bug#21428: 24.5; Crash of emacs on OS X, installed via homebrew cask

[Rainer M Krug <Rainer@krugs.de>]

[-- Attachment #1: Type: text/plain, Size: 13423 bytes --]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Rainer M Krug <Rainer@krugs.de>
>> Cc: 21428@debbugs.gnu.org,  mituharu+bug-gnu-emacs-mac@math.s.chiba-u.ac.jp
>> Date: Fri, 25 Sep 2015 14:30:05 +0200
>> 
>> ,----
>> | xdisp.c:24333: Emacs fatal error: assertion failed: face != NULL
>> | 
>> | Breakpoint 1, terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:370
>> | 370	  signal (sig, SIG_DFL);
>> | (gdb) bt
>> | #0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:370
>> | #1 0x00000001002256eb in die (msg=0x1003b680a "face != NULL",
>> | file=0x1003b24f0 "xdisp.c", line=24333) at alloc.c:6951
>> | #2 0x0000000100062f17 in get_glyph_face_and_encoding
>> | (f=0x103811830, glyph=0x103c4b060, char2b=0x7fff5fbfb310) at
>> | xdisp.c:24333
>> | #3 0x00000001000b581d in fill_glyph_string (s=0x7fff5fbfb360,
>> | face_id=50, start=34, end=71, overlaps=0) at xdisp.c:24558
>
> OK, I think I've seen enough of these for now, thanks.  It seems like
> a face is removed from the frame's face cache, but Emacs still thinks
> the face is cached and tries to use its (stale) cache slot.  The face
> is different each time, and there's nothing problematic with the face
> itself.
>
> I took a look at the code, and couldn't find any obvious way this
> could happen.  I need some way to narrow down the search.  So I need
> to ask you to try a few things, okay?
>
> First, I'd like to know whether the line of code marked below is ever
> executed:
>
>   static void
>   uncache_face (struct face_cache *c, struct face *face)
>   {
>     int i = face->hash % FACE_CACHE_BUCKETS_SIZE;
>
>     if (face->prev)
>       face->prev->next = face->next;
>     else
>       c->buckets[i] = face->next;
>
>     if (face->next)
>       face->next->prev = face->prev;
>
>     c->faces_by_id[face->id] = NULL;
>     if (face->id == c->used)
>       --c->used;  <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
>   }
>
> This is from xfaces.c, line 4322 with the current Git master.  Please
> put a breakpoint there, and run Emacs under GDB until it crashes as
> before, or until this breakpoint breaks.  If it breaks, please show
> the backtrace.

OK - Emacs crashed again (same pattern) and the breakpoint was
triggered:

