bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Vincent Lefevre]

Usually a middle-click pastes the PRIMARY selection, but sometimes
it pastes something else. I don't know how to reproduce this bug,
but it occurred several times in the last two hours.



In GNU Emacs 24.4.1 (x86_64-pc-linux-gnu, GTK+ Version 3.14.3)
 of 2014-10-25 on trouble, modified by Debian
Windowing system distributor `The X.Org Foundation', version 11.0.11601000
System Description:	Debian GNU/Linux unstable (sid)

Configured using:
 `configure --build x86_64-linux-gnu --prefix=/usr
 --sharedstatedir=/var/lib --libexecdir=/usr/lib
 --localstatedir=/var/lib --infodir=/usr/share/info
 --mandir=/usr/share/man --with-pop=yes
 --enable-locallisppath=/etc/emacs24:/etc/emacs:/usr/local/share/emacs/24.4/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/24.4/site-lisp:/usr/share/emacs/site-lisp
 --build x86_64-linux-gnu --prefix=/usr --sharedstatedir=/var/lib
 --libexecdir=/usr/lib --localstatedir=/var/lib
 --infodir=/usr/share/info --mandir=/usr/share/man --with-pop=yes
 --enable-locallisppath=/etc/emacs24:/etc/emacs:/usr/local/share/emacs/24.4/site-lisp:/usr/local/share/emacs/site-lisp:/usr/share/emacs/24.4/site-lisp:/usr/share/emacs/site-lisp
 --with-x=yes --with-x-toolkit=gtk3 --with-toolkit-scroll-bars
 'CFLAGS=-g -O2 -fstack-protector-strong -Wformat
 -Werror=format-security -Wall' CPPFLAGS=-D_FORTIFY_SOURCE=2
 LDFLAGS=-Wl,-z,relro'

Important settings:
  value of $LC_COLLATE: POSIX
  value of $LC_CTYPE: en_US.UTF-8
  value of $LC_TIME: en_DK
  value of $LANG: POSIX
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  display-time-mode: t
  show-paren-mode: t
  tooltip-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
<escape> x r e p o r t - b u <tab> <return>

Recent messages:
Loading cjk-enc...done
Loading /etc/emacs/site-start.d/50latex-cjk-common.el (source)...done
Loading /etc/emacs/site-start.d/50latex-cjk-thai.el (source)...done
Loading /etc/emacs/site-start.d/50psvn.el (source)...done
Loading /etc/emacs/site-start.d/50python-docutils.el (source)...done
Loading /etc/emacs/site-start.d/50rnc-mode.el (source)...done
Loading /etc/emacs/site-start.d/50w3m-el.el (source)...done
Loading /home/vinc17/share/emacs/site-lisp/mutteditor.el (source)...done
Loading time...done
For information about GNU Emacs and the GNU system, type C-h C-a.

Load-path shadows:
/usr/share/emacs24/site-lisp/css-mode/css-mode hides /usr/share/emacs/site-lisp/css-mode/css-mode
/usr/share/emacs/24.4/site-lisp/debian-startup hides /usr/share/emacs/site-lisp/debian-startup
/usr/share/emacs/site-lisp/autoconf/autotest-mode hides /usr/share/emacs/site-lisp/autotest-mode
/usr/share/emacs24/site-lisp/cmake-data/cmake-mode hides /usr/share/emacs/site-lisp/cmake-mode
/usr/share/emacs24/site-lisp/html-helper-mode/tempo hides /usr/share/emacs/24.4/lisp/tempo
/usr/share/emacs24/site-lisp/flim/hex-util hides /usr/share/emacs/24.4/lisp/hex-util
/usr/share/emacs24/site-lisp/flim/md4 hides /usr/share/emacs/24.4/lisp/md4
/usr/share/emacs24/site-lisp/dictionaries-common/flyspell hides /usr/share/emacs/24.4/lisp/textmodes/flyspell
/usr/share/emacs24/site-lisp/dictionaries-common/ispell hides /usr/share/emacs/24.4/lisp/textmodes/ispell
/usr/share/emacs/site-lisp/rst hides /usr/share/emacs/24.4/lisp/textmodes/rst
/usr/share/emacs24/site-lisp/css-mode/css-mode hides /usr/share/emacs/24.4/lisp/textmodes/css-mode
/usr/share/emacs24/site-lisp/flim/hmac-md5 hides /usr/share/emacs/24.4/lisp/net/hmac-md5
/usr/share/emacs24/site-lisp/flim/sasl-ntlm hides /usr/share/emacs/24.4/lisp/net/sasl-ntlm
/usr/share/emacs24/site-lisp/flim/sasl-cram hides /usr/share/emacs/24.4/lisp/net/sasl-cram
/usr/share/emacs24/site-lisp/flim/ntlm hides /usr/share/emacs/24.4/lisp/net/ntlm
/usr/share/emacs24/site-lisp/flim/sasl hides /usr/share/emacs/24.4/lisp/net/sasl
/usr/share/emacs24/site-lisp/flim/hmac-def hides /usr/share/emacs/24.4/lisp/net/hmac-def
/usr/share/emacs24/site-lisp/flim/sasl-digest hides /usr/share/emacs/24.4/lisp/net/sasl-digest
/usr/share/emacs24/site-lisp/latex-cjk-thai/thai-word hides /usr/share/emacs/24.4/lisp/language/thai-word
/usr/share/emacs24/site-lisp/html-helper-mode/html-helper-mode hides /usr/share/emacs/site-lisp/html-helper-mode/html-helper-mode
/usr/share/emacs24/site-lisp/html-helper-mode/hhm-config hides /usr/share/emacs/site-lisp/html-helper-mode/hhm-config
/usr/share/emacs24/site-lisp/html-helper-mode/tempo hides /usr/share/emacs/site-lisp/html-helper-mode/tempo
/usr/share/emacs24/site-lisp/html-helper-mode/visual-basic-mode hides /usr/share/emacs/site-lisp/html-helper-mode/visual-basic-mode

