emacs-22.1 with GTK dumps core when Gnome wigets clicked

emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Gary Mills]

Clicking on any of the `Specify a new file name', `Read an existing file',
or `Read a directory' icons causes a core dump.  This happens on both
Solaris 10 SPARC and Solaris 10 x86 compilations.

Here's part of an analysis on the core:
$ mdb $(whence emacs) core
Loading modules: [ libc.so.1 libuutil.so.1 libavl.so.1 ld.so.1 ]
> ::status
debugging core file of gemacs-22.1 (32-bit) from S0106080020b3a84b
file: /opt/local/bin/gemacs-22.1
initial argv: emacs
threading model: multi-threaded
status: process terminated by SIGSEGV (Segmentation Fault)
> ::stack
_malloc_internal+0xa4(19, fa0f0000, 3b5000, 3b2364, 3b4cd4, 5)
malloc+0x58(19, 3ad000, 221300, 3ad000, 221000, 1)
emacs_blocked_malloc+0x58(19, 0, 0, 74, 73, 3b1c00)
malloc+0x58(19, 3ad000, 1ae990, 3ad000, ff0000, 1)
libc.so.1`strdup+0xc(fa14f880, 1, 0, 0, 1, fac73cf0)
libgnomevfs-2.so.0.600.0`_gnome_vfs_xdg_hash_append_glob+0xe4(916230, fa14f899,
fa14f880, 80808080, 196c8, fd3241f0)
libgnomevfs-2.so.0.600.0`_gnome_vfs_xdg_glob_read_from_file+0xa0(916230,
fa14f899, 1150, 19494, 221a84, 1000)

I was able to prevent the core dump by adding:

  #define SYSTEM_MALLOC

to src/s/sol2-6.h and rebuilding and reinstalling.

In GNU Emacs 22.1.1 (sparc-sun-solaris2.10, GTK+ Version 2.4.9)
 of 2007-06-08 on celano
configured using `configure  '--program-prefix=g' '--without-gcc' '--with-x-toolkit=gtk''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: en_CA.ISO8859-1
  value of $LC_CTYPE: en_CA.ISO8859-1
  value of $LC_MESSAGES: C
  value of $LC_MONETARY: en_CA.ISO8859-1
  value of $LC_NUMERIC: en_CA.ISO8859-1
  value of $LC_TIME: en_CA.ISO8859-1
  value of $LANG: nil
  locale-coding-system: iso-8859-1
  default-enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  encoded-kbd-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  unify-8859-on-encoding-mode: t
  utf-translate-cjk-mode: t
  auto-compression-mode: t
  line-number-mode: t

Recent input:
ESC x r e p o r t - e m a c s - b u g RET

Recent messages:
("gemacs")
Loading encoded-kb...done
For information about the GNU Project and its goals, type C-h C-p.
Loading emacsbug...
Loading regexp-opt...done
Loading emacsbug...done

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[YAMAMOTO Mitsuharu]

>>>>> On Sat, 9 Jun 2007 10:49:41 -0500 (CDT), Gary Mills <mills@cc.umanitoba.ca> said:

> Clicking on any of the `Specify a new file name', `Read an existing
> file', or `Read a directory' icons causes a core dump.  This happens
> on both Solaris 10 SPARC and Solaris 10 x86 compilations.

Does this always happen on the first click of these buttons?  And
could you show the result of `grep PTHREAD src/config.h' at the build
directory?

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Gary Mills]

On Sun, Jun 10, 2007 at 05:43:43PM +0900, YAMAMOTO Mitsuharu wrote:
> >>>>> On Sat, 9 Jun 2007 10:49:41 -0500 (CDT), Gary Mills <mills@cc.umanitoba.ca> said:
> 
> > Clicking on any of the `Specify a new file name', `Read an existing
> > file', or `Read a directory' icons causes a core dump.  This happens
> > on both Solaris 10 SPARC and Solaris 10 x86 compilations.
> 
> Does this always happen on the first click of these buttons?

Yes, the first click.  It's very easy to replicate.  I'm running it
on the Solaris Gnome desktop with these libraries:

	$ pkg-config --modversion gtk+-2.0 glib-2.0
	2.4.9
	2.4.1

> And
> could you show the result of `grep PTHREAD src/config.h' at the build
> directory?

	$ grep PTHREAD src/config.h
	#define HAVE_GTK_AND_PTHREAD 1
	/* #undef HAVE_LIBPTHREADS */
	#define HAVE_PTHREAD_H 1

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[YAMAMOTO Mitsuharu]

>>>>> On Sun, 10 Jun 2007 07:51:20 -0500, Gary Mills <mills@cc.umanitoba.ca> said:

>> Does this always happen on the first click of these buttons?

> Yes, the first click.  It's very easy to replicate.  I'm running it
> on the Solaris Gnome desktop with these libraries:
> 	$ pkg-config --modversion gtk+-2.0 glib-2.0
>       2.4.9
>       2.4.1

By any chance do you know which thread library they (or Gnome VFS
backend that they load?) use?  Does anyone know how to check that?
(Sorry, I'm not a GTK+ expert.)

>> And could you show the result of `grep PTHREAD src/config.h' at the
>> build directory?

> 	$ grep PTHREAD src/config.h
> 	#define HAVE_GTK_AND_PTHREAD 1
> 	/* #undef HAVE_LIBPTHREADS */
> 	#define HAVE_PTHREAD_H 1

Thanks.  There's nothing wrong with this result if pthread is used.

If another thread library is used, the use of SYSTEM_MALLOC as in your
previous report will be the right thing to do.  Of course, we should
detect that within `configure' if possible.

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Gary Mills]

On Sun, Jun 10, 2007 at 10:48:32PM +0900, YAMAMOTO Mitsuharu wrote:
> >>>>> On Sun, 10 Jun 2007 07:51:20 -0500, Gary Mills <mills@cc.umanitoba.ca> said:
> 
> >> Does this always happen on the first click of these buttons?
> 
> > Yes, the first click.  It's very easy to replicate.  I'm running it
> > on the Solaris Gnome desktop with these libraries:
> > 	$ pkg-config --modversion gtk+-2.0 glib-2.0
> >       2.4.9
> >       2.4.1
> 
> By any chance do you know which thread library they (or Gnome VFS
> backend that they load?) use?  Does anyone know how to check that?
> (Sorry, I'm not a GTK+ expert.)

Nor am I, but this might be a clue.  I have emacs-22.1 installed
as `gemacs' for now.

	$ ldd $(whence gemacs) | grep thread
	        libpthread.so.1 =>       /lib/libpthread.so.1
	$ ldd $(whence gnome-terminal) | grep thread
	        libpthread.so.1 =>       /lib/libpthread.so.1
	        libgthread-2.0.so.0 =>   /usr/lib/libgthread-2.0.so.0
	        libthread.so.1 =>        /lib/libthread.so.1

> >> And could you show the result of `grep PTHREAD src/config.h' at the
> >> build directory?
> 
> > 	$ grep PTHREAD src/config.h
> > 	#define HAVE_GTK_AND_PTHREAD 1
> > 	/* #undef HAVE_LIBPTHREADS */
> > 	#define HAVE_PTHREAD_H 1
> 
> Thanks.  There's nothing wrong with this result if pthread is used.
> 
> If another thread library is used, the use of SYSTEM_MALLOC as in your
> previous report will be the right thing to do.  Of course, we should
> detect that within `configure' if possible.

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[YAMAMOTO Mitsuharu]

I found a possible problem, which may or may not be relevant to this
issue, in the initialization of the recursive mutex in src/gmalloc.c.
Could you try this patch?

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

Index: src/gmalloc.c
===================================================================
RCS file: /cvsroot/emacs/emacs/src/gmalloc.c,v
retrieving revision 1.21
diff -c -p -r1.21 gmalloc.c
*** src/gmalloc.c	28 Mar 2007 08:16:05 -0000	1.21
--- src/gmalloc.c	14 Jun 2007 02:03:33 -0000
*************** extern __malloc_size_t _bytes_free;
*** 235,240 ****
--- 235,243 ----
  extern __ptr_t _malloc_internal PP ((__malloc_size_t __size));
  extern __ptr_t _realloc_internal PP ((__ptr_t __ptr, __malloc_size_t __size));
  extern void _free_internal PP ((__ptr_t __ptr));
+ extern __ptr_t _malloc_internal_nolock PP ((__malloc_size_t __size));
+ extern __ptr_t _realloc_internal_nolock PP ((__ptr_t __ptr, __malloc_size_t __size));
+ extern void _free_internal_nolock PP ((__ptr_t __ptr));
  
  #ifdef USE_PTHREAD
  extern pthread_mutex_t _malloc_mutex;
*************** register_heapinfo ()
*** 554,560 ****
  
  #ifdef USE_PTHREAD
  static pthread_once_t malloc_init_once_control = PTHREAD_ONCE_INIT;
! pthread_mutex_t _malloc_mutex;
  #endif
  
  static void
--- 557,563 ----
  
  #ifdef USE_PTHREAD
  static pthread_once_t malloc_init_once_control = PTHREAD_ONCE_INIT;
! pthread_mutex_t _malloc_mutex = PTHREAD_MUTEX_INITIALIZER;
  #endif
  
  static void
*************** malloc_initialize_1 ()
*** 567,573 ****
    if (__malloc_initialize_hook)
      (*__malloc_initialize_hook) ();
  
! #ifdef USE_PTHREAD
    {
      pthread_mutexattr_t attr;
  
--- 570,578 ----
    if (__malloc_initialize_hook)
      (*__malloc_initialize_hook) ();
  
!   /* We don't use recursive mutex because pthread_mutexattr_init may
!      call malloc internally.  */
! #if 0 /* defined (USE_PTHREAD) */
    {
      pthread_mutexattr_t attr;
  
*************** morecore (size)
*** 661,667 ****
  	     `morecore_recursing' flag and return null.  */
  	  int save = errno;	/* Don't want to clobber errno with ENOMEM.  */
  	  morecore_recursing = 1;
! 	  newinfo = (malloc_info *) _realloc_internal
  	    (_heapinfo, newsize * sizeof (malloc_info));
  	  morecore_recursing = 0;
  	  if (newinfo == NULL)
--- 666,672 ----
  	     `morecore_recursing' flag and return null.  */
  	  int save = errno;	/* Don't want to clobber errno with ENOMEM.  */
  	  morecore_recursing = 1;
! 	  newinfo = (malloc_info *) _realloc_internal_nolock
  	    (_heapinfo, newsize * sizeof (malloc_info));
  	  morecore_recursing = 0;
  	  if (newinfo == NULL)
*************** morecore (size)
*** 717,723 ****
        /* Reset _heaplimit so _free_internal never decides
  	 it can relocate or resize the info table.  */
        _heaplimit = 0;
!       _free_internal (oldinfo);
        PROTECT_MALLOC_STATE (0);
  
        /* The new heap limit includes the new table just allocated.  */
--- 722,728 ----
        /* Reset _heaplimit so _free_internal never decides
  	 it can relocate or resize the info table.  */
        _heaplimit = 0;
!       _free_internal_nolock (oldinfo);
        PROTECT_MALLOC_STATE (0);
  
        /* The new heap limit includes the new table just allocated.  */
*************** morecore (size)
*** 732,738 ****
  