,----
| xdisp.c:24333: Emacs fatal error: assertion failed: face != NULL
| 
| Breakpoint 1, terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:370
| 370	  signal (sig, SIG_DFL);
| (gdb) bt
| #0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:370
| #1  0x00000001002256fb in die (msg=0x1003b681a "face != NULL", file=0x1003b2500 "xdisp.c", line=24333) at alloc.c:6951
| #2  0x0000000100062f27 in get_glyph_face_and_encoding (f=0x10182bc30, glyph=0x11b381d60, char2b=0x7fff5fbfaf90) at xdisp.c:24333
| #3  0x00000001000b582d in fill_glyph_string (s=0x7fff5fbfafc0, face_id=27, start=18, end=41, overlaps=0) at xdisp.c:24558
| #4  0x000000010006d5d9 in draw_glyphs (w=0x10182ac30, x=152, row=0x11b1b9f00, area=TEXT_AREA, start=0, end=41, hl=DRAW_NORMAL_TEXT, overlaps=0) at xdisp.c:25225
| #5  0x000000010006cf01 in x_write_glyphs (w=0x10182ac30, updated_row=0x11b1b9f00, start=0x11b381a00, updated_area=TEXT_AREA, len=41) at xdisp.c:27256
| #6  0x0000000100011da8 in update_text_area (w=0x10182ac30, updated_row=0x11b1b9f00, vpos=29) at dispnew.c:3611
| #7  0x000000010000f962 in update_window_line (w=0x10182ac30, vpos=29, mouse_face_overwritten_p=0x7fff5fbfbdf2) at dispnew.c:3854
| #8  0x00000001000078b2 in update_window (w=0x10182ac30, force_p=true) at dispnew.c:3477
| #9  0x00000001000066bf in update_window_tree (w=0x10182ac30, force_p=true) at dispnew.c:3219
| #10 0x000000010000639b in update_frame (f=0x10182bc30, force_p=true, inhibit_hairy_id_p=false) at dispnew.c:3108
| #11 0x0000000100051fb9 in redisplay_internal () at xdisp.c:13815
| #12 0x0000000100053ad9 in redisplay () at xdisp.c:13059
| #13 0x0000000100184349 in read_char (commandflag=1, map=4819150115, prev_event=0, used_mouse_menu=0x7fff5fbfefb7, end_time=0x0) at keyboard.c:2465
| #14 0x000000010017f2a9 in read_key_sequence (keybuf=0x7fff5fbff2f0, bufsize=30, prompt=0, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:9030
| #15 0x000000010017dba6 in command_loop_1 () at keyboard.c:1348
| #16 0x0000000100260716 in internal_condition_case (bfun=0x10017d5b0 <command_loop_1>, handlers=17616, hfun=0x100198e20 <cmd_error>) at eval.c:1309
| #17 0x0000000100198d1c in command_loop_2 (ignore=0) at keyboard.c:1088
| #18 0x000000010025f7de in internal_catch (tag=42768, func=0x100198cf0 <command_loop_2>, arg=0) at eval.c:1073
| #19 0x000000010017c8f0 in command_loop () at keyboard.c:1067
| #20 0x000000010017c732 in recursive_edit_1 () at keyboard.c:673
| #21 0x000000010017cb23 in Frecursive_edit () at keyboard.c:744
| #22 0x000000010017a6ca in main (argc=1, argv=0x7fff5fbff8f0) at emacs.c:1643
| 
| Lisp Backtrace:
| "redisplay_internal (C function)" (0x0)
| (gdb) bt full
| #0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:370
| No locals.
| #1  0x00000001002256fb in die (msg=0x1003b681a "face != NULL", file=0x1003b2500 "xdisp.c", line=24333) at alloc.c:6951
| No locals.
| #2  0x0000000100062f27 in get_glyph_face_and_encoding (f=0x10182bc30, glyph=0x11b381d60, char2b=0x7fff5fbfaf90) at xdisp.c:24333
| 	face = (struct face *) 0x0
| 	code = 0
| #3  0x00000001000b582d in fill_glyph_string (s=0x7fff5fbfafc0, face_id=27, start=18, end=41, overlaps=0) at xdisp.c:24558
| 	glyph = (struct glyph *) 0x11b381d60
| 	last = (struct glyph *) 0x11b3821b0
| 	voffset = 0
| 	glyph_not_available_p = false
| #4  0x000000010006d5d9 in draw_glyphs (w=0x10182ac30, x=152, row=0x11b1b9f00, area=TEXT_AREA, start=0, end=41, hl=DRAW_NORMAL_TEXT, overlaps=0) at xdisp.c:25225
| 	face_id = 27
| 	char2b = (XChar2b *) 0x7fff5fbfaf90
| 	first_glyph = (struct glyph *) 0x11b381d60
| 	head = (struct glyph_string *) 0x7fff5fbfb6f0
| 	tail = (struct glyph_string *) 0x7fff5fbfafc0
| 	s = (struct glyph_string *) 0x7fff5fbfafc0
| 	clip_head = (struct glyph_string *) 0x0
| 	clip_tail = (struct glyph_string *) 0x0
| 	i = 18
| 	j = 1519995
| 	x_reached = 1
| 	last_x = 2537
| 	area_left = 8
| 	f = (struct frame *) 0x10182bc30
| 	sa_avail = 15992
| 	sa_count = 5
| 	sa_must_free = false
| #5  0x000000010006cf01 in x_write_glyphs (w=0x10182ac30, updated_row=0x11b1b9f00, start=0x11b381a00, updated_area=TEXT_AREA, len=41) at xdisp.c:27256
| 	x = 16779745
| 	hpos = 0
| 	chpos = 14
| #6  0x0000000100011da8 in update_text_area (w=0x10182ac30, updated_row=0x11b1b9f00, vpos=29) at dispnew.c:3611
| 	current_row = (struct glyph_row *) 0x1045aa300
| 	desired_row = (struct glyph_row *) 0x11b1b9f00
| 	rif = (struct redisplay_interface *) 0x1007d8e98
| 	changed_p = false
| #7  0x000000010000f962 in update_window_line (w=0x10182ac30, vpos=29, mouse_face_overwritten_p=0x7fff5fbfbdf2) at dispnew.c:3854
| 	current_row = (struct glyph_row *) 0x1045aa300
