bug#1696: 23.0.60; Crash in XFreeColors

bug#1696: 23.0.60; Crash in XFreeColors

[Markus Triska]

When I do in an X terminal:

   $ emacs -Q --daemon

   $ emacsclient -c

then close that terminal (thus killing the client), and then do:

   $ emacsclient -c

in a new X terminal, the daemon often crashes with the following
backtrace. I can reproduce this on OSX and latest Kubuntu jaunty
(using two tabs in Konsole of KDE 4.1) with today's Emacs CVS version.

GNU gdb 6.3.50-20050815 (Apple version gdb-573) (Fri Oct 20 15:50:43 GMT 2006)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-apple-darwin"...Reading symbols for shared libraries .................................... done

/Users/mt/emacs/src/13683: No such file or directory.
Attaching to program: `/Users/mt/emacs/src/emacs', process 13683.
Reading symbols for shared libraries ....................................................................+++.++.++.+..++.+.++++++++++++++++++.....+++ done
0x90019d0c in select ()
DISPLAY = :0.0
TERM = xterm-color
Breakpoint 1 at 0x9010d3db
Breakpoint 2 at 0xfcdea: file sysdep.c, line 1144.
(gdb) c
Continuing.
Reading symbols for shared libraries . done

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x000004ec
0x01823335 in XFreeColors ()
(gdb) bt
#0  0x01823335 in XFreeColors ()
#1  0x00082425 in x_free_colors (f=0x22a7900, pixels=0xbfffad34, npixels=1) at xfaces.c:672
#2  0x00083060 in unload_color (f=0x22a7900, pixel=0) at xfaces.c:1544
#3  0x00096f72 in x_free_frame_resources (f=0x22a7900) at xterm.c:9508
#4  0x0009d59c in unwind_create_frame (frame=36337924) at xfns.c:3035
#5  0x00151fbe in unbind_to (count=112, value=58721289) at eval.c:3399
#6  0x001521ad in unwind_to_catch (catch=0xbfffd8a8, value=36018656) at eval.c:1292
#7  0x00153ce6 in Fsignal (error_symbol=58760953, data=50387197) at eval.c:1725
#8  0x00153d6c in xsignal (error_symbol=58760953, data=50387197) at eval.c:1750
#9  0x001540f0 in xsignal1 (error_symbol=58760953, arg=61490459) at eval.c:1767
#10 0x001541da in error (m=0x1b9938 "%s", a1=0xbfffafc0 "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0", a2=0x0, a3=0x0) at eval.c:2051
#11 0x00092ddc in x_connection_closed (dpy=0x31039a8, error_message=0xbfffb09c "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0") at xterm.c:7979
#12 0x00092ffe in x_error_quitter (display=0x4873400, error=0xbfffb360) at xterm.c:8041
#13 0x00093054 in x_error_handler (display=0x4873400, error=0xbfffb360) at xterm.c:7997
#14 0x01839e94 in _XError ()
#15 0x0183a72c in _XReply ()
#16 0x01835747 in XSync ()
#17 0x0009213e in x_catch_errors (dpy=0x4873400) at xterm.c:7704
#18 0x00092c8c in x_connection_closed (dpy=0x4873400, error_message=0xbfffbd9c "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0") at xterm.c:7862
#19 0x00092ffe in x_error_quitter (display=0x4873400, error=0xbfffc060) at xterm.c:8041
#20 0x00093054 in x_error_handler (display=0x4873400, error=0xbfffc060) at xterm.c:7997
#21 0x01839e94 in _XError ()
#22 0x0183a72c in _XReply ()
#23 0x01f27671 in XRenderQueryFormats ()
#24 0x01f27ba5 in XRenderFindVisualFormat ()
#25 0x01c1b8c9 in _XftDisplayInfoGet ()
#26 0x01c1bb67 in XftDefaultHasRender ()
#27 0x01c1bf73 in XftDefaultSubstitute ()
#28 0x01c1e59c in XftFontMatch ()
#29 0x001b07eb in xftfont_open (f=0x22a7900, entity=36339620, pixel_size=16) at xftfont.c:275
#30 0x00166aaa in font_open_entity (f=0x22a7900, entity=36339620, pixel_size=16) at font.c:2902
#31 0x00168338 in font_load_for_lface (f=0x22a7900, attrs=0xbfffcd90, spec=36339876) at font.c:3410
#32 0x0016a718 in font_open_by_name (f=0x22a7900, name=0x484ce44 "Bitstream Vera Sans Mono-15") at font.c:3465
#33 0x000126fc in x_set_font (f=0x22a7900, arg=61491067, oldval=58721289) at frame.c:3368
#34 0x00010687 in x_set_frame_parameters (f=0x22a7900, alist=50389821) at frame.c:3006
#35 0x0001377e in x_default_parameter (f=0x22a7900, alist=50389605, prop=58869201, deflt=61491147, xprop=0x1b2e94 "font", xclass=0x1ba354 "Font", type=RES_TYPE_STRING) at frame.c:4072
#36 0x0009d739 in x_default_font_parameter (f=0x22a7900, parms=50389605) at xfns.c:3099
#37 0x0009e84f in Fx_create_frame (parms=50389565) at xfns.c:3313
#38 0x001538c1 in Ffuncall (nargs=2, args=0xbfffd0d0) at eval.c:3050
#39 0x0018cbfb in Fbyte_code (bytestr=2125499, vector=2125516, maxdepth=5) at bytecode.c:678
#40 0x001531cb in funcall_lambda (fun=2125452, nargs=1, arg_vector=0xbfffd264) at eval.c:3231
#41 0x001536ae in Ffuncall (nargs=2, args=0xbfffd260) at eval.c:3101
#42 0x0018cbfb in Fbyte_code (bytestr=2411523, vector=2411540, maxdepth=6) at bytecode.c:678
#43 0x001531cb in funcall_lambda (fun=2411476, nargs=1, arg_vector=0xbfffd3f4) at eval.c:3231
#44 0x001536ae in Ffuncall (nargs=2, args=0xbfffd3f0) at eval.c:3101
#45 0x0018cbfb in Fbyte_code (bytestr=2410187, vector=2410204, maxdepth=4) at bytecode.c:678
#46 0x001531cb in funcall_lambda (fun=2410132, nargs=2, arg_vector=0xbfffd574) at eval.c:3231
#47 0x001536ae in Ffuncall (nargs=3, args=0xbfffd570) at eval.c:3101
#48 0x0018cbfb in Fbyte_code (bytestr=59210779, vector=35858852, maxdepth=5) at bytecode.c:678
#49 0x001531cb in funcall_lambda (fun=35859092, nargs=3, arg_vector=0xbfffd704) at eval.c:3231
#50 0x001536ae in Ffuncall (nargs=4, args=0xbfffd700) at eval.c:3101
#51 0x0018cbfb in Fbyte_code (bytestr=59169867, vector=35860740, maxdepth=17) at bytecode.c:678
#52 0x00152d96 in Feval (form=41878493) at eval.c:2385
#53 0x0015537f in internal_lisp_condition_case (var=58754321, bodyform=41878493, handlers=41871613) at eval.c:1456
#54 0x0018bb31 in Fbyte_code (bytestr=59135803, vector=35861236, maxdepth=6) at bytecode.c:868
#55 0x00152d96 in Feval (form=41878269) at eval.c:2385
#56 0x0015168a in internal_catch (tag=75918233, func=0x152986 <Feval>, arg=41878269) at eval.c:1247
#57 0x0018b9e1 in Fbyte_code (bytestr=59135899, vector=35670308, maxdepth=2) at bytecode.c:853
#58 0x001531cb in funcall_lambda (fun=35861492, nargs=2, arg_vector=0xbfffdcf4) at eval.c:3231
#59 0x001536ae in Ffuncall (nargs=3, args=0xbfffdcf0) at eval.c:3101
#60 0x00154ece in Fapply (nargs=2, args=0xbfffdd80) at eval.c:2532
#61 0x00155029 in apply1 (fn=75901137, arg=50394525) at eval.c:2796
#62 0x0018ff36 in read_process_output_call (fun_and_args=50394533) at process.c:5145
#63 0x001517ac in internal_condition_case_1 (bfun=0x18ff19 <read_process_output_call>, arg=50394533, handlers=58760953, hfun=0x18ff38 <read_process_output_error_handler>) at eval.c:1559
#64 0x0019043b in read_process_output (proc=36011060, channel=58760953) at process.c:5334
#65 0x0019640a in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=58721289, wait_proc=0x0, just_wait_proc=0) at process.c:4987
#66 0x0000c18e in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6637
#67 0x000ede4b in read_char (commandflag=1, nmaps=2, maps=0xbffff470, prev_event=58721289, used_mouse_menu=0xbffff568, end_time=0x0) at keyboard.c:2903
#68 0x000efbbb in read_key_sequence (keybuf=0xbffff628, bufsize=30, prompt=58721289, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9354
#69 0x000f1fdc in command_loop_1 () at keyboard.c:1632
#70 0x00151a38 in internal_condition_case (bfun=0xf1dbe <command_loop_1>, handlers=58760953, hfun=0xeaaff <cmd_error>) at eval.c:1511
#71 0x000e3e84 in command_loop_2 () at keyboard.c:1349
#72 0x0015168a in internal_catch (tag=58757025, func=0xe3e40 <command_loop_2>, arg=58721289) at eval.c:1247
#73 0x000e3c26 in command_loop () at keyboard.c:1328
#74 0x000e3cdf in recursive_edit_1 () at keyboard.c:942
#75 0x000e3e27 in Frecursive_edit () at keyboard.c:1004
#76 0x000e2c3f in main (argc=3, argv=0xbffffa64) at emacs.c:1786

