bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Torsten Bronger]

WARNING: This bug is difficult for me to reproduce.  I hope I found a
minimal example which exhibits the bug for everyone, but things like
display resolution or X settings may have an influence, so you may have
a hard time reproducing it.  That said ...

I see Emacs segfaulting when moving the cursor upwards in a LaTeX
document while tex-fold-mode is active.  The starting position of the
cursor is important.

I placed all files to reproduce the bug at
<http://wilson.bronger.org/emacs-glyph_row-bug.tar>.  The TeX file needs
to be put in /tmp.  tex-fold-mode must be present.  Furthermore, place
.emacs and .emacs.desktop in the proper positions, start current Git
Emacs, and press the "cursor up" button.  Then, Emacs crashes for me.

The subject of this bug is just to give it a name.  I do not know
whether glyph_row is the issue.  However, I bisected the problem, and it
started with commit f425a774, which sets glyph_row to NULL in two
places.  If I revert this commit, the problem is gone.


In GNU Emacs 28.0.50 (build 6, x86_64-pc-linux-gnu, cairo version 1.16.0)
 of 2020-12-10 built on brad
Repository revision: 4f352ad6f1759ae6dcff6ba43847273491bf9c30
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.12008000
System Description: Ubuntu 20.04.1 LTS

Configured using:
 'configure --prefix=/usr/ --mandir=/usr/share/man/
 --infodir=/usr/share/info/ --with-x-toolkit=no --without-makeinfo
 --with-xpm --with-jpeg --with-tiff --with-gif --with-png --with-x
 --with-file-notification=inotify'

Configured features:
XPM JPEG TIFF GIF PNG RSVG CAIRO SOUND GPM DBUS GSETTINGS GLIB NOTIFY
INOTIFY ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE HARFBUZZ M17N_FLT LIBOTF
ZLIB OLDXMENU X11 XDBE XIM MODULES THREADS LIBSYSTEMD PDUMPER LCMS2

Important settings:
  value of $EMACSLOADPATH: /home/bronger/.emacs.d/lisp:
  value of $LC_MONETARY: de_DE.UTF-8
  value of $LC_NUMERIC: de_DE.UTF-8
  value of $LC_TIME: de_DE.UTF-8
  value of $LANG: de_DE.UTF-8
  value of $XMODIFIERS: @im=fcitx
  locale-coding-system: utf-8-unix

Major mode: LaTeX/FP

Minor modes in effect:
  text-scale-mode: t
  flyspell-mode: t
  reftex-mode: t
  centered-cursor-mode: t
  magit-auto-revert-mode: t
  global-git-commit-mode: t
  async-bytecomp-package-mode: t
  shell-dirtrack-mode: t
  darkroom-mode: t
  global-auto-revert-mode: t
  TeX-fold-mode: t
  TeX-PDF-mode: t
  savehist-mode: t
  display-time-mode: t
  desktop-save-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  auto-fill-function: do-auto-fill

Load-path shadows:
/home/bronger/.emacs.d/elpa/auctex-12.3.1/tex-site hides /home/bronger/.emacs.d/lisp/tex-site
/home/bronger/.emacs.d/lisp/cmake-mode hides /usr/share/emacs/site-lisp/cmake-mode

