Emacs crash CVS 2003-10-17

Emacs crash CVS 2003-10-17

[Werner LEMBERG]

Below the output of `xbacktrace' and `bt full'.  I still have the
process.


    Werner


======================================================================

Program received signal SIGSEGV, Segmentation fault.
0x08077c43 in fill_glyph_string (s=0xbfffe424, face_id=26, start=6, end=79, 
    overlaps_p=0) at xdisp.c:16730
16730               = FONT_INFO_FROM_ID (f, face->font_info_id);
(gdb) xbacktrace
"message"
"what-cursor-position"
"call-interactively"
(gdb) bt full
#0  0x08077c43 in fill_glyph_string (s=0xbfffe424, face_id=26, start=6, 
    end=79, overlaps_p=0) at xdisp.c:16730
        font_info = (struct font_info *) 0x66
        charset = 152
        c2 = 102
        c1 = 81
        face = (struct face *) 0x0
        f = (struct frame *) 0x85af0c0
        glyph = (struct glyph *) 0x8e2c600
        char2b = (XChar2b *) 0xbfffe384
        two_byte_p = (int *) 0xbfffe358
        two_byte_p = 0
        start = 0
        end = -1073749116
        glyph = (struct glyph *) 0x8e2c600
        last = (struct glyph *) 0x8e2cbb4
        voffset = 0
        glyph_not_available_p = 0
#1  0x08078ad5 in draw_glyphs (w=0x85b3568, x=85, row=0x8f113b8, 
    area=TEXT_AREA, start=0, end=79, hl=DRAW_NORMAL_TEXT, overlaps_p=0)
    at xdisp.c:17476
        head = (struct glyph_string *) 0xbfffe534
        tail = (struct glyph_string *) 0xbfffe424
        s = (struct glyph_string *) 0xbfffe424
        last_x = 973
        x_reached = 150016952
        i = 6
        j = 0
        f = (struct frame *) 0x85af0c0
#2  0x0807cffe in x_write_glyphs (start=0x8e2c588, len=79) at xdisp.c:18518
        start = (struct glyph *) 0x51
        x = 150016952
#3  0x08053fb5 in update_text_area (w=0x85b3568, vpos=0) at dispnew.c:4270
        current_row = (struct glyph_row *) 0x8f133e0
        desired_row = (struct glyph_row *) 0x8f113b8
        changed_p = 0
#4  0x080543f6 in update_window_line (w=0x85b3568, vpos=0, 
    mouse_face_overwritten_p=0xbfffe808) at dispnew.c:4494
        w = (struct window *) 0x85b3568
        mouse_face_overwritten_p = (int *) 0x66
        current_row = (struct glyph_row *) 0x8f133e0
        desired_row = (struct glyph_row *) 0x8f113b8
        changed_p = 0
#5  0x08053d3b in update_window (w=0x85b3568, force_p=1) at dispnew.c:4150
        vpos = 0
        i = 81
        end = (struct glyph_row *) 0x8f115fc
        mode_line_row = (struct glyph_row *) 0x0
        header_line_row = (struct glyph_row *) 0x0
        changed_p = 1
        mouse_face_overwritten_p = 0
        row = (struct glyph_row *) 0x8f113b8
        yb = 48
        n_updated = 0
        desired_matrix = (struct glyph_matrix *) 0x8baf688
        paused_p = 0
        preempt_count = 9
#6  0x080537a3 in update_window_tree (w=0x8c39d18, force_p=0) at dispnew.c:3885
        w = (struct window *) 0x85b3568
        force_p = 0
        paused_p = 0
#7  0x080536a1 in update_frame (f=0x85af0c0, force_p=0, inhibit_hairy_id_p=0)
    at dispnew.c:3822
        f = (struct frame *) 0x85af0c0
        inhibit_hairy_id_p = 102
        paused_p = 139935528
        root_window = (struct window *) 0x8c39d18
