bug#69358: 30.0.50; Segmentation fault: compare_overlays (v1=v1@entry=0x0, v2=v2@entry=0x7fffffffd510)

bug#69358: 30.0.50; Segmentation fault: compare_overlays (v1=v1@entry=0x0, v2=v2@entry=0x7fffffffd510)

[Bruno Barbier]

Running emacs from the current master, I'm getting the following
segfault:

     Program received signal SIGSEGV, Segmentation fault.
     0x00005555556e7c14 in compare_overlays (v1=v1@entry=0x0, 
         v2=v2@entry=0x7fffffffd510) at buffer.c:3188
     3188	  if (s1->priority != s2->priority)

I didn't try to reproduce with "-Q" as it might be tricky to reproduce
(Emacs is stable, works for hours, only one specific workflow is
triggering the crash).

Find below the output of 'bt full' and 'xbacktrace' and other bug report
infos.

Let me know if you need me to collect more information to help you solve
this bug.

Thanks,

Bruno



┌────
│ bt full
│ #0  0x00005555556e7c14 in compare_overlays (v1=v1@entry=0x0, 
│     v2=v2@entry=0x7fffffffd510) at buffer.c:3188
│         s1 = 0x0
│         s2 = 0x7fffffffd510
│ #1  0x000055555574159e in Fget_pos_property (position=position@entry=0x3d2, 
│     prop=prop@entry=0xa3b0, object=object@entry=0x555559c2a1dd)
│     at editfns.c:328
│         ol = <optimized out>
│         this = 0x7fffffffd510
│         itree_local_iter_ = {
│           node = 0x555558172440,
│           begin = 243,
│           end = 245,
│           otick = 1,
│           order = ITREE_ASCENDING
│         }
│         itree_iter_ = 0x7fffffffd4e0
│         posn = 244
│         obuf = 0x555559c2a1d8
│         node = 0x55555a63ce40
│         tem = 0x55555a9b61c3
│         items = {{
│             overlay = 0x55555a5f312d,
│             beg = 217,
│             end = 244,
│             priority = 12,
│             spriority = 0
│           }, {
│             overlay = 0x4000000006000000,
│             beg = 4611686019484352512,
│             end = 3,
│             priority = 93825078009008,
│             spriority = 93824994725839
│           }}
│         result = 0x0
│         b = 0x555559c2a1d8
│         res = 0x55555a9c1623
│ #2  0x00005555557b764a in get_local_map (position=<optimized out>, 
│     position@entry=244, buffer=0x555559c2a1d8, type=type@entry=0xa3b0)
│     at intervals.c:2207
│         prop = 0x0
│         lispy_position = 0x3d2
│         lispy_buffer = 0x555559c2a1dd
│         old_begv = 1
│         old_zv = 2160
│         old_begv_byte = 1
│         old_zv_byte = 2160
│         count = <optimized out>
│ #3  0x00005555556ddd5b in Fcurrent_active_maps (olp=olp@entry=0x30, 
│     position=0x0) at keymap.c:1710
│         nmaps = <optimized out>
│         pt = 244
│         maps = 0x0
│         local_map = 0x555558adc0d3
│         keymap = <optimized out>
│         otlp = <optimized out>
│         count = <optimized out>
│         keymaps = 0x55555ab1af43
│ #4  0x00005555556c50bd in active_maps (first_event=first_event@entry=0x0, 
│     second_event=second_event@entry=0x0) at keyboard.c:10169
│         position = <optimized out>
│ #5  0x00005555556d446a in read_key_sequence (
│     keybuf=keybuf@entry=0x7fffffffd8c0, prompt=prompt@entry=0x0, 
│     dont_downcase_last=dont_downcase_last@entry=false, 
│     can_return_switch_frame=can_return_switch_frame@entry=true, 
│     fix_current_buffer=fix_current_buffer@entry=true, 
│     prevent_redisplay=prevent_redisplay@entry=false, 
│     disable_text_conversion_p=false) at keyboard.c:10544
