bug#63614: 29.0.91; PGTK Emacs crashes after clearing the clipboard

[leohdz172--- via "Bug reports for GNU Emacs, the Swiss army knife of text editors" <bug-gnu-emacs@gnu.org>]

On Thu, May 25, 2023 at 06:33:52PM -0600, Po Lu wrote:
> What if you apply this change?
> 
> diff --git a/src/pgtkterm.c b/src/pgtkterm.c
> index b8c626d81d8..bfad949941b 100644
> --- a/src/pgtkterm.c
> +++ b/src/pgtkterm.c
> @@ -376,11 +376,16 @@ mark_pgtkterm (void)
>    for (i = 0; i < n; i++)
>      {
>        union buffered_input_event *ev = &evq->q[i];
> -      mark_object (ev->ie.x);
> -      mark_object (ev->ie.y);
> -      mark_object (ev->ie.frame_or_window);
> -      mark_object (ev->ie.arg);
> -      mark_object (ev->ie.device);
> +
> +      if (ev->ie.type != SELECTION_CLEAR_EVENT
> +	  && ev->ie.type != SELECTION_REQUEST_EVENT)
> +	{
> +	  mark_object (ev->ie.x);
> +	  mark_object (ev->ie.y);
> +	  mark_object (ev->ie.frame_or_window);
> +	  mark_object (ev->ie.arg);
> +	  mark_object (ev->ie.device);
> +	}
>      }
> 
>    for (dpyinfo = x_display_list; dpyinfo;

I did not apply the patch, instead I updated to 42052686752e399e778d33401dd621afbac0071d
which is basically the same patch. It still crashes (the same way I reported first).
Here the backtrace:
(gdb) bt full
#0  0x00007f1c8c2ad8ec in  () at /usr/lib64/libc.so.6
#1  0x00007f1c8c25e3e2 in raise () at /usr/lib64/libc.so.6
#2  0x0000558328bcdc78 in terminate_due_to_signal (sig=11, backtrace_limit=<optimized out>)
    at emacs.c:464
#3  0x0000558328bceacb in handle_fatal_signal (sig=11) at sysdep.c:1783
        fatal = <optimized out>
#4  deliver_thread_signal (handler=<optimized out>, sig=11) at sysdep.c:1775
        fatal = <optimized out>
#5  deliver_fatal_thread_signal (sig=11) at sysdep.c:1795
        fatal = <optimized out>
#6  handle_sigsegv (sig=11, siginfo=0x558329455cb0 <sigsegv_stack+64496>, arg=<optimized out>)
    at sysdep.c:1888
        fatal = <optimized out>
#7  0x00007f1c8c25e490 in <signal handler called> () at /usr/lib64/libc.so.6
#8  0x0000558328e86fb9 in pgtk_handle_selection_clear (event=<optimized out>) at pgtkselect.c:742
        selection = <optimized out>
        changed_owner_time = 0
        selection_symbol = <optimized out>
        local_selection_data = <optimized out>
        local_selection_time = <optimized out>
        dpyinfo = 0x29baeab0
        Vselection_alist = <optimized out>
#9  0x0000558328cea9c6 in pgtk_handle_selection_event (event=0x7fffe2a229b0) at pgtkselect.c:782
        event = 0x558329405c80 <kbd_buffer+1152>
        copy = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0x29baeab0, requestor = 0x0, selection = 0x45, target = 0x0, property = 0x0, time = 0}
        moved_events = <optimized out>
#10 process_special_events () at keyboard.c:4449
        event = 0x558329405c80 <kbd_buffer+1152>
        copy = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0x29baeab0, requestor = 0x0, selection = 0x45, target = 0x0, property = 0x0, time = 0}
        moved_events = <optimized out>
#11 0x0000558328cebbcd in swallow_events (do_display=true) at keyboard.c:4489
        old_timers_run = <optimized out>
#12 0x0000558328e0789c in wait_reading_process_output
    (time_limit=<optimized out>, nsecs=<optimized out>, read_kbd=<optimized out>, do_display=<optimized out>, wait_for_cell=<optimized out>, wait_proc=<optimized out>, just_wait_proc=<optimized out>)
    at process.c:5781
        leave = false
        wrapped = <optimized out>
        process_skipped = <optimized out>
        channel_start = <optimized out>
        child_fd = <optimized out>