Features:
(shadow sort mail-extr emacsbug sendmail face-remap magit-extras python
tramp-sh tramp tramp-loaddefs trampver tramp-integration files-x
tramp-compat ls-lisp dired-aux vc-git flyspell ispell reftex-dcr reftex
reftex-loaddefs reftex-vars font-latex latexenc tex-mode
centered-cursor-mode etags-table magit-submodule magit-obsolete
magit-blame magit-stash magit-reflog magit-bisect magit-push magit-pull
magit-fetch magit-clone magit-remote magit-commit magit-sequence
magit-notes magit-worktree magit-tag magit-merge magit-branch
magit-reset magit-files magit-refs magit-status magit magit-repos
magit-apply magit-wip magit-log which-func imenu magit-diff smerge-mode
diff diff-mode magit-core magit-autorevert magit-margin magit-transient
magit-process magit-mode git-commit transient magit-git magit-section
magit-utils log-edit pcvs-util add-log with-editor async-bytecomp async
shell dash graphviz-dot-mode taskjuggler-mode skeleton darkroom cql-mode
sql view rust-mode swift-mode go-errcheck go-mode find-file ffap etags
fileloop xref project yaml-mode dockerfile-mode rx sh-script smie
executable dired-x adaptive-wrap org-duration org-element avl-tree
generator ol-eww ol-rmail ol-mhe ol-irc ol-info ol-gnus nnselect
gnus-search eieio-opt cl-extra help-mode speedbar ezimage dframe
gnus-art mm-uu mml2015 mm-view mml-smime smime dig gnus-sum shr kinsoku
svg dom gnus-group gnus-undo gnus-start gnus-dbus gnus-cloud nnimap
nnmail mail-source utf7 netrc nnoo parse-time iso8601 gnus-spec gnus-int
gnus-range message rmc puny rfc822 mml mml-sec epa derived epg
epg-config mm-decode mm-bodies mm-encode mail-parse rfc2231 mailabbrev
gmm-utils mailheader gnus-win gnus nnheader gnus-util rmail
rmail-loaddefs rfc2047 rfc2045 ietf-drums mail-utils mm-util mail-prsvr
wid-edit ol-docview doc-view jka-compr image-mode exif dired
dired-loaddefs ol-bibtex bibtex ol-bbdb ol-w3m org-agenda ob-python org
ob ob-tangle ob-ref ob-lob ob-table ob-exp org-macro org-footnote
org-src ob-comint org-pcomplete pcomplete org-list org-faces
org-entities time-date noutline outline org-version ob-emacs-lisp
ob-core ob-eval org-table ol org-keys org-compat org-macs org-loaddefs
format-spec find-func server mmm-mode mmm-univ mmm-class mmm-region
mmm-auto mmm-vars mmm-utils mmm-compat rst browse-kill-ring
bbdb-autoloads bbdb timezone cal-china lunar solar cal-dst cal-bahai
cal-islam cal-hebrew holidays hol-loaddefs appt diary-lib diary-loaddefs
cal-menu calendar cal-loaddefs preview reporter tex-buf latex
latex-flymake flymake-proc flymake compile text-property-search comint
ansi-color ring warnings thingatpt tex-ispell tex-style autorevert
filenotify tex-fold easy-mmode tex dbus xml crm advice texmathp edmacro
kmacro savehist time desktop frameset delsel cus-start cus-load tex-site
info package easymenu browse-url url url-proxy url-privacy url-expand
url-methods url-history url-cookie url-domsuf url-util mailcap
url-handlers url-parse auth-source cl-seq eieio eieio-core cl-macs
eieio-loaddefs password-cache json subr-x map url-vars seq byte-opt gv
bytecomp byte-compile cconv cl-loaddefs cl-lib iso-transl tooltip eldoc
electric uniquify ediff-hook vc-hooks lisp-float-type mwheel term/x-win
x-win term/common-win x-dnd tool-bar dnd fontset image regexp-opt fringe
tabulated-list replace newcomment text-mode elisp-mode lisp-mode
prog-mode register page tab-bar menu-bar rfn-eshadow isearch timer
select scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame minibuffer cl-generic cham georgian utf-8-lang
misc-lang vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms
cp51932 hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese composite charscript charprop case-table epa-hook
jka-cmpr-hook help simple abbrev obarray cl-preloaded nadvice button
loaddefs faces cus-face macroexp files window text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote threads dbusbind inotify lcms2
dynamic-setting system-font-setting font-render-setting cairo x
multi-tty make-network-process emacs)

Memory information:
((conses 16 489247 50916)
 (symbols 48 39010 1)
 (strings 32 136893 11721)
 (string-bytes 1 4610070)
 (vectors 16 63227)
 (vector-slots 8 732383 72966)
 (floats 8 869 67)
 (intervals 56 23909 2046)
 (buffers 984 39))

-- 
Torsten Bronger

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Stefan Kangas]

[-- Attachment #1: Type: text/plain, Size: 1249 bytes --]

Torsten Bronger <bronger@physik.rwth-aachen.de> writes:

> I see Emacs segfaulting when moving the cursor upwards in a LaTeX
> document while tex-fold-mode is active.  The starting position of the
> cursor is important.
>
> I placed all files to reproduce the bug at
> <http://wilson.bronger.org/emacs-glyph_row-bug.tar>.  The TeX file needs

I've attached the relevant file test.tex here.

