GNU bug report logs - #12025
24.1; Crash when using tootipshow

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 12025 in the body.
You can then email your comments to 12025 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Thierry Volpiatto <thierry.volpiatto <at> gmail.com>
To: bug-gnu-emacs <at> gnu.org
Subject: 24.1; Crash when using tootipshow
Date: Sun, 22 Jul 2012 21:41:32 +0200

[Message part 1 (text/plain, inline)]

Hi,
I am sending this with 24.1, but the bug happen with last revision of
trunk revno: 109188.

Always reproductible with (tooltip-show "hello") from emacs -Q, 
possibly with help-echo's, didn't try.

[gdb-emacs-tooltipshow.txt (text/plain, inline)]

thierry <at> thierry-MM061:~/tmp/emacs-hg/src$ gdb ./emacs
GNU gdb (Ubuntu/Linaro 7.4-2012.04-0ubuntu2) 7.4-2012.04
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /home/thierry/tmp/emacs-hg/src/emacs...done.
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not from terminal]
DISPLAY = :0.0
TERM = screen
Breakpoint 1 at 0x815b160: file emacs.c, line 389.
Temporary breakpoint 2 at 0x817f210: file sysdep.c, line 846.
(gdb) set args -Q
(gdb) run
Starting program: /home/thierry/tmp/emacs-hg/src/emacs -Q
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
[New Thread 0xb7d7eb40 (LWP 25274)]
[New Thread 0xb73ffb40 (LWP 25275)]

