GNU bug report logs - #17524
24.4.50; emacs_backtrace.txt

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 17524 in the body.
You can then email your comments to 17524 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Drew Adams <drew.adams <at> oracle.com>
To: bug-gnu-emacs <at> gnu.org
Subject: 24.4.50; emacs_backtrace.txt
Date: Sun, 18 May 2014 14:50:54 -0700 (PDT)

Exception 0xc0000005 at this address:
011f9061

Backtrace:
012012b3
01201324
010f44fa
01118ba3
01118b7e
01118bd7
010011e6
761402ff
778874fb
77849f41




In GNU Emacs 24.4.50.1 (i686-pc-mingw32)
 of 2014-04-29 on ODIEONE
Bzr revision: 117031 monnier <at> iro.umontreal.ca-20140429151607-qnkgbymwfaj5ut08
Windowing system distributor `Microsoft Corp.', version 6.1.7601
Configured using:
 `configure --prefix=/c/Devel/emacs/snapshot/trunk
 --enable-checking=yes,glyphs 'CFLAGS=-O0 -g3'
 LDFLAGS=-Lc:/Devel/emacs/lib 'CPPFLAGS=-DGC_MCHECK=1
 -Ic:/Devel/emacs/include''

Message #8 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Drew Adams <drew.adams <at> oracle.com>
To: 17524 <at> debbugs.gnu.org
Subject: RE: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Sun, 18 May 2014 14:54:22 -0700 (PDT)

Seems to be reproducible:

emacs -Q
Paste this text into *scratch* and eval it there:

(add-to-list
  'default-frame-alist
  '(font .
    "-bitstream-Courier 10 Pitch-normal-normal-normal-*-16-*-*-*-m-0-iso10646-1"))

Then `C-x 5 2' crashes Emacs.

> In GNU Emacs 24.4.50.1 (i686-pc-mingw32)
>  of 2014-04-29 on ODIEONE
> Bzr revision: 117031 monnier <at> iro.umontreal.ca-20140429151607-
> qnkgbymwfaj5ut08
> Windowing system distributor `Microsoft Corp.', version 6.1.7601
> Configured using:
>  `configure --prefix=/c/Devel/emacs/snapshot/trunk
>  --enable-checking=yes,glyphs 'CFLAGS=-O0 -g3'
>  LDFLAGS=-Lc:/Devel/emacs/lib 'CPPFLAGS=-DGC_MCHECK=1
>  -Ic:/Devel/emacs/include''

Message #11 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Michael Heerdegen <michael_heerdegen <at> web.de>
To: Drew Adams <drew.adams <at> oracle.com>
Cc: 17524 <at> debbugs.gnu.org
Subject: Re: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Mon, 19 May 2014 00:58:39 +0200

Hi,

FWIW, it doesn't crash on Debian using emacs-24 (and the font is applied
correctly).

> Seems to be reproducible:
>
> emacs -Q
> Paste this text into *scratch* and eval it there:
>
> (add-to-list
>   'default-frame-alist
>   '(font .
>     "-bitstream-Courier 10 Pitch-normal-normal-normal-*-16-*-*-*-m-0-iso10646-1"))
>
> Then `C-x 5 2' crashes Emacs.

Message #14 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Drew Adams <drew.adams <at> oracle.com>
To: Michael Heerdegen <michael_heerdegen <at> web.de>
Cc: 17524 <at> debbugs.gnu.org
Subject: RE: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Sun, 18 May 2014 16:42:16 -0700 (PDT)

> FWIW, it doesn't crash on Debian using emacs-24 (and the font is applied
> correctly).

Yes, it's probably related to the fact that I do not have that font.

With the reported 24.4 build, if I try to change the font in a 
different way, like this:

(set-face-attribute
  'default t :font
  "-bitstream-Courier 10 Pitch-normal-normal-normal-*-16-*-*-*-m-0-iso10646-1")

then I get an error saying the font is not available.  I get
the crash only with the recipe I gave, which uses
`default-frame-alist'.

(And with Emacs 24.3 I get that not-available error using either
method of changing the font.)

Message #19 received at 17524-done <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Drew Adams <drew.adams <at> oracle.com>
Cc: 17524-done <at> debbugs.gnu.org
Subject: Re: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Tue, 20 May 2014 19:30:16 +0300

> Date: Sun, 18 May 2014 14:54:22 -0700 (PDT)
> From: Drew Adams <drew.adams <at> oracle.com>
> 
> Seems to be reproducible:
> 
> emacs -Q
> Paste this text into *scratch* and eval it there:
> 
> (add-to-list
>   'default-frame-alist
>   '(font .
>     "-bitstream-Courier 10 Pitch-normal-normal-normal-*-16-*-*-*-m-0-iso10646-1"))
> 
> Then `C-x 5 2' crashes Emacs.

