EMACS_21_1_RC: crash (alloc.c, xfaces.c, ...)

EMACS_21_1_RC: crash (alloc.c, xfaces.c, ...)

[Reiner Steib]

[ This is a CVS checkout with "-r EMACS_21_1_RC" on 2004-04-07 (today) ]
In GNU Emacs 21.3.3 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2004-04-07 on lumberjack
configured using `configure  --prefix=/import/xtra/emacs/RC'
Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: POSIX
  value of $LC_CTYPE: en_US.ISO_8859-1
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: POSIX
  locale-coding-system: iso-latin-1
  default-enable-multibyte-characters: t

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

I ran Emacs under gdb from the ./src directory as described in
etc/DEBUG.  After some hours (mostly using Gnus), Emacs crashed with
SIGSEGV.

Although I have read the section "Debugging problems which happen in
GC" in etc/DEBUG, I don't know what information I should provide now.
Can anyone instruct me?  I've attached the output of "backtrace" below
("xbacktrace" gave no output).  I have the gdb session still running
under screen.

I though there might be interest in debugging this crash since 21.4 is
supposed to be released from EMACS_21_1_RC branch.

This is already the second crash I got with this Emacs today (the
other wasn't running under gdb).  Until yesterday, I used the version
checked out on 2004-02-23, which was quite stable (exception: the
crash I reported one week ago:
<URL:http://article.gmane.org/gmane.emacs.bugs/7434>.  According to
src/ChangeLog, there were several changes that _might_ be related,
AFAICS.

Bye, Reiner.

--8<---------------cut here---------------start------------->8---
#0  0x40387b40 in _int_malloc () from /lib/libc.so.6
#1  0x40386898 in malloc () from /lib/libc.so.6
#2  0x0811f4c8 in emacs_blocked_malloc (size=57) at alloc.c:737
#3  0x40386835 in malloc () from /lib/libc.so.6
#4  0x0811f05c in xmalloc (size=1078212128) at alloc.c:520
#5  0x0811f1ed in xstrdup (s=0x40442b90 "\244*\023") at alloc.c:571
#6  0x0809ecee in x_face_list_fonts (f=0x8413960, 
    pattern=0xbfffd2a0 "-misc-fixed-*-iso8859-1", fonts=0xa359258, nfonts=100, 
    try_alternatives_p=1) at xfaces.c:2406
#7  0x0809ef26 in sorted_font_list (f=0x8413960, 
    pattern=0xbfffd2a0 "-misc-fixed-*-iso8859-1", 
    cmpfn=0x809ef80 <cmp_font_names>, fonts=0xbfffd3b8) at xfaces.c:2484
#8  0x0809f067 in font_list_1 (f=0x8413960, pattern=111, family=0, 
    registry=-1073753440, fonts=0xbfffd3b8) at xfaces.c:2581
#9  0x0809f1e2 in font_list (f=0x8413960, pattern=405297516, family=960022548, 
    registry=943928236, fonts=0xbfffd3b8) at xfaces.c:2626
#10 0x080a4f64 in try_alternative_families (f=0x8413960, family=960022548, 
    registry=943928236, fonts=0xbfffd3b8) at xfaces.c:5888
#11 0x080a50ed in try_font_list (f=0x8413960, attrs=0x6f, family=943928220, 
    registry=943928236, fonts=0xbfffd3b8) at xfaces.c:5941
#12 0x080a51ca in choose_face_font (f=0x8413960, attrs=0xbfffd3b8, 
    fontset=105, c=943928220) at xfaces.c:6017
#13 0x0809dd0f in load_face_font (f=0x8413960, face=0x9f9c0d0, c=2176)
    at xfaces.c:1256
#14 0x080a5cc6 in realize_face (cache=0x8418258, attrs=0x9d162f8, c=2176, 
    base_face=0x9d162b0, former_face_id=0) at xfaces.c:6259
#15 0x080a7a9e in lookup_face (f=0x8413960, attr=0x9d162f8, c=2176, 
    base_face=0x9d162b0) at xfaces.c:5266
#16 0x080d5712 in face_for_char (f=0x8413960, face=0x9d162b0, c=2176)
    at fontset.c:485
#17 0x08061bca in get_next_display_element (it=0x9d162b0) at xdisp.c:4316
#18 0x08070125 in display_line (it=0xbfffd540) at xdisp.c:12900
#19 0x0806c719 in try_window (window=1226351168, pos=
      {charpos = -1073752768, bytepos = -1073753824}) at xdisp.c:10640
#20 0x0806c038 in redisplay_window (window=1226351168, just_this_one_p=0)
    at xdisp.c:10308
#21 0x08068e0b in redisplay_windows (window=169870616) at xdisp.c:9257
#22 0x080680e3 in redisplay_internal (preserve_echo_area=1) at xdisp.c:8860
#23 0x08068a26 in redisplay_preserve_echo_area (from_where=2) at xdisp.c:9077
#24 0x08056fda in sit_for (sec=0, usec=100000, reading=0, display=1, 
    initial_display=1) at dispnew.c:6230
#25 0x080da90a in command_loop_1 () at keyboard.c:1660
#26 0x08133e5a in internal_condition_case (bfun=0x80da2e0 <command_loop_1>, 
    handlers=405393860, hfun=0x80d9ee0 <cmd_error>) at eval.c:1267
#27 0x080da18b in command_loop_2 () at keyboard.c:1245
#28 0x081339c2 in internal_catch (tag=0, func=0x80da170 <command_loop_2>, 
    arg=405297516) at eval.c:1030
#29 0x080da142 in command_loop () at keyboard.c:1224
#30 0x080d9c46 in recursive_edit_1 () at keyboard.c:950
#31 0x080d9d98 in Frecursive_edit () at keyboard.c:1006
#32 0x080d8650 in main (argc=5, argv=0xbfffe554, envp=0xbfffe56c)
    at emacs.c:1553
#33 0x403258ae in __libc_start_main () from /lib/libc.so.6
--8<---------------cut here---------------end--------------->8---