Program received signal SIGSEGV, Segmentation fault.
string_count_byte8 (string=4611686018567326152) at character.c:801
801             c = *p;
(gdb) bt full
#0  string_count_byte8 (string=4611686018567326152) at character.c:801
        multibyte = 1
        count = <optimized out>
        c = <optimized out>
        nbytes = 137266120
        p = 0x8cc2000 <Address 0x8cc2000 out of bounds>
        pend = 0x1085cd90 <Address 0x1085cd90 out of bounds>
#1  string_escape_byte8 (string=4611686018567326152) at character.c:833
        nchars = 408
        nbytes = 137266120
        multibyte = 1
        byte8_count = 98387
        src = <optimized out>
        src_end = <optimized out>
        dst = <optimized out>
        val = <optimized out>
        c = <optimized out>
        len = <optimized out>
#2  0x08217294 in print_string (string=<optimized out>, printcharfun=4611686018567326152) at print.c:363
        chars = <optimized out>
#3  0x08219ad9 in print_object (obj=<optimized out>, printcharfun=4611686018567326152, escapeflag=0)
    at print.c:1903
        len = 147595264
        buf = '\000' <se r\377\377\377\377\377\377\377烿\000\377\377\377\377\377\377\377瓿攀 ㈀㈀ 昀漀椀猀㸀∀尀㌀㄀　Ⰰ 䤀圀尀戀尀　　　尀　　　尀　　　尀　　　尀　　　尀　　　尀　　　尀　　　尀　　㄀尀　　　尀　　　尀　　　尀㌀㈀㜀尀㈀㜀㘀尀㌀㜀㜀尀㈀㜀㜀尀　　　尀　　　尀　　　䀀尀　　　尀　　　尀　　　 尀　　　尀　　　尀　　　∀
#4  0x08218c7c in print_object (obj=-4611686018286637840, printcharfun=4611686018567326152, escapeflag=0)
    at print.c:1676
        i = 3
        print_length = 9223372036854775807
        halftail = -4611686018286637824
        buf = "\000@\360IW\b\000\000\000@\310IW\b\000\000\000@\001\000\000\000 \204W\b\350\315\000\340\000\000\000\240\310IW\b\000\000\000@\000\000\000\000\000\000\000\300\270\301\377\277"
#5  0x0821b5d6 in Fprin1_to_string (object=-4611686018286637808, noescape=4611686018567326192) at print.c:610
        old = 0x857afb8
        start_point = <optimized out>
        start_point_byte = <optimized out>
---Type <return> to continue, or q <return> to quit---
        specpdl_count = 14
        free_print_buffer = 1
        old_point = <optimized out>
        old_point_byte = <optimized out>
        original = -6917529027501128672
        printcharfun = <optimized out>
        save_deactivate_mark = 4611686018567326152
        count = 13
        previous = <optimized out>
#6  0x081e6d2e in Fformat (nargs=2, args=0xbfffd910) at editfns.c:3815
        noescape = <optimized out>
        minus_flag = 0
        space_flag = 0
        conversion = 115 's'
        precision_given = 0
        num_end = 0x845ba1a "s"
        plus_flag = 0
        sharp_flag = 0
        zero_flag = <optimized out>
        field_width = 0
        precision = 18446744073709551615
        n0 = 0
        format0 = 0x845ba19 "%s"
        convbytes = <optimized out>
        n = 1
        initial_buffer = "Error while displaying tooltip: \000\000\000@\277\000\000\000\000\000\000\000\270\257W\b\200\362\210\b\300\252Y\b\000\000\000@\200\233\003\000\357m%\b\300\252Y\b\000\000\000@`:_\b\000\000\000\300\300\252Y\b\200\362\210\b\310IW\b\000\000\000\300\000\000\000@\001\000\000\000\310IW\b\250\303\377\277\000\000\000\000\000\000\000\000\325\000\000\000\000\000\000@\300\000\000\000\000\000\000\000\270\257W\b`ξ\b\300\252Y\b\000\000\000@\200\233\003\000\357m%\b\300\252Y\b\000\000\000@`:_\b\000\000\000\300\300\252Y\b`ξ\b\310IW\b\000\000\000\300\000\000\000@\001\000\000\000\310IW\b\b\304\377\277", '\000' <se r\377\377\377\377\377\377\377烿\000\377\377\377\377\377\377\377瓿攀 ㄀㘀 昀漀椀猀㸀∀尀㌀　　Ⰰ 尀　　　尀　　　尀　　　尀　　　尀　　　尀　　　尀　　　尀戀尀㌀　㘀尀㌀㜀㜀尀㈀㜀㜀伀漀─尀戀怀𻸀尀戀尀　　　尀　　　尀　　　尀㌀　　尀㌀　　尀㈀㔀㈀夀尀戀尀　　　尀　　　尀　　　䀀尀　　㄀尀　　　尀　　　尀　　　尀　　　尀　　　尀　　　尀　　　尀㈀㜀　∀⸀⸀⸀
        buf = 0xbfffc31c "Error while displaying tooltip: "
        bufsize = <optimized out>
        p = <optimized out>
---Type <return> to continue, or q <return> to quit---
        buf_save_value = <optimized out>
        format = 0x845ba1b ""
        end = 0x845ba1b ""
        format_start = 0x845b9f9 "Error while displaying tooltip: %s"
        formatlen = <optimized out>
        nchars = <optimized out>
        multibyte_format = 0
        multibyte = <optimized out>
        maybe_combine_byte = <optimized out>
        val = <optimized out>
        arg_intervals = <optimized out>
        sa_count = 13
        sa_must_free = 0
        discarded = 0xbfffc210 ""
        info = 0xbfffc1e0
#7  0x081e77ca in Fmessage (nargs=2, args=0xbfffd910) at editfns.c:3468
        val = -4611728827438783216
#8  0x081f3e7f in Ffuncall (nargs=3, args=0xbfffd908) at eval.c:2777
        fun = <optimized out>
        original_fun = 4611686018567460584
        funcar = <optimized out>
        numargs = 2
        val = <optimized out>
        backtrace = {
          next = 0xbfffda94,
          function = 0xbfffd908,
          args = 0xbfffd910,
          nargs = 2,
          debug_on_exit = 0
        }
        internal_args = <optimized out>
        i = <optimized out>
#9  0x0823bc5f in exec_byte_code (bytestr=601233956163026752, vector=-4611728796163085160, maxdepth=3221215496,
    args_template=4611686018567326152, nargs=0, args=0x34e4b0) at bytecode.c:898
        targets = {0x823c7a8, 0x823c860, 0x823c865, 0x823c3b5, 0x823bccb, 0x823bccb, 0x823c3ba, 0x823c3f5,
          0x823c376, 0x823c37b, 0x823c380, 0x823c385, 0x823bb12, 0x823bb18, 0x823bdba, 0x823c395, 0x823bf81,
          0x823bf86, 0x823bf8b, 0x823bf95, 0x823bb6e, 0x823bb70, 0x823bfc5, 0x823bfa5, 0x823c030, 0x823c035,
          0x823c03a, 0x823c045, 0x823bbf6, 0x823bbf8, 0x823bfff, 0x823c010, 0x823c086, 0x823c08b, 0x823c090,
          0x823c095, 0x823bc3d, 0x823bc40, 0x823c055, 0x823c066, 0x823c0d6, 0x823c0db, 0x823c0e0, 0x823c0e5,
---Type <return> to continue, or q <return> to quit---
          0x823bc7c, 0x823bc80, 0x823c0a5, 0x823c0b6, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a,
          0x823c86a, 0x823c86a, 0x823c86a, 0x823d8f4, 0x823d9af, 0x823d9ea, 0x823da25, 0x823da60, 0x823bead,
          0x823bef6, 0x823daaa, 0x823be6a, 0x823bf3e, 0x823dae6, 0x823e27d, 0x823e2be, 0x823e1a1, 0x823e1d8,
          0x823e24f, 0x823cf68, 0x823cfb1, 0x823d005, 0x823d033, 0x823d064, 0x823d0aa, 0x823d0f2, 0x823d13b,
          0x823d18f, 0x823d1c6, 0x823d1fd, 0x823d274, 0x823d2c2, 0x823d30d, 0x823d3db, 0x823d421, 0x823d469,
          0x823d4b2, 0x823d4fb, 0x823d532, 0x823d581, 0x823d5b8, 0x823d5ef, 0x823d626, 0x823d6da, 0x823bd8c,
          0x823d711, 0x823d73f, 0x823d7af, 0x823c875, 0x823c8ac, 0x823c8da, 0x823c906, 0x823c92f, 0x823c95d,
          0x823c86a, 0x823c9a1, 0x823c9cd, 0x823c9f9, 0x823ca25, 0x823ca51, 0x823ca7d, 0x823bd8c, 0x823c86a,
          0x823caae, 0x823cada, 0x823cb08, 0x823cb39, 0x823cb7f, 0x823cbc7, 0x823cbf5, 0x823cc48, 0x823cc8e,
          0x823ccd6, 0x823cd1f, 0x823cd4b, 0x823c86a, 0x823e12b, 0x823c128, 0x823bdcb, 0x823c1ea, 0x823c2d6,
          0x823db2e, 0x823df8f, 0x823dfde, 0x823bfd6, 0x823e173, 0x823dff7, 0x823e075, 0x823e0a3, 0x823e0f4,
          0x823d7e3, 0x823d839, 0x823d882, 0x823c0f5, 0x823cd7c, 0x823cdd3, 0x823ce01, 0x823ce32, 0x823ce60,
