bug#29843: 25.3; Emacs crash when running emacsclient

bug#29843: 25.3; Emacs crash when running emacsclient

[Mike Kupfer]

I ran "emacsclient -c" to get a new Emacs frame on a system running MATE
on Debian 9.  IIRC, a new frame appeared for a split second and then
disappeared.  (I'm afraid the crash happened a few days ago and I'm just
now getting to filing the bug report.)  I found a core file; gdb says
there was a segmentation fault.  This is the first and only time I've
seen such a crash.

I'll hold onto the core file for a couple weeks in case there is
additional information to extract from it.

(gdb) bt full
#0  0x00007f0441b83f9f in raise () from /lib/x86_64-linux-gnu/libpthread.so.0
No symbol table info available.
#1  0x00000000004d99d1 in terminate_due_to_signal (sig=sig@entry=11, 
    backtrace_limit=backtrace_limit@entry=40) at emacs.c:381
No locals.
#2  0x00000000004f14ce in handle_fatal_signal (sig=sig@entry=11)
    at sysdep.c:1601
No locals.
#3  0x00000000004f16d9 in deliver_thread_signal (sig=sig@entry=11, 
    handler=0x4f14c0 <handle_fatal_signal>) at sysdep.c:1575
No locals.
#4  0x00000000004f173f in deliver_fatal_thread_signal (sig=11) at sysdep.c:1613
No locals.
#5  handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>)
    at sysdep.c:1695
        fatal = <optimized out>
#6  <signal handler called>
No symbol table info available.
#7  reconsider_clip_changes (w=w@entry=0x3764378) at xdisp.c:13452
No locals.
#8  0x000000000044b755 in redisplay_internal () at xdisp.c:13647
        w = <optimized out>
        sw = <optimized out>
---Type <return> to continue, or q <return> to quit---
        pending = false
        must_finish = <optimized out>
        match_p = <optimized out>
        tlbufpos = <optimized out>
        tlendpos = <optimized out>
        number_of_visible_frames = <optimized out>
        sf = <optimized out>
        polling_stopped_here = <optimized out>
        tail = <optimized out>
        consider_all_windows_p = <optimized out>
        update_miniwindow_p = <optimized out>
#9  0x000000000044db1a in redisplay_preserve_echo_area (
    from_where=from_where@entry=9) at xdisp.c:14324
No locals.
#10 0x0000000000589ba0 in wait_reading_process_output (
    time_limit=time_limit@entry=0, nsecs=nsecs@entry=0, 
    read_kbd=read_kbd@entry=-1, do_display=true, 
    wait_for_cell=wait_for_cell@entry=0, wait_proc=wait_proc@entry=0x0, 
    just_wait_proc=0) at process.c:4613
        old_timers_run = 2340
        old_buffer = 0x2a0bc00
        old_window = 58082173
        process_skipped = false
---Type <return> to continue, or q <return> to quit---
        channel = <optimized out>
        nfds = <optimized out>
        Available = {fds_bits = {0 <repeats 16 times>}}
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = <optimized out>
        check_delay = <optimized out>
        no_avail = <optimized out>
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 100000, tv_nsec = 0}
        end_time = {tv_sec = 36, tv_nsec = 0}
        timer_delay = <optimized out>
        got_output_end_time = {tv_sec = 1513807025, tv_nsec = 488460330}
        wait = INFINITY
        got_some_output = 2013
        now = {tv_sec = 0, tv_nsec = -1}
#11 0x00000000004e45ac in kbd_buffer_get_event (end_time=0x0, 
    used_mouse_menu=0x7ffd8c8436ab, kbp=<synthetic pointer>) at keyboard.c:3824
        do_display = <optimized out>
        obj = <optimized out>
#12 read_event_from_main_queue (used_mouse_menu=0x7ffd8c8436ab, 
    local_getcjmp=0x7ffd8c843330, end_time=0x0) at keyboard.c:2153
        c = 0
---Type <return> to continue, or q <return> to quit---
        save_jump = {{__jmpbuf = {111984640, 1, 13254656, 13259048, 
              140726960924680, 139656238959409, 12125088, 139656238954565}, 
            __mask_was_saved = 1, __saved_mask = {__val = {0, 13254656, 
                6158928815773191936, 3, 13254656, 0, 0, 13254680, 5847931, 
                8194, 0, 0, 0, 0, 0, 0}}}}
        kb = <optimized out>
#13 read_decoded_event_from_main_queue (used_mouse_menu=<optimized out>, 
    prev_event=<optimized out>, local_getcjmp=<optimized out>, 
    end_time=<optimized out>) at keyboard.c:2216
        terminal = <optimized out>
        events = {1, 22512, 0, 5859343, 44088325, 1, 6, 1, 28368, 5882400, 0, 
          0, 28368, 28368, 140726960928000, 140726960927632}
        n = 0
