bug#63614: 29.0.91; PGTK Emacs crashes after clearing the clipboard

[Po Lu via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>]

Leonardo Hernández Hernández <leohdz172@proton.me> writes:

>         event = 0x55d8dac3bc20 <kbd_buffer+1088>
>         copy = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0xdb87f650, requestor = 0x0, selection = 0x45, target = 0x0, property = 0x0, time = 0}
>         moved_events = <optimized out>
> #10 process_special_events () at keyboard.c:4449
>         event = 0x55d8dac3bc20 <kbd_buffer+1088>
>         copy = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0xdb87f650, requestor = 0x0, selection = 0x45, target = 0x0, property = 0x0, time = 0}
>         moved_events = <optimized out>
> #11 0x000055d8da521cbd in swallow_events (do_display=true) at keyboard.c:4489
>         old_timers_run = <optimized out>
> #12 0x000055d8da63da7c in wait_reading_process_output
>     (time_limit=<optimized out>, nsecs=<optimized out>, read_kbd=<optimized out>, do_display=<optimized out>, wait_for_cell=<optimized out>, wait_proc=<optimized out>, just_wait_proc=<optimized out>) at process.c:5781
>         leave = false
>         wrapped = <optimized out>
>         process_skipped = <optimized out>
>         channel_start = <optimized out>
>         child_fd = <optimized out>
>         channel = <optimized out>
>         nfds = <optimized out>
>         Available = {fds_bits = {16, 0 <repeats 15 times>}}
>         Writeok = {fds_bits = {0 <repeats 16 times>}}
>         check_write = true
>         check_delay = <optimized out>
>         no_avail = false
>         xerrno = 11
>         proc = <optimized out>
>         timeout = {tv_sec = 0, tv_nsec = 0}
>         end_time = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
>         timer_delay = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
>         got_output_end_time = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
>         wait = <optimized out>
>         got_some_output = <optimized out>
>         prev_wait_proc_nbytes_read = <optimized out>
>         retry_for_async = <optimized out>
>         count = {bytes = <optimized out>}
>         now = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
>         last_read_channel = -1
> #13 0x000055d8da41e3a0 in sit_for (timeout=<optimized out>, reading=<optimized out>, display_option=<optimized out>) at dispnew.c:6264
>         sec = 30
>         nsec = 0
>         do_display = <optimized out>
>         curbuf_eq_winbuf = true
>         nbytes = <optimized out>
> #14 0x000055d8da52a5c5 in read_char (commandflag=1, map=0x55d8dbdab6d3, prev_event=0x0, used_mouse_menu=0x7ffffcfef4fb, end_time=0x0) at keyboard.c:2881
>         delay_level = <optimized out>
>         buffer_size = <optimized out>
>         c = 0x0
>         local_getcjmp = {{__jmpbuf = {94389871329920, -4940312681896898891, 1, 140582085818120, 0, 94389890508307, -4940312682234540363, -1207467647118897483}, __mask_was_saved = 0, __saved_mask = {__val = {94389865389056, 94389889840131, 586, 2, 94389865403823, 140737437954896, 40080, 140737437954784, 0, 0, 140582085818125, 0, 94389889840131, 0, 146, 147}}}}
>         save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
>         tem = <optimized out>
>         save = <optimized out>
>         previous_echo_area_message = 0x0
>         also_record = 0x0
>         reread = false
>         recorded = false
>         polling_stopped_here = false
>         orig_kboard = 0x55d8db7facb0
> #15 0x000055d8da6d84b7 in read_key_sequence.constprop.0
>     (keybuf=<optimized out>, prevent_redisplay=false, fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, dont_downcase_last=<optimized out>, prompt=<optimized out>)
>     at keyboard.c:10083
>         interrupted_kboard = 0x55d8db7facb0
>         key = <optimized out>
>         used_mouse_menu = false