#8  0x0806cdaa in redisplay_internal (preserve_echo_area=0) at xdisp.c:10065
        f = (struct frame *) 0x85af0c0
        tail = 81
        frame = 81
        i = 1
        updated = (struct frame **) 0xbfffe894
        n = 0
        size = 50
        w = (struct window *) 0x8f84ab0
        f = (struct frame *) 0x0
        pause = 0
        must_finish = 1
        tlbufpos = {charpos = 682, bytepos = 682}
        tlendpos = {charpos = 3084, bytepos = 3090}
        number_of_visible_frames = 1
        count = 17
        polling_stopped_here = 1
        consider_all_windows_p = 1
#9  0x080691d7 in echo_area_display (update_frame_p=1) at xdisp.c:7638
        n = 81
        mini_window = -2007288472
        w = (struct window *) 0x10
        f = (struct frame *) 0x85af0c0
        window_height_changed_p = 1
#10 0x080679ca in message3_nolog (m=1756311532, nbytes=81, multibyte=1)
    at xdisp.c:6518
        frame = -2007306048
        f = (struct frame *) 0x85af0c0
        m = 1756311532
#11 0x080677f3 in message3 (m=1756311532, nbytes=81, multibyte=1)
    at xdisp.c:6459
        m = 1756311532
        nbytes = 81
        multibyte = 1
        gcpro1 = {next = 0xf2, var = 0x7, nvars = 0}
#12 0x08133089 in Fmessage (nargs=8, args=0xbfffeee8) at editfns.c:3036
        val = 1756311532
        nargs = 102
        args = (int *) 0x0
#13 0x08139d81 in Ffuncall (nargs=9, args=0xbfffeee4) at eval.c:2705
        nargs = -2009580760
        fun = -2009580760
        funcar = 81
        numargs = 8
        val = 81
        backtrace = {next = 0xbfffefd8, function = 0xbfffeee4, 
  args = 0xbfffeee8, nargs = 8, evalargs = 0 '\0', debug_on_exit = 0 '\0'}
        internal_args = (int *) 0x88383b28
        i = 81
#14 0x0816233c in Fbyte_code (bytestr=1746936808, vector=-2011159256, 
    maxdepth=12) at bytecode.c:689
        bytestr = 8
        vector = 3815
        maxdepth = -1073746204
        count = 5
        op = 8
        vectorp = (int *) 0x8202530
        stack = {pc = 0x8202522 "+.\b\207", top = 0xbfffef04, 
  bottom = 0xbfffeee4, byte_string = 1746936808, 
  byte_string_start = 0x82023f8 "g\030e\031d\032`\eÆ \211\034ÇV\203 ", 
  constants = -2011159256, next = 0x0}
        top = (int *) 0xbfffeee4
        result = 81
#15 0x0813a357 in funcall_lambda (fun=-2011159624, nargs=1, 
    arg_vector=0xbffff048) at eval.c:2911
        nargs = 1
        val = 102
        syms_left = 675056556
        next = 675056556
        count = 4
        i = 1
        optional = 1
        rest = 0
#16 0x08139f01 in Ffuncall (nargs=2, args=0xbffff044) at eval.c:2781
        nargs = -2011159624
        fun = -2011159624
        funcar = 81
        numargs = 1
        val = 81
        backtrace = {next = 0xbffff1b8, function = 0xbffff044, 
  args = 0xbffff048, nargs = 1, evalargs = 0 '\0', debug_on_exit = 0 '\0'}
        internal_args = (int *) 0x882023b8
        i = 81
#17 0x08136707 in Fcall_interactively (function=675356132, 
    record_flag=675056556, keys=-2009241152) at callint.c:870
        val = 102
        args = (int *) 0xbffff044
        visargs = (int *) 0xbffff034
        argstrings = (unsigned char **) 0xbffff024