Fixed in revision 117131 on the emacs-24 branch.

Thanks.

Message #22 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Michael Heerdegen <michael_heerdegen <at> web.de>
Cc: 17524 <at> debbugs.gnu.org, drew.adams <at> oracle.com
Subject: Re: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Tue, 20 May 2014 19:31:32 +0300

> From: Michael Heerdegen <michael_heerdegen <at> web.de>
> Date: Mon, 19 May 2014 00:58:39 +0200
> Cc: 17524 <at> debbugs.gnu.org
> 
> FWIW, it doesn't crash on Debian using emacs-24 (and the font is applied
> correctly).

Please try with a non-existent font pattern.

I fixed the crash for w32 only, as the corresponding code in xfns.c
looks a bit different, and I have no way of testing this recipe on X.

Message #25 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Michael Heerdegen <michael_heerdegen <at> web.de>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 17524 <at> debbugs.gnu.org, drew.adams <at> oracle.com
Subject: Re: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Tue, 20 May 2014 19:22:32 +0200

[Message part 1 (text/plain, inline)]

Eli Zaretskii <eliz <at> gnu.org> writes:

> Please try with a non-existent font pattern.

Then I see it crashing.  But it doesn't crash immediately after hitting
C-x 5 2.  I get an "invalid font name" error message, and Emacs survives
some more seconds and then seems to crash after a random command,
e.g. after hitting C-SPC or <up>.

Here's a backtrace:

[bt.txt (text/plain, inline)]

