GNU bug report logs - #18162
24.3.92; segfault on null face pointer in face_for_char

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 18162 in the body.
You can then email your comments to 18162 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Ken Raeburn <raeburn <at> permabit.com>
To: bug-gnu-emacs <at> gnu.org
Subject: 24.3.92; segfault on null face pointer in face_for_char
Date: Thu, 31 Jul 2014 19:24:13 -0400

Emacs crashed with a seg fault. I was typing into one of several X11
frames at the time, not doing anything particularly interesting as far
as I can tell. I think I was typing into the minibuffer. Unlike my other
crashes, this one doesn't seem to involve multiple displays at all; in
fact I don't think I used that session remotely since starting it.

My source is 24.3.92 plus:
 - Dmitry's patch to font.c (font_list_entities, font_matching_entity)
   to fix one of my earlier problems. 
 - Call delete_keyboard_wait_descriptor in x_connection_closed, before
   we clear dpyinfo->display.
 - Dmitry's patch to emacsclient to canonicalize the display name.

(gdb) bt
#0  0x00007f596c9fbb7b in raise (sig=<optimized out>) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:42
#1  0x0000000000519b25 in terminate_due_to_signal (sig=11, backtrace_limit=40) at emacs.c:378
#2  0x0000000000536dfe in handle_fatal_signal (sig=<optimized out>) at sysdep.c:1630
#3  0x0000000000536e63 in deliver_thread_signal (handler=0x536df0 <handle_fatal_signal>, sig=11) at sysdep.c:1604
#4  deliver_fatal_thread_signal (sig=11) at sysdep.c:1642
#5  <signal handler called>
#6  face_for_char (f=0x66f0858, face=0x0, c=8230, pos=-1, object=13137010) at fontset.c:914
#7  0x0000000000619155 in Finternal_char_font (position=<optimized out>, ch=<optimized out>) at fontset.c:1863
#8  0x00000000005a16fe in Ffuncall (nargs=<optimized out>, args=0x7fffbcddcdd8) at eval.c:2818
#9  0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=25, nargs=3, args=0x0) at bytecode.c:916
#10 0x00000000005a0f92 in funcall_lambda (fun=68493053, nargs=<optimized out>, arg_vector=0x7fffbcddcfa0) at eval.c:3049
#11 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcddcf98) at eval.c:2876
#12 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=127, nargs=2, args=0x0) at bytecode.c:916
#13 0x00000000005a0f92 in funcall_lambda (fun=55208949, nargs=<optimized out>, arg_vector=0x7fffbcddd180) at eval.c:3049
#14 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcddd178) at eval.c:2876
#15 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=20, nargs=5, args=0x0) at bytecode.c:916
#16 0x00000000005a08a2 in eval_sub (form=<optimized out>) at eval.c:2191
#17 0x000000000059f1a8 in internal_catch (tag=13137010, func=0x5a0010 <eval_sub>, arg=55280886) at eval.c:1118
#18 0x00000000005e0816 in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=140736362042152, nargs=141, args=0x0) at bytecode.c:1097
#19 0x00000000005a08a2 in eval_sub (form=<optimized out>) at eval.c:2191
#20 0x00000000005a43f9 in internal_lisp_condition_case (var=13137010, bodyform=55280758, handlers=<optimized out>) at eval.c:1323
#21 0x00000000005e0a2f in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=140736362042680, nargs=143, args=0x0) at bytecode.c:1162
#22 0x00000000005a0f92 in funcall_lambda (fun=55208901, nargs=<optimized out>, arg_vector=0x7fffbcddd710) at eval.c:3049
#23 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcddd708) at eval.c:2876
#24 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=13137010, nargs=1, args=0x0) at bytecode.c:916
#25 0x00000000005a0f92 in funcall_lambda (fun=55206941, nargs=<optimized out>, arg_vector=0x7fffbcddd8b0) at eval.c:3049
#26 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcddd8a8) at eval.c:2876
#27 0x00000000005a19a8 in call0 (fn=54172594) at eval.c:2599
#28 0x000000000059f2a2 in internal_condition_case (bfun=0x51f110 <safe_run_hooks_1>, handlers=<optimized out>, hfun=0x51cc40 <safe_run_hooks_error>) at eval.c:1354
#29 0x000000000051cbd9 in safe_run_hook_funcall (nargs=<optimized out>, args=<optimized out>) at keyboard.c:1930
