bug#1075: 23.0.60; [NS] wrong number of arguments in call to ns_free_indexed_color

[Harald Maier <harald@maierh.de>]

Lennart Staflin <lenst@lysator.liu.se> writes:

> After a crash I with ns_free_indexed_color, and x_clear_image_1 on the
> stack. I noticed that x_clear_image_1 calls ns_free_indexed_color with
> only one argument, but it takes two arguments. Perhaps that explains a
> number of crashes in ns_free_indexed_color.
>
> //Lennart Staflin
>
>
> In GNU Emacs 23.0.60.1 (powerpc-apple-darwin8.11.0, *Step 9.0)
> of 2008-10-03 on sin
> Windowing system distributor `Apple', version 49.46.48
> configured using `configure '--with-ns' '--enable-maintainer-mode'
> --without-x' '--with-jpeg' '--with-gif' '--with-png' 'CFLAGS=-g''

I am facing this bug too. Here is a full backtrace. It happens
for me intermittent.

Harald

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000028
0x0015e306 in ns_free_indexed_color (idx=0, f=0x0) at nsterm.m:1310
(gdb) bt
#0  0x0015e306 in ns_free_indexed_color (idx=0, f=0x0) at nsterm.m:1310
#1  0x0018513a in x_clear_image_1 (f=<value temporarily unavailable, due to optimizations>, img=0x195778f0, pixmap_p=<value temporarily unavailable, due to optimizations>, mask_p=1, colors_p=1) at image.c:1627
#2  0x00184b93 in free_image (f=0x0, img=0x195778f0) at image.c:1322
#3  0x001854db in clear_image_cache (f=0x8b7150, filter=25165833) at image.c:1836
#4  0x001855b6 in clear_image_caches (filter=25165833) at image.c:1873
#5  0x00035868 in redisplay_internal (preserve_echo_area=<value temporarily unavailable, due to optimizations>) at xdisp.c:12060
#6  0x00035d28 in redisplay_preserve_echo_area (from_where=13) at xdisp.c:12094
#7  0x00146de7 in status_notify (deleting_process=0x0) at process.c:6906
#8  0x001498dc in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=25165833, wait_proc=0x0, just_wait_proc=0) at process.c:4678
#9  0x0000c296 in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6619
#10 0x0009bbf8 in read_char (commandflag=1, nmaps=6, maps=0xbfffdfd0, prev_event=25165833, used_mouse_menu=0xbfffe0d8, end_time=0x0) at keyboard.c:2895
#11 0x0009dc3b in read_key_sequence (keybuf=0xbfffe198, bufsize=30, prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9349
#12 0x000a012a in command_loop_1 () at keyboard.c:1620
#13 0x00101ffd in internal_condition_case (bfun=0x9fef0 <command_loop_1>, handlers=25205497, hfun=0x96ba0 <cmd_error>) at eval.c:1511
#14 0x0008ff38 in command_loop_2 () at keyboard.c:1338
#15 0x00101edc in internal_catch (tag=0, func=0x8fef0 <command_loop_2>, arg=25165833) at eval.c:1247
#16 0x0008fc8e in command_loop () at keyboard.c:1317
#17 0x0008fd52 in recursive_edit_1 () at keyboard.c:942
#18 0x0008fed1 in Frecursive_edit () at keyboard.c:1004
#19 0x0008eb6b in main (argc=1, argv=0xbfffe5a4) at emacs.c:1689