> to be put in /tmp.  tex-fold-mode must be present.  Furthermore, place
> .emacs and .emacs.desktop in the proper positions, start current Git
> Emacs, and press the "cursor up" button.  Then, Emacs crashes for me.

Here are the steps I followed:

0. Install auctex
1. Put test.tex in /tmp
2. emacs -Q
3. C-x C-f /tmp/test.tex
4. <up>

But I did not see any crash.  Are any other steps needed to reproduce
this?

Could you also produce a backtrace of the problem?  You can find
instructions for doing that by typing `C-h C-d'.  Don't forget to
rebuild Emacs with debugging symbols first.

> The subject of this bug is just to give it a name.  I do not know
> whether glyph_row is the issue.  However, I bisected the problem, and it
> started with commit f425a774, which sets glyph_row to NULL in two
> places.  If I revert this commit, the problem is gone.

[-- Attachment #2: test.tex --]
[-- Type: text/x-tex, Size: 7243 bytes --]

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi sufd hu ds iufhds iufhiudshf iudshfl dsfliu
  hdsliuf hdsl iufhliuds hf dsfiu hdudsa hiu hdiusa hdliua hsliud hsaliud
  hsaiudhliusa hd iusahd iuhsal iudhsaliu hdliusahdliu hsald iuhsald iuhsal
  iuhdl saldiu hsaliud hsaliud hsaiud hlsaiu hdliusa hliud hsaliudh liusa
  hdliusa hdliua hssasdadsj saoij doisa jdöoi jsadöoi jsaöoid jöoisa doisa
  jdöoi jsaöoid jsaöoi jdöoisa jdöoi jsaödoi jsaöoid jsaöoi jdöoisa jdöi jsaöid
  jsaöi jdöoisa jdöoia jsöoid jsaöoid jsaöi jaöoisjdoijsadoijsaöoidjsaöi
  jdöijsa döiojsaöoi jdösaij döoiajs öidjdliu hsaliud hlisau hdliusa hdliuas
  hdsfui hsfliu hdsliuf hdsufhliuds hfliuds hfliu hdsliuf hdsliuf hliuds hfiuds
  hliuf hdsliuf dja isjdö saöjd iasöjd isajdöi sajöid jsaid jöisa djöisa jdöi
  ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöidj oisajoidsaö doia jsöoid jsaöoid jasöoi djöoisa
  jdöoia sjöoid jsaödoi sajöoid jsaöoid jösaoi jdöoisa jöoid jsaöoid joisa
  jdöoi jsaöoid jsaöoijdaöois jö diad jsa idjasoi d sa jfds
  hjfjöoiajöofadsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saodsakjd saöoid jsaid jasoi dja isjdö saöjd iasöjd
  isajdöi sajöid jsaid jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi
  jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi asaoi dijas öoidjasfsdoisjd foi sjfioj safoij siö jföisoaj
  föoisj öföoi jdöoisa jdöoiasjdoijsaöoid jöosa djö jsadö isajö idjösaoi
  jdöoisa jdöoiajsjsdah d jsaio döoisa jdöoijsa öoidj saöoi jdöoisa jdoisöid
  jsa idjasoi d sa jdsaöoid jsaoi jasidj öoidjsaöoi jdöoisajödoia jsdöoi jasöoi
  jdöoisa jdöoi jsaöoid jsaöoi jdöoisa jdöoia jsöoidjasdsaj djsaöoidöoisa
  jdöoia sjöoiddsalkj dösajdöjsa ölkdjölsa jdisa döi jsaöoijd öoisa jdöoisaj
  öoid jsaöoid jöoisaj döoisaj döoi jsadsaöoi jdö isajödoi jsaö oidjösa oijdöoi
  doisajdöoialloHdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi
  sajöid jsaid jöisa a iasöjd isajdöi sajöid jsaid jöisa djöisa jdöi asaoi
  dijas öoidjasfsdoisjd foi sjfioj safoij siö jföisoaj föoisj öföoi jdöoisa
  jdöoiasjdoijsaöoid jöosa djö jsadö isajö idjösaoi jdöoisa jdöoiajsjsöid jsa
  idjasoi d sa jdsaöoid jsaoi jdsaj djsaöoidöoisa jdöoia sjöoiddsalkj
  dösajdöjsa ölkdjölsa jdisa döi jsaöoijd öoisa jdöoisaj öoid jsaöoid jöoisaj
  döoisaj döoi jsadsaöoi jdö isajödoi jsaö oidjösa oijdöoi doisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoadsi oi sadoi jsaio djoisa jdoia jsdoi jsaöoid
  jöoisa jdöoisa jdöiudsah liu hdiusa hdliu hsaliud hsaiudhoi jsaöoid jaöois
  jdsadsaoij doijsaöoidjsaoidjöoisa jddöoi jsaöoid jaöois jdöoia jdöoi jsaöoid
  jsaöoidj öoisadsdjoias jdoijsa dsa jdid jasoi dja isjdö saöjd iasöjd isajdöi
  sajöid jsaid jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi
  jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaou hdsauh dliu hsaldui
  hasliu hdliuas hdliu hsaliud hsaldliusahdliu hsaliudhsadu alus hdlu sahlud
  hsalud hliusahdliu hsaldiui jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}

