  0x000000000043abb9 in next_element_from_string (it=0x7fffffff3a10)
    at xdisp.c:6238
        position = {
          charpos = 0, 
          bytepos = 0
        }
#3  0x0000000000438a39 in get_next_display_element (it=0x7fffffff3a10)
    at xdisp.c:5649
        success_p = 1
#4  0x000000000043bd34 in move_it_in_display_line_to (it=0x7fffffff3a10, 
    to_charpos=326, to_x=0, op=9) at xdisp.c:6718
        x = 0
        i = 0
        ascent = 0
        descent = 0
        result = MOVE_UNDEFINED
        saved_glyph_row = 0x13b5380
        wrap_it = {

bug#7016: Bug in Speedbar

[Chong Yidong]

> The easiest way to reproduce the bug is as follows:
> 1. Load emacs with "emacs -Q"
> 2. Open the file with the above code.
> 3. semantic-mode
> 4. global-linum-mode
> 5. Open speedbar
> 6. Go to 'quick buffers' display in speedbar
> 7. Press space on the .cpp file opened and then press space twice on
> the Variables section.

Thank you for the concise recipe.  I've committed a fix, which will be
included in Emacs 23.3.