#14 read_char (commandflag=commandflag@entry=1, map=map@entry=54350483, 
    prev_event=0, used_mouse_menu=used_mouse_menu@entry=0x7ffd8c8436ab, 
    end_time=end_time@entry=0x0) at keyboard.c:2804
        c = <optimized out>
        jmpcount = 3
        local_getcjmp = {{__jmpbuf = {12146400, 7691748870007031619, 44088325, 
              13310208, 140726960928672, 54350483, -7690582675852490941, 
              7691750525119891267}, __mask_was_saved = 0, __saved_mask = {
              __val = {44088325, 1, 28368, 0, 0, 12189696, 26976, 
                140726960927952, 5536826, 140726960927744, 5536269, 0, 
---Type <return> to continue, or q <return> to quit---
                4383341, 20815747, 5479950, 140726960927632}}}}
        save_jump = {{__jmpbuf = {111984640, 1, 13254656, 13259048, 
              140726960924680, 139656238959409, 12125088, 139656238954565}, 
            __mask_was_saved = 1, __saved_mask = {__val = {0, 13254656, 
                6158928815773191936, 3, 13254656, 0, 0, 28368, 5878859, 3, 
                140726960927944, 17117824, 1, 5403280, 5479094, 18685328}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0
        also_record = 0
        reread = false
        recorded = false
        polling_stopped_here = true
        orig_kboard = 0xcb1900
#15 0x00000000004e638d in read_key_sequence (
    keybuf=keybuf@entry=0x7ffd8c8437a0, prompt=prompt@entry=0, 
    dont_downcase_last=dont_downcase_last@entry=false, 
    can_return_switch_frame=can_return_switch_frame@entry=true, 
    fix_current_buffer=fix_current_buffer@entry=true, 
    prevent_redisplay=prevent_redisplay@entry=false, bufsize=30)
    at keyboard.c:9068
        interrupted_kboard = 0xcb1900
        interrupted_frame = 0x10eec30
---Type <return> to continue, or q <return> to quit---
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = <optimized out>
        keys_local_start = <optimized out>
        new_binding = <optimized out>
        t = <optimized out>
        echo_start = 0
        keys_start = 0
        current_binding = 54350483
        first_event = 0
        first_unbound = 31
        mock_input = 0
        fkey = {parent = 16864899, map = 16864899, start = 0, end = 0}
        keytran = {parent = 12577347, map = 12577347, start = 0, end = 0}
        indec = {parent = 16864915, map = 16864915, start = 0, end = 0}
        shift_translated = false
        delayed_switch_frame = 0
        original_uppercase = 227
        original_uppercase_position = -1
        dummyflag = false
        fake_prefixed_keys = 0
#16 0x00000000004e7f34 in command_loop_1 () at keyboard.c:1370
---Type <return> to continue, or q <return> to quit---
        cmd = <optimized out>
        keybuf = {98, 214, 194, 5597777, 0, 27312, 12243552, 72704963, 
          140726960928864, 0, 72704963, -1, -1, 5559508, 420992, 72704963, 
          8641764, 0, 140726960928864, 5105722, 140726960928864, 0, 0, 
          5106039, 17664, 6194144, 96, 5547969, 42585235, 0}
        i = <optimized out>
        prev_modiff = 227
        prev_buffer = 0x6c06000
#17 0x000000000054a302 in internal_condition_case (
    bfun=bfun@entry=0x4e7d20 <command_loop_1>, handlers=handlers@entry=17904, 
    hfun=hfun@entry=0x4de870 <cmd_error>) at eval.c:1315
        val = <optimized out>
        c = <optimized out>
#18 0x00000000004d9e54 in command_loop_2 (ignore=ignore@entry=0)
    at keyboard.c:1112
        val = 0
#19 0x000000000054a2a3 in internal_catch (tag=tag@entry=44736, 
    func=func@entry=0x4d9e30 <command_loop_2>, arg=arg@entry=0) at eval.c:1080
        val = <optimized out>
        c = <optimized out>
#20 0x00000000004d9e10 in command_loop () at keyboard.c:1091
No locals.
#21 0x00000000004de457 in recursive_edit_1 () at keyboard.c:697
---Type <return> to continue, or q <return> to quit---
        val = <optimized out>
#22 0x00000000004de7b8 in Frecursive_edit () at keyboard.c:768
        buffer = <optimized out>
#23 0x000000000040fc5f in main (argc=<optimized out>, argv=0x7ffd8c843b08)
    at emacs.c:1629
        dummy = 140726960929256
        stack_bottom_variable = -116 '\214'
        do_initial_setlocale = <optimized out>
        dumping = <optimized out>
        skip_args = 0
        rlim = {rlim_cur = 8720000, rlim_max = 18446744073709551615}
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
(gdb) xbacktrace
Undefined command: "xbacktrace".  Try "help".
(gdb) 