#30 0x000000000059f754 in run_hook_with_args (nargs=1, args=0x7fffbcddd958, funcall=0x51cb90 <safe_run_hook_funcall>) at eval.c:2551
#31 0x000000000052030f in safe_run_hooks (hook=54172594) at keyboard.c:1947
#32 0x000000000052b3e8 in command_loop_1 () at keyboard.c:1573
#33 0x000000000059f2a2 in internal_condition_case (bfun=0x52ae70 <command_loop_1>, handlers=<optimized out>, hfun=0x5200f0 <cmd_error>) at eval.c:1354
#34 0x000000000051cc2e in command_loop_2 (ignore=<optimized out>) at keyboard.c:1177
#35 0x000000000059f1a8 in internal_catch (tag=13137010, func=0x51cc10 <command_loop_2>, arg=13137010) at eval.c:1118
#36 0x000000000051fb7c in command_loop () at keyboard.c:1148
#37 recursive_edit_1 () at keyboard.c:777
#38 0x0000000000551271 in read_minibuf (map=77373078, initial=113165873, prompt=<optimized out>, expflag=false, histvar=<optimized out>, histpos=74575237, defalt=113165969, allow_props=false, inherit_input_method=false) at minibuf.c:674
#39 0x0000000000551a76 in Fread_from_minibuffer (prompt=9342561, initial_contents=113165873, keymap=77373078, read=13137010, hist=13204834, default_value=113165969, inherit_input_method=13137010) at minibuf.c:957
#40 0x00000000005a15b8 in Ffuncall (nargs=<optimized out>, args=0x7fffbcdddd18) at eval.c:2841
#41 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=46, nargs=8, args=0x0) at bytecode.c:916
#42 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcddde80) at eval.c:2876
#43 0x000000000054e9e7 in Fcompleting_read (prompt=9342561, collection=13346450, predicate=13203650, require_match=17289890, initial_input=113165873, hist=13204834, def=113165969, inherit_input_method=13137010) at minibuf.c:1674
#44 0x00000000005a17bb in Ffuncall (nargs=<optimized out>, args=0x7fffbcdde050) at eval.c:2848
#45 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=140736362045520, nargs=8, args=0x0) at bytecode.c:916
#46 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcdde1f8) at eval.c:2876
#47 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=5, nargs=7, args=0x0) at bytecode.c:916
#48 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcdde368) at eval.c:2876
#49 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=2, nargs=5, args=0x0) at bytecode.c:916
#50 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcdde4b8) at eval.c:2876
#51 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=13137010, nargs=3, args=0x0) at bytecode.c:916
#52 0x00000000005a08a2 in eval_sub (form=<optimized out>) at eval.c:2191
#53 0x00000000005a3311 in Feval (form=9484614, lexical=<optimized out>) at eval.c:2003
#54 0x000000000059c70e in Fcall_interactively (function=13516626, record_flag=13137010, keys=13172029) at callint.c:345
#55 0x00000000005a16c6 in Ffuncall (nargs=<optimized out>, args=0x7fffbcdde818) at eval.c:2822
#56 0x00000000005e055d in exec_byte_code (bytestr=0, vector=0, maxdepth=8230, args_template=108, nargs=4, args=0x0) at bytecode.c:916
#57 0x00000000005a1324 in Ffuncall (nargs=<optimized out>, args=0x7fffbcdde970) at eval.c:2876
#58 0x00000000005a198a in call1 (fn=<optimized out>, arg1=<optimized out>) at eval.c:2614
#59 0x000000000052b3b6 in command_loop_1 () at keyboard.c:1559
#60 0x000000000059f2a2 in internal_condition_case (bfun=0x52ae70 <command_loop_1>, handlers=<optimized out>, hfun=0x5200f0 <cmd_error>) at eval.c:1354
#61 0x000000000051cc2e in command_loop_2 (ignore=<optimized out>) at keyboard.c:1177
#62 0x000000000059f1a8 in internal_catch (tag=13137010, func=0x51cc10 <command_loop_2>, arg=13137010) at eval.c:1118
#63 0x000000000051fc07 in command_loop () at keyboard.c:1156
#64 recursive_edit_1 () at keyboard.c:777
#65 0x000000000051ff55 in Frecursive_edit () at keyboard.c:848
#66 0x0000000000411a95 in main (argc=2, argv=<optimized out>) at emacs.c:1646
You can't do that without a process to debug.
(gdb) fr 6
#6  face_for_char (f=0x66f0858, face=0x0, c=8230, pos=-1, object=13137010) at fontset.c:914
914	  eassert (fontset_id_valid_p (face->fontset));
(gdb) up
#7  0x0000000000619155 in Finternal_char_font (position=<optimized out>, ch=<optimized out>) at fontset.c:1863
1863	  face_id = FACE_FOR_CHAR (f, FACE_FROM_ID (f, face_id), c, pos, Qnil);
(gdb)

