bug#74902: 31.0.50; Segfault when deleting frames

bug#74902: 31.0.50; Segfault when deleting frames

[Steven Allen via Bug reports for GNU Emacs, the Swiss army knife of text editors]

I use EXWM and, Emacs very occasionally seems to crash when closing
floating windows. Specifically, it crashes when deleting the frame
wrapping the floating window. Unfortunately, I don't have a great way to
reproduce it with a minimal setup or to reproduce it reliably enough to
grab a trace with GDB.

As far as I can tell, this is because `delete-frame' calls `delq' (from
C) which then handles a signal (not sure what signal) via the
`FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
eventually calls `gobble_input' which operates on frames.


Backtrace:

    /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
    /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
    /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
    /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
    /usr/bin/emacs(+0xeff78) [0x61e779237f78]
    /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
    /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
    /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
    /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
    /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
    /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
    /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
    /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
    /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]
    /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-9789f41c/preloaded/window-0d1b8b93-5fc421c3.eln(F77696e646f772d2d64656c657465_window__delete_0+0xf6) [0x7e3a500879e6]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-9789f41c/preloaded/window-0d1b8b93-5fc421c3.eln(F7265706c6163652d6275666665722d696e2d77696e646f7773_replace_buffer_in_windows_0+0x2fb) [0x7e3a5008893b]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/emacs(Fkill_buffer+0x179) [0x61e779367229]
    /home/steb/.config/emacs/eln-cache/31.0.50-9789f41c/exwm-manage-481a2a54-f343330e.eln(F616e6f6e796d6f75732d6c616d626461_anonymous_lambda_20+0x72) [0x7e3a48615462]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/emacs(Fapply+0x464) [0x61e7793ec0f4]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-9789f41c/preloaded/timer-3ee7cfd9-4017b895.eln(F74696d65722d6576656e742d68616e646c6572_timer_event_handler_0+0x408) [0x7e3a4fa48468]
    /usr/bin/emacs(Ffuncall+0x107) [0x61e7793fb617]
    /usr/bin/emacs(timer_check+0x4de) [0x61e779331bce]
    /usr/bin/emacs(+0x3d325b) [0x61e77951b25b]
    /usr/bin/emacs(read_char+0x1c8f) [0x61e779339e0f]
    /usr/bin/emacs(+0x3c4c9e) [0x61e77950cc9e]
    /usr/bin/emacs(+0x1e60e3) [0x61e77932e0e3]
    /usr/bin/emacs(internal_condition_case+0x77) [0x61e7793eb237]
    /usr/bin/emacs(command_loop_2+0x2f) [0x61e77932d45f]
    /usr/bin/emacs(internal_catch+0x46) [0x61e7793eb176]
    /usr/bin/emacs(+0x1e58cb) [0x61e77932d8cb]
    /usr/bin/emacs(recursive_edit_1+0xf6) [0x61e77932da86]
    /usr/bin/emacs(Frecursive_edit+0x110) [0x61e77932dd30]
    /usr/bin/emacs(main+0x298b) [0x61e7791b9ecb]
    /usr/lib/libc.so.6(+0x2618e) [0x7e3a544c018e]
    /usr/lib/libc.so.6(__libc_start_main+0x8a) [0x7e3a544c024a]
    /usr/bin/emacs(_start+0x25) [0x61e7791ba695]

In GNU Emacs 31.0.50 (build 1, x86_64-pc-linux-gnu, cairo version
 1.18.2) of 2024-12-07 built on Laptop
Repository revision: 6f6b641975e4828f96913b29b1476c6323c952d8
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.12101014
System Description: Arch Linux

Configured using:
 'configure --prefix=/usr --sysconfdir=/etc --libexecdir=/usr/lib
 --localstatedir=/var --mandir=/usr/share/man --with-gameuser=:games
 --with-modules --without-m17n-flt --without-selinux --without-pop
 --without-gconf --disable-gc-mark-trace --enable-link-time-optimization
 --with-native-compilation=yes --with-xinput2 --with-x-toolkit=no
 --without-toolkit-scroll-bars --without-xft --without-xaw3d
 --without-gsettings --with-cairo-xcb --with-sound=no --with-tree-sitter
 --without-gpm --without-compress-install
 '--program-transform-name=s/\([ec]tags\)/\1.emacs/'
 'CFLAGS=-march=native -mtune=native -O3 -pipe -fno-plt -fexceptions
 -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security
 -fstack-clash-protection -fcf-protection -fomit-frame-pointer
 -fno-math-errno -fno-trapping-math -fno-math-errno -fno-trapping-math
 -flto=auto' 'LDFLAGS=-Wl,-O1 -Wl,--sort-common -Wl,--as-needed
 -Wl,-z,relro -Wl,-z,now -Wl,-z,pack-relative-relocs -flto=auto''

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS HARFBUZZ JPEG LCMS2 LIBOTF
LIBSYSTEMD LIBXML2 MODULES NATIVE_COMP NOTIFY INOTIFY OLDXMENU PDUMPER
PNG RSVG SECCOMP SQLITE3 THREADS TIFF TREE_SITTER WEBP X11 XDBE XIM
XINPUT2 XPM ZLIB

