bug#23939: Segfault in daemon mode Emacs when detaching an X session

bug#23939: Segfault in daemon mode Emacs when detaching an X session

[Doug Gilmore]

[-- Attachment #1: Type: text/plain, Size: 649 bytes --]

I have been running my own build of Emacs 24.2 for quite a while in
daemon mode for quite a while without any problems except that the
daemon would on rare occasions crash when I detached a windows frame
via the delete-frame Emacs command.  The other day this happened
several times in succession when connecting to a daemon running on
another host and I was able to catch the failure under an attached gdb
session.  I attached a backtrace and a prototype fix.

I have been building my own Emacs on Ubuntu-12/14 configured with the
--with-x-toolkit=lucid option, so this is not a Gtk issue.

Has anyone else been seeing this problem?

Thanks,

Doug

[-- Attachment #2: emacs-gdb-log.txt --]
[-- Type: text/plain, Size: 6131 bytes --]

(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
x_uncatch_errors () at /scratch/dgilmore/emacs-24.2/src/xterm.c:7672
(gdb) f
#0  x_uncatch_errors () at /scratch/dgilmore/emacs-24.2/src/xterm.c:7672
(gdb) where
#0  x_uncatch_errors () at /scratch/dgilmore/emacs-24.2/src/xterm.c:7672
#1  0x00000000004cb588 in x_catch_errors_unwind (dummy=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/xselect.c:546
#2  0x000000000055b4ce in unbind_to (count=<optimized out>, value=11872738) at /scratch/dgilmore/emacs-24.2/src/eval.c:3433
#3  0x000000000055b6e5 in unwind_to_catch (catch=0x7ffc44910f60, value=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/eval.c:1314
#4  0x000000000055d5a9 in Fsignal (error_symbol=11924850, data=38401462) at /scratch/dgilmore/emacs-24.2/src/eval.c:1764
#5  0x000000000055d5b9 in xsignal (error_symbol=<optimized out>, data=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/eval.c:1785
#6  0x000000000055e087 in xsignal1 (error_symbol=11924850, arg=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/eval.c:1800
#7  0x000000000055e10c in verror (m=<optimized out>, ap=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/eval.c:1998
#8  0x000000000055e19c in error (m=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/eval.c:2010
#9  0x00000000004b333c in x_connection_closed (dpy=<optimized out>, error_message=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/xterm.c:7879
#10 0x00000000004b5642 in x_error_quitter (display=0x21379e0, event=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/xterm.c:7934
#11 0x00000000004b5685 in x_error_handler (event=<optimized out>, display=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/xterm.c:7904
#12 x_error_handler (display=<optimized out>, event=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/xterm.c:7890
#13 0x00007f80182da20f in _XError () from /usr/lib/x86_64-linux-gnu/libX11.so.6
#14 0x00007f80182d71d1 in ?? () from /usr/lib/x86_64-linux-gnu/libX11.so.6
#15 0x00007f80182d7215 in ?? () from /usr/lib/x86_64-linux-gnu/libX11.so.6
#16 0x00007f80182d8050 in _XReply () from /usr/lib/x86_64-linux-gnu/libX11.so.6
#17 0x00007f80182d399d in XSync () from /usr/lib/x86_64-linux-gnu/libX11.so.6
#18 0x00000000004b98a8 in x_catch_errors (dpy=0x21379e0) at /scratch/dgilmore/emacs-24.2/src/xterm.c:7652
#19 0x00000000004ce84e in x_reply_selection_request (event=0x7ffc44910a10, dpyinfo=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/xselect.c:624
#20 x_handle_selection_request (event=0x7ffc44910a10) at /scratch/dgilmore/emacs-24.2/src/xselect.c:868
#21 x_handle_selection_event (event=0x7ffc44910a10) at /scratch/dgilmore/emacs-24.2/src/xselect.c:1021
#22 0x00000000004eb9cb in process_special_events () at /scratch/dgilmore/emacs-24.2/src/keyboard.c:4209