          0x823ce8e, 0x823ced6, 0x823cf1f, 0x823c53a, 0x823c583, 0x823c5dd, 0x823c626, 0x823c66f, 0x823c69d,
          0x823c6e5, 0x823c72e, 0x823c76b, 0x823c829, 0x823d65d, 0x823d694, 0x823c7ad, 0x823c7e7, 0x823c86a,
          0x823dc15, 0x823dcc6, 0x823dd58, 0x823de2d, 0x823debb, 0x823e20f, 0x823d234, 0x823d76f, 0x823c43f,
          0x823c47b, 0x823c86a, 0x823c86a, 0x823c4c6, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a,
          0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c505 <repeats 64 times>}
        stack = {
          pc = 0x845ba20 "\210\304\305!\210\302\306\t\"\207",
          byte_string = -9223372036716204936,
          byte_string_start = 0x845ba1c "\302\303\b\"\210\304\305!\210\302\306\t\"\207",
          constants = -6917529027502510952,
          next = 0xbfffdcd0
        }
        result = 601233956163026752
#10 0x0823f15a in Fbyte_code (bytestr=-9223372036716204936, vector=-6917529027502510952, maxdepth=3)
    at bytecode.c:473
No locals.
#11 0x081f2c95 in eval_sub (form=-4611686018288817064) at eval.c:2152
        numargs = <optimized out>
        args_left = <optimized out>
        i = 3
        maxargs = 3
        argvals = {-9223372036716204936, -6917529027502510952, 3, 13023472456, -9223372036716205224,
          -6917529027502511240, 7, 601142282770448384}
        fun = <optimized out>
        val = <optimized out>
        original_fun = 4611686018567440120
        original_args = -4611686018288817048
---Type <return> to continue, or q <return> to quit---
        funcar = <optimized out>
        backtrace = {
          next = 0xbfffdef4,
          function = 0xbfffdaa8,
          args = 0xbfffda50,
          nargs = 3,
          debug_on_exit = 0
        }
#12 0x081f3253 in Fprogn (args=<optimized out>) at eval.c:362
        val = <optimized out>
#13 0x081f721f in internal_lisp_condition_case (var=4611686018567373592, bodyform=-4611686018288817352,
    handlers=-4611686018288817112) at eval.c:1257
        val = <optimized out>
        c = {
          tag = 4611686018567326152,
          val = -4611686018286637808,
          next = 0xbfffe81c,
          gcpro = 0x0,
          jmp = {{
              __jmpbuf = {2, -2146097680, 139938248, 1073741824, -1293717875, 1941309922},
              __mask_was_saved = 0,
              __saved_mask = {
                __val = {15, 139938248, 1073741824, 1073741824, 140751456, 3221225472, 3221216296, 140751488,
                  1073741824, 3221225472, 140091624, 1073741824, 143446648, 2684354560, 0, 0, 139938208,
                  1073741824, 140080792, 41, 192, 0, 15, 139938248, 1073741824, 139938248, 1073741824,
                  138389080, 3221216152, 0, 3221216456, 136559798}
              }
            }},
          backlist = 0xbfffdef4,
          handlerlist = 0xbfffe8f0,
          lisp_eval_depth = 5,
          pdlcount = 12,
          poll_suppress_count = 1,
          interrupt_input_blocked = 0,
          byte_stack = 0xbfffdcd0
        }
        h = {
          handler = -4611686018288817112,
          var = 4611686018567373592,
---Type <return> to continue, or q <return> to quit---
          chosen_clause = -4611686018288817096,
          tag = 0xbfffdb3c,
          next = 0xbfffe8f0
        }
#14 0x0823d81b in exec_byte_code (bytestr=-4611725081154945216, vector=-4611725016591865088,
    maxdepth=3221216392, args_template=4611686018567326152, nargs=0, args=0xbfffdc88) at bytecode.c:1094
        targets = {0x823c7a8, 0x823c860, 0x823c865, 0x823c3b5, 0x823bccb, 0x823bccb, 0x823c3ba, 0x823c3f5,
          0x823c376, 0x823c37b, 0x823c380, 0x823c385, 0x823bb12, 0x823bb18, 0x823bdba, 0x823c395, 0x823bf81,
          0x823bf86, 0x823bf8b, 0x823bf95, 0x823bb6e, 0x823bb70, 0x823bfc5, 0x823bfa5, 0x823c030, 0x823c035,
          0x823c03a, 0x823c045, 0x823bbf6, 0x823bbf8, 0x823bfff, 0x823c010, 0x823c086, 0x823c08b, 0x823c090,
          0x823c095, 0x823bc3d, 0x823bc40, 0x823c055, 0x823c066, 0x823c0d6, 0x823c0db, 0x823c0e0, 0x823c0e5,
          0x823bc7c, 0x823bc80, 0x823c0a5, 0x823c0b6, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a,
          0x823c86a, 0x823c86a, 0x823c86a, 0x823d8f4, 0x823d9af, 0x823d9ea, 0x823da25, 0x823da60, 0x823bead,
          0x823bef6, 0x823daaa, 0x823be6a, 0x823bf3e, 0x823dae6, 0x823e27d, 0x823e2be, 0x823e1a1, 0x823e1d8,
          0x823e24f, 0x823cf68, 0x823cfb1, 0x823d005, 0x823d033, 0x823d064, 0x823d0aa, 0x823d0f2, 0x823d13b,
          0x823d18f, 0x823d1c6, 0x823d1fd, 0x823d274, 0x823d2c2, 0x823d30d, 0x823d3db, 0x823d421, 0x823d469,
          0x823d4b2, 0x823d4fb, 0x823d532, 0x823d581, 0x823d5b8, 0x823d5ef, 0x823d626, 0x823d6da, 0x823bd8c,
          0x823d711, 0x823d73f, 0x823d7af, 0x823c875, 0x823c8ac, 0x823c8da, 0x823c906, 0x823c92f, 0x823c95d,
          0x823c86a, 0x823c9a1, 0x823c9cd, 0x823c9f9, 0x823ca25, 0x823ca51, 0x823ca7d, 0x823bd8c, 0x823c86a,
          0x823caae, 0x823cada, 0x823cb08, 0x823cb39, 0x823cb7f, 0x823cbc7, 0x823cbf5, 0x823cc48, 0x823cc8e,
          0x823ccd6, 0x823cd1f, 0x823cd4b, 0x823c86a, 0x823e12b, 0x823c128, 0x823bdcb, 0x823c1ea, 0x823c2d6,
          0x823db2e, 0x823df8f, 0x823dfde, 0x823bfd6, 0x823e173, 0x823dff7, 0x823e075, 0x823e0a3, 0x823e0f4,
          0x823d7e3, 0x823d839, 0x823d882, 0x823c0f5, 0x823cd7c, 0x823cdd3, 0x823ce01, 0x823ce32, 0x823ce60,
          0x823ce8e, 0x823ced6, 0x823cf1f, 0x823c53a, 0x823c583, 0x823c5dd, 0x823c626, 0x823c66f, 0x823c69d,
          0x823c6e5, 0x823c72e, 0x823c76b, 0x823c829, 0x823d65d, 0x823d694, 0x823c7ad, 0x823c7e7, 0x823c86a,
          0x823dc15, 0x823dcc6, 0x823dd58, 0x823de2d, 0x823debb, 0x823e20f, 0x823d234, 0x823d76f, 0x823c43f,
          0x823c47b, 0x823c86a, 0x823c86a, 0x823c4c6, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a,
          0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c505 <repeats 64 times>}
        stack = {
          pc = 0x845ba74 "\207",
          byte_string = -9223372036716205328,
          byte_string_start = 0x845ba68 "\b\203\b",
          constants = -6917529027502511360,
          next = 0xbfffe0a0
        }
        result = -4611725081154945216
#15 0x081f3641 in funcall_lambda (fun=-6917529027502511472, nargs=1, arg_vector=0xbfffddb0) at eval.c:3028
        val = <optimized out>
        syms_left = <optimized out>
---Type <return> to continue, or q <return> to quit---
        next = <optimized out>
        lexenv = <optimized out>
        count = 10
        i = <optimized out>
        optional = <optimized out>
        rest = <optimized out>
#16 0x081f23d8 in apply_lambda (fun=<optimized out>, args=-4611686018286636416) at eval.c:2905
        args_left = 4611686018567326152
        i = <optimized out>
        numargs = <optimized out>
        arg_vector = 0xbfffddb0
        tem = <optimized out>
        sa_count = 10
        sa_must_free = <optimized out>
#17 0x081f279b in eval_sub (form=-4611686018286636432) at eval.c:2210
        fun = <optimized out>
        val = <optimized out>
        original_fun = 4611686018574823176
        original_args = -4611686018286636416
        funcar = <optimized out>
