GNU bug report logs - #20802
Segfault when showing non-GTK+ tooltip

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: emacs; Reported by: Tobias Getzner <tobias.getzner@HIDDEN>; dated Sat, 13 Jun 2015 09:19:02 UTC; Maintainer for emacs is bug-gnu-emacs@HIDDEN.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 15:59:06 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 11:59:06 2015
Received: from localhost ([127.0.0.1]:56026 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4tGT-0004Yl-Km
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 11:59:05 -0400
Received: from mtaout22.012.net.il ([80.179.55.172]:64029)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4tGQ-0004Y5-2n
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 11:59:03 -0400
Received: from conversion-daemon.a-mtaout22.012.net.il by
 a-mtaout22.012.net.il (HyperSendmail v2007.08) id
 <0NQ100500OE0JZ00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Tue, 16 Jun 2015 18:58:55 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout22.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ100532OE6F750@HIDDEN>;
 Tue, 16 Jun 2015 18:58:55 +0300 (IDT)
Date: Tue, 16 Jun 2015 18:58:43 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <1434468845.21431.2.camel@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: Tobias Getzner <tobias.getzner@HIDDEN>
Message-id: <83oakfmyq4.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
 <1434468845.21431.2.camel@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: rudalics@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> From: Tobias Getzner <tobias.getzner@HIDDEN>
> Date: Tue, 16 Jun 2015 17:34:05 +0200
> 
> Thanks! I built from master (34a43ba), which includes your 93ae9f4. I’m
> still seeing a segfault for the steps given above. Backtrace below.

Please run Emacs under GDB, put a breakpoint in
x_free_frame_resources, then perform your steps, and show backtrace
each time the breakpoint breaks.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 15:34:17 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 11:34:17 2015
Received: from localhost ([127.0.0.1]:55984 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4ssS-0003yV-4a
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 11:34:17 -0400
Received: from mout.gmx.net ([212.227.17.22]:50146)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z4ssP-0003xy-GI
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 11:34:14 -0400
Received: from glenalbyn.linguistics.ruhr-uni-bochum.de ([134.147.14.84]) by
 mail.gmx.com (mrgmx102) with ESMTPSA (Nemesis) id 0MWQSM-1ZcQQ01B1O-00Xec8;
 Tue, 16 Jun 2015 17:34:06 +0200
Message-ID: <1434468845.21431.2.camel@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: martin rudalics <rudalics@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>, 
 20802 <at> debbugs.gnu.org
Date: Tue, 16 Jun 2015 17:34:05 +0200
In-Reply-To: <558024F4.5090205@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:9C5aLq6Bq/T+Y5SZwrJuaVqvtdwFeOdkOgqCX6VJU+CW3YsHYPM
 TIR9yepnMtRbXVjCaX7UWN6o39DWd2mm9KxhEsyY/m9pXFCj1Z0CMVNWr7v/puJSkfEv+Rf
 ATEgh6BeWWSq9iKk1ksEKGKwOEsdyzO12QpSGbP57rnzq/lifl7lfVpp/Uxn8mPpGaMGWXi
 7wOpGpKry1W1SAlO2jqsw==
X-UI-Out-Filterresults: notjunk:1;V01:K0:vMPBw2StdF4=:p7hP0FvKl6w2eTN1EbI/oL
 54evsB0CKInugBE07vMu/Idunex3oyYCBHA8D1w0NzqJQyakM2ZbdBFThoCyEnlSEbCyZhBbs
 qVzvR8dj+VEKd4g3wg0VGS0qS3c88q9xw/P7cTGj31bv4c+t9hOdGE+Fj3Q0FZcsqcxWZBXvz
 XYSSabkaWB0chX2bf4/EgWsa7qzJjxA6TYwGtfw2yjDEl7hiW3u59Jp4jG1nvmolJi/DLgiNz
 GhGz57xw9QtHHEh9VfEYebfca4zfLR+NWtEoIC/+RcaZ7cZIc09XDhJF8Xkuq5n8B1cQeR9KI
 m0aj1yckbDoUvIFv3wZsLtOgb5xQLZxwUTw2xMqISQv/NC3hkBAvKvw2Pq1ZWJKT3QfaC9eYu
 PjwXgq9AWVqTfbKFwUuZnUil79qgkW9+V+WqpsX7pxD89aK7yVVTzu0706PfXNFzBvoYGzwGU
 ASzEPh5f62RNnijX2fc4Y/T4nk6aJfZtcENr9Q4eLWgDnKoNhJfKnsH0+ELgrHZavkLDqgoCI
 kHEtoEEfYzxCNo4DZZikQSITnVPJpnf+kaD7ipgb06jlux4HIA4RofBjOv82a8uXZrbT2Yocc
 P4tbGurAPSXkhLvapBsHZhpX6xzghcLuTJoy0LeMtRAf04iqwsNL/UbvfI2LJuEV+FpMotVqz
 qDlXn2v+PEn2kSqJ6jLk4a08pntxDWXBQnjS1JOFW55xcz7F6gzYOibzk7e+ZFKCXgfQ=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Di, 2015-06-16 at 15:30 +0200, martin rudalics wrote:
>  > This was after setting x-gtk-use-system-tooltip to nil and=20
> customizing
>  > the tooltip face to #qqq.
> [...]
>  > Program received signal SIGSEGV, Segmentation fault.
>  > cache_image (f=3D0x1170a68, img=3D<optimized out>) at image.c:1782
>  > 1782	  for (i =3D 0; i < c->used; ++i)
>=20
> This should be indeed the same segfault I saw.  Meanwhile I checked=20
> in a
> fix on trunk/master.  If you can build Emacs please try it.
>=20

Thanks! I built from master (34a43ba), which includes your 93ae9f4. I=E2=80=
=99m
still seeing a segfault for the steps given above. Backtrace below.

