Segmentation fault in xg_hide_tooltip

Segmentation fault in xg_hide_tooltip

[Julien Danjou]

[-- Attachment #1: Type: text/plain, Size: 3586 bytes --]

Hi,

I've got a recurrent segmentation fault while playing with several
frame in emacs 24.

I've got several backtraces. All mention `tooltip', but are sometimes
different and segfault later in GTK.

This one seems the most accurate (I got it twice on 4 tries). I can also
provide the other ones if that can help.

#0  0x00000000004e0dfd in xg_hide_tooltip (f=0x2bd7ee0) at gtkutil.c:653
#1  0x00000000004b6f61 in Fx_hide_tip () at xfns.c:5236
#2  0x0000000000563193 in Ffuncall (nargs=<value optimized out>, args=<value optimized out>) at eval.c:2980
#3  0x000000000059dfa2 in Fbyte_code (bytestr=<value optimized out>, vector=<value optimized out>, maxdepth=<value optimized out>) at bytecode.c:679
#4  0x00000000005653af in funcall_lambda (fun=10090797, nargs=<value optimized out>, arg_vector=<value optimized out>) at eval.c:3165
#5  0x0000000000562fc3 in Ffuncall (nargs=<value optimized out>, args=0x99f928) at eval.c:3040
#6  0x000000000059dfa2 in Fbyte_code (bytestr=<value optimized out>, vector=<value optimized out>, maxdepth=<value optimized out>) at bytecode.c:679
#7  0x00000000005653af in funcall_lambda (fun=10092437, nargs=<value optimized out>, arg_vector=<value optimized out>) at eval.c:3165
#8  0x0000000000562fc3 in Ffuncall (nargs=<value optimized out>, args=0x99ff90) at eval.c:3040
#9  0x000000000056440a in call1 (fn=<value optimized out>, arg1=<value optimized out>) at eval.c:2782
#10 0x00000000004f7a27 in show_help_echo (help=11716946, window=<value optimized out>, object=140737488342448, pos=24978448, 
    ok_to_overwrite_keystroke_echo=5) at keyboard.c:2317
#11 0x00000000004f9bee in read_char (commandflag=<value optimized out>, nmaps=<value optimized out>, maps=<value optimized out>, 
    prev_event=<value optimized out>, used_mouse_menu=<value optimized out>, end_time=<value optimized out>) at keyboard.c:3208
#12 0x00000000004fcddb in read_key_sequence (keybuf=<value optimized out>, bufsize=<value optimized out>, prompt=<value optimized out>, 
    dont_downcase_last=<value optimized out>, can_return_switch_frame=<value optimized out>, fix_current_buffer=<value optimized out>) at keyboard.c:9330
#13 0x00000000004ff340 in command_loop_1 () at keyboard.c:1613
#14 0x000000000056243d in internal_condition_case (bfun=<value optimized out>, handlers=<value optimized out>, hfun=<value optimized out>) at eval.c:1458
#15 0x00000000004f845e in command_loop_2 (ignore=<value optimized out>) at keyboard.c:1338
#16 0x0000000000562568 in internal_catch (tag=<value optimized out>, func=<value optimized out>, arg=<value optimized out>) at eval.c:1202
#17 0x00000000004f8623 in command_loop () at keyboard.c:1317
#18 0x00000000004f8a08 in recursive_edit_1 () at keyboard.c:940
#19 0x00000000004f8b47 in Frecursive_edit () at keyboard.c:1002
#20 0x00000000004ec125 in main (argc=0, argv=0x7fffffffdfe8) at emacs.c:1763
(gdb) print f
$1 = (FRAME_PTR) 0x2bd7ee0
(gdb) print f->output_data
$2 = {tty = 0x0, x = 0x0, w32 = 0x0, ns = 0x0, nothing = 0}
(gdb) print f->output_data.x
$3 = (struct x_output *) 0x0

The relevant code seems to be:
 648 int 
 649 xg_hide_tooltip (FRAME_PTR f) 
 650 { 
 651   int ret = 0; 
 652 #ifdef USE_GTK_TOOLTIP 
 653   if (f->output_data.x->ttip_window) 

       ^^^ here

 654     { 
 655       GtkWindow *win = f->output_data.x->ttip_window; 

[…]

 670 #endif 
 671   return ret; 
 672 } 

I've no idea how to "fix" this. Any hint appreciated. I can test patches
if needed.

-- 
Julien Danjou
// ᐰ <julien@danjou.info>   http://julien.danjou.info

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]

Re: Segmentation fault in xg_hide_tooltip

[Jan Djärv]

Hmm, obviously a race condition.  I've checked in a fix, please try it.

	Jan D.