Recent input:    [ Deleted as it's not releated. ]
Recent messages: [ Deleted as it's not releated. ]

Re: EMACS_21_1_RC: crash (alloc.c, xfaces.c, ...)

[Reiner Steib]

On Wed, Apr 07 2004, Reiner Steib wrote:

> This is already the second crash I got with this Emacs today (the
> other wasn't running under gdb).

Got another crash. :-(

I'm running message buffers in dedicated frames.  I got the crash
after sending a mail with `C-c C-c'.  (The message was copied to the
Gcc group, but the nov file hasn't been updated.)

Bye, Reiner.

--8<---------------cut here---------------start------------->8---
Program received signal SIGSEGV, Segmentation fault.
0x08120fdc in mem_find (start=0x9af1e80) at alloc.c:2737
2737      while (start < p->start || start >= p->end)
(gdb) xbacktrace 
0x86d9ff4 "nnheader-insert-nov"
0x87f1cec "nnml-add-nov"
0x87f15b0 "nnml-save-mail"
0x87f14e4 "nnml-request-accept-article"
0x87af6a4 "gnus-request-accept-article"
0x88f15e4 "gnus-inews-do-gcc"
0x81cb960 "run-hooks"
0x8788aa0 "message-send"
0x8213b5c "message-send-and-exit"
0x81cdf00 "call-interactively"
(gdb) bt
#0  0x08120fdc in mem_find (start=0x9af1e80) at alloc.c:2737
#1  0x0811f333 in lisp_free (block=0x9af1e80) at alloc.c:632
#2  0x0811fc1c in sweep_strings () at alloc.c:1528
#3  0x08122b03 in gc_sweep () at alloc.c:4928
#4  0x08121cad in Fgarbage_collect () at alloc.c:4194
#5  0x081613fb in Fbyte_code (bytestr=1240349480, vector=134, 
    maxdepth=-1073753212) at bytecode.c:791
#6  0x08135f9b in funcall_lambda (fun=1215363344, nargs=1, 
    arg_vector=0xbfffd4b4) at eval.c:2851
#7  0x081359cb in Ffuncall (nargs=2, args=0xbfffd4b0) at eval.c:2716
#8  0x0816113b in Fbyte_code (bytestr=6815, vector=1, maxdepth=-1073752912)
    at bytecode.c:716
#9  0x08135f9b in funcall_lambda (fun=1216005032, nargs=3, 
    arg_vector=0xbfffd5c4) at eval.c:2851
#10 0x081359cb in Ffuncall (nargs=4, args=0xbfffd5c0) at eval.c:2716
#11 0x0816113b in Fbyte_code (bytestr=1240349480, vector=3, 
    maxdepth=-1073752640) at bytecode.c:716
#12 0x08135f9b in funcall_lambda (fun=1216172784, nargs=1, 
    arg_vector=0xbfffd6e4) at eval.c:2851
#13 0x081359cb in Ffuncall (nargs=2, args=0xbfffd6e0) at eval.c:2716
#14 0x0816113b in Fbyte_code (bytestr=948302124, vector=1, 
    maxdepth=-1073752352) at bytecode.c:716
#15 0x08135f9b in funcall_lambda (fun=1216742456, nargs=3, 
    arg_vector=0xbfffd808) at eval.c:2851