Best,
TG=20


Program received signal SIGSEGV, Segmentation fault.
lookup_image (f=3D0x1195480, spec=3Dspec@entry=3D16917427) at image.c:1744
1744	      cache_image (f, img);
(gdb) bt
#0  lookup_image (f=3D0x1195480, spec=3Dspec@entry=3D16917427) at image.c:1=
744
#1  0x000000000043737f in calc_pixel_width_or_height (res=3Dres@entry=3D0x7=
fffffff37c8, it=3Dit@entry=3D0x7fffffff72f0, prop=3D16917427, font=3Dfont@e=
ntry=3D0x11986c0, width_p=3Dwidth_p@entry=3Dtrue,=20
    align_to=3Dalign_to@entry=3D0x7fffffff3890) at xdisp.c:24019
#2  0x00000000004370e8 in calc_pixel_width_or_height (align_to=3D0x7fffffff=
3890, width_p=3D<optimized out>, font=3D0x11986c0, prop=3D<optimized out>, =
it=3D0x7fffffff72f0, res=3D0x7fffffff37c8) at xdisp.c:24056
#3  calc_pixel_width_or_height (res=3Dres@entry=3D0x7fffffff3838, it=3Dit@e=
ntry=3D0x7fffffff72f0, prop=3D16917347, font=3Dfont@entry=3D0x11986c0, widt=
h_p=3Dwidth_p@entry=3Dtrue, align_to=3Dalign_to@entry=3D0x7fffffff3890)
    at xdisp.c:24058
#4  0x00000000004372e6 in calc_pixel_width_or_height (align_to=3D0x7fffffff=
3890, width_p=3Dtrue, font=3D0x11986c0, prop=3D<optimized out>, it=3D0x7fff=
ffff72f0, res=3D0x7fffffff3838) at xdisp.c:23902
#5  calc_pixel_width_or_height (res=3Dres@entry=3D0x7fffffff3898, it=3Dit@e=
ntry=3D0x7fffffff72f0, prop=3D<optimized out>, font=3Dfont@entry=3D0x11986c=
0, width_p=3Dwidth_p@entry=3Dtrue, align_to=3Dalign_to@entry=3D0x7fffffff38=
90)
    at xdisp.c:24033
#6  0x000000000045b4f1 in calc_pixel_width_or_height (align_to=3D0x7fffffff=
3890, width_p=3Dtrue, font=3D0x11986c0, prop=3D<optimized out>, it=3D0x7fff=
ffff72f0, res=3D0x7fffffff3898) at xdisp.c:25909
#7  produce_stretch_glyph (it=3D0x7fffffff72f0) at xdisp.c:25910
#8  0x000000000045a415 in x_produce_glyphs (it=3D0x7fffffff72f0) at xdisp.c=
:27136
#9  0x00000000004480ee in display_line (it=3Dit@entry=3D0x7fffffff72f0) at =
xdisp.c:20223
#10 0x000000000044c6ca in try_window (window=3Dwindow@entry=3D18441365, pos=
=3D..., flags=3Dflags@entry=3D1) at xdisp.c:16889
#11 0x00000000004627d2 in redisplay_window (window=3D18441365, just_this_on=
e_p=3Djust_this_one_p@entry=3Dfalse) at xdisp.c:16362
#12 0x000000000046548b in redisplay_window_0 (window=3Dwindow@entry=3D18441=
365) at xdisp.c:14181
#13 0x000000000055765b in internal_condition_case_1 (bfun=3Dbfun@entry=3D0x=
465460 <redisplay_window_0>, arg=3D18441365, handlers=3D<optimized out>, hf=
un=3Dhfun@entry=3D0x42c260 <redisplay_window_error>) at eval.c:1372
#14 0x00000000004319df in redisplay_windows (window=3D18441365) at xdisp.c:=
14161
#15 0x0000000000452541 in redisplay_internal () at xdisp.c:13753
#16 0x000000000045469a in redisplay_preserve_echo_area (from_where=3Dfrom_w=
here@entry=3D2) at xdisp.c:14014
#17 0x000000000041d6de in Fredisplay (force=3D0) at dispnew.c:5777
#18 0x0000000000558f5e in Ffuncall (nargs=3D1, args=3Dargs@entry=3D0x7fffff=
ffc140) at eval.c:2718
#19 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D8816373, maxdepth=3D<optimized out>, args_template=3D<optimized out>, na=
rgs=3Dnargs@entry=3D1, args=3D<optimized out>, args@entry=3D0x7fffffffc140)
    at bytecode.c:919
#20 0x0000000000558ad4 in funcall_lambda (fun=3D8816340, nargs=3Dnargs@entr=
y=3D1, arg_vector=3D0x7fffffffc140, arg_vector@entry=3D0x7fffffffc2c0) at e=
val.c:2885
#21 0x0000000000558d7b in Ffuncall (nargs=3D2, args=3Dargs@entry=3D0x7fffff=
ffc2b8) at eval.c:2779
#22 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10509325, maxdepth=3D<optimized out>, args_template=3Dargs_template@entr=
y=3D0, nargs=3Dnargs@entry=3D0, args=3D<optimized out>, args@entry=3D0x0)
    at bytecode.c:919
#23 0x00000000005589af in funcall_lambda (fun=3D10509197, nargs=3Dnargs@ent=
ry=3D2, arg_vector=3Darg_vector@entry=3D0x7fffffffc4c0) at eval.c:2951
#24 0x0000000000558d7b in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffc4b8) at eval.c:2779
#25 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10511429, maxdepth=3D<optimized out>, args_template=3Dargs_template@entr=
y=3D0, nargs=3Dnargs@entry=3D0, args=3D<optimized out>, args@entry=3D0x0)
    at bytecode.c:919
#26 0x00000000005589af in funcall_lambda (fun=3D10511333, nargs=3Dnargs@ent=
ry=3D1, arg_vector=3Darg_vector@entry=3D0x7fffffffc778) at eval.c:2951
#27 0x0000000000558d7b in Ffuncall (nargs=3D2, args=3D0x7fffffffc770) at ev=
al.c:2779
#28 0x0000000000556f95 in run_hook_with_args (nargs=3D2, args=3D0x7fffffffc=
770, funcall=3D0x558ba0 <Ffuncall>) at eval.c:2529
#29 0x0000000000558e69 in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffc768) at eval.c:2698
#30 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10508605, maxdepth=3D<optimized out>, args_template=3Dargs_template@entr=
y=3D0, nargs=3Dnargs@entry=3D0, args=3D<optimized out>, args@entry=3D0x0)
    at bytecode.c:919
#31 0x00000000005589af in funcall_lambda (fun=3D10508541, nargs=3Dnargs@ent=
ry=3D1, arg_vector=3Darg_vector@entry=3D0x7fffffffca48) at eval.c:2951
#32 0x0000000000558d7b in Ffuncall (nargs=3Dnargs@entry=3D2, args=3Dargs@en=
try=3D0x7fffffffca40) at eval.c:2779
#33 0x000000000055a1f3 in Fapply (nargs=3D2, args=3D0x7fffffffca40) at eval=
.c:2293
#34 0x0000000000558e69 in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffca38) at eval.c:2698
#35 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10064605, maxdepth=3D<optimized out>, args_template=3Dargs_template@entr=
y=3D0, nargs=3Dnargs@entry=3D0, args=3D<optimized out>, args@entry=3D0x0)
    at bytecode.c:919
#36 0x00000000005589af in funcall_lambda (fun=3D10064525, nargs=3Dnargs@ent=
ry=3D1, arg_vector=3Darg_vector@entry=3D0x7fffffffcc38) at eval.c:2951
#37 0x0000000000558d7b in Ffuncall (nargs=3Dnargs@entry=3D2, args=3Dargs@en=
try=3D0x7fffffffcc30) at eval.c:2779
#38 0x000000000055904a in call1 (fn=3Dfn@entry=3D43776, arg1=3Darg1@entry=
=3D23853549) at eval.c:2573
#39 0x00000000004ee838 in timer_check_2 (idle_timers=3D<optimized out>, tim=
ers=3D<optimized out>) at keyboard.c:4536
#40 timer_check () at keyboard.c:4603
#41 0x00000000004eebe9 in readable_events (flags=3Dflags@entry=3D1) at keyb=
oard.c:3437
#42 0x00000000004f0218 in get_input_pending (flags=3Dflags@entry=3D1) at ke=
yboard.c:6821
#43 0x00000000004f2328 in detect_input_pending_run_timers (do_display=3Ddo_=
display@entry=3Dtrue) at keyboard.c:9976
#44 0x000000000059719e in wait_reading_process_output (time_limit=3Dtime_li=
mit@entry=3D30, nsecs=3D<optimized out>, nsecs@entry=3D0, read_kbd=3Dread_k=
bd@entry=3D-1, do_display=3Ddo_display@entry=3Dtrue,=20
    wait_for_cell=3Dwait_for_cell@entry=3D0, wait_proc=3Dwait_proc@entry=3D=
0x0, just_wait_proc=3D0) at process.c:5009
#45 0x00000000004221d2 in sit_for (timeout=3D<optimized out>, reading=3Drea=
ding@entry=3Dtrue, display_option=3Ddisplay_option@entry=3D1) at dispnew.c:=
5748
#46 0x00000000004f48a4 in read_char (commandflag=3Dcommandflag@entry=3D1, m=
ap=3Dmap@entry=3D34697955, prev_event=3D0, used_mouse_menu=3Dused_mouse_men=
u@entry=3D0x7fffffffd82b, end_time=3Dend_time@entry=3D0x0) at keyboard.c:27=
84
#47 0x00000000004f542c in read_key_sequence (keybuf=3Dkeybuf@entry=3D0x7fff=
ffffd900, prompt=3Dprompt@entry=3D0, dont_downcase_last=3Ddont_downcase_las=
t@entry=3Dfalse,=20
    can_return_switch_frame=3Dcan_return_switch_frame@entry=3Dtrue, fix_cur=
rent_buffer=3Dfix_current_buffer@entry=3Dtrue, prevent_redisplay=3Dprevent_=
redisplay@entry=3Dfalse, bufsize=3D30) at keyboard.c:9159
#48 0x00000000004f7051 in command_loop_1 () at keyboard.c:1407
#49 0x0000000000557537 in internal_condition_case (bfun=3Dbfun@entry=3D0x4f=
6e20 <command_loop_1>, handlers=3Dhandlers@entry=3D18624, hfun=3Dhfun@entry=
=3D0x4edf70 <cmd_error>) at eval.c:1348
#50 0x00000000004e95fc in command_loop_2 (ignore=3Dignore@entry=3D0) at key=
board.c:1139
#51 0x0000000000557413 in internal_catch (tag=3Dtag@entry=3D44352, func=3Df=
unc@entry=3D0x4e95e0 <command_loop_2>, arg=3Darg@entry=3D0) at eval.c:1108
#52 0x00000000004e95b9 in command_loop () at keyboard.c:1118
#53 0x00000000004edb5b in recursive_edit_1 () at keyboard.c:728
#54 0x00000000004edea8 in Frecursive_edit () at keyboard.c:799
#55 0x0000000000418447 in main (argc=3D2, argv=3D0x7fffffffdc68) at emacs.c=
:1626




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 14:55:38 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 10:55:38 2015
Received: from localhost ([127.0.0.1]:55941 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4sH2-00032u-8i
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 10:55:37 -0400
Received: from mtaout25.012.net.il ([80.179.55.181]:44102)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4sGy-00032a-Ag
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 10:55:33 -0400
Received: from conversion-daemon.mtaout25.012.net.il by mtaout25.012.net.il
 (HyperSendmail v2007.08) id <0NQ100I00KW64Y00@HIDDEN> for
 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 17:50:39 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout25.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ100IHDL8EPT10@HIDDEN>; Tue, 16 Jun 2015 17:50:39 +0300 (IDT)
Date: Tue, 16 Jun 2015 17:54:51 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <558024E6.6090503@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83wpz3n1ok.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
 <83zj41nhg9.fsf@HIDDEN> <557EF6B7.3000701@HIDDEN> <83fv5sop6q.fsf@HIDDEN>
 <558024E6.6090503@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Tue, 16 Jun 2015 15:30:14 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> In 32a4883..93ae9f4 master -> master I checked in a fix for X and NS
> although I wasn't able to reproduce the crash on the latter (probably
> due to the fact that on NS like with the native Gtk tooltips one can't
> override the colors anyway).
> 
>  >> One last question: In struct image_cache we specify refcount as
>  >> ptrdiff_t while w32fns.c defines image_cache_refcount as int.  Both
>  >> xfns.c and nsfns.m define image_cache_refcount as ptrdiff_t.  Shouldn't
>  >> we uniquify this?
>  >
>  > Yes, please.  The fewer differences between the various *fns.c and
>  > *term.c functions with similar, let alone identical names, the better.
> 
> I made it a ptrdiff_t on Windows.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 13:31:19 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 09:31:19 2015
Received: from localhost ([127.0.0.1]:55378 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4qxR-00011l-CU
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 09:31:18 -0400
Received: from mout.gmx.net ([212.227.15.19]:59252)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4qwp-00010T-Ua
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 09:30:40 -0400
Received: from [188.22.108.24] ([188.22.108.24]) by mail.gmx.com (mrgmx002)
 with ESMTPSA (Nemesis) id 0MYOkT-1ZZyhq0fS5-00V5Vu; Tue, 16 Jun 2015 15:30:31
 +0200
Message-ID: <558024F4.5090205@HIDDEN>
Date: Tue, 16 Jun 2015 15:30:28 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Tobias Getzner <tobias.getzner@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>, 
 20802 <at> debbugs.gnu.org
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN>
In-Reply-To: <1434439264.2078.6.camel@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:jkr9LCO+DS6oORlhT3W45qwljs2jKuaWc1KCV9jDwFn4UQJTquy
 OzL3P3LIcxPG9utQXNPUYJrFBh/+PqAaDexDdSmGFFsRT0s+7jHuszbcvbeWAomkz5chtsa
 +lVMqmsF2UVLW2rbyBLYtOp8gp0ynRPgYFDzbHm0Fab0w9lhFWWkoHJfogekshPX1YBnXTs
 9XXxxnKaqw8G627P2havA==
X-UI-Out-Filterresults: notjunk:1;V01:K0:oDKb8XK7YTc=:YBJgPasAGu2FhLm1Sf0rFc
 Vq5A5gZA33OyNpl6W+8RBIp5mm6gskzu5/KIadrl0PTiPlgi/4xWNKT6g+9UnQL4ak0u9OFI9
 RMJWcpEthov878XmL4iEPhryRvReRuz6cBCvpM52+3c60HIwIyPxw3kK8yWSv5QZtLbN09cgn
 518vQOJ7b6a4UAVUvGDZnJTEDvCd7wJ3sVyOukrURA9+ZX4g49YAaaDQkdGf0AEKjnDrO8IN3
 8pziWCyazvJkoiZ01aCynHTvwCkIpNxPYtmSdxy6Gsznb05vgGVDmNLfR5TdIy0ZhUEstiABq
 G+aL5S2XsyqZPuCyh/nxWw9Sn1K+Qn+CAWDVNQHca3SgaZz/LEqmx6z06eLxH+rt6ISBibLIc
 RBqQozMvqzyzvh7gN4XTn3tY69AWW7SCigbgCpChc4rDXgvZVg92Zxi6CtujgmuZDIKq+qiNb
 Zg/K7ddIH5oRWvpQCj+hzajBYaLtlsMTWbh32m0Exi2gznaGBu/T7QTBjsbiqhPzIFHu3l3Us
 pc/vxD0F720lvwkrnB/UWYjkhERgluIk2ChKZu+C7tbVay2uzgfGt6fUThQmku6pLx/xzTxlj
 XpQbHuYUdT7VifNVfGHg9JIN3/QfhGpqDlX4e43vYx2eWGq3ZekT8nNxXuWzpuormHzUwzprZ
 1gofTeAdH0EwBCfJEd29DI2B8hffIho2Zzs23NbMDh2MhWiHJ6egAIg3yra1XJhuV91M=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > This was after setting x-gtk-use-system-tooltip to nil and customizing
 > the tooltip face to #qqq.
[...]
 > Program received signal SIGSEGV, Segmentation fault.
 > cache_image (f=0x1170a68, img=<optimized out>) at image.c:1782
 > 1782	  for (i = 0; i < c->used; ++i)

This should be indeed the same segfault I saw.  Meanwhile I checked in a
fix on trunk/master.  If you can build Emacs please try it.