  /* Allocate memory from the heap.  */
  __ptr_t
! _malloc_internal (size)
       __malloc_size_t size;
  {
    __ptr_t result;
--- 737,743 ----
  
  /* Allocate memory from the heap.  */
  __ptr_t
! _malloc_internal_nolock (size)
       __malloc_size_t size;
  {
    __ptr_t result;
*************** _malloc_internal (size)
*** 752,758 ****
      return NULL;
  #endif
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    if (size < sizeof (struct list))
--- 757,762 ----
*************** _malloc_internal (size)
*** 802,811 ****
  	  /* No free fragments of the desired size, so get a new block
  	     and break it into fragments, returning the first.  */
  #ifdef GC_MALLOC_CHECK
! 	  result = _malloc_internal (BLOCKSIZE);
  	  PROTECT_MALLOC_STATE (0);
  #else
! 	  result = malloc (BLOCKSIZE);
  #endif
  	  if (result == NULL)
  	    {
--- 806,815 ----
  	  /* No free fragments of the desired size, so get a new block
  	     and break it into fragments, returning the first.  */
  #ifdef GC_MALLOC_CHECK
! 	  result = _malloc_internal_nolock (BLOCKSIZE);
  	  PROTECT_MALLOC_STATE (0);
  #else
! 	  result = _malloc_internal_nolock (BLOCKSIZE);
  #endif
  	  if (result == NULL)
  	    {
*************** _malloc_internal (size)
*** 932,938 ****
--- 936,954 ----
  
    PROTECT_MALLOC_STATE (1);
   out:
+   return result;
+ }
+ 
+ __ptr_t
+ _malloc_internal (size)
+      __malloc_size_t size;
+ {
+   __ptr_t result;
+ 
+   LOCK ();
+   result = _malloc_internal_nolock (size);
    UNLOCK ();
+ 
    return result;
  }
  
*************** void (*__free_hook) PP ((__ptr_t __ptr))
*** 1024,1032 ****
  struct alignlist *_aligned_blocks = NULL;
  
  /* Return memory to the heap.
!    Like `free' but don't call a __free_hook if there is one.  */
  void
! _free_internal (ptr)
       __ptr_t ptr;
  {
    int type;
--- 1040,1048 ----
  struct alignlist *_aligned_blocks = NULL;
  
  /* Return memory to the heap.
!    Like `_free_internal' but don't lock mutex.  */
  void
! _free_internal_nolock (ptr)
       __ptr_t ptr;
  {
    int type;
*************** _free_internal (ptr)
*** 1043,1049 ****
    if (ptr == NULL)
      return;
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    for (l = _aligned_blocks; l != NULL; l = l->next)
--- 1059,1064 ----
*************** _free_internal (ptr)
*** 1158,1164 ****
  		 table's blocks to the system before we have copied them to
  		 the new location.  */
  	      _heaplimit = 0;
! 	      _free_internal (_heapinfo);
  	      _heaplimit = oldlimit;
  
  	      /* Tell malloc to search from the beginning of the heap for
--- 1173,1179 ----
  		 table's blocks to the system before we have copied them to
  		 the new location.  */
  	      _heaplimit = 0;
! 	      _free_internal_nolock (_heapinfo);
  	      _heaplimit = oldlimit;
  
  	      /* Tell malloc to search from the beginning of the heap for
*************** _free_internal (ptr)
*** 1166,1173 ****
  	      _heapindex = 0;
  
  	      /* Allocate new space for the info table and move its data.  */
! 	      newinfo = (malloc_info *) _malloc_internal (info_blocks
! 							  * BLOCKSIZE);
  	      PROTECT_MALLOC_STATE (0);
  	      memmove (newinfo, _heapinfo, info_blocks * BLOCKSIZE);
  	      _heapinfo = newinfo;
--- 1181,1188 ----
  	      _heapindex = 0;
  
  	      /* Allocate new space for the info table and move its data.  */
! 	      newinfo = (malloc_info *) _malloc_internal_nolock (info_blocks
! 								 * BLOCKSIZE);
  	      PROTECT_MALLOC_STATE (0);
  	      memmove (newinfo, _heapinfo, info_blocks * BLOCKSIZE);
  	      _heapinfo = newinfo;
*************** _free_internal (ptr)
*** 1231,1239 ****
  	  _bytes_free -= BLOCKSIZE;
  
  #ifdef GC_MALLOC_CHECK
! 	  _free_internal (ADDRESS (block));
  #else
! 	  free (ADDRESS (block));
  #endif
  	}
        else if (_heapinfo[block].busy.info.frag.nfree != 0)
--- 1246,1254 ----
  	  _bytes_free -= BLOCKSIZE;
  
  #ifdef GC_MALLOC_CHECK
! 	  _free_internal_nolock (ADDRESS (block));
  #else
! 	  _free_internal_nolock (ADDRESS (block));
  #endif
  	}
        else if (_heapinfo[block].busy.info.frag.nfree != 0)
*************** _free_internal (ptr)
*** 1269,1274 ****
--- 1284,1299 ----
      }
  
    PROTECT_MALLOC_STATE (1);
+ }
+ 
+ /* Return memory to the heap.
+    Like `free' but don't call a __free_hook if there is one.  */
+ void
+ _free_internal (ptr)
+      __ptr_t ptr;
+ {
+   LOCK ();
+   _free_internal_nolock (ptr);
    UNLOCK ();
  }
  
*************** __ptr_t (*__realloc_hook) PP ((__ptr_t _
*** 1415,1421 ****
     new region.  This module has incestuous knowledge of the
     internals of both free and malloc. */
  __ptr_t
! _realloc_internal (ptr, size)
       __ptr_t ptr;
       __malloc_size_t size;
  {
--- 1440,1446 ----
     new region.  This module has incestuous knowledge of the
     internals of both free and malloc. */
  __ptr_t
! _realloc_internal_nolock (ptr, size)
       __ptr_t ptr;
       __malloc_size_t size;
  {
*************** _realloc_internal (ptr, size)
*** 1425,1439 ****
  
    if (size == 0)
      {
!       _free_internal (ptr);
!       return _malloc_internal (0);
      }
    else if (ptr == NULL)
!     return _malloc_internal (size);
  
    block = BLOCK (ptr);
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    type = _heapinfo[block].busy.type;
--- 1450,1463 ----
  
    if (size == 0)
      {
!       _free_internal_nolock (ptr);
!       return _malloc_internal_nolock (0);
      }
    else if (ptr == NULL)
!     return _malloc_internal_nolock (size);
  
    block = BLOCK (ptr);
  
    PROTECT_MALLOC_STATE (0);
  
    type = _heapinfo[block].busy.type;
*************** _realloc_internal (ptr, size)
*** 1443,1453 ****
        /* Maybe reallocate a large block to a small fragment.  */
        if (size <= BLOCKSIZE / 2)
  	{
! 	  result = _malloc_internal (size);
  	  if (result != NULL)
  	    {
  	      memcpy (result, ptr, size);
! 	      _free_internal (ptr);
  	      goto out;
  	    }
  	}
--- 1467,1477 ----
        /* Maybe reallocate a large block to a small fragment.  */
        if (size <= BLOCKSIZE / 2)
  	{
! 	  result = _malloc_internal_nolock (size);
  	  if (result != NULL)
  	    {
  	      memcpy (result, ptr, size);
! 	      _free_internal_nolock (ptr);
  	      goto out;
  	    }
  	}
*************** _realloc_internal (ptr, size)
*** 1467,1473 ****
  	     Now we will free this chunk; increment the statistics counter
  	     so it doesn't become wrong when _free_internal decrements it.  */
  	  ++_chunks_used;
! 	  _free_internal (ADDRESS (block + blocks));
  	  result = ptr;
  	}
        else if (blocks == _heapinfo[block].busy.info.size)
--- 1491,1497 ----
  	     Now we will free this chunk; increment the statistics counter
  	     so it doesn't become wrong when _free_internal decrements it.  */
  	  ++_chunks_used;
! 	  _free_internal_nolock (ADDRESS (block + blocks));
  	  result = ptr;
  	}
        else if (blocks == _heapinfo[block].busy.info.size)
*************** _realloc_internal (ptr, size)
*** 1482,1489 ****
  	  /* Prevent free from actually returning memory to the system.  */
  	  oldlimit = _heaplimit;
  	  _heaplimit = 0;
! 	  _free_internal (ptr);
! 	  result = _malloc_internal (size);
  	  PROTECT_MALLOC_STATE (0);
  	  if (_heaplimit == 0)
  	    _heaplimit = oldlimit;
--- 1506,1513 ----
  	  /* Prevent free from actually returning memory to the system.  */
  	  oldlimit = _heaplimit;
  	  _heaplimit = 0;
! 	  _free_internal_nolock (ptr);
! 	  result = _malloc_internal_nolock (size);
  	  PROTECT_MALLOC_STATE (0);
  	  if (_heaplimit == 0)
  	    _heaplimit = oldlimit;
*************** _realloc_internal (ptr, size)
*** 1493,1505 ****
  		 the thing we just freed.  Unfortunately it might
  		 have been coalesced with its neighbors.  */
  	      if (_heapindex == block)
! 	        (void) _malloc_internal (blocks * BLOCKSIZE);
  	      else
  		{
  		  __ptr_t previous
! 		    = _malloc_internal ((block - _heapindex) * BLOCKSIZE);
! 		  (void) _malloc_internal (blocks * BLOCKSIZE);
! 		  _free_internal (previous);
  		}
  	      goto out;
  	    }
--- 1517,1529 ----
  		 the thing we just freed.  Unfortunately it might
  		 have been coalesced with its neighbors.  */
  	      if (_heapindex == block)
! 	        (void) _malloc_internal_nolock (blocks * BLOCKSIZE);
  	      else
  		{
  		  __ptr_t previous
! 		    = _malloc_internal_nolock ((block - _heapindex) * BLOCKSIZE);
! 		  (void) _malloc_internal_nolock (blocks * BLOCKSIZE);
! 		  _free_internal_nolock (previous);
  		}
  	      goto out;
  	    }
*************** _realloc_internal (ptr, size)
*** 1519,1536 ****
  	{
  	  /* The new size is different; allocate a new space,
  	     and copy the lesser of the new size and the old. */
! 	  result = _malloc_internal (size);
  	  if (result == NULL)
  	    goto out;
  	  memcpy (result, ptr, min (size, (__malloc_size_t) 1 << type));
! 	  _free_internal (ptr);
  	}
        break;
      }
  
    PROTECT_MALLOC_STATE (1);
   out:
    UNLOCK ();
    return result;
  }
  
--- 1543,1573 ----
  	{
  	  /* The new size is different; allocate a new space,
  	     and copy the lesser of the new size and the old. */
! 	  result = _malloc_internal_nolock (size);
  	  if (result == NULL)
  	    goto out;
  	  memcpy (result, ptr, min (size, (__malloc_size_t) 1 << type));
! 	  _free_internal_nolock (ptr);
  	}
        break;
      }
  
    PROTECT_MALLOC_STATE (1);
   out:
+   return result;
+ }
+ 
+ __ptr_t
+ _realloc_internal (ptr, size)
+      __ptr_t ptr;
+      __malloc_size_t size;
+ {
+   __ptr_t result;
+ 
+   LOCK();
+   result = _realloc_internal_nolock (ptr, size);
    UNLOCK ();
+ 
    return result;
  }

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[YAMAMOTO Mitsuharu]

>>>>> On Thu, 14 Jun 2007 13:49:25 -0500, Gary Mills <mills@cc.umanitoba.ca> said:

>> I found a possible problem, which may or may not be relevant to
>> this issue, in the initialization of the recursive mutex in
>> src/gmalloc.c.  Could you try this patch?