        channel = <optimized out>
        nfds = <optimized out>
        Available = {fds_bits = {16, 0 <repeats 15 times>}}
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = true
        check_delay = <optimized out>
        no_avail = false
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 0, tv_nsec = 0}
        end_time = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        timer_delay = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        got_output_end_time = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        wait = <optimized out>
        got_some_output = <optimized out>
        prev_wait_proc_nbytes_read = <optimized out>
        retry_for_async = <optimized out>
        count = {bytes = <optimized out>}
        now = {tv_sec = <optimized out>, tv_nsec = <optimized out>}
        last_read_channel = -1
#13 0x0000558328be8350 in sit_for
    (timeout=<optimized out>, reading=<optimized out>, display_option=<optimized out>) at dispnew.c:6264
        sec = 30
        nsec = 0
        do_display = <optimized out>
        curbuf_eq_winbuf = true
        nbytes = <optimized out>
#14 0x0000558328cf44d5 in read_char
    (commandflag=1, map=0x55832a17ef73, prev_event=0x0, used_mouse_menu=0x7fffe2a234ab, end_time=0x0)
    at keyboard.c:2881
        delay_level = <optimized out>
        buffer_size = <optimized out>
        c = 0x0
        local_getcjmp = {{__jmpbuf = {94021820932736, -961532412328081999, 1, 139760518129416, 0, 94021828021619, -961532411696839247, -6458610983165819471}, __mask_was_saved = 0, __saved_mask = {__val = {94021814991392, 94021835287715, 586, 2, 94021815006159, 140736995668736, 40128, 140736995668624, 0, 0, 139760518129421, 0, 94021835287715, 0, 146, 147}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0x0
        also_record = 0x0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x558329b292d0
#15 0x0000558328ea2417 in read_key_sequence.constprop.0
    (keybuf=<optimized out>, prevent_redisplay=false, fix_current_buffer=<optimized out>, can_return_switch_frame=<optimized out>, dont_downcase_last=<optimized out>, prompt=<optimized out>) at keyboard.c:10083
        interrupted_kboard = 0x558329b292d0
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = <optimized out>
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 0x55832a17ef73
        first_unbound = 31
        mock_input = 0
        used_mouse_menu_history = {false <repeats 30 times>}
        fkey = {parent = 0x5583299bd393, map = 0x5583299bd393, start = 0, end = 0}
        keytran = {parent = 0x7f1c888080f3, map = 0x7f1c888080f3, start = 0, end = 0}
        indec = {parent = 0x5583299bd3a3, map = 0x5583299bd3a3, start = 0, end = 0}
        shift_translated = <optimized out>
        delayed_switch_frame = <optimized out>
        original_uppercase = <optimized out>
        original_uppercase_position = <optimized out>
        dummyflag = false
        fake_prefixed_keys = 0x0
        first_event = 0x0
        second_event = <optimized out>
#16 0x0000558328ce7b6a in command_loop_1 () at keyboard.c:1384
        cmd = <optimized out>
        keybuf = {0x5e, 0x558328da6526 <eval_sub+1142>, 0x55832996a510, 0x558328dff13c <exec_byte_code+508>, 0x0, 0x80, 0x0, 0x7f1c8850dbc8, 0x558328f56020 <main_thread.lto_priv>, 0x7f1c888e52e2, 0x5583299b03c4, 0x0, 0x558328ee0314, 0x7f1c8dbc3705, 0x5441465f53554244, 0x7f1c8c2bb400, 0x7fffe2a23aa0, 0xa6ec1548f4ad3200, 0x9540, 0x558328ee6d80, 0x7fffe2a23770, 0x60, 0x5583299b03c4, 0x0, 0x558328f56020 <main_thread.lto_priv>, 0x558328ce58a5 <top_level_2+725>, 0x558328ee0314, 0x7f1c8c2bbf12 <malloc+434>, 0x15, 0x30}