Thanks for report and backtrace, martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 13:30:45 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 09:30:45 2015
Received: from localhost ([127.0.0.1]:55375 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4qws-00010g-QY
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 09:30:43 -0400
Received: from mout.gmx.net ([212.227.15.19]:53843)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4qwa-000108-5B
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 09:30:25 -0400
Received: from [188.22.108.24] ([188.22.108.24]) by mail.gmx.com (mrgmx001)
 with ESMTPSA (Nemesis) id 0MTBLi-1ZWvuB1ylS-00S3LE; Tue, 16 Jun 2015 15:30:17
 +0200
Message-ID: <558024E6.6090503@HIDDEN>
Date: Tue, 16 Jun 2015 15:30:14 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
 <83zj41nhg9.fsf@HIDDEN> <557EF6B7.3000701@HIDDEN> <83fv5sop6q.fsf@HIDDEN>
In-Reply-To: <83fv5sop6q.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:DdPeCt926ljA8o+kzkFt0bqMUz1yARSKK3t9YosLlMmnJNj+HdQ
 ymZEd/9HzB0Lmo5Fc21jN7TfhdwTvULWSSHGMkAzfcoZ0wmgetACrrsZUM7z/milRdNxKgy
 dyY1Hmxu/pGxlIyyYfpVTv4E/4/sGtDOhzFNgO2xEeghMEOydLFtmckRcucUlZ/6vzvkJor
 MbZj0CNdXqDHh7azwhqJQ==
X-UI-Out-Filterresults: notjunk:1;V01:K0:t0MEvyMX6Tk=:yHpPxGNCnNYjhl+3eQui8G
 teKs39tG7bUUUnOTZP8PVTe4bmNTVI0cMTQWmdWeW1+jLit2756a6OuNVmNk4RQuJNrt9/l++
 TgANgazkfBtHa/TEqXTe1fc+sVcJosf1OioZcQroWkGMqiC6jOzNGPfXo2MaEdXdKqKYfMKv0
 dQXFX/gsUqJvufH7gvV1UMDAw8xJT9lMQ5ayGszWPTu/ycYO7zkoY95axJV0jBYN6O9rQ1UlU
 NPyG6rItFPxTvnSauKgT9gXSQ0Tk86Wyj64Uk98PQ7kn5Z0Rr0dkumZ7EaLYkzmhKGjIgfLsF
 OIcewC/LDFL9IY01tT97RBk8EHCGdifjynni9QPILKMhhqhOztik1ZH+XKoH1SxWJd9cBybNR
 2eMl5CiorH9SjUNguspP0jgfDn36sqQnmEGq/J20bgF+L2apJFZJcOGIpK6S4IfwfIEb2nJ9L
 i0+/4PcJH0DY5Pe1VequU3F05BGaPsvyf4Ma2339DBw0VHNkA1GGMtTo0TfQiqLWCujGld+oa
 uWXCZ7SOXOmQXZ0tsmEPUg6Du+7lkf/sLGZ4kGBnE1p3G3/tGw1y8DnDX/01U+Z2upbXw0fl4
 l3GOeYT3sIdRfhH5Nk/x2H2RZ9PtDmVThXhgr1vVHseABRuJ2NqTYdvdrpfD0tlCI4gqbEQVF
 BQr1/qx8xlYRGQytrP+Cocj6tY7rr3H/PzB6JPzI7cDbbQ4/UZSNLnOwxtTrcLRJqnlc=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

In 32a4883..93ae9f4 master -> master I checked in a fix for X and NS
although I wasn't able to reproduce the crash on the latter (probably
due to the fact that on NS like with the native Gtk tooltips one can't
override the colors anyway).

 >> One last question: In struct image_cache we specify refcount as
 >> ptrdiff_t while w32fns.c defines image_cache_refcount as int.  Both
 >> xfns.c and nsfns.m define image_cache_refcount as ptrdiff_t.  Shouldn't
 >> we uniquify this?
 >
 > Yes, please.  The fewer differences between the various *fns.c and
 > *term.c functions with similar, let alone identical names, the better.

I made it a ptrdiff_t on Windows.

Thanks for the basic work, martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 07:21:19 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 03:21:18 2015
Received: from localhost ([127.0.0.1]:55186 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4lBM-0007fj-Mk
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 03:21:18 -0400
Received: from mout.gmx.net ([212.227.17.20]:49512)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z4lBI-0007fU-Nm
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 03:21:14 -0400
Received: from glenalbyn.linguistics.ruhr-uni-bochum.de ([134.147.14.84]) by
 mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0Lp3Qu-1ZYKm52mWa-00er5M;
 Tue, 16 Jun 2015 09:21:05 +0200
Message-ID: <1434439264.2078.6.camel@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: Eli Zaretskii <eliz@HIDDEN>, 20802 <at> debbugs.gnu.org
Date: Tue, 16 Jun 2015 09:21:04 +0200
In-Reply-To: <83381wq76d.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:gkJKtsh/321X+sXrKUJUXrRrcQtxnpxFlPR/njz3nXyEdg10eGj
 AYb9YqQUGJCl/DtcHvxUp8JZ1AAUoN9To036y8aykFscSsorAmo+JVVOmAxo3Q5HtVcOTzF
 PCy11LU5uLrMorevkGz7oE5E0D2CfwjjfGBNmw41Z74HVsoidVDvPQbWi3Ew4/ZoHbJKdLU
 JJQB0lwn17j5ZTsDzzbag==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Sa, 2015-06-13 at 12:38 +0300, Eli Zaretskii wrote:
> > From: Tobias Getzner <tobias.getzner@HIDDEN>
> > Date: Sat, 13 Jun 2015 11:18:38 +0200
> >=20
> > When x-gtk-use-system-tooltips is set to nil, and the tooltip face=20
> > is
> > customized using an invalid color string such as #zz, Emacs will
> > segfault when a tooltip is being drawn.
>=20
> I cannot reproduce this on my system, so please show a backtrace from
> running Emacs inside GDB.  Also, please tell how you customized the
> face color, exactly -- it could be that only some specific ways of
> customizing it cause the problem.

Thanks to Martin for reproducing. From what little I can infer, you
seem to have made sense of this already, but just for the sake of
completeness, below is my backtrace. The line numbers seem a bit
different, but I guess it=E2=80=99s otherwise identical to Martin=E2=80=99s=
?

This was after setting x-gtk-use-system-tooltip to nil and customizing
the tooltip face to #qqq.