        fun = 2
        funcar = 81
        specs = -1073745852
        teml = 0
        enable = 675056556
        speccount = 3
        next_event = 3
        prefix_arg = -1458400096
        string = (unsigned char *) 0xbffff054 "P"
        tem = (unsigned char *) 0x81922f3 ""
        varies = (int *) 0xbffff014
        i = 2
        j = 0
        count = 1
        foo = 102
        prompt1 = '\0' <repeats 99 times>
        tem1 = 0x66 <Address 0x66 out of bounds>
        arg_from_tty = 0
        gcpro1 = {next = 0x2000, var = 0x0, nvars = 0}
        gcpro2 = {next = 0x869f788, var = 0x4, nvars = 0}
        gcpro3 = {next = 0x283c8bac, var = 0x0, nvars = 2}
        gcpro4 = {next = 0x0, var = 0x0, nvars = 2}
        key_count = 3
        record_then_fail = 0
        save_this_command = 675356132
        save_last_command = 675108364
        save_this_original_command = 675356132
        save_real_this_command = 675356132
#18 0x080ea4d7 in Fcommand_execute (cmd=675356132, record_flag=675056556, 
    keys=675056556, special=675056556) at keyboard.c:9724
        record_flag = 675056556
        keys = 102
        special = 102
        final = 136324024
        tem = 81
        prefixarg = -1458400096
        backtrace = {next = 0x0, function = 0x83c0348, args = 0xbffff1d4, 
  nargs = 1, evalargs = 0 '\0'}
#19 0x080e0871 in command_loop_1 () at keyboard.c:1755
        scount = 2
        cmd = 2
        lose = 2
        nonundocount = 0
        keybuf = {24, 61, -1073745284, 135133204, -1458731784, -1073745336, 
  -1073745284, 135133127, 0, 1, -1073743900, 1077999908, 135703744, 
  -1073744896, 17, 1076902158, 177478308, 1073775649, -1073745168, 32, 
  -1073745084, 0, -1073745376, -1073745516, 0, 1073741824, -1073745028, 
  135496313, -1073745212, -1073744832}
        i = 2
        no_direct = 0
        prev_modiff = 676
        prev_buffer = (struct buffer *) 0x8fe2450
        was_locked = 0
        already_adjusted = 0
#20 0x081382cd in internal_condition_case (bfun=0x80dfb60 <command_loop_1>, 
    handlers=675150244, hfun=0x80df740 <cmd_error>) at eval.c:1333
        val = 81
        c = {tag = 675056556, val = 675056556, next = 0xbffff3c4}
        h = {handler = 675150244, var = 675056556, chosen_clause = 675056604, 
  tag = 0xbffff2b4, next = 0x0}
#21 0x080dfa0e in command_loop_2 () at keyboard.c:1292
        val = 102
#22 0x08137e35 in internal_catch (tag=675111508, 
    func=0x80df9f0 <command_loop_2>, arg=675056556) at eval.c:1094
        tag = 81
        c = {tag = 675111508, val = 675056556, next = 0x0}
#23 0x080df9b3 in command_loop () at keyboard.c:1271
No locals.
#24 0x080df4b4 in recursive_edit_1 () at keyboard.c:987
        count = 1
        val = 0
#25 0x080df5f1 in Frecursive_edit () at keyboard.c:1043
        count = 0
        buffer = 102
#26 0x080de345 in main (argc=1, argv=0xbffff7e4) at emacs.c:1666
        dummy = 0
        stack_bottom_variable = 0 '\0'
        skip_args = 0
        rlim = {rlim_cur = 8388608, rlim_max = 18446744073709551615}
        no_loadup = 0
        junk = 0x0
#27 0x4030c7ee in __libc_start_main () from /lib/libc.so.6
No symbol table info available.