│         count = <optimized out>
│         t = <optimized out>
│         echo_start = 0
│         keys_start = 0
│         current_binding = <optimized out>
│         first_unbound = 31
│         mock_input = 0
│         used_mouse_menu_history = {false <repeats 30 times>}
│         fkey = {
│           parent = 0x7ffff2b53333,
│           map = 0x7ffff2b53333,
│           start = 0,
│           end = 0
│         }
│         keytran = {
│           parent = 0x7ffff337b92b,
│           map = 0x7ffff337b92b,
│           start = 0,
│           end = 0
│         }
│         indec = {
│           parent = 0x7ffff2b53323,
│           map = 0x7ffff2b53323,
│           start = 0,
│           end = 0
│         }
│         shift_translated = <optimized out>
│         delayed_switch_frame = <optimized out>
│         original_uppercase = <optimized out>
│         original_uppercase_position = <optimized out>
│         dummyflag = false
│         disabled_conversion = false
│         starting_buffer = <optimized out>
│         fake_prefixed_keys = 0x0
│         first_event = <optimized out>
│         second_event = 0x0
│ #6  0x00005555556d6124 in command_loop_1 () at keyboard.c:1428
│         cmd = <optimized out>
│         keybuf = {0x62a0, 0x2e85ab4fb59acd00, 0x7ffff31c9f15, 0x3, 0xa0, 
│           0x2e85ab4fb59acd00, 0x60, 0x0, 0x0, 0xf330, 0x555559da4bd5, 
│           0x555555750afa <unbind_to+282>, 0x7fffffffd9a0, 0x7fffffffd9a0, 0x9, 
│           0xf330, 0x30, 0x555559da4bd5, 0x7ffff2bed79c, 0x55555aaa4a53, 0x60, 
│           0x7fffffffd9a0, 0x7ffff2b80be3, 0x7fffffffdb24, 0x5, 
│           0x5555556c96ab <cmd_error+363>, 0x0, 0x0, 0x0, 0x2e85ab4fb59acd00}
│         i = <optimized out>
│         last_pt = <optimized out>
│         prev_modiff = 1277
│         prev_buffer = 0x555559c2a1d8
│ #7  0x000055555574f6d7 in internal_condition_case (
│     bfun=bfun@entry=0x5555556d5f60 <command_loop_1>, 
│     handlers=handlers@entry=0x90, hfun=hfun@entry=0x5555556c9540 <cmd_error>)
│     at eval.c:1537
│         val = <optimized out>
│         c = 0x555555e2ec30
│ #8  0x00005555556c1546 in command_loop_2 (handlers=handlers@entry=0x90)
│     at keyboard.c:1167
│         val = <optimized out>
│ #9  0x000055555574f631 in internal_catch (tag=tag@entry=0x102f0, 
│     func=func@entry=0x5555556c1520 <command_loop_2>, arg=arg@entry=0x90)
│     at eval.c:1217
│         val = <optimized out>
│         c = 0x555555e30c10
│ #10 0x00005555556c14e1 in command_loop () at keyboard.c:1145
│ No locals.
│ #11 0x00005555556c90d1 in recursive_edit_1 () at keyboard.c:753
│         count = <optimized out>
│         val = <optimized out>
│ #12 0x00005555556c9450 in Frecursive_edit () at keyboard.c:836
│         count = <optimized out>
│         buffer = <optimized out>
│ #13 0x00005555555a354e in main (argc=5, argv=<optimized out>) at emacs.c:2624
│         stack_bottom_variable = 0x0
│         old_argc = <optimized out>
│         dump_file = 0x0
│         no_loadup = false
│         junk = 0x0
│         dname_arg = 0x0
│         ch_to_dir = 0x0
│         original_pwd = <optimized out>
│         dump_mode = <optimized out>
│         skip_args = 0
│         temacs = 0x0
│         attempt_load_pdump = <optimized out>
│         only_version = false
│         rlim = {
│           rlim_cur = 10022912,
│           rlim_max = 18446744073709551615
│         }
│         lc_all = <optimized out>
│         sockfd = -1
└────