| 	desired_row = (struct glyph_row *) 0x11b1b9f00
| 	rif = (struct redisplay_interface *) 0x1007d8e98
| 	changed_p = false
| #8  0x00000001000078b2 in update_window (w=0x10182ac30, force_p=true) at dispnew.c:3477
| 	vpos = 29
| 	i = 783
| 	end = (struct glyph_row *) 0x11b1c0300
| 	mode_line_row = (struct glyph_row *) 0x11b1c0300
| 	header_line_row = (struct glyph_row *) 0x11b1b8200
| 	changed_p = true
| 	mouse_face_overwritten_p = false
| 	row = (struct glyph_row *) 0x11b1b9f00
| 	yb = 1402
| 	n_updated = 0
| 	desired_matrix = (struct glyph_matrix *) 0x101478110
| 	paused_p = false
| 	preempt_count = 17
| 	rif = (struct redisplay_interface *) 0x1007d8e98
| #9  0x00000001000066bf in update_window_tree (w=0x10182ac30, force_p=true) at dispnew.c:3219
| 	paused_p = false
| #10 0x000000010000639b in update_frame (f=0x10182bc30, force_p=true, inhibit_hairy_id_p=false) at dispnew.c:3108
| 	paused_p = false
| 	root_window = (struct window *) 0x10182ac30
| #11 0x0000000100051fb9 in redisplay_internal () at xdisp.c:13815
| 	gcscrollbars = false
| 	f = (struct frame *) 0x10182bc30
| 	w = (struct window *) 0x10182ac30
| 	sw = (struct window *) 0x10182ac30
| 	fr = (struct frame *) 0x10182bc30
| 	pending = false
| 	must_finish = false
| 	match_p = true
| 	tlbufpos = {
|   charpos = 774,
|   bytepos = 774
| }
| 	tlendpos = {
|   charpos = 269,
|   bytepos = 269
| }
| 	number_of_visible_frames = 1
| 	count = 2
| 	sf = (struct frame *) 0x10182bc30
| 	polling_stopped_here = true
| 	tail = 4412501059
| 	frame = 4320312373
| 	consider_all_windows_p = true
| 	update_miniwindow_p = false
| #12 0x0000000100053ad9 in redisplay () at xdisp.c:13059
| No locals.
| #13 0x0000000100184349 in read_char (commandflag=1, map=4819150115, prev_event=0, used_mouse_menu=0x7fff5fbfefb7, end_time=0x0) at keyboard.c:2465
| 	echo_current = true
| 	c = 0
| 	jmpcount = 140734799801360
| 	local_getcjmp = 0x7fff5fbfeba0
| 	save_jump = 0x7fff5fbfeb00
| 	tem = 2
| 	save = 0
| 	previous_echo_area_message = 0
| 	also_record = 0
| 	reread = false
| 	recorded = false
| 	polling_stopped_here = false
| 	orig_kboard = (struct kboard *) 0x101436bb0
| #14 0x000000010017f2a9 in read_key_sequence (keybuf=0x7fff5fbff2f0, bufsize=30, prompt=0, dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:9030
| 	interrupted_kboard = (KBOARD *) 0x101436bb0
| 	interrupted_frame = (struct frame *) 0x10182bc30
| 	key = 140734799802480
| 	used_mouse_menu = false
| 	echo_local_start = 0
| 	last_real_key_start = 0
| 	keys_local_start = 0
| 	new_binding = 1062
| 	count = 2
| 	t = 0
| 	echo_start = 0
| 	keys_start = 0
| 	current_binding = 4819150115
| 	first_event = 0
| 	first_unbound = 31
| 	mock_input = 0
| 	fkey = {
|   parent = 4337131763,
|   map = 4337131763,
|   start = 0,
|   end = 0
| }
| 	keytran = {
|   parent = 4336943683,
|   map = 4336943683,
|   start = 0,
|   end = 0
| }
| 	indec = {
|   parent = 4337131827,
|   map = 4337131827,
|   start = 0,
|   end = 0
| }
| 	shift_translated = false
| 	delayed_switch_frame = 0
| 	original_uppercase = 0
| 	original_uppercase_position = -1
| 	dummyflag = false
| 	starting_buffer = (struct buffer *) 0x112b39c90
| 	fake_prefixed_keys = 0
| #15 0x000000010017dba6 in command_loop_1 () at keyboard.c:1348
| 	cmd = 61397272
| 	keybuf = 0x7fff5fbff2f0
| 	i = 1
| 	prev_modiff = 15153
| 	prev_buffer = (struct buffer *) 0x112b39c90
| 	already_adjusted = false
| #16 0x0000000100260716 in internal_condition_case (bfun=0x10017d5b0 <command_loop_1>, handlers=17616, hfun=0x100198e20 <cmd_error>) at eval.c:1309
| 	val = 4303299704
| 	c = (struct handler *) 0x101403dc0
| #17 0x0000000100198d1c in command_loop_2 (ignore=0) at keyboard.c:1088
| 	val = 2
| #18 0x000000010025f7de in internal_catch (tag=42768, func=0x100198cf0 <command_loop_2>, arg=0) at eval.c:1073
| 	val = 0
| 	c = (struct handler *) 0x101404e60
| #19 0x000000010017c8f0 in command_loop () at keyboard.c:1067
| No locals.
| #20 0x000000010017c732 in recursive_edit_1 () at keyboard.c:673
| 	count = 1
| 	val = 0
| #21 0x000000010017cb23 in Frecursive_edit () at keyboard.c:744
| 	count = 0
| 	buffer = 0
| #22 0x000000010017a6ca in main (argc=1, argv=0x7fff5fbff8f0) at emacs.c:1643
| 	dummy = 140734799806464
| 	stack_bottom_variable = 0 '\0'
| 	do_initial_setlocale = true
| 	dumping = false
| 	skip_args = 0
| 	rlim = {
|   rlim_cur = 8720000,
|   rlim_max = 67104768
| }
| 	no_loadup = false
| 	junk = 0x0
| 	dname_arg = 0x0
| 	dname_arg2 = 0x7fff5fbff870 "\001"
| 	ch_to_dir = 0x0
| 	original_pwd = 0x0
| 
| Lisp Backtrace:
| "redisplay_internal (C function)" (0x0)
| (gdb)
`----

