bug#5837: 23.1.95; Nextstep emacs -nw segfaults on startup in ns_set_doc_edited

bug#5837: 23.1.95; Nextstep emacs -nw segfaults on startup in ns_set_doc_edited

[Steve Revilak]

[-- Attachment #1: Type: text/plain, Size: 7135 bytes --]

This bug report will be sent to the Free Software Foundation,
not to your local site managers!
Please write in English if possible, because the Emacs maintainers
usually do not have translators to read other languages for them.

                                 * * *

I've just built emacs 23.1.95 on two Mac OS X systems; one Mac OS
10.6.2 (x86_64), and one Mac OS 10.4.11 (PPC G5).  On both systems
"emacs -nw" segfaults on startup.  The segfault happens so early that
I cannot use M-x report-emacs-bug on the affected systems.

When I run emacs as a windowed application (without "-nw"), then there
is no segfault.

Emacs was configured as "./configure --with-ns".

I've looked through the emacs-devel archive, and found one thread that
discusses a similar crash:

   http://lists.gnu.org/archive/html/emacs-devel/2010-04/msg00075.html

In my case, the crash happens in a different place (ns_set_doc_edited,
as opposed to alloc.c).

Here is a gdb session + backtrace taken Mac OS X 10.6.2.  The gdb
session shows emacs being started with "-nw -Q".  The presence (or
absense) of "-Q" doesn't seem to change the segfault behavior.

------------------------------------------------------------------
(0:0)oatmeal:bin$ gdb /Applications/Emacs.app/Contents/MacOS/Emacs
GNU gdb 6.3.50-20050815 (Apple version gdb-1346) (Fri Sep 18 20:40:51 UTC 2009)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin"...
Reading symbols for shared libraries ......... done

(gdb) set args -Q -nw
(gdb) run
Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
0x0000000100178b46 in ns_set_doc_edited (f=0x101506f08, arg=4320133130) at nsfns.m:691
691       NSView *view = FRAME_NS_VIEW (f);


(gdb) bt
#0  0x0000000100178b46 in ns_set_doc_edited (f=0x101506f08, arg=4320133130) at nsfns.m:691
#1  0x0000000100037e3c in prepare_menu_bars () at xdisp.c:9574
#2  0x000000010004140a in redisplay_internal (preserve_echo_area=<value temporarily unavailable, due to optimizations>) at xdisp.c:11430
#3  0x000000010009e81e in read_char (commandflag=1, nmaps=2, maps=0x7fff5fbfed00, prev_event=4320133130, used_mouse_menu=0x7fff5fbfee44, end_time=0x0) at keyboard.c:2727
#4  0x00000001000a0faf in read_key_sequence (keybuf=0x7fff5fbfeee0, bufsize=30, prompt=4320133130, dont_downcase_last=0, can_return_switch_frame=1, fix_current_buffer=1) at keyboard.c:9512
#5  0x00000001000a352b in command_loop_1 () at keyboard.c:1643
#6  0x0000000100107637 in internal_condition_case (bfun=0x1000a32e0 <command_loop_1>, handlers=4320204170, hfun=0x10009b580 <cmd_error>) at eval.c:1490
#7  0x000000010009a907 in command_loop_2 () at keyboard.c:1360
#8  0x0000000100107740 in internal_catch (tag=<value temporarily unavailable, due to optimizations>, func=0x10009a8d0 <command_loop_2>, arg=4320133130) at eval.c:1226
#9  0x000000010009b396 in command_loop () at keyboard.c:1339
#10 0x000000010009b7ff in recursive_edit_1 () at keyboard.c:954
#11 0x000000010009b99f in Frecursive_edit () at keyboard.c:1016
#12 0x0000000100090f87 in main (argc=3, argv=0x7fff5fbff4b8) at emacs.c:1833
Current language:  auto; currently objective-c

(gdb) p view
$2 = <variable optimized away by compiler>
(gdb) p *view
Cannot access memory at address 0x0