┌────
│ xbacktrace
└────

In GNU Emacs 30.0.50 (build 1, x86_64-pc-linux-gnu, X toolkit, cairo
 version 1.18.0) of 2024-02-24 built on keynux
Repository revision: 477eb882b57b3defd43ea8dd9510cfdf5fd9ee79
Repository branch: bba-main-master
Windowing system distributor 'The X.Org Foundation', version 11.0.12101011
System Description: Gentoo Linux

Configured using:
 'configure --prefix=/home/bruno/local --with-x-toolkit=lucid
 --without-toolkit-scroll-bars --without-tree-sitter
 --without-native-compilation --without-modules --without-xwidgets
 --without-pop --without-mailutils --without-compress-install
 --without-hesiod --without-gameuser --without-lcms2 --without-wide-int
 --without-kerberos --without-kerberos5 --with-sound=no --without-ns
 --without-gsettings --without-gconf --without-libotf --without-m17n-flt
 --with-gif=ifavailable --with-harfbuzz'

Configured features:
ACL CAIRO DBUS FREETYPE GIF GLIB GMP GNUTLS GPM HARFBUZZ JPEG LIBXML2
NOTIFY INOTIFY PDUMPER PNG RSVG SECCOMP SQLITE3 THREADS TIFF WEBP X11
XDBE XIM XINPUT2 XPM LUCID ZLIB

Important settings:
  value of $LC_CTYPE: en_US.UTF-8
  value of $LANG: C.UTF8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  show-paren-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  minibuffer-regexp-mode: t
  line-number-mode: t
  indent-tabs-mode: t
  transient-mark-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message mailcap yank-media puny dired
dired-loaddefs rfc822 mml mml-sec password-cache epa derived epg rfc6068
epg-config gnus-util text-property-search time-date subr-x mm-decode
mm-bodies mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader
sendmail rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils
warnings icons cl-loaddefs cl-lib rmc iso-transl tooltip cconv eldoc
paren electric uniquify ediff-hook vc-hooks lisp-float-type elisp-mode
mwheel term/x-win x-win term/common-win x-dnd touch-screen tool-bar dnd
fontset image regexp-opt fringe tabulated-list replace newcomment
text-mode lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow
isearch easymenu timer select scroll-bar mouse jit-lock font-lock syntax
font-core term/tty-colors frame minibuffer nadvice seq simple cl-generic
indonesian philippine cham georgian utf-8-lang misc-lang vietnamese
tibetan thai tai-viet lao korean japanese eucjp-ms cp51932 hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
composite emoji-zwj charscript charprop case-table epa-hook
jka-cmpr-hook help abbrev obarray oclosure cl-preloaded button loaddefs
theme-loaddefs faces cus-face macroexp files window text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget keymap
hashtable-print-readable backquote threads dbusbind inotify
dynamic-setting font-render-setting cairo x-toolkit xinput2 x multi-tty
move-toolbar make-network-process emacs)

Memory information:
((conses 16 40182 12061) (symbols 48 5225 0) (strings 32 13458 1825)
 (string-bytes 1 325236) (vectors 16 9366)
 (vector-slots 8 111959 8728) (floats 8 27 24) (intervals 56 311 2)
 (buffers 976 12))

bug#69358: 30.0.50; Segmentation fault: compare_overlays (v1=v1@entry=0x0, v2=v2@entry=0x7fffffffd510)

[Eli Zaretskii]

