bug#75199: 30.0.93; Emacs crashes when completing with corfu

[Zhengyi Fu <i@fuzy.me>]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Zhengyi Fu <i@fuzy.me>
>> Date: Mon, 30 Dec 2024 21:02:59 +0800
>> 
>> Emacs built without Cairo steadily crashes when trying to complete
>> symbols with Corfu.
>> 
>> Steps to reproduce:
>> 
>> 1. emacs -Q -l path/to/corfu.el
>> 2. M-x corfu-mode
>> 3. Try completing a simple by pressing C-M-i
>> 
>> I got the following backtrace from GDB by reproducing the bug after
>> evaluating (x-synchronize t):
>> 
>> (gdb) br x_error_quitter
>> Breakpoint 1 at 0x550530: file xterm.c, line 27111.
>> (gdb) r
>> Starting program: /home/zhengyi/src/emacs/src/emacs -Q -l \~/.emacs.d/straight/repos/corfu/corfu.el
>> [Thread debugging using libthread_db enabled]
>> Using host libthread_db library "/lib64/libthread_db.so.1".
>> [New Thread 0x7ffff13fe6c0 (LWP 15400)]
>> [New Thread 0x7ffff0a6e6c0 (LWP 15401)]
>> [New Thread 0x7fffebfff6c0 (LWP 15402)]
>> [New Thread 0x7fffeb66f6c0 (LWP 15403)]
>> 
>> Thread 1 "emacs" hit Breakpoint 1, x_error_quitter (display=0xe19910, event=0x0) at xterm.c:27111
>> 27111	  if (event->error_code == BadName)
>> (gdb) bt full
>> #0  x_error_quitter (display=0xe19910, event=0x0) at xterm.c:27111
>> 	buf = '\000' <repeats 255 times>
>> 	buf1 = '\000' <repeats 272 times>...
>> #1  0x000000000055076b in x_error_handler (display=0xe19910, event=0x7fffffffba70) at xterm.c:27090
>> 	stack = <optimized out>
>> 	dpyinfo = <optimized out>
>> 	fail = <optimized out>
>> 	last = <optimized out>
>
> I don't understand how 'event', which was 0x7fffffffba70 in
> x_error_handler became a NULL pointer inside x_error_quitter, which
> x_error_handler calls.
>
> Po Lu, any ideas?
>
> Zhengyi Fu, can you configure Emacs 30.0.93 with --enable-checking and
> compile it with -O0, and see if you get more detailed diagnostics?
>
> Also, does disabling the X input method help in any way?  (I see you
> are using fcitx.)

This the backtrace I got after rebuilding Emacs with --enable-checking
and -O0 and disabling fcitx:


(gdb) r
Starting program: /home/zhengyi/src/emacs/src/emacs -Q -l \~/.emacs.d/straight/repos/corfu/corfu.el
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7ffff1bfe6c0 (LWP 58332)]
[New Thread 0x7ffff126e6c0 (LWP 58333)]
[New Thread 0x7fffebfff6c0 (LWP 58334)]
[New Thread 0x7fffeb66f6c0 (LWP 58335)]
[Detaching after vfork from child process 58338]
[Detaching after vfork from child process 58343]
[Detaching after vfork from child process 58350]
[Detaching after vfork from child process 58351]
[Detaching after vfork from child process 58352]
[Detaching after vfork from child process 58353]
[Detaching after vfork from child process 58357]
[Detaching after vfork from child process 58361]
[Detaching after vfork from child process 58366]
[Detaching after vfork from child process 58370]
[Detaching after vfork from child process 58374]
[Detaching after vfork from child process 58379]

Thread 1 "emacs" hit Breakpoint 1, x_error_quitter (display=0x104d5d0, event=0x7fffffffb8c0) at xterm.c:27111
27111	  if (event->error_code == BadName)
(gdb) bt full
#0  x_error_quitter (display=0x104d5d0, event=0x7fffffffb8c0) at xterm.c:27111
	buf = '\000' <repeats 16 times>, "P\267\377\377\377\177\000\000\001\000\000\000\000\000\000\000\240\267\377\377\377\177", '\000' <repeats 26 times>, "\001\001. \000\000\000\000 ", '\000' <repeats 15 times>, "/#\305\367\377\177\000\000d\372\004\001\000\000\000\000 ", '\000' <repeats 15 times>, "\300\n\005\001", '\000' <repeats 12 times>, "\362\321\361\363\377\177\000\000d\372\004\001\000\000\000\000\000-cYwQ6n\240\271\377\377\377\177\000\000\001\000\000\000\000\000\000\000\360\371\004\001", '\000' <repeats 20 times>...