Best, and thanks,
TG


Program received signal SIGSEGV, Segmentation fault.
cache_image (f=3D0x1170a68, img=3D<optimized out>) at image.c:1782
1782	  for (i =3D 0; i < c->used; ++i)
(gdb) bt
#0  cache_image (f=3D0x1170a68, img=3D<optimized out>) at image.c:1782
#1  lookup_image (f=3D0x1170a68, spec=3Dspec@entry=3D19521878) at
image.c:1693
#2  0x00000000004393ff in handle_single_display_spec (it=3Dit@entry=3D0x7ff
fffff7da0,=20
    spec=3D<optimized out>, object=3Dobject@entry=3D31549445,=20
overlay=3Doverlay@entry=3D12308786,=20
    position=3Dposition@entry=3D0x7fffffff7ed8, bufpos=3Dbufpos@entry=3D255=
,
display_replaced_p=3D0,=20
    frame_window_p=3D1) at xdisp.c:5310
#3  0x0000000000439fd8 in handle_display_spec (it=3Dit@entry=3D0x7fffffff7d
a0, spec=3D<optimized out>,=20
    object=3Dobject@entry=3D31549445, overlay=3D12308786,=20
position=3Dposition@entry=3D0x7fffffff7ed8,=20
    bufpos=3Dbufpos@entry=3D255, frame_window_p=3D1) at xdisp.c:4836
#4  0x000000000043a299 in handle_display_prop (it=3D0x7fffffff7da0) at
xdisp.c:4759
#5  0x000000000043d002 in handle_stop (it=3Dit@entry=3D0x7fffffff7da0) at
xdisp.c:3492
#6  0x00000000004463a2 in next_element_from_buffer (it=3D0x7fffffff7da0)
at xdisp.c:8290
#7  0x0000000000441275 in get_next_display_element (it=3Dit@entry=3D0x7ffff
fff7da0) at xdisp.c:6944
#8  0x0000000000447188 in display_line (it=3Dit@entry=3D0x7fffffff7da0) at
xdisp.c:20241
#9  0x000000000044b6ea in try_window (window=3Dwindow@entry=3D18291325,
pos=3D..., flags=3Dflags@entry=3D1)
    at xdisp.c:17007
#10 0x000000000046170e in redisplay_window (window=3D18291325,=20
    just_this_one_p=3Djust_this_one_p@entry=3Dfalse) at xdisp.c:16486
#11 0x0000000000463aa3 in redisplay_window_0 (window=3Dwindow@entry=3D18291
325) at xdisp.c:14373
#12 0x000000000055b53b in internal_condition_case_1 (
    bfun=3Dbfun@entry=3D0x463a70 <redisplay_window_0>, arg=3D18291325,
handlers=3D<optimized out>,=20
    hfun=3Dhfun@entry=3D0x42be50 <redisplay_window_error>) at eval.c:1372
#13 0x0000000000430caf in redisplay_windows (window=3D18291325) at
xdisp.c:14353
#14 0x0000000000450331 in redisplay_internal () at xdisp.c:13949
#15 0x0000000000452530 in redisplay_preserve_echo_area (
from_where=3Dfrom_where@entry=3D2)
    at xdisp.c:14206
#16 0x000000000041b065 in Fredisplay (force=3D12308786) at dispnew.c:5896
#17 0x000000000055d1a7 in Ffuncall (nargs=3D<optimized out>,=20
args=3Dargs@entry=3D0x7fffffffc1f0)
    at eval.c:2811
#18 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D8822021,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D1,=20
    args=3D<optimized out>, args@entry=3D0x869ce1 <pure+123745>) at
bytecode.c:916
#19 0x000000000055ccb7 in funcall_lambda (fun=3D140737488339872,=20
nargs=3Dnargs@entry=3D1,=20
    arg_vector=3D0x869ce1 <pure+123745>, arg_vector@entry=3D0x7fffffffc340)
at eval.c:2978
#20 0x000000000055cfbb in Ffuncall (nargs=3D2, args=3Dargs@entry=3D0x7fffff=
ff
c338) at eval.c:2872
#21 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10488933,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,
nargs=3D<optimized out>,=20
    args=3D<optimized out>) at bytecode.c:916
#22 0x000000000055c4e3 in eval_sub (form=3D<optimized out>) at
eval.c:2187
#23 0x000000000055fbc3 in Fprogn (body=3D10488838) at eval.c:462
#24 internal_lisp_condition_case (var=3D<optimized out>,
bodyform=3D10488550,=20
    handlers=3D<optimized out>) at eval.c:1306
#25 0x0000000000593bcf in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10488493,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:1162
#26 0x000000000055cc1f in funcall_lambda (fun=3D10488365,=20
nargs=3Dnargs@entry=3D2,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffc720) at eval.c:3044
#27 0x000000000055cfbb in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ff
c718) at eval.c:2872
#28 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10490901,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:916
#29 0x000000000055cc1f in funcall_lambda (fun=3D10490821,=20
nargs=3Dnargs@entry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffc978) at eval.c:3044
#30 0x000000000055cfbb in Ffuncall (nargs=3D2, args=3D0x7fffffffc970) at
eval.c:2872
#31 0x000000000055b89d in run_hook_with_args (nargs=3D2,
args=3D0x7fffffffc970,=20
    funcall=3D0x55cd90 <Ffuncall>) at eval.c:2547
#32 0x000000000055d09a in Ffuncall (nargs=3D<optimized out>,=20
args=3Dargs@entry=3D0x7fffffffc968)
    at eval.c:2792
#33 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10488085,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:916
#34 0x000000000055cc1f in funcall_lambda (fun=3D10488021,=20
nargs=3Dnargs@entry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffcbf8) at eval.c:3044
#35 0x000000000055cfbb in Ffuncall (nargs=3Dnargs@entry=3D2,=20
args=3Dargs@entry=3D0x7fffffffcbf0)
    at eval.c:2872
#36 0x000000000055e6a2 in Fapply (nargs=3D2, args=3D0x7fffffffcbf0) at
eval.c:2297
#37 0x000000000055d09a in Ffuncall (nargs=3D<optimized out>,=20
args=3Dargs@entry=3D0x7fffffffcbe8)
    at eval.c:2792
#38 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10054405,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,
nargs=3D<optimized out>,=20
    args=3D<optimized out>) at bytecode.c:916
#39 0x000000000055c4e3 in eval_sub (form=3Dform@entry=3D10054326) at
eval.c:2187
#40 0x000000000055fade in internal_lisp_condition_case (var=3D<optimized
out>, bodyform=3D10054326,=20
    handlers=3D<optimized out>) at eval.c:1317
#41 0x0000000000593bcf in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10054093,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:1162
#42 0x000000000055cc1f in funcall_lambda (fun=3D10054013,=20
nargs=3Dnargs@entry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffcfe8) at eval.c:3044
#43 0x000000000055cfbb in Ffuncall (nargs=3Dnargs@entry=3D2,=20
args=3Dargs@entry=3D0x7fffffffcfe0)
    at eval.c:2872
#44 0x000000000055d2da in call1 (fn=3D<optimized out>, arg1=3Darg1@entry=3D=
18
809933) at eval.c:2610
#45 0x00000000004ef218 in timer_check_2 (idle_timers=3D<optimized out>,
timers=3D<optimized out>)
    at keyboard.c:4515
#46 timer_check () at keyboard.c:4582
#47 0x00000000004ef5d1 in readable_events (flags=3D1) at keyboard.c:3448
#48 0x00000000004f0c78 in get_input_pending (flags=3Dflags@entry=3D1) at
keyboard.c:6766
#49 0x00000000004f3ea8 in detect_input_pending_run_timers (
do_display=3Ddo_display@entry=3Dtrue)
    at keyboard.c:9895
#50 0x000000000059cd8c in wait_reading_process_output (
time_limit=3Dtime_limit@entry=3D30,=20
    nsecs=3Dnsecs@entry=3D0, read_kbd=3Dread_kbd@entry=3D-1,=20
do_display=3Ddo_display@entry=3Dtrue,=20
    wait_for_cell=3D12308786, wait_proc=3Dwait_proc@entry=3D0x0,
just_wait_proc=3D0) at process.c:4702
#51 0x00000000004221f3 in sit_for (timeout=3D<optimized out>,=20
reading=3Dreading@entry=3Dtrue,=20
    display_option=3Ddisplay_option@entry=3D1) at dispnew.c:5867
#52 0x00000000004f4df4 in read_char (commandflag=3D1, map=3Dmap@entry=3D353=
25
094, prev_event=3D12308786,=20
    used_mouse_menu=3Dused_mouse_menu@entry=3D0x7fffffffd7bb,=20
end_time=3Dend_time@entry=3D0x0)
    at keyboard.c:2810
#53 0x00000000004f5fcd in read_key_sequence (keybuf=3Dkeybuf@entry=3D0x7fff
ffffd890, prompt=3D12308786,=20
    dont_downcase_last=3Ddont_downcase_last@entry=3Dfalse,=20
    can_return_switch_frame=3Dcan_return_switch_frame@entry=3Dtrue,=20
    fix_current_buffer=3Dfix_current_buffer@entry=3Dtrue,=20
    prevent_redisplay=3Dprevent_redisplay@entry=3Dfalse, bufsize=3D30) at
keyboard.c:9089
#54 0x00000000004f7d30 in command_loop_1 () at keyboard.c:1453
#55 0x000000000055b417 in internal_condition_case (bfun=3Dbfun@entry=3D0x4f
7b30 <command_loop_1>,=20
    handlers=3D<optimized out>, hfun=3Dhfun@entry=3D0x4ee880 <cmd_error>) a=
t
eval.c:1348
#56 0x00000000004e9d6e in command_loop_2 (ignore=3Dignore@entry=3D12308786)
at keyboard.c:1178
#57 0x000000000055b2fb in internal_catch (tag=3D12356258,=20
    func=3Dfunc@entry=3D0x4e9d50 <command_loop_2>, arg=3D12308786) at
eval.c:1112
#58 0x00000000004ee467 in command_loop () at keyboard.c:1157
#59 recursive_edit_1 () at keyboard.c:778
#60 0x00000000004ee7a8 in Frecursive_edit () at keyboard.c:849
#61 0x00000000004181a9 in main (argc=3D<optimized out>,
argv=3D0x7fffffffdbf8) at emacs.c:1642




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 15 Jun 2015 17:29:57 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Jun 15 13:29:57 2015
Received: from localhost ([127.0.0.1]:54926 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4YCq-00025i-WE
	for submit <at> debbugs.gnu.org; Mon, 15 Jun 2015 13:29:57 -0400
Received: from mtaout20.012.net.il ([80.179.55.166]:40120)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4YCo-00025T-Ej
 for 20802 <at> debbugs.gnu.org; Mon, 15 Jun 2015 13:29:55 -0400
Received: from conversion-daemon.a-mtaout20.012.net.il by
 a-mtaout20.012.net.il (HyperSendmail v2007.08) id
 <0NPZ00E00XQ0TD00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Mon, 15 Jun 2015 20:29:47 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPZ00ELSXXNKMB0@HIDDEN>;
 Mon, 15 Jun 2015 20:29:47 +0300 (IDT)
Date: Mon, 15 Jun 2015 20:29:33 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557EF6B7.3000701@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83fv5sop6q.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
 <83zj41nhg9.fsf@HIDDEN> <557EF6B7.3000701@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Mon, 15 Jun 2015 18:00:55 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> One last question: In struct image_cache we specify refcount as
> ptrdiff_t while w32fns.c defines image_cache_refcount as int.  Both
> xfns.c and nsfns.m define image_cache_refcount as ptrdiff_t.  Shouldn't
> we uniquify this?

Yes, please.  The fewer differences between the various *fns.c and
*term.c functions with similar, let alone identical names, the better.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 15 Jun 2015 16:01:11 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Jun 15 12:01:11 2015
Received: from localhost ([127.0.0.1]:54876 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4Wow-0008Vu-HV
	for submit <at> debbugs.gnu.org; Mon, 15 Jun 2015 12:01:10 -0400
Received: from mout.gmx.net ([212.227.17.20]:56460)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4Wot-0008VV-Ka
 for 20802 <at> debbugs.gnu.org; Mon, 15 Jun 2015 12:01:08 -0400
Received: from [178.190.21.103] ([178.190.21.103]) by mail.gmx.com (mrgmx103)
 with ESMTPSA (Nemesis) id 0M6SE3-1ZF2Jd1yax-00ySQN;
 Mon, 15 Jun 2015 18:00:58 +0200
Message-ID: <557EF6B7.3000701@HIDDEN>
Date: Mon, 15 Jun 2015 18:00:55 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
 <83zj41nhg9.fsf@HIDDEN>
In-Reply-To: <83zj41nhg9.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:3ygWe03tFgyZRa1kcWfw7vYhpkETwD3xm1EQVCZmpuI0jfqerKP
 yRKH25OnIVl2lcHqGUNejXuAmuoVlMTIxKAQA++dhcltLBCjkTkNqFAJsV4it8e8ypCW+o2
 Nlkw8IocQGaDedMxlpdUPw+W+Wp8KWobrb3FkGQzM4XujRGv60OQJWOZauXvfUpPPuzJB40
 Xa/fOITnflrA3EwEN7kUQ==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 >> How are these supposed to
 >> work when GLYPH_DEBUG is not defined?
 >
 > It cannot, obviously.  Bug#17524 was reported in the GLYPH_DEBUG code:
 > the assertion there segfaulted when it tried to access the image
 > cache.  So the code was fixed only for that situation.

Hmmm ...  you should have told Michael back then.  You clairvoyantly
identified the problem then as ...