(gdb) p *f
$3 = {
   size = 4611686018427388949,
   next = 0x1015067e8,
   name = 4296987921,
   icon_name = 4320133130,
   title = 4320133130,
   focus_frame = 4320133130,
   root_window = 4317016477,
   selected_window = 4317016477,
   minibuffer_window = 4317017085,
   param_alist = 4345638054,
   scroll_bars = 4320133130,
   condemned_scroll_bars = 4320133130,
   menu_bar_items = 4303773861,
   face_alist = 4323932566,
   menu_bar_vector = 4320133130,
   buffer_predicate = 4320133130,
   buffer_list = 4320157334,
   buried_buffer_list = 4320133130,
   menu_bar_window = 4320133130,
   tool_bar_window = 4320133130,
   tool_bar_items = 4320133130,
   desired_tool_bar_string = 4320133130,
   current_tool_bar_string = 4320133130,
   face_cache = 0x101555108,
   menu_bar_items_used = 0,
   namebuf = 0x0,
   current_pool = 0x10080c9f0,
   desired_pool = 0x10080c9d0,
   desired_matrix = 0x10080ca10,
   current_matrix = 0x10080cc70,
   glyphs_initialized_p = 1,
   resized_p = 0,
   force_flush_display_p = 1,
   default_face_done_p = 0,
   already_hscrolled_p = 0,
   updated_p = 0,
   minimize_tool_bar_window_p = 0,
   external_tool_bar = 0,
   tool_bar_lines = 0,
   n_tool_bar_rows = 0,
   n_tool_bar_items = 0,
   decode_mode_spec_buffer = 0x10080db90 '-' <repeats 200 times>...,
   insert_line_cost = 0x10080e010,
   delete_line_cost = 0x10080e220,
   insert_n_lines_cost = 0x10080e170,
   delete_n_lines_cost = 0x10080e0c0,
   text_lines = 43,
   text_cols = 95,
   total_lines = 0,
   total_cols = 95,
   new_text_lines = 0,
   new_text_cols = 0,
   left_pos = 0,
   top_pos = 0,
   pixel_height = 0,
   pixel_width = 0,
   resx = 0,
   resy = 0,
   x_pixels_diff = 0,
   y_pixels_diff = 0,
   win_gravity = 0,
   size_hint_flags = 0,
   border_width = 0,
   internal_border_width = 0,
   column_width = 1,
   space_width = 0,
   line_height = 1,
   output_method = output_termcap,
   terminal = 0x10080b250,
   output_data = {
     tty = 0x0,
     x = 0x0,
     w32 = 0x0,
     ns = 0x0,
     nothing = 0
   },
   font_driver_list = 0x0,
   font_data_list = 0x0,
   fringe_cols = 0,
   left_fringe_width = 0,
   right_fringe_width = 0,
   want_fullscreen = FULLSCREEN_NONE,
   menu_bar_lines = 1,
   external_menu_bar = 0,
   display_preempted = 0 '\000',
   visible = 1 '\001',
   iconified = 0 '\000',
   async_visible = 1 '\001',
   async_iconified = 0 '\000',
   garbaged = 0 '\000',
   has_minibuffer = 1 '\001',
   wants_modeline = 1 '\001',
   can_have_scroll_bars = 0 '\000',
   auto_raise = 0 '\000',
   auto_lower = 0 '\000',
   no_split = 0 '\000',
   explicit_name = 0 '\000',
   window_sizes_changed = 0 '\000',
   mouse_moved = 0 '\000',
   pointer_invisible = 0 '\000',
   vertical_scroll_bar_type = vertical_scroll_bar_none,
   desired_cursor = FILLED_BOX_CURSOR,
   cursor_width = 0,
   blink_off_cursor = FILLED_BOX_CURSOR,
   blink_off_cursor_width = 0,
   message_buf = 0x10080da10 "",
   scroll_bottom_vpos = 0,
   config_scroll_bar_width = 0,
   config_scroll_bar_cols = 0,
   scroll_bar_actual_width = 0,
   cost_calculation_baud_rate = 9600,
   alpha = {0, 0},
   gamma = 0,
   extra_line_spacing = 0,
   background_pixel = 18446744073709551613,
   foreground_pixel = 18446744073709551614
}