> I'm sorry to report that it still dumps core when I click on one of
> those icons.

I've set up Solaris 10 11/06 SPARC with Sun Studio 11 and tried
making/running the GTK+ build, but couldn't reproduce the crash even
with unmodified Emacs 22.1.  That may be because mine is a
uniprocessor machine.  What about yours?

Could you try yet another patch below and identify the line in the
source code where the crash occurs?

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

Index: src/gmalloc.c
===================================================================
RCS file: /cvsroot/emacs/emacs/src/gmalloc.c,v
retrieving revision 1.21
diff -c -p -r1.21 gmalloc.c
*** src/gmalloc.c	28 Mar 2007 08:16:05 -0000	1.21
--- src/gmalloc.c	16 Jun 2007 05:15:04 -0000
*************** extern __malloc_size_t _bytes_free;
*** 235,248 ****
  extern __ptr_t _malloc_internal PP ((__malloc_size_t __size));
  extern __ptr_t _realloc_internal PP ((__ptr_t __ptr, __malloc_size_t __size));
  extern void _free_internal PP ((__ptr_t __ptr));
  
  #ifdef USE_PTHREAD
! extern pthread_mutex_t _malloc_mutex;
  #define LOCK()     pthread_mutex_lock (&_malloc_mutex)
  #define UNLOCK()   pthread_mutex_unlock (&_malloc_mutex)
  #else
  #define LOCK()
  #define UNLOCK()
  #endif
  
  #endif /* _MALLOC_INTERNAL.  */
--- 235,255 ----
  extern __ptr_t _malloc_internal PP ((__malloc_size_t __size));
  extern __ptr_t _realloc_internal PP ((__ptr_t __ptr, __malloc_size_t __size));
  extern void _free_internal PP ((__ptr_t __ptr));
+ extern __ptr_t _malloc_internal_nolock PP ((__malloc_size_t __size));
+ extern __ptr_t _realloc_internal_nolock PP ((__ptr_t __ptr, __malloc_size_t __size));
+ extern void _free_internal_nolock PP ((__ptr_t __ptr));
  
  #ifdef USE_PTHREAD
! extern pthread_mutex_t _malloc_mutex, _aligned_blocks_mutex;
  #define LOCK()     pthread_mutex_lock (&_malloc_mutex)
  #define UNLOCK()   pthread_mutex_unlock (&_malloc_mutex)
+ #define LOCK_ALIGNED_BLOCKS()     pthread_mutex_lock (&_aligned_blocks_mutex)
+ #define UNLOCK_ALIGNED_BLOCKS()   pthread_mutex_unlock (&_aligned_blocks_mutex)
  #else
  #define LOCK()
  #define UNLOCK()
+ #define LOCK_ALIGNED_BLOCKS()
+ #define UNLOCK_ALIGNED_BLOCKS()
  #endif
  
  #endif /* _MALLOC_INTERNAL.  */
*************** register_heapinfo ()
*** 554,560 ****
  
  #ifdef USE_PTHREAD
  static pthread_once_t malloc_init_once_control = PTHREAD_ONCE_INIT;
! pthread_mutex_t _malloc_mutex;
  #endif
  
  static void
--- 561,568 ----
  
  #ifdef USE_PTHREAD
  static pthread_once_t malloc_init_once_control = PTHREAD_ONCE_INIT;
! pthread_mutex_t _malloc_mutex = PTHREAD_MUTEX_INITIALIZER;
! pthread_mutex_t _aligned_blocks_mutex = PTHREAD_MUTEX_INITIALIZER;
  #endif
  
  static void
*************** malloc_initialize_1 ()
*** 567,573 ****
    if (__malloc_initialize_hook)
      (*__malloc_initialize_hook) ();
  
! #ifdef USE_PTHREAD
    {
      pthread_mutexattr_t attr;
  
--- 575,583 ----
    if (__malloc_initialize_hook)
      (*__malloc_initialize_hook) ();
  
!   /* We don't use recursive mutex because pthread_mutexattr_init may
!      call malloc internally.  */
! #if 0 /* defined (USE_PTHREAD) */
    {
      pthread_mutexattr_t attr;
  
*************** static int morecore_recursing;
*** 616,624 ****
  
  /* Get neatly aligned memory, initializing or
     growing the heap info table as necessary. */
! static __ptr_t morecore PP ((__malloc_size_t));
  static __ptr_t
! morecore (size)
       __malloc_size_t size;
  {
    __ptr_t result;
--- 626,634 ----
  
  /* Get neatly aligned memory, initializing or
     growing the heap info table as necessary. */
! static __ptr_t morecore_nolock PP ((__malloc_size_t));
  static __ptr_t
! morecore_nolock (size)
       __malloc_size_t size;
  {
    __ptr_t result;
*************** morecore (size)
*** 661,667 ****
  	     `morecore_recursing' flag and return null.  */
  	  int save = errno;	/* Don't want to clobber errno with ENOMEM.  */
  	  morecore_recursing = 1;
! 	  newinfo = (malloc_info *) _realloc_internal
  	    (_heapinfo, newsize * sizeof (malloc_info));
  	  morecore_recursing = 0;
  	  if (newinfo == NULL)
--- 671,677 ----
  	     `morecore_recursing' flag and return null.  */
  	  int save = errno;	/* Don't want to clobber errno with ENOMEM.  */
  	  morecore_recursing = 1;
! 	  newinfo = (malloc_info *) _realloc_internal_nolock
  	    (_heapinfo, newsize * sizeof (malloc_info));
  	  morecore_recursing = 0;
  	  if (newinfo == NULL)
*************** morecore (size)
*** 717,723 ****
        /* Reset _heaplimit so _free_internal never decides
  	 it can relocate or resize the info table.  */
        _heaplimit = 0;
!       _free_internal (oldinfo);
        PROTECT_MALLOC_STATE (0);
  
        /* The new heap limit includes the new table just allocated.  */
--- 727,733 ----
        /* Reset _heaplimit so _free_internal never decides
  	 it can relocate or resize the info table.  */
        _heaplimit = 0;
!       _free_internal_nolock (oldinfo);
        PROTECT_MALLOC_STATE (0);
  
        /* The new heap limit includes the new table just allocated.  */
*************** morecore (size)
*** 732,738 ****
  
  /* Allocate memory from the heap.  */
  __ptr_t
! _malloc_internal (size)
       __malloc_size_t size;
  {
    __ptr_t result;
--- 742,748 ----
  
  /* Allocate memory from the heap.  */
  __ptr_t
! _malloc_internal_nolock (size)
       __malloc_size_t size;
  {
    __ptr_t result;
*************** _malloc_internal (size)
*** 752,758 ****
      return NULL;
  #endif
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    if (size < sizeof (struct list))
--- 762,767 ----
*************** _malloc_internal (size)
*** 802,811 ****
  	  /* No free fragments of the desired size, so get a new block
  	     and break it into fragments, returning the first.  */
  #ifdef GC_MALLOC_CHECK
! 	  result = _malloc_internal (BLOCKSIZE);
  	  PROTECT_MALLOC_STATE (0);
  #else
! 	  result = malloc (BLOCKSIZE);
  #endif
  	  if (result == NULL)
  	    {
--- 811,820 ----
  	  /* No free fragments of the desired size, so get a new block
  	     and break it into fragments, returning the first.  */
  #ifdef GC_MALLOC_CHECK
! 	  result = _malloc_internal_nolock (BLOCKSIZE);
  	  PROTECT_MALLOC_STATE (0);
  #else
! 	  result = _malloc_internal_nolock (BLOCKSIZE);
  #endif
  	  if (result == NULL)
  	    {
*************** _malloc_internal (size)
*** 874,880 ****
   		  _heaplimit += wantblocks - lastblocks;
  		  continue;
  		}
! 	      result = morecore (wantblocks * BLOCKSIZE);
  	      if (result == NULL)
  		goto out;
  	      block = BLOCK (result);
--- 883,889 ----
   		  _heaplimit += wantblocks - lastblocks;
  		  continue;
  		}
! 	      result = morecore_nolock (wantblocks * BLOCKSIZE);
  	      if (result == NULL)
  		goto out;
  	      block = BLOCK (result);
*************** _malloc_internal (size)
*** 932,938 ****
--- 941,959 ----
  
    PROTECT_MALLOC_STATE (1);
   out:
+   return result;
+ }
+ 
+ __ptr_t
+ _malloc_internal (size)
+      __malloc_size_t size;
+ {
+   __ptr_t result;
+ 
+   LOCK ();
+   result = _malloc_internal_nolock (size);
    UNLOCK ();
+ 
    return result;
  }
  
*************** void (*__free_hook) PP ((__ptr_t __ptr))
*** 1024,1032 ****
  struct alignlist *_aligned_blocks = NULL;
  
  /* Return memory to the heap.
!    Like `free' but don't call a __free_hook if there is one.  */
  void
! _free_internal (ptr)
       __ptr_t ptr;
  {
    int type;
--- 1045,1053 ----
  struct alignlist *_aligned_blocks = NULL;
  
  /* Return memory to the heap.
!    Like `_free_internal' but don't lock mutex.  */
  void
! _free_internal_nolock (ptr)
       __ptr_t ptr;
  {
    int type;
*************** _free_internal (ptr)
*** 1043,1051 ****
    if (ptr == NULL)
      return;
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    for (l = _aligned_blocks; l != NULL; l = l->next)
      if (l->aligned == ptr)
        {
--- 1064,1072 ----
    if (ptr == NULL)
      return;
  
    PROTECT_MALLOC_STATE (0);
  
+   LOCK_ALIGNED_BLOCKS ();
    for (l = _aligned_blocks; l != NULL; l = l->next)
      if (l->aligned == ptr)
        {
*************** _free_internal (ptr)
*** 1053,1058 ****
--- 1074,1080 ----
  	ptr = l->exact;
  	break;
        }
+   UNLOCK_ALIGNED_BLOCKS ();
  
    block = BLOCK (ptr);
  
*************** _free_internal (ptr)
*** 1158,1164 ****
  		 table's blocks to the system before we have copied them to
  		 the new location.  */
  	      _heaplimit = 0;
! 	      _free_internal (_heapinfo);
  	      _heaplimit = oldlimit;
  
  	      /* Tell malloc to search from the beginning of the heap for
--- 1180,1186 ----
  		 table's blocks to the system before we have copied them to
  		 the new location.  */
  	      _heaplimit = 0;
! 	      _free_internal_nolock (_heapinfo);
  	      _heaplimit = oldlimit;
  
  	      /* Tell malloc to search from the beginning of the heap for
*************** _free_internal (ptr)
*** 1166,1173 ****
  	      _heapindex = 0;
  
  	      /* Allocate new space for the info table and move its data.  */
! 	      newinfo = (malloc_info *) _malloc_internal (info_blocks
! 							  * BLOCKSIZE);
  	      PROTECT_MALLOC_STATE (0);
  	      memmove (newinfo, _heapinfo, info_blocks * BLOCKSIZE);
  	      _heapinfo = newinfo;
--- 1188,1195 ----
  	      _heapindex = 0;
  