The incoming face_id value was optimized out, but since "position" is
nil (from looking in the caller's frame), it should've been assigned
from lookup_basic_face(f,DEFAULT_FACE_ID), and since
Vface_remapping_alist is nil, that would just be DEFAULT_FACE_ID or 0.

c=8230 is HORIZONTAL ELLIPSIS

pos=-1

f->face_cache points to:

$22 = {
  buckets = 0x6122800, 
  f = 0x66f0858, 
  faces_by_id = 0x77a97c0, 
  size = 112, 
  used = 0, 
  menu_face_changed_p = false
}

Since "used" is 0, FACE_FROM_ID returns a null pointer, which gets
passed to FACE_FOR_CHAR and face_for_char, and the latter assumes it's
not a null pointer.

The "buckets" array (1001 entries if I read the code right) is all
null pointers. The "faces_by_id" array isn't all null, but the only
non-null entries are at indices above 90 and it looks like anything
above "used" may just be uninitialized.

The funcall_lambda in stack frame 10 appears to be calling
char-displayable-p (from the doc string filename and offset).
The funcall_lambda in stack frame 13 is calling icomplete-completions.
In frame 22 we're calling icomplete-exhibit.
In frame 25 the COMPILED_DOC_STRING slot is 0.

The recent keys typed (extracted from the recent_keys array) end with:

48, 96, 24, 28, 536871384, 536871384, 96, 24, 28, 96, 24, 18259138,
436, 468, 432, 464

536871384 is 0x8000076 or CHAR_META + v
18259138 is the symbol M-backspace

So:
M-v M-v C-x C-f C-g C-x C-f M-backspace m u l t
Then *splat*.

I do not have any recipe for reproducing this.




In GNU Emacs 24.3.92.1 (x86_64-unknown-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2014-06-27 on just-testing.permabit.com
Windowing system distributor `The X.Org Foundation', version 11.0.11103000
System Description:	Ubuntu 12.04.4 LTS

Configured using:
 `configure
 --prefix=/permabit/user/raeburn/I64/install/emacs-24.3.92.precise
 --with-x-toolkit=lucid --enable-checking'

Important settings:
  locale-coding-system: nil

Major mode: CPerl

Minor modes in effect:
  shell-dirtrack-mode: t
  rcirc-track-minor-mode: t
  display-time-mode: t
  which-function-mode: t
  icomplete-mode: t
  hideshowvis-minor-mode: t
  desktop-save-mode: t
  jabber-activity-mode: t
  tooltip-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  buffer-read-only: t
  line-number-mode: t
  transient-mark-mode: t
  hs-minor-mode: t

Recent input:
e s s SPC <M-backspace> s u b p r o c e s s SPC t o 
SPC e x e c SPC C-u C-f C-u C-f C-u C-f C-b C-u C-k 
i n SPC b a c k g r o u n d SPC h a s n ' t SPC d o 
n e SPC t h e SPC e x e c SPC y e t <M-backspace> b 
y SPC t h e SPC t i m e SPC p k i l l SPC r u n s . 
<backspace> , SPC s o SPC t h a t SPC p k i l l SPC 
o e <backspace> <backspace> d o e s n ' t SPC f i n 
d SPC t h e SPC p r o c e s s . SPC I f SPC t h a t 
' s SPC t h e SPC c a s e , SPC s l e e p i n g SPC 
a SPC f e w SPC <M-backspace> 1 <backspace> s e c o 
n d SPC o r SPC t w o SPC w o u l d SPC p r o b a b 
l y SPC f i x SPC i t . <return> I t SPC w o u l d 
SPC b e SPC k i n d SPC o f SPC w e i r d SPC f o r 
SPC t h i n g s SPC t o SPC h a p p e n SPC i n SPC 
t h a t SPC o r d e r SPC t h o u g h . <return> C-M-d 
<escape> x r e p o r t - e m <tab> <return>