I am sure the crash occurs again, so please let me know what further
info you need from the next crash.



>
> If this breakpoint never breaks before another crash, please
> reconfigure Emacs like this:
>
>   CFLAGS="-ggdb3 -O0" CXXFLAGS="-ggdb3 -O0" LDFLAGS="-ggdb3" ./configure --enable-checking='yes,glyphs'
>
> then rebuild, and run it after setting these three variables to t:
>
>   inhibit-try-cursor-movement
>   inhibit-try-window-id
>   inhibit-try-window-reusing
>
> This disables some redisplay optimizations, so you might see slow
> redisplay; this is normal.  What is important is to see whether the
> crashes disappear when these variables are set to non-nil values.  If
> you run for a long time without crashes, then set these variables to
> nil, one by one, in the order they are shown above, and each time let
> Emacs run enough time for you to be sure the problem doesn't happen,
> before you proceed to the next variable.
>
> I hope these two procedures will collect data that will help me zero
> in on the problematic code.
>
> Thanks.

-- 
Rainer M. Krug, PhD (Conservation Ecology, SUN), MSc (Conservation Biology, UCT), Dipl. Phys. (Germany)

Centre of Excellence for Invasion Biology
Stellenbosch University
South Africa

Tel :       +33 - (0)9 53 10 27 44
Cell:       +33 - (0)6 85 62 59 98
Fax :       +33 - (0)9 58 10 27 44

Fax (D):    +49 - (0)3 21 21 25 22 44

email:      Rainer@krugs.de

Skype:      RMkrug

PGP: 0x0F52F982

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 454 bytes --]