   But the real problem is that call to
   x_free_frame_resources, which eventually calls free_frame_faces, which
   decrements the image-cache refcount and frees the image cache, because
   the refcount goes to zero.

... but the recipe ...

   So I think the X version needs the same change I made in w32fns.c in
   revision 117131, modulo the changes to the assertions.

... was misleading because the bug was triggerd without violating an
assertion.  I doubt that Michael then build with glyph debugging enabled
because otherwise his fix should have helped indeed.

 > IOW, that bug was mentioned as a source of ideas, not as something to
 > copy verbatim to xfns.c.  Sorry if I was unclear about that.

OK.  One last question: In struct image_cache we specify refcount as
ptrdiff_t while w32fns.c defines image_cache_refcount as int.  Both
xfns.c and nsfns.m define image_cache_refcount as ptrdiff_t.  Shouldn't
we uniquify this?

martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 15 Jun 2015 15:02:25 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Jun 15 11:02:25 2015
Received: from localhost ([127.0.0.1]:54839 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4Vu4-0006xD-PQ
	for submit <at> debbugs.gnu.org; Mon, 15 Jun 2015 11:02:25 -0400
Received: from mtaout20.012.net.il ([80.179.55.166]:46428)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4Vu1-0006wo-N9
 for 20802 <at> debbugs.gnu.org; Mon, 15 Jun 2015 11:02:22 -0400
Received: from conversion-daemon.a-mtaout20.012.net.il by
 a-mtaout20.012.net.il (HyperSendmail v2007.08) id
 <0NPZ00D00QV2WC00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Mon, 15 Jun 2015 18:02:13 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPZ00D0FR3OX200@HIDDEN>;
 Mon, 15 Jun 2015 18:02:13 +0300 (IDT)
Date: Mon, 15 Jun 2015 18:01:58 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557E8B50.80905@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83zj41nhg9.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Mon, 15 Jun 2015 10:22:40 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
>  > Thanks.  Now I know why this cannot be reproduced on Windows: this is
>  > bug#17524 coming back to haunt us.  That bug was reported on Windows,
>  > I fixed it on Windows, then suggested a similar fix for X, but was
>  > told it didn't help there.
>  >
>  > So now please try making a fix on X similar to commit ebdc80316, and
>  > if that indeed doesn't help with this crash, perhaps some simple
>  > variation of that will.
> 
> Sorry.  I must be missing something very elementary here.  Your "shadow"
> refcounts
> 
> #ifdef GLYPH_DEBUG
> static int image_cache_refcount, dpyinfo_refcount;
> #endif
> 
> are defined iff you have GLYPH_DEBUG defined.  How are these supposed to
> work when GLYPH_DEBUG is not defined?

It cannot, obviously.  Bug#17524 was reported in the GLYPH_DEBUG code:
the assertion there segfaulted when it tried to access the image
cache.  So the code was fixed only for that situation.

Doing that for a non-GLYPH_DEBUG code will require the shadow variable
to come out of that condition as well.  Or use some other flag
variable to indicate that x_free_frame_resources is about to be called
when the refcount was not yet incremented.

IOW, that bug was mentioned as a source of ideas, not as something to
copy verbatim to xfns.c.  Sorry if I was unclear about that.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 15 Jun 2015 08:22:56 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Jun 15 04:22:56 2015
Received: from localhost ([127.0.0.1]:54339 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4PfT-0004bq-Nt
	for submit <at> debbugs.gnu.org; Mon, 15 Jun 2015 04:22:55 -0400
Received: from mout.gmx.net ([212.227.15.18]:50347)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4PfR-0004bc-0g
 for 20802 <at> debbugs.gnu.org; Mon, 15 Jun 2015 04:22:53 -0400
Received: from [178.190.162.212] ([178.190.162.212]) by mail.gmx.com
 (mrgmx003) with ESMTPSA (Nemesis) id 0Lmqxo-1ZVmrV2QU0-00h6VF; Mon, 15 Jun
 2015 10:22:41 +0200
Message-ID: <557E8B50.80905@HIDDEN>
Date: Mon, 15 Jun 2015 10:22:40 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN>
In-Reply-To: <83h9qapee0.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:bAtKJN8z8eibgl/L3Uu7q5T58uMPVys744pptBRu9KEkKJNXUsK
 zxDP8X22NncIc7YfxUIDw50zAVjNgw8+Oz+cVImB5f/M3iI8rsxUiCI04EKA+y3DUDdo2WB
 7MCF5a2Pgyi/MhuaTsT8UZE+ZpWsTioVVzQGmIbrzfghl+Ms7hKSx+DQ3PseQv42cPuhJaU
 JP349/HLT7K3YRMmXumqQ==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Thanks.  Now I know why this cannot be reproduced on Windows: this is
 > bug#17524 coming back to haunt us.  That bug was reported on Windows,
 > I fixed it on Windows, then suggested a similar fix for X, but was
 > told it didn't help there.
 >
 > So now please try making a fix on X similar to commit ebdc80316, and
 > if that indeed doesn't help with this crash, perhaps some simple
 > variation of that will.

Sorry.  I must be missing something very elementary here.  Your "shadow"
refcounts

#ifdef GLYPH_DEBUG
static int image_cache_refcount, dpyinfo_refcount;
#endif

are defined iff you have GLYPH_DEBUG defined.  How are these supposed to
work when GLYPH_DEBUG is not defined?

martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 14 Jun 2015 14:13:14 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Jun 14 10:13:13 2015
Received: from localhost ([127.0.0.1]:53972 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z48ev-0004qO-Da
	for submit <at> debbugs.gnu.org; Sun, 14 Jun 2015 10:13:13 -0400
Received: from mtaout26.012.net.il ([80.179.55.182]:33223)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z48es-0004q9-Su
 for 20802 <at> debbugs.gnu.org; Sun, 14 Jun 2015 10:13:11 -0400
Received: from conversion-daemon.mtaout26.012.net.il by mtaout26.012.net.il
 (HyperSendmail v2007.08) id <0NPX00J00U7QBA00@HIDDEN> for
 20802 <at> debbugs.gnu.org; Sun, 14 Jun 2015 17:15:23 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout26.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPX00C5MU9NR580@HIDDEN>; Sun, 14 Jun 2015 17:15:23 +0300 (IDT)
Date: Sun, 14 Jun 2015 17:12:55 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557D5EE9.7070902@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83h9qapee0.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Sun, 14 Jun 2015 13:00:57 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> What happens is given in the backtraces below.  The first breakpoint is
> hit when Emacs creates the image cache for the original frame
> (f=0x13a7e00).  The second breakpoint is hit when freeing the image
> cache for the tooltip frame (f=0xe0c7a0).  This removes the image_cache
> created in make_image_cache at 0x1676f90.  The third breakpoint is the
> same as in my earlier posts.
> 
> The reason seems obvious: When the color is not defined for the tooltip
> frame we do _not_ increment the refcount of the image cache.  But we
> subsequently free the image cache in unwind_create_frame.  Bad luck.

Thanks.  Now I know why this cannot be reproduced on Windows: this is
bug#17524 coming back to haunt us.  That bug was reported on Windows,
I fixed it on Windows, then suggested a similar fix for X, but was
told it didn't help there.

So now please try making a fix on X similar to commit ebdc80316, and
if that indeed doesn't help with this crash, perhaps some simple
variation of that will.

TIA




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 14 Jun 2015 11:01:22 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Jun 14 07:01:22 2015
Received: from localhost ([127.0.0.1]:53256 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z45fE-0005r3-Rg
	for submit <at> debbugs.gnu.org; Sun, 14 Jun 2015 07:01:22 -0400
Received: from mout.gmx.net ([212.227.17.22]:57935)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z45fA-0005qo-RC
 for 20802 <at> debbugs.gnu.org; Sun, 14 Jun 2015 07:01:18 -0400
Received: from [178.190.22.22] ([178.190.22.22]) by mail.gmx.com (mrgmx102)
 with ESMTPSA (Nemesis) id 0Lz0aC-1Z8Zi03An2-014FK3; Sun, 14 Jun 2015 13:01:09
 +0200
Message-ID: <557D5EE9.7070902@HIDDEN>
Date: Sun, 14 Jun 2015 13:00:57 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
In-Reply-To: <83twubpt43.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:Jh4yIjVJ7+nyhHrJm5KlSt1MCIMwtcMW1psXWMaPE2sXLM7m32w
 sJi1PkPCXKxRVw0HkHv5ORUPJ3uOfU+FQD34xa7+bep0WyFeLRTkbDV/OhmylNS5D/h3cbt
 XxY0thbiBuXbV7dbpcmdCnExC9yir932s9WZ/BgZMuibYEbvCKzL9U+cZUx7+oxMfzjviAm
 I5asxtsolYOeXZEQ07hpw==
X-UI-Out-Filterresults: notjunk:1;V01:K0:XLzyHO68enQ=:taG/cL8GJ7s+ktDadTfTy6
 BhBAOzjPjEEB3jgo7FsJ0wnKpQjeRde7HK1knB6dTZUOg0iAufhVCIuHFxWhKa4uJ+oTb6Ytd
 RlvPayGHPVYzDAyIr6fnE19zmV2VTLN7+Mt6AISJyYNd01L6IBrLJz+SZSnvdo+jai1yv4+GZ
 3nkor/rGIYs6N7jujtuEEPz6WGBfRVpwq2nu+kmsSWCFAMbZnHIoOOxl/y93qf6tnDhpr+MM1
 bK2QVqUXZH7LWZYWblCAfX96F1VSCJ1KsZqQRh++veEAx5WJtZ8uq9Fon3++YUyn1mDv6pWyG
 dzU37UX9FVyG0FczUxSTQOrCa3Akr4xjiYrV4GY+fWfpkYXQskbQWpyzNHGtaDhMbaJrViWXI
 zBuQQk7LdfX28sBsG6jBfgaSSa7FLfc4UIp3V9t6hpP4vLyzX9GuON+28OiDhqlhB+tlqc860
 TXcjMZMIle9b7P4fSYD8VpE/Ko03a5X4M7fFPFlhFADLg8KVOP4J8M9e7LFPKx/yAI40JtyMR
 uRoe+RyLsWfZ2MuENL02oxhOokswJBKutpkkdSk4XeKt/Uh21Cxis/tEqVhrPBHzwQG/D+Pay
 LQ4krLjMArwxvYlJnlZXFRxwuB2fSWqcAXbw5GSGwOyHo9oWRPyiYgRkuRjzHMsKHzJmEH/UB
 JfxR/Ua5/ZteBq/Lgrz/Wn8TMEqE7gGaPsE0wCvkubb9HArFY3PR7pV6pBQAvJs43p5Q=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

What happens is given in the backtraces below.  The first breakpoint is
hit when Emacs creates the image cache for the original frame
(f=0x13a7e00).  The second breakpoint is hit when freeing the image
cache for the tooltip frame (f=0xe0c7a0).  This removes the image_cache
created in make_image_cache at 0x1676f90.  The third breakpoint is the
same as in my earlier posts.