> From: Bruno Barbier <perso.bruno.barbier@free.fr>
> Date: Sat, 24 Feb 2024 12:07:31 +0100
> 
> 
> Running emacs from the current master, I'm getting the following
> segfault:
> 
>      Program received signal SIGSEGV, Segmentation fault.
>      0x00005555556e7c14 in compare_overlays (v1=v1@entry=0x0, 
>          v2=v2@entry=0x7fffffffd510) at buffer.c:3188
>      3188	  if (s1->priority != s2->priority)
> 
> I didn't try to reproduce with "-Q" as it might be tricky to reproduce
> (Emacs is stable, works for hours, only one specific workflow is
> triggering the crash).
> 
> Find below the output of 'bt full' and 'xbacktrace' and other bug report
> infos.
> 
> Let me know if you need me to collect more information to help you solve
> this bug.
> 
> Thanks,
> 
> Bruno
> 
> 
> 
> ┌────
> │ bt full
> │ #0  0x00005555556e7c14 in compare_overlays (v1=v1@entry=0x0, 
> │     v2=v2@entry=0x7fffffffd510) at buffer.c:3188
> │         s1 = 0x0
> │         s2 = 0x7fffffffd510
> │ #1  0x000055555574159e in Fget_pos_property (position=position@entry=0x3d2, 
> │     prop=prop@entry=0xa3b0, object=object@entry=0x555559c2a1dd)
> │     at editfns.c:328
> │         ol = <optimized out>
> │         this = 0x7fffffffd510
> │         itree_local_iter_ = {
> │           node = 0x555558172440,
> │           begin = 243,
> │           end = 245,
> │           otick = 1,
> │           order = ITREE_ASCENDING
> │         }
> │         itree_iter_ = 0x7fffffffd4e0
> │         posn = 244
> │         obuf = 0x555559c2a1d8
> │         node = 0x55555a63ce40
> │         tem = 0x55555a9b61c3
> │         items = {{
> │             overlay = 0x55555a5f312d,
> │             beg = 217,
> │             end = 244,
> │             priority = 12,
> │             spriority = 0
> │           }, {
> │             overlay = 0x4000000006000000,
> │             beg = 4611686019484352512,
> │             end = 3,
> │             priority = 93825078009008,
> │             spriority = 93824994725839
> │           }}
> │         result = 0x0
> │         b = 0x555559c2a1d8
> │         res = 0x55555a9c1623

Adding Stefan, who made the changes there last.

Stefan, there's some kind of thinko in the code: result seems to stay
at its initial NULL value.  Or did I miss something?

bug#69358: 30.0.50; Segmentation fault: compare_overlays (v1=v1@entry=0x0, v2=v2@entry=0x7fffffffd510)

[Stefan Monnier via Bug reports for GNU Emacs, the Swiss army knife of text editors]

> Stefan, there's some kind of thinko in the code: result seems to stay
> at its initial NULL value.  Or did I miss something?

Oops, should be fixed now, thanks.


        Stefan

bug#69358: 30.0.50; Segmentation fault: compare_overlays (v1=v1@entry=0x0, v2=v2@entry=0x7fffffffd510)

[Bruno Barbier]

Stefan Monnier <monnier@iro.umontreal.ca> writes:

>> Stefan, there's some kind of thinko in the code: result seems to stay
>> at its initial NULL value.  Or did I miss something?
>
> Oops, should be fixed now, thanks.
>
>
>         Stefan

My crash recipe doesn't work anymore :-)

Thanks Stefan, Eli.

Bruno

bug#69358: 30.0.50; Segmentation fault: compare_overlays (v1=v1@entry=0x0, v2=v2@entry=0x7fffffffd510)

[Eli Zaretskii]

> From: Bruno Barbier <perso.bruno.barbier@free.fr>
> Cc: 69358@debbugs.gnu.org
> Date: Sat, 24 Feb 2024 20:37:22 +0100
> 
> Stefan Monnier <monnier@iro.umontreal.ca> writes:
> 
> >> Stefan, there's some kind of thinko in the code: result seems to stay
> >> at its initial NULL value.  Or did I miss something?
> >
> > Oops, should be fixed now, thanks.
> >
> >
> >         Stefan
> 
> My crash recipe doesn't work anymore :-)
> 
> Thanks Stefan, Eli.

Thanks for testing, I'm therefore closing this bug.