Lisp Backtrace:
"x-create-frame" (0xbfffd0d4)
"x-create-frame-with-faces" (0xbfffd264)
"make-frame" (0xbfffd3f4)
"make-frame-on-display" (0xbfffd574)
"server-create-window-system-frame" (0xbfffd704)
"byte-code" (0xbfffd834)
"byte-code" (0xbfffda64)
"server-process-filter" (0xbfffdcf4)
(gdb) bt full
#0  0x01823335 in XFreeColors ()
No symbol table info available.
#1  0x00082425 in x_free_colors (f=0x22a7900, pixels=0xbfffad34, npixels=1) at xfaces.c:672
        class = 28
        f = (struct frame *) 0x1c
#2  0x00083060 in unload_color (f=0x22a7900, pixel=0) at xfaces.c:1544
No locals.
#3  0x00096f72 in x_free_frame_resources (f=0x22a7900) at xterm.c:9508
        dpyinfo = (struct x_display_info *) 0x22599e0
        f = (struct frame *) 0x22a7900
#4  0x0009d59c in unwind_create_frame (frame=36337924) at xfns.c:3035
        f = (struct frame *) 0x0
        frame = 36337924
#5  0x00151fbe in unbind_to (count=112, value=58721289) at eval.c:3399
        quitf = 58721289
#6  0x001521ad in unwind_to_catch (catch=0xbfffd8a8, value=36018656) at eval.c:1292
No locals.
#7  0x00153ce6 in Fsignal (error_symbol=58760953, data=50387197) at eval.c:1725
        unwind_data = 36018656
        h = (struct handler *) 0xbfffd91c
        clause = 41871653
        allhandlers = (struct handler *) 0xbfffd91c
        conditions = 35373005
        string = 28
        real_error_symbol = 58760953
        bp = (struct backtrace *) 0x0
#8  0x00153d6c in xsignal (error_symbol=58760953, data=50387197) at eval.c:1750
        error_symbol = 28
        data = 28
#9  0x001540f0 in xsignal1 (error_symbol=58760953, arg=61490459) at eval.c:1767
        error_symbol = 28
        arg = 28
#10 0x001541da in error (m=0x1b9938 "%s", a1=0xbfffafc0 "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0", a2=0x0, a3=0x0) at eval.c:2051
        buf = "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0\000\0047\001\024\000\342\306\202\003\340\306\202\003h\257\377\277\313\001\024\000y\324\202\003\342\306\202\003\t\004\200\003x\026\020\003\000\000\000\000!\004\200\003x\324\202\003\000\000\000\000\360\177$\002\200\202$\002\250\257\377\277k\037\025\000y\324\202\003x\324\202\003\250\257\377\277\231 \025\000y\324\202\003\t\004\200\003x\026\020\003\001\000\000\000\002\000\000"
        size = 61490459
        buffer = 0xbfffaebc "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0"
        args = {0xbfffafc0 "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0", 0x0, 0x0}
        allocated = 0
        string = 61490459
        a1 = 0x1c <Address 0x1c out of bounds>
        a2 = 0x1c <Address 0x1c out of bounds>
        a3 = 0x1c <Address 0x1c out of bounds>
#11 0x00092ddc in x_connection_closed (dpy=0x31039a8, error_message=0xbfffb09c "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0") at xterm.c:7979
        dpyinfo = (struct x_display_info *) 0x22599e0
        frame = 0
        tail = 36018656
#12 0x00092ffe in x_error_quitter (display=0x4873400, error=0xbfffb360) at xterm.c:8041
        buf = "BadRequest (invalid request code or no such operation)", '\0' <repeats 201 times>
        buf1 = "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0\000\277\000\000\000\000\0004\207\004\004\000\000\000\330\263\377\277\234\263\377\277\037\000\000\000\206\002\000\000\334\375\000\220\a\000\000\000\037\000\000\000\037\000\000\000\000\000\000\0007\000\000\000\001\000\000\000\002\000\000\000\177\003 \000\000\000\034\005\320\231\026\000\027\000\000\000\200\314\377\277\037\000\000\000\247\037\000\000\377\377\000\000\000\000\000\000\000\000\000\000\377\377", '\0' <repeats 93 times>...
#13 0x00093054 in x_error_handler (display=0x4873400, error=0xbfffb360) at xterm.c:7997
No locals.
#14 0x01839e94 in _XError ()
No symbol table info available.
#15 0x0183a72c in _XReply ()
No symbol table info available.
#16 0x01835747 in XSync ()
No symbol table info available.
#17 0x0009213e in x_catch_errors (dpy=0x4873400) at xterm.c:7704
        dpy = (struct _XDisplay *) 0x4873400
#18 0x00092c8c in x_connection_closed (dpy=0x4873400, error_message=0xbfffbd9c "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0") at xterm.c:7862
        dpyinfo = (struct x_display_info *) 0x22599e0
        frame = 0
        tail = 36018656
#19 0x00092ffe in x_error_quitter (display=0x4873400, error=0xbfffc060) at xterm.c:8041
        buf = "BadRequest (invalid request code or no such operation)", '\0' <repeats 201 times>
        buf1 = "X protocol error: BadRequest (invalid request code or no such operation) on protocol request 0", '\0' <repeats 21 times>, "\240\001@", '\0' <repeats 13 times>, "\360\002@", '\0' <repeats 22 times>, "render\000\000rgba\000\000\000\000", '\377' <repeats 16 times>, "ormal-normal-*-*-*-*-*-m-0-iso10646--*-m-0-i"...
#20 0x00093054 in x_error_handler (display=0x4873400, error=0xbfffc060) at xterm.c:7997
No locals.
#21 0x01839e94 in _XError ()
No symbol table info available.
#22 0x0183a72c in _XReply ()
No symbol table info available.
#23 0x01f27671 in XRenderQueryFormats ()
No symbol table info available.
#24 0x01f27ba5 in XRenderFindVisualFormat ()
No symbol table info available.
#25 0x01c1b8c9 in _XftDisplayInfoGet ()
No symbol table info available.
#26 0x01c1bb67 in XftDefaultHasRender ()
No symbol table info available.
#27 0x01c1bf73 in XftDefaultSubstitute ()
No symbol table info available.
#28 0x01c1e59c in XftFontMatch ()
No symbol table info available.
#29 0x001b07eb in xftfont_open (f=0x22a7900, entity=36339620, pixel_size=16) at xftfont.c:275
        result = 61490539
        display = (struct _XDisplay *) 0x4873400
        val = 36018656
        filename = 61490859
        index = 0
        tail = 36018656
        font_object = 53872140
        pat = (struct _FcPattern *) 0x22a8160
        match = (struct _FcPattern *) 0x31
        size = 16
        xftfont = (XftFont *) 0x51
        spacing = 36340064