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: journalctl

Minor modes in effect:
  notmuch-bookmarks-mode: t
  windmove-mode: t
  global-atomic-chrome-edit-mode: t
  iwd-agent-mode: t
  i3bar-mode: t
  ednc-mode: t
  exwm-xsettings-mode: t
  exwm-background-mode: t
  exwm-systemtray-mode: t
  exwm-randr-mode: t
  auto-compile-on-load-mode: t
  auto-compile-on-save-mode: t
  save-place-mode: t
  savehist-mode: t
  openwith-mode: t
  org-super-agenda-mode: t
  global-org-modern-mode: t
  eat-eshell-mode: t
  magit-todos-mode: t
  global-git-commit-mode: t
  magit-auto-revert-mode: t
  server-mode: t
  recentf-mode: t
  global-treesit-auto-mode: t
  editorconfig-mode: t
  yas-global-mode: t
  yas-minor-mode: t
  async-bytecomp-package-mode: t
  sudo-edit-indicator-mode: t
  global-auto-revert-mode: t
  vertico-mode: t
  corfu-popupinfo-mode: t
  global-corfu-mode: t
  corfu-mode: t
  minibuffer-depth-indicate-mode: t
  minibuffer-electric-default-mode: t
  isearch-mb-mode: t
  pixel-scroll-precision-mode: t
  global-hl-todo-mode: t
  all-the-icons-completion-mode: t
  marginalia-mode: t
  visual-replace-global-mode: t
  global-jinx-mode: t
  evil-goggles-mode: t
  global-evil-surround-mode: t
  evil-surround-mode: t
  global-evil-collection-unimpaired-mode: t
  evil-collection-unimpaired-mode: t
  evil-mode: t
  evil-local-mode: t
  desktop-environment-mode: t
  global-eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tab-bar-history-mode: t
  tab-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  window-divider-mode: t
  minibuffer-regexp-mode: t
  column-number-mode: t
  line-number-mode: t
  visual-line-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
/home/steb/.cache/emacs/elpa/filechooser-0.2.1/filechooser hides /usr/share/emacs/site-lisp/filechooser
/home/steb/.cache/emacs/elpa/filechooser-0.2.1/filechooser-autoloads hides /usr/share/emacs/site-lisp/filechooser-autoloads
/home/steb/.cache/emacs/elpa/protobuf-mode-20240823.1417/protobuf-mode hides /usr/share/emacs/site-lisp/protobuf-mode
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch hides /usr/share/emacs/site-lisp/notmuch
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-wash hides /usr/share/emacs/site-lisp/notmuch-wash
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-tree hides /usr/share/emacs/site-lisp/notmuch-tree
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-tag hides /usr/share/emacs/site-lisp/notmuch-tag
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-show hides /usr/share/emacs/site-lisp/notmuch-show
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-query hides /usr/share/emacs/site-lisp/notmuch-query
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-print hides /usr/share/emacs/site-lisp/notmuch-print
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-parser hides /usr/share/emacs/site-lisp/notmuch-parser
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-mua hides /usr/share/emacs/site-lisp/notmuch-mua
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-message hides /usr/share/emacs/site-lisp/notmuch-message
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-maildir-fcc hides /usr/share/emacs/site-lisp/notmuch-maildir-fcc
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-lib hides /usr/share/emacs/site-lisp/notmuch-lib
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-jump hides /usr/share/emacs/site-lisp/notmuch-jump
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-hello hides /usr/share/emacs/site-lisp/notmuch-hello
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-draft hides /usr/share/emacs/site-lisp/notmuch-draft
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-crypto hides /usr/share/emacs/site-lisp/notmuch-crypto
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-compat hides /usr/share/emacs/site-lisp/notmuch-compat
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-company hides /usr/share/emacs/site-lisp/notmuch-company
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/notmuch-address hides /usr/share/emacs/site-lisp/notmuch-address
/home/steb/.cache/emacs/elpa/notmuch-20240816.2039/coolj hides /usr/share/emacs/site-lisp/coolj
/home/steb/.cache/emacs/elpa/modus-themes-4.6.0/theme-loaddefs hides /usr/share/emacs/31.0.50/lisp/theme-loaddefs

