bug#40049: 26.1; Coredump on GNUS reading e-mail

[Sergey Organov <sorganov@gmail.com>]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Sergey Organov <sorganov@gmail.com>
>> Date: Fri, 13 Mar 2020 08:23:59 +0300
>> 
>> Emacs coredumps when GNUS tries to read some kinds of mails.
>> 
>> To reproduce from 'emacs -Q', untar attached file that will create
>> 'gnus-coredump' directory with a single mail file in it, then:
>> 
>> $ emacs -Q
>> M-x gnus
>> G D ;; gnus-group-enter-directory
>> <type directory name> RET
>> 
>> GNUS then tries to open this directory as group and Emacs crashes. The
>> backtrace and other information follows:
>
> This recipe should be run with -xrm "emacs.synchronous: true", so that
> the X protocol errors are acted upon immediately where they happen.
> then the GDB backtrace will be much more informative, as it will show
> the code which causes this.

Below is backtrace from 'emacs -Q -xrm "emacs.synchronous: true"'. There
behavior slightly changed: GNUS showed group name and I then needed to
enter the group to produce coredump.

> Anyway, this looks like a font problem we fixed some time ago, so
> upgrading to Emacs 26.3 or (better) to the pretest of Emacs 27 should
> fix this, I think.  Another potential solution is to uninstall the
> offending font (Noto Color, perhaps?).

Hopefully this coredump will help to confirm it's a known bug:

#0  0x00007ff5e1fb65cb in raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
        set = {__val = {402653184, 0 <repeats 15 times>}}
        pid = <optimized out>
        tid = <optimized out>
#1  0x00000000004f6f37 in terminate_due_to_signal
    (sig=sig@entry=6, backtrace_limit=backtrace_limit@entry=40)
    at ./debian/build-src/src/emacs.c:394
#2  0x0000000000511643 in emacs_abort () at ./debian/build-src/src/sysdep.c:2426
#3  0x00000000004c3f23 in x_connection_closed
    (dpy=dpy@entry=0x4a15290, error_message=<optimized out>, 
    error_message@entry=0x7ffe77e4cbb0 "X protocol error: BadLength (poly request too large or internal Xlib length error) on protocol request 139", ioerror=ioerror@entry=false)
    at ./debian/build-src/src/xterm.c:9816
        dpyinfo = <optimized out>
        frame = <optimized out>
        tail = <optimized out>
        idx = <optimized out>
#4  0x00000000004c7d49 in x_error_quitter
    (display=0x4a15290, event=<optimized out>, event=<optimized out>)
    at ./debian/build-src/src/xterm.c:9904
        buf = "BadLength (poly request too large or internal Xlib length error)", '\000' <repeats 191 times>
        buf1 = "X protocol error: BadLength (poly request too large or internal Xlib length error) on protocol request 139", '\000' <repeats 44 times>, "\360?", '\000' <repeats 62 times>...
#5  0x00000000004c7dcb in x_error_handler (display=0x4a15290, event=0x7ffe77e4cd70)
    at ./debian/build-src/src/xterm.c:9874
#6  0x00007ff5e3fdb11a in _XError () at /lib/x86_64-linux-gnu/libX11.so.6
#7  0x00007ff5e3fd8077 in  () at /lib/x86_64-linux-gnu/libX11.so.6
#8  0x00007ff5e3fd811d in  () at /lib/x86_64-linux-gnu/libX11.so.6
#9  0x00007ff5e3fd8a55 in _XEventsQueued () at /lib/x86_64-linux-gnu/libX11.so.6
#10 0x00007ff5e3fca7b7 in XPending () at /lib/x86_64-linux-gnu/libX11.so.6
#11 0x00007ff5e487420d in  () at /lib/x86_64-linux-gnu/libgdk-3.so.0
#12 0x00007ff5e434d669 in g_main_context_prepare () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#13 0x00007ff5e434e06b in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#14 0x00007ff5e434e207 in g_main_context_pending () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#15 0x00007ff5e4b42b9d in gtk_events_pending () at /lib/x86_64-linux-gnu/libgtk-3.so.0
#16 0x00000000004c4917 in XTread_socket (terminal=<optimized out>, hold_quit=0x7ffe77e4d070) at ./debian/build-src/src/xterm.c:9142
        count = 0
        dpyinfo = 0x4ac53b0
#17 0x00000000004fe1c9 in gobble_input () at ./debian/build-src/src/keyboard.c:6910
        nr = <optimized out>
        hold_quit = {kind = NO_EVENT, part = scroll_bar_nowhere, code = 0, modifiers = 0, x = 0, y = 0, timestamp = 0, frame_or_window = 0, arg = 0}
        next = 0x0
        nread = 0
        err = false
        t = 0x114de40 <bss_sbrk_buffer+7579168>
#18 0x00000000004fe875 in handle_async_input () at ./debian/build-src/src/keyboard.c:7146
        nread = <optimized out>
#19 0x00000000004fe875 in process_pending_signals () at ./debian/build-src/src/keyboard.c:7160
#20 0x000000000056f5ad in maybe_quit () at ./debian/build-src/src/eval.c:1494
#21 0x00000000005766f2 in Flength (sequence=0, sequence@entry=80145715) at ./debian/build-src/src/lisp.h:1221
        li = {tortoise = 80145715, max = 2, n = 0, q = 0}
        i = 2
        val = <optimized out>
#22 0x0000000000577739 in concat (nargs=nargs@entry=1, args=args@entry=0x7ffe77e4d228, target_type=Lisp_Cons, last_special=last_special@entry=false) at ./debian/build-src/src/fns.c:582
        len = <optimized out>
        val = <optimized out>
        tail = 0
        this = 80145715
        toindex = <optimized out>
        toindex_byte = 0
        result_len = 0
        result_len_byte = 0
        argnum = 0
        last_tail = 0
        prev = <optimized out>
        some_multibyte = false
        textprops = 0x0
        num_textprops = 0
        sa_avail = 16384
        sa_count = 4
        sa_must_free = false
#23 0x0000000000578356 in Fcopy_sequence (arg=<optimized out>) at ./debian/build-src/src/lisp.h:615
#24 0x00000000004fd323 in timer_check () at ./debian/build-src/src/keyboard.c:4516
        nexttime = <optimized out>
        timers = 0
        idle_timers = <optimized out>
        tem = 0
#25 0x00000000004fd875 in readable_events (flags=flags@entry=1) at ./debian/build-src/src/keyboard.c:3340
#26 0x00000000004fe368 in get_input_pending (flags=flags@entry=1) at ./debian/build-src/src/keyboard.c:6827
#27 0x0000000000500bc8 in detect_input_pending_run_timers (do_display=do_display@entry=true) at ./debian/build-src/src/keyboard.c:9951
        old_timers_run = <optimized out>
#28 0x00000000005b0387 in wait_reading_process_output (time_limit=time_limit@entry=30, nsecs=nsecs@entry=0, read_kbd=read_kbd@entry=-1, do_display=do_display@entry=true, wait_for_cell=wait_for_cell@entry=0, wait_proc=wait_proc@entry=0x0, just_wait_proc=0) at ./debian/build-src/src/process.c:5514
        old_timers_run = 90
        old_buffer = 0x4cee000
        old_window = 18897973
        leave = false