The reason seems obvious: When the color is not defined for the tooltip
frame we do _not_ increment the refcount of the image cache.  But we
subsequently free the image cache in unwind_create_frame.  Bad luck.

martin


(gdb) run
Starting program: /home/martin/emacs-git/trunk/obj-gtk/src/emacs
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffef48c700 (LWP 4514)]
[New Thread 0x7fffedadf700 (LWP 4515)]
[New Thread 0x7fffed28e700 (LWP 4516)]
(gdb) bt
#0  make_image_cache () at ../../src/image.c:1356
#1  0x0000000000524b87 in init_frame_faces (f=0x13a7e00) at ../../src/xfaces.c:591
#2  0x0000000000551afb in Fx_create_frame (parms=...) at ../../src/xfns.c:3215
#3  0x00000000006297ae in Ffuncall (nargs=2, args=0x7fffffffb848) at ../../src/eval.c:2718
#4  0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#5  0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, arg_vector=0xa0be8d) at ../../src/eval.c:2951
#6  0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffc0d8) at ../../src/eval.c:2767
#7  0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x7fffffffc978) at ../../src/bytecode.c:919
#8  0x000000000062a11f in funcall_lambda (fun=..., nargs=1, arg_vector=0x7fffffffc970) at ../../src/eval.c:2885
#9  0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffc968) at ../../src/eval.c:2767
#10 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x7fffffffd1e0) at ../../src/bytecode.c:919
#11 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, arg_vector=0x7fffffffd1e0) at ../../src/eval.c:2885
#12 0x0000000000629a1a in Ffuncall (nargs=1, args=0x7fffffffd1d8) at ../../src/eval.c:2767
#13 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x7fffffffdab8) at ../../src/bytecode.c:919
#14 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, arg_vector=0x7fffffffdab8) at ../../src/eval.c:2885
#15 0x0000000000629a1a in Ffuncall (nargs=1, args=0x7fffffffdab0) at ../../src/eval.c:2767
#16 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x7fffffffe260) at ../../src/bytecode.c:919
#17 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, arg_vector=0x7fffffffe260) at ../../src/eval.c:2885
#18 0x0000000000629db3 in apply_lambda (fun=..., args=..., count=3) at ../../src/eval.c:2826
#19 0x0000000000628201 in eval_sub (form=...) at ../../src/eval.c:2226
#20 0x00000000006276a7 in Feval (form=..., lexical=...) at ../../src/eval.c:1996
#21 0x00000000005798fe in top_level_2 () at ../../src/keyboard.c:1148
#22 0x0000000000625ac9 in internal_condition_case (bfun=0x5798e1 <top_level_2>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#23 0x000000000057993f in top_level_1 (ignore=...) at ../../src/keyboard.c:1156
#24 0x0000000000624ec4 in internal_catch (tag=..., func=0x579900 <top_level_1>, arg=...) at ../../src/eval.c:1108
#25 0x0000000000579839 in command_loop () at ../../src/keyboard.c:1117
#26 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#27 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#28 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at ../../src/emacs.c:1626

Lisp Backtrace:
"x-create-frame" (0xffffb850)
"x-create-frame-with-faces" (0xffffc0e0)
"make-frame" (0xffffc970)
"frame-initialize" (0xffffd1e0)
"command-line" (0xffffdab8)
"normal-top-level" (0xffffe260)
(gdb) p c
$38 = (struct image_cache *) 0x1676f90
(gdb) c
Continuing.
(gdb) bt
#0  free_image_cache (f=0xe0c7a0) at ../../src/image.c:1432
#1  0x0000000000524c5e in free_frame_faces (f=0xe0c7a0) at ../../src/xfaces.c:624
#2  0x0000000000548bb0 in x_free_frame_resources (f=0xe0c7a0) at ../../src/xterm.c:10228
#3  0x0000000000550621 in unwind_create_frame (frame=...) at ../../src/xfns.c:2833
#4  0x00000000005549b3 in unwind_create_tip_frame (frame=...) at ../../src/xfns.c:4991
#5  0x000000000062ae77 in unbind_to (count=9, value=...) at ../../src/eval.c:3208
#6  0x0000000000624fa6 in unwind_to_catch (catch=0x15696d0, value=...) at ../../src/eval.c:1157
#7  0x00000000006250b4 in Fthrow (tag=..., value=...) at ../../src/eval.c:1188
#8  0x00000000005799be in Ftop_level () at ../../src/keyboard.c:1179
#9  0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffff9168) at ../../src/eval.c:2715
#10 0x000000000061f642 in Ffuncall_interactively (nargs=1, args=0x7fffffff9168) at ../../src/callint.c:252
#11 0x0000000000629676 in Ffuncall (nargs=2, args=0x7fffffff9160) at ../../src/eval.c:2698
#12 0x0000000000621bf9 in Fcall_interactively (function=..., record_flag=..., keys=...) at ../../src/callint.c:849
#13 0x0000000000629813 in Ffuncall (nargs=4, args=0x7fffffff9688) at ../../src/eval.c:2725
#14 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x7fffffff9f20) at ../../src/bytecode.c:919
#15 0x000000000062a11f in funcall_lambda (fun=..., nargs=1, arg_vector=0x7fffffff9f18) at ../../src/eval.c:2885
#16 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffff9f10) at ../../src/eval.c:2767
#17 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#18 0x000000000057a4f6 in command_loop_1 () at ../../src/keyboard.c:1521
#19 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#20 0x00000000005798be in command_loop_2 (ignore=...) at ../../src/keyboard.c:1139
#21 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 <command_loop_2>, arg=...) at ../../src/eval.c:1108
#22 0x00000000005797f6 in command_loop () at ../../src/keyboard.c:1110
#23 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#24 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#25 0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffffa408) at ../../src/eval.c:2715
#26 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=2, args=0x7fffffffac98) at ../../src/bytecode.c:919
#27 0x000000000062a11f in funcall_lambda (fun=..., nargs=2, arg_vector=0x7fffffffac98) at ../../src/eval.c:2885
#28 0x0000000000629a1a in Ffuncall (nargs=3, args=0x7fffffffac90) at ../../src/eval.c:2767
#29 0x0000000000628a06 in Fapply (nargs=2, args=0x7fffffffada0) at ../../src/eval.c:2337
#30 0x00000000006290fc in apply1 (fn=..., arg=...) at ../../src/eval.c:2558
#31 0x0000000000622711 in call_debugger (arg=...) at ../../src/eval.c:309
#32 0x0000000000626ab3 in maybe_call_debugger (conditions=..., sig=..., data=...) at ../../src/eval.c:1726
#33 0x00000000006262c8 in Fsignal (error_symbol=..., data=...) at ../../src/eval.c:1544
#34 0x00000000006263fe in xsignal (error_symbol=..., data=...) at ../../src/eval.c:1581
#35 0x000000000062663c in signal_error (s=0x6fd2de "Undefined color", arg=...) at ../../src/eval.c:1636
#36 0x000000000054c091 in x_decode_color (f=0xe0c7a0, color_name=..., mono_color=16777215) at ../../src/xfns.c:495
#37 0x000000000054c566 in x_set_background_color (f=0xe0c7a0, arg=..., oldval=...) at ../../src/xfns.c:638
#38 0x000000000042d45d in x_set_frame_parameters (f=0xe0c7a0, alist=...) at ../../src/frame.c:3152
#39 0x0000000000431ce6 in x_default_parameter (f=0xe0c7a0, alist=..., prop=..., deflt=..., xprop=0x6fd49d "background", xclass=0x6fd908 "Background", type=RES_TYPE_STRING) at ../../src/frame.c:4374
#40 0x000000000055549d in x_create_tip_frame (dpyinfo=0x1622000, parms=..., text=...) at ../../src/xfns.c:5173
#41 0x0000000000556884 in Fx_show_tip (string=..., frame=..., parms=..., timeout=..., dx=..., dy=...) at ../../src/xfns.c:5543
#42 0x0000000000628116 in eval_sub (form=...) at ../../src/eval.c:2200
#43 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#44 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#45 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#46 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#47 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#48 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#49 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#50 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#51 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#52 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#53 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#54 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#55 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#56 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#57 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#58 0x000000000062a511 in funcall_lambda (fun=..., nargs=0, arg_vector=0x0) at ../../src/eval.c:2944
#59 0x0000000000629b19 in Ffuncall (nargs=1, args=0x7fffffffcbb0) at ../../src/eval.c:2779
#60 0x000000000062853a in Fapply (nargs=2, args=0x7fffffffcbb0) at ../../src/eval.c:2289
#61 0x0000000000629676 in Ffuncall (nargs=3, args=0x7fffffffcba8) at ../../src/eval.c:2698
#62 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#63 0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, arg_vector=0xadb72d) at ../../src/eval.c:2951
#64 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffd430) at ../../src/eval.c:2767
#65 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#66 0x0000000000582a83 in timer_check_2 (timers=..., idle_timers=...) at ../../src/keyboard.c:4533
#67 0x0000000000582bf2 in timer_check () at ../../src/keyboard.c:4600
#68 0x000000000058008d in readable_events (flags=1) at ../../src/keyboard.c:3434
#69 0x000000000058841c in get_input_pending (flags=1) at ../../src/keyboard.c:6818
#70 0x000000000058ff13 in detect_input_pending_run_timers (do_display=true) at ../../src/keyboard.c:9973
#71 0x0000000000684c13 in wait_reading_process_output (time_limit=2025, nsecs=0, read_kbd=-1, do_display=true, wait_for_cell=..., wait_proc=0x0, just_wait_proc=0) at ../../src/process.c:5014
#72 0x0000000000422610 in sit_for (timeout=..., reading=true, display_option=1) at ../../src/dispnew.c:5748
#73 0x000000000057de53 in read_char (commandflag=1, map=..., prev_event=..., used_mouse_menu=0x7fffffffe23f, end_time=0x0) at ../../src/keyboard.c:2781
#74 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffffe410, bufsize=30, prompt=..., dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#75 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#76 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#77 0x00000000005798be in command_loop_2 (ignore=...) at ../../src/keyboard.c:1139
#78 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 <command_loop_2>, arg=...) at ../../src/eval.c:1108
#79 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#80 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#81 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#82 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at ../../src/emacs.c:1626

