bug#71929: 30.0.60; crash in mark_image_cache

[Sean Whitton <spwhitton@spwhitton.name>]

Hello,

On Sun 07 Jul 2024 at 03:41pm +08, Po Lu wrote:

> Eli Zaretskii <eliz@gnu.org> writes:
>
>> This is the initial frame of the daemon.  It is not a GUI frame, and
>> so it should not have a valid image cache.  I guess some change is
>> needed in verify_image_cache_refcount?
>
> Not quite: init_frame_faces is apparently called before the frame is
> entered into Vframe_list, so, likewise, the face cache's reference count
> should be verified before it is incremented.
>
> Sean, please retry with this patch substituted for the previous:

This time it doesn't crash until I open and close a frame, as can be
seen in the backtrace:

 0 in terminate_due_to_signal of emacs.c:442
 1 in emacs_abort of sysdep.c:2391
 2 in verify_image_cache_refcount of /home/spwhitton/src/emacs/primary/src/frame.h:1706
 3 in free_frame_faces of xfaces.c:715
 4 in pgtk_free_frame_resources of pgtkterm.c:443
 5 in pgtk_destroy_window of pgtkterm.c:539
 6 in delete_frame of frame.c:2318
 7 in Fdelete_frame of frame.c:2527
 8 in funcall_subr of eval.c:3163
 9 in exec_byte_code of bytecode.c:812
10 in funcall_lambda of eval.c:3252
11 in funcall_general of eval.c:3044
12 in Ffuncall of eval.c:3093
13 in Ffuncall_interactively of callint.c:250
14 in funcall_subr of eval.c:3184
15 in funcall_general of eval.c:3040
16 in Ffuncall of eval.c:3093
17 in Fcall_interactively of callint.c:789
18 in funcall_subr of eval.c:3165
19 in exec_byte_code of bytecode.c:812
20 in funcall_lambda of eval.c:3252
21 in funcall_general of eval.c:3044
22 in Ffuncall of eval.c:3093
23 in read_char of /home/spwhitton/src/emacs/primary/src/lisp.h:1178
24 in read_key_sequence of keyboard.c:10743
25 in command_loop_1 of /home/spwhitton/src/emacs/primary/src/lisp.h:1178
26 in internal_condition_case of eval.c:1613
27 in command_loop_2 of keyboard.c:1168
28 in internal_catch of eval.c:1292
29 in command_loop of /home/spwhitton/src/emacs/primary/src/lisp.h:1178
30 in recursive_edit_1 of keyboard.c:754
31 in Frecursive_edit of keyboard.c:837
32 in main of emacs.c:2631