Features:
(shadow sort mail-extr emacsbug mule-util tramp-cmds cc-mode cc-fonts
cc-guess cc-menus cc-cmds consult-xref evil-collection-eglot eglot
external-completion jsonrpc evil-collection-ert ert ewoc
evil-collection-debug debug backtrace rainbow-delimiters vc
evil-collection-flymake flymake c++-ts-mode c-ts-mode c-ts-common
evil-collection-consult consult magit-bookmark org-bookmark-heading
notmuch-bookmarks evil-collection-bookmark bookmark texinfo
texinfo-loaddefs evil-collection-vc-git vc-git vc-dispatcher misearch
multi-isearch vertico-repeat windmove journalctl bash-completion
eshell-syntax-highlighting em-elecslash em-glob em-extpipe em-basic
em-alias pinentry evil-collection-atomic-chrome atomic-chrome websocket
bindat let-alist iwd i3bar ednc filechooser dbus exwm-xsettings
xcb-xsettings exwm-background exwm-systemtray xcb-systemtray xcb-xembed
exwm-randr xcb-randr exwm exwm-input xcb-keysyms xcb-xkb exwm-manage
exwm-floating xcb-cursor xcb-render exwm-layout exwm-workspace exwm-core
xcb-ewmh xcb-icccm xcb xcb-xproto xcb-types xcb-debug cus-start posframe
visual-wrap face-remap visual-fill-column ligature evil-org corg
org-appear ws-butler oc-basic bibtex ol-man ol-info ol-docview
evil-collection-doc-view doc-view jka-compr evil-collection-image
image-mode exif auto-compile show-font saveplace tramp-cache time-stamp
savehist openwith org-super-agenda ts ht org-habit org-crypt
org-protocol ox-typst ox-odt rng-loc rng-uri rng-parse rng-match rng-dt
rng-util rng-pttrn nxml-parse nxml-ns nxml-enc xmltok nxml-util ox-latex
ox-icalendar evil-org-agenda org-agenda ox-html table ox-ascii
ox-publish ox org-attach org-element org-persist org-id org-refile
org-element-ast inline avl-tree ob-http ob-http-mode org-modern ob-dot
ob-latex ob-python evil-collection-python python ob-gnuplot ob-calc
calc-store calc-trail calc-ext evil-collection-calc calc calc-loaddefs
calc-macs ob-shell evil-collection-org org ob ob-tangle ob-ref ob-lob
ob-table ob-exp org-macro evil-collection-xref xref org-src
evil-collection-sh-script sh-script smie executable ob-comint
org-pcomplete org-list org-footnote org-faces org-entities
evil-collection-outline noutline outline ob-emacs-lisp ob-core ob-eval
org-cycle org-table ol org-fold org-fold-core org-keys oc org-loaddefs
org-compat org-version org-macs notmuch-addr evil-collection-notmuch
notmuch notmuch-tree notmuch-jump notmuch-hello notmuch-show
notmuch-print notmuch-crypto notmuch-mua notmuch-message notmuch-draft
notmuch-maildir-fcc notmuch-address notmuch-company notmuch-parser
notmuch-wash coolj goto-addr icalendar diary-lib diary-loaddefs
evil-collection-calendar cal-menu calendar cal-loaddefs notmuch-tag
notmuch-lib notmuch-compat hl-line mm-view mml-smime smime gnutls dig
eshell-prompt-extras em-dirs em-ls em-prompt em-hist em-unix em-pred
esh-mode esh-var evil-collection-eat eat evil-collection-term term
disp-table ehelp eshell esh-cmd generator esh-ext esh-proc esh-opt
esh-io esh-arg esh-module esh-module-loaddefs esh-util forge-core
forge-db closql emacsql-sqlite emacsql emacsql-compiler eieio-base
evil-collection-magit-todos magit-todos pcre2el rxt advice re-builder
evil-collection-grep grep evil-collection-compile compile pcase
evil-collection-magit magit-submodule magit-blame magit-stash
magit-reflog magit-bisect magit-push magit-pull magit-fetch magit-clone
magit-remote magit-commit magit-sequence magit-notes magit-worktree
magit-tag magit-merge magit-branch magit-reset magit-files magit-refs
magit-status magit evil-collection-magit-repos magit-repos magit-apply
magit-wip magit-log which-func evil-collection-imenu imenu magit-diff
evil-collection-smerge-mode smerge-mode diff diff-mode track-changes
git-commit evil-collection-log-edit log-edit message sendmail yank-media
puny evil-collection-dired dired dired-loaddefs rfc822 mml mml-sec
evil-collection-epa epa derived epg rfc6068 epg-config gnus-util
text-property-search mm-decode mm-bodies mm-encode mail-parse rfc2231
rfc2047 rfc2045 mm-util ietf-drums mail-prsvr mailabbrev mail-utils
gmm-utils mailheader pcvs-util add-log magit-core magit-autorevert
magit-margin magit-transient magit-process evil-collection-with-editor
with-editor server magit-mode transient benchmark magit-git magit-base
evil-collection-magit-section magit-section cursor-sensor crm tramp-sh
recentf tree-widget easy-mmode treesit-auto editorconfig
editorconfig-core editorconfig-core-handle editorconfig-fnmatch
yasnippet async-bytecomp async sudo-edit tramp trampver
tramp-integration files-x tramp-message tramp-compat shell pcomplete
evil-collection-comint comint ansi-osc parse-time iso8601 time-date
format-spec ansi-color tramp-loaddefs autorevert filenotify project
vertico corfu-popupinfo evil-collection-corfu corfu orderless mb-depth
minibuf-eldef isearch-mb pixel-scroll cua-base hl-todo
all-the-icons-completion all-the-icons all-the-icons-faces
all-the-icons-data-material-icons
all-the-icons-data-fluentui-system-icons
all-the-icons-data-fontawesome-4 all-the-icons-data-weather-icons
all-the-icons-data-vscode-codicons all-the-icons-data-octicons
all-the-icons-data-mfixx all-the-icons-data-file-icons
all-the-icons-data-devopicons all-the-icons-data-alltheicons svg dom xml
marginalia modus-vivendi-theme modus-themes visual-replace ispell jinx
evil-goggles pulse color evil-textobj-tree-sitter
evil-textobj-tree-sitter-thing-at-point evil-textobj-tree-sitter-core
treesit evil-args evil-surround evil-collection-unimpaired
evil-collection-tabulated-list evil-collection-tab-bar
evil-collection-simple evil-collection-replace