	buf1 = "p\350\004\001\000\000\000\000\300\n\005\001\000\000\000\000\360\371\004\001\000\000\000\000\377\377\377\377\377\377\377\377d\372\004\001\000\000\000\000\000\020", '\000' <repeats 22 times>, " \264\377\377\377\177\000\000\001\000\000\000\000\000\000\000p\264\377\377\377\177\000\000P", '\000' <repeats 15 times>, "\301\031\305\367\377\177\000\000 \v\005\001\000\000\000\000\360\371\004\001\000\000\000\000$ \000\000\000\000\000\000\260\265\377\377\377\177\000\000д\377\377\377\177\000\000\201\035\305\367\377\177\000\000\360\264\377\377\377\177\000\000\277.\305\367\377\177\000\000 \265\377\377\377\177\000\000\b\372\004\001\000\000\000\000\002\000\000\000\000\000\000\000\000"...
#1  0x00000000005d32de in x_error_handler (display=0x104d5d0, event=0x7fffffffb8c0) at xterm.c:27090
	stack = 0x0
	dpyinfo = 0x105f4d0
	fail = 0x0
	last = 0x104d5d0
#2  0x00007ffff7cc047b in _XError () at /lib64/libX11.so.6
#3  0x00007ffff7cc0577 in ??? () at /lib64/libX11.so.6
#4  0x00007ffff7cc062d in ??? () at /lib64/libX11.so.6
#5  0x00007ffff7cc22dd in _XReply () at /lib64/libX11.so.6
#6  0x00007ffff7cc265b in XSync () at /lib64/libX11.so.6
#7  0x00007ffff7cc26fb in ??? () at /lib64/libX11.so.6
#8  0x00007ffff7c9ae83 in XCreatePixmap () at /lib64/libX11.so.6
#9  0x00007ffff7c9f10b in XCreatePixmapFromBitmapData () at /lib64/libX11.so.6
#10 0x00000000005acef7 in x_draw_fringe_bitmap (w=0x1bf5f80, row=0x1c3c060, p=0x7fffffffbe60) at xterm.c:7993
	clipmask = 0
	image_rect = {x = 1, y = 18, width = 8, height = 0}
	px = 0
	pixmap = 4785737
	gcv = {function = -227767256, plane_mask = 140737488338224, foreground = 7102373, background = 140737260588072, line_width = -17072, line_style = 32767, cap_style = 7102479, join_style = 0, fill_style = 7092985, fill_rule = 0, arc_mode = -227767256, tile = 140737488338560, stipple = 7114578, ts_x_origin = 0, ts_y_origin = 0, font = 0, subwindow_mode = 15924032, graphics_exposures = 0, clip_x_origin = 0, clip_y_origin = 0, clip_mask = 15924080, dash_offset = 48, dashes = 10 '\n'}
	bg = {pixel = 4769435, red = 46245, green = 433, blue = 0, flags = 0 '\000', pad = 0 '\000'}
	picture = 0
	attrs = {repeat = 0, alpha_map = 0, alpha_x_origin = 0, alpha_y_origin = 0, clip_x_origin = 0, clip_y_origin = 0, clip_mask = 0, graphics_exposures = 0, subwindow_mode = 0, poly_edge = 0, poly_mode = 0, dither = 0, component_alpha = 0}
	py = 0
	drawable = 13631756
	bits = 0x1bf4120 ""
	depth = 32
	background = 4290834431
	dest = {x = 1, y = 18, width = 8, height = 0}
	pwidth = 8
	pheight = 0
	f = 0x1b1b4a0
	display = 0x104d5d0
	gc = 0x1ad5840
	face = 0x101b720
	clip_rect = {x = 1, y = 1, width = 256, height = 35}
#11 0x00000000007d4009 in draw_fringe_bitmap_1 (w=0x1bf5f80, row=0x1c3c060, left_p=1, overlay=0, which=26) at fringe.c:711
	f = 0x1b1b4a0
	p = {which = 26, bits = 0x1bf4120, wd = 8, h = 0, dh = 0, x = 1, y = 18, bx = 1, nx = 8, by = 1, ny = 35, cursor_p = false, overlay_p = false, face = 0x101b720}