        name = "al-norma$\000\000\000rmal-*-*\216\230\025\000\t\004\200\003\333\307\000\002\030\314\377\277\244b4\000\f\0066\003Q\000\000\000\000\000\000\000\225\320\204\004\000\000\000\0001\000\000\000\360\201*\002\000\000\000\000\215\343\000\003\000\000\000\000H\000\000\000\nN\022\000pb4\000\000\000\000\000h\314\377\277SY\022\000kE\252\003hE\252\003h\314\377\277\227-\023\000\200b4\000\000\000\000\000\000\000\000\000D\320\204\004Q", '\0' <repeats 15 times>, "Q\000\000\000\030s\020\003H\315\377\277SY\022\000kE\252\003hE\252\003\250\314\377\277\324Y\022\000\200b4\000D\320\204\004Q\000\000\000\000\000\000\000Q\000\000\000\000"...
        len = 28
        i = 28
        extents = {
  width = 33028, 
  height = 554, 
  x = 30980, 
  y = 554, 
  xOff = -13200, 
  yOff = -16385
}
        ft_face = (FT_Face) 0x1
#30 0x00166aaa in font_open_entity (f=0x22a7900, entity=36339620, pixel_size=16) at font.c:2902
        driver_list = (struct font_driver_list *) 0x1c
        objlist = 36018656
        val = 0
        font_object = 13
        min_width = 0
        height = 36339620
        scaled_pixel_size = 28
#31 0x00168338 in font_load_for_lface (f=0x22a7900, attrs=0xbfffcd90, spec=36339876) at font.c:3410
        entity = 28
        attrs = (Lisp_Object *) 0xbfffcd90
        spec = 36339876
#32 0x0016a718 in font_open_by_name (f=0x22a7900, name=0x484ce44 "Bitstream Vera Sans Mono-15") at font.c:3465
        args = {58782521, 61491003}
        spec = 28
        attrs = {1, 58721289, 58721289, 58745865, 960, 58745865, 58745865, 695750, 75812452, 75874072, -1073754648, 1289008, 35949244, 27, -1073754660, 58721289, 62919, 50389765}
        f = (FRAME_PTR) 0x1c
        name = 0x22599e0 "{5"
#33 0x000126fc in x_set_font (f=0x22a7900, arg=61491067, oldval=58721289) at frame.c:3368
        fontset = -1
        font_object = -1073754584
        f = (struct frame *) 0x22a7900
        arg = 61491064
        oldval = 58721289
#34 0x00010687 in x_set_frame_parameters (f=0x22a7900, alist=50389821) at frame.c:3006
        param_index = 28
        old_value = 58721289
        prop = 58721289
        val = 61491067
        tail = 36018656
        width = 10
        height = 10
        left = 58721313
        top = 1781396
        icon_left = 4
        icon_top = -1073754376
        i = 1
        p = 0
        left_no_change = 58721289
        top_no_change = -1073754280
        icon_left_no_change = 78888
        icon_top_no_change = 58721289
        fullscreen_is_being_set = 0
#35 0x0001377e in x_default_parameter (f=0x22a7900, alist=50389605, prop=58869201, deflt=61491147, xprop=0x1b2e94 "font", xclass=0x1ba354 "Font", type=RES_TYPE_STRING) at frame.c:4072
        tem = 61491067
        alist = 28
        xprop = 0x1c <Address 0x1c out of bounds>
        xclass = 0x1c <Address 0x1c out of bounds>
        type = 28
#36 0x0009d739 in x_default_font_parameter (f=0x22a7900, parms=50389605) at xfns.c:3099
        dpyinfo = (struct x_display_info *) 0x3aa47cb
        font_param = 58721289
        font = 61491147
#37 0x0009e84f in Fx_create_frame (parms=50389565) at xfns.c:3313
        f = (struct frame *) 0x22a7900
        frame = 36337924
        tem = 36018656
        name = 58721313
        minibuffer_only = 0
        width = 0
        height = 36018656
        display = 36337920
        dpyinfo = (struct x_display_info *) 0x22599e0
        parent = 58721289
        kb = (struct kboard *) 0x22cd940
        parms = 28
#38 0x001538c1 in Ffuncall (nargs=2, args=0xbfffd0d0) at eval.c:3050
        fun = -1073753900
        original_fun = 58949361
        funcar = 36018656
        numargs = 1
        val = 0
        backtrace = {
  next = 0xbfffd21c, 
  function = 0xbfffd0d0, 
  args = 0xbfffd0d4, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0xbfffd0d4
        i = 36018656
        args = (Lisp_Object *) 0x3837ef1
#39 0x0018cbfb in Fbyte_code (bytestr=2125499, vector=2125516, maxdepth=5) at bytecode.c:678
        op = 28
        vectorp = (Lisp_Object *) 0x206ed0
        stack = {
  pc = 0x2e0312 "\024\316\216\317\f!\210\320\f\b\"\210\321\f!\210\322\f\b\"\210\n\204V", 
  top = 0xbfffd0d4, 
  bottom = 0xbfffd0d0, 
  byte_string = 2125499, 
  byte_string_start = 0x2e02dc "\306\b!\020\307\b!\031\310\b\236\032\311\033\312\211\034\035\v\312\036\026\211\036\027\2030", 
  constants = 2125516, 
  next = 0xbfffd2e4
}
        result = 0
        bytestr = 36018656
#40 0x001531cb in funcall_lambda (fun=2125452, nargs=1, arg_vector=0xbfffd264) at eval.c:3231
        val = 28
        syms_left = 2125448
        next = 2125448
        i = 1
        optional = 1
        rest = 0
#41 0x001536ae in Ffuncall (nargs=2, args=0xbfffd260) at eval.c:3101
        fun = 2125452
        original_fun = 59225673
        funcar = 36018656
        numargs = 1
        val = 0
        backtrace = {
  next = 0xbfffd3ac, 
  function = 0xbfffd260, 
  args = 0xbfffd264, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x206e8c
        i = 36018656
        args = (Lisp_Object *) 0x387b649
#42 0x0018cbfb in Fbyte_code (bytestr=2411523, vector=2411540, maxdepth=6) at bytecode.c:678
        op = 28
        vectorp = (Lisp_Object *) 0x24cc18
        stack = {
  pc = 0x2b15d3 "\026\027\321\016\027!\210\016\031\311\036\032\211\036\033\203\232", 
  top = 0xbfffd264, 
  bottom = 0xbfffd260, 
  byte_string = 2411523, 
  byte_string_start = 0x2b1575 "\306\b\236\203,", 
  constants = 2411540, 
  next = 0xbfffd464
}
        result = 0
        bytestr = 36018656
#43 0x001531cb in funcall_lambda (fun=2411476, nargs=1, arg_vector=0xbfffd3f4) at eval.c:3231
        val = 28
        syms_left = 2411472
        next = 2411472
        i = 1
        optional = 1
        rest = 0
#44 0x001536ae in Ffuncall (nargs=2, args=0xbfffd3f0) at eval.c:3101
        fun = 2411476
        original_fun = 59471017
        funcar = 36018656
        numargs = 1
        val = 0
        backtrace = {
  next = 0xbfffd52c, 
  function = 0xbfffd3f0, 
  args = 0xbfffd3f4, 
  nargs = 1, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x24cbd4
        i = 36018656
        args = (Lisp_Object *) 0x38b74a9
#45 0x0018cbfb in Fbyte_code (bytestr=2410187, vector=2410204, maxdepth=4) at bytecode.c:678
        op = 28
        vectorp = (Lisp_Object *) 0x24c6e0
        stack = {
  pc = 0x2b18d1 "\207", 
  top = 0xbfffd3f4, 
  bottom = 0xbfffd3f0, 
  byte_string = 2410187, 