evil-collection-process-menu evil-collection-package-menu
evil-collection-kmacro evil-collection-info evil-collection-indent
evil-collection-help evil-collection-elisp-mode evil-collection-eldoc
evil-collection-custom evil-collection-buff-menu evil-collection
annalist evil evil-integration evil-maps evil-commands reveal evil-jumps
evil-command-window evil-types evil-search evil-ex evil-macros
evil-repeat evil-states evil-core comp-run evil-common thingatpt rect
evil-vars ring edmacro kmacro general f dash s mode-local find-func
no-littering compat finder-inf notmuch-version info
all-the-icons-completion-autoloads all-the-icons-dired-autoloads
all-the-icons-ibuffer-autoloads all-the-icons-autoloads
app-launcher-autoloads aria2-autoloads atomic-chrome-autoloads
auto-compile-autoloads bash-completion-autoloads bluetooth-autoloads
buffer-move-autoloads calibre-autoloads cape-autoloads casual-autoloads
clojure-mode-autoloads comint-mime-autoloads consult-eglot-autoloads
consult-project-extra-autoloads corfu-autoloads corg-autoloads
csv-mode-autoloads dape-autoloads devdocs-autoloads
dired-filter-autoloads dired-hacks-utils-autoloads dired-k-autoloads
discomfort-autoloads debase-autoloads disk-usage-autoloads eat-autoloads
edit-indirect-autoloads ednc-autoloads eff-autoloads
embark-consult-autoloads consult-autoloads embark-autoloads
ement-autoloads eshell-prompt-extras-autoloads
eshell-syntax-highlighting-autoloads evil-args-autoloads
evil-collection-autoloads annalist-autoloads evil-goggles-autoloads
evil-nerd-commenter-autoloads evil-org-autoloads evil-surround-autoloads
evil-textobj-tree-sitter-autoloads evm-mode-autoloads
expand-region-autoloads exwm-autoloads filechooser-autoloads
flymake-ruff-autoloads forge-search-autoloads general-autoloads
git-link-autoloads git-modes-autoloads gnuplot-autoloads gptel-autoloads
graphviz-dot-mode-autoloads helpful-autoloads elisp-refs-autoloads
htmlize-autoloads i3bar-autoloads igist-autoloads info-colors-autoloads
isearch-mb-autoloads iwd-autoloads iwindow-autoloads jinx-autoloads
journalctl-autoloads kotlin-mode-autoloads kubernetes-evil-autoloads
evil-autoloads goto-chg-autoloads kubernetes-autoloads
ligature-autoloads link-hint-autoloads avy-autoloads
magit-popup-autoloads magit-todos-autoloads hl-todo-autoloads
f-autoloads marginalia-autoloads mastodon-autoloads mathjax-autoloads
microdata-autoloads modus-themes-autoloads named-pipe-autoloads
nftables-mode-autoloads no-littering-autoloads notmuch-addr-autoloads
notmuch-transient-autoloads nov-autoloads esxml-autoloads kv-autoloads
ob-http-autoloads ol-notmuch-autoloads notmuch-autoloads
openwith-autoloads orderless-autoloads org-appear-autoloads
org-bookmark-heading-autoloads org-download-autoloads async-autoloads
org-modern-autoloads org-super-agenda-autoloads ht-autoloads
orgit-forge-autoloads orgit-autoloads forge-autoloads
markdown-mode-autoloads magit-autoloads ghub-autoloads closql-autoloads
emacsql-autoloads ox-typst-autoloads package-lint-flymake-autoloads
package-lint-autoloads password-store-autoloads pcre2el-autoloads
pdf-tools-autoloads persist-autoloads pinentry-autoloads
pkgbuild-mode-autoloads playerctl-autoloads plz-autoloads
posframe-autoloads proced-narrow-autoloads protobuf-mode-autoloads
pulseaudio-control-autoloads qrencode-autoloads
rainbow-delimiters-autoloads rainbow-mode-autoloads request-autoloads
rg-autoloads rmsbolt-autoloads rust-playground-autoloads
show-font-autoloads solidity-mode-autoloads ssh-config-mode-autoloads
sudo-edit-autoloads svg-lib-autoloads syncthing-autoloads
systemctl-autoloads systemd-autoloads tablist-autoloads
taxy-magit-section-autoloads taxy-autoloads magit-section-autoloads
tmr-autoloads tp-autoloads treepy-autoloads treesit-auto-autoloads
ts-autoloads s-autoloads dash-autoloads tzc-autoloads
udev-mode-autoloads vala-mode-autoloads cc-styles cc-align cc-engine
cc-vars cc-defs varuga-autoloads vertico-autoloads vimrc-mode-autoloads
visual-fill-column-autoloads visual-replace-autoloads vundo-autoloads
wat-ts-mode-autoloads watch-autoloads web-mode-autoloads
websocket-autoloads wgrep-autoloads whisper-autoloads
with-editor-autoloads ws-butler-autoloads xelb-autoloads yaml-autoloads
yasnippet-autoloads comp comp-cstr cl-extra help-mode comp-common
warnings rx xdg package browse-url url url-proxy url-privacy url-expand
url-methods url-history url-cookie generate-lisp-file url-domsuf
url-util mailcap url-handlers url-parse auth-source cl-seq eieio
eieio-core cl-macs password-cache json subr-x map byte-opt gv bytecomp
byte-compile url-vars cus-edit pp cus-load icons wid-edit cl-loaddefs
cl-lib rmc iso-transl tooltip cconv eldoc paren electric uniquify
ediff-hook vc-hooks lisp-float-type elisp-mode mwheel term/x-win x-win
term/common-win x-dnd touch-screen tool-bar dnd fontset image regexp-opt
fringe tabulated-list replace newcomment text-mode lisp-mode prog-mode
register page tab-bar menu-bar rfn-eshadow isearch easymenu timer select
scroll-bar mouse jit-lock font-lock syntax font-core term/tty-colors
frame minibuffer nadvice seq simple cl-generic indonesian philippine
cham georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese composite emoji-zwj charscript
charprop case-table epa-hook jka-cmpr-hook help abbrev obarray oclosure
cl-preloaded button loaddefs theme-loaddefs faces cus-face macroexp
files window text-properties overlay sha1 md5 base64 format env
code-pages mule custom widget keymap hashtable-print-readable backquote
threads dbusbind inotify lcms2 dynamic-setting font-render-setting cairo
xinput2 x multi-tty move-toolbar make-network-process native-compile
emacs)