\emph{Hdsads dsaoi saoi saoid jasoi dja isjdö saöjd iasöjd isajdöi sajöid jsaid
  jöisa djöisa jdöi ajsöid jsa idjasoi d sa jdsaöoid jsaoi jdoisajdöoiallo}
% Local Variables:
% TeX-PDF-mode: t
% eval: (tex-fold-mode)
% eval: (font-lock-fontify-buffer)
% eval: (TeX-fold-buffer)
% End:

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Torsten Bronger]

[-- Attachment #1: Type: text/plain, Size: 1118 bytes --]

Hallöchen!

Stefan Kangas writes:

> Torsten Bronger <bronger@physik.rwth-aachen.de> writes:
>
> [...]
>
>> to be put in /tmp.  tex-fold-mode must be present.  Furthermore,
>> place .emacs and .emacs.desktop in the proper positions, start
>> current Git Emacs, and press the "cursor up" button.  Then, Emacs
>> crashes for me.
>
> Here are the steps I followed:
>
> 0. Install auctex
> 1. Put test.tex in /tmp
> 2. emacs -Q
> 3. C-x C-f /tmp/test.tex
> 4. <up>
>
> But I did not see any crash.  Are any other steps needed to
> reproduce this?

Yes, .emacs and .emacs.desktop in the tar file need to be in the
proper locations.  Moreover, tex-fold-mode must be installed.  This
is annoying, I know, but I really found no simpler way to trigger
the error.

> Could you also produce a backtrace of the problem?  You can find
> instructions for doing that by typing `C-h C-d'.  Don't forget to
> rebuild Emacs with debugging symbols first.

I will try to do so, but please bear with me as I have no experience
with such tools and workflows.

Regards,
Torsten.

-- 
Torsten Bronger

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 4913 bytes --]

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Eli Zaretskii]

> From: Torsten Bronger <bronger@physik.rwth-aachen.de>
> Date: Thu, 10 Dec 2020 08:55:59 +0100
> 
> I see Emacs segfaulting when moving the cursor upwards in a LaTeX
> document while tex-fold-mode is active.  The starting position of the
> cursor is important.
> 
> I placed all files to reproduce the bug at
> <http://wilson.bronger.org/emacs-glyph_row-bug.tar>.  The TeX file needs
> to be put in /tmp.  tex-fold-mode must be present.  Furthermore, place
> .emacs and .emacs.desktop in the proper positions, start current Git
> Emacs, and press the "cursor up" button.  Then, Emacs crashes for me.
> 
> The subject of this bug is just to give it a name.  I do not know
> whether glyph_row is the issue.  However, I bisected the problem, and it
> started with commit f425a774, which sets glyph_row to NULL in two
> places.  If I revert this commit, the problem is gone.