In GNU Emacs 25.3.3 (x86_64-pc-linux-gnu, X toolkit, Xaw scroll bars)
 of 2017-11-24 built on alto
Windowing system distributor 'The X.Org Foundation', version 11.0.11902000
System Description:	Debian GNU/Linux 9.3 (stretch)

Configured features:
XPM JPEG TIFF GIF PNG SOUND NOTIFY GNUTLS LIBXML2 FREETYPE XFT ZLIB
TOOLKIT_SCROLL_BARS LUCID X11

Important settings:
  value of $LC_TIME: C
  value of $LANG: en_US.utf8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  shell-dirtrack-mode: t
  delete-selection-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  transient-mark-mode: t

Recent messages:
No current message
No more undeleted messages
Processing deletes and refiles for +inbox...done
No current message
When done with a buffer, type C-x #
Mark saved where search started [2 times]
fetchmail: background fetchmail at 2473 awakened.
Scanning +inbox...done
No messages in +inbox, range (all)
When done with this frame, type C-x 5 0

Load-path shadows:
None found.

Features:
(shadow emacsbug ispell gnus-fun mh-limit wdired grep compile
mh-identity mh-letter mh-alias crm mh-thread shr-color color mh-funcs
mh-search dired-aux dired-x mh-mime mh-show goto-addr thingatpt misearch
multi-isearch skeleton sgml-mode calc-alg calc-ext calc-menu calc
calc-loaddefs calc-macs vc-hg diary-lib diary-loaddefs cal-move
org-element org-rmail org-mhe org-irc org-info org-gnus org-docview
doc-view jka-compr image-mode org-bibtex bibtex org-bbdb org-w3m org
org-macro org-footnote org-pcomplete org-list org-faces org-entities
org-version ob-emacs-lisp ob ob-tangle ob-ref ob-lob ob-table ob-exp
org-src ob-keys ob-comint ob-core ob-eval org-compat org-macs
org-loaddefs find-func cal-menu calendar cal-loaddefs mh-inc hl-line
mh-tool-bar mh-seq mh-folder which-func imenu shr seq dom subr-x
browse-url pp mh-xface mh-utils gnus-mh mh-comp mh-scan mh-gnus mh-acros
cl mh-e mh-compat mh-buffers mh-loaddefs sort gnus-cite flow-fill
mail-extr gnus-async gnus-bcklg gnus-kill qp gnus-ml disp-table
mm-archive url-http url-gw url-cache url-auth url-handlers nnrss xml
mm-url url url-proxy url-privacy url-expand url-methods url-history
url-cookie url-domsuf url-util url-parse url-vars nndoc nndraft nnmh
network-stream nsm starttls gnus-agent gnus-srvr gnus-score score-mode
nnvirtual gnus-msg gnus-art mm-uu mml2015 mm-view mml-smime smime dig
mailcap nntp gnus-cache gnus-sum gnus-group gnus-undo gnus-start
gnus-cloud nnimap nnmail mail-source tls gnutls utf7 netrc nnoo
parse-time gnus-spec gnus-int gnus-range gnus-win gnus gnus-ems nnheader
wid-edit mdk-mail smtpmail auth-source cl-seq eieio byte-opt bytecomp
byte-compile cl-extra cconv eieio-core cl-macs gv sendmail message dired
format-spec rfc822 mml mml-sec password-cache epg epg-config gnus-util
mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045
ietf-drums mm-util help-fns help-mode mail-prsvr mailabbrev mail-utils
gmm-utils mailheader server noutline outline easy-mmode cc-mode cc-fonts
cc-guess cc-menus cc-cmds cc-styles cc-align cc-engine cc-vars cc-defs
shell pcomplete comint ansi-color ring xcscope easymenu advice delsel vc
cl-loaddefs pcase cl-lib vc-dispatcher timeclock mdk-hacks time-date
mule-util tooltip eldoc electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel x-win term/common-win x-dnd tool-bar dnd fontset
image regexp-opt fringe tabulated-list newcomment elisp-mode lisp-mode
prog-mode register page menu-bar rfn-eshadow timer select scroll-bar
mouse jit-lock font-lock syntax facemenu font-core frame cl-generic cham
georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese eucjp-ms cp51932 hebrew greek romanian slovak czech
european ethiopic indian cyrillic chinese charscript case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer cl-preloaded nadvice
loaddefs button faces cus-face macroexp files text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote inotify dynamic-setting
font-render-setting x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 436498 59278)
 (symbols 48 48971 439)
 (miscs 40 1179 1618)
 (strings 32 107096 17586)
 (string-bytes 1 3380995)
 (vectors 16 49112)
 (vector-slots 8 1688850 220616)
 (floats 8 777 714)
 (intervals 56 13824 1147)
 (buffers 976 99))