	fb = 0x1bf4110
	period = 0
	face_id = 21
	offset = 0
	header_line_height = 0
#12 0x00000000007d471d in draw_fringe_bitmap (w=0x1bf5f80, row=0x1c3c060, left_p=1) at fringe.c:880
	overlay = 0
#13 0x00000000007d4829 in draw_row_fringe_bitmaps (w=0x1bf5f80, row=0x1c3c060) at fringe.c:901
#14 0x00000000007d4a6e in draw_window_fringes (w=0x1bf5f80, no_fringe_p=true) at fringe.c:949
	row = 0x1c3c060
	yb = 350
	nrows = 18
	y = 0
	rn = 0
	updated_p = false
	window_buffer = 0xfe567d
	oldbuf = 0x7ffff2856418
#15 0x000000000046dcad in gui_update_window_end (w=0x1bf5f80, cursor_on_p=true, mouse_face_overwritten_p=false) at dispnew.c:3948
	f = 0x1b1b4a0
#16 0x000000000046da27 in update_window (w=0x1bf5f80, force_p=true) at dispnew.c:3869
	end = 0x1af1820
	tab_line_row = 0x0
	mouse_face_overwritten_p = false
	n_updated = 0
	mode_line_row = 0x1af1820
	changed_p = true
	invisible_rows_marked = true
	row = 0x1af1820
	header_line_row = 0x0
	yb = 350
	desired_matrix = 0x1b191e0
	paused_p = false
	preempt_count = 9
	rif = 0x8df2a0 <x_redisplay_interface>
#17 0x000000000046cc71 in update_window_tree (w=0x1bf5f80, force_p=true) at dispnew.c:3491
	paused_p = false
#18 0x000000000046c61b in update_frame (f=0x1b1b4a0, force_p=true, inhibit_hairy_id_p=false) at dispnew.c:3326
	paused_p = false
	root_window = 0x1bf5f80
#19 0x00000000004c51b1 in redisplay_internal () at xdisp.c:17468
	gcscrollbars = true
	f_redisplay_flag = true
	f = 0x1b1b4a0
	w = 0x11d1690
	sw = 0x11d1690
	fr = 0x11d13e0
	pending = false
	must_finish = false
	match_p = true
	tlbufpos = {charpos = 180, bytepos = 184}
	tlendpos = {charpos = 0, bytepos = 0}
	number_of_visible_frames = 2
	sf = 0x11d13e0
	polling_stopped_here = true
	tail = 0x1a17043
	frame = 0x1b1b4a5
	hscroll_retries = 0
	garbaged_frame_retries = 0
	consider_all_windows_p = true
	update_miniwindow_p = false
	count = {bytes = 128}
#20 0x00000000004c2bab in redisplay () at xdisp.c:16563
#21 0x0000000000616041 in read_char (commandflag=1, map=0x1ba88f3, prev_event=0x0, used_mouse_menu=0x7fffffffd9ef, end_time=0x0) at keyboard.c:2678
	echo_current = true
	c = 0x0
	local_getcjmp = {{__jmpbuf = {140737259281624, 140737259281667, 140737488345056, 7102846, 48, 140737259281624, 15924032, 0}, __mask_was_saved = 0, __saved_mask = {__val = {140737488345104, 6496078, 140737267083907, 140737488345264, 6517891, 15924032, 0, 0, 140737488345168, 7233523, 26984432, 140737488345264, 7277134, 29001987, 128, 140737488345264}}}}
	save_jump = {{__jmpbuf = {140737488344944, 7120998, 140737262216221, 12658762781, 0, 44256, 140737488345136, 140737267219456}, __mask_was_saved = -226139107, __saved_mask = {__val = {746, 0, 44256, 15968288, 44256, 140737488344944, 55850543136, 140737262216221, 140737488344960, 7101566, 140737262216221, 140737488344992, 7101662, 7092985, 140737262216221, 140737488345056}}}}
	tem = 0x1a77dd0
	save = 0x1ba88f3