Lisp Backtrace:
"x-show-tip" (0xffffb810)
"progn" (0xffffbb20)
"if" (0xffffbd40)
"let*" (0xffffc040)
"progn" (0xffffc250)
"if" (0xffffc470)
"let*" (0xffffc770)
"eldoc-tooltip--make" (0xffffcbb8)
"apply" (0xffffcbb0)
"timer-event-handler" (0xffffd438)
(gdb) p c
$39 = (struct image_cache *) 0x1676f90
(gdb) c
Continuing.
(gdb) bt
#0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x24d7600) at ../../src/image.c:1775
#1  0x00000000006c96e3 in lookup_image (f=0x13a7e00, spec=...) at ../../src/image.c:1686
#2  0x000000000044bebc in handle_single_display_spec (it=0x7fffffff46f0, spec=..., object=..., overlay=..., position=0x7fffffff4828, bufpos=203, display_replaced=0, frame_window_p=true) at ../../src/xdisp.c:5137
#3  0x00000000004498cd in handle_display_spec (it=0x7fffffff46f0, spec=..., object=..., overlay=..., position=0x7fffffff4828, bufpos=203, frame_window_p=true) at ../../src/xdisp.c:4654
#4  0x00000000004492c8 in handle_display_prop (it=0x7fffffff46f0) at ../../src/xdisp.c:4576
#5  0x0000000000445e8d in handle_stop (it=0x7fffffff46f0) at ../../src/xdisp.c:3299
#6  0x0000000000454ee3 in next_element_from_buffer (it=0x7fffffff46f0) at ../../src/xdisp.c:8133
#7  0x00000000004511b5 in get_next_display_element (it=0x7fffffff46f0) at ../../src/xdisp.c:6785
#8  0x000000000047e4ea in display_line (it=0x7fffffff46f0) at ../../src/xdisp.c:20132
#9  0x00000000004719a2 in try_window (window=..., pos=..., flags=1) at ../../src/xdisp.c:16892
#10 0x000000000046df50 in redisplay_window (window=..., just_this_one_p=false) at ../../src/xdisp.c:16365
#11 0x00000000004654d0 in redisplay_window_0 (window=...) at ../../src/xdisp.c:14184
#12 0x0000000000625c43 in internal_condition_case_1 (bfun=0x46548e <redisplay_window_0>, arg=..., handlers=..., hfun=0x465456 <redisplay_window_error>) at ../../src/eval.c:1372
#13 0x000000000046542c in redisplay_windows (window=...) at ../../src/xdisp.c:14164
#14 0x00000000004653e2 in redisplay_windows (window=...) at ../../src/xdisp.c:14158
#15 0x00000000004641e1 in redisplay_internal () at ../../src/xdisp.c:13756
#16 0x0000000000461e04 in redisplay () at ../../src/xdisp.c:13019
#17 0x000000000057d4a3 in read_char (commandflag=1, map=..., prev_event=..., used_mouse_menu=0x7fffffff9d8f, end_time=0x0) at ../../src/keyboard.c:2542
#18 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffff9f60, bufsize=30, prompt=..., dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#19 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#20 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#21 0x00000000005798be in command_loop_2 (ignore=...) at ../../src/keyboard.c:1139
#22 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 <command_loop_2>, arg=...) at ../../src/eval.c:1108
#23 0x00000000005797f6 in command_loop () at ../../src/keyboard.c:1110
#24 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#25 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#26 0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffffa408) at ../../src/eval.c:2715
#27 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=2, args=0x7fffffffac98) at ../../src/bytecode.c:919
#28 0x000000000062a11f in funcall_lambda (fun=..., nargs=2, arg_vector=0x7fffffffac98) at ../../src/eval.c:2885
#29 0x0000000000629a1a in Ffuncall (nargs=3, args=0x7fffffffac90) at ../../src/eval.c:2767
#30 0x0000000000628a06 in Fapply (nargs=2, args=0x7fffffffada0) at ../../src/eval.c:2337
#31 0x00000000006290fc in apply1 (fn=..., arg=...) at ../../src/eval.c:2558
#32 0x0000000000622711 in call_debugger (arg=...) at ../../src/eval.c:309
#33 0x0000000000626ab3 in maybe_call_debugger (conditions=..., sig=..., data=...) at ../../src/eval.c:1726
#34 0x00000000006262c8 in Fsignal (error_symbol=..., data=...) at ../../src/eval.c:1544
#35 0x00000000006263fe in xsignal (error_symbol=..., data=...) at ../../src/eval.c:1581
#36 0x000000000062663c in signal_error (s=0x6fd2de "Undefined color", arg=...) at ../../src/eval.c:1636
#37 0x000000000054c091 in x_decode_color (f=0x26aafb0, color_name=..., mono_color=16777215) at ../../src/xfns.c:495
#38 0x000000000054c566 in x_set_background_color (f=0x26aafb0, arg=..., oldval=...) at ../../src/xfns.c:638
#39 0x000000000042d45d in x_set_frame_parameters (f=0x26aafb0, alist=...) at ../../src/frame.c:3152
#40 0x0000000000431ce6 in x_default_parameter (f=0x26aafb0, alist=..., prop=..., deflt=..., xprop=0x6fd49d "background", xclass=0x6fd908 "Background", type=RES_TYPE_STRING) at ../../src/frame.c:4374
#41 0x000000000055549d in x_create_tip_frame (dpyinfo=0x1622000, parms=..., text=...) at ../../src/xfns.c:5173
#42 0x0000000000556884 in Fx_show_tip (string=..., frame=..., parms=..., timeout=..., dx=..., dy=...) at ../../src/xfns.c:5543
#43 0x0000000000628116 in eval_sub (form=...) at ../../src/eval.c:2200
#44 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#45 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#46 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#47 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#48 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#49 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#50 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#51 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#52 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#53 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#54 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#55 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#56 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#57 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#58 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#59 0x000000000062a511 in funcall_lambda (fun=..., nargs=0, arg_vector=0x0) at ../../src/eval.c:2944
#60 0x0000000000629b19 in Ffuncall (nargs=1, args=0x7fffffffcbb0) at ../../src/eval.c:2779
#61 0x000000000062853a in Fapply (nargs=2, args=0x7fffffffcbb0) at ../../src/eval.c:2289
#62 0x0000000000629676 in Ffuncall (nargs=3, args=0x7fffffffcba8) at ../../src/eval.c:2698
#63 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#64 0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, arg_vector=0xadb72d) at ../../src/eval.c:2951
#65 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffd430) at ../../src/eval.c:2767
#66 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#67 0x0000000000582a83 in timer_check_2 (timers=..., idle_timers=...) at ../../src/keyboard.c:4533
#68 0x0000000000582bf2 in timer_check () at ../../src/keyboard.c:4600
#69 0x000000000058008d in readable_events (flags=1) at ../../src/keyboard.c:3434
#70 0x000000000058841c in get_input_pending (flags=1) at ../../src/keyboard.c:6818
#71 0x000000000058ff13 in detect_input_pending_run_timers (do_display=true) at ../../src/keyboard.c:9973
#72 0x0000000000684c13 in wait_reading_process_output (time_limit=2025, nsecs=0, read_kbd=-1, do_display=true, wait_for_cell=..., wait_proc=0x0, just_wait_proc=0) at ../../src/process.c:5014
#73 0x0000000000422610 in sit_for (timeout=..., reading=true, display_option=1) at ../../src/dispnew.c:5748
#74 0x000000000057de53 in read_char (commandflag=1, map=..., prev_event=..., used_mouse_menu=0x7fffffffe23f, end_time=0x0) at ../../src/keyboard.c:2781
#75 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffffe410, bufsize=30, prompt=..., dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#76 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#77 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#78 0x00000000005798be in command_loop_2 (ignore=...) at ../../src/keyboard.c:1139
#79 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 <command_loop_2>, arg=...) at ../../src/eval.c:1108
#80 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#81 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#82 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#83 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at ../../src/emacs.c:1626

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
"recursive-edit" (0xffffa410)
"debug" (0xffffac98)
"x-show-tip" (0xffffb810)
"progn" (0xffffbb20)
"if" (0xffffbd40)
"let*" (0xffffc040)
"progn" (0xffffc250)
"if" (0xffffc470)
"let*" (0xffffc770)
"eldoc-tooltip--make" (0xffffcbb8)
"apply" (0xffffcbb0)
"timer-event-handler" (0xffffd438)
(gdb) p c
$40 = (struct image_cache *) 0x0
(gdb)




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 14:42:48 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 10:42:48 2015
Received: from localhost ([127.0.0.1]:52829 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3me0-0007bc-1j
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:42:48 -0400
Received: from mtaout20.012.net.il ([80.179.55.166]:61929)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z3mdx-0007bM-LM
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:42:46 -0400
Received: from conversion-daemon.a-mtaout20.012.net.il by
 a-mtaout20.012.net.il (HyperSendmail v2007.08) id
 <0NPW00G000G1UW00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Sat, 13 Jun 2015 17:42:39 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPW00GIO0V2XG00@HIDDEN>;
 Sat, 13 Jun 2015 17:42:39 +0300 (IDT)
Date: Sat, 13 Jun 2015 17:42:36 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557C3E1F.6030305@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83twubpt43.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Sat, 13 Jun 2015 16:28:47 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> As I mentioned earlier this seems to be due to the fact that the
> debugger intervenes in some recursive fashion.  The crash happens after
> the backtrace window popped up and when I try to ‘switch-to-prev-buffer’
> in the window where the tooltip should have appeared.  Without that I'm
> _not_ able to reproduce the crash.
> 
>  > Can you see what is that frame, and why we didn't call
>  > init_frame_faces for it?
> 
> What makes you think this is not my normal frame in the first place and
> why init_frame_faces was not called for it?  Hmmm, I see, nothing can
> stop make_image_cache apparently.

Exactly.  It is created in init_frame_faces, and never removed as long
as the frame is alive.

> I'll look into this later

Thanks.

>  > Also, which image are we trying to display
>  > here?
> 
> How would I know?

I thought you could look that up in the debugger.  For example, the
value of 'spec' in frame #1 (see below) could tell.

>  > Something on the toolbar, perhaps?  Did you move mouse pointer
>  > over a tool-bar button to trigger a tooltip that failed?
> 
> The toolbar is disabled with my customizations.