#0  cache_image (f=0x1126078, img=0x1776e70) at image.c:1782
#1  lookup_image (f=f <at> entry=0x1126078, spec=spec <at> entry=12316966) at image.c:1693
#2  0x00000000005bd990 in Fimage_mask_p (spec=12316966, frame=<optimized out>) at image.c:922
#3  0x0000000000551878 in Ffuncall (nargs=<optimized out>, args=<optimized out>) at eval.c:2818
#4  0x0000000000585365 in exec_byte_code (bytestr=16204144, vector=12233266, maxdepth=12311458, 
    args_template=12065010, nargs=140737488340704, args=0x2) at bytecode.c:916
#5  0x000000000055134f in funcall_lambda (fun=10284653, nargs=nargs <at> entry=1, 
    arg_vector=arg_vector <at> entry=0x7fffffffc878) at eval.c:3049
#6  0x00000000005516ab in Ffuncall (nargs=nargs <at> entry=2, args=args <at> entry=0x7fffffffc870)
    at eval.c:2876
#7  0x00000000005519ca in call1 (fn=fn <at> entry=10284653, arg1=<optimized out>) at eval.c:2614
#8  0x0000000000558272 in mapcar1 (leni=leni <at> entry=14, vals=vals <at> entry=0x7fffffffc8e0, 
    fn=fn <at> entry=10284653, seq=seq <at> entry=19265750) at fns.c:2329
#9  0x0000000000558749 in Fmapcar (function=10284653, sequence=19265750) at fns.c:2399
#10 0x0000000000551878 in Ffuncall (nargs=<optimized out>, args=<optimized out>) at eval.c:2818
#11 0x0000000000585365 in exec_byte_code (bytestr=16204144, vector=12233266, maxdepth=12311458, 
    args_template=12065010, nargs=0, args=0x3) at bytecode.c:916
#12 0x000000000055134f in funcall_lambda (fun=10284573, nargs=nargs <at> entry=0, 
    arg_vector=arg_vector <at> entry=0x7fffffffcbb0) at eval.c:3049
#13 0x00000000005516ab in Ffuncall (nargs=1, args=0x7fffffffcba8) at eval.c:2876
#14 0x0000000000585365 in exec_byte_code (bytestr=16204144, vector=12233266, maxdepth=12311458, 
    args_template=12065010, nargs=18, args=0x1) at bytecode.c:916
#15 0x000000000055134f in funcall_lambda (fun=fun <at> entry=10284365, nargs=nargs <at> entry=1, 
    arg_vector=arg_vector <at> entry=0x7fffffffccc0) at eval.c:3049
#16 0x0000000000550844 in apply_lambda (fun=10284365, args=<optimized out>) at eval.c:2924
#17 0x0000000000550b9b in eval_sub (form=form <at> entry=12317174) at eval.c:2260
#18 0x0000000000554141 in Feval (form=12317174, lexical=<optimized out>) at eval.c:2003
#19 0x000000000054fe56 in internal_condition_case_1 (bfun=bfun <at> entry=0x4e1900 <eval_dyn>, 
    arg=arg <at> entry=12317174, handlers=<optimized out>, 
    hfun=hfun <at> entry=0x4e17e0 <menu_item_eval_property_1>) at eval.c:1378
#20 0x00000000004e9ef7 in menu_item_eval_property (sexpr=12317174) at keyboard.c:7602
#21 0x00000000004f38f7 in get_keyelt (object=<optimized out>, object <at> entry=19280358, 
    autoload=autoload <at> entry=true) at keymap.c:758
#22 0x00000000004f3c1f in access_keymap_1 (map=<optimized out>, idx=<optimized out>, 
    t_ok=t_ok <at> entry=true, noinherit=noinherit <at> entry=false, autoload=autoload <at> entry=true)
    at keymap.c:524
#23 0x00000000004f4cc3 in access_keymap (map=<optimized out>, idx=<optimized out>, 
    t_ok=t_ok <at> entry=true, noinherit=noinherit <at> entry=false, autoload=autoload <at> entry=true)
    at keymap.c:557
#24 0x00000000004eb166 in tool_bar_items (reuse=<optimized out>, nitems=nitems <at> entry=0x7fffffffcfdc)
    at keyboard.c:7993
#25 0x0000000000430c65 in update_tool_bar (f=f <at> entry=0x1126078, 
    save_match_data=save_match_data <at> entry=0) at xdisp.c:11869
#26 0x000000000044c365 in update_tool_bar (save_match_data=0, f=<optimized out>) at xdisp.c:11647
#27 prepare_menu_bars () at xdisp.c:11636
#28 redisplay_internal () at xdisp.c:13437
#29 0x000000000044da45 in redisplay_preserve_echo_area (from_where=from_where <at> entry=11)
    at xdisp.c:14028
#30 0x000000000058fa4f in wait_reading_process_output (time_limit=time_limit <at> entry=30, 
    nsecs=nsecs <at> entry=0, read_kbd=read_kbd <at> entry=-1, do_display=do_display <at> entry=true, 
    wait_for_cell=12065010, wait_proc=wait_proc <at> entry=0x0, just_wait_proc=just_wait_proc <at> entry=0)
    at process.c:4546
#31 0x000000000041f874 in sit_for (timeout=<optimized out>, reading=reading <at> entry=true, 
    display_option=display_option <at> entry=1) at dispnew.c:5805
#32 0x00000000004ec0d4 in read_char (commandflag=1, map=map <at> entry=25017254, prev_event=12065010, 
    used_mouse_menu=used_mouse_menu <at> entry=0x7fffffffe44b, end_time=end_time <at> entry=0x0)
    at keyboard.c:2809
#33 0x00000000004ed5a3 in read_key_sequence (keybuf=keybuf <at> entry=0x7fffffffe520, prompt=12065010, 
    dont_downcase_last=dont_downcase_last <at> entry=false, 
    can_return_switch_frame=can_return_switch_frame <at> entry=true, 
    fix_current_buffer=fix_current_buffer <at> entry=true, 
    prevent_redisplay=prevent_redisplay <at> entry=false, bufsize=30) at keyboard.c:9087
#34 0x00000000004ef1c0 in command_loop_1 () at keyboard.c:1452
#35 0x000000000054fd2e in internal_condition_case (bfun=bfun <at> entry=0x4eefd0 <command_loop_1>, 
    handlers=<optimized out>, hfun=hfun <at> entry=0x4e6080 <cmd_error>) at eval.c:1354
#36 0x00000000004e184e in command_loop_2 (ignore=ignore <at> entry=12065010) at keyboard.c:1177
#37 0x000000000054fc3b in internal_catch (tag=12112514, func=func <at> entry=0x4e1830 <command_loop_2>, 
    arg=12065010) at eval.c:1118
#38 0x00000000004e5ca7 in command_loop () at keyboard.c:1156
#39 recursive_edit_1 () at keyboard.c:777
#40 0x00000000004e5fbd in Frecursive_edit () at keyboard.c:848
#41 0x0000000000415ec5 in main (argc=<optimized out>, argv=0x7fffffffe878) at emacs.c:1646

[Message part 3 (text/plain, inline)]

Michael.

Message #28 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Michael Heerdegen <michael_heerdegen <at> web.de>
Cc: 17524 <at> debbugs.gnu.org, drew.adams <at> oracle.com
Subject: Re: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Tue, 20 May 2014 23:00:29 +0300

> From: Michael Heerdegen <michael_heerdegen <at> web.de>
> Cc: drew.adams <at> oracle.com,  17524 <at> debbugs.gnu.org
> Date: Tue, 20 May 2014 19:22:32 +0200
> 
> Eli Zaretskii <eliz <at> gnu.org> writes:
> 
> > Please try with a non-existent font pattern.
> 
> Then I see it crashing.  But it doesn't crash immediately after hitting
> C-x 5 2.  I get an "invalid font name" error message, and Emacs survives
> some more seconds and then seems to crash after a random command,
> e.g. after hitting C-SPC or <up>.