  	      /* Allocate new space for the info table and move its data.  */
! 	      newinfo = (malloc_info *) _malloc_internal_nolock (info_blocks
! 								 * BLOCKSIZE);
  	      PROTECT_MALLOC_STATE (0);
  	      memmove (newinfo, _heapinfo, info_blocks * BLOCKSIZE);
  	      _heapinfo = newinfo;
*************** _free_internal (ptr)
*** 1231,1239 ****
  	  _bytes_free -= BLOCKSIZE;
  
  #ifdef GC_MALLOC_CHECK
! 	  _free_internal (ADDRESS (block));
  #else
! 	  free (ADDRESS (block));
  #endif
  	}
        else if (_heapinfo[block].busy.info.frag.nfree != 0)
--- 1253,1261 ----
  	  _bytes_free -= BLOCKSIZE;
  
  #ifdef GC_MALLOC_CHECK
! 	  _free_internal_nolock (ADDRESS (block));
  #else
! 	  _free_internal_nolock (ADDRESS (block));
  #endif
  	}
        else if (_heapinfo[block].busy.info.frag.nfree != 0)
*************** _free_internal (ptr)
*** 1269,1274 ****
--- 1291,1306 ----
      }
  
    PROTECT_MALLOC_STATE (1);
+ }
+ 
+ /* Return memory to the heap.
+    Like `free' but don't call a __free_hook if there is one.  */
+ void
+ _free_internal (ptr)
+      __ptr_t ptr;
+ {
+   LOCK ();
+   _free_internal_nolock (ptr);
    UNLOCK ();
  }
  
*************** __ptr_t (*__realloc_hook) PP ((__ptr_t _
*** 1415,1421 ****
     new region.  This module has incestuous knowledge of the
     internals of both free and malloc. */
  __ptr_t
! _realloc_internal (ptr, size)
       __ptr_t ptr;
       __malloc_size_t size;
  {
--- 1447,1453 ----
     new region.  This module has incestuous knowledge of the
     internals of both free and malloc. */
  __ptr_t
! _realloc_internal_nolock (ptr, size)
       __ptr_t ptr;
       __malloc_size_t size;
  {
*************** _realloc_internal (ptr, size)
*** 1425,1439 ****
  
    if (size == 0)
      {
!       _free_internal (ptr);
!       return _malloc_internal (0);
      }
    else if (ptr == NULL)
!     return _malloc_internal (size);
  
    block = BLOCK (ptr);
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    type = _heapinfo[block].busy.type;
--- 1457,1470 ----
  
    if (size == 0)
      {
!       _free_internal_nolock (ptr);
!       return _malloc_internal_nolock (0);
      }
    else if (ptr == NULL)
!     return _malloc_internal_nolock (size);
  
    block = BLOCK (ptr);
  
    PROTECT_MALLOC_STATE (0);
  
    type = _heapinfo[block].busy.type;
*************** _realloc_internal (ptr, size)
*** 1443,1453 ****
        /* Maybe reallocate a large block to a small fragment.  */
        if (size <= BLOCKSIZE / 2)
  	{
! 	  result = _malloc_internal (size);
  	  if (result != NULL)
  	    {
  	      memcpy (result, ptr, size);
! 	      _free_internal (ptr);
  	      goto out;
  	    }
  	}
--- 1474,1484 ----
        /* Maybe reallocate a large block to a small fragment.  */
        if (size <= BLOCKSIZE / 2)
  	{
! 	  result = _malloc_internal_nolock (size);
  	  if (result != NULL)
  	    {
  	      memcpy (result, ptr, size);
! 	      _free_internal_nolock (ptr);
  	      goto out;
  	    }
  	}
*************** _realloc_internal (ptr, size)
*** 1467,1473 ****
  	     Now we will free this chunk; increment the statistics counter
  	     so it doesn't become wrong when _free_internal decrements it.  */
  	  ++_chunks_used;
! 	  _free_internal (ADDRESS (block + blocks));
  	  result = ptr;
  	}
        else if (blocks == _heapinfo[block].busy.info.size)
--- 1498,1504 ----
  	     Now we will free this chunk; increment the statistics counter
  	     so it doesn't become wrong when _free_internal decrements it.  */
  	  ++_chunks_used;
! 	  _free_internal_nolock (ADDRESS (block + blocks));
  	  result = ptr;
  	}
        else if (blocks == _heapinfo[block].busy.info.size)
*************** _realloc_internal (ptr, size)
*** 1482,1489 ****
  	  /* Prevent free from actually returning memory to the system.  */
  	  oldlimit = _heaplimit;
  	  _heaplimit = 0;
! 	  _free_internal (ptr);
! 	  result = _malloc_internal (size);
  	  PROTECT_MALLOC_STATE (0);
  	  if (_heaplimit == 0)
  	    _heaplimit = oldlimit;
--- 1513,1520 ----
  	  /* Prevent free from actually returning memory to the system.  */
  	  oldlimit = _heaplimit;
  	  _heaplimit = 0;
! 	  _free_internal_nolock (ptr);
! 	  result = _malloc_internal_nolock (size);
  	  PROTECT_MALLOC_STATE (0);
  	  if (_heaplimit == 0)
  	    _heaplimit = oldlimit;
*************** _realloc_internal (ptr, size)
*** 1493,1505 ****
  		 the thing we just freed.  Unfortunately it might
  		 have been coalesced with its neighbors.  */
  	      if (_heapindex == block)
! 	        (void) _malloc_internal (blocks * BLOCKSIZE);
  	      else
  		{
  		  __ptr_t previous
! 		    = _malloc_internal ((block - _heapindex) * BLOCKSIZE);
! 		  (void) _malloc_internal (blocks * BLOCKSIZE);
! 		  _free_internal (previous);
  		}
  	      goto out;
  	    }
--- 1524,1536 ----
  		 the thing we just freed.  Unfortunately it might
  		 have been coalesced with its neighbors.  */
  	      if (_heapindex == block)
! 	        (void) _malloc_internal_nolock (blocks * BLOCKSIZE);
  	      else
  		{
  		  __ptr_t previous
! 		    = _malloc_internal_nolock ((block - _heapindex) * BLOCKSIZE);
! 		  (void) _malloc_internal_nolock (blocks * BLOCKSIZE);
! 		  _free_internal_nolock (previous);
  		}
  	      goto out;
  	    }
*************** _realloc_internal (ptr, size)
*** 1519,1536 ****
  	{
  	  /* The new size is different; allocate a new space,
  	     and copy the lesser of the new size and the old. */
! 	  result = _malloc_internal (size);
  	  if (result == NULL)
  	    goto out;
  	  memcpy (result, ptr, min (size, (__malloc_size_t) 1 << type));
! 	  _free_internal (ptr);
  	}
        break;
      }
  
    PROTECT_MALLOC_STATE (1);
   out:
    UNLOCK ();
    return result;
  }
  
--- 1550,1580 ----
  	{
  	  /* The new size is different; allocate a new space,
  	     and copy the lesser of the new size and the old. */
! 	  result = _malloc_internal_nolock (size);
  	  if (result == NULL)
  	    goto out;
  	  memcpy (result, ptr, min (size, (__malloc_size_t) 1 << type));
! 	  _free_internal_nolock (ptr);
  	}
        break;
      }
  
    PROTECT_MALLOC_STATE (1);
   out:
+   return result;
+ }
+ 
+ __ptr_t
+ _realloc_internal (ptr, size)
+      __ptr_t ptr;
+      __malloc_size_t size;
+ {
+   __ptr_t result;
+ 
+   LOCK();
+   result = _realloc_internal_nolock (ptr, size);
    UNLOCK ();
+ 
    return result;
  }
  
*************** memalign (alignment, size)
*** 1718,1723 ****
--- 1762,1768 ----
  	 of an allocated block.  */
  
        struct alignlist *l;
+       LOCK_ALIGNED_BLOCKS ();
        for (l = _aligned_blocks; l != NULL; l = l->next)
  	if (l->aligned == NULL)
  	  /* This slot is free.  Use it.  */
*************** memalign (alignment, size)
*** 1728,1740 ****
  	  if (l == NULL)
  	    {
  	      free (result);
! 	      return NULL;
  	    }
  	  l->next = _aligned_blocks;
  	  _aligned_blocks = l;
  	}
        l->exact = result;
        result = l->aligned = (char *) result + alignment - adj;
      }
  
    return result;
--- 1773,1788 ----
  	  if (l == NULL)
  	    {
  	      free (result);
! 	      result = NULL;
! 	      goto out;
  	    }
  	  l->next = _aligned_blocks;
  	  _aligned_blocks = l;
  	}
        l->exact = result;
        result = l->aligned = (char *) result + alignment - adj;
+     out:
+       UNLOCK_ALIGNED_BLOCKS ();
      }
  
    return result;

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Gary Mills]

On Sat, Jun 16, 2007 at 02:22:54PM +0900, YAMAMOTO Mitsuharu wrote:
> >>>>> On Thu, 14 Jun 2007 13:49:25 -0500, Gary Mills <mills@cc.umanitoba.ca> said:
> 
> >> I found a possible problem, which may or may not be relevant to
> >> this issue, in the initialization of the recursive mutex in
> >> src/gmalloc.c.  Could you try this patch?
> 
> > I'm sorry to report that it still dumps core when I click on one of
> > those icons.
> 
> I've set up Solaris 10 11/06 SPARC with Sun Studio 11 and tried
> making/running the GTK+ build, but couldn't reproduce the crash even
> with unmodified Emacs 22.1.  That may be because mine is a
> uniprocessor machine.  What about yours?

That'll be it.  I've run emacs-22.1 on both SPARC and x86 hardware,
but never on a uniprocessor machine.  We don't have any of those left.
However, I just took one CPU offline on my Ultra 60 and tried
emacs-22.1.  When I click on the `Read and existing file' icon, the
`Find File' dialogue window appears just like it should.

When I click on that icon with both CPUs online, I get a very long
pause, after which the emacs window disappears, leaving a 94-meg core
file.

> Could you try yet another patch below and identify the line in the
> source code where the crash occurs?

I'll see what I can do.

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Gary Mills]

On Sat, Jun 16, 2007 at 02:22:54PM +0900, YAMAMOTO Mitsuharu wrote:
> 
> Could you try yet another patch below and identify the line in the
> source code where the crash occurs?

It does still dump core for me.  I'm not sure that I can identify the
source line.  I have very little experience with debuggers.  I'd have
to use dbx in this case.  I'll see what I can do.