Features:
(shadow sort gnus-util mail-extr warnings emacsbug message format-spec
rfc822 mml easymenu mml-sec mm-decode mm-bodies mm-encode mail-parse
rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047 rfc2045
ietf-drums mm-util help-fns mail-prsvr mail-utils time cus-start
cus-load paren cc-styles cc-align cc-engine cc-vars cc-defs w3m-load
jabber-autoloads time-date tooltip electric uniquify ediff-hook vc-hooks
lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image regexp-opt
fringe tabulated-list newcomment lisp-mode prog-mode register page
menu-bar rfn-eshadow timer select scroll-bar mouse jit-lock font-lock
syntax facemenu font-core frame cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese hebrew greek
romanian slovak czech european ethiopic indian cyrillic chinese
case-table epa-hook jka-cmpr-hook help simple abbrev minibuffer nadvice
loaddefs button faces cus-face macroexp files text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process dbusbind
gfilenotify dynamic-setting system-font-setting font-render-setting
move-toolbar gtk x-toolkit x multi-tty emacs)

Memory information:
((conses 16 91698 6613)
 (symbols 48 20147 0)
 (miscs 40 92 97)
 (strings 32 15288 4583)
 (string-bytes 1 446909)
 (vectors 16 9914)
 (vector-slots 8 393330 6872)
 (floats 8 69 217)
 (intervals 56 233 0)
 (buffers 960 12)
 (heap 1024 24993 1000))

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Vincent Lefevre]

On 2014-11-03 21:56:44 +0100, Vincent Lefevre wrote:
> Usually a middle-click pastes the PRIMARY selection, but sometimes
> it pastes something else. I don't know how to reproduce this bug,
> but it occurred several times in the last two hours.

It occurred again. This time I did the following:

1. Middle-click. The correct PRIMARY selection was pasted.
2. Left-click to another position (in the same buffer).
3. Middle-click. But something else was pasted!

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Vincent Lefevre]

This occurs very often, and I've finally managed to find a way to
reproduce the bug:

1. Open a file containing a line, say "foo", with "emacs -Q".

2. When the cursor is at the beginning, type C-k.

3. Select text in some other window.

4. Left-click in the initial Emacs window.

5. Middle-click in the initial Emacs window.

Instead of pasting the selected text, this pastes what was cut
with C-k.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Vincent Lefevre]

retitle 18939 24.4; a left-click in Emacs sometimes modifies the PRIMARY selection
thanks

On 2014-12-28 16:03:00 +0100, Vincent Lefevre wrote:
> This occurs very often, and I've finally managed to find a way to
> reproduce the bug:
> 
> 1. Open a file containing a line, say "foo", with "emacs -Q".
> 
> 2. When the cursor is at the beginning, type C-k.
> 
> 3. Select text in some other window.
> 
> 4. Left-click in the initial Emacs window.
> 
> 5. Middle-click in the initial Emacs window.
> 
> Instead of pasting the selected text, this pastes what was cut
> with C-k.