(gdb) bt full
#0  0x0015e306 in ns_free_indexed_color (idx=0, f=0x0) at nsterm.m:1310
        color_table = <value temporarily unavailable, due to optimizations>
#1  0x0018513a in x_clear_image_1 (f=<value temporarily unavailable, due to optimizations>, img=0x195778f0, pixmap_p=<value temporarily unavailable, due to optimizations>, mask_p=1, colors_p=1) at image.c:1627
No locals.
#2  0x00184b93 in free_image (f=0x0, img=0x195778f0) at image.c:1322
        c = (struct image_cache *) 0x16f0c540
#3  0x001854db in clear_image_cache (f=0x8b7150, filter=25165833) at image.c:1836
        img = (struct image *) 0x195778f0
        t = {
  tv_sec = 1218913349, 
  tv_usec = 686755
}
        old = 1218911549
        i = 3
        nfreed = 2
        c = (struct image_cache *) 0x16f0c540
#4  0x001855b6 in clear_image_caches (filter=25165833) at image.c:1873
        tail = 4300800
#5  0x00035868 in redisplay_internal (preserve_echo_area=<value temporarily unavailable, due to optimizations>) at xdisp.c:12060
        w = (struct window *) 0x195978f0
        f = <value temporarily unavailable, due to optimizations>
        pause = 0
        must_finish = 1
        tlbufpos = {
  charpos = 425537696, 
  bytepos = 425537696
}
        number_of_visible_frames = 1
        polling_stopped_here = 1
        old_frame = 9138516
        consider_all_windows_p = <value temporarily unavailable, due to optimizations>
#6  0x00035d28 in redisplay_preserve_echo_area (from_where=13) at xdisp.c:12094
No locals.
#7  0x00146de7 in status_notify (deleting_process=0x0) at process.c:6906
        proc = 422480020
        buffer = 425665812
        tail = <value temporarily unavailable, due to optimizations>
        msg = 51929347
#8  0x001498dc in wait_reading_process_output (time_limit=30, microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=25165833, wait_proc=0x0, just_wait_proc=0) at process.c:4678
        Atemp = {
  fds_bits = {0 <repeats 32 times>}
}
        Ctemp = {
  fds_bits = {0 <repeats 32 times>}
}
        timeout_reduced_for_timers = 1
        channel = <value temporarily unavailable, due to optimizations>
        nfds = 1
        Available = {
  fds_bits = {128, 0 <repeats 31 times>}
}
        Connecting = {
  fds_bits = {0 <repeats 32 times>}
}
        check_connect = 0
        check_delay = 0
        no_avail = <value temporarily unavailable, due to optimizations>
        xerrno = <value temporarily unavailable, due to optimizations>
        proc = <value temporarily unavailable, due to optimizations>
        timeout = {
  tv_sec = 0, 
  tv_usec = 0
}
        end_time = {
  tv_sec = 1218913379, 
  tv_usec = 636576
}
        wait_channel = -1
        got_some_input = 1
#9  0x0000c296 in sit_for (timeout=240, reading=1, do_display=1) at dispnew.c:6619
        sec = <value temporarily unavailable, due to optimizations>
        usec = 0
#10 0x0009bbf8 in read_char (commandflag=1, nmaps=6, maps=0xbfffdfd0, prev_event=25165833, used_mouse_menu=0xbfffe0d8, end_time=0x0) at keyboard.c:2895
        tem0 = <value temporarily unavailable, due to optimizations>
        delay_level = 4
        buffer_size = <value temporarily unavailable, due to optimizations>
        c = 25165833
        count = <value temporarily unavailable, due to optimizations>
        jmpcount = 2
        local_getcjmp = {918399, 0, 8098, 633595, 981200, 3440316, 0, 3440316, -1073750152, -1073750544, 25165855, 662, 635534, 23, 31, 31, 33554432, -1073807305}
        save_jump = {0 <repeats 18 times>}
        key_already_recorded = 0
        tem = <value temporarily unavailable, due to optimizations>
        save = <value temporarily unavailable, due to optimizations>
        previous_echo_area_message = 25165833
        also_record = 25165833
        reread = 0
        polling_stopped_here = <value temporarily unavailable, due to optimizations>
        orig_kboard = (struct kboard *) 0x83b140
#11 0x0009dc3b in read_key_sequence (keybuf=0xbfffe198, bufsize=30, prompt=25165833, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9349
        interrupted_kboard = (KBOARD *) 0x83b140
        key = 1058327
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 25165833
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 6
        nmaps_allocated = 6
        defs = (Lisp_Object * volatile) 0xbfffdfa0
        submaps = (Lisp_Object * volatile) 0xbfffdfd0
        orig_local_map = 50222101
        orig_keymap = 25165833
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
  parent = 4941253, 
  map = 4941253, 
  start = 0, 
  end = 0
}
        keytran = {
  parent = 4386685, 
  map = 4386685, 
  start = 0, 
  end = 0
}
        indec = {
  parent = 4941261, 
  map = 4941261, 
  start = 0, 
  end = 0
}
        shift_translated = 0
        delayed_switch_frame = 25165833
        original_uppercase = -1073749720
        original_uppercase_position = -1
        starting_buffer = (struct buffer *) 0x19523aa0
        fake_prefixed_keys = 25165833
#12 0x000a012a in command_loop_1 () at keyboard.c:1620
        cmd = <value temporarily unavailable, due to optimizations>
        lose = <value temporarily unavailable, due to optimizations>
        nonundocount = 0
        keybuf = {35523785, 617387, 3441000, 25165833, -1073749464, 617600, 366757405, -1073749538, -1073749512, -1880941328, 4301001, 152, -1073749538, 25165833, 1, 10, 0, -1895817300, 6307477, 1, -1073749448, -1791741113, 50388496, 0, -1073749492, -1073749680, 0, 3866624, 25165833, 33476529}
        i = 1
        prev_modiff = 25222
        prev_buffer = (struct buffer *) 0x19523aa0
        already_adjusted = 0
#13 0x00101ffd in internal_condition_case (bfun=0x9fef0 <command_loop_1>, handlers=25205497, hfun=0x96ba0 <cmd_error>) at eval.c:1511
        val = <value temporarily unavailable, due to optimizations>
        c = {
  tag = 25165833, 
  val = 25165833, 
  next = 0xbfffe34c, 
  gcpro = 0x0, 
  jmp = {-1073806465, -1880940628, 8098, 1056523, 25165833, 25165833, 3440252, 3440316, -1073749272, -1073749456, 31, 662, 1056666, 1245207, 3407903, 3407903, -1073807360, -1073807305}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
        h = {
  handler = 25205497, 
  var = 25165833, 
  chosen_clause = 25165881, 
  tag = 0xbfffe248, 
  next = 0x0
}
#14 0x0008ff38 in command_loop_2 () at keyboard.c:1338
        val = 0
#15 0x00101edc in internal_catch (tag=0, func=0x8fef0 <command_loop_2>, arg=25165833) at eval.c:1247
        c = {
  tag = 25201569, 
  val = 25165833, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {-1791753345, 0, 8098, 1056313, -1791740947, 19216, 3440384, 3440316, -1073749048, -1073749200, 25296927, 662, 1056463, 25296919, 25296927, 25165855, 6291456, 4259895}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
#16 0x0008fc8e in command_loop () at keyboard.c:1317
No locals.
#17 0x0008fd52 in recursive_edit_1 () at keyboard.c:942
        val = <value temporarily unavailable, due to optimizations>
#18 0x0008fed1 in Frecursive_edit () at keyboard.c:1004
        buffer = 25165833
#19 0x0008eb6b in main (argc=1, argv=0xbfffe5a4) at emacs.c:1689
        dummy = 0
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = 1
        skip_args = 0
        rlim = {
  rlim_cur = 8388608, 
  rlim_max = 67104768
}
        no_loadup = 0
        junk = 0x0