Memory information:
((conses 16 1395639 980414) (symbols 48 71688 3) (strings 32 377983 67952) (string-bytes 1 11865296)
 (vectors 16 132134) (vector-slots 8 1522623 421201) (floats 8 742 4321) (intervals 56 43580 33010)
 (buffers 992 35))

bug#74902: 31.0.50; Segfault when deleting frames

[Eli Zaretskii]

> Date: Sun, 15 Dec 2024 14:01:17 -0800
> From:  Steven Allen via "Bug reports for GNU Emacs,
>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
> 
> 
> I use EXWM and, Emacs very occasionally seems to crash when closing
> floating windows. Specifically, it crashes when deleting the frame
> wrapping the floating window. Unfortunately, I don't have a great way to
> reproduce it with a minimal setup or to reproduce it reliably enough to
> grab a trace with GDB.
> 
> As far as I can tell, this is because `delete-frame' calls `delq' (from
> C) which then handles a signal (not sure what signal) via the
> `FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
> eventually calls `gobble_input' which operates on frames.
> 
> 
> Backtrace:
> 
>     /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
>     /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
>     /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
>     /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
>     /usr/bin/emacs(+0xeff78) [0x61e779237f78]
>     /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
>     /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
>     /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
>     /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
>     /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
>     /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
>     /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
>     /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
>     /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]

This is less useful than a backtrace could be.  Can you run Emacs
under GDB, and when it crashes, type

  (gdb) thread apply all bt

and post here everything GDB produces as result?

bug#74902: 31.0.50; Segfault when deleting frames

[Steven Allen via Bug reports for GNU Emacs, the Swiss army knife of text editors]

Eli Zaretskii <eliz@gnu.org> writes:

>> Date: Sun, 15 Dec 2024 14:01:17 -0800
>> From:  Steven Allen via "Bug reports for GNU Emacs,
>>  the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>
>> 
>> 
>> I use EXWM and, Emacs very occasionally seems to crash when closing
>> floating windows. Specifically, it crashes when deleting the frame
>> wrapping the floating window. Unfortunately, I don't have a great way to
>> reproduce it with a minimal setup or to reproduce it reliably enough to
>> grab a trace with GDB.
>> 
>> As far as I can tell, this is because `delete-frame' calls `delq' (from
>> C) which then handles a signal (not sure what signal) via the
>> `FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
>> eventually calls `gobble_input' which operates on frames.
>> 
>> 
>> Backtrace:
>> 
>>     /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
>>     /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
>>     /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
>>     /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
>>     /usr/bin/emacs(+0xeff78) [0x61e779237f78]
>>     /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
>>     /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
>>     /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
>>     /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
>>     /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
>>     /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
>>     /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
>>     /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
>>     /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]
>
> This is less useful than a backtrace could be.  Can you run Emacs
> under GDB, and when it crashes, type
>
>   (gdb) thread apply all bt
>
> and post here everything GDB produces as result?