>         echo_local_start = 0
>         last_real_key_start = 0
>         keys_local_start = 0
>         new_binding = <optimized out>
>         t = 0
>         echo_start = 0
>         keys_start = 0
>         current_binding = 0x55d8dbdab6d3
>         first_unbound = 31
>         mock_input = 0
>         used_mouse_menu_history = {false <repeats 30 times>}
>         fkey = {parent = 0x55d8db691393, map = 0x55d8db691393, start = 0, end = 0}
>         keytran = {parent = 0x7fdbd1c0897b, map = 0x7fdbd1c0897b, start = 0, end = 0}
>         indec = {parent = 0x55d8db6913a3, map = 0x55d8db6913a3, start = 0, end = 0}
>         shift_translated = <optimized out>
>         delayed_switch_frame = <optimized out>
>         original_uppercase = <optimized out>
>         original_uppercase_position = <optimized out>
>         dummyflag = false
>         fake_prefixed_keys = 0x0
>         first_event = 0x0
>         second_event = <optimized out>
> #16 0x000055d8da51dc5a in command_loop_1 () at keyboard.c:1384
>         cmd = <optimized out>
>         keybuf = {0x5e, 0x55d8da5dc786 <eval_sub+1142>, 0x55d8db63e510, 0x55d8da63530c <exec_byte_code+508>, 0x0, 0x80, 0x0, 0x7fdbd190e738, 0x55d8da78c020 <main_thread.lto_priv>, 0x7fdbd1ce62b5, 0x55d8db6843c4, 0x0, 0x55d8da716314, 0x7fdbd6f01705, 0x53474e, 0x7fdbd5638400, 0x7ffffcfefaf0, 0xe90a45cb1b95ae00, 0x9510, 0x55d8da71cd60, 0x7ffffcfef7c0, 0x60, 0x55d8db6843c4, 0x0, 0x55d8da78c020 <main_thread.lto_priv>, 0x55d8da51b995 <top_level_2+725>, 0x55d8da716314, 0x7fdbd5638f12 <malloc+434>, 0x15, 0x30}
>         i = <optimized out>
>         prev_modiff = 31
>         prev_buffer = 0x7fdbd1497708
> #17 0x000055d8da5d6b67 in internal_condition_case (bfun=0x55d8da51d990 <command_loop_1>, handlers=<optimized out>, hfun=0x55d8da51b3f0 <cmd_error>) at eval.c:1474
>         val = <optimized out>
>         c = 0x55d8db688350
> #18 0x000055d8da51b6ae in command_loop_2 (handlers=handlers@entry=0x90) at keyboard.c:1133
>         val = <optimized out>
> #19 0x000055d8da5d6abc in internal_catch (tag=<optimized out>, func=0x55d8da51b680 <command_loop_2>, arg=0x90) at eval.c:1197
>         val = <optimized out>
>         c = 0x55d8db687de0
> #20 0x000055d8da51d479 in command_loop () at keyboard.c:1111
> #21 0x000055d8da70b9b0 in recursive_edit_1.isra.0 () at keyboard.c:720
>         val = <optimized out>
> #22 0x000055d8da51d95c in Frecursive_edit () at keyboard.c:803
>         buffer = <optimized out>
> #23 0x000055d8da411b9d in main (argc=<optimized out>, argv=0x7ffffcfefc08) at emacs.c:2529
>         stack_bottom_variable = 0x0
>         no_loadup = false
>         junk = 0x0
>         dname_arg = 0x0
>         ch_to_dir = 0x0
>         original_pwd = 0x0
>         dump_mode = <optimized out>
>         skip_args = 0
>         temacs = 0x0
>         attempt_load_pdump = <optimized out>
>         only_version = false
>         rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
>         lc_all = <optimized out>
>         sockfd = -1
>         module_assertions = <optimized out>
> (gdb) frame 8
> #8  0x000055d8da6bd059 in pgtk_handle_selection_clear (event=<optimized out>) at pgtkselect.c:742
> 742	 local_selection_data = LOCAL_SELECTION (selection_symbol, dpyinfo);
> (gdb) p *event
> value has been optimized out
> (gdb) frame 9
> #9  0x000055d8da520ab6 in pgtk_handle_selection_event (event=0x7ffffcfeea00) at pgtkselect.c:782
> 782	   pgtk_handle_selection_clear (event);
> (gdb) p *event
> $1 = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0xdb87f650, requestor = 0x0, selection = 0x45, target = 0x0, property = 0x0, time = 0}

I suppose what this shows is that an invalid SELECTION_CLEAR_EVENT has
somehow found its way in to the keyboard buffer.

We need to narrow down the scope of the problem.  If you comment out the
entirety of `process_special_events', does the crash still occur?