        i = <optimized out>
        prev_modiff = 34
        prev_buffer = 0x7f1c88096708
#17 0x0000558328da0907 in internal_condition_case
    (bfun=0x558328ce78a0 <command_loop_1>, handlers=<optimized out>, hfun=0x558328ce5300 <cmd_error>)
    at eval.c:1474
        val = <optimized out>
        c = 0x5583299b4350
#18 0x0000558328ce55be in command_loop_2 (handlers=handlers@entry=0x90) at keyboard.c:1133
        val = <optimized out>
#19 0x0000558328da085c in internal_catch
    (tag=<optimized out>, func=0x558328ce5590 <command_loop_2>, arg=0x90) at eval.c:1197
        val = <optimized out>
        c = 0x5583299b3de0
#20 0x0000558328ce7389 in command_loop () at keyboard.c:1111
#21 0x0000558328ed5910 in recursive_edit_1.isra.0 () at keyboard.c:720
        val = <optimized out>
#22 0x0000558328ce786c in Frecursive_edit () at keyboard.c:803
        buffer = <optimized out>
#23 0x0000558328bdbbad in main (argc=<optimized out>, argv=0x7fffe2a23bb8) at emacs.c:2529
        stack_bottom_variable = 0x0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = 0x0
        dump_mode = <optimized out>
        skip_args = 0
        temacs = 0x0
        attempt_load_pdump = <optimized out>
        only_version = false
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        lc_all = <optimized out>
        sockfd = -1
        module_assertions = <optimized out>
(gdb) frame 9
#9  0x0000558328cea9c6 in pgtk_handle_selection_event (event=0x7fffe2a229b0) at pgtkselect.c:782
782	   pgtk_handle_selection_clear (event);
(gdb) p *event
$1 = {kind = SELECTION_CLEAR_EVENT, dpyinfo = 0x29baeab0, requestor = 0x0, selection = 0x45,
  target = 0x0, property = 0x0, time = 0}
(gdb) p *event->selection
$2 = <incomplete type>
(gdb) p *event->dpyinfo
Cannot access memory at address 0x29baeab0
(gdb) p kbd_buffer[1152].sie
$3 = {kind = NO_EVENT, dpyinfo = 0x0, requestor = 0x0, selection = 0x0, target = 0x0, property = 0x0,
  time = 0}
(gdb) p x_display_list
$4 = (struct pgtk_display_info *) 0x558329baeab0
(gdb) p *x_display_list
$5 = {next = 0x0, terminal = 0x558329a8e7f0, {gdpy = 0x558329ac4b10, display = 0x558329ac4b10}, name_list_element = 0x5583299bd383, reference_count = 1, x_id = 1,
  x_id_name = 0x558329b781a0 "emacs@gentoo", n_fonts = 5, smallest_char_width = 2, smallest_font_height = 15, bitmaps = 0x0, bitmaps_size = 0, bitmaps_last = 0, resx = 96, resy = 96,
  grabbed = 0, n_planes = 32, color_p = 1, icon_bitmap_id = -2, root_window = 42, rdb = 0x0, vertical_scroll_bar_cursor = 0x558329b49230, horizontal_scroll_bar_cursor = 0x558329bfbe30,
  mouse_highlight = {mouse_face_beg_row = -1, mouse_face_beg_col = -1, mouse_face_beg_x = 0, mouse_face_end_row = -1, mouse_face_end_col = -1, mouse_face_end_x = 0, mouse_face_window = 0x0,
    mouse_face_face_id = 0, mouse_face_overlay = 0x0, mouse_face_mouse_frame = 0x0, mouse_face_mouse_x = 0, mouse_face_mouse_y = 0, mouse_face_past_end = false, mouse_face_defer = false,
    mouse_face_hidden = false}, highlight_frame = 0x0, x_focus_frame = 0x0, x_focus_event_frame = 0x0, last_mouse_frame = 0x0, last_mouse_motion_frame = 0x0, last_mouse_motion_x = 0,
  last_mouse_motion_y = 0, last_mouse_glyph = {x = 0, y = 0, width = 0, height = 0}, last_mouse_movement_time = 0, last_user_time = 10173018, last_mouse_scroll_bar = 0x0,
  invisible_cursor = 0x558329bb7b30, xg_cursor = 0x558329bb72b0, devices = 0x558329c0e860, last_mouse_glyph_frame = 0x0, last_click_event = 0x0, im = {context = 0x558329b952b0,
    focused_frame = 0x0}, scroll = {acc_x = 0, acc_y = 0, x_per_char = 1, y_per_line = 1}, connection = 4}
(gdb)