In the meantime, here's the stack traces from the core file:

$ pstack core
core 'core' of 22463:   /tmp/emacs
-----------------  lwp# 1 / thread# 1  --------------------
 fecd5e5c g_main_context_acquire (1, fed3ec00, 1, fed3ec00, 6edb10, fed3ec00) + 174
 fecd70ec g_main_context_iterate (6edb00, 0, 0, 6edb00, 0, 7415e0) + 78
 fecd75d0 g_main_context_pending (0, fed3ec00, 6edb00, 0, ffbfba18, ffffffff) + 94
 ff1aa648 gtk_events_pending (0, 1b3f2c, 0, a800, 37c400, aaf0) + 44
 0011fe28 XTread_socket (0, 87, ffbfcbc4, 3ad7c4, 3ad340, 3af528) + 138
 0015af88 read_avail_input (0, 0, 0, ffbfcbc4, 3b1254, 3b2314) + 60
 0015383c poll_for_input_1 (0, 400, 0, 0, 0, 3b2400) + 20
 00153864 poll_for_input (6d6220, 33172f3, d144, 7fffff73, 0, 0) + 18
 00211880 alarm_signal_handler (6d6220, ffbfcd8c, 15384c, 819fa0, 3ad340, 3aac94) + e8
 002119cc do_pending_atimers (0, 0, 0, 2000, ffbfcdb8, 1) + 50
 0014d858 fatal_error_signal (b, 0, ffbfcfb8, 3ad000, 2, 3b5400) + d0
 fd340a14 __sighndlr (b, 0, ffbfcfb8, 14d788, 0, 1) + c
 fd335a30 call_user_handler (b, 0, 4, 0, fd7f2000, ffbfcfb8) + 3b8
 fd34098c __lwp_park (0, 0, 3a8910, 0, 0, 1) + 14
 001ae9ac emacs_blocked_free (c10f50, ffbfd3f0, 0, 1, c11f80, 3a8800) + 30
 00222418 free     (c10f50, 2fff, ffbfd3f0, 1ae97c, 3b4c00, 1ae97c) + 1c
 fa313184 do_get_file_info (0, c0fa00, c06900, 9, 0, c10f50) + 104
 fac21a80 gnome_vfs_get_file_info_uri_cancellable (c0fa00, c06900, 9, 0, 6a2e80, 0) + c8
 fac3e468 gnome_vfs_get_file_info (6a2e80, c06900, 9, c0fa00, 2, c10000) + 20
 fac84754 get_vfs_info (617e40, 6a2e80, 8, fac847a0, 13454, c06900) + f8
 fac847c0 gtk_file_system_gnome_vfs_render_icon (617e40, 6a2e80, b29e00, 12, 0, 118bc) + 4c
 ff159874 shortcuts_reload_icons (b29e00, 20, ffbfd704, ffbfd700, ffffffff, ffbfd690) + a0
 ff15dc8c change_icon_theme (b29e00, 12, 0, fedd42c8, 0, ff35e53c) + 60
 ff15de64 gtk_file_chooser_default_screen_changed (b29e00, ff376fb8, 742640, 200724, fedc6818, 0) + 58
 fedadcd8 g_closure_invoke (ffbfd9f8, ffbfd88c, 2, 18000, 0, 74e150) + 174
 fedc576c signal_emit_unlocked_R (1008, fedeeaf8, fed3ee34, fed3ee20, fedeeae4, 756d40) + e14
 fedc442c g_signal_emit_valist (b29e00, 3f3c55, 756d40, ffbfdc2c, fedeeaf8, fed3ee2c) + 7f8
 fedc4738 g_signal_emit (b29e00, 42, 0, 0, a8d48, b29e00) + 1c
 ff2b5930 gtk_widget_propagate_hierarchy_changed_recurse (b29e00, ffbfdd5c, 3, a8cd4, fedd0ed8, 220720) + d4
 ff0f05a0 gtk_box_forall (ad6180, 1, ff2b585c, ffbfdd5c, 973800, 1c00) + 90
 ff2b5964 gtk_widget_propagate_hierarchy_changed_recurse (ad6180, ffbfdd5c, a80e0, a8cd4, ff2b64d4, 220620) + 108
 ff2b5a30 _gtk_widget_propagate_hierarchy_changed (ad6180, 3600, 3600, 0, 973800, 0) + b4
 ff2b4980 gtk_widget_set_parent (ad6180, ad6480, 600, 220620, 0, ff35e53c) + 298 ff0ef998 gtk_box_pack_start (ad6480, ad6180, 800, 80, a5, 800) + 1bc
 ff156d4c gtk_file_chooser_dialog_constructor (b16b00, ff376fac, 757600, 299c, 0, b16bb8) + 104
 fedb1158 g_object_newv (960340, ff156c48, 818580, 1, 60f600, 818590) + 328
 fedb1b60 g_object_new_valist (0, 0, ffbfe134, 0, 3, 60f000) + 358
 fedb0d30 g_object_new (960340, ff327710, 3518b0, ff327718, 0, fedd9800) + 60
 ff156f28 gtk_file_chooser_dialog_new_valist (3518b0, 75cc00, 0, 0, 236680, ffbfe1ec) + 50
 ff156fa0 gtk_file_chooser_dialog_new (3518b0, 75cc00, 0, 236680, fffffffa, 370640) + 20
 001491b8 xg_get_file_with_chooser (6c6a00, 3518b0, abc350, 0, 0, ffbfe660) + 80 0014959c xg_get_file_name (6c6a00, 3518b0, abc350, 1, 0, e) + 70
 0012e99c Fx_file_dialog (602d2cc4, 1fffffff, 0, 30, 203c2800, 203c2800) + 168
 0018d71c Fread_file_name (602d2cc4, 606b4d30, 60789650, 203c2830, 203c2800, 3aac00) + 5e0
 001cdfd4 Ffuncall (10, ffbfe7c0, ffbfe85c, 6, 252974, 80252974) + 408
 001ffdc4 Fbyte_code (4, 24, 20434a70, 3afc7c, 272d28, 3b1314) + 1424
 001ce65c funcall_lambda (1, 4, ffbfe9f4, 203c2800, 3, 80272ce8) + 310
 001ce0b0 Ffuncall (8, ffbfe9f0, ffbfe9f4, 2, 272ce8, 80272ce8) + 4e4
 001ffdc4 Fbyte_code (2, 22, 20434a70, 3afc7c, 2d2ca4, 3b1314) + 1424
 001ce65c funcall_lambda (802d2c6c, 0, ffbfebd0, 203c2800, 3, 802d2c6c) + 310
 001ce0b0 Ffuncall (0, ffbfebcc, ffbfebd0, 1, 2d2c6c, 802d2c6c) + 4e4
 001cda58 apply1   (2067fc30, 203c2800, 753500, 0, 203c2800, 3aac00) + 1c
 001c9430 Fcall_interactively (2067fc30, 2067fc30, 3afc00, 2067fc30, 203c2800, 3b4400) + 1910
 00160ba8 Fcommand_execute (3b4800, 3b5400, 203c2800, 802d2c6c, 0, 203c2800) + 1b0
 00152778 command_loop_1 (151400, 3b4950, 40000000, 1fffffff, 3aadfc, 0) + 112c
 001cb958 internal_condition_case (3aac00, 0, 3b2000, 203d0670, 3b4800, ffbfefb4) + 11c
 001512a0 command_loop_2 (151400, 3aadfc, 150e70, 3b1250, 150c00, 3b1000) + 2c
 001cb364 internal_catch (0, 3b5400, 3b4800, 3b4800, ffbfefb4, 3afc00) + c4
 00151218 command_loop (3b1c00, 3b2400, 3aac00, 3aadfc, 3b5530, 151274) + 7c
 00150b60 recursive_edit_1 (0, 10, 0, 44c810, 1, 3b4400) + 80
 00150ce4 Frecursive_edit (3aac00, 3aac00, 0, 3aac00, 150c00, 0) + e4
 0014f15c main     (ffbff23c, ffbff2a4, 3b5400, 1, 1, ffbffdde) + 124c
 0008bd68 _start   (0, 0, 0, 0, 0, 0) + 108
-----------------  lwp# 2 / thread# 2  --------------------
 fd3416b8 __pollsys (964080, 8, 0, 0, 0, 1) + 8
 fd2dd170 poll     (964080, 8, ffffffff, fd7f2400, b16310, 0) + 7c
 fecd8098 g_main_context_poll (b16300, ffffffff, 8, 964080, 8, fd2dd0f4) + ec
 fecd74a0 g_main_context_iterate (964080, 1, 1, b16300, b16308, 8) + 42c
 fecd7c44 g_main_loop_run (6798b0, fed3ec00, ff000000, 617460, 0, fed2a800) + 348
 fab90e18 link_io_thread_fn (0, fabb0188, fd338f9c, 800, fabad258, 910) + 28
 fecf2268 g_thread_create_proxy (617460, 1, fed3ec00, 0, fd339f78, fab90df0) + 134
 fd3408e8 _lwp_start (0, 0, 0, 0, 0, 0)
-----------------  lwp# 3 / thread# 3  --------------------
 0022151c _malloc_internal_nolock (10, bde444, 3b5000, 3b256c, 3b4ee4, 4) + bc
 00221b90 _malloc_internal (10, 0, 0, ff92e318, 82ccd8, 4) + 4
 00221bf8 malloc   (10, 3ad000, 221b8c, 3ad000, 221800, 1) + 58
 001aeb48 emacs_blocked_malloc (10, 1, fd36ec80, fa0f0000, 3a8918, 3b2000) + 58
 00221bf8 malloc   (10, 3ad000, 1aeaf0, 3ad000, 82ccc8, 1) + 58
 00222770 calloc   (1, 10, ffffffff, fffffff8, ffffffe0, 10) + 10
 fac548a0 _xdg_glob_hash_insert_text (0, fa14f88e, c10e10, 67, 6f, 19bb4) + dc
 fac548f0 _xdg_glob_hash_insert_text (c0c2b0, fa14f88d, c10e10, 6e, 70, c10e00) + 12c
 fac548f0 _xdg_glob_hash_insert_text (c0e780, fa14f88c, c10e10, 70, 2e, bfe1c0) + 12c
 fac548f0 _xdg_glob_hash_insert_text (c0c400, fa14f88b, c10e10, 2e, 1, bfe250) + 12c
 fac54da4 _gnome_vfs_xdg_hash_append_glob (bfe2b0, fa14f88a, fa14f880, 80808080, 196c8, fd3241f0) + f4
 fac54f84 _gnome_vfs_xdg_glob_read_from_file (bfe2b0, fa14f88a, 1150, 19494, 221bf8, 1000) + a0
 fac540a4 _xdg_mime_init_from_directory (bfe270, 10f4, 1a348, 221bf8, fac6e384, 1000) + 74
 fac542c0 xdg_mime_init (ffbffbb1, fac5b97e, b, fac730d0, 7a1420, fac6e384) + 1a0
 fac54528 _gnome_vfs_xdg_get_mime_type_from_file_name (c07810, 0, 19e70, fd36fd04, fac6e384, 1000) + 1c
 fac37850 gnome_vfs_mime_type_from_name_or_default (fac72c08, 0, c07810, 36c08, 1, fac6e384) + ec
 fac37d38 _gnome_vfs_get_mime_type_internal (0, c07800, 1000, 0, 36874, 0) + 234 fac37fa8 gnome_vfs_get_file_mime_type_internal (8000, fa14fd18, 0, 1, c07800, 364fc) + 12c
 fa312b04 get_mime_type (c06980, c07800, 9, fa14fd18, 0, 139ec) + 90
 fa313050 do_read_directory (c07000, 7a1740, c06980, be51b0, fa326c4c, 1) + c8
 fac302d8 load_directory_details (7a1b60, c06980, ffffff74, 0, 0, 30) + dc
 fac30714 _gnome_vfs_job_execute (fac305d4, 7a1b60, 3dd54, 140, 28, fac6e384) + fc
 fac2de10 thread_routine (1, 1000, 405ec, fed3ee28, fac6e384, 7a1b60) + 80
 fac42d2c thread_entry (7a1860, 4, b7, fac5a468, fac5a4a0, fac6e384) + a8
 fecf2268 g_thread_create_proxy (7a1820, 1, fed3ec00, 0, fd339f78, fac42c84) + 134
 fd3408e8 _lwp_start (0, 0, 0, 0, 0, 0)

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Gary Mills]

On Sat, Jun 16, 2007 at 09:30:59AM -0500, Gary Mills wrote:
> On Sat, Jun 16, 2007 at 02:22:54PM +0900, YAMAMOTO Mitsuharu wrote:
> > 
> > Could you try yet another patch below and identify the line in the
> > source code where the crash occurs?
> 
> It does still dump core for me.  I'm not sure that I can identify the
> source line.  I have very little experience with debuggers.  I'd have
> to use dbx in this case.  I'll see what I can do.