Recent messages:
Message from NagiosAdmin in system-alerts <at> conference.chat.permabit.com
Mark saved where search started
Mark set
Mark saved where search started
limershein <at> chat.permabit.com is now Online
Checking spelling of RECOGNIZEABLE...
Mark set
tomj <at> chat.permabit.com is now Offline
simon <at> chat.permabit.com is now Away (I'm not here right now)
limershein <at> chat.permabit.com is now Offline

Load-path shadows:
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-festival hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-festival
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-chat hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-chat
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-bookmarks hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-bookmarks
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-ahc-presence hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-ahc-presence
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-chatbuffer hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-chatbuffer
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-roster hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-roster
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-core hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-core
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-ft-common hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-ft-common
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-presence hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-presence
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-si-server hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-si-server
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-autoloads hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-autoloads
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-truncate hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-truncate
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-ft-server hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-ft-server
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-conn hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-conn
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-sasl hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-sasl
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/fsm hides /usr/share/emacs/site-lisp/emacs-jabber/fsm
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-ft-client hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-ft-client
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-xmessage hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-xmessage
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-chatstates hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-chatstates
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-export hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-export
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-time hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-time
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-screen hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-screen
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-autoaway hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-autoaway
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-compose hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-compose
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber hides /usr/share/emacs/site-lisp/emacs-jabber/jabber
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-modeline hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-modeline
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-activity hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-activity
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/srv hides /usr/share/emacs/site-lisp/emacs-jabber/srv
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-events hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-events
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-version hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-version
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-feature-neg hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-feature-neg
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-menu hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-menu
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-history hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-history
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-avatar hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-avatar
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-muc hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-muc
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-watch hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-watch
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-xml hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-xml
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-muc-nick-completion hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-muc-nick-completion
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-alert hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-alert
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-osd hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-osd
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-ourversion hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-ourversion
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-si-client hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-si-client
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-util hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-util
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-widget hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-widget
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-vcard hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-vcard
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-keepalive hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-keepalive
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-register hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-register
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-iq hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-iq
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-awesome hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-awesome
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-browse hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-browse
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-ratpoison hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-ratpoison
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-si-common hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-si-common
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-wmii hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-wmii
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-disco hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-disco
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-search hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-search
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-keymap hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-keymap
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-gmail hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-gmail
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-socks5 hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-socks5
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-vcard-avatars hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-vcard-avatars
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-private hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-private
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-sawfish hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-sawfish
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-ahc hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-ahc
/permabit/user/raeburn/.emacs.d/elpa/jabber-20140523.153/jabber-logon hides /usr/share/emacs/site-lisp/emacs-jabber/jabber-logon
~/permabit-emacs/objdump hides /permabit/user/raeburn/elisp/objdump/objdump
~/permabit-emacs/kr-pdoc hides /permabit/user/raeburn/elisp/kr-pdoc
/permabit/user/raeburn/.emacs.d/elpa/systemtap-mode-20121209.1510/systemtap-mode hides /permabit/user/raeburn/elisp/systemtap-mode
/permabit/user/raeburn/.emacs.d/elpa/ssh-20120904.1342/ssh hides /permabit/user/raeburn/elisp/ssh
/permabit/user/raeburn/.emacs.d/elpa/edit-server-20131229.441/edit-server hides /permabit/user/raeburn/elisp/edit-server
~/permabit-emacs/c-fns hides /permabit/user/raeburn/elisp/c-fns
/permabit/user/raeburn/elisp/objdump/loaddefs hides /permabit/user/raeburn/I64/install/emacs-24.3.92.precise/share/emacs/24.3.92/lisp/loaddefs

