23.0.60; Segmentation fault when deleting Emacs frame

23.0.60; Segmentation fault when deleting Emacs frame

[Lawrence Mitchell]

[I sent the bug a few weeks ago, but didn't get any response.  The
behaviour hasn't changed so am resending].

Please describe exactly what actions triggered the bug
and the precise symptoms of the bug:

When starting emacs in a terminal and then using emacsclient to create
an X frame, attempting to delete the X frame causes a segmentation fault
in FcPatternDestroy() when using the following recipe:

1) emacs -Q -nw -fn 'Bitstream Vera Sans Mono-10' -l ~/bug.el

;; In another terminal create an X frame
2) emacsclient -c

;; Delete the frame
3) C-x 5 0

4) Segmentation fault

Cheers,

Lawrence

Possibly relevant Xresources:

*font:	-misc-fixed-medium-r-normal-*-16-160-*-*-*-*-iso8859-*
Emacs.FontBackend:	xft
Emacs.font:	Bitstream Vera Sans Mono-10
Xft.antialias:	1
Xft.dpi:	96.000000
Xft.hinting:	1
Xft.hintstyle:	hintmedium
Xft.rgba:	none


bug.el:
---begin---
(server-start)

(custom-set-faces
 '(default ((t (:family "mono"))))
 '(bold ((t (:family "mono"))))
 '(mode-line ((t (:inherit default))))
 '(mode-line-inactive ((t (:inherit bold)))))
---end---

fontconfig is version 2.2.3

Backtrace:

#0  0x00530b64 in FcPatternDestroy () from /usr/lib/libfontconfig.so.1
No symbol table info available.
#1  0x082186b6 in ftfont_free_entity (entity=139370620)
    at /scratch/s0198183/src/emacs/src/ftfont.c:790
	val = 147789322
	pattern = (FcPattern *) 0x853c338
#2  0x0820fe90 in font_clear_cache (f=0x850d8e0, cache=138425381, 
    driver=0x83ad700) at /scratch/s0198183/src/emacs/src/font.c:2330
	objlist = 138111177
	entity = 139370620
	vec = 141504956
	i = 0
	tail = 147963365
	elt = 147963373
#3  0x0820fc8b in font_finish_cache (f=0x850d8e0, driver=0x83ad700)
    at /scratch/s0198183/src/emacs/src/font.c:2268
	cache = 147922285
	val = 138425373
	tmp = 138425389
#4  0x082115fa in font_update_drivers (f=0x850d8e0, new_drivers=138111177)
    at /scratch/s0198183/src/emacs/src/font.c:3011
	active_drivers = 138111177
	list = (struct font_driver_list *) 0x8bbb1c8
#5  0x08060c2f in Fdelete_frame (frame=139516132, force=138111177)
    at /scratch/s0198183/src/emacs/src/frame.c:1495
	f = (struct frame *) 0x850d8e0
	sf = (struct frame *) 0x83d6868
	kb = (struct kboard *) 0x0
	minibuffer_selected = 0
#6  0x081b506f in Ffuncall (nargs=1, args=0xbff38010)
    at /scratch/s0198183/src/emacs/src/eval.c:3028
	fun = 136572964
	original_fun = 138146385
	funcar = 138111177
	numargs = 0
	lisp_numargs = 135473710
	val = -1074561096
	backtrace = {
  next = 0xbff381e0, 
  function = 0xbff38010, 
  args = 0xbff38014, 
  nargs = 0, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0xbff37f40
	i = 2
#7  0x081b0b60 in Fcall_interactively (function=138146385, 
    record_flag=138111177, keys=138149596)
    at /scratch/s0198183/src/emacs/src/callint.c:842
	val = 8192
	args = (Lisp_Object *) 0xbff38010
	visargs = (Lisp_Object *) 0xbff37ff0
	specs = 136596851
	filter_specs = 136596851
	teml = 0
	up_event = 138111177
	enable = 138111177
	speccount = 3
	next_event = 3
	prefix_arg = 138111177
	string = (unsigned char *) 0xbff38030 ""
	tem = (unsigned char *) 0xbff38030 ""
	varies = (int *) 0xbff37fd0
	i = 1
	j = 0
	count = 0
	foo = 0
	prompt1 = "\000 ", '\0' <repeats 14 times>, "$\360#\bQ\362;\b\310\177\363\277\311h;\bQ\362;\b\000\000\000\000\000\000\000\000\311h;\b", '\0' <repeats 12 times>, "\311h;\b", '\0' <repeats 12 times>, "Q\362;\b\000\000\000\000\000\000\000\000H\200\363\277\326h\024\b\311h;\b"
	tem1 = 0x0
	arg_from_tty = 0
	gcpro1 = {
  next = 0x0, 
  var = 0x0, 
  nvars = 0
}
	gcpro2 = {
  next = 0x0, 
  var = 0x0, 
  nvars = 0
}
	gcpro3 = {
  next = 0x0, 
  var = 0x0, 
  nvars = 1
}
	gcpro4 = {
  next = 0x0, 
  var = 0x0, 
  nvars = 1
}
	gcpro5 = {
  next = 0x0, 
  var = 0x0, 
  nvars = 0
}
	key_count = 3
	record_then_fail = 0
	save_this_command = 138146385
	save_last_command = 138111177
	save_this_original_command = 138146385
	save_real_this_command = 138146385
#8  0x081b5099 in Ffuncall (nargs=4, args=0xbff38270)
    at /scratch/s0198183/src/emacs/src/eval.c:3031
	fun = 137797484
	original_fun = 138274025
	funcar = 138146385
	numargs = 3
	lisp_numargs = 0
	val = 0
	backtrace = {
  next = 0x0, 
  function = 0xbff38270, 
  args = 0xbff38274, 
  nargs = 3, 
  evalargs = 0 '\0', 
  debug_on_exit = 0 '\0'
}
	internal_args = (Lisp_Object *) 0xbff38274
	i = 0
#9  0x081b4cc0 in call3 (fn=138274025, arg1=138146385, arg2=138111177, 
    arg3=138111177) at /scratch/s0198183/src/emacs/src/eval.c:2855
	ret_ungc_val = 138111177
	gcpro1 = {
  next = 0xbff38268, 
  var = 0x81bd11b, 
  nvars = 4
}
#10 0x08141e1f in Fcommand_execute (cmd=138146385, record_flag=138111177, 
    keys=138111177, special=138111177)
    at /scratch/s0198183/src/emacs/src/keyboard.c:10443
	final = 136572964
	tem = 138111177
	prefixarg = 138111177
#11 0x08134680 in command_loop_1 ()
    at /scratch/s0198183/src/emacs/src/keyboard.c:1908
	scount = 2
	cmd = 138146385
	lose = 335544320
	nonundocount = 0
	keybuf = {192, 424, 384, -1208359664, 8144949, 134535965, 1908692, 
  1910436, 134535965, -1074559928, 1850786, 134523436, 0, -1074560076, 
  -1074560384, 0, 0, 0, 1, 135885289, 148442560, 4443068, -1074559724, 
  -1074560064, 138111177, 143418153, 138421181, 136831556, 0, 0}
	i = 3
	prev_modiff = 1
	prev_buffer = (struct buffer *) 0x83bcdc0
	already_adjusted = 0
#12 0x081b2d90 in internal_condition_case (bfun=0x813306f <command_loop_1>, 
    handlers=138155409, hfun=0x8132a86 <cmd_error>)
    at /scratch/s0198183/src/emacs/src/eval.c:1494
	val = 138421181
	c = {
  tag = 138111177, 
  val = 138111177, 
  next = 0xbff38540, 
  gcpro = 0x0, 
  jmp = {{
      __jmpbuf = {-1074559168, -1074558572, -1074558688, -1074559736, 
        -1074560032, 135998751}, 
      __mask_was_saved = 0, 
      __saved_mask = {
        __val = {0, 0, 0, 0, 0, 0, 4456436, 3220408724, 3220408608, 
          3220407432, 4443187, 29, 3220407600, 3220407456, 3220408128, 
          3220407752, 135587193, 29, 3220407600, 3220407456, 3220407776, 
          3220408724, 3220408608, 3220407624, 135587398, 3220407776, 
          3220407488, 128, 1908692, 0, 0, 3220407368}
      }
    }}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
	h = {
  handler = 138155409, 
  var = 138111177, 
  chosen_clause = 0, 
  tag = 0xbff38420, 
  next = 0x0
}
#13 0x08132dcc in command_loop_2 ()
    at /scratch/s0198183/src/emacs/src/keyboard.c:1370
	val = 0
#14 0x081b2838 in internal_catch (tag=138150257, 
    func=0x8132dae <command_loop_2>, arg=138111177)
    at /scratch/s0198183/src/emacs/src/eval.c:1230
	c = {
  tag = 138150257, 
  val = 138111177, 
  next = 0x0, 
  gcpro = 0x0, 
  jmp = {{
      __jmpbuf = {-1074559168, -1074558572, -1074558688, -1074559464, 
        -1074559696, 135997478}, 
      __mask_was_saved = 0, 
      __saved_mask = {
        __val = {1, 3220407816, 134902851, 138242904, 0, 0, 0, 0, 6727712, 0, 
          0, 0, 2, 0, 0, 0, 22, 176, 6721524, 3220407800, 135913267, 
          138340873, 138337394, 138111177, 138137024, 3220407788, 138111177, 
          3220407800, 138337394, 138337394, 138111177, 3220408608}
      }
    }}, 
  backlist = 0x0, 
  handlerlist = 0x0, 
  lisp_eval_depth = 0, 
  pdlcount = 2, 
  poll_suppress_count = 1, 
  interrupt_input_blocked = 0, 
  byte_stack = 0x0
}
#15 0x08132d80 in command_loop ()
    at /scratch/s0198183/src/emacs/src/keyboard.c:1349
No locals.
#16 0x08132696 in recursive_edit_1 ()
    at /scratch/s0198183/src/emacs/src/keyboard.c:958
	count = 1
	val = 135473178
#17 0x081327fe in Frecursive_edit ()
    at /scratch/s0198183/src/emacs/src/keyboard.c:1020
	count = 0
	buffer = 138111177
#18 0x081310ef in main (argc=5, argv=0xbff38994)
    at /scratch/s0198183/src/emacs/src/emacs.c:1787
	dummy = 6721524
	stack_bottom_variable = 8 '\b'
	do_initial_setlocale = 1
	skip_args = 1
	rlim = {
  rlim_cur = 10485760, 
  rlim_max = 18446744073709551615
}
	no_loadup = 0
	junk = 0x0