This might be what you want:

$ dbx src/emacs core
...
t@2 (l@2) terminated by signal KILL (Killed)
0xfd3416b8: __pollsys+0x0008:   blu      _cerror        ! 0xfd2a2600
(dbx) where
current thread: t@2
=>[1] __pollsys(0x4, 0x8, 0x0, 0x0, 0x622b08, 0x0), at 0xfd3416b8
  [2] _pollsys(0x964080, 0x8, 0x0, 0x0, 0x0, 0x1), at 0xfd334824
  [3] _poll(0x964080, 0x8, 0xffffffff, 0xfd7f2400, 0xb16310, 0x0), at 0xfd2dd170
  [4] g_main_context_poll(0xb16300, 0xffffffff, 0x8, 0x964080, 0x8, 0xfd2dd0f4), at 0xfecd8098
  [5] g_main_context_iterate(0x964080, 0x1, 0x1, 0xb16300, 0xb16308, 0x8), at 0xfecd74a0
  [6] g_main_loop_run(0x6798b0, 0xfed3ec00, 0xff000000, 0x617460, 0x0, 0xfed2a800), at 0xfecd7c44
  [7] link_io_thread_fn(0x0, 0xfabb0188, 0xfd338f9c, 0x800, 0xfabad258, 0x910), at 0xfab90e18
  [8] g_thread_create_proxy(0x617460, 0x1, 0xfed3ec00, 0x0, 0xfd339f78, 0xfab90df0), at 0xfecf2268
(dbx) lwps
  l@1 LWP suspended in g_main_context_acquire()
 >l@2 LWP suspended in __pollsys()
o l@3 signal SIGSEGV in _malloc_internal_nolock()
(dbx) lwp l@3
t@3 (l@3) stopped in _malloc_internal_nolock (optimized) at line 796 in file "gmalloc.c"
  796               next->next->prev = next->prev;
(dbx) where
=>[1] _malloc_internal_nolock(size = ???) (optimized), at 0x22151c (line ~796) in "gmalloc.c"
  [2] _malloc_internal(size = ???) (optimized), at 0x221b90 (line ~954) in "gmalloc.c"
  [3] malloc(size = ???) (optimized), at 0x221bf8 (line ~967) in "gmalloc.c"
  [4] emacs_blocked_malloc(size = ???, ptr = ???) (optimized), at 0x1aeb48 (line ~1244) in "alloc.c"
  [5] malloc(size = ???) (optimized), at 0x221bf8 (line ~967) in "gmalloc.c"
  [6] calloc(nmemb = ???, size = ???) (optimized), at 0x222770 (line ~1624) in "gmalloc.c"
  [7] _xdg_glob_hash_insert_text(0x0, 0xfa14f88e, 0xc10e10, 0x67, 0x6f, 0x19bb4), at 0xfac548a0
...
(dbx) print next->prev
dbx: Can't evaluate local variables in optimized functions

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[YAMAMOTO Mitsuharu]

>>>>> On Sat, 16 Jun 2007 10:40:07 -0500, Gary Mills <mills@cc.umanitoba.ca> said:

> On Sat, Jun 16, 2007 at 09:30:59AM -0500, Gary Mills wrote:
>> On Sat, Jun 16, 2007 at 02:22:54PM +0900, YAMAMOTO Mitsuharu wrote:
>> > 
>> > Could you try yet another patch below and identify the line in the
>> > source code where the crash occurs?
>> 
>> It does still dump core for me.  I'm not sure that I can identify
>> the source line.  I have very little experience with debuggers.
>> I'd have to use dbx in this case.  I'll see what I can do.

> This might be what you want:

Yes, that's it.  Thanks a lot.

> (dbx) lwp l@3
> t@3 (l@3) stopped in _malloc_internal_nolock (optimized) at line 796 in file "gmalloc.c"
>   796               next->next->prev = next->prev;

Gosh!  I noticed that the mutex code in gmalloc.c did not take effect
at all because `HAVE_GTK_AND_PTHREAD' is checked before including
config.h.  Could you try moving the following part at the beginning of
gmalloc.c to just before the first occurrence of '#ifdef USE_PTHREAD'?

#ifdef HAVE_GTK_AND_PTHREAD
#define USE_PTHREAD
#endif

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Gary Mills]

On Sun, Jun 17, 2007 at 03:41:26PM +0900, YAMAMOTO Mitsuharu wrote:
> 
> Gosh!  I noticed that the mutex code in gmalloc.c did not take effect
> at all because `HAVE_GTK_AND_PTHREAD' is checked before including
> config.h.  Could you try moving the following part at the beginning of
> gmalloc.c to just before the first occurrence of '#ifdef USE_PTHREAD'?
> 
> #ifdef HAVE_GTK_AND_PTHREAD
> #define USE_PTHREAD
> #endif

Well, I got a different core dump this time...

$ dbx src/emacs core
...
t@2 (l@2) terminated by signal KILL (Killed)
0xfd3416b8: __pollsys+0x0008:   blu      _cerror        ! 0xfd2a2600
(dbx) lwps
  l@1 LWP suspended in _write()
 >l@2 LWP suspended in __pollsys()
o l@3 signal SIGSEGV in 0x0()
(dbx) lwp l@3
Current function is malloc (optimized)
  967     return (__malloc_hook != NULL ? *__malloc_hook : _malloc_internal) (size);
t@3 (l@3) stopped in (unknown) at 0x0
0x00000000:     <bad address 0x0>
(dbx) regs
current thread: t@3
current frame:  [2]
g0-g1    0x00000000 0x00000000 0x00000000 0x00678000
g2-g3    0x00000000 0x0000006d 0x00000000 0x0084eec0
g4-g5    0x00000000 0x003b2000 0x00000000 0x003a8800
g6-g7    0x00000000 0x00000000 0x00000000 0xfa0f0000
o0-o1    0x00000000 0x00000010 0x00000000 0x00001000
o2-o3    0x00000000 0xfd36ec80 0x00000000 0xfa0f0000
o4-o5    0x00000000 0x00368ae0 0x00000000 0x00000000
o6-o7    0x00000000 0xfa14f5e0 0x00000000 0x00221cc0
l0-l1    0x00000000 0x00000056 0x00000000 0x00000000
l2-l3    0x00000000 0xfd7f2000 0x00000000 0xff39c000
l4-l5    0x00000000 0x00000004 0x00000000 0x00000000
l6-l7    0x00000000 0x00000001 0x00000000 0x001aeba8
i0-i1    0x00000000 0x00000010 0x00000000 0x003ad400
i2-i3    0x00000000 0x00000000 0x00000000 0x003ad400
i4-i5    0x00000000 0x00000000 0x00000000 0x00000001
i6-i7    0x00000000 0xfa14f640 0x00000000 0x0022286c
y        0x00000000 0x00000000
ccr      0x00000000 0xfe001000
pc       0x00000000 0x00221cc0:malloc+0x58      call     %i2
npc      0x00000000 0x00000004:0x00000004       <bad address 0x4>

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[YAMAMOTO Mitsuharu]

>>>>> On Sun, 17 Jun 2007 11:01:06 -0500, Gary Mills <mills@cc.umanitoba.ca> said:

> Well, I got a different core dump this time...

> (dbx) lwp l@3
> Current function is malloc (optimized)
>   967     return (__malloc_hook != NULL ? *__malloc_hook : _malloc_internal) (size);
> t@3 (l@3) stopped in (unknown) at 0x0
> 0x00000000:     <bad address 0x0>

Please try the following patch.  It tries to fix the following
problems of gmalloc.c with HAVE_GTK_AND_PTHREAD in Emacs 22.1.

* HAVE_GTK_AND_PTHREAD was checked before including config.h.
* malloc_initialize_1 called pthread_mutexattr_init that may call malloc.
* _aligned_blocks was not protected.
* __malloc_hook etc. may be modified between its NULL-check and the use.

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

Index: src/gmalloc.c
===================================================================
RCS file: /cvsroot/emacs/emacs/src/gmalloc.c,v
retrieving revision 1.21
diff -c -p -r1.21 gmalloc.c
*** src/gmalloc.c	28 Mar 2007 08:16:05 -0000	1.21
--- src/gmalloc.c	18 Jun 2007 01:00:00 -0000
***************
*** 1,9 ****
  /* This file is no longer automatically generated from libc.  */
  
  #define _MALLOC_INTERNAL
- #ifdef HAVE_GTK_AND_PTHREAD
- #define USE_PTHREAD
- #endif
  
  /* The malloc headers and source files from the C library follow here.  */
  
--- 1,6 ----
*************** Fifth Floor, Boston, MA 02110-1301, USA.
*** 40,45 ****
--- 37,46 ----
  #include <config.h>
  #endif
  
+ #ifdef HAVE_GTK_AND_PTHREAD
+ #define USE_PTHREAD
+ #endif
+ 
  #if ((defined __cplusplus || (defined (__STDC__) && __STDC__) \
        || defined STDC_HEADERS || defined PROTOTYPES) \
       && ! defined (BROKEN_PROTOTYPES))
*************** extern __malloc_size_t _bytes_free;
*** 235,248 ****
  extern __ptr_t _malloc_internal PP ((__malloc_size_t __size));
  extern __ptr_t _realloc_internal PP ((__ptr_t __ptr, __malloc_size_t __size));
  extern void _free_internal PP ((__ptr_t __ptr));
  
  #ifdef USE_PTHREAD
! extern pthread_mutex_t _malloc_mutex;
  #define LOCK()     pthread_mutex_lock (&_malloc_mutex)
  #define UNLOCK()   pthread_mutex_unlock (&_malloc_mutex)
  #else
  #define LOCK()
  #define UNLOCK()
  #endif
  
  #endif /* _MALLOC_INTERNAL.  */
--- 236,256 ----
  extern __ptr_t _malloc_internal PP ((__malloc_size_t __size));
  extern __ptr_t _realloc_internal PP ((__ptr_t __ptr, __malloc_size_t __size));
  extern void _free_internal PP ((__ptr_t __ptr));
+ extern __ptr_t _malloc_internal_nolock PP ((__malloc_size_t __size));
+ extern __ptr_t _realloc_internal_nolock PP ((__ptr_t __ptr, __malloc_size_t __size));
+ extern void _free_internal_nolock PP ((__ptr_t __ptr));
  