        process_skipped = <optimized out>
        channel = <optimized out>
        nfds = 1
        Available = {fds_bits = {32, 0 <repeats 15 times>}}
        Writeok = {fds_bits = {0 <repeats 16 times>}}
        check_write = <optimized out>
        check_delay = <optimized out>
        no_avail = false
        xerrno = 11
        proc = <optimized out>
        timeout = {tv_sec = 0, tv_nsec = 0}
        end_time = {tv_sec = 1584099190, tv_nsec = 783572691}
        timer_delay = <optimized out>
        got_output_end_time = {tv_sec = 1584099190, tv_nsec = 783572691}
        wait = TIMEOUT
        got_some_output = -1
        retry_for_async = <optimized out>
        count = 3
        now = {tv_sec = 0, tv_nsec = -1}
#29 0x00000000004244ba in sit_for (timeout=122, reading=reading@entry=true, display_option=display_option@entry=1) at ./debian/build-src/src/lisp.h:855
        sec = 30
        nsec = 0
        do_display = true
#30 0x000000000050323b in read_char (commandflag=commandflag@entry=1, map=map@entry=80145603, prev_event=0, used_mouse_menu=used_mouse_menu@entry=0x7ffe77e4de4b, end_time=end_time@entry=0x0) at ./debian/build-src/src/lisp.h:944
        tem0 = <optimized out>
        timeout = <optimized out>
        delay_level = 4
        buffer_size = <optimized out>
        c = <optimized out>
        jmpcount = 3
        local_getcjmp = {{__jmpbuf = {1, -2416469996254394248, 88136616, 80145603, 0, 140730909908800, 2416769021276588152, -2416469309686937480}, __mask_was_saved = 0, __saved_mask = {__val = {140730909908112, 80666629, 32400, 80666624, 5653333, 1, 4, 2, 80666624, 42, 6679040, 10, 140730909907728, 281474976726784, 140730909907384, 140730909907352}}}}
        save_jump = {{__jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, __mask_was_saved = 0, __saved_mask = {__val = {0 <repeats 16 times>}}}}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0
        also_record = 0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x4a840c0
#31 0x00000000005049a0 in read_key_sequence (keybuf=keybuf@entry=0x7ffe77e4df40, prompt=prompt@entry=0, dont_downcase_last=dont_downcase_last@entry=false, can_return_switch_frame=can_return_switch_frame@entry=true, fix_current_buffer=fix_current_buffer@entry=true, prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at ./debian/build-src/src/keyboard.c:9147
        interrupted_kboard = <optimized out>
        interrupted_frame = 0x1204c30 <bss_sbrk_buffer+8328208>
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        new_binding = <optimized out>
        count = 3
        t = 0
        echo_start = 0
        keys_start = 0
        current_binding = 80145603
        first_event = 0
        first_unbound = 31
        mock_input = 0
        fkey = {parent = 15196995, map = 15196995, start = 0, end = 0}
        keytran = {parent = 11008659, map = 11008659, start = 0, end = 0}
        indec = {parent = 15197011, map = 15197011, start = 0, end = 0}
        shift_translated = false
        delayed_switch_frame = 0
        original_uppercase = 0
        original_uppercase_position = -1
        dummyflag = false
        starting_buffer = 0x4cee000
        fake_prefixed_keys = 0
#32 0x00000000005060a4 in command_loop_1 () at ./debian/build-src/src/lisp.h:855
        cmd = <optimized out>
        keybuf = {54, 402, 0, -7601620639412960768, 0, 17483521, 4, 7818336, 10341984, 10507232, 140730909909072, 5700864, 271, 320, -920, 4, 223338299410, 0, 0, 472446402651, 511101108348, -7601620639412960768, 120, 140730909909024, 0, 11315811, -1, 5691065, 5, 31200}
        i = <optimized out>
        prev_modiff = 13
        prev_buffer = 0x52d1410
#33 0x000000000056cd9e in internal_condition_case (bfun=bfun@entry=0x505e80 <command_loop_1>, handlers=handlers@entry=21072, hfun=hfun@entry=0x4fc780 <cmd_error>) at ./debian/build-src/src/eval.c:1332
        val = <optimized out>
        c = 0x49f5980
#34 0x00000000004f7344 in command_loop_2 (ignore=ignore@entry=0) at ./debian/build-src/src/lisp.h:855
        val = <optimized out>
#35 0x000000000056cd0d in internal_catch (tag=tag@entry=50928, func=func@entry=0x4f7320 <command_loop_2>, arg=arg@entry=0) at ./debian/build-src/src/eval.c:1097
        val = <optimized out>
        c = 0x49f5860
#36 0x00000000004f72db in command_loop () at ./debian/build-src/src/lisp.h:855
#37 0x00000000004fc363 in recursive_edit_1 () at ./debian/build-src/src/keyboard.c:695
        count = 1
        val = <optimized out>
#38 0x00000000004fc6a8 in Frecursive_edit () at ./debian/build-src/src/keyboard.c:766
        buffer = <optimized out>
#39 0x000000000041a631 in main (argc=<optimized out>, argv=0x7ffe77e4e2f8) at ./debian/build-src/src/emacs.c:1713
        stack_bottom_variable = 0x7ff5e1b131a2 <__libc_calloc+130>
        do_initial_setlocale = <optimized out>
        dumping = <optimized out>
        skip_args = 0
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>
        disable_aslr = <optimized out>
        rlim = {rlim_cur = 10022912, rlim_max = 18446744073709551615}
        sockfd = -1

Thanks,
-- Sergey