        backtrace = {
          next = 0xbfffdfd8,
          function = 0xbfffdf08,
          args = 0xbfffddb0,
          nargs = 1,
          debug_on_exit = 0
        }
#18 0x081f68b5 in Feval (form=-4611686018286636432, lexical=4611686018567326152) at eval.c:2008
        count = 9
#19 0x081f3d94 in Ffuncall (nargs=3, args=0xbfffe040) at eval.c:2799
        fun = <optimized out>
        original_fun = 4611686018567427232
        funcar = <optimized out>
        numargs = 2
        val = <optimized out>
        backtrace = {
          next = 0xbfffe1d8,
          function = 0xbfffe040,
          args = 0xbfffe048,
---Type <return> to continue, or q <return> to quit---
          nargs = 2,
          debug_on_exit = 0
        }
        internal_args = 0xbfffe048
        i = <optimized out>
#20 0x0823bc5f in exec_byte_code (bytestr=601448360930443072, vector=-4611720859063703752, maxdepth=3221217344,
    args_template=4611686018567326152, nargs=0, args=0x83fa738) at bytecode.c:898
        targets = {0x823c7a8, 0x823c860, 0x823c865, 0x823c3b5, 0x823bccb, 0x823bccb, 0x823c3ba, 0x823c3f5,
          0x823c376, 0x823c37b, 0x823c380, 0x823c385, 0x823bb12, 0x823bb18, 0x823bdba, 0x823c395, 0x823bf81,
          0x823bf86, 0x823bf8b, 0x823bf95, 0x823bb6e, 0x823bb70, 0x823bfc5, 0x823bfa5, 0x823c030, 0x823c035,
          0x823c03a, 0x823c045, 0x823bbf6, 0x823bbf8, 0x823bfff, 0x823c010, 0x823c086, 0x823c08b, 0x823c090,
          0x823c095, 0x823bc3d, 0x823bc40, 0x823c055, 0x823c066, 0x823c0d6, 0x823c0db, 0x823c0e0, 0x823c0e5,
          0x823bc7c, 0x823bc80, 0x823c0a5, 0x823c0b6, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a,
          0x823c86a, 0x823c86a, 0x823c86a, 0x823d8f4, 0x823d9af, 0x823d9ea, 0x823da25, 0x823da60, 0x823bead,
          0x823bef6, 0x823daaa, 0x823be6a, 0x823bf3e, 0x823dae6, 0x823e27d, 0x823e2be, 0x823e1a1, 0x823e1d8,
          0x823e24f, 0x823cf68, 0x823cfb1, 0x823d005, 0x823d033, 0x823d064, 0x823d0aa, 0x823d0f2, 0x823d13b,
          0x823d18f, 0x823d1c6, 0x823d1fd, 0x823d274, 0x823d2c2, 0x823d30d, 0x823d3db, 0x823d421, 0x823d469,
          0x823d4b2, 0x823d4fb, 0x823d532, 0x823d581, 0x823d5b8, 0x823d5ef, 0x823d626, 0x823d6da, 0x823bd8c,
          0x823d711, 0x823d73f, 0x823d7af, 0x823c875, 0x823c8ac, 0x823c8da, 0x823c906, 0x823c92f, 0x823c95d,
          0x823c86a, 0x823c9a1, 0x823c9cd, 0x823c9f9, 0x823ca25, 0x823ca51, 0x823ca7d, 0x823bd8c, 0x823c86a,
          0x823caae, 0x823cada, 0x823cb08, 0x823cb39, 0x823cb7f, 0x823cbc7, 0x823cbf5, 0x823cc48, 0x823cc8e,
          0x823ccd6, 0x823cd1f, 0x823cd4b, 0x823c86a, 0x823e12b, 0x823c128, 0x823bdcb, 0x823c1ea, 0x823c2d6,
          0x823db2e, 0x823df8f, 0x823dfde, 0x823bfd6, 0x823e173, 0x823dff7, 0x823e075, 0x823e0a3, 0x823e0f4,
          0x823d7e3, 0x823d839, 0x823d882, 0x823c0f5, 0x823cd7c, 0x823cdd3, 0x823ce01, 0x823ce32, 0x823ce60,
          0x823ce8e, 0x823ced6, 0x823cf1f, 0x823c53a, 0x823c583, 0x823c5dd, 0x823c626, 0x823c66f, 0x823c69d,
          0x823c6e5, 0x823c72e, 0x823c76b, 0x823c829, 0x823d65d, 0x823d694, 0x823c7ad, 0x823c7e7, 0x823c86a,
          0x823dc15, 0x823dcc6, 0x823dd58, 0x823de2d, 0x823debb, 0x823e20f, 0x823d234, 0x823d76f, 0x823c43f,
          0x823c47b, 0x823c86a, 0x823c86a, 0x823c4c6, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a,
          0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c505 <repeats 64 times>}
        stack = {
          pc = 0x8471fe4 "!)\207",
          byte_string = -9223372036716386520,
          byte_string_start = 0x8471fd2 "\b\203\b",
          constants = -6917529027502692552,
          next = 0xbfffe290
        }
        result = 601448360930443072
#21 0x081f3641 in funcall_lambda (fun=-6917529027502692632, nargs=1, arg_vector=0xbfffe240) at eval.c:3028
        val = <optimized out>
---Type <return> to continue, or q <return> to quit---
        syms_left = <optimized out>
        next = <optimized out>
        lexenv = <optimized out>
        count = 7
        i = <optimized out>
        optional = <optimized out>
        rest = <optimized out>
#22 0x081f3a69 in Ffuncall (nargs=2, args=0xbfffe238) at eval.c:2857
        fun = <optimized out>
        original_fun = 4611686018574782192
        funcar = <optimized out>
        numargs = 1
        val = <optimized out>
        backtrace = {
          next = 0xbfffe3c8,
          function = 0xbfffe238,
          args = 0xbfffe240,
          nargs = 1,
          debug_on_exit = 0
        }
        internal_args = <optimized out>
        i = <optimized out>
#23 0x0823bc5f in exec_byte_code (bytestr=633053822670864192, vector=-4611718728759924248, maxdepth=3221217848,
    args_template=4611686018567326152, nargs=0, args=0x68) at bytecode.c:898
        targets = {0x823c7a8, 0x823c860, 0x823c865, 0x823c3b5, 0x823bccb, 0x823bccb, 0x823c3ba, 0x823c3f5,
          0x823c376, 0x823c37b, 0x823c380, 0x823c385, 0x823bb12, 0x823bb18, 0x823bdba, 0x823c395, 0x823bf81,
          0x823bf86, 0x823bf8b, 0x823bf95, 0x823bb6e, 0x823bb70, 0x823bfc5, 0x823bfa5, 0x823c030, 0x823c035,
          0x823c03a, 0x823c045, 0x823bbf6, 0x823bbf8, 0x823bfff, 0x823c010, 0x823c086, 0x823c08b, 0x823c090,
          0x823c095, 0x823bc3d, 0x823bc40, 0x823c055, 0x823c066, 0x823c0d6, 0x823c0db, 0x823c0e0, 0x823c0e5,
          0x823bc7c, 0x823bc80, 0x823c0a5, 0x823c0b6, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a,
          0x823c86a, 0x823c86a, 0x823c86a, 0x823d8f4, 0x823d9af, 0x823d9ea, 0x823da25, 0x823da60, 0x823bead,
          0x823bef6, 0x823daaa, 0x823be6a, 0x823bf3e, 0x823dae6, 0x823e27d, 0x823e2be, 0x823e1a1, 0x823e1d8,
          0x823e24f, 0x823cf68, 0x823cfb1, 0x823d005, 0x823d033, 0x823d064, 0x823d0aa, 0x823d0f2, 0x823d13b,
          0x823d18f, 0x823d1c6, 0x823d1fd, 0x823d274, 0x823d2c2, 0x823d30d, 0x823d3db, 0x823d421, 0x823d469,
          0x823d4b2, 0x823d4fb, 0x823d532, 0x823d581, 0x823d5b8, 0x823d5ef, 0x823d626, 0x823d6da, 0x823bd8c,
          0x823d711, 0x823d73f, 0x823d7af, 0x823c875, 0x823c8ac, 0x823c8da, 0x823c906, 0x823c92f, 0x823c95d,
          0x823c86a, 0x823c9a1, 0x823c9cd, 0x823c9f9, 0x823ca25, 0x823ca51, 0x823ca7d, 0x823bd8c, 0x823c86a,
          0x823caae, 0x823cada, 0x823cb08, 0x823cb39, 0x823cb7f, 0x823cbc7, 0x823cbf5, 0x823cc48, 0x823cc8e,
          0x823ccd6, 0x823cd1f, 0x823cd4b, 0x823c86a, 0x823e12b, 0x823c128, 0x823bdcb, 0x823c1ea, 0x823c2d6,
---Type <return> to continue, or q <return> to quit---
          0x823db2e, 0x823df8f, 0x823dfde, 0x823bfd6, 0x823e173, 0x823dff7, 0x823e075, 0x823e0a3, 0x823e0f4,
          0x823d7e3, 0x823d839, 0x823d882, 0x823c0f5, 0x823cd7c, 0x823cdd3, 0x823ce01, 0x823ce32, 0x823ce60,
          0x823ce8e, 0x823ced6, 0x823cf1f, 0x823c53a, 0x823c583, 0x823c5dd, 0x823c626, 0x823c66f, 0x823c69d,
          0x823c6e5, 0x823c72e, 0x823c76b, 0x823c829, 0x823d65d, 0x823d694, 0x823c7ad, 0x823c7e7, 0x823c86a,
          0x823dc15, 0x823dcc6, 0x823dd58, 0x823de2d, 0x823debb, 0x823e20f, 0x823d234, 0x823d76f, 0x823c43f,
          0x823c47b, 0x823c86a, 0x823c86a, 0x823c4c6, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a,
