bug#27398: segfault in turn_on_face

bug#27398: segfault in turn_on_face

[Björn Griebenow]

[-- Attachment #1: Type: text/html, Size: 7621 bytes --]

[-- Attachment #2: emacs_segfault_backtrace.txt --]
[-- Type: text/plain, Size: 5981 bytes --]

(gdb) bt
#0  turn_on_face (f=0xc3e680, face_id=22) at term.c:1895
#1  0x00000000004b3e12 in tty_write_glyphs (f=<optimized out>, string=<optimized out>, len=<optimized out>) at term.c:767
#2  0x000000000041d2ba in update_frame_line (f=f@entry=0xc3e680, vpos=vpos@entry=66) at dispnew.c:4838
#3  0x0000000000420a76 in update_frame_1 (f=f@entry=0xc3e680, force_p=force_p@entry=true, inhibit_id_p=<optimized out>, inhibit_id_p@entry=false, set_cursor_p=set_cursor_p@entry=true) at dispnew.c:4540
#4  0x000000000042225e in update_frame (f=f@entry=0xc3e680, force_p=<optimized out>, force_p@entry=false, inhibit_hairy_id_p=inhibit_hairy_id_p@entry=false) at dispnew.c:3122
#5  0x0000000000454f8c in redisplay_internal () at xdisp.c:14044
#6  0x00000000004562e1 in echo_area_display (update_frame_p=update_frame_p@entry=true) at xdisp.c:11361
#7  0x000000000045641a in message3_nolog (m=m@entry=50211780) at xdisp.c:10344
#8  0x000000000045656c in message3 (m=m@entry=50211780) at xdisp.c:10273
#9  0x000000000055f29c in Fmessage (nargs=<optimized out>, args=<optimized out>) at editfns.c:3698
#10 0x0000000000565fd9 in Ffuncall (nargs=4, args=args@entry=0x7fffffffd088) at eval.c:2673
#11 0x000000000059b243 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=nargs@entry=1, args=<optimized out>, args@entry=0x1bb18e4) at bytecode.c:880
#12 0x0000000000565bf6 in funcall_lambda (fun=140737488344096, nargs=nargs@entry=1, arg_vector=0x1bb18e4, arg_vector@entry=0x7fffffffd228) at eval.c:2855
#13 0x0000000000565ecb in Ffuncall (nargs=nargs@entry=2, args=args@entry=0x7fffffffd220) at eval.c:2754
#14 0x00000000005661ca in call1 (fn=fn@entry=13266240, arg1=<optimized out>) at eval.c:2552
#15 0x000000000056d28a in mapcar1 (leni=22, vals=vals@entry=0x0, fn=fn@entry=13266240, seq=seq@entry=49588339) at fns.c:2522
#16 0x000000000056d692 in Fmapc (function=13266240, sequence=49588339) at fns.c:2606
#17 0x00000000005660c5 in Ffuncall (nargs=3, args=args@entry=0x7fffffffd388) at eval.c:2696
#18 0x000000000059b243 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=nargs@entry=1, args=<optimized out>, args@entry=0x1bb0364) at bytecode.c:880
#19 0x0000000000565bf6 in funcall_lambda (fun=140737488344496, nargs=nargs@entry=1, arg_vector=0x1bb0364, arg_vector@entry=0x7fffffffd540) at eval.c:2855
#20 0x0000000000565ecb in Ffuncall (nargs=2, args=args@entry=0x7fffffffd538) at eval.c:2754
#21 0x000000000059b243 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=nargs@entry=0, args=<optimized out>, args@entry=0x1ba4a04) at bytecode.c:880
#22 0x0000000000565bf6 in funcall_lambda (fun=140737488344928, nargs=nargs@entry=0, arg_vector=0x1ba4a04, arg_vector@entry=0x7fffffffd6f0) at eval.c:2855
#23 0x0000000000565ecb in Ffuncall (nargs=1, args=args@entry=0x7fffffffd6e8) at eval.c:2754
#24 0x000000000059b243 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=nargs@entry=0, args=<optimized out>, args@entry=0x1bac8e4) at bytecode.c:880