bug#29843: 25.3; Emacs crash when running emacsclient

[Eli Zaretskii]

> From: Mike Kupfer <mkupfer@alum.berkeley.edu>
> Date: Sun, 24 Dec 2017 12:29:06 -0800
> 
> I ran "emacsclient -c" to get a new Emacs frame on a system running MATE
> on Debian 9.  IIRC, a new frame appeared for a split second and then
> disappeared.  (I'm afraid the crash happened a few days ago and I'm just
> now getting to filing the bug report.)  I found a core file; gdb says
> there was a segmentation fault.  This is the first and only time I've
> seen such a crash.
> 
> I'll hold onto the core file for a couple weeks in case there is
> additional information to extract from it.
> 
> (gdb) bt full
> #0  0x00007f0441b83f9f in raise () from /lib/x86_64-linux-gnu/libpthread.so.0
> No symbol table info available.
> #1  0x00000000004d99d1 in terminate_due_to_signal (sig=sig@entry=11, 
>     backtrace_limit=backtrace_limit@entry=40) at emacs.c:381
> No locals.
> #2  0x00000000004f14ce in handle_fatal_signal (sig=sig@entry=11)
>     at sysdep.c:1601
> No locals.
> #3  0x00000000004f16d9 in deliver_thread_signal (sig=sig@entry=11, 
>     handler=0x4f14c0 <handle_fatal_signal>) at sysdep.c:1575
> No locals.
> #4  0x00000000004f173f in deliver_fatal_thread_signal (sig=11) at sysdep.c:1613
> No locals.
> #5  handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>)
>     at sysdep.c:1695
>         fatal = <optimized out>
> #6  <signal handler called>
> No symbol table info available.
> #7  reconsider_clip_changes (w=w@entry=0x3764378) at xdisp.c:13452

This segfault is here:

  static void
  reconsider_clip_changes (struct window *w)
  {
    struct buffer *b = XBUFFER (w->contents);

    if (b->clip_changed
	&& w->window_end_valid
	&& w->current_matrix->buffer == b
	&& w->current_matrix->zv == BUF_ZV (b)
	&& w->current_matrix->begv == BUF_BEGV (b))   <<<<<<<<<<<<<<<<<<
      b->clip_changed = false;

So either w or b is a NULL or garbled pointer.  Can you tell which
one?  (Let me know if you need help with GDB commands to do that.)