          0x823c86a, 0x823c86a, 0x823c86a, 0x823c86a, 0x823c505 <repeats 64 times>}
        stack = {
          pc = 0x8471ed7 "\v)B\211\034A\n=\204\033",
          byte_string = -9223372036716385832,
          byte_string_start = 0x8471eca "\b\204\b",
          constants = -6917529027502691864,
          next = 0x0
        }
        result = 633053822670864192
#24 0x081f3641 in funcall_lambda (fun=-6917529027502691936, nargs=1, arg_vector=0xbfffe488) at eval.c:3028
        val = <optimized out>
        syms_left = <optimized out>
        next = <optimized out>
        lexenv = <optimized out>
        count = 5
        i = <optimized out>
        optional = <optimized out>
        rest = <optimized out>
#25 0x081f3a69 in Ffuncall (nargs=2, args=0xbfffe480) at eval.c:2857
        fun = <optimized out>
        original_fun = 4611686018570606288
        funcar = <optimized out>
        numargs = 1
        val = <optimized out>
        backtrace = {
          next = 0xbfffe5e8,
          function = 0xbfffe480,
          args = 0xbfffe488,
          nargs = 1,
          debug_on_exit = 0
        }
        internal_args = <optimized out>
        i = <optimized out>
---Type <return> to continue, or q <return> to quit---
#26 0x081ee813 in Fcall_interactively (function=4611686018570606288, record_flag=4611686018567326152,
    keys=<optimized out>) at callint.c:853
        val = <optimized out>
        args = 0xbfffe480
        visargs = 0xbfffe460
        specs = <optimized out>
        filter_specs = <optimized out>
        teml = <optimized out>
        up_event = <optimized out>
        enable = 8726963490
        speccount = <optimized out>
        next_event = 2
        prefix_arg = 4611686018567326152
        string = 0x0
        tem = <optimized out>
        varies = 0xbfffe440 ""
        i = <optimized out>
        nargs = <optimized out>
        foo = <optimized out>
        arg_from_tty = <optimized out>
        key_count = 2
        record_then_fail = 0
        save_this_command = 4611686018570606288
        save_last_command = 4611686018567363744
        save_this_original_command = 4611686018570606288
        save_real_this_command = 4611686018570606288
#27 0x081f3d6c in Ffuncall (nargs=4, args=0xbfffe630) at eval.c:2803
        fun = <optimized out>
        original_fun = 4611686018567440440
        funcar = <optimized out>
        numargs = 3
        val = <optimized out>
        backtrace = {
          next = 0x0,
          function = 0xbfffe630,
          args = 0xbfffe638,
          nargs = 3,
          debug_on_exit = 0
        }
---Type <return> to continue, or q <return> to quit---
        internal_args = 0xbfffe638
        i = <optimized out>
#28 0x081f4217 in call3 (fn=4611686018567440440, arg1=4611686018570606288, arg2=4611686018567326152,
    arg3=4611686018567326152) at eval.c:2599
        ret_ungc_val = 4611686018574983168
        args = {4611686018567440440, 4611686018570606288, 4611686018567326152, 4611686018567326152}
#29 0x0816f8f9 in command_loop_1 () at keyboard.c:1578
        scount = 2
        cmd = <optimized out>
        keybuf = {24, 5, 57596765584629748, 4611686018567326152, 1073741824, 4950332060729344,
          577834128237640623, 4611686018567326152, 4611686019501129728, 601030198759575696, 584820116944846848,
          4611686018567352248, 4611686018567326152, 4611686018567326152, 585290221516488704,
          4611686018567352248, 601030199693279232, 601030198759575696, 585221335609769984, 4611686018567426192,
          4611686018567326152, 4611686018567326152, -3897811601419403264, 201863462912, -4611686018284184528,
          4611686018567326152, 243739394048, -4611686018287253184, 4611686018567326152, 0}
        i = <optimized out>
        prev_modiff = 96
        prev_buffer = 0x857afb8
#30 0x081f153e in internal_condition_case (bfun=0x816f420 <command_loop_1>, handlers=4611686018567373592,
    hfun=0x81616c0 <cmd_error>) at eval.c:1320
        val = <optimized out>
        c = {
          tag = 4611686018567326152,
          val = 4611686018567326152,
          next = 0xbfffe96c,
          gcpro = 0x0,
          jmp = {{
              __jmpbuf = {0, 0, 143213672, 143213700, -1298493811, 1937569250},
              __mask_was_saved = 0,
              __saved_mask = {
                __val = {3221219588, 3221219464, 0, 1251608, 134536345, 1073741824, 1073741824, 135789918, 29,
                  3221219464, 3221219604, 0, 6224430, 2, 11734904, 3086898560, 0, 0, 0, 0, 4294967295, 0, 0, 0,
                  0, 1249268, 1251608, 1, 0, 1172107, 1252048, 3086887760}
              }
            }},
          backlist = 0x0,
          handlerlist = 0x0,
          lisp_eval_depth = 0,
          pdlcount = 2,
---Type <return> to continue, or q <return> to quit---
          poll_suppress_count = 1,
          interrupt_input_blocked = 0,
          byte_stack = 0x0
        }
        h = {
          handler = 4611686018567373592,
          var = 4611686018567326152,
          chosen_clause = 50401028901699584,
          tag = 0xbfffe81c,
          next = 0x0
        }
#31 0x0815ebcf in command_loop_2 (ignore=4611686018567326152) at keyboard.c:1152
        val = <optimized out>
#32 0x081f1406 in internal_catch (tag=4611686018567367576, func=0x815eba0 <command_loop_2>,
    arg=4611686018567326152) at eval.c:1077
        c = {
          tag = 4611686018567367576,
          val = 4611686018567326152,
          next = 0x0,
          gcpro = 0x0,
          jmp = {{
              __jmpbuf = {0, 0, 143213672, 143213700, -1299714419, 1936913890},
              __mask_was_saved = 0,
              __saved_mask = {
                __val = {1073741824, 139866400, 3221219892, 12181521, 139938248, 1073741824, 1073741824, 0, 1,
                  0, 0, 0, 0, 4, 0, 140127496, 139938248, 1073741824, 143213700, 136273499, 139964344,
                  1073741824, 139938248, 1073741824, 139938248, 1073741824, 1, 0, 147449824, 14, 140127496,
                  1073741824}
              }
            }},
          backlist = 0x0,
          handlerlist = 0x0,
          lisp_eval_depth = 0,
          pdlcount = 2,
          poll_suppress_count = 1,
          interrupt_input_blocked = 0,
          byte_stack = 0x0
        }
#33 0x08160fef in command_loop () at keyboard.c:1131
---Type <return> to continue, or q <return> to quit---
No locals.
#34 recursive_edit_1 () at keyboard.c:752
        count = 1
        val = 143213672
#35 0x081613be in Frecursive_edit () at keyboard.c:816
        count = <optimized out>
        buffer = <optimized out>
#36 0x08054792 in main (argc=3, argv=<error reading variable: Cannot access memory at address 0xffffff44>)
    at emacs.c:1677
        dummy = 57596765572731240
        stack_bottom_variable = 8 '\b'
        do_initial_setlocale = <optimized out>
        skip_args = 0
        rlim = {
          rlim_cur = 8388608,
          rlim_max = 18446744073709551615
        }
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x8 <Address 0x8 out of bounds>