Re: Emacs crash CVS 2003-10-17

[Kenichi Handa]

In article <20031110.093607.43003888.wl@gnu.org>, Werner LEMBERG <wl@gnu.org> writes:

> Below the output of `xbacktrace' and `bt full'.  I still have the
> process.
[...]
> Program received signal SIGSEGV, Segmentation fault.
> 0x08077c43 in fill_glyph_string (s=0xbfffe424, face_id=26, start=6, end=79, 
>     overlaps_p=0) at xdisp.c:16730
> 16730               = FONT_INFO_FROM_ID (f, face->font_info_id);

I'd like to know the result of these:
(gdb) p *face
(gdb) p *glyph

But, as it craches in the inline function
get_glyph_face_and_encoding, those values won't be available
in the current gdb session.

Can you reproduce it constantly?  If not, could you
re-compile xdisp.c with CFLAGS='-g -fno-inline', rebuild
emacs, and use it for a while?   The actual procedure will
be:
% cd .../emacs/src
% rm xdisp.o
% make CFLAGS='-g -fno-inline'


---
Ken'ichi HANDA
handa@m17n.org

Re: Emacs crash CVS 2003-10-17

[Werner LEMBERG]

> > Program received signal SIGSEGV, Segmentation fault.
> > 0x08077c43 in fill_glyph_string (s=0xbfffe424, face_id=26,
> >     start=6, end=79, overlaps_p=0) at xdisp.c:16730
> > 16730               = FONT_INFO_FROM_ID (f, face->font_info_id);
> 
> I'd like to know the result of these:
> (gdb) p *face
> (gdb) p *glyph

  (gdb) p *face
  Cannot access memory at address 0x0
  (gdb) p *glyph
  $5 = {
    charpos = 7, 
    object = -2006738280, 
    pixel_width = 24, 
    voffset = 0, 
    type = 0, 
    multibyte_p = 1, 
    left_box_line_p = 0, 
    right_box_line_p = 0, 
    overlaps_vertically_p = 0, 
    padding_p = 0, 
    glyph_not_available_p = 0, 
    face_id = 26, 
    font_type = 0, 
    u = {
      ch = 157926, 
      cmp_id = 157926, 
      img_id = 157926, 
      stretch = {
        height = 26854, 
        ascent = 2
      }, 
      val = 157926
    }
  }

> But, as it crashes in the inline function
> get_glyph_face_and_encoding, those values won't be available in the
> current gdb session.
> 
> Can you reproduce it constantly?

No.

> If not, could you
> re-compile xdisp.c with CFLAGS='-g -fno-inline', rebuild
> emacs, and use it for a while?   The actual procedure will
> be:
> % cd .../emacs/src
> % rm xdisp.o
> % make CFLAGS='-g -fno-inline'

OK, I'll rebuild emacs from a recent CVS snapshot with `-O0'.


    Werner

Re: Emacs crash CVS 2003-10-17

[Kenichi Handa]

In article <20031110.145406.63054872.wl@gnu.org>, Werner LEMBERG <wl@gnu.org> writes:

>>  > Program received signal SIGSEGV, Segmentation fault.
>>  > 0x08077c43 in fill_glyph_string (s=0xbfffe424, face_id=26,
>>  >     start=6, end=79, overlaps_p=0) at xdisp.c:16730
>>  > 16730               = FONT_INFO_FROM_ID (f, face->font_info_id);
>>  
>>  I'd like to know the result of these:
>>  (gdb) p *face
>>  (gdb) p *glyph

>   (gdb) p *face
>   Cannot access memory at address 0x0
>   (gdb) p *glyph
>   $5 = {
>     charpos = 7, 
[...]
>     face_id = 26, 

Hmmm, then somehow, the call of FACE_FROM_ID here:

L16697  face = FACE_FROM_ID (f, glyph->face_id);

returns NULL.

Please show the result of these:
(gdb) p *f->face_cache
(gdb) p *f->face_cache->faces_by_id[26]

By the way, xbacktrace shows that Emacs crashed while
calling message.  I remember you are using a separate frame
for the minibuffer, so the message of what-cursor-position
is shown in the minibuffer-only frame, right?

---
Ken'ichi HANDA
handa@m17n.org

Re: Emacs crash CVS 2003-10-17

[Werner LEMBERG]

From: Kenichi Handa <handa@m17n.org>
Subject: Re: Emacs crash CVS 2003-10-17
Date: Tue, 11 Nov 2003 09:15:30 +0900 (JST)

> In article <20031110.145406.63054872.wl@gnu.org>, Werner LEMBERG <wl@gnu.org> writes:
> 
> >>  > Program received signal SIGSEGV, Segmentation fault.
> >>  > 0x08077c43 in fill_glyph_string (s=0xbfffe424, face_id=26,
> >>  >     start=6, end=79, overlaps_p=0) at xdisp.c:16730
> >>  > 16730               = FONT_INFO_FROM_ID (f, face->font_info_id);
> >>  
> >>  I'd like to know the result of these:
> >>  (gdb) p *face
> >>  (gdb) p *glyph
> 
> >   (gdb) p *face
> >   Cannot access memory at address 0x0
> >   (gdb) p *glyph
> >   $5 = {
> >     charpos = 7, 
> [...]
> >     face_id = 26, 
> 
> Hmmm, then somehow, the call of FACE_FROM_ID here:
> 
> L16697  face = FACE_FROM_ID (f, glyph->face_id);
> 
> returns NULL.
> 
> Please show the result of these:
> (gdb) p *f->face_cache
> (gdb) p *f->face_cache->faces_by_id[26]