Features:
(shadow sort mail-extr gnus-msg emacsbug sendmail gud descr-text
help-mode misearch multi-isearch face-remap shell pcomplete grep
jabber-rtt goto-addr jabber-keepalive jabber-ping jabber-bookmarks
jabber-private sasl-digest hmac-md5 hex-util mule-util bug-reference
jka-compr flyspell ispell git-commit-mode server log-edit easy-mmode
pcvs-util add-log sh-script smie executable nroff-mode make-mode
systemtap-mode cc-awk python autorevert filenotify vc-dispatcher vc-svn
vc-git rcirc hideshow cc-langs cc-mode cc-fonts cc-guess cc-menus
cc-cmds edit-server-autoloads info git-rebase-mode-autoloads
git-commit-mode-autoloads popup-autoloads ssh-autoloads
systemtap-mode-autoloads package time which-func warnings imenu
icomplete kr-stuff hideshowvis desktop frameset ses byte-opt bytecomp
byte-compile cconv unsafep browse-url edit-server gnus-demon nntp
gnus-art mm-uu mml2015 epg-config mm-view mml-smime smime password-cache
dig gnus-sum nnoo gnus-group gnus-undo nnmail mail-source gnus-start
gnus-spec gnus-int gnus-range message cl-macs rfc822 mml mml-sec
mm-decode mm-bodies mm-encode mail-parse rfc2231 rfc2047 rfc2045
ietf-drums mailabbrev gmm-utils mailheader gnus-win gnus gnus-ems
nnheader gnus-util mail-utils mm-util mail-prsvr iso-transl kr-dbus
notifications dbus kr-math jabber jabber-awesome jabber-osd jabber-wmii
jabber-xmessage jabber-festival jabber-sawfish jabber-ratpoison
jabber-screen jabber-socks5 jabber-ft-server jabber-si-server
jabber-ft-client jabber-ft-common jabber-si-client jabber-si-common
jabber-feature-neg jabber-truncate jabber-time jabber-autoaway
jabber-vcard-avatars jabber-chatstates jabber-events jabber-vcard
jabber-avatar mailcap jabber-activity jabber-watch jabber-modeline
jabber-ahc-presence jabber-ahc jabber-version jabber-ourversion
jabber-muc-nick-completion hippie-exp jabber-browse jabber-search
jabber-register jabber-roster format-spec jabber-presence time-date
assoc jabber-muc jabber-newdisco jabber-widget jabber-disco wid-edit
jabber-chat ewoc jabber-history jabber-chatbuffer jabber-alert jabber-iq
jabber-keymap jabber-core jabber-sasl sasl sasl-anonymous sasl-login
sasl-plain fsm jabber-logon jabber-conn srv dns starttls tls jabber-xml
xml jabber-menu jabber-util jabber-autoloads idutils derived thingatpt
compile comint ansi-color ring cperl-mode easymenu cc-styles cc-align
cc-engine cc-vars p4 dired kr-message-timestamp advice c-eldoc cl gv
cl-loaddefs cl-lib cc-defs eldoc help-fns timeclock tooltip electric
uniquify ediff-hook vc-hooks lisp-float-type mwheel x-win x-dnd tool-bar
dnd fontset image regexp-opt fringe tabulated-list newcomment lisp-mode
prog-mode register page menu-bar rfn-eshadow timer select scroll-bar
mouse jit-lock font-lock syntax facemenu font-core frame cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese hebrew greek romanian slovak czech european ethiopic indian
cyrillic chinese case-table epa-hook jka-cmpr-hook help simple abbrev
minibuffer nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote make-network-process
dbusbind gfilenotify dynamic-setting system-font-setting
font-render-setting x-toolkit x multi-tty emacs)

Memory information:
((conses 16 653516 77413)
 (symbols 48 50191 1)
 (miscs 40 88809 7040)
 (strings 32 99387 12399)
 (string-bytes 1 3055253)
 (vectors 16 40112)
 (vector-slots 8 1303460 94829)
 (floats 8 376 468)
 (intervals 56 41734 2747)
 (buffers 960 208)
 (heap 1024 73655 3286))

Message #8 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Ken Raeburn <raeburn <at> permabit.com>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Fri, 01 Aug 2014 08:57:35 +0300

> From: Ken Raeburn <raeburn <at> permabit.com>
> Date: Thu, 31 Jul 2014 19:24:13 -0400
> 
> (gdb) fr 6
> #6  face_for_char (f=0x66f0858, face=0x0, c=8230, pos=-1, object=13137010) at fontset.c:914
> 914	  eassert (fontset_id_valid_p (face->fontset));
> (gdb) up
> #7  0x0000000000619155 in Finternal_char_font (position=<optimized out>, ch=<optimized out>) at fontset.c:1863
> 1863	  face_id = FACE_FOR_CHAR (f, FACE_FROM_ID (f, face_id), c, pos, Qnil);
> (gdb)
> 
> The incoming face_id value was optimized out, but since "position" is
> nil (from looking in the caller's frame), it should've been assigned
> from lookup_basic_face(f,DEFAULT_FACE_ID), and since
> Vface_remapping_alist is nil, that would just be DEFAULT_FACE_ID or 0.
> 
> c=8230 is HORIZONTAL ELLIPSIS

Where did the ellipsis character come from?  Did you have some buffer
shown in that frame that could have used this character?  According to
the last keys you show below, you were typing into minibuffer, which
is unlikely to have that character.