  #ifdef USE_PTHREAD
! extern pthread_mutex_t _malloc_mutex, _aligned_blocks_mutex;
  #define LOCK()     pthread_mutex_lock (&_malloc_mutex)
  #define UNLOCK()   pthread_mutex_unlock (&_malloc_mutex)
+ #define LOCK_ALIGNED_BLOCKS()     pthread_mutex_lock (&_aligned_blocks_mutex)
+ #define UNLOCK_ALIGNED_BLOCKS()   pthread_mutex_unlock (&_aligned_blocks_mutex)
  #else
  #define LOCK()
  #define UNLOCK()
+ #define LOCK_ALIGNED_BLOCKS()
+ #define UNLOCK_ALIGNED_BLOCKS()
  #endif
  
  #endif /* _MALLOC_INTERNAL.  */
*************** register_heapinfo ()
*** 554,560 ****
  
  #ifdef USE_PTHREAD
  static pthread_once_t malloc_init_once_control = PTHREAD_ONCE_INIT;
! pthread_mutex_t _malloc_mutex;
  #endif
  
  static void
--- 562,569 ----
  
  #ifdef USE_PTHREAD
  static pthread_once_t malloc_init_once_control = PTHREAD_ONCE_INIT;
! pthread_mutex_t _malloc_mutex = PTHREAD_MUTEX_INITIALIZER;
! pthread_mutex_t _aligned_blocks_mutex = PTHREAD_MUTEX_INITIALIZER;
  #endif
  
  static void
*************** malloc_initialize_1 ()
*** 567,573 ****
    if (__malloc_initialize_hook)
      (*__malloc_initialize_hook) ();
  
! #ifdef USE_PTHREAD
    {
      pthread_mutexattr_t attr;
  
--- 576,584 ----
    if (__malloc_initialize_hook)
      (*__malloc_initialize_hook) ();
  
!   /* We don't use recursive mutex because pthread_mutexattr_init may
!      call malloc internally.  */
! #if 0 /* defined (USE_PTHREAD) */
    {
      pthread_mutexattr_t attr;
  
*************** static int morecore_recursing;
*** 616,624 ****
  
  /* Get neatly aligned memory, initializing or
     growing the heap info table as necessary. */
! static __ptr_t morecore PP ((__malloc_size_t));
  static __ptr_t
! morecore (size)
       __malloc_size_t size;
  {
    __ptr_t result;
--- 627,635 ----
  
  /* Get neatly aligned memory, initializing or
     growing the heap info table as necessary. */
! static __ptr_t morecore_nolock PP ((__malloc_size_t));
  static __ptr_t
! morecore_nolock (size)
       __malloc_size_t size;
  {
    __ptr_t result;
*************** morecore (size)
*** 661,667 ****
  	     `morecore_recursing' flag and return null.  */
  	  int save = errno;	/* Don't want to clobber errno with ENOMEM.  */
  	  morecore_recursing = 1;
! 	  newinfo = (malloc_info *) _realloc_internal
  	    (_heapinfo, newsize * sizeof (malloc_info));
  	  morecore_recursing = 0;
  	  if (newinfo == NULL)
--- 672,678 ----
  	     `morecore_recursing' flag and return null.  */
  	  int save = errno;	/* Don't want to clobber errno with ENOMEM.  */
  	  morecore_recursing = 1;
! 	  newinfo = (malloc_info *) _realloc_internal_nolock
  	    (_heapinfo, newsize * sizeof (malloc_info));
  	  morecore_recursing = 0;
  	  if (newinfo == NULL)
*************** morecore (size)
*** 717,723 ****
        /* Reset _heaplimit so _free_internal never decides
  	 it can relocate or resize the info table.  */
        _heaplimit = 0;
!       _free_internal (oldinfo);
        PROTECT_MALLOC_STATE (0);
  
        /* The new heap limit includes the new table just allocated.  */
--- 728,734 ----
        /* Reset _heaplimit so _free_internal never decides
  	 it can relocate or resize the info table.  */
        _heaplimit = 0;
!       _free_internal_nolock (oldinfo);
        PROTECT_MALLOC_STATE (0);
  
        /* The new heap limit includes the new table just allocated.  */
*************** morecore (size)
*** 732,738 ****
  
  /* Allocate memory from the heap.  */
  __ptr_t
! _malloc_internal (size)
       __malloc_size_t size;
  {
    __ptr_t result;
--- 743,749 ----
  
  /* Allocate memory from the heap.  */
  __ptr_t
! _malloc_internal_nolock (size)
       __malloc_size_t size;
  {
    __ptr_t result;
*************** _malloc_internal (size)
*** 752,758 ****
      return NULL;
  #endif
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    if (size < sizeof (struct list))
--- 763,768 ----
*************** _malloc_internal (size)
*** 802,809 ****
  	  /* No free fragments of the desired size, so get a new block
  	     and break it into fragments, returning the first.  */
  #ifdef GC_MALLOC_CHECK
! 	  result = _malloc_internal (BLOCKSIZE);
  	  PROTECT_MALLOC_STATE (0);
  #else
  	  result = malloc (BLOCKSIZE);
  #endif
--- 812,821 ----
  	  /* No free fragments of the desired size, so get a new block
  	     and break it into fragments, returning the first.  */
  #ifdef GC_MALLOC_CHECK
! 	  result = _malloc_internal_nolock (BLOCKSIZE);
  	  PROTECT_MALLOC_STATE (0);
+ #elif defined (USE_PTHREAD)
+ 	  result = _malloc_internal_nolock (BLOCKSIZE);
  #else
  	  result = malloc (BLOCKSIZE);
  #endif
*************** _malloc_internal (size)
*** 874,880 ****
   		  _heaplimit += wantblocks - lastblocks;
  		  continue;
  		}
! 	      result = morecore (wantblocks * BLOCKSIZE);
  	      if (result == NULL)
  		goto out;
  	      block = BLOCK (result);
--- 886,892 ----
   		  _heaplimit += wantblocks - lastblocks;
  		  continue;
  		}
! 	      result = morecore_nolock (wantblocks * BLOCKSIZE);
  	      if (result == NULL)
  		goto out;
  	      block = BLOCK (result);
*************** _malloc_internal (size)
*** 932,938 ****
--- 944,962 ----
  
    PROTECT_MALLOC_STATE (1);
   out:
+   return result;
+ }
+ 
+ __ptr_t
+ _malloc_internal (size)
+      __malloc_size_t size;
+ {
+   __ptr_t result;
+ 
+   LOCK ();
+   result = _malloc_internal_nolock (size);
    UNLOCK ();
+ 
    return result;
  }
  
*************** __ptr_t
*** 940,949 ****
  malloc (size)
       __malloc_size_t size;
  {
    if (!__malloc_initialized && !__malloc_initialize ())
      return NULL;
  
!   return (__malloc_hook != NULL ? *__malloc_hook : _malloc_internal) (size);
  }
  \f
  #ifndef _LIBC
--- 964,979 ----
  malloc (size)
       __malloc_size_t size;
  {
+   __ptr_t (*hook) (__malloc_size_t);
+ 
    if (!__malloc_initialized && !__malloc_initialize ())
      return NULL;
  
!   /* Copy the value of __malloc_hook to an automatic variable in case
!      __malloc_hook is modified in another thread between its
!      NULL-check and the use.  */
!   hook = __malloc_hook;
!   return (hook != NULL ? *hook : _malloc_internal) (size);
  }
  \f
  #ifndef _LIBC
*************** void (*__free_hook) PP ((__ptr_t __ptr))
*** 1024,1032 ****
  struct alignlist *_aligned_blocks = NULL;
  
  /* Return memory to the heap.
!    Like `free' but don't call a __free_hook if there is one.  */
  void
! _free_internal (ptr)
       __ptr_t ptr;
  {
    int type;
--- 1054,1062 ----
  struct alignlist *_aligned_blocks = NULL;
  
  /* Return memory to the heap.
!    Like `_free_internal' but don't lock mutex.  */
  void
! _free_internal_nolock (ptr)
       __ptr_t ptr;
  {
    int type;
*************** _free_internal (ptr)
*** 1043,1051 ****
    if (ptr == NULL)
      return;
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    for (l = _aligned_blocks; l != NULL; l = l->next)
      if (l->aligned == ptr)
        {
--- 1073,1081 ----
    if (ptr == NULL)
      return;
  
    PROTECT_MALLOC_STATE (0);
  
+   LOCK_ALIGNED_BLOCKS ();
    for (l = _aligned_blocks; l != NULL; l = l->next)
      if (l->aligned == ptr)
        {
*************** _free_internal (ptr)
*** 1053,1058 ****
--- 1083,1089 ----
  	ptr = l->exact;
  	break;
        }
+   UNLOCK_ALIGNED_BLOCKS ();
  
    block = BLOCK (ptr);
  
*************** _free_internal (ptr)
*** 1158,1164 ****
  		 table's blocks to the system before we have copied them to
  		 the new location.  */
  	      _heaplimit = 0;
! 	      _free_internal (_heapinfo);
  	      _heaplimit = oldlimit;
  
  	      /* Tell malloc to search from the beginning of the heap for
--- 1189,1195 ----
  		 table's blocks to the system before we have copied them to
  		 the new location.  */
  	      _heaplimit = 0;
! 	      _free_internal_nolock (_heapinfo);
  	      _heaplimit = oldlimit;
  
  	      /* Tell malloc to search from the beginning of the heap for
*************** _free_internal (ptr)
*** 1166,1173 ****
  	      _heapindex = 0;
  
  	      /* Allocate new space for the info table and move its data.  */
! 	      newinfo = (malloc_info *) _malloc_internal (info_blocks
! 							  * BLOCKSIZE);
  	      PROTECT_MALLOC_STATE (0);
  	      memmove (newinfo, _heapinfo, info_blocks * BLOCKSIZE);
  	      _heapinfo = newinfo;
--- 1197,1204 ----
  	      _heapindex = 0;
  
  	      /* Allocate new space for the info table and move its data.  */
! 	      newinfo = (malloc_info *) _malloc_internal_nolock (info_blocks
! 								 * BLOCKSIZE);
  	      PROTECT_MALLOC_STATE (0);
  	      memmove (newinfo, _heapinfo, info_blocks * BLOCKSIZE);
  	      _heapinfo = newinfo;
*************** _free_internal (ptr)
*** 1230,1237 ****
  	  _chunks_free -= BLOCKSIZE >> type;
  	  _bytes_free -= BLOCKSIZE;
  
! #ifdef GC_MALLOC_CHECK
! 	  _free_internal (ADDRESS (block));
  #else
  	  free (ADDRESS (block));
  #endif
--- 1261,1268 ----
  	  _chunks_free -= BLOCKSIZE >> type;
  	  _bytes_free -= BLOCKSIZE;
  
! #if defined (GC_MALLOC_CHECK) || defined (USE_PTHREAD)
! 	  _free_internal_nolock (ADDRESS (block));
  #else
  	  free (ADDRESS (block));
  #endif
*************** _free_internal (ptr)
*** 1269,1274 ****
--- 1300,1315 ----
      }
  
    PROTECT_MALLOC_STATE (1);
+ }
+ 
+ /* Return memory to the heap.
+    Like `free' but don't call a __free_hook if there is one.  */
+ void
+ _free_internal (ptr)
+      __ptr_t ptr;
+ {
+   LOCK ();
+   _free_internal_nolock (ptr);
    UNLOCK ();
  }
  
