Re: [scratch/igc] 985247b6bee crash on Linux, KDE, Wayland

[Eli Zaretskii <eliz@gnu.org>]

> From: Eval EXEC <execvy@gmail.com>
> Cc: pipcet@protonmail.com,  gerd.moellmann@gmail.com,  emacs-devel@gnu.org
> Date: Fri, 06 Sep 2024 11:10:15 +0800
> 
> Eval EXEC <execvy@gmail.com> writes:
> 
> > I recompiled commit 95a30325a84 (HEAD -> scratch/igc, origin/scratch/igc)
> > * src/igc.c (fix_frame): Correct the previous change.
> >
> > After testing, I believe the issue has been resolved.
> 
> scratch/igc 95a30325 crash again:
> 
> I use latest scratch/igc commit: * 95a30325a84 - (HEAD -> scratch/igc, origin/scratch/igc) * src/igc.c (fix_frame): Fix last change. (8 hours ago) <Eli Zaretskii>
> 
> #5  igc_assert_fail (file=<optimized out>, line=<optimized out>, msg=<optimized out>) at /home/exec/Projects/git.savannah.gnu.org/git/emacs/src/igc.c:209

It's an assertion violation, and it's too bad 'msg' is "optimized
out", because it's valuable information.

This is a different problem, I think.

> #9  0x0000000000690c05 in fix_lisp_obj (ss=ss@entry=0x7ffc7653e6f8, pobj=pobj@entry=0x7f08addd06b8) at /home/exec/Projects/git.savannah.gnu.org/git/emacs/src/igc.c:975
>         off = <optimized out>
>         client = <optimized out>
>         base = 0x7f088a262a50
>         res = <optimized out>
>         new_off = <optimized out>
>         p = 0x7f08addd06b8
>         word = <optimized out>
>         tag = <optimized out>
>         _ss = 0x7ffc7653e6f8
>         _mps_zs = <optimized out>
>         _mps_ufs = 36029896530599944
>         _mps_wt = <optimized out>
>         _mps_w = <optimized out>
> #10 0x00000000006919f8 in fix_cons (cons=0x7f08addd06b0, ss=0x7ffc7653e6f8) at /home/exec/Projects/git.savannah.gnu.org/git/emacs/src/igc.c:1751
>         res = <optimized out>
>         _ss = 0x7ffc7653e6f8
>         _mps_zs = <optimized out>
>         _mps_ufs = 36028797018972168
>         _mps_wt = <optimized out>
>         _mps_w = <optimized out>

So this says we hit the trouble while fixing a car of a cons:

  static mps_res_t
  fix_cons (mps_ss_t ss, struct Lisp_Cons *cons)
  {
    MPS_SCAN_BEGIN (ss)
    {
      IGC_FIX12_OBJ (ss, &cons->u.s.car);  <<<<<<<<<<<<<<<<<<<<<
      IGC_FIX12_OBJ (ss, &cons->u.s.u.cdr);
    }
    MPS_SCAN_END (ss);
    return MPS_RES_OK;
  }

  static mps_res_t
  fix_lisp_obj (mps_ss_t ss, Lisp_Object *pobj)
  {
    MPS_SCAN_BEGIN (ss)
    {
      mps_word_t *p = (mps_word_t *) pobj;
      mps_word_t word = *p;

      /* Quickly rule out Qnil, and prevent subtraxting from a
	 null pointer.  */
      if (word == 0)
	return MPS_RES_OK;

      mps_word_t tag = word & IGC_TAG_MASK;
      if (tag == Lisp_Int0 || tag == Lisp_Int1)
	return MPS_RES_OK;
      else if (tag == Lisp_Type_Unused0)
	emacs_abort ();

      if (tag == Lisp_Symbol)
	{
	  ptrdiff_t off = word ^ tag;
	  mps_addr_t client = (mps_addr_t) ((char *) lispsym + off);
	  mps_addr_t base = client;
	  if (MPS_FIX1 (ss, base))
	    {
	      mps_res_t res = MPS_FIX2 (ss, &base); <<<<<<<<<<<<<<<<<<<

I guess it would be interesting to see what was the cons and what was
the symbol that was its car?

Like this:

  (gdb) frame 9
  (gdb) p *pobj
  (gdb) xtype
  (gdb) xsymbol
  (gdb) frame 10
  (gdb) p *cons
  (gdb) xcons
  (gdb) p *xcons
  (gdb) xcdr
  (gdb) xtype