  byte_string_start = 0x2b1875 "\306\307!\203\037", 
  constants = 2410204, 
  next = 0xbfffd5f4
}
        result = 0
        bytestr = 36018656
#46 0x001531cb in funcall_lambda (fun=2410132, nargs=2, arg_vector=0xbfffd574) at eval.c:3231
        val = 28
        syms_left = 2410128
        next = 2410128
        i = 2
        optional = 1
        rest = 0
#47 0x001536ae in Ffuncall (nargs=3, args=0xbfffd570) at eval.c:3101
        fun = 2410132
        original_fun = 61161905
        funcar = 36018656
        numargs = 2
        val = 0
        backtrace = {
  next = 0xbfffd6bc, 
  function = 0xbfffd570, 
  args = 0xbfffd574, 
  nargs = 2, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x24c694
        i = 36018656
        args = (Lisp_Object *) 0x3a541b1
#48 0x0018cbfb in Fbyte_code (bytestr=59210779, vector=35858852, maxdepth=5) at bytecode.c:678
        op = 28
        vectorp = (Lisp_Object *) 0x22329a8
        stack = {
  pc = 0x48596d9 "\034\312\327\330\f\"\b\"\210\331\f!\210\332\b\304\f#\210\332\b\333\334\f!#\210\335\336\337!\340\"\210\f*\207", 
  top = 0xbfffd578, 
  bottom = 0xbfffd570, 
  byte_string = 59210779, 
  byte_string_start = 0x4859698 "\305\306\307\"\210\310\311!\204\027", 
  constants = 35858852, 
  next = 0xbfffd7b4
}
        result = 0
        bytestr = 36018656
#49 0x001531cb in funcall_lambda (fun=35859092, nargs=3, arg_vector=0xbfffd704) at eval.c:3231
        val = 28
        syms_left = 35859088
        next = 35859088
        i = 3
        optional = 0
        rest = 0
#50 0x001536ae in Ffuncall (nargs=4, args=0xbfffd700) at eval.c:3101
        fun = 35859092
        original_fun = 75918065
        funcar = 36018656
        numargs = 3
        val = 0
        backtrace = {
  next = 0xbfffd854, 
  function = 0xbfffd700, 
  args = 0xbfffd704, 
  nargs = 3, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x2232a94
        i = 36018656
        args = (Lisp_Object *) 0x4866af1
#51 0x0018cbfb in Fbyte_code (bytestr=59169867, vector=35860740, maxdepth=17) at bytecode.c:678
        op = 28
        vectorp = (Lisp_Object *) 0x2233108
        stack = {
  pc = 0x4859c8f "\202\350\002\016D\205\350\002\201b", 
  top = 0xbfffd70c, 
  bottom = 0xbfffd700, 
  byte_string = 59169867, 
  byte_string_start = 0x48599b8 "\306\b!\210\307\310\t\"\204\030", 
  constants = 35860740, 
  next = 0xbfffd9e4
}
        result = 0
        bytestr = 36018656
#52 0x00152d96 in Feval (form=41878493) at eval.c:2385
        numargs = 36018656
        argvals = {59169867, 35860740, 136, 768, 768, 1085823, 1384299, 59314267}
        args_left = 58721289
        i = 3
        fun = 0
        val = 0
        original_fun = 58832233
        original_args = 41878501
        funcar = 36018656
        backtrace = {
  next = 0xbfffda84, 
  function = 0xbfffd86c, 
  args = 0xbfffd834, 
  nargs = 3, 
  evalargs = 1 '\001', 
  debug_on_exit = 0 '\0'
}
        form = 58721289
#53 0x0015537f in internal_lisp_condition_case (var=58754321, bodyform=41878493, handlers=41871613) at eval.c:1456
        val = 36018656
        c = {
  tag = 58721289, 
  val = 50387205, 
  next = 0xbfffdadc, 
  gcpro = 0x0, 
  jmp = {895, 0, 8103, 1397216, 2, 1389816, 75864364, 58721289, -1073751736, -1073751920, 31, 662, 1397382, 59310103, 58720287, 31, -1073807360, 55}, 
  backlist = 0xbfffda84, 
  handlerlist = 0xbfffde2c, 
  lisp_eval_depth = 2, 
  pdlcount = 7, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0xbfffd9e4
}
        h = {
  handler = 41871613, 
  var = 58754321, 
  chosen_clause = 41871653, 
  tag = 0xbfffd8a8, 
  next = 0xbfffde2c
}
#54 0x0018bb31 in Fbyte_code (bytestr=59135803, vector=35861236, maxdepth=6) at bytecode.c:868
        handlers = 28
        body = 36018656
        op = 28
        vectorp = (Lisp_Object *) 0x22332f8
        stack = {
  pc = 0x485992c "\207", 
  top = 0xbfffd960, 
  bottom = 0xbfffd960, 
  byte_string = 59135803, 
  byte_string_start = 0x48598c8 "\303\304\bP\t\"\210\305\t\306\"\204L", 
  constants = 35861236, 
  next = 0xbfffdbe4
}
        result = 0
        bytestr = 36018656
#55 0x00152d96 in Feval (form=41878269) at eval.c:2385
        numargs = 36018656
        argvals = {59135803, 35861236, 48, -1073751252, -1073751252, 0, 23941624, 23941624}
        args_left = 58721289
        i = 3
        fun = 0
        val = 0
        original_fun = 58832233
        original_args = 41878277
        funcar = 36018656
        backtrace = {
  next = 0xbfffdcac, 
  function = 0xbfffda9c, 
  args = 0xbfffda64, 
  nargs = 3, 
  evalargs = 1 '\001', 
  debug_on_exit = 0 '\0'
}
        form = 58721289
#56 0x0015168a in internal_catch (tag=75918233, func=0x152986 <Feval>, arg=41878269) at eval.c:1247
        c = {
  tag = 75918233, 
  val = 58721289, 
  next = 0xbfffddb8, 
  gcpro = 0x0, 
  jmp = {-1073806465, 0, 8103, 1381870, 109657, 39800668, 75864215, 75864214, -1073751208, -1073751360, 39780383, 662, 1382013, 23, 31, 31, 0, 55}, 
  backlist = 0xbfffdcac, 
  handlerlist = 0xbfffde2c, 
  lisp_eval_depth = 1, 
  pdlcount = 7, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0xbfffdbe4
}
        tag = 28
#57 0x0018b9e1 in Fbyte_code (bytestr=59135899, vector=35670308, maxdepth=2) at bytecode.c:853
        v1 = 28
        op = 28
        vectorp = (Lisp_Object *) 0x2204928
        stack = {
  pc = 0x4859897 "\207", 
  top = 0xbfffdb74, 
  bottom = 0xbfffdb70, 
  byte_string = 59135899, 
  byte_string_start = 0x4859894 "\300\301\215\207", 
  constants = 35670308, 
  next = 0x0
}
        result = 0
        bytestr = 36018656
#58 0x001531cb in funcall_lambda (fun=35861492, nargs=2, arg_vector=0xbfffdcf4) at eval.c:3231
        val = 28
        syms_left = 35861488
        next = 35861488
        i = 2
        optional = 0
        rest = 0
#59 0x001536ae in Ffuncall (nargs=3, args=0xbfffdcf0) at eval.c:3101
        fun = 35861492
        original_fun = 75901137
        funcar = 36018656
        numargs = 2
        val = 0
        backtrace = {
  next = 0x0, 
  function = 0xbfffdcf0, 
  args = 0xbfffdcf4, 
  nargs = 2, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
        internal_args = (Lisp_Object *) 0x22333f4