(gdb) p expected
$3 = 0
(gdb) p c
$4 = (struct image_cache *) 0x555557f65370
(gdb) p c->refcount
$5 = 1
(gdb) set $cons = Vframe_list
(gdb) while $cons
 >xgetptr $cons
 >p ((struct Lisp_Cons *) $ptr)->u.s.car
 >xframe
 >p *$
 >xgetptr $cons
 >set $cons = ((struct Lisp_Cons *) $ptr)->u.s.u.cdr
 >end
$6 = XIL(0x555555f3dfd5)
$7 = (struct frame *) 0x555555f3dfd0
"F1"
$8 = {
  header = {
    size = 4611686018595352602
  },
  name = XIL(0x55555587c944),
  icon_name = XIL(0),
  title = XIL(0),
  parent_frame = XIL(0),
  last_mouse_device = XIL(0),
  focus_frame = XIL(0),
  root_window = XIL(0x555555f3e225),
  selected_window = XIL(0x555555f3e225),
  old_selected_window = XIL(0x555555f3e225),
  minibuffer_window = XIL(0x555555f3e4cd),
  param_alist = XIL(0x555557a23c73),
  scroll_bars = XIL(0),
  condemned_scroll_bars = XIL(0),
  menu_bar_items = XIL(0x555558f8b705),
  face_hash_table = XIL(0x555555f3e775),
  menu_bar_vector = XIL(0),
  buffer_predicate = XIL(0),
  buffer_list = XIL(0x55555934f053),
  buried_buffer_list = XIL(0),
  tab_bar_window = XIL(0),
  desired_tab_bar_string = XIL(0),
  current_tab_bar_string = XIL(0),
  tool_bar_position = XIL(0x11d00),
  font_data = XIL(0),
  tab_bar_items = XIL(0),
  tool_bar_items = XIL(0),
  face_cache = 0x555555f741d0,
  image_cache = 0x0,
  last_tab_bar_item = -1,
  menu_bar_items_used = 0,
  current_pool = 0x555555f3f4b0,
  desired_pool = 0x555555f3f490,
  desired_matrix = 0x555555f3f4d0,
  current_matrix = 0x555555f3f740,
  glyphs_initialized_p = true,
  resized_p = false,
  default_face_done_p = false,
  already_hscrolled_p = false,
  updated_p = false,
  minimize_tab_bar_window_p = false,
  external_tool_bar = false,
  fonts_changed = false,
  cursor_type_changed = false,
  redisplay = true,
  external_menu_bar = false,
  visible = 1,
  iconified = false,
  garbaged = false,
  wants_modeline = true,
  auto_raise = false,
  auto_lower = false,
  no_split = false,
  explicit_name = false,
  window_change = false,
  window_state_change = false,
  mouse_moved = false,
  pointer_invisible = false,
  frozen_window_starts = false,
  output_method = output_initial,
  tooltip = false,
  want_fullscreen = FULLSCREEN_NONE,
  vertical_scroll_bar_type = vertical_scroll_bar_none,
  horizontal_scroll_bars = false,
  undecorated = false,
  override_redirect = false,
  skip_taskbar = false,
  no_focus_on_map = false,
  no_accept_focus = false,
  z_group = z_group_none,
  no_special_glyphs = false,
  can_set_window_size = true,
  after_make_frame = true,
  tab_bar_redisplayed = false,
  tab_bar_resized = false,
  tool_bar_redisplayed = false,
  tool_bar_resized = false,
  inhibit_horizontal_resize = false,
  inhibit_vertical_resize = false,
  face_change = false,
  inhibit_clear_image_cache = false,
  new_size_p = false,
  was_invisible = false,
  select_mini_window_flag = false,
  change_stamp = 7,
  number_of_windows = 2,
  tab_bar_lines = 0,
  tab_bar_height = 0,
  n_tab_bar_rows = 0,
  n_tab_bar_items = 0,
  tool_bar_lines = 0,
  tool_bar_height = 0,
  n_tool_bar_rows = 0,
  n_tool_bar_items = 0,
  decode_mode_spec_buffer = 0x555555f3f340 "",
  insert_line_cost = 0x0,
  delete_line_cost = 0x0,
  insert_n_lines_cost = 0x0,
  delete_n_lines_cost = 0x0,
  text_cols = 80,
  text_lines = 24,
  text_width = 80,
  text_height = 24,
  total_cols = 80,
  total_lines = 25,
  pixel_width = 80,
  pixel_height = 25,
  new_width = -1,
  new_height = -1,
  left_pos = 0,
  top_pos = 0,
  win_gravity = 0,
  size_hint_flags = 0,
  border_width = 0,
  child_frame_border_width = -1,
  internal_border_width = 0,
  right_divider_width = 0,
  bottom_divider_width = 0,
  left_fringe_width = 0,
  right_fringe_width = 0,
  fringe_cols = 0,
  menu_bar_lines = 1,
  menu_bar_height = 1,
  column_width = 1,
  line_height = 1,
  terminal = 0x555555f3ddb0,
  output_data = {
    tty = 0x0,
    x = 0x0,
    w32 = 0x0,
    ns = 0x0,
    pgtk = 0x0,
    haiku = 0x0,
    android = 0x0
  },
  font_driver_list = 0x0,
  desired_cursor = FILLED_BOX_CURSOR,
  cursor_width = 0,
  blink_off_cursor = FILLED_BOX_CURSOR,
  blink_off_cursor_width = 0,
  config_scroll_bar_width = 0,
  config_scroll_bar_cols = 0,
  config_scroll_bar_height = 0,
  config_scroll_bar_lines = 0,
  cost_calculation_baud_rate = 0,
  alpha = {0, 0},
  alpha_background = 0,
  gamma = 0,
  extra_line_spacing = 0,
  background_pixel = 18446744073709551613,
  foreground_pixel = 18446744073709551614
}

-- 
Sean Whitton