> pos=-1
> 
> f->face_cache points to:
> 
> $22 = {
>   buckets = 0x6122800, 
>   f = 0x66f0858, 
>   faces_by_id = 0x77a97c0, 
>   size = 112, 
>   used = 0, 
>   menu_face_changed_p = false
> }
> 
> Since "used" is 0, FACE_FROM_ID returns a null pointer, which gets
> passed to FACE_FOR_CHAR and face_for_char, and the latter assumes it's
> not a null pointer.

Sounds like some code called clear_face_cache, for some reason.  Is f
at all the same frame where you were typing?  If not, the crash could
have nothing to do with what you typed, but with some background
activity on another frame.

Message #11 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Ken Raeburn <raeburn <at> permabit.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Fri, 1 Aug 2014 04:46:28 -0400

On Aug 1, 2014, at 01:57, Eli Zaretskii <eliz <at> gnu.org> wrote:
>> c=8230 is HORIZONTAL ELLIPSIS
> 
> Where did the ellipsis character come from?  Did you have some buffer
> shown in that frame that could have used this character?  According to
> the last keys you show below, you were typing into minibuffer, which
> is unlikely to have that character.

icomplete-completions checks to see if the ellipsis character is displayable or if it should use "..." instead. At the point where it does that check, it hasn't decided whether it wants to use an ellipsis yet.

> Sounds like some code called clear_face_cache, for some reason.  Is f
> at all the same frame where you were typing?  If not, the crash could
> have nothing to do with what you typed, but with some background
> activity on another frame.

Yes, the current buffer was showing a source file, and I was navigating to the parent directory, which has multiple entries starting with "mult". That window and the minibuffer window were the only contents of the frame.

There is a fair amount of background activity going on (auto-revert-mode buffers and emacs-jabber, mainly), but the only bit that might've affected the current frame might've been an update to the mode line where I've got an indicator of new jabber messages (in a different face from the default). So I'm not sure what would've cleared the cache.

Ken

Message #14 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Ken Raeburn <raeburn <at> permabit.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 18162 <18162 <at> debbugs.gnu.org>
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Fri, 1 Aug 2014 21:52:44 -0400

[Message part 1 (text/plain, inline)]

On Fri, Aug 1, 2014 at 1:57 AM, Eli Zaretskii <eliz <at> gnu.org> wrote:

> Sounds like some code called clear_face_cache, for some reason.  Is f
> at all the same frame where you were typing?  If not, the crash could
> have nothing to do with what you typed, but with some background
> activity on another frame.
>

I just ran Emacs a while under gdb, and it called clear_face_cache while I
wasn't doing anything interesting, just typing into a buffer. It happened
from in redisplay_internal when clear_face_cache_count reached 501. Its
documentation says it's used to "clear the face cache every once in a
while".

[Message part 2 (text/html, inline)]

Message #17 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Ken Raeburn <raeburn <at> permabit.com>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Sat, 02 Aug 2014 09:49:34 +0300

> Date: Fri, 1 Aug 2014 21:52:44 -0400
> From: Ken Raeburn <raeburn <at> permabit.com>
> Cc: 18162 <18162 <at> debbugs.gnu.org>
> 
> On Fri, Aug 1, 2014 at 1:57 AM, Eli Zaretskii <eliz <at> gnu.org> wrote:
> 
> > Sounds like some code called clear_face_cache, for some reason.  Is f
> > at all the same frame where you were typing?  If not, the crash could
> > have nothing to do with what you typed, but with some background
> > activity on another frame.
> >
> 
> I just ran Emacs a while under gdb, and it called clear_face_cache while I
> wasn't doing anything interesting, just typing into a buffer. It happened
> from in redisplay_internal when clear_face_cache_count reached 501. Its
> documentation says it's used to "clear the face cache every once in a
> while".

There's nothing wrong with a call to clear_face_cache.  We do this all
the time, as you have discovered.  The problem is if we try using
faces after that without first realizing the basic faces.

Message #20 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Ken Raeburn <raeburn <at> permabit.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Sat, 2 Aug 2014 06:00:34 -0400

On Aug 2, 2014, at 02:49, Eli Zaretskii <eliz <at> gnu.org> wrote:
> There's nothing wrong with a call to clear_face_cache.  We do this all
> the time, as you have discovered.  The problem is if we try using
> faces after that without first realizing the basic faces.