  (gdb) p *f->face_cache
  $6 = {
    buckets = 0x8660de0, 
    f = 0x85af0c0, 
    faces_by_id = 0x8ba02f0, 
    size = 200, 
    used = 21, 
    menu_face_changed_p = 0
  }
  (gdb) p *f->face_cache->faces_by_id[26]
  Cannot access memory at address 0x0

The last non-zero index is 20:

  (gdb) p *f->face_cache->faces_by_id[20]
  $19 = {
    id = 20, 
    gc = 0x8db55a8, 
    font = 0x8d63470, 
    stipple = 0, 
    foreground = 3355443, 
    background = 15066597, 
    underline_color = 0, 
    overline_color = 0, 
    strike_through_color = 0, 
    box_color = 12566463, 
    font_name = 0x8c94c38 "-Etl-Fixed-Bold-R-Normal--24-240-72-72-C-120-ISO8859-1", 
    font_info_id = 0, 
    fontset = 22, 
    pixmap_w = 0, 
    pixmap_h = 0, 
    box_line_width = -1, 
    box = FACE_SIMPLE_BOX, 
    use_box_color_for_shadows_p = 1, 
    lface = {675056940, 1758776380, 675105332, 174, 675105476, 675105332, 
      675056556, 675056556, 1749329204, 1749332324, 675056556, 675056556, 
      675056556, -1471922728, 675056556, 675056556, 120}, 
    hash = 675090362, 
    charset = 0, 
    underline_p = 0, 
    overline_p = 0, 
    strike_through_p = 0, 
    foreground_defaulted_p = 0, 
    background_defaulted_p = 0, 
    underline_defaulted_p = 0, 
    overline_color_defaulted_p = 0, 
    strike_through_color_defaulted_p = 0, 
    box_color_defaulted_p = 1, 
    tty_bold_p = 0, 
    tty_dim_p = 0, 
    tty_underline_p = 0, 
    tty_alt_charset_p = 0, 
    tty_reverse_p = 0, 
    tty_blinking_p = 0, 
    colors_copied_bitwise_p = 0, 
    overstrike = 0, 
    next = 0x0, 
    prev = 0x0, 
    ascii_face = 0x8fb51c8
  }

> By the way, xbacktrace shows that Emacs crashed while calling
> message.  I remember you are using a separate frame for the
> minibuffer, so the message of what-cursor-position is shown in the
> minibuffer-only frame, right?

No.  I only use a separate minibuffer-only frame if I access the
40x40 bitmap fonts for CNS-11643 which isn't the case currently.


    Werner

Re: Emacs crash CVS 2003-10-17

[Kenichi Handa]

In article <20031111.062904.179201862.wl@gnu.org>, Werner LEMBERG <wl@gnu.org> writes:
>>  Please show the result of these:
>>  (gdb) p *f->face_cache
>>  (gdb) p *f->face_cache->faces_by_id[26]

>   (gdb) p *f->face_cache
>   $6 = {
>     buckets = 0x8660de0, 
>     f = 0x85af0c0, 
>     faces_by_id = 0x8ba02f0, 
>     size = 200, 
>     used = 21, 
>     menu_face_changed_p = 0
>   }
>   (gdb) p *f->face_cache->faces_by_id[26]
>   Cannot access memory at address 0x0

> The last non-zero index is 20:

Then, please see all
f->face_cache->faces_by_id[N]->font_name and check if any of
them shows a big5 font.

>>  By the way, xbacktrace shows that Emacs crashed while calling
>>  message.  I remember you are using a separate frame for the
>>  minibuffer, so the message of what-cursor-position is shown in the
>>  minibuffer-only frame, right?

> No.  I only use a separate minibuffer-only frame if I access the
> 40x40 bitmap fonts for CNS-11643 which isn't the case currently.

Hmmm.  The bug occured when you called what-cursor-position
and Emacs tried to display the big5 character under the
cursor in the echo area.  That means that the big5 charater
was already displayed on the current frame.  Is it right?

---
Ken'ichi HANDA
handa@m17n.org

Re: Emacs crash CVS 2003-10-17

[Werner LEMBERG]

> > The last non-zero index is 20:
>
> Then, please see all f->face_cache->faces_by_id[N]->font_name and
> check if any of them shows a big5 font.

