Re: MPS: Crash when switching to buffer

[Eli Zaretskii <eliz@gnu.org>]

> From: Ihor Radchenko <yantar92@posteo.net>
> Cc: Gerd Möllmann <gerd.moellmann@gmail.com>, Eli Zaretskii
>  <eliz@gnu.org>,
>  eller.helmut@gmail.com
> Date: Mon, 01 Jul 2024 09:26:25 +0000
> 
> 
> Thread 1 "emacs" hit Breakpoint 1, terminate_due_to_signal (sig=sig@entry=11, backtrace_limit=backtrace_limit@entry=40) at emacs.c:443
> 443	{
> (gdb) bt
> #0  terminate_due_to_signal (sig=sig@entry=11, backtrace_limit=backtrace_limit@entry=40) at emacs.c:443
> #1  0x00005555556e446b in handle_fatal_signal (sig=sig@entry=11) at sysdep.c:1800
> #2  0x00005555556e44d0 in deliver_thread_signal (sig=11, handler=0x5555556e4457 <handle_fatal_signal>) at sysdep.c:1792
> #3  deliver_fatal_thread_signal (sig=sig@entry=11) at sysdep.c:1812
> #4  0x00005555556e44fd in handle_sigsegv (sig=11, siginfo=<optimized out>, arg=<optimized out>) at sysdep.c:1950
> #5  0x00007ffff3048050 in <signal handler called> () at /lib64/libc.so.6
> #6  0x00007ffff304822b in kill () at /lib64/libc.so.6
> #7  0x0000555555880af9 in sigHandle (sig=<optimized out>, info=<optimized out>, uap=<optimized out>) at /home/yantar92/Dist/mps/code/protsgix.c:114
> #8  0x00007ffff3048050 in <signal handler called> () at /lib64/libc.so.6
> #9  XCDR (c=XIL(0x32ec042e3)) at /home/yantar92/Git/emacs/src/lisp.h:1522
> #10 plist_get (plist=<optimized out>, prop=prop@entry=XIL(0x8220)) at fns.c:2611
> #11 0x000055555575a8de in Fget (symbol=symbol@entry=XIL(0x2aaa92d6f288), propname=propname@entry=XIL(0x8220)) at fns.c:2631
> #12 0x0000555555664370 in resolve_face_name (face_name=XIL(0x2aaa92d6f288), signal_p=signal_p@entry=false) at xfaces.c:2004
> #13 0x0000555555669e57 in get_lface_attributes
>     (w=w@entry=0x7fffef8a0068, f=f@entry=0x7fffe26fd610, face_name=<optimized out>, attrs=attrs@entry=0x7fffffff5270, signal_p=signal_p@entry=false, named_merge_points=<optimized out>, named_merge_points@entry=0x0) at xfaces.c:2105
> #14 0x0000555555670ea9 in lookup_derived_face
>     (w=0x7fffef8a0068, f=f@entry=0x7fffe26fd610, symbol=<optimized out>, face_id=face_id@entry=45, signal_p=signal_p@entry=false) at xfaces.c:5279
> #15 0x0000555555671ef4 in merge_faces (w=<optimized out>, face_name=<optimized out>, face_name@entry=XIL(0x30), face_id=<optimized out>, base_face_id=45)
>     at xfaces.c:7128
> #16 0x00005555555c0751 in next_element_from_display_vector (it=0x7fffffff7dc0) at xdisp.c:9045

This is not a crash when switching buffers, this is a crash in
redisplay, when merging faces for display.

What exactly is the cause of segfault in plist_get?  Please look at
the data there in the debugger and see which one(s) are invalid or
corrupted.  From the backtrace it sounds like the plist of the face is
botched, but that's a guess.

Is this reproducible? I tried switching between two buffers and didn't
get any crashes here, FWIW.