Okay, I guess I misread your earlier message as suggesting that that was the problem. In any case, starting from that, I've got a recipe that seems to be somewhat reliable at triggering the problem:

  emacs -Q
  M-x list-faces-display RET
Type into the scratch buffer:
  (progn (clear-face-cache t) (internal-char-font nil 8230))
Hit C-j to evaluate. This generally works the first time. Move the cursor back up to the end of the expression and hit C-j again. The second time usually crashes for me.

The use of list-faces-display came about through guesswork and it seems to help. The real trick, I think, is to get FRAME_DISPLAY_INFO(f)->n_fonts to be large enough to trigger the call to free_all_realized_faces.

Ken

Message #23 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Ken Raeburn <raeburn <at> permabit.com>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Sat, 02 Aug 2014 13:41:12 +0300

> From: Ken Raeburn <raeburn <at> permabit.com>
> Date: Sat, 2 Aug 2014 06:00:34 -0400
> Cc: 18162 <at> debbugs.gnu.org
> 
>   emacs -Q
>   M-x list-faces-display RET
> Type into the scratch buffer:
>   (progn (clear-face-cache t) (internal-char-font nil 8230))
> Hit C-j to evaluate. This generally works the first time. Move the cursor back up to the end of the expression and hit C-j again. The second time usually crashes for me.

It didn't crash for me.  But then you have a patched Emacs; do you see
the crashes with those patches reverted?

In any case, please tell the details of the crash, as I don't see it
here.

Message #26 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: raeburn <at> permabit.com
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Sat, 02 Aug 2014 15:50:48 +0300

> Date: Sat, 02 Aug 2014 13:41:12 +0300
> From: Eli Zaretskii <eliz <at> gnu.org>
> Cc: 18162 <at> debbugs.gnu.org
> 
> > From: Ken Raeburn <raeburn <at> permabit.com>
> > Date: Sat, 2 Aug 2014 06:00:34 -0400
> > Cc: 18162 <at> debbugs.gnu.org
> > 
> >   emacs -Q
> >   M-x list-faces-display RET
> > Type into the scratch buffer:
> >   (progn (clear-face-cache t) (internal-char-font nil 8230))
> > Hit C-j to evaluate. This generally works the first time. Move the cursor back up to the end of the expression and hit C-j again. The second time usually crashes for me.
> 
> It didn't crash for me.

Moreover, even if I force the call to clear_font_cache by invoking
clear-font-cache in the progn, I don't see a crash, and the use count
of the frame's face cache is not zero.

So one way of tracking this down would be to put a breakpoint in
Fclear_face_cache, and when it breaks, step through the function until
it assigns the frame pointer to 'f', and put a watchpoint on
f->face_cache->used, to see which code zeroes it.  My guess would be
that some code calls free_realized_faces (I misremembered earlier:
clear_face_cache doesn't do that).

Message #29 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Ken Raeburn <raeburn <at> permabit.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Sun, 3 Aug 2014 02:51:38 -0400

I just tested on a machine without any of the patches, and was able to reproduce the crash. I'm not sure what else about my environment is likely to be different from yours...

On Aug 2, 2014, at 08:50, Eli Zaretskii <eliz <at> gnu.org> wrote:
> Moreover, even if I force the call to clear_font_cache by invoking
> clear-font-cache in the progn, I don't see a crash, and the use count
> of the frame's face cache is not zero.
> 
> So one way of tracking this down would be to put a breakpoint in
> Fclear_face_cache, and when it breaks, step through the function until
> it assigns the frame pointer to 'f', and put a watchpoint on
> f->face_cache->used, to see which code zeroes it.  My guess would be
> that some code calls free_realized_faces (I misremembered earlier:
> clear_face_cache doesn't do that).

In the code I'm looking at, clear_face_cache can call free_all_realized_faces, but only if FRAME_DISPLAY_INFO(f)->n_fonts is larger than 10 for some frame. (And either clear_fonts_p is set, or you've made over 500 calls since the last font cache cleaning.) In my first evaluation of the lisp code I gave, the n_fonts field had the value 7; on the second evaluation it had the value 12, the cache got cleared, the null pointer was stored, and Emacs segfaulted.

I've done next to nothing with fonts and faces in Emacs source code, so I'm not sure what a good way is to drive up the number. If I run my test again without list-faces-display, the font counts I'm seeing are first 4 and then 7 for repeated evaluations, as displayed via gdb breakpoint commands. If I split the window with C-x 2 then the count goes up to 8 (new inactive mode line?). Reducing the font size (C-x -) made it jump to 14, and 15 on repeated evaluations, without triggering the problem, but when I set the font size back (C-x +) and evaluated the expression one more time, I got the crash.