0 <= N <= 10 and N = 17 is

  -Etl-Fixed-Medium-R-Normal--24-240-72-72-C-120-ISO8859-1

0 <= N <= 16 and N = 20 is

  -Etl-Fixed-Bold-R-Normal--24-240-72-72-C-120-ISO8859-1

Finally, N = 18 and N = 19 is

  -ETen-Fixed-Medium-R-Normal--24-230-75-75-C-240-Big5.ETen-0


(gdb) p *f->face_cache->faces_by_id[18]
$45 = {
  id = 18, 
  gc = 0x8e094f0, 
  font = 0x916d168, 
  stipple = 0, 
  foreground = 2263842, 
  background = 16777215, 
  underline_color = 0, 
  overline_color = 0, 
  strike_through_color = 0, 
  box_color = 0, 
  font_name = 0x8ee0358 "-ETen-Fixed-Medium-R-Normal--24-230-75-75-C-240-Big5.ETen-0", 
  font_info_id = 1, 
  fontset = 21, 
  pixmap_w = 0, 
  pixmap_h = 0, 
  box_line_width = 0, 
  box = FACE_NO_BOX, 
  use_box_color_for_shadows_p = 0, 
  lface = {675056940, 1758776380, 675105332, 174, 675105332, 675105332, 
    675056556, 675056556, 1756208724, 1756707188, 675056556, 675056556, 
    675056556, 675056556, 1755877084, 675056556, 120}, 
  hash = 675027541, 
  charset = 0, 
  underline_p = 0, 
  overline_p = 0, 
  strike_through_p = 0, 
  foreground_defaulted_p = 0, 
  background_defaulted_p = 0, 
  underline_defaulted_p = 0, 
  overline_color_defaulted_p = 0, 
  strike_through_color_defaulted_p = 0, 
  box_color_defaulted_p = 0, 
  tty_bold_p = 0, 
  tty_dim_p = 0, 
  tty_underline_p = 0, 
  tty_alt_charset_p = 0, 
  tty_reverse_p = 0, 
  tty_blinking_p = 0, 
  colors_copied_bitwise_p = 1, 
  overstrike = 0, 
  next = 0x0, 
  prev = 0x8eaa9b0, 
  ascii_face = 0x8eaa9b0
}
(gdb) p *f->face_cache->faces_by_id[19]
$47 = {
  id = 19, 
  gc = 0x8f772b0, 
  font = 0x916d168, 
  stipple = 0, 
  foreground = 0, 
  background = 16777215, 
  underline_color = 0, 
  overline_color = 0, 
  strike_through_color = 0, 
  box_color = 0, 
  font_name = 0x8ee0358 "-ETen-Fixed-Medium-R-Normal--24-230-75-75-C-240-Big5.ETen-0", 
  font_info_id = 1, 
  fontset = 2, 
  pixmap_w = 0, 
  pixmap_h = 0, 
  box_line_width = 0, 
  box = FACE_NO_BOX, 
  use_box_color_for_shadows_p = 0, 
  lface = {675056940, 1758776380, 675105332, 174, 675105332, 675105332, 
    675056556, 675056556, 1751501428, 1756707188, 675056556, 675056556, 
    675056556, 675056556, 1755877084, 675105884, 120}, 
  hash = 675089964, 
  charset = 0, 
  underline_p = 0, 
  overline_p = 0, 
  strike_through_p = 0, 
  foreground_defaulted_p = 0, 
  background_defaulted_p = 0, 
  underline_defaulted_p = 0, 
  overline_color_defaulted_p = 0, 
  strike_through_color_defaulted_p = 0, 
  box_color_defaulted_p = 0, 
  tty_bold_p = 0, 
  tty_dim_p = 0, 
  tty_underline_p = 0, 
  tty_alt_charset_p = 0, 
  tty_reverse_p = 0, 
  tty_blinking_p = 0, 
  colors_copied_bitwise_p = 1, 
  overstrike = 0, 
  next = 0x0, 
  prev = 0x8bc67b8, 
  ascii_face = 0x8b2b498
}

> Hmmm.  The bug occured when you called what-cursor-position and
> Emacs tried to display the big5 character under the cursor in the
> echo area.  That means that the big5 charater was already displayed
> on the current frame.  Is it right?

Uh, oh, I no longer remember :-(


    Werner