#16 0x081359cb in Ffuncall (nargs=4, args=0xbfffd804) at eval.c:2716
#17 0x0816113b in Fbyte_code (bytestr=1542, vector=3, maxdepth=-1073752060)
    at bytecode.c:716
#18 0x08135f9b in funcall_lambda (fun=1213351848, nargs=4, 
    arg_vector=0xbfffd924) at eval.c:2851
#19 0x081359cb in Ffuncall (nargs=5, args=0xbfffd920) at eval.c:2716
#20 0x0816113b in Fbyte_code (bytestr=1, vector=4, maxdepth=-1073751776)
    at bytecode.c:716
#21 0x08135f9b in funcall_lambda (fun=1217478576, nargs=0, 
    arg_vector=0xbfffdabc) at eval.c:2851
#22 0x081359cb in Ffuncall (nargs=1, args=0xbfffdab8) at eval.c:2716
#23 0x08135527 in run_hook_with_args (nargs=1, args=0xbfffdab8, 
    cond=to_completion) at eval.c:2330
#24 0x0813540a in Frun_hooks (nargs=1, args=0xbfffdb44) at eval.c:2198
#25 0x08135bd5 in Ffuncall (nargs=2, args=0xbfffdb40) at eval.c:2640
#26 0x0816113b in Fbyte_code (bytestr=1, vector=1, maxdepth=-1073751232)
    at bytecode.c:716
#27 0x08135f9b in funcall_lambda (fun=1216004904, nargs=1, 
    arg_vector=0xbfffdc64) at eval.c:2851
#28 0x081359cb in Ffuncall (nargs=2, args=0xbfffdc60) at eval.c:2716
#29 0x0816113b in Fbyte_code (bytestr=947564100, vector=1, 
    maxdepth=-1073750944) at bytecode.c:716
#30 0x08135f9b in funcall_lambda (fun=1216001680, nargs=1, 
    arg_vector=0xbfffdda4) at eval.c:2851
#31 0x081359cb in Ffuncall (nargs=2, args=0xbfffdda0) at eval.c:2716
#32 0x081318b7 in Fcall_interactively (function=405887516, 
    record_flag=405297516, keys=1231180608) at callint.c:797
#33 0x080e4bcc in Fcommand_execute (cmd=-1741596132, record_flag=405297516, 
    keys=405297516, special=405297516) at keyboard.c:9262
#34 0x080da6b7 in command_loop_1 () at keyboard.c:1661
#35 0x08133e5a in internal_condition_case (bfun=0x80da2e0 <command_loop_1>, 
    handlers=405393860, hfun=0x80d9ee0 <cmd_error>) at eval.c:1267
#36 0x080da18b in command_loop_2 () at keyboard.c:1245
#37 0x081339c2 in internal_catch (tag=0, func=0x80da170 <command_loop_2>, 
    arg=405297516) at eval.c:1030
#38 0x080da142 in command_loop () at keyboard.c:1224
#39 0x080d9c46 in recursive_edit_1 () at keyboard.c:950
#40 0x080d9d98 in Frecursive_edit () at keyboard.c:1006
#41 0x080d8650 in main (argc=5, argv=0xbfffe554, envp=0xbfffe56c)
    at emacs.c:1553
#42 0x403258ae in __libc_start_main () from /lib/libc.so.6
--8<---------------cut here---------------end--------------->8---