Ken

Message #32 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Ken Raeburn <raeburn <at> permabit.com>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Sun, 03 Aug 2014 18:04:29 +0300

> From: Ken Raeburn <raeburn <at> permabit.com>
> Date: Sun, 3 Aug 2014 02:51:38 -0400
> Cc: 18162 <at> debbugs.gnu.org
> 
> On Aug 2, 2014, at 08:50, Eli Zaretskii <eliz <at> gnu.org> wrote:
> > Moreover, even if I force the call to clear_font_cache by invoking
> > clear-font-cache in the progn, I don't see a crash, and the use count
> > of the frame's face cache is not zero.
> > 
> > So one way of tracking this down would be to put a breakpoint in
> > Fclear_face_cache, and when it breaks, step through the function until
> > it assigns the frame pointer to 'f', and put a watchpoint on
> > f->face_cache->used, to see which code zeroes it.  My guess would be
> > that some code calls free_realized_faces (I misremembered earlier:
> > clear_face_cache doesn't do that).
> 
> In the code I'm looking at, clear_face_cache can call free_all_realized_faces, but only if FRAME_DISPLAY_INFO(f)->n_fonts is larger than 10 for some frame.

Yes, I meant clear_face_cache doesn't do that directly.  And since
free_realized_faces is called from several other places, it's best not
to assume this particular call is necessarily the culprit.

> (And either clear_fonts_p is set, or you've made over 500 calls since the last font cache cleaning.) In my first evaluation of the lisp code I gave, the n_fonts field had the value 7; on the second evaluation it had the value 12, the cache got cleared, the null pointer was stored, and Emacs segfaulted.
> 
> I've done next to nothing with fonts and faces in Emacs source code, so I'm not sure what a good way is to drive up the number. If I run my test again without list-faces-display, the font counts I'm seeing are first 4 and then 7 for repeated evaluations, as displayed via gdb breakpoint commands. If I split the window with C-x 2 then the count goes up to 8 (new inactive mode line?). Reducing the font size (C-x -) made it jump to 14, and 15 on repeated evaluations, without triggering the problem, but when I set the font size back (C-x +) and evaluated the expression one more time, I got the crash.

Does the patch below help?

=== modified file 'src/fontset.c'
--- src/fontset.c	2014-01-01 07:43:34 +0000
+++ src/fontset.c	2014-08-03 15:00:11 +0000
@@ -1860,6 +1860,8 @@ DEFUN ("internal-char-font", Finternal_c
     return Qnil;
   if (!FRAME_WINDOW_P (f))
     return Qnil;
+  if (FRAME_FACE_CACHE (f)->used == 0)
+    recompute_basic_faces (f);
   face_id = FACE_FOR_CHAR (f, FACE_FROM_ID (f, face_id), c, pos, Qnil);
   face = FACE_FROM_ID (f, face_id);
   if (face->font)

Message #35 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Ken Raeburn <raeburn <at> permabit.com>
To: Eli Zaretskii <eliz <at> gnu.org>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Thu, 7 Aug 2014 00:12:42 -0400

On Aug 3, 2014, at 11:04, Eli Zaretskii <eliz <at> gnu.org> wrote:
> Does the patch below help?

Yes, with that patch, so far I'm not able to reproduce the problem. Thanks!

Ken

Message #38 received at 18162 <at> debbugs.gnu.org (full text, mbox):

From: Eli Zaretskii <eliz <at> gnu.org>
To: Ken Raeburn <raeburn <at> permabit.com>
Cc: 18162 <at> debbugs.gnu.org
Subject: Re: bug#18162: 24.3.92; segfault on null face pointer in face_for_char
Date: Thu, 07 Aug 2014 18:19:24 +0300

> From: Ken Raeburn <raeburn <at> permabit.com>
> Date: Thu, 7 Aug 2014 00:12:42 -0400
> Cc: 18162 <at> debbugs.gnu.org
> 
> On Aug 3, 2014, at 11:04, Eli Zaretskii <eliz <at> gnu.org> wrote:
> > Does the patch below help?
> 
> Yes, with that patch, so far I'm not able to reproduce the problem. Thanks!

Thanks, committed to the emacs-24 branch.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.