Re: [scratch/igc] 985247b6bee crash on Linux, KDE, Wayland

[Pip Cet <pipcet@protonmail.com>]

"Eval EXEC" <execvy@gmail.com> writes:

> Pip Cet <pipcet@protonmail.com> writes:
>
>> "Eval EXEC" <execvy@gmail.com> writes:
>>
>>> Eval EXEC <execvy@gmail.com> writes:
>>>
>>>> I recompiled commit 95a30325a84 (HEAD -> scratch/igc, origin/scratch/igc)
>>>> * src/igc.c (fix_frame): Correct the previous change.
>>>>
>>>> After testing, I believe the issue has been resolved.
>>>
>>> scratch/igc 95a30325 crash again:
>>>
>>> I use latest scratch/igc commit: * 95a30325a84 - (HEAD -> scratch/igc, origin/scratch/igc) * src/igc.c (fix_frame): Fix last change. (8 hours ago) <Eli Zaretskii>
>>>
>>> build it by:
>>>
>>> #!/usr/bin/env bash
>>> set -ex
>>>
>>> make extraclean
>>>
>>> BRANCH_NAME=$(git branch --show-current | sed 's/\//_/g')
>>> COMMIT_ID=$(git rev-parse --short=8 HEAD)
>>> BUILD_DIR=${BRANCH_NAME}-commit-${COMMIT_ID}
>>> INSTALL_PREFIX=$(realpath ../emacs-build/${BUILD_DIR})
>>>
>>> ./autogen.sh
>>> ./configure CFLAGS='-g3 -ggdb -O2 -fno-omit-frame-pointer -mtune=native -march=native' \
>>>   --prefix=${INSTALL_PREFIX} \
>>>   --with-mps=yes \
>>>   --with-imagemagick  \
>>>   --with-modules \
>>>   --without-compress-install \
>>>   --with-native-compilation  --with-mailutils\
>>>   --enable-link-time-optimization \
>>>   --with-tree-sitter --with-xinput2  \
>>>   --with-dbus  --with-native-compilation=aot \
>>>   --with-file-notification=inotify\
>>>   && make -j30 install
>>>
>>> rm ../emacs-build/emacs
>>> ln -s ${INSTALL_PREFIX} ../emacs-build/emacs
>>
>> Thanks, and sorry you're seeing so many crashes.  It's stable here, so
>> we're going to need your help debugging this :-)
>
> Thanks for the update. No problem. I'm really happy to debug with you all.
> 全世界 Emacs  用户联合起来， Make Emacs Great Again!
>
>> Did you use any special options or patches when building mps (link time
>> optimization or -O3, in particular)?
>
> No special options or patches
>
>> Could you please try (but please
>> keep the core file and binary for this crash) rebuilding mps with "-g3
>> -ggdb -O0" to see whether the problem is, maybe, mps rather than Emacs?
>> That should also improve the debugging output, so please provide further
>> crashes if they do happen with those options.
>
> OK, I will rebuild mps and emacs with "-g3 -ggdb -O0" now

Has the crash happened again with those settings?

>>> #9  0x0000000000690c05 in fix_lisp_obj (ss=ss@entry=0x7ffc7653e6f8, pobj=pobj@entry=0x7f08addd06b8) at /home/exec/Projects/git.savannah.gnu.org/git/emacs/src/igc.c:975
>>
>> This is the car of a cons cell, and it looks like it was freed by a
>> previous garbage collection so it's no longer valid.
>>
>>>         off = <optimized out>
>>>         client = <optimized out>
>>>         base = 0x7f088a262a50
>>
>> Could you open the coredump again and run
>>
>> (gdb) x/32gx 0x7f088a262a00
> It's:
> (gdb) x/32gx 0x7f088a262a00
> 0x7f088a262a00: 0x00000000005a2a06      0x0000000000000000
> 0x7f088a262a10: 0x0000000322e4d00d      0x0000000000004c58
> 0x7f088a262a20: 0x0000000000000000      0x0000000322e4d10d
> 0x7f088a262a30: 0x00000000005a2a06      0x0000000000000000
> 0x7f088a262a40: 0x0000000322e4d20d      0x00000000005a2a0a
> 0x7f088a262a50: 0x0000000000000000      0x0000000322e4d30d
> 0x7f088a262a60: 0x0000000000004c58      0x0000000000000000
> 0x7f088a262a70: 0x0000000322e4d40d      0x00000000005a2a0a
> 0x7f088a262a80: 0x0000000000000000      0x0000000322e4d50d
> 0x7f088a262a90: 0x00000000005a2a0e      0x0000000000000000
> 0x7f088a262aa0: 0x0000000322e4d60d      0x0000000000004c58
> 0x7f088a262ab0: 0x0000000000000000      0x0000000322e4d70d
> 0x7f088a262ac0: 0x00000000005a2a0e      0x0000000000000000
> 0x7f088a262ad0: 0x0000000322e4d80d      0x00000000005a2a12
> 0x7f088a262ae0: 0x0000000000000000      0x0000000322e4d90d
> 0x7f088a262af0: 0x0000000000004c58      0x0000000000000000
>
>
>> so we can get an idea of what was allocated around that time?
>>
>>>         res = <optimized out>
>>>         new_off = <optimized out>
>>>         p = 0x7f08addd06b8
>>>         word = <optimized out>
>>>         tag = <optimized out>
>>>         _ss = 0x7ffc7653e6f8
>>>         _mps_zs = <optimized out>
>>>         _mps_ufs = 36029896530599944
>>>         _mps_wt = <optimized out>
>>>         _mps_w = <optimized out>
>>> #10 0x00000000006919f8 in fix_cons (cons=0x7f08addd06b0, ss=0x7ffc7653e6f8) at /home/exec/Projects/git.savannah.gnu.org/git/emacs/src/igc.c:1751
>>
>> This is the cons cell itself (the IGC header is what "cons" points to).
>>
>> Please also run
>>
>> (gdb) x/64gx 0x7f08addd0600
> It's
> (gdb) x/64gx 0x7f08addd0600
> 0x7f08addd0600: 0x00007f08addd063b      0x00000003df45210d

So we can decode those to three interleaved lists reading, in part:

(nil font-lock-face (:foreground ...))
(rear-nonsticky t <bad symbol> ...)
(nil font-lock-face (...))

<bad symbol> is a pointer to what looks like the nursery generation, but
one which we must have failed to trace (presumably the symbol was either
uninterned and freed or interned and moved to an older generation) and
which was subsequently reused for cons cells by composite.c

Going back to the original report, I notice that it was trying to print
an "error in process filter: " message while handling what looks like a
(long) sequence of terminal escape codes.  Were you using M-x term at
the time?  Did you notice such error messages?

I'll have another look at the process filter/longjmp code, but I suspect
we're going to have to wait for further crashes to get to the bottom of
this.

Thanks
Pip