Yeah, I agree. I'll do that if I can find a reliable way to reproduce
it. At the moment it happens once every few months.

bug#74902: 31.0.50; Segfault when deleting frames

[Robert Pluim]

>>>>> On Mon, 16 Dec 2024 08:12:46 -0800, Steven Allen via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org> said:

    Steven> Eli Zaretskii <eliz@gnu.org> writes:
    >>> As far as I can tell, this is because `delete-frame' calls `delq' (from
    >>> C) which then handles a signal (not sure what signal) via the
    >>> `FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
    >>> eventually calls `gobble_input' which operates on frames.
    >>> 
    >>> 
    >>> Backtrace:
    >>> 
    >>> /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
    >>> /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
    >>> /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
    >>> /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
    >>> /usr/bin/emacs(+0xeff78) [0x61e779237f78]
    >>> /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
    >>> /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
    >>> /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
    >>> /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
    >>> /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
    >>> /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
    >>> /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
    >>> /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
    >>> /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]
    >> 
    >> This is less useful than a backtrace could be.  Can you run Emacs
    >> under GDB, and when it crashes, type
    >> 
    >> (gdb) thread apply all bt
    >> 
    >> and post here everything GDB produces as result?

    Steven> Yeah, I agree. I'll do that if I can find a reliable way to reproduce
    Steven> it. At the moment it happens once every few months.

If you do find a reproducer, then based on the trace above I think the
following should fix it:

diff --git a/src/frame.c b/src/frame.c
index f6053fca3ef..ff9e1d24ea1 100644
--- a/src/frame.c
+++ b/src/frame.c
@@ -2281,7 +2281,9 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
   delete_all_child_windows (f->root_window);
   fset_root_window (f, Qnil);
 
+  block_input();
   Vframe_list = Fdelq (frame, Vframe_list);
+  unblock_input();
   SET_FRAME_VISIBLE (f, 0);
 
   /* Allow the vector of menu bar contents to be freed in the next





Robert
-- 

bug#74902: 31.0.50; Segfault when deleting frames

[Eli Zaretskii]

> From: Robert Pluim <rpluim@gmail.com>
> Cc: Steven Allen <steven@stebalien.com>,  74902@debbugs.gnu.org
> Date: Mon, 16 Dec 2024 18:20:34 +0100
> 
> >>>>> On Mon, 16 Dec 2024 08:12:46 -0800, Steven Allen via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org> said:
> 
>     Steven> Eli Zaretskii <eliz@gnu.org> writes:
>     >>> As far as I can tell, this is because `delete-frame' calls `delq' (from
>     >>> C) which then handles a signal (not sure what signal) via the
>     >>> `FOR_EACH_TAIL' macro while deleting the frame. Unfortunately, that
>     >>> eventually calls `gobble_input' which operates on frames.
>     >>> 
>     >>> 
>     >>> Backtrace:
>     >>> 
>     >>> /usr/bin/emacs(emacs_backtrace+0x4e) [0x61e77935447e]
>     >>> /usr/bin/emacs(terminate_due_to_signal+0xaf) [0x61e7791a4c5d]
>     >>> /usr/bin/emacs(+0x5e062) [0x61e7791a6062]
>     >>> /usr/lib/libc.so.6(+0x42150) [0x7e3a544dc150]
>     >>> /usr/bin/emacs(+0xeff78) [0x61e779237f78]
>     >>> /usr/bin/emacs(+0x19a564) [0x61e7792e2564]
>     >>> /usr/bin/emacs(+0x19a829) [0x61e7792e2829]
>     >>> /usr/bin/emacs(+0x1a1c58) [0x61e7792e9c58]
>     >>> /usr/bin/emacs(+0x1b0bb8) [0x61e7792f8bb8]
>     >>> /usr/bin/emacs(gobble_input+0x272) [0x61e77933f3a2]
>     >>> /usr/bin/emacs(probably_quit+0xc6) [0x61e7793ec666]
>     >>> /usr/bin/emacs(Fdelq+0xb6) [0x61e77940c196]
>     >>> /usr/bin/emacs(delete_frame+0x2d4) [0x61e7791d77b4]
>     >>> /usr/bin/emacs(Fdelete_frame+0x17) [0x61e7791d8a07]
>     >> 
>     >> This is less useful than a backtrace could be.  Can you run Emacs
>     >> under GDB, and when it crashes, type
>     >> 
>     >> (gdb) thread apply all bt
>     >> 
>     >> and post here everything GDB produces as result?
> 
>     Steven> Yeah, I agree. I'll do that if I can find a reliable way to reproduce
>     Steven> it. At the moment it happens once every few months.
> 
> If you do find a reproducer, then based on the trace above I think the
> following should fix it:
> 
> diff --git a/src/frame.c b/src/frame.c
> index f6053fca3ef..ff9e1d24ea1 100644
> --- a/src/frame.c
> +++ b/src/frame.c
> @@ -2281,7 +2281,9 @@ delete_frame (Lisp_Object frame, Lisp_Object force)
>    delete_all_child_windows (f->root_window);
>    fset_root_window (f, Qnil);
>  
> +  block_input();
>    Vframe_list = Fdelq (frame, Vframe_list);
> +  unblock_input();
>    SET_FRAME_VISIBLE (f, 0);
>  
>    /* Allow the vector of menu bar contents to be freed in the next

Robert, I think you should install this on the master branch.