        i = 36018656
        args = (Lisp_Object *) 0x48628d1
#60 0x00154ece in Fapply (nargs=2, args=0xbfffdd80) at eval.c:2532
        ret_ungc_val = 28
        i = 1310826
        numargs = 28
        spread_arg = 58721289
        funcall_args = (Lisp_Object *) 0xbfffdcf0
        fun = 3392976
#61 0x00155029 in apply1 (fn=75901137, arg=50394525) at eval.c:2796
        arg = 28
        ret_ungc_val = 28
#62 0x0018ff36 in read_process_output_call (fun_and_args=50394533) at process.c:5145
No locals.
#63 0x001517ac in internal_condition_case_1 (bfun=0x18ff19 <read_process_output_call>, arg=50394533, handlers=58760953, hfun=0x18ff38 <read_process_output_error_handler>) at eval.c:1559
        val = 36018656
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbffff6d8, 
  gcpro = 0x0, 
  jmp = {895, 433535, 8103, 1382069, -1073750440, 434284, 59314267, 58760953, -1073750440, -1073750624, -1073807329, 662, 1382218, 1245207, -1073807329, 31, -65536, 55}, 
  backlist = 0x0, 
  handlerlist = 0xbffff74c, 
  lisp_eval_depth = 0, 
  pdlcount = 5, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 58760953, 
  var = 58721289, 
  chosen_clause = 58745392, 
  tag = 0xbfffddb8, 
  next = 0xbffff74c
}
#64 0x0019043b in read_process_output (proc=36011060, channel=58760953) at process.c:5334
        odeactivate = 58721289
        text = 59314267
        outer_running_asynch_code = 0
        waiting = -1
        nbytes = 759
        outstream = 75901137
        old = (struct buffer *) 0x3101678
        p = (struct Lisp_Process *) 0x2257c30
        opoint = 1477660520
        coding = (struct coding_system *) 0x2235340
        carryover = 59314267
#65 0x0019640a in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=58721289, wait_proc=0x0, just_wait_proc=0) at process.c:4987
        nread = 28
        timeout_reduced_for_timers = 0
        channel = 4
        nfds = 1
        Available = {
  fds_bits = {16, 0 <repeats 31 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = 0
        no_avail = 0
        xerrno = 1
        proc = 4
        timeout = {
  tv_sec = 30, 
  tv_usec = 0
}
        end_time = {
  tv_sec = 1230151716, 
  tv_usec = 819301
}
        wait_channel = -1
        got_some_input = 1
#66 0x0000c18e in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6637
        sec = 30
        usec = 0
        do_display = 1
#67 0x000ede4b in read_char (commandflag=1, nmaps=2, maps=0xbffff470, prev_event=58721289, used_mouse_menu=0xbffff568, end_time=0x0) at keyboard.c:2903
        tem0 = 30
        delay_level = 4
        buffer_size = 36018656
        c = 58721289
        count = 58748777
        jmpcount = 2
        local_getcjmp = {895, 1310684, 8103, 970649, -1073745000, 1310753, 3398384, 3392976, -1073744856, -1073745328, 983071, 662, 972588, 983063, 58720287, 31, 0, 55}
        save_jump = {0 <repeats 18 times>}
        key_already_recorded = 0
        tem = 28
        save = -1073745120
        previous_echo_area_message = 58721289
        also_record = 58721289
        reread = 0
        polling_stopped_here = 30
        orig_kboard = (struct kboard *) 0x3102338
#68 0x000efbbb in read_key_sequence (keybuf=0xbffff628, bufsize=30, prompt=58721289, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9354
        interrupted_kboard = (KBOARD *) 0x3102338
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 58721289
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 2
        nmaps_allocated = 2
        defs = (Lisp_Object * volatile) 0xbffff450
        submaps = (Lisp_Object * volatile) 0xbffff470
        orig_local_map = 41880381
        orig_keymap = 58721289
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 35438045, 
  map = 35438045, 
  start = 0, 
  end = 0
}
        keytran = {
  parent = 35377021, 
  map = 35377021, 
  start = 0, 
  end = 0
}
        indec = {
  parent = 35438101, 
  map = 35438101, 
  start = 0, 
  end = 0
}
        shift_translated = 0
        delayed_switch_frame = 58721289
        original_uppercase = 3171168
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x3101678
        fake_prefixed_keys = 58721289
#69 0x000f1fdc in command_loop_1 () at keyboard.c:1632
        cmd = 3392976
        lose = 3392976
        nonundocount = 0
        keybuf = {192, 24, 0, 20, -1073746160, 0, 61534356, 1, 61534356, 53822270, 0, 1, 0, 53822268, 0, 0, 0, 61535148, 0, 0, 0, 1, 58721289, 0, -1073744228, -1073744416, 0, 0, 58721289, 59213281}
        i = 2
        prev_modiff = 12
        prev_buffer = (struct buffer *) 0x3101678
        already_adjusted = 0
#70 0x00151a38 in internal_condition_case (bfun=0xf1dbe <command_loop_1>, handlers=58760953, hfun=0xeaaff <cmd_error>) at eval.c:1511
        val = 36018656
        c = {
  tag = 58721289, 
  val = 58721289, 
  next = 0xbffff7dc, 
  gcpro = 0x0, 
  jmp = {895, 3432812, 8103, 1382727, 58721289, 58721289, 3406256, 3392976, -1073744008, -1073744192, 31, 662, 1382876, 1700200471, 3407903, 3342367, -1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 58760953, 
  var = 58721289, 
  chosen_clause = 0, 
  tag = 0xbffff6d8, 
  next = 0x0
}
#71 0x000e3e84 in command_loop_2 () at keyboard.c:1349
        val = 28
#72 0x0015168a in internal_catch (tag=58757025, func=0xe3e40 <command_loop_2>, arg=58721289) at eval.c:1247
        c = {
  tag = 58757025, 
  val = 58721289, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {895, -1073743840, 8103, 1381870, 1, 58721289, 3415312, 3392976, -1073743784, -1073743936, 58851359, 662, 1382013, 58851351, 58851359, 58720287, 51380224, 55}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        tag = 28
#73 0x000e3c26 in command_loop () at keyboard.c:1328
        val = 28
#74 0x000e3cdf in recursive_edit_1 () at keyboard.c:942
        val = 0
#75 0x000e3e27 in Frecursive_edit () at keyboard.c:1004
        buffer = 58721289
#76 0x000e2c3f in main (argc=3, argv=0xbffffa64) at emacs.c:1786
        dummy = 0
        stack_bottom_variable = 0 '\0'
        do_initial_setlocale = 1
        skip_args = 1
        rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67108864
}
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0