#25 0x0000000000565bf6 in funcall_lambda (fun=140737488345776, nargs=nargs@entry=0, arg_vector=0x1bac8e4, arg_vector@entry=0x7fffffffd8c8) at eval.c:2855
#26 0x0000000000565ecb in Ffuncall (nargs=1, args=0x7fffffffd8c0) at eval.c:2754
#27 0x0000000000566129 in funcall_nil (nargs=<optimized out>, args=<optimized out>) at eval.c:2332
#28 0x0000000000564235 in run_hook_with_args (nargs=1, args=0x7fffffffd8c0, funcall=0x566120 <funcall_nil>) at eval.c:2509
#29 0x0000000000564413 in run_hook_with_args (funcall=<optimized out>, args=<optimized out>, nargs=<optimized out>) at eval.c:2355
#30 Frun_hook_with_args (args=0x7fffffffd8c0, nargs=1) at eval.c:2374
#31 run_hook (hook=<optimized out>) at eval.c:2522
#32 Frun_hooks (nargs=2, args=0x7fffffffd9b0) at eval.c:2356
#33 0x0000000000565fd9 in Ffuncall (nargs=3, args=args@entry=0x7fffffffd9a8) at eval.c:2673
#34 0x000000000059b243 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=nargs@entry=0, args=<optimized out>, args@entry=0x97f43c <pure+1202844>)
    at bytecode.c:880
#35 0x0000000000565bf6 in funcall_lambda (fun=140737488346256, nargs=nargs@entry=0, arg_vector=0x97f43c <pure+1202844>, arg_vector@entry=0x7fffffffdbd8) at eval.c:2855
#36 0x0000000000565ecb in Ffuncall (nargs=1, args=args@entry=0x7fffffffdbd0) at eval.c:2754
#37 0x000000000059b243 in exec_byte_code (bytestr=<optimized out>, vector=<optimized out>, maxdepth=<optimized out>, args_template=<optimized out>, nargs=nargs@entry=0, args=<optimized out>, args@entry=0x97e484 <pure+1198820>)
    at bytecode.c:880
#38 0x0000000000565bf6 in funcall_lambda (fun=0, fun@entry=9954389, nargs=nargs@entry=0, arg_vector=0x97e484 <pure+1198820>, arg_vector@entry=0x7fffffffdd00) at eval.c:2855
#39 0x0000000000564f48 in apply_lambda (fun=9954389, args=<optimized out>, count=count@entry=4) at eval.c:2794
#40 0x00000000005652aa in eval_sub (form=form@entry=18816083) at eval.c:2241
#41 0x0000000000568b7c in Feval (form=18816083, lexical=<optimized out>) at eval.c:1988
#42 0x00000000005647e2 in internal_condition_case (bfun=bfun@entry=0x4f1970 <top_level_2>, handlers=handlers@entry=19056, hfun=hfun@entry=0x4f6560 <cmd_error>) at eval.c:1309
#43 0x00000000004f40c0 in top_level_1 (ignore=ignore@entry=0) at keyboard.c:1124
#44 0x0000000000564783 in internal_catch (tag=tag@entry=45840, func=func@entry=0x4f4060 <top_level_1>, arg=arg@entry=0) at eval.c:1074
#45 0x00000000004f190d in command_loop () at keyboard.c:1085
#46 0x00000000004f6147 in recursive_edit_1 () at keyboard.c:692
#47 0x00000000004f64a8 in Frecursive_edit () at keyboard.c:763
#48 0x0000000000419212 in main (argc=2, argv=0x7fffffffe0b8) at emacs.c:1626
(gdb) 

bug#27398: segfault in turn_on_face

[Eli Zaretskii]

> From: "Björn Griebenow" <B.Griebenow@web.de>
> Date: Fri, 16 Jun 2017 13:46:03 +0200
> Sensitivity: Normal
> 
> I have encountered a bug which segfaults Emacs in "-nw" mode but not in graphical mode.
> I can reproduce the bug with:
> - Emacs 25.1 (prebuild by Debian as version 25.1+1-4)
> - Emacs 25.2 (fresh build from git repository (emacs-25.2 branch))

Can you try the master branch, please?  A similar problem was fixed
there a few months ago, see bug#26097.

If the master branch doesn't solve this, is it possible to provide a
reproducible recipe starting from "emacs -Q" that triggers this crash?

Thanks.