Note: in 5, the middle-click can also be done in an xterm, with the
same problem. What actually occurred is that in 4, the PRIMARY was
modified, while a left-click should never have modified anything!

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Riku Saikkonen]

I tried to trace where the bug occurs, and got as far as this:

mouse-drag-track contains the lines

	  ;; Otherwise, run binding of terminating up-event.
          (deactivate-mark)
	  (if do-multi-click
	      (goto-char start-point)
	    (unless moved-off-start
	      (pop-mark)))

(lines 858-863 of mouse.el in Emacs 24.4.1)

Commenting out the last (pop-mark) fixes the bug, but leaves extra marks
in the mark ring (accessible with C-u C-SPC) at every point you click.
There's a corresponding push-mark on line 796 which this pop-mark
appears to try to undo, but it appears that as a side effect pop-mark
sets the primary selection (in the situation described in the bug).

I am not sure what would be a proper fix. Perhaps mouse-drag-track
should not push the mark at all until it detects something else than a
single click (i.e., (or moved-off-start do-multi-click) or something)?
(From a quick look at the source, that seems to be how mouse-drag-track
worked in Emacs 23.4.1. But the source has changed quite a lot since
then.)

PS. I found out about this bug because Debian currently considers it to
    be a release-critical bug; see <http://bugs.debian.org/774090>.

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Vincent Lefevre]

[-- Attachment #1: Type: text/plain, Size: 1002 bytes --]

[Cc to the Debian bug]

On 2014-12-30 12:45:12 +0200, Riku Saikkonen wrote:
> I tried to trace where the bug occurs, and got as far as this:
> 
> mouse-drag-track contains the lines
> 
> 	  ;; Otherwise, run binding of terminating up-event.
>           (deactivate-mark)
> 	  (if do-multi-click
> 	      (goto-char start-point)
> 	    (unless moved-off-start
> 	      (pop-mark)))
> 
> (lines 858-863 of mouse.el in Emacs 24.4.1)
[...]

How about locally setting select-active-regions to nil for
(deactivate-mark)? See attached patch, which seems to work
for me, though I don't know all the consequences.

It is inspired from the patch suggested at

  http://debbugs.gnu.org/cgi/bugreport.cgi?bug=6872#8

and the one that was really applied as
1c409d0b963ebdb1f48b90ddce85c56d989bee5f.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

[-- Attachment #2: emacs24-primarysel2.patch --]
[-- Type: text/plain, Size: 481 bytes --]

diff --git a/lisp/mouse.el b/lisp/mouse.el
index e267418..2afe313 100644
--- a/lisp/mouse.el
+++ b/lisp/mouse.el
@@ -856,7 +856,8 @@ DO-MOUSE-DRAG-REGION-POST-PROCESS should only be used by
 		     (copy-region-as-kill (mark) (point)))))
 
 	  ;; Otherwise, run binding of terminating up-event.
-          (deactivate-mark)
+          (let (select-active-regions)
+            (deactivate-mark))
 	  (if do-multi-click
 	      (goto-char start-point)
 	    (unless moved-off-start

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Glenn Morris]

Riku Saikkonen wrote:

> PS. I found out about this bug because Debian currently considers it to
>     be a release-critical bug; see <http://bugs.debian.org/774090>.

FWIW, that severity was self-assigned by the OP.

For those who care about such things, this has apparently has a
(placeholder?) CVE number (CVE-2014-9483) now. (It might have been nice
if these developments had been mentioned here.)

See eg
http://www.scip.ch/en/?vuldb.68502                   # "critical" (?!)
http://xforce.iss.net/xforce/xfdb/99688              # medium risk

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Stefan Monnier]

> This occurs very often, and I've finally managed to find a way to
> reproduce the bug:

> 1. Open a file containing a line, say "foo", with "emacs -Q".

> 2. When the cursor is at the beginning, type C-k.

> 3. Select text in some other window.

> 4. Left-click in the initial Emacs window.

> 5. Middle-click in the initial Emacs window.

> Instead of pasting the selected text, this pastes what was cut
> with C-k.

I can't reproduce it here.
I did the following:

% emacs24 -Q    ; That's Debian's Emacs-24.4
M-< C-k
C-x 5 b *Messages*
drag-mouse-1               [ in *Messages*, to select "information" ]
mouse-1                    [ in *scratch* ]
mouse-2                    [ in *scratch* ]

Result: it inserted "information", as it should.


