From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.io!.POSTED.ciao.gmane.io!not-for-mail From: Eli Zaretskii Newsgroups: gmane.emacs.bugs Subject: bug#41239: GTK builds crashing in XTread_socket after deleting a frame Date: Wed, 20 May 2020 19:07:50 +0300 Message-ID: <835zcq7fop.fsf@gnu.org> References: <83v9kz679v.fsf@gnu.org> <0af1b68c-93d3-2e8b-7810-41d60ef6a2a8@gmx.at> <837dxe61g7.fsf@gnu.org> <9395943c-9690-3d97-067d-77d65c27c187@gmx.at> <83d075uisz.fsf@gnu.org> <87pnazl6hg.fsf@gmail.com> Injection-Info: ciao.gmane.io; posting-host="ciao.gmane.io:159.69.161.202"; logging-data="84258"; mail-complaints-to="usenet@ciao.gmane.io" Cc: 41239@debbugs.gnu.org To: Noam Postavsky Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Wed May 20 18:09:10 2020 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane-mx.org Original-Received: from lists.gnu.org ([209.51.188.17]) by ciao.gmane.io with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1jbRHJ-000LoP-SS for geb-bug-gnu-emacs@m.gmane-mx.org; Wed, 20 May 2020 18:09:09 +0200 Original-Received: from localhost ([::1]:60366 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jbRHI-0000B2-Uc for geb-bug-gnu-emacs@m.gmane-mx.org; Wed, 20 May 2020 12:09:08 -0400 Original-Received: from eggs.gnu.org ([2001:470:142:3::10]:44468) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jbRHC-00007h-LM for bug-gnu-emacs@gnu.org; Wed, 20 May 2020 12:09:02 -0400 Original-Received: from debbugs.gnu.org ([209.51.188.43]:42546) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1jbRHC-0004mw-Bx for bug-gnu-emacs@gnu.org; Wed, 20 May 2020 12:09:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84_2) (envelope-from ) id 1jbRHC-0007YU-7p for bug-gnu-emacs@gnu.org; Wed, 20 May 2020 12:09:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Eli Zaretskii Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Wed, 20 May 2020 16:09:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 41239 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: confirmed Original-Received: via spool by 41239-submit@debbugs.gnu.org id=B41239.158999090028989 (code B ref 41239); Wed, 20 May 2020 16:09:02 +0000 Original-Received: (at 41239) by debbugs.gnu.org; 20 May 2020 16:08:20 +0000 Original-Received: from localhost ([127.0.0.1]:54092 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jbRGK-0007XH-7T for submit@debbugs.gnu.org; Wed, 20 May 2020 12:08:20 -0400 Original-Received: from eggs.gnu.org ([209.51.188.92]:36926) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1jbRGI-0007Wl-Hb for 41239@debbugs.gnu.org; Wed, 20 May 2020 12:08:07 -0400 Original-Received: from fencepost.gnu.org ([2001:470:142:3::e]:52080) by eggs.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jbRGD-00045X-5o; Wed, 20 May 2020 12:08:01 -0400 Original-Received: from [176.228.60.248] (port=4528 helo=home-c4e4a596f7) by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1jbRG2-0004Xp-ED; Wed, 20 May 2020 12:08:00 -0400 In-Reply-To: <87pnazl6hg.fsf@gmail.com> (message from Noam Postavsky on Tue, 19 May 2020 21:50:35 -0400) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane-mx.org@gnu.org Original-Sender: "bug-gnu-emacs" Xref: news.gmane.io gmane.emacs.bugs:180666 Archived-At: > From: Noam Postavsky > Cc: martin rudalics , 41239@debbugs.gnu.org > Date: Tue, 19 May 2020 21:50:35 -0400 > > > Once again, all the crashes are inside memory-allocation functions, > > which suggests some kind of memory corruption. Did someone try to run > > this scenario under valgrind? > > I've tried it now, log attached (minus what I believe are some false > positives that printed during startup). This is against latest master Thanks. This seems to say that we cause some memory allocation in functions called by xg_prepare_tooltip, but the allocated memory region is not large enough, and that causes invalid reads beyond end of allocated region when we call xg_free_frame_widgets (as side effect of deleting the tooltip frame, I suppose). Can someone spot where we pass some wrong parameters to GTK/GIO functions in xg_prepare_tooltip? Or something we do wrong in xg_free_frame_widgets? Failing that, I guess we will need to step through the GTK functions mentioned by valgrind and see what's going on there.