Lisp Backtrace:
"x-create-frame" (0xbfffd0d4)
"x-create-frame-with-faces" (0xbfffd264)
"make-frame" (0xbfffd3f4)
"make-frame-on-display" (0xbfffd574)
"server-create-window-system-frame" (0xbfffd704)
"byte-code" (0xbfffd834)
"byte-code" (0xbfffda64)
"server-process-filter" (0xbfffdcf4)

In GNU Emacs 23.0.60.1 (i386-apple-darwin8.11.1, GTK+ Version 2.12.9)
 of 2008-12-22 on mt-computer.local
Windowing system distributor `The XFree86 Project, Inc', version 11.0.40400000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_GB.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: nil
  default-enable-multibyte-characters: t

bug#1696: 23.0.60; Crash in XFreeColors

[Dan Nicolaescu]

Markus Triska <markus.triska@gmx.at> writes:

  > When I do in an X terminal:
  > 
  >    $ emacs -Q --daemon
  > 
  >    $ emacsclient -c
  > 
  > then close that terminal (thus killing the client), and then do:
  > 
  >    $ emacsclient -c
  > 
  > in a new X terminal, the daemon often crashes with the following
  > backtrace. I can reproduce this on OSX and latest Kubuntu jaunty
  > (using two tabs in Konsole of KDE 4.1) with today's Emacs CVS version.

Can you please try to reproduce this when you configure --with-x-toolkit=lucid + try
no to use the deamon: just do in a different  terminal:

   emacs -Q -f server-start

bug#1696: 23.0.60; Crash in XFreeColors

[Markus Triska]

Dan Nicolaescu <dann@ics.uci.edu> writes:

> Can you please try to reproduce this when you configure
> --with-x-toolkit=lucid 

I cannot reproduce the problem with the lucid toolkit.

> + try no to use the deamon: just do in a different terminal:
>
>    emacs -Q -f server-start

With either toolkit, I cannot reproduce the problem in this way.

bug#1696: 23.0.60; Crash in XFreeColors

[Dan Nicolaescu]

Markus Triska <markus.triska@gmx.at> writes:

  > Dan Nicolaescu <dann@ics.uci.edu> writes:
  > 
  > > Can you please try to reproduce this when you configure
  > > --with-x-toolkit=lucid 
  > 
  > I cannot reproduce the problem with the lucid toolkit.
  > 
  > > + try no to use the deamon: just do in a different terminal:
  > >
  > >    emacs -Q -f server-start
  > 
  > With either toolkit, I cannot reproduce the problem in this way.

How about if you do:

emacs -Q -nw -f server-start

bug#1696: 23.0.60; Crash in XFreeColors

[Markus Triska]

Dan Nicolaescu <dann@ics.uci.edu> writes:

> How about if you do:
>
> emacs -Q -nw -f server-start

This also fails to trigger the problem that I initially described.

bug#1696: 23.0.60; Crash in XFreeColors

[Chong Yidong]

> When I do in an X terminal:
>
>    $ emacs -Q --daemon
>
>    $ emacsclient -c
>
> then close that terminal (thus killing the client), and then do:
>
>    $ emacsclient -c
>
> in a new X terminal, the daemon often crashes with the following
> backtrace. I can reproduce this on OSX and latest Kubuntu jaunty
> (using two tabs in Konsole of KDE 4.1) with today's Emacs CVS version.

I haven't been able to reproduce this at all, using a GTK build (which I
assume is what you are using).  Do you still see the problem occurring?

bug#1696: 23.0.60; Crash in XFreeColors

[Markus Triska]

Chong Yidong <cyd@stupidchicken.com> writes:

> I haven't been able to reproduce this at all, using a GTK build (which I
> assume is what you are using).  Do you still see the problem occurring?

Yes, the problem only occurs with GTK, and I still see it with the
latest Emacs CVS version (both locally and via SSH), on Ubuntu jaunty.
Sometimes Emacs loops (as described in etc/PROBLEMS) if I try to
reproduce it, but at other times it still crashes. I will set up an SSH
account for you if you want to reproduce it yourself on this machine.

bug#1696: 23.0.60; Crash in XFreeColors

[YAMAMOTO Mitsuharu]

>>>>> On Wed, 08 Apr 2009 19:38:33 +0200, Markus Triska <markus.triska@gmx.at> said:

>> I haven't been able to reproduce this at all, using a GTK build
>> (which I assume is what you are using).  Do you still see the
>> problem occurring?

> Yes, the problem only occurs with GTK, and I still see it with the
> latest Emacs CVS version (both locally and via SSH), on Ubuntu
> jaunty.  Sometimes Emacs loops (as described in etc/PROBLEMS) if I
> try to reproduce it, but at other times it still crashes. I will set
> up an SSH account for you if you want to reproduce it yourself on
> this machine.

Could you try adding the following lines just before the call to
XftFontMatch in xftfont.c?  This is not intended as a final solution,
but just to see if my conjecture is correct.

  {
    int event_base, error_base;
    XRenderQueryExtension (display, &event_base, &error_base);
  }

If this works, then the cause of the problem is the order of adding
X11 extensions by libXft and libXrender (indeed nothing to do with
GTK+).  They both set hooks to XCloseDisplay via XESetCloseDisplay.
These hooks are called in LIFO way with respect to the addition of the
extensions.  If the extension for libXft is added before the one for
libXrender, then that leads to a problematic situation that libXft's
CloseDisplay hook is called later and it adds libXrender's hook again
and causes inconsistency in its internal states.