Thanks.

bug#29843: 25.3; Emacs crash when running emacsclient

[Mike Kupfer]

Eli Zaretskii wrote:

> This segfault is here:
> 
>   static void
>   reconsider_clip_changes (struct window *w)
>   {
>     struct buffer *b = XBUFFER (w->contents);
> 
>     if (b->clip_changed
> 	&& w->window_end_valid
> 	&& w->current_matrix->buffer == b
> 	&& w->current_matrix->zv == BUF_ZV (b)
> 	&& w->current_matrix->begv == BUF_BEGV (b))   <<<<<<<<<<<<<<<<<<
>       b->clip_changed = false;
> 
> So either w or b is a NULL or garbled pointer.  Can you tell which
> one?  (Let me know if you need help with GDB commands to do that.)

Hmm, I'm guessing that b is null.  w->contents is zero, but I'm having
some trouble figuring out what XBUFFER(0) would return, and gdb won't
display b directly.  I can't tell if w is garbled.

(gdb) up 7
#7  reconsider_clip_changes (w=w@entry=0x3764378) at xdisp.c:13452
13452	  if (b->clip_changed
(gdb) print w
$1 = (struct window *) 0x3764378
(gdb) print *w
$2 = {header = {size = 4611686018494648343}, frame = 58081653, 
  next = 58082661, prev = 0, parent = 0, normal_lines = 72039007, 
  normal_cols = 72038999, new_total = 2, new_normal = 2, new_pixel = 2, 
  contents = 0, start = 55248673, pointm = 55248593, old_pointm = 55248553, 
  temslot = 0, vertical_scroll_bar = 0, vertical_scroll_bar_type = 43344, 
  horizontal_scroll_bar = 0, horizontal_scroll_bar_type = 43344, 
  display_table = 0, dedicated = 0, redisplay_end_trigger = 0, 
  combination_limit = 112076805, window_parameters = 0, current_matrix = 0x0, 
  desired_matrix = 0x0, prev_buffers = 115608467, next_buffers = 0, 
  use_time = 2567, sequence_number = 151, pixel_left = 0, pixel_top = 0, 
  left_col = 0, top_line = 0, pixel_width = 672, pixel_height = 560, 
  total_cols = 84, total_lines = 35, hscroll = 0, min_hscroll = 0, 
  hscroll_whole = 0, last_modified = 98, last_overlay_modified = 35, 
  last_point = 1, base_line_number = 0, base_line_pos = 0, 
  column_number_displayed = -1, nrows_scale_factor = 1, 
  ncols_scale_factor = 1, cursor = {x = 0, y = 0, hpos = 0, vpos = 0}, 
  phys_cursor = {x = 0, y = 0, hpos = 0, vpos = 0}, output_cursor = {x = 0, 
    y = 0, hpos = 0, vpos = 0}, last_cursor_vpos = 0, 
  phys_cursor_type = NO_CURSOR, phys_cursor_width = -1, 
  phys_cursor_ascent = 0, phys_cursor_height = 0, left_fringe_width = -1, 
  right_fringe_width = -1, left_margin_cols = 0, right_margin_cols = 0, 
  scroll_bar_width = -1, scroll_bar_height = -1, mode_line_height = 16, 
  header_line_height = -1, window_end_pos = 0, window_end_vpos = 14, 
  mini = false, horizontal = false, update_mode_line = false, 
  last_had_star = false, start_at_line_beg = true, force_start = false, 
  optional_new_start = false, phys_cursor_on_p = false, cursor_off_p = false, 
  last_cursor_off_p = false, must_be_updated_p = false, 
  pseudo_window_p = false, fringes_outside_margins = false, 
  window_end_valid = false, redisplay = true, suspend_auto_hscroll = false, 
  vscroll = 0, window_end_bytepos = 0}
(gdb) print b
$3 = <optimized out>
(gdb) print w.contents
$4 = 0
[...]
(gdb) print w.window_end_valid
$6 = false
(gdb) print w.current_matrix
$7 = (struct glyph_matrix *) 0x0
(gdb) print /x w.header.size
$8 = 0x4000000004025017

mike

bug#29843: 25.3; Emacs crash when running emacsclient

[Eli Zaretskii]

