Re: [scratch/igc] 985247b6bee crash on Linux, KDE, Wayland

[Pip Cet <pipcet@protonmail.com>]

"Eli Zaretskii" <eliz@gnu.org> writes:
>> From: Eval EXEC <execvy@gmail.com>
>> Date: Thu, 05 Sep 2024 14:24:39 +0800
>>
>> ```elisp
>>   (setq-default tab-bar-format
>> 				'(tab-bar-format-menu-bar
>>                   tab-bar-format-history tab-bar-format-tabs
>>                   tab-bar-separator tab-bar-format-add-tab
>>                   tab-bar-separator tab-bar-format-align-right
>>                   tab-bar-format-global))
>> ```
>>
>> Than, about 20 seconds after, the emacs crash, crash bt is:
>> ```
>>         info "(gdb)Auto-loading safe path"
>> warning: File "/nix/store/x47hg342iyiw50c1fhqjzz4n0rqy3dhh-isl-0.20/lib/libisl.so.19.1.0-gdb.py" auto-loading has been declined by your `auto-load safe-path' set to "$debugdir:$datadir/auto-load:/nix/store/40yjzm7r5ki59kkk9423dnwbm86x7pyd-gcc-13.2.0-lib".
>> (gdb) bt
>> #0  0x00007f84a90a2efc in __pthread_kill_implementation () from /nix/store/dbcw19dshdwnxdv5q2g6wldj6syyvq7l-glibc-2.39-52/lib/libc.so.6
>> #1  0x00007f84a9052e86 in raise () from /nix/store/dbcw19dshdwnxdv5q2g6wldj6syyvq7l-glibc-2.39-52/lib/libc.so.6
>> #2  0x0000000000429886 in terminate_due_to_signal ()
>> #3  0x0000000000431d79 in igc_assert_fail.lto_priv[cold] ()
>> #4  0x00000000007b0e60 in LockClaim ()
>> #5  0x00000000007ddea5 in ArenaEnterLock ()
>> #6  0x00000000007e01a1 in mps_ap_fill ()
>> #7  0x00000000006e74b6 in alloc_impl.lto_priv ()
>> #8  0x000000000060993b in list2 ()
>> #9  0x000000000042da87 in xsignal2 ()
>> #10 0x000000000042c379 in wrong_type_argument ()
>> #11 0x0000000000430730 in get_process.lto_priv[cold] ()
>> #12 0x00000000006bd653 in process_send_signal ()
>> #13 0x00000000006be017 in kill_buffer_processes ()
>> #14 0x000000000058efb5 in shut_down_emacs ()
>> #15 0x0000000000429852 in terminate_due_to_signal ()
>> #16 0x000000000042a38f in handle_sigsegv.lto_priv[cold] ()
>> #17 <signal handler called>
>> #18 0x00007f84a905316b in kill () from /nix/store/dbcw19dshdwnxdv5q2g6wldj6syyvq7l-glibc-2.39-52/lib/libc.so.6
>> #19 0x00000000007e3919 in sigHandle ()
>> #20 <signal handler called>
>> #21 0x000000000075d716 in dflt_scan_obj.isra ()
>> #22 0x00000000006e288d in dflt_scan ()
>
> Looks like a SIGSEGV while handling protection-induced SIGSEGV?  I
> don't think I understand why the second SIGSEGV was triggered.

sigHandle() triggers a second SIGSEGV if the first SIGSEGV wasn't
handled successfully, after restoring the previous sigaction.  So this
is a "normal", fatal SIGSEGV and MPS passed it on.

> Is this related to tab-bar, i.e. if you do not modify tab-bar-format,
> does this not happen?

I suspect it's a tracing problem related to the (highly optimized,
inlined, LTO'd) code used by Flist and copy_font_spec.  We'll have to
disassemble those functions and check where and how they store
references to the list being built.

Pip