I think the problem is, like on Windows, that this recipe causes Emacs
to free the image cache of the single frame.  It doesn't crash
immediately because the assertion in unwind_create_frame on X is
different from that on Windows, and doesn't dereference the NULL
image_cache pointer.  But the real problem is that call to
x_free_frame_resources, which eventually calls free_frame_faces, which
decrements the image-cache refcount and frees the image cache, because
the refcount goes to zero.

So I think the X version needs the same change I made in w32fns.c in
revision 117131, modulo the changes to the assertions.  Can you try
that?  (There's a comment I added as part of the commit that explains
the problem in more detail.)

Message #31 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Michael Heerdegen <michael_heerdegen <at> web.de>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 17524 <at> debbugs.gnu.org
Subject: Re: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Wed, 21 May 2014 17:47:11 +0200

Eli Zaretskii <eliz <at> gnu.org> writes:

> Can you try that?  (There's a comment I added as part of the commit
> that explains the problem in more detail.)

I'll do my best and try it later today.

Michael.

Message #34 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Michael Heerdegen <michael_heerdegen <at> web.de>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 17524 <at> debbugs.gnu.org
Subject: Re: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Fri, 23 May 2014 00:46:45 +0200

[Message part 1 (text/plain, inline)]

Hello,

Hope I did what you meant.  This is what I tried:

[xfns.c.patch (text/x-diff, inline)]

*** /tmp/ediff3444YHS	2014-05-23 00:42:39.365203371 +0200
--- /home/micha/software/emacs/src/xfns.c	2014-05-23 00:17:59.787938756 +0200
***************
*** 2694,2699 ****
--- 2694,2710 ----
      {
  #if defined GLYPH_DEBUG && defined ENABLE_CHECKING
        struct x_display_info *dpyinfo = FRAME_DISPLAY_INFO (f);
+       
+       /* If the frame's image cache refcount is still the same as our
+ 	 private shadow variable, it means we are unwinding a frame
+ 	 for which we didn't yet call init_frame_faces, where the
+ 	 refcount is incremented.  Therefore, we increment it here, so
+ 	 that free_frame_faces, called in x_free_frame_resources
+ 	 below, will not mistakenly decrement the counter that was not
+ 	 incremented yet to account for this new frame.  */
+       if (FRAME_IMAGE_CACHE (f) != NULL
+ 	  && FRAME_IMAGE_CACHE (f)->refcount == image_cache_refcount)
+ 	FRAME_IMAGE_CACHE (f)->refcount++;
  #endif
  
        x_free_frame_resources (f);
***************
*** 2702,2708 ****
  #if defined GLYPH_DEBUG && defined ENABLE_CHECKING
        /* Check that reference counts are indeed correct.  */
        eassert (dpyinfo->reference_count == dpyinfo_refcount);
!       eassert (dpyinfo->terminal->image_cache->refcount == image_cache_refcount);
  #endif
        return Qt;
      }
--- 2713,2720 ----
  #if defined GLYPH_DEBUG && defined ENABLE_CHECKING
        /* Check that reference counts are indeed correct.  */
        eassert (dpyinfo->reference_count == dpyinfo_refcount);
!       eassert (dpyinfo->terminal->image_cache != NULL
!                && dpyinfo->terminal->image_cache->refcount == image_cache_refcount);
  #endif
        return Qt;
      }

[Message part 3 (text/plain, inline)]

Was that correct?  In any case, it crashed again:

[bt (application/octet-stream, inline)]

[Message part 5 (text/plain, inline)]

Michael.

Message #37 received at 17524 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Michael Heerdegen <michael_heerdegen <at> web.de>
Cc: 17524 <at> debbugs.gnu.org
Subject: Re: bug#17524: 24.4.50; emacs_backtrace.txt
Date: Fri, 23 May 2014 09:01:17 +0300

> From: Michael Heerdegen <michael_heerdegen <at> web.de>
> Cc: 17524 <at> debbugs.gnu.org
> Date: Fri, 23 May 2014 00:46:45 +0200
> 
> Hope I did what you meant.  This is what I tried:

Yes, that's it.  Thanks.

> Was that correct?  In any case, it crashed again:

Then I guess my crystal ball was cloudy, and someone with access to X
will have to actually debug this.

Thank you for your efforts.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.