> From: Mike Kupfer <mkupfer@alum.berkeley.edu>
> cc: 29843@debbugs.gnu.org
> Date: Mon, 25 Dec 2017 10:22:16 -0800
> 
> >   static void
> >   reconsider_clip_changes (struct window *w)
> >   {
> >     struct buffer *b = XBUFFER (w->contents);
> > 
> >     if (b->clip_changed
> > 	&& w->window_end_valid
> > 	&& w->current_matrix->buffer == b
> > 	&& w->current_matrix->zv == BUF_ZV (b)
> > 	&& w->current_matrix->begv == BUF_BEGV (b))   <<<<<<<<<<<<<<<<<<
> >       b->clip_changed = false;
> > 
> > So either w or b is a NULL or garbled pointer.  Can you tell which
> > one?  (Let me know if you need help with GDB commands to do that.)
> 
> Hmm, I'm guessing that b is null.  w->contents is zero

Zero means w->contents is nil, which means this window is not a live
window.  But I don't understand how that could happen, since that's
supposed to be the selected window.

Did Emacs do something in the background when this happened?  Some
timer or perhaps some process filter or sentinel?  Or maybe some hook
that runs when a client frame opens?  Otherwise I don't understand how
come that window got deleted.

bug#29843: 25.3; Emacs crash when running emacsclient

[Mike Kupfer]

Eli Zaretskii wrote:

> Zero means w->contents is nil, which means this window is not a live
> window.  But I don't understand how that could happen, since that's
> supposed to be the selected window.
> 
> Did Emacs do something in the background when this happened?  Some
> timer or perhaps some process filter or sentinel?  Or maybe some hook
> that runs when a client frame opens?  Otherwise I don't understand how
> come that window got deleted.

I don't think I have any hooks that would run when the client frame
opens.

I didn't notice anything going on in the background.  I probably had an
asynchronous shell command running ("tail -f /var/log/syslog"), though I
don't understand why that could cause a window to be deleted.

If something like this happens again, I'll look more closely at what
Emacs might have been doing at the time of the crash.

thanks,
mike

bug#29843: 25.3; Emacs crash when running emacsclient

[Mike Kupfer]

I don't know if this is related to the crash, but this morning when I
ran "emacsclient -c", a frame appeared for a split second and then
disappeared again.  Emacs did not crash.  I reran "emacsclient -c" and
got a new frame which stayed open.  I looked in *Messages*, and the last
few lines were

  Processing deletes and refiles for +inbox...done
  No current message
  When done with this frame, type C-x 5 0
  X protocol error: BadPixmap (invalid Pixmap parameter) on protocol request 55
  When done with this frame, type C-x 5 0 [2 times]

regards,
mike

bug#29843: 25.3; Emacs crash when running emacsclient

[Eli Zaretskii]

> From: Mike Kupfer <mkupfer@alum.berkeley.edu>
> cc: Eli Zaretskii <eliz@gnu.org>
> Date: Tue, 26 Dec 2017 10:02:58 -0800
> 
> I don't know if this is related to the crash, but this morning when I
> ran "emacsclient -c", a frame appeared for a split second and then
> disappeared again.  Emacs did not crash.  I reran "emacsclient -c" and
> got a new frame which stayed open.  I looked in *Messages*, and the last
> few lines were
> 
>   Processing deletes and refiles for +inbox...done
>   No current message
>   When done with this frame, type C-x 5 0
>   X protocol error: BadPixmap (invalid Pixmap parameter) on protocol request 55
>   When done with this frame, type C-x 5 0 [2 times]

Sounds like bug#27816, which I hope is fixed in Emacs 26.

bug#29843: 25.3; Emacs crash when running emacsclient

[Mike Kupfer]

>>   Processing deletes and refiles for +inbox...done
>>   No current message
>>   When done with this frame, type C-x 5 0
>>   X protocol error: BadPixmap (invalid Pixmap parameter) on protocol request 55
>>   When done with this frame, type C-x 5 0 [2 times]

> Sounds like bug#27816, which I hope is fixed in Emacs 26.

I don't think I've seen this crash since I upgraded to Emacs 26.  I
certainly can't remember the last time I saw it, so I'm going to go
ahead and close this bug.

cheers,
mike