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

bug#1696: 23.0.60; Crash in XFreeColors

[Markus Triska]

YAMAMOTO Mitsuharu <mituharu@math.s.chiba-u.ac.jp> writes:

> Could you try adding the following lines just before the call to
> XftFontMatch in xftfont.c?  This is not intended as a final solution,
> but just to see if my conjecture is correct.

Meanwhile I upgraded Kubuntu to the released version of "jaunty" and
cannot reproduce the problem I originally reported there. Thus I
unfortunately do not know whether your changes fix the problem. Thank
you nevertheless for looking into it - I hope they fix the issue for
others. On current OSX Leopard, I cannot start the client (using -c)
at all with Emacs CVS, since the server immediately crashes with:

mt-imac:emacs mt$ gdb emacs 17781
GNU gdb 6.3.50-20050815 (Apple version gdb-962) (Sat Jul 26 08:14:40 UTC 2008)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-apple-darwin"...Reading symbols for shared libraries ..................................... done

/Users/mt/emacs/17781: No such file or directory.
Attaching to program: `/usr/local/bin/emacs', process 17781.
Reading symbols for shared libraries ++++++++++++++++++++++++++++++++++++....................................................................................................... done
0x966036f2 in select$DARWIN_EXTSN ()
(gdb) The program is running.  Quit anyway (and detach it)? (y or n) y
Detaching from program: `/usr/local/bin/emacs', process 17781 thread 0x203.
mt-imac:emacs mt$ gdb emacs 17781
GNU gdb 6.3.50-20050815 (Apple version gdb-962) (Sat Jul 26 08:14:40 UTC 2008)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-apple-darwin"...Reading symbols for shared libraries ..................................... done

/Users/mt/emacs/17781: No such file or directory.
Attaching to program: `/usr/local/bin/emacs', process 17781.
Reading symbols for shared libraries ++++++++++++++++++++++++++++++++++++....................................................................................................... done
0x966036f2 in select$DARWIN_EXTSN ()
(gdb) c 
Continuing.

Program received signal SIGTRAP, Trace/breakpoint trap.
0x9578d871 in __CFRunLoopFindMode ()
(gdb) bt
#0  0x9578d871 in __CFRunLoopFindMode ()
#1  0x9578f6ac in CFRunLoopAddSource ()
#2  0x96916dd0 in DAApprovalSessionScheduleWithRunLoop ()
#3  0x96da621a in _FSGetDiskArbSession ()
#4  0x96da5f62 in CreateDiskArbDiskForMountPath ()
#5  0x96da4d8e in FSCacheableClient_GetVolumeCachedInfo ()
#6  0x96da46c7 in MountVolume ()
#7  0x96da43c2 in MountInitialVolumes ()
#8  0x96da3fc1 in INIT_FileManager ()
#9  0x96da3e70 in GetRetainedVolFSVCBByVolumeID ()
#10 0x96da260e in PathGetObjectInfo ()
#11 0x96da24d9 in FSPathMakeRefInternal ()
#12 0x96dae0ff in FSPathMakeRef ()
#13 0x00bc2052 in FT_New_Face_From_Resource ()
#14 0x00bc2340 in FT_New_Face ()
#15 0x00f4c21b in _XftLockFile ()
#16 0x00f4cb42 in XftFontOpenInfo ()
#17 0x00f4d816 in XftFontOpenPattern ()
#18 0x001c7917 in xftfont_open (f=0x183b650, entity=25437572, pixel_size=20) at xftfont.c:279
#19 0x001799b6 in font_open_entity (f=0x183b650, entity=25437572, pixel_size=20) at font.c:2926
#20 0x0017b6a7 in font_load_for_lface (f=0x183b650, attrs=0x1842580, spec=25437572) at font.c:3453
#21 0x0017b72f in font_open_by_spec (f=0xf, spec=15) at font.c:3504
#22 0x0017db85 in font_open_by_name (f=0xf, name=0x1842584 " %?\001?\034?\002\001\021\005\003?\020\005\003\t") at font.c:3522
#23 0x000136c5 in x_set_font (f=0x1842580, arg=42691723, oldval=41943049) at frame.c:3385
#24 0x00010d06 in x_set_frame_parameters (f=0x183b650, alist=22640485) at frame.c:3014
#25 0x00014933 in x_default_parameter (f=0x183b650, alist=15, prop=42093081, deflt=42691819, xprop=0xf <Address 0xf out of bounds>, xclass=0xf <Address 0xf out of bounds>, type=15) at frame.c:4127
#26 0x000a6e20 in x_default_font_parameter (f=0x183b650, parms=22653253) at xfns.c:3095
#27 0x000a80dd in Fx_create_frame (parms=22653253) at xfns.c:3309
#28 0x001650a1 in Ffuncall (nargs=2, args=0xbfffd0d0) at eval.c:3051
#29 0x001a038b in Fbyte_code (bytestr=2215915, vector=2215932, maxdepth=5) at bytecode.c:678
#30 0x00164951 in funcall_lambda (fun=2215868, nargs=1, arg_vector=0xbfffd264) at eval.c:3232
#31 0x00164e9b in Ffuncall (nargs=2, args=0xbfffd260) at eval.c:3102
#32 0x001a038b in Fbyte_code (bytestr=2502571, vector=2502588, maxdepth=6) at bytecode.c:678
#33 0x00164951 in funcall_lambda (fun=2502524, nargs=1, arg_vector=0xbfffd3f4) at eval.c:3232
#34 0x00164e9b in Ffuncall (nargs=2, args=0xbfffd3f0) at eval.c:3102
#35 0x001a038b in Fbyte_code (bytestr=2501451, vector=2501468, maxdepth=4) at bytecode.c:678
#36 0x00164951 in funcall_lambda (fun=2501396, nargs=2, arg_vector=0xbfffd574) at eval.c:3232
#37 0x00164e9b in Ffuncall (nargs=3, args=0xbfffd570) at eval.c:3102
#38 0x001a038b in Fbyte_code (bytestr=42600811, vector=25203460, maxdepth=5) at bytecode.c:678
#39 0x00164951 in funcall_lambda (fun=25199876, nargs=3, arg_vector=0xbfffd704) at eval.c:3232
#40 0x00164e9b in Ffuncall (nargs=4, args=0xbfffd700) at eval.c:3102
#41 0x001a038b in Fbyte_code (bytestr=42589595, vector=25208916, maxdepth=17) at bytecode.c:678
#42 0x001644b6 in Feval (form=22588933) at eval.c:2386
#43 0x00166da2 in internal_lisp_condition_case (var=42305513, bodyform=22588933, handlers=22613341) at eval.c:1457
#44 0x001a0da2 in Fbyte_code (bytestr=42590171, vector=25209412, maxdepth=6) at bytecode.c:868
#45 0x001644b6 in Feval (form=22554309) at eval.c:2386
#46 0x00162bbc in internal_catch (tag=15, func=0x164090 <Feval>, arg=22554309) at eval.c:1248
#47 0x001a0d46 in Fbyte_code (bytestr=42590251, vector=25202884, maxdepth=2) at bytecode.c:853
#48 0x00164951 in funcall_lambda (fun=25209668, nargs=2, arg_vector=0xbfffdcf4) at eval.c:3232
#49 0x00164e9b in Ffuncall (nargs=3, args=0xbfffdcf0) at eval.c:3102
#50 0x001668b5 in Fapply (nargs=2, args=0xbfffdd80) at eval.c:2533
#51 0x00166a0d in apply1 (fn=50488705, arg=24868373) at eval.c:2797
#52 0x001a387d in read_process_output_call (fun_and_args=24868365) at process.c:5155
#53 0x00162cf3 in internal_condition_case_1 (bfun=0x1a3860 <read_process_output_call>, arg=24868365, handlers=41982641, hfun=0x1a3880 <read_process_output_error_handler>) at eval.c:1560
#54 0x001a3da0 in read_process_output (proc=25216740, channel=41982641) at process.c:5343
#55 0x001aa2a7 in wait_reading_process_output (time_limit=0, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=41943049, wait_proc=0x0, just_wait_proc=0) at process.c:4997
#56 0x000fb9bc in read_char (commandflag=1, nmaps=2, maps=0xbffff420, prev_event=41943049, used_mouse_menu=0xbffff518, end_time=0x0) at keyboard.c:4099
#57 0x000fd9f4 in read_key_sequence (keybuf=0xbffff5d8, bufsize=30, prompt=41943049, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9458
#58 0x000fff1a in command_loop_1 () at keyboard.c:1642
#59 0x00162fdd in internal_condition_case (bfun=0xffce0 <command_loop_1>, handlers=41982641, hfun=0xf6560 <cmd_error>) at eval.c:1512
#60 0x000ef208 in command_loop_2 () at keyboard.c:1359
#61 0x00162bbc in internal_catch (tag=15, func=0xef1c0 <command_loop_2>, arg=41943049) at eval.c:1248
#62 0x000eef5e in command_loop () at keyboard.c:1338
#63 0x000ef022 in recursive_edit_1 () at keyboard.c:953
#64 0x000ef1a1 in Frecursive_edit () at keyboard.c:1015
#65 0x000edf0b in main (argc=3, argv=0xbffff9d8) at emacs.c:1852