#23 0x00000000004edde5 in swallow_events (do_display=0) at /scratch/dgilmore/emacs-24.2/src/keyboard.c:4227
#24 0x000000000059c609 in wait_reading_process_output (time_limit=5, microsecs=0, read_kbd=0, do_display=0, wait_for_cell=12135958, wait_proc=<optimized out>, just_wait_proc=0)
    at /scratch/dgilmore/emacs-24.2/src/process.c:4771
#25 0x00000000004cd71b in x_get_foreign_selection (selection_symbol=<optimized out>, target_type=12182354, time_stamp=11872738, frame=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/xselect.c:1271
#26 0x00000000004cd89b in x_clipboard_manager_save (frame=34646533) at /scratch/dgilmore/emacs-24.2/src/xselect.c:2197
#27 0x000000000055acfe in internal_condition_case_1 (bfun=0x4cd820 <x_clipboard_manager_save>, arg=34646533, handlers=11872786, hfun=0x4cb8e0 <x_clipboard_manager_error_1>)
    at /scratch/dgilmore/emacs-24.2/src/eval.c:1552
#28 0x000000000041b3b8 in delete_frame (frame=34646533, force=11872738) at /scratch/dgilmore/emacs-24.2/src/frame.c:1232
#29 0x000000000055ca34 in Ffuncall (nargs=<optimized out>, args=0x7ffc449111f0) at /scratch/dgilmore/emacs-24.2/src/eval.c:3004
#30 0x0000000000558c51 in Fcall_interactively (function=11914818, record_flag=11872786, keys=11918933) at /scratch/dgilmore/emacs-24.2/src/callint.c:852
#31 0x000000000055ca21 in Ffuncall (nargs=<optimized out>, args=0x7ffc449113b0) at /scratch/dgilmore/emacs-24.2/src/eval.c:3008
#32 0x000000000055cc84 in call3 (fn=<optimized out>, arg1=<optimized out>, arg2=<optimized out>, arg3=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/eval.c:2801
#33 0x00000000004e781a in Fexecute_extended_command (prefixarg=11872738) at /scratch/dgilmore/emacs-24.2/src/keyboard.c:10419
#34 0x000000000055ca43 in Ffuncall (nargs=<optimized out>, args=0x7ffc44911530) at /scratch/dgilmore/emacs-24.2/src/eval.c:3001
#35 0x0000000000558c51 in Fcall_interactively (function=11921106, record_flag=11872738, keys=11918933) at /scratch/dgilmore/emacs-24.2/src/callint.c:852
#36 0x000000000055ca21 in Ffuncall (nargs=<optimized out>, args=0x7ffc44911700) at /scratch/dgilmore/emacs-24.2/src/eval.c:3008
#37 0x000000000055cc84 in call3 (fn=<optimized out>, arg1=<optimized out>, arg2=<optimized out>, arg3=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/eval.c:2801
#38 0x00000000004f5299 in command_loop_1 () at /scratch/dgilmore/emacs-24.2/src/keyboard.c:1572
#39 0x000000000055ab96 in internal_condition_case (bfun=0x4f4f00 <command_loop_1>, handlers=11924850, hfun=0x4e9cc0 <cmd_error>) at /scratch/dgilmore/emacs-24.2/src/eval.c:1514
#40 0x00000000004e812e in command_loop_2 (ignore=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/keyboard.c:1160
#41 0x000000000055aa78 in internal_catch (tag=<error reading variable: Cannot access memory at address 0xffffffffffffffe0>, func=0x4e8110 <command_loop_2>, arg=11872738)
    at /scratch/dgilmore/emacs-24.2/src/eval.c:1271
#42 0x00000000004e9797 in command_loop () at /scratch/dgilmore/emacs-24.2/src/keyboard.c:1139
#43 recursive_edit_1 () at /scratch/dgilmore/emacs-24.2/src/keyboard.c:759
#44 0x00000000004e9acc in Frecursive_edit () at /scratch/dgilmore/emacs-24.2/src/keyboard.c:823
#45 0x000000000040c45d in main (argc=2, argv=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/emacs.c:1715
(gdb) p x_error_message
$1 = (struct x_error_message_stack *) 0x0

[-- Attachment #3: 0001-Make-sure-x_error_message-is-not-NULL.patch --]
[-- Type: application/octet-stream, Size: 862 bytes --]

From f95687788e0031d96cdfadbe897d9af413ad9488 Mon Sep 17 00:00:00 2001
From: Doug Gilmore <dougjgilmore@gmail.com>
Date: Sat, 9 Jul 2016 17:56:56 -0700
Subject: [PATCH] Make sure x_error_message is not NULL.

Before dereferencing the pointer.
---
 src/xterm.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/xterm.c b/src/xterm.c
index 9ce1668..86734ec 100644
--- a/src/xterm.c
+++ b/src/xterm.c
@@ -7665,6 +7665,14 @@ x_uncatch_errors (void)
 {
   struct x_error_message_stack *tmp;
 
+  /* In rare situations when running Emacs run in daemon mode,
+     shutting down an emacsclient via delete-frame can cause
+     x_uncatch_errors to be called when x_error_message is set to
+     NULL.  */
+  
+  if (x_error_message == NULL)
+    return;
+
   BLOCK_INPUT;
 
   /* The display may have been closed before this function is called.
-- 
1.9.1

bug#23939: Segfault in daemon mode Emacs when detaching an X session

[Noam Postavsky]

#14958 = emacs --daemon crashing when X-frames are removed ungracefully
#11676 = Daemon crashes when ssh dies
#22174 = emacs --daemon crashes when ssh is disconnected. I am using lucid x toolkit.
merge 14958 11676 22174
#11639 = 24.0.95; Emacs daemon hangs when emacsclient was killed
# probably the GTK thing
merge 11639 8501
quit

Doug Gilmore <dougjgilmore@gmail.com> writes:

> I have been running my own build of Emacs 24.2 for quite a while in
> daemon mode for quite a while without any problems except that the
> daemon would on rare occasions crash when I detached a windows frame
> via the delete-frame Emacs command.  The other day this happened
> several times in succession when connecting to a daemon running on
> another host and I was able to catch the failure under an attached gdb
> session.  I attached a backtrace and a prototype fix.
>
> I have been building my own Emacs on Ubuntu-12/14 configured with the
> --with-x-toolkit=lucid option, so this is not a Gtk issue.
>
> Has anyone else been seeing this problem?

There are some other reports about Emacs daemon dying when closing X
sessions, but the backtraces look different, so I guess it's not the
same problem.

> #0  x_uncatch_errors () at /scratch/dgilmore/emacs-24.2/src/xterm.c:7672
> #1  0x00000000004cb588 in x_catch_errors_unwind (dummy=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/xselect.c:546
> #2  0x000000000055b4ce in unbind_to (count=<optimized out>, value=11872738) at /scratch/dgilmore/emacs-24.2/src/eval.c:3433
> #3  0x000000000055b6e5 in unwind_to_catch (catch=0x7ffc44910f60, value=<optimized out>) at /scratch/dgilmore/emacs-24.2/src/eval.c:1314
> #4  0x000000000055d5a9 in Fsignal (error_symbol=11924850, data=38401462) at /scratch/dgilmore/emacs-24.2/src/eval.c:1764

> (gdb) p x_error_message
> $1 = (struct x_error_message_stack *) 0x0

> Subject: [PATCH] Make sure x_error_message is not NULL.
>
> Before dereferencing the pointer.

> @@ -7665,6 +7665,14 @@ x_uncatch_errors (void)
>  {
>    struct x_error_message_stack *tmp;
>  
> +  /* In rare situations when running Emacs run in daemon mode,
> +     shutting down an emacsclient via delete-frame can cause
> +     x_uncatch_errors to be called when x_error_message is set to
> +     NULL.  */
> +  
> +  if (x_error_message == NULL)
> +    return;
> +

If this really is possible, I guess a NULL check wouldn't be a bad
thing...

bug#23939: Segfault in daemon mode Emacs when detaching an X session

[Lars Ingebrigtsen]

Noam Postavsky <npostavs@gmail.com> writes:

>> +  /* In rare situations when running Emacs run in daemon mode,
>> +     shutting down an emacsclient via delete-frame can cause
>> +     x_uncatch_errors to be called when x_error_message is set to
>> +     NULL.  */
>> +  
>> +  if (x_error_message == NULL)
>> +    return;
>
> If this really is possible, I guess a NULL check wouldn't be a bad
> thing...

I've applied the patch to Emacs 28, as it seemed to fix the bug for
Doug, and it should probably not have any adverse affects otherwise.

-- 
(domestic pets only, the antidote for overdose, milk.)
   bloggy blog: http://lars.ingebrigtsen.no