Ouch! what a terrible blunder!  Sorry about that; I see the problem
and am working on a solution.

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Stefan Kangas]

Torsten Bronger <bronger@physik.rwth-aachen.de> writes:

>>> to be put in /tmp.  tex-fold-mode must be present.  Furthermore,
>>> place .emacs and .emacs.desktop in the proper positions, start
>>> current Git Emacs, and press the "cursor up" button.  Then, Emacs
>>> crashes for me.
>>
>> Here are the steps I followed:
>>
>> 0. Install auctex
>> 1. Put test.tex in /tmp
>> 2. emacs -Q
>> 3. C-x C-f /tmp/test.tex
>> 4. <up>
>>
>> But I did not see any crash.  Are any other steps needed to
>> reproduce this?
>
> Yes, .emacs and .emacs.desktop in the tar file need to be in the
> proper locations.  Moreover, tex-fold-mode must be installed.  This
> is annoying, I know, but I really found no simpler way to trigger
> the error.

OK, so I tried this:

0. mkdir /tmp/emacs-bug
1. mv test.tex .emacs .emacs.desktop /tmp/emacs-bug
2. cd /tmp/emacs-bug
3. HOME=`pwd` emacs
4. M-x package-install RET
5. [Install auctex]
6. C-x C-f test.tex RET
7. <up>

And I see no crash.  Are the above steps all that is needed?

>> Could you also produce a backtrace of the problem?  You can find
>> instructions for doing that by typing `C-h C-d'.  Don't forget to
>> rebuild Emacs with debugging symbols first.
>
> I will try to do so, but please bear with me as I have no experience
> with such tools and workflows.

Thanks, that would be helpful.

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Eli Zaretskii]

> Date: Thu, 10 Dec 2020 15:54:55 +0200
> From: Eli Zaretskii <eliz@gnu.org>
> Cc: 45156@debbugs.gnu.org
> 
> > I see Emacs segfaulting when moving the cursor upwards in a LaTeX
> > document while tex-fold-mode is active.  The starting position of the
> > cursor is important.
> > 
> > I placed all files to reproduce the bug at
> > <http://wilson.bronger.org/emacs-glyph_row-bug.tar>.  The TeX file needs
> > to be put in /tmp.  tex-fold-mode must be present.  Furthermore, place
> > .emacs and .emacs.desktop in the proper positions, start current Git
> > Emacs, and press the "cursor up" button.  Then, Emacs crashes for me.
> > 
> > The subject of this bug is just to give it a name.  I do not know
> > whether glyph_row is the issue.  However, I bisected the problem, and it
> > started with commit f425a774, which sets glyph_row to NULL in two
> > places.  If I revert this commit, the problem is gone.
> 
> Ouch! what a terrible blunder!  Sorry about that; I see the problem
> and am working on a solution.

Should be fixed now, please try the latest master branch.  If there
are any adverse effects of the change I installed, please tell the
details.

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Torsten Bronger]

[-- Attachment #1: Type: text/plain, Size: 329 bytes --]

Hallöchen!

Eli Zaretskii writes:

> [...]
>
> Should be fixed now, please try the latest master branch.  If
> there are any adverse effects of the change I installed, please
> tell the details.

The current master does not have this problem any more.  Thank you!

Regards,
Torsten Bronger.

-- 
Torsten Bronger

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 4913 bytes --]

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Eli Zaretskii]

> From: Torsten Bronger <bronger@physik.rwth-aachen.de>
> Date: Thu, 10 Dec 2020 22:04:11 +0100
> 
> Eli Zaretskii writes:
> 
> > [...]
> >
> > Should be fixed now, please try the latest master branch.  If
> > there are any adverse effects of the change I installed, please
> > tell the details.
> 
> The current master does not have this problem any more.  Thank you!