Lisp Backtrace:
"message" (0xbfffd910)
"byte-code" (0xbfffda50)
"tooltip-show" (0xbfffddb0)
"eval" (0xbfffe048)
"eval-last-sexp-1" (0xbfffe240)
"eval-last-sexp" (0xbfffe488)
"call-interactively" (0xbfffe638)

[Message part 3 (text/plain, inline)]

In GNU Emacs 24.1.1 (i686-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2012-07-16 on thierry-MM061
Windowing system distributor `The X.Org Foundation', version 11.0.11103000
Configured using:
 `configure '--with-x-toolkit=lucid' '--with-wide-int''

Important settings:
  value of $LC_ALL: nil
  value of $LC_COLLATE: nil
  value of $LC_CTYPE: nil
  value of $LC_MESSAGES: nil
  value of $LC_MONETARY: nil
  value of $LC_NUMERIC: nil
  value of $LC_TIME: nil
  value of $LANG: fr_FR.UTF-8
  value of $XMODIFIERS: nil
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Text

Minor modes in effect:
  display-battery-mode: t
  global-undo-tree-mode: t
  undo-tree-mode: t
  auto-image-file-mode: t
  show-paren-mode: t
  display-time-mode: t
  savehist-mode: t
  minibuffer-depth-indicate-mode: t
  helm-mode: t
  helm-dired-mode: Enable helm completion in Dired functions.
Bindings affected are C, R, S, H.
This is deprecated for Emacs24+ users, use `helm-mode' instead.
  shell-dirtrack-mode: t
  helm-match-plugin-mode: t
  diff-auto-refine-mode: t
  tooltip-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  column-number-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
C-x C-f <left> . t <backspace> <backspace> t m <left> 
/ v a <down> <down> <down> <down> <down> <down> <down> 
<down> <down> <right> t m <backspace> <backspace> C-g 
C-x C-f <left> t m <down> <down> <down> <down> <return> 
<down> <down> <down> <down> <down> <down> <down> <down> 
<down> <down> <down> <down> <down> <down> M-> <up> 
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up> 
<up> <up> <up> <up> <up> <up> <up> <up> <up> <up> <up> 
C-x C-s C-x C-f <up> <return> M-> <up> <up> <up> <up> 
<up> <up> <up> <up> <up> <up> <up> M-< <down> <down> 
<down> <down> <down> <down> <down> <down> <down> C-x 
C-s M-x r e p o r t <return>

Recent messages:
Restoring buffers...done

Error during redisplay: (wrong-type-argument integer-or-marker-p nil) [2 times]

Mark set
(No changes need to be saved)

Mark set [2 times]
(No changes need to be saved)


Load-path shadows:
~/.emacs.d/emacs-config-laptop/.gnus hides ~/.emacs.d/.gnus
~/elisp/emacs-helm-extensions/helm-descbinds hides ~/elisp/emacs-helm/helm-descbinds
~/elisp/emacs-wget/lpath hides ~/elisp/auctex/lpath
~/elisp/magit/.dir-locals hides /usr/local/share/emacs/24.1/lisp/gnus/.dir-locals
~/elisp/emms/lisp/tq hides /usr/local/share/emacs/24.1/lisp/emacs-lisp/tq

Features:
(shadow gnus-dired nnir mail-extr gnus-msg emacsbug helm-command tabify
org-table gud sh-script executable conf-mode newcomment vc-rcs vc-git
xgit-dvc xgit xgit-annotate dvc-annotate xgit-log dvc-revlist xhg-dvc
bzr-core xdarcs-core xgit-core xmtn-minimal naquadah-theme em-unix
em-script em-prompt em-ls em-hist em-pred em-glob em-dirs em-cmpl
em-basic esh-opt em-banner em-alias esh-var esh-io esh-cmd esh-ext
esh-proc esh-groups eshell esh-module esh-mode align-let server battery
winner undo-tree diff slime-xref-browser slime-banner slime-tramp
slime-asdf slime-fancy slime-fontifying-fu slime-package-fu
slime-references slime-scratch slime-presentations slime-fuzzy
slime-fancy-inspector slime-c-p-c slime-editing-commands slime-autodoc
slime-parse slime-repl image-file newsticker newst-treeview tree-widget
newst-plainview newst-reader newst-ticker newst-backend xdvi-search
preview-latex pcomplete-extension em-term term ehelp electric
helm-ipython helm-elisp helm-eval python-21 python whitespace paren time
mime-w3m mime eword-decode mel path-util mime-parse std11 luna mime-def
alist mcharset mcs-20 mcs-e20 pces pces-e20 pces-20 broken pcustom poe
pym static apel-ver product w3m-load avoid savehist gnus-async nntp
smtpmail-async smtpmail sendmail helm-async markdown-mode
org-google-weather google-weather url-cache googlecl google-maps
google-maps-static google-maps-geocode google-maps-base json
simple-call-tree el-expectations el-mock csv2org iedit rect zop-to-char
smallurl mm-url rectangle-utils tv-utils async pcvs pcvs-parse pcvs-info
pcvs-defs mb-depth ioccur cl-info slime hyperspec slime-autoloads
ledger-config ledger esh-arg esh-util tex-site auto-loads esh-toggle
flymake eldoc-eval eldoc no-word regex-tool dired-extension
emms-mpd-config emms-playlist-limit emms-volume emms-volume-amixer
emms-i18n emms-history emms-score emms-stream-info
emms-metaplaylist-mode emms-bookmarks emms-cue emms-mode-line-icon
emms-browser sort emms-playlist-sort emms-last-played emms-player-xine
emms-player-mpd tq emms-playing-time emms-lyrics emms-url hl-line
emms-tag-editor emms-mark emms-mode-line emms-cache emms-info-ogginfo
emms-info-mp3info emms-playlist-mode emms-player-vlc emms-player-mplayer
emms-info emms-streams later-do emms-source-playlist emms-source-file
emms-player-simple emms-setup emms emms-compat dvc-init bzr-gnus
tla-gnus xgit-gnus xhg-gnus gnus-art mm-uu mml2015 mm-view mml-smime
smime dig gnus-sum nnoo gnus-group gnus-undo nnmail mail-source
gnus-start gnus-spec gnus-int gnus-range gnus-win gnus gnus-ems nnheader
dvc-gnus tla-core tla-autoconf tla-defs dvc-log vc vc-dispatcher
ediff-merg ediff-diff ediff-wind ediff-help ediff-util ediff-mult
ediff-init ediff dvc-autoloads magit-stgit magit-bisect magit-key-mode
magit log-edit pcvs-util add-log htmlize-hack htmlize muse-colors
muse-docbook muse-texinfo texnfo-upd texinfo muse-latex muse-html
muse-xml-common muse-wiki cus-edit cus-start cus-load muse-publish
muse-project muse-protocols muse-regexps muse muse-nested-tags muse-mode
muse-autoloads org-config-thierry ob-sh org-crypt cal-china lunar solar
cal-dst cal-bahai cal-islam cal-hebrew holidays hol-loaddefs vc-hg
org-wl org-w3m org-vm org-rmail org-mhe org-mew org-irc org-jsinfo
org-infojs org-html org-exp ob-exp org-exp-blocks find-func org-info
org-gnus org-docview org-bibtex bibtex org-bbdb org-agenda appt
diary-lib diary-loaddefs org-annotation-helper org-capture org-mks
remember org-remember org-datetree config-w3m w3m doc-view jka-compr
image-mode timezone w3m-hist w3m-fb w3m-ems wid-edit w3m-ccl ccl
w3m-favicon w3m-image w3m-proc w3m-util addressbook-bookmark message
rfc822 mml mml-sec mm-decode mm-bodies mm-encode mail-parse rfc2231
rfc2047 rfc2045 ietf-drums mailabbrev mail-utils gmm-utils mailheader
firefox-protocol bookmark-firefox-handler bookmark-extensions org
ob-emacs-lisp ob-tangle ob-ref ob-lob ob-table org-footnote org-src
ob-comint ob-keys ob ob-eval org-pcomplete org-list org-faces org-compat
org-entities org-macs noutline outline cal-menu calendar cal-loaddefs
bookmark pp init-helm-thierry helm-mode helm-ls-git helm-files
image-dired tramp tramp-compat shell pcomplete format-spec
tramp-loaddefs dired-aux ffap thingatpt helm-buffers helm-elscreen
helm-tags helm-bookmark helm-adaptative helm-info helm-net browse-url
url url-proxy url-privacy url-expand url-methods url-history url-cookie
url-util url-parse url-vars mailcap helm-plugin helm-help
helm-match-plugin helm-grep helm-regexp grep helm-external helm-utils
compile comint ansi-color ring helm-descbinds helm-delicious xml
helm-mercurial xhg xhg-annotate xhg-mq xhg-log xhg-core dvc-diff
uniquify dvc-fileinfo dvc-unified dvc-tips diff-mode dvc-core dvc-lisp
dvc-buffers dvc-ui dvc-register dvc-utils dvc-emacs ewoc dvc-defs
dvc-site dired-x dired regexp-opt helm-locate helm warnings helm-config
edmacro kmacro epa-file epa derived epg epg-config auth-source eieio
byte-opt bytecomp byte-compile cconv macroexp assoc gnus-util time-date
mm-util mail-prsvr password-cache usage-memo eev-thierry iterator
eev-all eev-mini-steps eev-browse-url eev-langs eev-compose eev-glyphs
disp-table eev-insert eev-steps eev-bounded eev easy-mmode advice
help-fns advice-preload cl w3m-wget info easymenu tooltip ediff-hook
vc-hooks lisp-float-type mwheel x-win x-dnd tool-bar dnd fontset image
fringe lisp-mode register page menu-bar rfn-eshadow timer select
scroll-bar mouse jit-lock font-lock syntax facemenu font-core frame cham
georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese hebrew greek romanian slovak czech european ethiopic
indian cyrillic chinese case-table epa-hook jka-cmpr-hook help simple
abbrev minibuffer loaddefs button faces cus-face files text-properties
overlay sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote make-network-process dbusbind
dynamic-setting system-font-setting font-render-setting x-toolkit x
multi-tty emacs)