In GNU Emacs 23.0.93.1 (i386-apple-darwin9.6.1, GTK+ Version 2.14.7)
 of 2009-05-09 on mt-imac.local
Windowing system distributor `The X.Org Foundation', version 11.0.10402000
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t

bug#1696: 23.0.60; Crash in XFreeColors

[YAMAMOTO Mitsuharu]

>>>>> On Sat, 09 May 2009 01:40:01 +0200, Markus Triska <markus.triska@gmx.at> said:

>> Could you try adding the following lines just before the call to
>> XftFontMatch in xftfont.c?  This is not intended as a final
>> solution, but just to see if my conjecture is correct.

> Meanwhile I upgraded Kubuntu to the released version of "jaunty" and
> cannot reproduce the problem I originally reported there. Thus I
> unfortunately do not know whether your changes fix the
> problem. Thank you nevertheless for looking into it - I hope they
> fix the issue for others. On current OSX Leopard, I cannot start the
> client (using -c) at all with Emacs CVS, since the server
> immediately crashes with:

This seems to be another issue and related to daemon mode, rather than
a conflict between close-display hooks of libXft and libXrender that I
mentioned.  Actually, I was trying the following steps not involving
daemon mode.

  1. $ emacs -nw -Q
  2. (make-frame-on-display (getenv "DISPLAY")) ;; on tty
  3. (x-synchronize t)				;; on X, optional
  4. C-x 5 0					;; on X
  5. Repeat 2 and 4 a few times.

This produced a backtrace that is similar to your original report for
me on Mac OS X (both 10.4 and 10.5), X11 build with Xft support.
Though I couldn't reproduce it on Ubuntu 9.04.

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

bug#1696: 23.0.60; Crash in XFreeColors

[Markus Triska]

YAMAMOTO Mitsuharu <mituharu@math.s.chiba-u.ac.jp> writes:

>   1. $ emacs -nw -Q
>   2. (make-frame-on-display (getenv "DISPLAY")) ;; on tty
>   3. (x-synchronize t)				;; on X, optional
>   4. C-x 5 0					;; on X
>   5. Repeat 2 and 4 a few times.
>
> This produced a backtrace that is similar to your original report for
> me on Mac OS X (both 10.4 and 10.5), X11 build with Xft support.
> Though I couldn't reproduce it on Ubuntu 9.04.

Thank you, based on these steps, when I evaluate in "emacs -Q -nw" (on
Leopard):

   (while t
     (delete-frame (make-frame-on-display (getenv "DISPLAY"))))

then I see these messages flickering on the terminal a few times:

   Xlib:  extension "Generic Event Extension" missing on display "/tmp/launch-IGhxO1/:0".
   Xlib:  extension "Generic Event Extension" missing on display "/tmp/launch-IGhxO1/:0".
   Xlib:  extension "Generic Event Extension" missing on display "/tmp/launch-IGhxO1/:0".
   The program 'emacs' received an X Window System error.
   This probably reflects a bug in the program.
   The error was 'BadColor (invalid Colormap parameter)'.
   (Details: serial 477 error_code 12 request_code 89 minor_code 0)
   (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

and Emacs eventually quits with exit code 01.

bug#1696: 23.0.60; Crash in XFreeColors

[Markus Triska]

The patch you suggested improves the situation considerably: Emacs seems
to loop indefinitely with my previous test case, as intended. However, I
see the following messages flickering on the terminal:

Xlib:  extension "RANDR" missing on display "/tmp/launch-IGhxO1/:0".
Xlib:  extension "Generic Event Extension" missing on display "/tmp/launch-IGhxO1/:0".
Xlib:  extension "Generic Event Extension" missing on display "/tmp/launch-IGhxO1/:0".
Xlib:  extension "Generic Event Extension" missing on display "/tmp/launch-IGhxO1/:0".
Xlib:  extension "Generic Event Extension" missing on display "/tmp/launch-IGhxO1/:0".
Xlib:  extension "RANDR" missing on display "/tmp/launch-IGhxO1/:0".

and when I press "C-g" (as often as necessary) to interrupt the loop, I
once got:

(emacs:18799): Gtk-CRITICAL **: gtk_box_pack: assertion `child->parent
== NULL' failed

Very often, when I then exit Emacs with C-x C-c, I see "Fatal error" on
the terminal, but I could not reproduce this problem in the debugger.

bug#1696: 23.0.60; Crash in XFreeColors

[YAMAMOTO Mitsuharu]

>>>>> On Sat, 09 May 2009 10:01:10 +0900, YAMAMOTO Mitsuharu <mituharu@math.s.chiba-u.ac.jp> said:

> This seems to be another issue and related to daemon mode, rather than
> a conflict between close-display hooks of libXft and libXrender that I
> mentioned.  Actually, I was trying the following steps not involving
> daemon mode.

>   1. $ emacs -nw -Q
>   2. (make-frame-on-display (getenv "DISPLAY")) ;; on tty
>   3. (x-synchronize t)				;; on X, optional
>   4. C-x 5 0					;; on X
>   5. Repeat 2 and 4 a few times.

> This produced a backtrace that is similar to your original report for
> me on Mac OS X (both 10.4 and 10.5), X11 build with Xft support.
> Though I couldn't reproduce it on Ubuntu 9.04.

Now I understand why I couldn't reproduce it on Ubuntu 9.04.  The
libXrender extension had already been added as of the first libXft
call (i.e., XftFontMatch) because of the mouse cursor theme.

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp