bug#34256: 27.0.50; Crash on draw_glyphs()

[Kaushal Modi <kaushal.modi@gmail.com>]

[-- Attachment #1: Type: text/plain, Size: 12817 bytes --]

On Wed, Jan 30, 2019 at 11:51 AM Eli Zaretskii <eliz@gnu.org> wrote:

>
> I recommend always using these options when building the master
> branch.
>

OK. Will do so.

> I'll work on getting a recipe.
>
> Thanks.
>

Unfortunately, I couldn't create a recipe even with my whole emacs config.
I can recreate the issue only when I load the desktop session.

Here is the snippet of the .desktop file related to the buffer in which I
can reproduce the crash consistently.

=====

(setq desktop-saved-frameset
      [frameset 1
                (23633 59565 276710 128000)
                (desktop . "208")
                "kmodi@kmodi-lx01.foo.bar.com" nil nil
                ((((minibuffer . t)
                   (undecorated)
                   (override-redirect)
                   (font-backend xft x)
                   (font .
"-unknown-PragmataPro-normal-normal-normal-*-18-*-*-*-*-0-iso10646-1")
                   (font-parameter .
"-unknown-PragmataPro-normal-normal-normal-*-18-*-*-*-*-0-iso10646-1")
                   (border-width . 0)
                   (internal-border-width . 0)
                   (right-divider-width . 1)
                   (bottom-divider-width . 0)
                   (vertical-scroll-bars)
                   (horizontal-scroll-bars)
                   (foreground-color . "#f7f7f7")
                   (background-color . "#282828")
                   (mouse-color . "black")
                   (border-color . "black")
                   (screen-gamma)
                   (line-spacing)
                   (left-fringe . 8)
                   (right-fringe . 8)
                   (no-special-glyphs)
                   (scroll-bar-foreground)
                   (scroll-bar-background)
                   (menu-bar-lines . 0)
                   (tool-bar-lines . 0)
                   (title)
                   (wait-for-wm . t)
                   (tool-bar-position . top)
                   (inhibit-double-buffering)
                   (icon-type . t)
                   (auto-raise)
                   (auto-lower)
                   (cursor-type . box)
                   (scroll-bar-width . 0)
                   (scroll-bar-height . 0)
                   (alpha)
                   (no-focus-on-map)
                   (no-accept-focus)
                   (fullscreen)
                   (visibility . t)
                   (skip-taskbar)
                   (z-group)
                   (display-type . color)
                   (background-mode . dark)
                   (cursor-color . "white")
                   (sticky)
                   (last-focus-update)
                   (frameset--id . "BE37-83AB-0DA7-C565")
                   (frameset--mini t . t)
                   (modeline . t)
                   (unsplittable)
                   (icon-name)
                   (display . ":1.0")
                   (explicit-name)
                   (fullscreen-restore)
                   (frameset--text-pixel-width . 2030)
                   (frameset--text-pixel-height . 1089)
                   (height . 54)
                   (width . 225)
                   (left . 0)
                   (top . 0))
                  ((min-height . 4)
                   (min-width . 10)
                   (min-height-ignore . 2)
                   (min-width-ignore . 4)
                   (min-height-safe . 1)
                   (min-width-safe . 2)
                   (min-pixel-height . 80)
                   (min-pixel-width . 90)
                   (min-pixel-height-ignore . 40)
                   (min-pixel-width-ignore . 36)
                   (min-pixel-height-safe . 20)
                   (min-pixel-width-safe . 18))
                  leaf
                  (pixel-width . 2046)
                  (pixel-height . 1069)
                  (total-width . 227)
                  (total-height . 53)
                  (normal-height . 1.0)
                  (normal-width . 1.0)
                  (buffer "emacs_27_0.desktop"
                          (selected . t)
                          (hscroll . 0)
                          (fringes 8 8 nil)
                          (margins nil)
                          (scroll-bars nil 0 t nil 0 t)
                          (vscroll . 0)
                          (dedicated)
                          (point . 45706)
                          (start . 42427))
                  (prev-buffers
                   ("emacs_27_0.desktop" 42647 45125)
                   ("init.el" 9884 10328)
                   ("rxdp_simple_test.sv" 1 1089))))])

...

(desktop-create-buffer 208
  "/home/kmodi/hugo/work_blog/content-org/work-posts.org"
  "work-posts.org"
  'org-mode
  '(auto-fill-mode abbrev-mode visual-line-mode eldoc-mode
override-global-mode modi-mode beacon-mode hi-lock-mode
volatile-highlights-mode hungry-delete-mode page-break-lines-mode
undo-tree-mode wrap-region-mode writegood-mode diff-hl-mode org-indent-mode
org-hugo-auto-export-mode projectile-mode hardcore-mode which-key-mode
ivy-mode anzu-mode mode-line-space-mode)
  50848
  '(nil nil)
  nil
  nil
  '((indent-tabs-mode) (buffer-display-time 23633 59378 650447 18000)
(buffer-file-coding-system . utf-8-unix) (fill-column . 70)
(truncate-lines))
  '((mark-ring nil)))

=====

- I cannot reproduce the crash in an emacs -Q session using the same Org
file, or even using my full unaltered config (except for commenting out
desktop loading).

But now I have this detailed backtrace; hopefully it helps you spot the
problem:

xdisp.c:26154: Emacs fatal error: assertion failed: s->img

Thread 1 "emacs" hit Breakpoint 1, terminate_due_to_signal (sig=sig@entry=6,
    backtrace_limit=backtrace_limit@entry=2147483647) at emacs.c:370
370     {
(gdb) bt
#0  terminate_due_to_signal (sig=sig@entry=6,
backtrace_limit=backtrace_limit@entry=2147483647) at emacs.c:370
#1  0x00000000005a1622 in die (msg=msg@entry=0x67dc2c "s->img",
file=file@entry=0x67dbaa "xdisp.c", line=line@entry=26154) at alloc.c:7453
#2  0x00000000004378fe in fill_image_glyph_string (s=s@entry=0x7fffffff7aa0)
at xdisp.c:26154
#3  0x00000000004708cf in draw_glyphs (w=w@entry=0x13fa4e0, x=44,
row=0x234ba50, area=area@entry=TEXT_AREA, start=<optimized out>, start@entry=0,
end=end@entry=6, hl=DRAW_NORMAL_TEXT, overlaps=0)
    at xdisp.c:26841
#4  0x0000000000474bd2 in x_write_glyphs (w=0x13fa4e0,
updated_row=<optimized out>, start=<optimized out>, updated_area=TEXT_AREA,
len=6) at xdisp.c:29042
#5  0x000000000042244d in update_text_area (w=w@entry=0x13fa4e0,
updated_row=updated_row@entry=0x234ba50, vpos=vpos@entry=14) at
dispnew.c:3613
#6  0x0000000000422fea in update_window_line (w=w@entry=0x13fa4e0,
vpos=vpos@entry=14,
mouse_face_overwritten_p=mouse_face_overwritten_p@entry=0x7fffffff7f2f)
at dispnew.c:3856
#7  0x000000000042366e in update_window (w=w@entry=0x13fa4e0,
force_p=force_p@entry=true) at dispnew.c:3478
#8  0x00000000004238ab in update_window_tree (w=0x13fa4e0,
force_p=force_p@entry=true) at dispnew.c:3220
#9  0x000000000042389b in update_window_tree (w=w@entry=0xdfaee0,
force_p=force_p@entry=true) at dispnew.c:3218
#10 0x00000000004259db in update_frame (f=f@entry=0x143b1b0, force_p=true,
force_p@entry=false, inhibit_hairy_id_p=inhibit_hairy_id_p@entry=false) at
dispnew.c:3109
#11 0x000000000046cf22 in redisplay_internal () at xdisp.c:14521
#12 0x000000000046e493 in redisplay () at xdisp.c:13664
#13 0x000000000054451e in read_char (commandflag=0, map=...,
map@entry=XIL(0x418b203),
prev_event=XIL(0x418b203),
used_mouse_menu=used_mouse_menu@entry=0x7fffffff967b,
end_time=end_time@entry=0x0)
    at keyboard.c:2462
#14 0x0000000000545f05 in read_key_sequence
(keybuf=keybuf@entry=0x7fffffff9750,
prompt=..., prompt@entry=XIL(0x2fd53a4), dont_downcase_last=<optimized out>,
    can_return_switch_frame=can_return_switch_frame@entry=false,
fix_current_buffer=fix_current_buffer@entry=false,
prevent_redisplay=prevent_redisplay@entry=false) at keyboard.c:9082
#15 0x00000000005489be in read_key_sequence_vs (prompt=...,
continue_echo=XIL(0), dont_downcase_last=...,
can_return_switch_frame=XIL(0), cmd_loop=...,
allow_string=allow_string@entry=false)
    at keyboard.c:9777
#16 0x0000000000548a97 in Fread_key_sequence_vector (prompt=...,
continue_echo=..., dont_downcase_last=..., can_return_switch_frame=...,
cmd_loop=...) at keyboard.c:9858
#17 0x00000000005cf89c in funcall_subr (subr=0xcdd780
<Sread_key_sequence_vector>, numargs=numargs@entry=3,
args=args@entry=0x7fffffff9970)
at eval.c:2947
#18 0x00000000005cdc27 in Ffuncall (nargs=4, args=args@entry=0x7fffffff9968)
at eval.c:2860
#19 0x000000000060f0bb in exec_byte_code (bytestr=..., vector=...,
vector@entry=XIL(0x7ffff31fe77d), maxdepth=..., maxdepth@entry=make_number(14),
args_template=...,
    args_template@entry=make_number(256), nargs=nargs@entry=1,
args=<optimized out>, args@entry=0x7fffffff9ca0) at bytecode.c:633
#20 0x00000000005d0e5b in funcall_lambda (fun=fun@entry=XIL(0x7ffff31fe74d),
nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x7fffffff9ca0) at
eval.c:3058
#21 0x00000000005cdd80 in Ffuncall (nargs=2, args=args@entry=0x7fffffff9c98)
at eval.c:2862
#22 0x000000000060f0bb in exec_byte_code (bytestr=..., vector=...,
vector@entry=XIL(0x7ffff319f95d), maxdepth=..., maxdepth@entry=make_number(9),
args_template=..., args_template@entry=make_number(257),
    nargs=nargs@entry=1, args=<optimized out>, args@entry=0x7fffffffa0a0)
at bytecode.c:633
#23 0x00000000005d0e5b in funcall_lambda (fun=fun@entry=XIL(0x7ffff319f92d),
nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x7fffffffa0a0) at
eval.c:3058
#24 0x00000000005cdd80 in Ffuncall (nargs=2, args=args@entry=0x7fffffffa098)
at eval.c:2862
#25 0x000000000060f0bb in exec_byte_code (bytestr=..., vector=...,
vector@entry=XIL(0x604bd85), maxdepth=..., maxdepth@entry=make_number(14),
args_template=..., args_template@entry=make_number(0),
    nargs=nargs@entry=0, args=<optimized out>, args@entry=0x7fffffffa620)
at bytecode.c:633
#26 0x00000000005d0e5b in funcall_lambda (fun=fun@entry=XIL(0x604bec5),
nargs=nargs@entry=0, arg_vector=arg_vector@entry=0x7fffffffa620) at
eval.c:3058
#27 0x00000000005cdd80 in Ffuncall (nargs=nargs@entry=1,
args=args@entry=0x7fffffffa618)
at eval.c:2862
#28 0x00000000005c91cb in Ffuncall_interactively (nargs=1,
args=0x7fffffffa618) at callint.c:253
#29 0x00000000005cf71c in funcall_subr (subr=0xce4780
<Sfuncall_interactively>, numargs=numargs@entry=1,
args=args@entry=0x7fffffffa618)
at eval.c:2915
#30 0x00000000005cdc27 in Ffuncall (nargs=nargs@entry=2,
args=args@entry=0x7fffffffa610)
at eval.c:2860
#31 0x00000000005ce16c in Fapply (nargs=nargs@entry=3,
args=args@entry=0x7fffffffa610)
at eval.c:2433
#32 0x00000000005c9a0a in Fcall_interactively (function=...,
record_flag=..., keys=...) at callint.c:340
#33 0x00000000005cf86a in funcall_subr (subr=0xce4740
<Scall_interactively>, numargs=numargs@entry=3, args=args@entry=0x7fffffffa750)
at eval.c:2940#34 0x00000000005cdc27 in Ffuncall (nargs=4,
args=args@entry=0x7fffffffa748)
at eval.c:2860
#35 0x000000000060f0bb in exec_byte_code (bytestr=..., vector=...,
vector@entry=XIL(0x7ffff32a25a5), maxdepth=..., maxdepth@entry=make_number(13),
args_template=...,
    args_template@entry=make_number(1025), nargs=nargs@entry=1,
args=<optimized out>, args@entry=0x7fffffffaa78) at bytecode.c:633
#36 0x00000000005d0e5b in funcall_lambda (fun=fun@entry=XIL(0x7ffff32a2575),
nargs=nargs@entry=1, arg_vector=arg_vector@entry=0x7fffffffaa78) at
eval.c:3058
#37 0x00000000005cdd80 in Ffuncall (nargs=nargs@entry=2,
args=args@entry=0x7fffffffaa70)
at eval.c:2862
#38 0x00000000005ce041 in call1 (fn=..., fn@entry=XIL(0x4020), arg1=...) at
eval.c:2711
#39 0x0000000000547999 in command_loop_1 () at keyboard.c:1462
#40 0x00000000005ccded in internal_condition_case (bfun=bfun@entry=0x5473a3
<command_loop_1>, handlers=..., handlers@entry=XIL(0x5490),
hfun=hfun@entry=0x53c25f
<cmd_error>) at eval.c:1376
#41 0x0000000000537c9a in command_loop_2 (ignore=..., ignore@entry=XIL(0))
at keyboard.c:1090
#42 0x00000000005ccd35 in internal_catch (tag=..., func=func@entry=0x537c82
<command_loop_2>, arg=..., arg@entry=XIL(0)) at eval.c:1139
---Type <return> to continue, or q <return> to quit---
#43 0x000000000053addd in command_loop () at keyboard.c:1069
#44 0x000000000053bcff in recursive_edit_1 () at keyboard.c:714
#45 0x000000000053c061 in Frecursive_edit () at keyboard.c:785
#46 0x0000000000534efa in main (argc=1, argv=<optimized out>) at
emacs.c:1949

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
"read-key-sequence-vector" (0xffff9970)
"read-key" (0xffff9ca0)
"yes-or-no-p" (0xffffa0a0)
"vc-revert" (0xffffa620)
"funcall-interactively" (0xffffa618)
"call-interactively" (0xffffa750)
"command-execute" (0xffffaa78)
(gdb)

More Info:

- The Org file/buffer seen when this crash happens displays inline images.

[-- Attachment #2: Type: text/html, Size: 16641 bytes --]