*************** FREE_RETURN_TYPE
*** 1278,1285 ****
  free (ptr)
       __ptr_t ptr;
  {
!   if (__free_hook != NULL)
!     (*__free_hook) (ptr);
    else
      _free_internal (ptr);
  }
--- 1319,1328 ----
  free (ptr)
       __ptr_t ptr;
  {
!   void (*hook) (__ptr_t) = __free_hook;
! 
!   if (hook != NULL)
!     (*hook) (ptr);
    else
      _free_internal (ptr);
  }
*************** __ptr_t (*__realloc_hook) PP ((__ptr_t _
*** 1415,1421 ****
     new region.  This module has incestuous knowledge of the
     internals of both free and malloc. */
  __ptr_t
! _realloc_internal (ptr, size)
       __ptr_t ptr;
       __malloc_size_t size;
  {
--- 1458,1464 ----
     new region.  This module has incestuous knowledge of the
     internals of both free and malloc. */
  __ptr_t
! _realloc_internal_nolock (ptr, size)
       __ptr_t ptr;
       __malloc_size_t size;
  {
*************** _realloc_internal (ptr, size)
*** 1425,1439 ****
  
    if (size == 0)
      {
!       _free_internal (ptr);
!       return _malloc_internal (0);
      }
    else if (ptr == NULL)
!     return _malloc_internal (size);
  
    block = BLOCK (ptr);
  
-   LOCK ();
    PROTECT_MALLOC_STATE (0);
  
    type = _heapinfo[block].busy.type;
--- 1468,1481 ----
  
    if (size == 0)
      {
!       _free_internal_nolock (ptr);
!       return _malloc_internal_nolock (0);
      }
    else if (ptr == NULL)
!     return _malloc_internal_nolock (size);
  
    block = BLOCK (ptr);
  
    PROTECT_MALLOC_STATE (0);
  
    type = _heapinfo[block].busy.type;
*************** _realloc_internal (ptr, size)
*** 1443,1453 ****
        /* Maybe reallocate a large block to a small fragment.  */
        if (size <= BLOCKSIZE / 2)
  	{
! 	  result = _malloc_internal (size);
  	  if (result != NULL)
  	    {
  	      memcpy (result, ptr, size);
! 	      _free_internal (ptr);
  	      goto out;
  	    }
  	}
--- 1485,1495 ----
        /* Maybe reallocate a large block to a small fragment.  */
        if (size <= BLOCKSIZE / 2)
  	{
! 	  result = _malloc_internal_nolock (size);
  	  if (result != NULL)
  	    {
  	      memcpy (result, ptr, size);
! 	      _free_internal_nolock (ptr);
  	      goto out;
  	    }
  	}
*************** _realloc_internal (ptr, size)
*** 1467,1473 ****
  	     Now we will free this chunk; increment the statistics counter
  	     so it doesn't become wrong when _free_internal decrements it.  */
  	  ++_chunks_used;
! 	  _free_internal (ADDRESS (block + blocks));
  	  result = ptr;
  	}
        else if (blocks == _heapinfo[block].busy.info.size)
--- 1509,1515 ----
  	     Now we will free this chunk; increment the statistics counter
  	     so it doesn't become wrong when _free_internal decrements it.  */
  	  ++_chunks_used;
! 	  _free_internal_nolock (ADDRESS (block + blocks));
  	  result = ptr;
  	}
        else if (blocks == _heapinfo[block].busy.info.size)
*************** _realloc_internal (ptr, size)
*** 1482,1489 ****
  	  /* Prevent free from actually returning memory to the system.  */
  	  oldlimit = _heaplimit;
  	  _heaplimit = 0;
! 	  _free_internal (ptr);
! 	  result = _malloc_internal (size);
  	  PROTECT_MALLOC_STATE (0);
  	  if (_heaplimit == 0)
  	    _heaplimit = oldlimit;
--- 1524,1531 ----
  	  /* Prevent free from actually returning memory to the system.  */
  	  oldlimit = _heaplimit;
  	  _heaplimit = 0;
! 	  _free_internal_nolock (ptr);
! 	  result = _malloc_internal_nolock (size);
  	  PROTECT_MALLOC_STATE (0);
  	  if (_heaplimit == 0)
  	    _heaplimit = oldlimit;
*************** _realloc_internal (ptr, size)
*** 1493,1505 ****
  		 the thing we just freed.  Unfortunately it might
  		 have been coalesced with its neighbors.  */
  	      if (_heapindex == block)
! 	        (void) _malloc_internal (blocks * BLOCKSIZE);
  	      else
  		{
  		  __ptr_t previous
! 		    = _malloc_internal ((block - _heapindex) * BLOCKSIZE);
! 		  (void) _malloc_internal (blocks * BLOCKSIZE);
! 		  _free_internal (previous);
  		}
  	      goto out;
  	    }
--- 1535,1547 ----
  		 the thing we just freed.  Unfortunately it might
  		 have been coalesced with its neighbors.  */
  	      if (_heapindex == block)
! 	        (void) _malloc_internal_nolock (blocks * BLOCKSIZE);
  	      else
  		{
  		  __ptr_t previous
! 		    = _malloc_internal_nolock ((block - _heapindex) * BLOCKSIZE);
! 		  (void) _malloc_internal_nolock (blocks * BLOCKSIZE);
! 		  _free_internal_nolock (previous);
  		}
  	      goto out;
  	    }
*************** _realloc_internal (ptr, size)
*** 1519,1536 ****
  	{
  	  /* The new size is different; allocate a new space,
  	     and copy the lesser of the new size and the old. */
! 	  result = _malloc_internal (size);
  	  if (result == NULL)
  	    goto out;
  	  memcpy (result, ptr, min (size, (__malloc_size_t) 1 << type));
! 	  _free_internal (ptr);
  	}
        break;
      }
  
    PROTECT_MALLOC_STATE (1);
   out:
    UNLOCK ();
    return result;
  }
  
--- 1561,1591 ----
  	{
  	  /* The new size is different; allocate a new space,
  	     and copy the lesser of the new size and the old. */
! 	  result = _malloc_internal_nolock (size);
  	  if (result == NULL)
  	    goto out;
  	  memcpy (result, ptr, min (size, (__malloc_size_t) 1 << type));
! 	  _free_internal_nolock (ptr);
  	}
        break;
      }
  
    PROTECT_MALLOC_STATE (1);
   out:
+   return result;
+ }
+ 
+ __ptr_t
+ _realloc_internal (ptr, size)
+      __ptr_t ptr;
+      __malloc_size_t size;
+ {
+   __ptr_t result;
+ 
+   LOCK();
+   result = _realloc_internal_nolock (ptr, size);
    UNLOCK ();
+ 
    return result;
  }
  
*************** realloc (ptr, size)
*** 1539,1549 ****
       __ptr_t ptr;
       __malloc_size_t size;
  {
    if (!__malloc_initialized && !__malloc_initialize ())
      return NULL;
  
!   return (__realloc_hook != NULL ? *__realloc_hook : _realloc_internal)
!     (ptr, size);
  }
  /* Copyright (C) 1991, 1992, 1994 Free Software Foundation, Inc.
  
--- 1594,1606 ----
       __ptr_t ptr;
       __malloc_size_t size;
  {
+   __ptr_t (*hook) (__ptr_t, __malloc_size_t);
+ 
    if (!__malloc_initialized && !__malloc_initialize ())
      return NULL;
  
!   hook = __realloc_hook;
!   return (hook != NULL ? *hook : _realloc_internal) (ptr, size);
  }
  /* Copyright (C) 1991, 1992, 1994 Free Software Foundation, Inc.
  
*************** memalign (alignment, size)
*** 1681,1689 ****
  {
    __ptr_t result;
    unsigned long int adj, lastadj;
  
!   if (__memalign_hook)
!     return (*__memalign_hook) (alignment, size);
  
    /* Allocate a block with enough extra space to pad the block with up to
       (ALIGNMENT - 1) bytes if necessary.  */
--- 1738,1747 ----
  {
    __ptr_t result;
    unsigned long int adj, lastadj;
+   __ptr_t (*hook) (__malloc_size_t, __malloc_size_t) = __memalign_hook;
  
!   if (hook)
!     return (*hook) (alignment, size);
  
    /* Allocate a block with enough extra space to pad the block with up to
       (ALIGNMENT - 1) bytes if necessary.  */
*************** memalign (alignment, size)
*** 1718,1723 ****
--- 1776,1782 ----
  	 of an allocated block.  */
  
        struct alignlist *l;
+       LOCK_ALIGNED_BLOCKS ();
        for (l = _aligned_blocks; l != NULL; l = l->next)
  	if (l->aligned == NULL)
  	  /* This slot is free.  Use it.  */
*************** memalign (alignment, size)
*** 1725,1740 ****
        if (l == NULL)
  	{
  	  l = (struct alignlist *) malloc (sizeof (struct alignlist));
! 	  if (l == NULL)
  	    {
! 	      free (result);
! 	      return NULL;
  	    }
- 	  l->next = _aligned_blocks;
- 	  _aligned_blocks = l;
  	}
!       l->exact = result;
!       result = l->aligned = (char *) result + alignment - adj;
      }
  
    return result;
--- 1784,1806 ----
        if (l == NULL)
  	{
  	  l = (struct alignlist *) malloc (sizeof (struct alignlist));
! 	  if (l != NULL)
  	    {
! 	      l->next = _aligned_blocks;
! 	      _aligned_blocks = l;
  	    }
  	}
!       if (l != NULL)
! 	{
! 	  l->exact = result;
! 	  result = l->aligned = (char *) result + alignment - adj;
! 	}
!       UNLOCK_ALIGNED_BLOCKS ();
!       if (l == NULL)
! 	{
! 	  free (result);
! 	  result = NULL;
! 	}
      }
  
    return result;

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Gary Mills]

On Mon, Jun 18, 2007 at 10:08:11AM +0900, YAMAMOTO Mitsuharu wrote:
> 
> Please try the following patch.  It tries to fix the following
> problems of gmalloc.c with HAVE_GTK_AND_PTHREAD in Emacs 22.1.
> 
> * HAVE_GTK_AND_PTHREAD was checked before including config.h.
> * malloc_initialize_1 called pthread_mutexattr_init that may call malloc.
> * _aligned_blocks was not protected.
> * __malloc_hook etc. may be modified between its NULL-check and the use.

I'm very pleased to report that this time it works correctly, and
doesn't dump core!  It was built with this configuration under
Solaris 10 11/06 SPARC:

  PATH=/usr/sfw/bin:/opt/SUNWspro/bin:/usr/bin:/usr/local/bin:/usr/ccs/bin:/usr/sbin; export PATH
  
  env INSTALL=/usr/ucb/install \
          ./configure \
          --program-prefix=g \
          --without-gcc \
          --with-x-toolkit=gtk

-- 
-Gary Mills-    -Unix Support-    -U of M Academic Computing and Networking-

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[YAMAMOTO Mitsuharu]

>>>>> On Sun, 17 Jun 2007 22:03:18 -0500, Gary Mills <mills@cc.umanitoba.ca> said:

> I'm very pleased to report that this time it works correctly, and
> doesn't dump core!

I'm glad to hear that, and thanks for your testing.

				     YAMAMOTO Mitsuharu
				mituharu@math.s.chiba-u.ac.jp

Re: emacs-22.1 with GTK dumps core when Gnome wigets clicked

[Richard Stallman]

    I found a possible problem, which may or may not be relevant to this
    issue, in the initialization of the recursive mutex in src/gmalloc.c.
    Could you try this patch?

Has anyone tried this patch?
Has anyone else studied this patch?