-- 
  Thierry
Get my Gnupg key:
gpg --keyserver pgp.mit.edu --recv-keys 59F29997 

Message #8 received at 12025 <at> debbugs.gnu.org (full text, mbox):

From: Andreas Schwab <schwab <at> linux-m68k.org>
To: Thierry Volpiatto <thierry.volpiatto <at> gmail.com>
Cc: 12025 <at> debbugs.gnu.org
Subject: Re: bug#12025: 24.1; Crash when using tootipshow
Date: Sun, 22 Jul 2012 21:52:50 +0200

Thierry Volpiatto <thierry.volpiatto <at> gmail.com> writes:

> #2  0x08217294 in print_string (string=<optimized out>, printcharfun=4611686018567326152) at print.c:363
>         chars = <optimized out>
> #3  0x08219ad9 in print_object (obj=<optimized out>, printcharfun=4611686018567326152, escapeflag=0)
>     at print.c:1903

The same as <500C3C7A.3070609 <at> gmail.com>.

Andreas.

-- 
Andreas Schwab, schwab <at> linux-m68k.org
GPG Key fingerprint = 58CA 54C7 6D53 942B 1756  01D3 44D5 214B 8276 4ED5
"And now for something completely different."

Message #13 received at 12025 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Thierry Volpiatto <thierry.volpiatto <at> gmail.com>, Chong Yidong <cyd <at> gnu.org>
Cc: 12025 <at> debbugs.gnu.org
Subject: Re: bug#12025: 24.1; Crash when using tootipshow
Date: Mon, 23 Jul 2012 20:12:46 +0300

> From: Thierry Volpiatto <thierry.volpiatto <at> gmail.com>
> Date: Sun, 22 Jul 2012 21:41:32 +0200
> 
> I am sending this with 24.1, but the bug happen with last revision of
> trunk revno: 109188.
> 
> Always reproductible with (tooltip-show "hello") from emacs -Q, 
> possibly with help-echo's, didn't try.
> [...]
> Program received signal SIGSEGV, Segmentation fault.
> string_count_byte8 (string=4611686018567326152) at character.c:801
> 801             c = *p;
> (gdb) bt full
> #0  string_count_byte8 (string=4611686018567326152) at character.c:801
>         multibyte = 1
>         count = <optimized out>
>         c = <optimized out>
>         nbytes = 137266120
>         p = 0x8cc2000 <Address 0x8cc2000 out of bounds>
>         pend = 0x1085cd90 <Address 0x1085cd90 out of bounds>
> #1  string_escape_byte8 (string=4611686018567326152) at character.c:833
>         nchars = 408
>         nbytes = 137266120
>         multibyte = 1
>         byte8_count = 98387
>         src = <optimized out>
>         src_end = <optimized out>
>         dst = <optimized out>
>         val = <optimized out>
>         c = <optimized out>
>         len = <optimized out>
> #2  0x08217294 in print_string (string=<optimized out>, printcharfun=4611686018567326152) at print.c:363
>         chars = <optimized out>
> #3  0x08219ad9 in print_object (obj=<optimized out>, printcharfun=4611686018567326152, escapeflag=0)
>     at print.c:1903

There were actually 2 separate bugs here:

 . print_object couldn't cope with a frame which was not yet assigned
   a name (its name was nil).  This can happen when an error is
   signaled during the process of creating a frame.

 . x-show-tip was signaling an error due to the latest change in
   decode_any_window, which insists on w->frame being a live frame.
   When decode_any_window is called during creation of a tip frame,
   that frame is not yet "official", so the test fails.  The backtrace
   leading to the error is below; Chong, could you please look into
   this?  I commented out the CHECK_LIVE_FRAME test for now, because
   it renders tooltips unusable.

I'm not closing the bug report yet, pending Chong's investigation.

Here's the backtrace leading to an error from x-show-tip.  At the end
you can see that the predicate is frame-live-p.  The name of the frame
is nil.