Thanks, I'm therefore closing this bug report.

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Vasilij Schneidermann]

[-- Attachment #1: Type: text/plain, Size: 642 bytes --]

I've run into this bug after upgrading from Emacs 27.1 to 27.2, rebuilt
Emacs with debug symbols and managed to chase it down to a line in
xdisp.c dereferencing a null pointer today. Running `git blame` pointed
me towards this thread. While the bug has been fixed on master and it's
rather tricky to reproduce (it involves at least one third party package
for me and typing a long line at the end of the window that then wraps
around), I'd be inclined to call 27.2 more than just a bugfix release
due to the xdisp.c change introducing this bug. Is there a chance that a
patch can be published for the 27.2 release for downstream maintainers?

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Eli Zaretskii]

> Date: Fri, 30 Apr 2021 13:03:22 +0200
> From: Vasilij Schneidermann <mail@vasilij.de>
> 
> Is there a chance that a patch can be published for the 27.2 release
> for downstream maintainers?

I don't understand what that means in practice.  Can you elaborate,
please?

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Vasilij Schneidermann]

[-- Attachment #1: Type: text/plain, Size: 595 bytes --]

> I don't understand what that means in practice.  Can you elaborate,
> please?

The Emacs package on Arch Linux [1] applies three patches to avoid
fontconfig-related crashes when loading up color fonts [2]. The changes
for this bug look more complicated and might need adjustments to apply
cleanly to the 27.2 release. If that's indeed the case, then I'd try to
get the Arch Linux maintainer to apply it to their Emacs package to
avoid that particular crash.

[1]: https://archlinux.org/packages/extra/x86_64/emacs/
[2]: https://github.com/archlinux/svntogit-packages/tree/packages/emacs/trunk

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Eli Zaretskii]

> Date: Fri, 30 Apr 2021 15:10:32 +0200
> From: Vasilij Schneidermann <mail@vasilij.de>
> Cc: 45156@debbugs.gnu.org
> 
> > I don't understand what that means in practice.  Can you elaborate,
> > please?
> 
> The Emacs package on Arch Linux [1] applies three patches to avoid
> fontconfig-related crashes when loading up color fonts [2]. The changes
> for this bug look more complicated and might need adjustments to apply
> cleanly to the 27.2 release. If that's indeed the case, then I'd try to
> get the Arch Linux maintainer to apply it to their Emacs package to
> avoid that particular crash.

Let me know if it doesn't apply cleanly.

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Gregory Heytings]

>
> The Emacs package on Arch Linux [1] applies three patches to avoid 
> fontconfig-related crashes when loading up color fonts [2]. The changes 
> for this bug look more complicated and might need adjustments to apply 
> cleanly to the 27.2 release.
>

These three patches are already included in the Emacs 27.2 (and in the 
Emacs 26.3) release AFAICS.

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Vasilij Schneidermann]

[-- Attachment #1: Type: text/plain, Size: 233 bytes --]

> These three patches are already included in the Emacs 27.2 (and in the Emacs
> 26.3) release AFAICS.

Good point. It seems they aren't applied during the build process, so it
looks like the package maintainer forgot removing them.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Vasilij Schneidermann]

[-- Attachment #1: Type: text/plain, Size: 225 bytes --]

> Let me know if it doesn't apply cleanly.

I've rebuilt the package and the patch applied cleanly. My downstream
bug report can be found on [1]. Feel free to close this bug again.

[1]: https://bugs.archlinux.org/task/70661

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

bug#45156: 28.0.50; Segfault due to glyph_row being set to NULL

[Eli Zaretskii]

> Date: Fri, 30 Apr 2021 17:05:38 +0200
> From: Vasilij Schneidermann <mail@vasilij.de>
> Cc: 45156@debbugs.gnu.org
> 
> > Let me know if it doesn't apply cleanly.
> 
> I've rebuilt the package and the patch applied cleanly. My downstream
> bug report can be found on [1]. Feel free to close this bug again.

Thanks.

The bug stays closed, your messages didn't reopen it.