Thanks.

bug#74902: 31.0.50; Segfault when deleting frames

[Steven Allen via Bug reports for GNU Emacs, the Swiss army knife of text editors]

[-- Attachment #1: Type: text/plain, Size: 102 bytes --]


I was able to get a GDB backtrace after some button mashing. Let me know
if you need anything else.


[-- Attachment #2: GDB Backtrace --]
[-- Type: text/plain, Size: 5052 bytes --]

#0  format_mode_line_unwind_data (target_frame=target_frame@entry=0x58a7d5394680, obuf=<optimized out>, owin=<optimized out>, save_proptrans=save_proptrans@entry=false) at ../../src/xdisp.c:13716
#1  0x000058a7c8feb3c6 in gui_consider_frame_title (frame=XIL(0x58a7d5394685)) at ../../src/xdisp.c:13910
#2  0x000058a7c90d6b89 in SET_FRAME_ICONIFIED (f=0x58a7d5394680, i=1) at ../../src/frame.h:1468
#3  handle_one_xevent (dpyinfo=<optimized out>, event=<optimized out>, finish=0x7ffe4f3c8c3c, hold_quit=<optimized out>) at ../../src/xterm.c:20090
#4  0x000058a7c90e40b8 in XTread_socket (terminal=<optimized out>, hold_quit=0x7ffe4f3c8d60) at ../../src/xterm.c:25738
#5  0x000058a7c912a962 in gobble_input () at ../../src/keyboard.c:7922
#6  0x000058a7c91d7da6 in handle_async_input () at ../../src/keyboard.c:8161
#7  process_pending_signals () at ../../src/keyboard.c:8175
#8  probably_quit () at ../../src/eval.c:1788
#9  0x000058a7c91f7826 in maybe_quit () at ../../src/lisp.h:3956
#10 Fdelq (elt=XIL(0x58a7d5394685), list=<optimized out>) at ../../src/fns.c:2098
#11 0x000058a7c8fbd444 in delete_frame (frame=XIL(0x58a7d5394685), force=XIL(0)) at ../../src/frame.c:2500
#12 0x000058a7c8fbe6c7 in Fdelete_frame (frame=<optimized out>, force=<optimized out>) at ../../src/frame.c:2743
#13 0x000071768fefb9e6 in F77696e646f772d2d64656c657465_window__delete_0 () from /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-523952f2/preloaded/window-0d1b8b93-d9709ebc.eln
#14 0x000058a7c91e6d57 in Ffuncall (nargs=4, args=0x7ffe4f3c90f0) at ../../src/eval.c:3079
#15 0x000071768fefc93b in F7265706c6163652d6275666665722d696e2d77696e646f7773_replace_buffer_in_windows_0 () from /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-523952f2/preloaded/window-0d1b8b93-d9709ebc.eln
#16 0x000058a7c91e6d57 in Ffuncall (nargs=2, args=0x7ffe4f3c91b0) at ../../src/eval.c:3079
#17 0x000058a7c91528e9 in replace_buffer_in_windows (buffer=XIL(0x58a7d89b4565)) at ../../src/window.c:3647
#18 replace_buffer_in_windows (buffer=XIL(0x58a7d89b4565)) at ../../src/window.c:3642
#19 Fkill_buffer (buffer_or_name=<optimized out>) at ../../src/buffer.c:2012
#20 0x000071768b655462 in F616e6f6e796d6f75732d6c616d626461_anonymous_lambda_20 () from /home/steb/.config/emacs/eln-cache/31.0.50-523952f2/exwm-manage-481a2a54-1f060da2.eln
#21 0x000058a7c91e6d57 in Ffuncall (nargs=2, args=0x7ffe4f3c9360) at ../../src/eval.c:3079
#22 0x000058a7c91d7834 in Fapply (nargs=2, args=0x7ffe4f3c9360) at ../../src/eval.c:2708
#23 0x000058a7c91e6d57 in Ffuncall (nargs=3, args=0x7ffe4f3c9358) at ../../src/eval.c:3079
#24 0x000071768e47b468 in F74696d65722d6576656e742d68616e646c6572_timer_event_handler_0 () from /usr/bin/../lib/emacs/31.0.50/native-lisp/31.0.50-523952f2/preloaded/timer-3ee7cfd9-4017b895.eln
#25 0x000058a7c91e6d57 in Ffuncall (nargs=2, args=0x7ffe4f3c94a0) at ../../src/eval.c:3079
#26 0x000058a7c911d1ce in timer_check_2 (timers=<optimized out>, idle_timers=<optimized out>) at ../../src/keyboard.c:4804
#27 timer_check () at ../../src/keyboard.c:4869
#28 0x000058a7c930661b in wait_reading_process_output.constprop.1 (time_limit=<optimized out>, nsecs=<optimized out>, read_kbd=-1, do_display=true, just_wait_proc=<optimized out>, wait_proc=<optimized out>, wait_for_cell=<optimized out>) at ../../src/process.c:5446
#29 0x000058a7c8fb60e0 in sit_for (timeout=<optimized out>, reading=<optimized out>, display_option=<optimized out>) at ../../src/dispnew.c:6889
#30 0x000058a7c9127880 in read_char (commandflag=1, map=XIL(0x58a7d5e4b153), prev_event=make_fixnum(27), used_mouse_menu=0x7ffe4f3ca0eb, end_time=0x0) at ../../src/keyboard.c:2925
#31 0x000058a7c92f837e in read_key_sequence.constprop.0 (keybuf=keybuf@entry=0x7ffe4f3ca270, prevent_redisplay=prevent_redisplay@entry=false, disable_text_conversion_p=<optimized out>, fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, dont_downcase_last=<optimized out>, prompt=<optimized out>) at ../../src/keyboard.c:10746
#32 0x000058a7c91196e3 in command_loop_1 () at ../../src/keyboard.c:1424
#33 0x000058a7c91d6977 in internal_condition_case (bfun=0x58a7c91194c0 <command_loop_1>, handlers=<optimized out>, hfun=0x58a7c91166e0 <cmd_error>) at ../../src/eval.c:1607
#34 0x000058a7c9118a5f in command_loop_2 (handlers=handlers@entry=XIL(0x90)) at ../../src/keyboard.c:1163
#35 0x000058a7c91d68b6 in internal_catch (tag=<optimized out>, func=0x58a7c9118a30 <command_loop_2>, arg=XIL(0x90)) at ../../src/eval.c:1286
#36 0x000058a7c9118ecb in command_loop () at ../../src/keyboard.c:1141
#37 0x000058a7c9119086 in recursive_edit_1 () at ../../src/keyboard.c:749
#38 0x000058a7c9119330 in Frecursive_edit () at ../../src/keyboard.c:832
#39 0x000058a7c8fa3f8b in main (argc=<optimized out>, argv=<optimized out>) at ../../src/emacs.c:2625