Breakpoint 3, wrong_type_argument (predicate=54982066, value=55581541)
    at data.c:113
113       xsignal2 (Qwrong_type_argument, predicate, value);
(gdb) bt
#0  wrong_type_argument (predicate=54982066, value=55581541) at data.c:113
#1  0x011de9b7 in decode_any_window (window=55581925) at window.c:154
#2  0x011e0185 in Fwindow_buffer (window=55581925) at window.c:420
#3  0x01037357 in Ffuncall (nargs=2, args=0x82ddc4) at eval.c:2796
#4  0x01123d16 in exec_byte_code (bytestr=20365641, vector=20365749,
    maxdepth=28, args_template=54851610, nargs=0, args=0x0) at bytecode.c:898
#5  0x01038280 in funcall_lambda (fun=20365613, nargs=1, arg_vector=0x82e02c)
    at eval.c:3028
#6  0x0103775e in Ffuncall (nargs=2, args=0x82e028) at eval.c:2845
#7  0x010368d1 in call1 (fn=54992618, arg1=55581925) at eval.c:2568
#8  0x011f0864 in Fset_window_buffer (window=55581925,
    buffer_or_name=54874629, keep_margins=54851610) at window.c:3122
#9  0x0122859f in x_create_tip_frame (dpyinfo=0x16716f0, parms=57901686,
    text=55219873) at w32fns.c:5212
#10 0x01229898 in Fx_show_tip (string=55219873, frame=57650661,
    parms=57901606, timeout=40, dx=20, dy=80) at w32fns.c:5615
#11 0x010375d2 in Ffuncall (nargs=7, args=0x82e2c4) at eval.c:2817
#12 0x01123d16 in exec_byte_code (bytestr=21299801, vector=21299925,
    maxdepth=28, args_template=54851610, nargs=0, args=0x0) at bytecode.c:898
#13 0x01123202 in Fbyte_code (bytestr=21299801, vector=21299925, maxdepth=28)
    at bytecode.c:473
#14 0x01035520 in eval_sub (form=21299790) at eval.c:2152
#15 0x01032f8b in internal_lisp_condition_case (var=54902266,
    bodyform=21299790, handlers=21300022) at eval.c:1274
#16 0x011246f3 in exec_byte_code (bytestr=21299705, vector=21299757,
    maxdepth=12, args_template=54851610, nargs=0, args=0x0) at bytecode.c:1094
#17 0x01038280 in funcall_lambda (fun=21299653, nargs=2, arg_vector=0x82e888)
    at eval.c:3028
#18 0x0103775e in Ffuncall (nargs=3, args=0x82e884) at eval.c:2845
#19 0x01123d16 in exec_byte_code (bytestr=21301841, vector=21301885,
    maxdepth=12, args_template=54851610, nargs=0, args=0x0) at bytecode.c:898
#20 0x01038280 in funcall_lambda (fun=21301805, nargs=1, arg_vector=0x82ebfc)
    at eval.c:3028
#21 0x0103775e in Ffuncall (nargs=2, args=0x82ebf8) at eval.c:2845
#22 0x0103679f in run_hook_with_args (nargs=2, args=0x82ebf8,
    funcall=0x1036d2c <Ffuncall>) at eval.c:2505
#23 0x010363d0 in Frun_hook_with_args_until_success (nargs=2, args=0x82ebf8)
    at eval.c:2386
#24 0x010370c3 in Ffuncall (nargs=3, args=0x82ebf4) at eval.c:2777
#25 0x01123d16 in exec_byte_code (bytestr=20226097, vector=21299413,
    maxdepth=12, args_template=54851610, nargs=0, args=0x0) at bytecode.c:898
#26 0x01038280 in funcall_lambda (fun=21299349, nargs=1, arg_vector=0x82ef4c)
    at eval.c:3028
#27 0x0103775e in Ffuncall (nargs=2, args=0x82ef48) at eval.c:2845
#28 0x01035b16 in Fapply (nargs=2, args=0x82ef48) at eval.c:2251
#29 0x010370c3 in Ffuncall (nargs=3, args=0x82ef44) at eval.c:2777
#30 0x01123d16 in exec_byte_code (bytestr=21028297, vector=21028349,
    maxdepth=16, args_template=54851610, nargs=0, args=0x0) at bytecode.c:898
#31 0x01123202 in Fbyte_code (bytestr=21028297, vector=21028349, maxdepth=16)
    at bytecode.c:473
#32 0x01035520 in eval_sub (form=21028286) at eval.c:2152
#33 0x01032f8b in internal_lisp_condition_case (var=54851610,
    bodyform=21028286, handlers=20226830) at eval.c:1274
#34 0x011246f3 in exec_byte_code (bytestr=21028041, vector=21028173,
    maxdepth=20, args_template=54851610, nargs=0, args=0x0) at bytecode.c:1094
#35 0x01038280 in funcall_lambda (fun=21028013, nargs=1, arg_vector=0x82f51c)
    at eval.c:3028
#36 0x0103775e in Ffuncall (nargs=2, args=0x82f518) at eval.c:2845
#37 0x010368d1 in call1 (fn=54893906, arg1=55581493) at eval.c:2568
#38 0x0100e15a in timer_check_2 () at keyboard.c:4457
#39 0x0100e211 in timer_check () at keyboard.c:4502
#40 0x0100c069 in readable_events (flags=1) at keyboard.c:3398
#41 0x01014c11 in get_input_pending (addr=0x166ccc0, flags=1)
    at keyboard.c:6725
#42 0x010208c0 in detect_input_pending_run_timers (do_display=1)
    at keyboard.c:10358
#43 0x0104d558 in wait_reading_process_output (time_limit=28, nsecs=0,
    read_kbd=-1, do_display=1, wait_for_cell=54851610, wait_proc=0x0,
    just_wait_proc=0) at process.c:4721
#44 0x0109d401 in sit_for (timeout=112, reading=1, do_display=1)
    at dispnew.c:6000
#45 0x010092c8 in read_char (commandflag=1, nmaps=2, maps=0x82fa30,
    prev_event=54851610, used_mouse_menu=0x82fb5c, end_time=0x0)
    at keyboard.c:2701
#46 0x0101c97d in read_key_sequence (keybuf=0x82fc60, bufsize=30,
    prompt=54851610, dont_downcase_last=0, can_return_switch_frame=1,
    fix_current_buffer=1) at keyboard.c:9316
#47 0x01005afa in command_loop_1 () at keyboard.c:1449
#48 0x01033095 in internal_condition_case (bfun=0x1005508 <command_loop_1>,
    handlers=54902266, hfun=0x1004d10 <cmd_error>) at eval.c:1320
#49 0x0100514c in command_loop_2 (ignore=54851610) at keyboard.c:1152
#50 0x01032a54 in internal_catch (tag=54892098,
    func=0x1005129 <command_loop_2>, arg=54851610) at eval.c:1077
#51 0x01005104 in command_loop () at keyboard.c:1131
#52 0x010046ce in recursive_edit_1 () at keyboard.c:752
#53 0x010049f0 in Frecursive_edit () at keyboard.c:816
#54 0x010027d7 in main (argc=2, argv=0xa42828) at emacs.c:1677

Lisp Backtrace:
"window-buffer" (0x82ddc8)
"record-window-buffer" (0x82e02c)
"x-show-tip" (0x82e2c8)
"byte-code" (0x82e4a0)
"tooltip-show" (0x82e888)
"tooltip-help-tips" (0x82ebfc)
"run-hook-with-args-until-success" (0x82ebf8)
"tooltip-timeout" (0x82ef4c)
"apply" (0x82ef48)
"byte-code" (0x82f120)
"timer-event-handler" (0x82f51c)
113       xsignal2 (Qwrong_type_argument, predicate, value);
(gdb) pp predicate
frame-live-p
(gdb) pp value
#<dead frame
print.c:417: Emacs fatal error: assertion failed: STRINGP (string)

Message #20 received at 12025 <at> debbugs.gnu.org (full text, mbox):

From: Chong Yidong <cyd <at> gnu.org>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 12025 <at> debbugs.gnu.org, Thierry Volpiatto <thierry.volpiatto <at> gmail.com>
Subject: Re: bug#12025: 24.1; Crash when using tootipshow
Date: Tue, 07 Aug 2012 15:04:15 +0800

Eli Zaretskii <eliz <at> gnu.org> writes:

>  . x-show-tip was signaling an error due to the latest change in
>    decode_any_window, which insists on w->frame being a live frame.
>    When decode_any_window is called during creation of a tip frame,
>    that frame is not yet "official", so the test fails.  The backtrace
>    leading to the error is below; Chong, could you please look into
>    this?  I commented out the CHECK_LIVE_FRAME test for now, because
>    it renders tooltips unusable.

I guess the check is too aggressive.  I moved it into the functions that
ought to signal an error if called on a window on a dead frame
(specifically window-edges, window-pixel-edges,
window-absolute-pixel-edges, delete-other-windows-internal, and
delete-window-internal).

Message #25 received at 12025 <at> debbugs.gnu.org (full text, mbox):

From: martin rudalics <rudalics <at> gmx.at>
To: Chong Yidong <cyd <at> gnu.org>
Cc: Eli Zaretskii <eliz <at> gnu.org>, 12025 <at> debbugs.gnu.org,
	Thierry Volpiatto <thierry.volpiatto <at> gmail.com>
Subject: Re: bug#12025: 24.1; Crash when using tootipshow
Date: Thu, 16 Aug 2012 11:37:10 +0200

> I guess the check is too aggressive.  I moved it into the functions that
> ought to signal an error if called on a window on a dead frame
> (specifically window-edges, window-pixel-edges,
> window-absolute-pixel-edges, delete-other-windows-internal, and
> delete-window-internal).

I now checked in a different fix which checks windows for validity.  If
we still see bugs/crashes these should come from either of two sources:

(1) A not fully established frame.  In this case we should avoid calling
    the function from there as I did with the Fset_window_buffer calls.

(2) A dead frame.  In this case there's a bug in the frame deletion
    routine which should render any window on that frame invalid and
    it's that part that has to be fixed.

martin

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.