Lisp Backtrace:
"delete-frame" (0xbff38014)
"call-interactively" (0xbff38274)



If Emacs crashed, and you have the Emacs process in the gdb debugger,
please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
If you would like to further debug the crash, please read the file
/scratch/s0198183/applications/emacs-trunk/share/emacs/23.0.60/etc/DEBUG for instructions.


In GNU Emacs 23.0.60.5 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2008-03-04 on lamacq.ph.ed.ac.uk
Windowing system distributor `The X.Org Foundation', version 11.0.60802000
configured using `configure  '--prefix=/scratch/s0198183/applications/emacs-trunk/' '--enable-font-backend' '--with-xft' '-C' 'CFLAGS=-ggdb3 -O0''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: en_GB.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default-enable-multibyte-characters: t


Recent input:
M-x r e p o r t - e m <tab> <return>

Re: 23.0.60; Segmentation fault when deleting Emacs frame

[Lawrence Mitchell]

Lawrence Mitchell wrote:
> [I sent the bug a few weeks ago, but didn't get any response.  The
> behaviour hasn't changed so am resending].

> Please describe exactly what actions triggered the bug
> and the precise symptoms of the bug:

> When starting emacs in a terminal and then using emacsclient to create
> an X frame, attempting to delete the X frame causes a segmentation fault
> in FcPatternDestroy() when using the following recipe:

> 1) emacs -Q -nw -fn 'Bitstream Vera Sans Mono-10' -l ~/bug.el

> ;; In another terminal create an X frame
> 2) emacsclient -c

> ;; Delete the frame
> 3) C-x 5 0

> 4) Segmentation fault

> Cheers,

> Lawrence

> Possibly relevant Xresources:

> *font:	-misc-fixed-medium-r-normal-*-16-160-*-*-*-*-iso8859-*
> Emacs.FontBackend:	xft
> Emacs.font:	Bitstream Vera Sans Mono-10
> Xft.antialias:	1
> Xft.dpi:	96.000000
> Xft.hinting:	1
> Xft.hintstyle:	hintmedium
> Xft.rgba:	none

> bug.el:
> ---begin---
> (server-start)

> (custom-set-faces
>  '(default ((t (:family "mono"))))
>  '(bold ((t (:family "mono"))))
>  '(mode-line ((t (:inherit default))))
>  '(mode-line-inactive ((t (:inherit bold)))))
> ---end---

> fontconfig is version 2.2.3


Having recently updated my Emacs (on 2008-07-01), I find that I
can no longer trigger this bug.  It appears it has been fixed
somewhere along the lines.

Cheers,
Lawrence
-- 
Lawrence Mitchell <wence@gmx.li>