Julien Danjou skrev 2010-08-11 18.48:
> Hi,
>
> I've got a recurrent segmentation fault while playing with several
> frame in emacs 24.
>
> I've got several backtraces. All mention `tooltip', but are sometimes
> different and segfault later in GTK.
>
> This one seems the most accurate (I got it twice on 4 tries). I can also
> provide the other ones if that can help.
>
> #0  0x00000000004e0dfd in xg_hide_tooltip (f=0x2bd7ee0) at gtkutil.c:653
> #1  0x00000000004b6f61 in Fx_hide_tip () at xfns.c:5236
> #2  0x0000000000563193 in Ffuncall (nargs=<value optimized out>, args=<value optimized out>) at eval.c:2980
> #3  0x000000000059dfa2 in Fbyte_code (bytestr=<value optimized out>, vector=<value optimized out>, maxdepth=<value optimized out>) at bytecode.c:679
> #4  0x00000000005653af in funcall_lambda (fun=10090797, nargs=<value optimized out>, arg_vector=<value optimized out>) at eval.c:3165
> #5  0x0000000000562fc3 in Ffuncall (nargs=<value optimized out>, args=0x99f928) at eval.c:3040
> #6  0x000000000059dfa2 in Fbyte_code (bytestr=<value optimized out>, vector=<value optimized out>, maxdepth=<value optimized out>) at bytecode.c:679
> #7  0x00000000005653af in funcall_lambda (fun=10092437, nargs=<value optimized out>, arg_vector=<value optimized out>) at eval.c:3165
> #8  0x0000000000562fc3 in Ffuncall (nargs=<value optimized out>, args=0x99ff90) at eval.c:3040
> #9  0x000000000056440a in call1 (fn=<value optimized out>, arg1=<value optimized out>) at eval.c:2782
> #10 0x00000000004f7a27 in show_help_echo (help=11716946, window=<value optimized out>, object=140737488342448, pos=24978448,
>      ok_to_overwrite_keystroke_echo=5) at keyboard.c:2317
> #11 0x00000000004f9bee in read_char (commandflag=<value optimized out>, nmaps=<value optimized out>, maps=<value optimized out>,
>      prev_event=<value optimized out>, used_mouse_menu=<value optimized out>, end_time=<value optimized out>) at keyboard.c:3208
> #12 0x00000000004fcddb in read_key_sequence (keybuf=<value optimized out>, bufsize=<value optimized out>, prompt=<value optimized out>,
>      dont_downcase_last=<value optimized out>, can_return_switch_frame=<value optimized out>, fix_current_buffer=<value optimized out>) at keyboard.c:9330
> #13 0x00000000004ff340 in command_loop_1 () at keyboard.c:1613
> #14 0x000000000056243d in internal_condition_case (bfun=<value optimized out>, handlers=<value optimized out>, hfun=<value optimized out>) at eval.c:1458
> #15 0x00000000004f845e in command_loop_2 (ignore=<value optimized out>) at keyboard.c:1338
> #16 0x0000000000562568 in internal_catch (tag=<value optimized out>, func=<value optimized out>, arg=<value optimized out>) at eval.c:1202
> #17 0x00000000004f8623 in command_loop () at keyboard.c:1317
> #18 0x00000000004f8a08 in recursive_edit_1 () at keyboard.c:940
> #19 0x00000000004f8b47 in Frecursive_edit () at keyboard.c:1002
> #20 0x00000000004ec125 in main (argc=0, argv=0x7fffffffdfe8) at emacs.c:1763
> (gdb) print f
> $1 = (FRAME_PTR) 0x2bd7ee0
> (gdb) print f->output_data
> $2 = {tty = 0x0, x = 0x0, w32 = 0x0, ns = 0x0, nothing = 0}
> (gdb) print f->output_data.x
> $3 = (struct x_output *) 0x0
>
> The relevant code seems to be:
>   648 int
>   649 xg_hide_tooltip (FRAME_PTR f)
>   650 {
>   651   int ret = 0;
>   652 #ifdef USE_GTK_TOOLTIP
>   653   if (f->output_data.x->ttip_window)
>
>         ^^^ here
>
>   654     {
>   655       GtkWindow *win = f->output_data.x->ttip_window;
>
> […]
>
>   670 #endif
>   671   return ret;
>   672 }
>
> I've no idea how to "fix" this. Any hint appreciated. I can test patches
> if needed.
>

Re: Segmentation fault in xg_hide_tooltip

[Julien Danjou]

[-- Attachment #1: Type: text/plain, Size: 411 bytes --]

On Wed, Aug 11 2010, Jan Djärv wrote: 

> Hmm, obviously a race condition.  I've checked in a fix, please 
  try it. 

Good. I cannot reproduce the problem anymore.
Since it was quite random, it may meant that I either suck at it, 
or that you fixed the bug. ;-)

I'll keep you in touch if I see it again.

Thanks Jan.

-- 
Julien Danjou
// ᐰ <julien@danjou.info>   http://julien.danjou.info

[-- Attachment #2: Type: application/pgp-signature, Size: 197 bytes --]