        Stefan

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Vincent Lefevre]

On 2015-03-21 09:42:32 -0400, Stefan Monnier wrote:
> > This occurs very often, and I've finally managed to find a way to
> > reproduce the bug:
> 
> > 1. Open a file containing a line, say "foo", with "emacs -Q".
> 
> > 2. When the cursor is at the beginning, type C-k.
> 
> > 3. Select text in some other window.
                           ^^^^^

> > 4. Left-click in the initial Emacs window.
> 
> > 5. Middle-click in the initial Emacs window.
> 
> > Instead of pasting the selected text, this pastes what was cut
> > with C-k.
> 
> I can't reproduce it here.
> I did the following:
> 
> % emacs24 -Q    ; That's Debian's Emacs-24.4
> M-< C-k
> C-x 5 b *Messages*
> drag-mouse-1               [ in *Messages*, to select "information" ]

It step 3, it must be another window (e.g. xterm, or even some
other Emacs window at least if it is not the same process).

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Stefan Monnier]

>> % emacs24 -Q    ; That's Debian's Emacs-24.4
>> M-< C-k
>> C-x 5 b *Messages*
>> drag-mouse-1               [ in *Messages*, to select "information" ]
> It step 3, it must be another window

With C-x 5 b I did get another window (frame).

> (e.g. xterm, or even some other Emacs window at least if it is not the
> same process).

I haven't tried with another Emacs process, but I did try with an xterm
and got the same result.
What do you get if you follow my recipe?


        Stefan

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Vincent Lefevre]

On 2015-03-21 18:25:01 -0400, Stefan Monnier wrote:
> >> % emacs24 -Q    ; That's Debian's Emacs-24.4
> >> M-< C-k
> >> C-x 5 b *Messages*
> >> drag-mouse-1               [ in *Messages*, to select "information" ]
> > It step 3, it must be another window
> 
> With C-x 5 b I did get another window (frame).

Yes, but this also has the effect to do other operations in
the Emacs process.

> > (e.g. xterm, or even some other Emacs window at least if it is not the
> > same process).
> 
> I haven't tried with another Emacs process, but I did try with an xterm
> and got the same result.
> What do you get if you follow my recipe?

Emacs behaves correctly in this case. Ditto if I do the
C-x 5 b *Messages* before the M-< C-k. But if the other window
belongs to a different process, the bug occurs.

-- 
Vincent Lefèvre <vincent@vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Jan Djärv]

Hi.

It seems I introduced this bug when fixing 16382.

The analysis that mouse-drag-track has something to do with this is correct, 
however it is not pop-mark, it is deactivate-mark who sets PRIMARY wrongly 
sometimes (pop-mark may itself call deactivate-mark).

I have checked in a fix in the emacs-24 branch.

	Jan D.

Den 2015-03-22 02:42, Vincent Lefevre skrev:
> On 2015-03-21 18:25:01 -0400, Stefan Monnier wrote:
>>>> % emacs24 -Q    ; That's Debian's Emacs-24.4
>>>> M-< C-k
>>>> C-x 5 b *Messages*
>>>> drag-mouse-1               [ in *Messages*, to select "information" ]
>>> It step 3, it must be another window
>>
>> With C-x 5 b I did get another window (frame).
>
> Yes, but this also has the effect to do other operations in
> the Emacs process.
>
>>> (e.g. xterm, or even some other Emacs window at least if it is not the
>>> same process).
>>
>> I haven't tried with another Emacs process, but I did try with an xterm
>> and got the same result.
>> What do you get if you follow my recipe?
>
> Emacs behaves correctly in this case. Ditto if I do the
> C-x 5 b *Messages* before the M-< C-k. But if the other window
> belongs to a different process, the bug occurs.
>

bug#18939: 24.4; middle-click sometimes pastes data other than the PRIMARY selection

[Glenn Morris]

Stefan Monnier wrote:

> I haven't tried with another Emacs process, but I did try with an xterm
> and got the same result.

Totally reproducible for me in emacs-24 or Debian's 24, but curiously
not apparently in master... If someone else sees the same, they might
try bisecting to find what fixed it. There does seem to be weirdness in
that some times it does _not_ happen even with 24. I think maybe I
convinced myself this was due to selecting Emacs by clicking on the
window border rather than in the actual body of scratch. But that could
be coincidence I suppose.

in xterm:
emacs -Q
M-< C-k        # in scratch
mouse-1 on xterm that launched Emacs, double mouse-1 on "emacs"
mouse-1        # in scratch. NB in the buffer, not eg on the WM frame
mouse-2
  -> ";; This buffer is for notes..."

This is under XFCE on Debian testing, in case that matters, with
WM focus-follows-click.