	previous_echo_area_message = 0x0
	also_record = 0x0
	reread = false
	recorded = false
	polling_stopped_here = false
	orig_kboard = 0x104f640
	jmpcount = {bytes = 0}
#22 0x000000000062a235 in read_key_sequence (keybuf=0x7fffffffdc10, prompt=0x0, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false, disable_text_conversion_p=false) at keyboard.c:10743
	interrupted_kboard = 0x104f640
	interrupted_frame = 0x11d13e0
	key = 0x30
	used_mouse_menu = false
	echo_local_start = 0
	last_real_key_start = 0
	keys_local_start = 0
	new_binding = 0xba
	count = {bytes = 96}
	t = 0
	echo_start = 0
	keys_start = 0
	current_binding = 0x1ba88f3
	first_unbound = 31
	mock_input = 0
	used_mouse_menu_history = {false <repeats 30 times>}
	fkey = {parent = 0x7ffff24c7983, map = 0x7ffff24c7983, start = 0, end = 0}
	keytran = {parent = 0x7ffff2cef743, map = 0x7ffff2cef743, start = 0, end = 0}
	indec = {parent = 0x7ffff24c7973, map = 0x7ffff24c7973, start = 0, end = 0}
	shift_translated = false
	delayed_switch_frame = 0x0
	original_uppercase = 0x0
	original_uppercase_position = -1
	disabled_conversion = false
	starting_buffer = 0x7ffff2856418
	fake_prefixed_keys = 0x0
	first_event = 0x0
	second_event = 0x0
#23 0x0000000000612514 in command_loop_1 () at keyboard.c:1429
	cmd = 0x7ffff175a428
	keybuf = {0x20000026, 0x16, 0x2ffffdca0, 0x0, 0x0, 0xb2b0, 0x7ffff3e0b018, 0x7ffff2d1bc30, 0x0, 0xb2b0, 0x7ffff2856418, 0x0, 0x0, 0xf3adf0 <lispsym+45744>, 0x6c3af9 <builtin_lisp_symbol+44>, 0x0, 0x7fffffffdd20, 0x6ca866 <set_default_internal+914>, 0x7ffff285641d, 0x2006ed6c1, 0x0, 0xb2b0, 0x7ffff2d1bc30, 0x7ffff2d1bc30, 0x0, 0x0, 0x7fffffffdd60, 0xb2b0, 0xf3adf0 <lispsym+45744>, 0xb2b0}
	i = 1
	last_pt = 184
	prev_modiff = 110
	prev_buffer = 0x7ffff2856418
#24 0x00000000006eac73 in internal_condition_case (bfun=0x6120ef <command_loop_1>, handlers=0x90, hfun=0x6115f7 <cmd_error>) at eval.c:1613
	val = 0x60e5cf <builtin_lisp_symbol+44>
	c = 0x102b850
#25 0x0000000000611cf7 in command_loop_2 (handlers=0x90) at keyboard.c:1168
	val = 0x90
#26 0x00000000006ea0cb in internal_catch (tag=0x12270, func=0x611cd4 <command_loop_2>, arg=0x90) at eval.c:1292
	val = 0x7fffffffdf20
	c = 0x102b710
#27 0x0000000000611c90 in command_loop () at keyboard.c:1146
#28 0x00000000006110d0 in recursive_edit_1 () at keyboard.c:754
	count = {bytes = 32}
	val = 0x6f02e8 <record_unwind_protect+114>
#29 0x00000000006112e3 in Frecursive_edit () at keyboard.c:837
	count = {bytes = 0}
	buffer = 0x0
#30 0x000000000060cf48 in main (argc=4, argv=0x7fffffffe238) at emacs.c:2635
	stack_bottom_variable = 0x53
	old_argc = 4
	dump_file = 0x0
	no_loadup = false
	junk = 0x0
	dname_arg = 0x0
	ch_to_dir = 0x0
	original_pwd = 0x0
	dump_mode = 0x0
	skip_args = 0
	temacs = 0x0
	attempt_load_pdump = true
	only_version = false
	rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
	lc_all = 0x0
	sockfd = -1
	module_assertions = false
(gdb)