Lisp Backtrace:
"window--delete" (0x4f3c90f8)
"replace-buffer-in-windows" (0x4f3c91b8)
0xcf2129c0 PVEC_SUBR
"apply" (0x4f3c9360)
"timer-event-handler" (0x4f3c94a8)
Detaching from program: /usr/bin/emacs-31.0.50, process 53461
[Inferior 1 (process 53461) detached]

bug#74902: 31.0.50; Segfault when deleting frames

[Eli Zaretskii]

> From: Steven Allen <steven@stebalien.com>
> Cc: 74902@debbugs.gnu.org
> Date: Sat, 28 Dec 2024 15:23:12 -0800
> 
> I was able to get a GDB backtrace after some button mashing. Let me know
> if you need anything else.
> 
> #0  format_mode_line_unwind_data (target_frame=target_frame@entry=0x58a7d5394680, obuf=<optimized out>, owin=<optimized out>, save_proptrans=save_proptrans@entry=false) at ../../src/xdisp.c:13716
> #1  0x000058a7c8feb3c6 in gui_consider_frame_title (frame=XIL(0x58a7d5394685)) at ../../src/xdisp.c:13910
> #2  0x000058a7c90d6b89 in SET_FRAME_ICONIFIED (f=0x58a7d5394680, i=1) at ../../src/frame.h:1468
> #3  handle_one_xevent (dpyinfo=<optimized out>, event=<optimized out>, finish=0x7ffe4f3c8c3c, hold_quit=<optimized out>) at ../../src/xterm.c:20090
> #4  0x000058a7c90e40b8 in XTread_socket (terminal=<optimized out>, hold_quit=0x7ffe4f3c8d60) at ../../src/xterm.c:25738
> #5  0x000058a7c912a962 in gobble_input () at ../../src/keyboard.c:7922
> #6  0x000058a7c91d7da6 in handle_async_input () at ../../src/keyboard.c:8161
> #7  process_pending_signals () at ../../src/keyboard.c:8175
> #8  probably_quit () at ../../src/eval.c:1788
> #9  0x000058a7c91f7826 in maybe_quit () at ../../src/lisp.h:3956
> #10 Fdelq (elt=XIL(0x58a7d5394685), list=<optimized out>) at ../../src/fns.c:2098
> #11 0x000058a7c8fbd444 in delete_frame (frame=XIL(0x58a7d5394685), force=XIL(0)) at ../../src/frame.c:2500

Thanks.  I guess we also need a FRAME_LIVE_P test in
gui_consider_frame_title?