(0:0)oatmeal:~$ uname -a
Darwin oatmeal 10.2.0 Darwin Kernel Version 10.2.0: Tue Nov  3 10:37:10 PST 2009; root:xnu-1486.2.11~1/RELEASE_I386 i386

(0:0)oatmeal:~$ sw_vers
ProductName:    Mac OS X
ProductVersion: 10.6.2
BuildVersion:   10C540

------------------------------------------------------------------

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]

bug#5837: 23.1.95; Nextstep emacs -nw segfaults on startup in ns_set_doc_edited

[Chong Yidong]

Steve Revilak <steve@srevilak.net> writes:

> I've just built emacs 23.1.95 on two Mac OS X systems; one Mac OS
> 10.6.2 (x86_64), and one Mac OS 10.4.11 (PPC G5).  On both systems
> "emacs -nw" segfaults on startup.  The segfault happens so early that
> I cannot use M-x report-emacs-bug on the affected systems.
>
> When I run emacs as a windowed application (without "-nw"), then there
> is no segfault.

Thanks for the bug report.  Does the following patch fix the problem?

=== modified file 'src/xdisp.c'
*** src/xdisp.c	2010-03-30 17:26:58 +0000
--- src/xdisp.c	2010-04-05 14:05:48 +0000
***************
*** 9570,9576 ****
  	  update_tool_bar (f, 0);
  #endif
  #ifdef HAVE_NS
!           if (windows_or_buffers_changed)
              ns_set_doc_edited (f, Fbuffer_modified_p
  			       (XWINDOW (f->selected_window)->buffer));
  #endif
--- 9570,9577 ----
  	  update_tool_bar (f, 0);
  #endif
  #ifdef HAVE_NS
!           if (windows_or_buffers_changed
! 	      && FRAME_NS_P (f))
              ns_set_doc_edited (f, Fbuffer_modified_p
  			       (XWINDOW (f->selected_window)->buffer));
  #endif

bug#5837: 23.1.95; Nextstep emacs -nw segfaults on startup in ns_set_doc_edited

[Eli Zaretskii]

> Date: Mon, 5 Apr 2010 09:48:31 -0400
> From: Steve Revilak <steve@srevilak.net>
> Cc: 
> 
> I've just built emacs 23.1.95 on two Mac OS X systems; one Mac OS
> 10.6.2 (x86_64), and one Mac OS 10.4.11 (PPC G5).  On both systems
> "emacs -nw" segfaults on startup.  The segfault happens so early that
> I cannot use M-x report-emacs-bug on the affected systems.
> 
> When I run emacs as a windowed application (without "-nw"), then there
> is no segfault.
> 
> Emacs was configured as "./configure --with-ns".
> 
> I've looked through the emacs-devel archive, and found one thread that
> discusses a similar crash:
> 
>    http://lists.gnu.org/archive/html/emacs-devel/2010-04/msg00075.html
> 
> In my case, the crash happens in a different place (ns_set_doc_edited,
> as opposed to alloc.c).

That crash is different, I think: it's in a middle of GC, and in a
general area of Emacs code.  Your crash is in NS-specific code.

But it looks very similar, if not identical, to bug#5834.

bug#5837: 23.1.95; Nextstep emacs -nw segfaults on startup in ns_set_doc_edited

[Steve Revilak]

[-- Attachment #1: Type: text/plain, Size: 177 bytes --]

>Thanks for the bug report.  Does the following patch fix the problem?

Chong,

Thanks for the patch.  This fixes the crash on both Mac OS X 10.4.11
and Mac OS X 10.6.2.

Steve

[-- Attachment #2: Type: application/pgp-signature, Size: 198 bytes --]