From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Pip Cet Newsgroups: gmane.emacs.bugs Subject: bug#21380: 25.0.50; GTK-induced segfault when scheduling timer from window-configuration-change-hook Date: Sun, 30 Aug 2015 16:24:55 +0000 Message-ID: References: <83mvx8252m.fsf@gnu.org> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: multipart/alternative; boundary=001a1144ac34e1e77f051e89c12a X-Trace: ger.gmane.org 1440951927 29593 80.91.229.3 (30 Aug 2015 16:25:27 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sun, 30 Aug 2015 16:25:27 +0000 (UTC) Cc: 21380@debbugs.gnu.org To: Eli Zaretskii Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sun Aug 30 18:25:12 2015 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1ZW5Pr-00049Q-Qo for geb-bug-gnu-emacs@m.gmane.org; Sun, 30 Aug 2015 18:25:12 +0200 Original-Received: from localhost ([::1]:59356 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZW5Pr-0006Jx-K6 for geb-bug-gnu-emacs@m.gmane.org; Sun, 30 Aug 2015 12:25:11 -0400 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:58941) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZW5Pm-0006HU-SU for bug-gnu-emacs@gnu.org; Sun, 30 Aug 2015 12:25:08 -0400 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZW5Pi-0004k4-Qw for bug-gnu-emacs@gnu.org; Sun, 30 Aug 2015 12:25:06 -0400 Original-Received: from debbugs.gnu.org ([208.118.235.43]:50675) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZW5Pi-0004jp-OG for bug-gnu-emacs@gnu.org; Sun, 30 Aug 2015 12:25:02 -0400 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.80) (envelope-from ) id 1ZW5Pi-0007v9-Eh for bug-gnu-emacs@gnu.org; Sun, 30 Aug 2015 12:25:02 -0400 X-Loop: help-debbugs@gnu.org Resent-From: Pip Cet Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sun, 30 Aug 2015 16:25:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 21380 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: Original-Received: via spool by 21380-submit@debbugs.gnu.org id=B21380.144095190030436 (code B ref 21380); Sun, 30 Aug 2015 16:25:02 +0000 Original-Received: (at 21380) by debbugs.gnu.org; 30 Aug 2015 16:25:00 +0000 Original-Received: from localhost ([127.0.0.1]:42885 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZW5Pf-0007up-5g for submit@debbugs.gnu.org; Sun, 30 Aug 2015 12:24:59 -0400 Original-Received: from mail-io0-f181.google.com ([209.85.223.181]:36732) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZW5Pc-0007ud-7m for 21380@debbugs.gnu.org; Sun, 30 Aug 2015 12:24:57 -0400 Original-Received: by iod35 with SMTP id 35so6636349iod.3 for <21380@debbugs.gnu.org>; Sun, 30 Aug 2015 09:24:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=5Zg6HP1gweiQ3HDhGDtCA4dB0UlQD3SyeDixI+5i0Zk=; b=lGn4CFK1puDMlkeq23+W4Brkb5APNaIgABerDtKNRlh6o2uGAd8pKZNICId4G6CGZb hq/FxPbvR4zBUFtu3bKsmrWLDd2EeT6bK+CctVRz7qaHj21krslvZWQMJT9DPjXknYN7 rYNV2vUAv7U2dM/DPGDB9j7NdKfnRyGRTvybKRcbXUOTYpJzuwnwlaEfN/zixm1MTBPb UpT2t5qrUUAqelpQMWXUlR7wQPZ8l9E7UCPZHuGKQzr+Xt4kn9SfDmQ/VgxQGsj3g6I5 oenKE0VtRwKcGJEbtGAG5mlt8zJXeys+57m4MIwd0VvfCu2Ort8P/jrhn5ZagSWijf45 y72g== X-Received: by 10.107.47.97 with SMTP id j94mr21528385ioo.136.1440951895712; Sun, 30 Aug 2015 09:24:55 -0700 (PDT) Original-Received: by 10.79.78.66 with HTTP; Sun, 30 Aug 2015 09:24:55 -0700 (PDT) In-Reply-To: X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:105983 Archived-At: --001a1144ac34e1e77f051e89c12a Content-Type: text/plain; charset=UTF-8 I think the problem is the call to do_pending_window_change in xg_frame_resized in gtkutil.c: the commit message (commit 3477e27021db) says: Author: Martin Rudalics AuthorDate: Sun Jul 27 15:21:30 2014 +0200 Commit: Martin Rudalics CommitDate: Sun Jul 27 15:21:30 2014 +0200 Complete pixelwise frame/window resizing, add horizontal scrollbar support. [...] * gtkutil.c (xg_frame_resized): Don't call do_pending_window_change. but the diff is: @@ -883,6 +884,8 @@ xg_frame_resized (struct frame *f, int pixelwidth, int pixelheight) change_frame_size (f, width, height, 0, 1, 0, 1); SET_FRAME_GARBAGED (f); cancel_mouse_face (f); + + do_pending_window_change (0); } } And my current understanding is this bug would not occur if that call were removed. The same issue applies to the change to x_set_window_size, but I'm not certain about removing either call. On Sun, Aug 30, 2015 at 3:27 PM, Pip Cet wrote: > I forgot to make clear that I verified with gdb that args[0] == > Vtimer_list. And if there's anything else you would like me to debug, > please let me know. It's very unfortunate I can't reproduce it with emacs > -Q and I realize that makes it impossible for you to deal with this bug > except through information I provide. > > Thanks for trying anyway, > Pip > > On Sun, Aug 30, 2015 at 3:24 PM, Pip Cet wrote: > >> >> >> On Sun, Aug 30, 2015 at 3:01 PM, Eli Zaretskii wrote: >> >>> > Date: Sun, 30 Aug 2015 12:51:26 +0000 >>> > From: Pip Cet >>> > Somehow, the argument to Fcopy_sequence was changed while concat was >>> > underway. >>> >>> How do you see that? >>> >> >> I originally concluded it was the only way to trigger the bug, but I just >> managed to trigger it again and have it open in a GDB session: >> >> #1 0x00000000005efdb3 in concat (nargs=1, args=0x7fffffff76e8, >> target_type=Lisp_Cons, last_special=false) at fns.c:747 >> 747 XSETCAR (tail, elt); >> (gdb) p result_len >> $22 = 4 >> (gdb) p debug_print(Flength(args[0])) >> 5 >> $23 = void >> (gdb) >> >> >>> > Further investigation indicates that >>> > window-configuration-change-hook was called in the middle of concat: >>> >>> Did you understand how this fact is related to the segfault? >>> >> >> I _think_ I do. >> >> 1. concat called with args[0] == Vtimer_list >> 2. concat stores result_len (=4) >> 3. concat calls make_list (4) >> 4. make_list interrupted by QUIT >> 5. see stack trace >> 6. window-configuration-change-hook modifies Vtimer_list, which now has >> length 5 >> 7. control returns to concat >> 8. concat tries to write 5 elements into a 4-element list, which causes >> the segfault because `tail' is unexpectedly NULL. >> >> Does that make sense to you? >> >> Thanks, >> Pip >> > > --001a1144ac34e1e77f051e89c12a Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
I think the problem is the call to do_pending_wi= ndow_change in xg_frame_resized in gtkutil.c: the commit message (commit 34= 77e27021db) says:

Author:=C2=A0=C2=A0=C2=A0=C2=A0 Martin Rudalics &l= t;rudalics@gmx.at&= gt;
AuthorDate: Sun Jul 27 15:21:30 2014 +0200
Commit:=C2=A0=C2=A0=C2= =A0=C2=A0 Martin Rudalics <rudalics@gmx.at>
CommitDate: Sun Jul 27 15:21:30 2014 +02= 00

=C2=A0=C2=A0=C2=A0 Complete pixelwise frame/window resizing, add = horizontal scrollbar support.
=C2=A0=C2=A0=C2=A0 [...]
=C2=A0=C2=A0= =C2=A0 * gtkutil.c (xg_frame_resized): Don't call
=C2=A0=C2=A0=C2=A0= do_pending_window_change.

but the diff is:

@@ -883,6 += 884,8 @@ xg_frame_resized (struct frame *f, int pixelwidth, int pixelheight= )
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 change_frame_size (f, width, heig= ht, 0, 1, 0, 1);
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 SET_FRAME_GARBAGED= (f);
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 cancel_mouse_face (f);
++=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 do_pending_window_change (0);
=C2=A0= =C2=A0=C2=A0=C2=A0 }
=C2=A0}

And my current= understanding is this bug would not occur if that call were removed. The s= ame issue applies to the change to x_set_window_size, but I'm not certa= in about removing either call.
On Sun, Aug 30, 2015 at 3:27 PM, Pip Cet <pipc= et@gmail.com> wrote:
I forgot to make clear that I verified with gdb that a= rgs[0] =3D=3D Vtimer_list. And if there's anything else you would like = me to debug, please let me know. It's very unfortunate I can't repr= oduce it with emacs -Q and I realize that makes it impossible for you to de= al with this bug except through information I provide.

Thanks = for trying anyway,
Pip

On Sun, A= ug 30, 2015 at 3:24 PM, Pip Cet <pipcet@gmail.com> wrote:
=


On Sun, Aug 30, 2015 at 3:01 PM, E= li Zaretskii <eliz@gnu.org> wrote:
> Date: Sun, 30 Aug 2015 12:51:26= +0000
> From: Pip Cet <pipcet@gmail.com>
 > Somehow, the argument to Fcopy_sequence was changed while concat was > underway.

How do you see that?

I originall= y concluded it was the only way to trigger the bug, but I just managed to t= rigger it again and have it open in a GDB session:

=
#1=C2=A0 0x00000000005efdb3 in concat (nargs=3D1, args=3D0x7fffffff76e= 8, target_type=3DLisp_Cons, last_special=3Dfalse) at fns.c:747
747=C2=A0= =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 XSETCAR (tail, elt);
(gdb) p res= ult_len
$22 =3D 4
(gdb) p debug_print(Flength(args[0]))
5
$23 = =3D void
(gdb)
=C2=A0
> Further investigation indicates that
> window-configuration-change-hook was called in the middle of concat:
Did you understand how this fact is related to the segfault?

I _think_ I do.

1= . concat called with args[0] =3D=3D Vtimer_list
2. concat sto= res result_len (=3D4)
3. concat calls make_list (4)
=
4. make_list interrupted by QUIT
5. see stack trace
<= /div>
6. window-configuration-change-hook modifies Vtimer_list, which n= ow has length 5
7. control returns to concat
8.= concat tries to write 5 elements into a 4-element list, which causes the s= egfault because `tail' is unexpectedly NULL.

Does that make sense to you?

Thanks,
Pip=


--001a1144ac34e1e77f051e89c12a--