Hmm... then what other images do we display?  Note that according to
the backtrace, we've found a 'display' property in  buffer, which
caused the call to lookup_image:

  #0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x198ee20) at ../../src/image.c:1775
  #1  0x00000000006c96e3 in lookup_image (f=0x13a7e00, spec=...) at ../../src/image.c:1686
  #2  0x000000000044bebc in handle_single_display_spec (it=0x7fffffff8ba0, spec=..., object=..., overlay=..., position=0x7fffffff8cd8, bufpos=203, display_replaced=0, frame_window_p=true) at ../../src/xdisp.c:5137
  [...]
  #6  0x0000000000454ee3 in next_element_from_buffer (it=0x7fffffff8ba0) at ../../src/xdisp.c:8133

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 14:29:06 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 10:29:06 2015
Received: from localhost ([127.0.0.1]:52819 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3mQj-0005ls-EQ
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:29:06 -0400
Received: from mout.gmx.net ([212.227.15.19]:65154)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z3mQh-0005lJ-AC
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:29:04 -0400
Received: from [178.190.161.122] ([178.190.161.122]) by mail.gmx.com
 (mrgmx001) with ESMTPSA (Nemesis) id 0MaaOf-1YkJlZ2aFd-00K7Nb; Sat, 13 Jun
 2015 16:28:56 +0200
Message-ID: <557C3E1F.6030305@HIDDEN>
Date: Sat, 13 Jun 2015 16:28:47 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN>
In-Reply-To: <83vberpv07.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:2P9it5LOblp2qQ4gvgXkPt/gLm17EvTLvApjeCE95LsaHlwGmpl
 Vn4Plqz2AqqjP5+HMY3u5V42TjfGvnv5nzHY+oRMrAi9rydiXsn8+XLvFG9C5DnQSsjdiNr
 W6ONiaD8/+VNqVg1r7E2gs9v3l3ghmrEJHozol7nwm9ePhi1LMQcCMwjyA/qn0S9dy+R15k
 VZA7diHLVffBHQ3mnCx4Q==
X-UI-Out-Filterresults: notjunk:1;V01:K0:Z0v80EP0pEI=:liTTJ+tgEJmYAKSNoPZ7OM
 slNzEQrEkGn+0frCRW32l0MW0KlMnhawqwi6AeMRR32L2RhjjYIiQtnxRWdAZYxZvLDo/RMYS
 MnF3LCjBN4MEQfJQBMaOgmvJATSJkc3Mk1y1JD75tLIxIdzmVIs/gxa0HbmxTyX6jgVh+waL4
 ukSfmPExLfDmw5ezw2xCPekhU9EO25eWZKYcdhQEomBFKDH9QtZIGVOxjNGt2mpu6mZeww52n
 Sc+eYFD0zIzQL2g2MqihN8cdWhUPRGMN5ETK0Va2EhQSAgxK5vLzKOKS214XGMNsXdN0cx350
 Jr8b2ufCvCHWDHI/qkan5O7xd5MafMypN6TlQzekF3tV098/NrdRuWkOaMRIX1oF6H5hVx2Gm
 6jhvbrxHDU2sossbNZbbLtr+Q8b4bgJxWoz6coXIMgG4Byufl0LJh3XN7vkudHbWMO5u/ei08
 LHvYhdsJr/KeRrX+H6LQeOUBXd3YkjodFqzezme/d5n0I9NtYvXRrfXqyXq2tYt0Nj7cK5f9t
 qA+YtnMEx4gzPqiYDsSgyCeceCkts5rK3WrDDpx7QcpFd1JTQjyzb1UqbucFvoPkehgGY5tNb
 qdLrb5BpVEXF4+cWY3zTq+nayJG3FaiqXgN81msfE/fT+YwuzNX70V/x7h0E2MVkZWBMQaxS/
 1biBnm9W9CI6a+tBtAmWRwRl+2SEbJB7T9T8ZUrsNM3qa7Q7P+FOoAUnTY6/dhX9KBPo=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > So FRAME_IMAGE_CACHE returns a NULL pointer, I guess.  But how did
 > that happen?  We allocate the cache in xfaces.c:init_frame_faces.  I
 > could understand why init_frame_faces was not yet called for the tip
 > frame we were trying to create, but the crash happens because of a
 > different frame.  Look:
 >
 >    #37 0x000000000054c091 in x_decode_color (f=3D0x24d2c30, color_name=
=3D..., mono_color=3D16777215) at ../../src/xfns.c:495
 >    #38 0x000000000054c566 in x_set_background_color (f=3D0x24d2c30, ar=
g=3D..., oldval=3D...) at ../../src/xfns.c:638
 >    #39 0x000000000042d45d in x_set_frame_parameters (f=3D0x24d2c30, al=
ist=3D...) at ../../src/frame.c:3152
 >    #40 0x0000000000431ce6 in x_default_parameter (f=3D0x24d2c30, alist=
=3D..., prop=3D..., deflt=3D..., xprop=3D0x6fd49d "background", xclass=3D=
0x6fd908 "Background", type=3DRES_TYPE_STRING) at ../../src/frame.c:4374
 >    #41 0x000000000055549d in x_create_tip_frame (dpyinfo=3D0x1621ee0, =
parms=3D..., text=3D...) at ../../src/xfns.c:5173
 >
 > This is the tip frame we are creating, its pointer is 0x24d2c30.  But
 > when we crash, it's for a different frame, whose pointer is 0x13a7e00:=

 >
 >    #0  0x00000000006c9b5c in cache_image (f=3D0x13a7e00, img=3D0x249e0=
10) at ../../src/image.c:1775
 >    #1  0x00000000006c96e3 in lookup_image (f=3D0x13a7e00, spec=3D...) =
at ../../src/image.c:1686

As I mentioned earlier this seems to be due to the fact that the
debugger intervenes in some recursive fashion.  The crash happens after
the backtrace window popped up and when I try to =E2=80=98switch-to-prev-=
buffer=E2=80=99
in the window where the tooltip should have appeared.  Without that I'm
_not_ able to reproduce the crash.

 > Can you see what is that frame, and why we didn't call
 > init_frame_faces for it?

What makes you think this is not my normal frame in the first place and
why init_frame_faces was not called for it?  Hmmm, I see, nothing can
stop make_image_cache apparently.  I'll look into this later - sounds
like a thunderstorm approaching and I'll rather switch off my machine.

 > Also, which image are we trying to display
 > here?

How would I know?  I never see one because I build without image
support.

 > Something on the toolbar, perhaps?  Did you move mouse pointer
 > over a tool-bar button to trigger a tooltip that failed?

The toolbar is disabled with my customizations.

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 14:01:59 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 10:01:59 2015
Received: from localhost ([127.0.0.1]:52785 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3m0U-000565-Ol
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:01:59 -0400
Received: from mtaout28.012.net.il ([80.179.55.184]:53261)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z3m0Q-00055o-0T
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:01:56 -0400
Received: from conversion-daemon.mtaout28.012.net.il by mtaout28.012.net.il
 (HyperSendmail v2007.08) id <0NPV00A00YRCCB00@HIDDEN> for
 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 17:01:18 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout28.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPV0061LYY6CZ50@HIDDEN>; Sat, 13 Jun 2015 17:01:18 +0300 (IDT)
Date: Sat, 13 Jun 2015 17:01:44 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557C2EF2.5030308@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83vberpv07.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Sat, 13 Jun 2015 15:24:02 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
>  > Thanks, but I still cannot reproduce this.  (On what OS did you
>  > reproduce it?)
> 
> A Gtk build on Debian.  Run with all my customizations.

I see that x_decode_color in xfns.c signals an error, while the same
function in w32fns.c doesn't.  But even if I add the call to
signal_error to w32fns.c's implementation, I still cannot reproduce
the crash.  I do see an error message in the echo area, but no
debugger pops up.

> Sorry, I forgot to tell.  Line 1775 of image.c here is
> 
>    for (i = 0; i < c->used; ++i)
> 
> in the context of
> 
>    struct image_cache *c = FRAME_IMAGE_CACHE (f);
>    ptrdiff_t i;
> 
>    /* Find a free slot in c->images.  */
>    for (i = 0; i < c->used; ++i)
>      if (c->images[i] == NULL)
>        break;
> 
>    /* If no free slot found, maybe enlarge c->images.  */
> 
> in cache_image.  i is still 0 and I get
> 
> (gdb) p c->used
> Cannot access memory at address 0x18

So FRAME_IMAGE_CACHE returns a NULL pointer, I guess.  But how did
that happen?  We allocate the cache in xfaces.c:init_frame_faces.  I
could understand why init_frame_faces was not yet called for the tip
frame we were trying to create, but the crash happens because of a
different frame.  Look:

  #37 0x000000000054c091 in x_decode_color (f=0x24d2c30, color_name=..., mono_color=16777215) at ../../src/xfns.c:495
  #38 0x000000000054c566 in x_set_background_color (f=0x24d2c30, arg=..., oldval=...) at ../../src/xfns.c:638
  #39 0x000000000042d45d in x_set_frame_parameters (f=0x24d2c30, alist=...) at ../../src/frame.c:3152
  #40 0x0000000000431ce6 in x_default_parameter (f=0x24d2c30, alist=..., prop=..., deflt=..., xprop=0x6fd49d "background", xclass=0x6fd908 "Background", type=RES_TYPE_STRING) at ../../src/frame.c:4374
  #41 0x000000000055549d in x_create_tip_frame (dpyinfo=0x1621ee0, parms=..., text=...) at ../../src/xfns.c:5173

This is the tip frame we are creating, its pointer is 0x24d2c30.  But
when we crash, it's for a different frame, whose pointer is 0x13a7e00:

  #0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x249e010) at ../../src/image.c:1775
  #1  0x00000000006c96e3 in lookup_image (f=0x13a7e00, spec=...) at ../../src/image.c:1686

Can you see what is that frame, and why we didn't call
init_frame_faces for it?  Also, which image are we trying to display
here?  Something on the toolbar, perhaps?  Did you move mouse pointer
over a tool-bar button to trigger a tooltip that failed?




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 13:24:21 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 09:24:21 2015
Received: from localhost ([127.0.0.1]:52467 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3lQ4-00048o-BK
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 09:24:21 -0400
Received: from mout.gmx.net ([212.227.15.18]:58096)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z3lQ2-00048a-6K
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 09:24:19 -0400
Received: from [188.22.238.237] ([188.22.238.237]) by mail.gmx.com (mrgmx002)
 with ESMTPSA (Nemesis) id 0LsCdj-1ZAFGu1lTr-013sNl;
 Sat, 13 Jun 2015 15:24:11 +0200
Message-ID: <557C2EF2.5030308@HIDDEN>
Date: Sat, 13 Jun 2015 15:24:02 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN>
In-Reply-To: <831thfri91.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:rhXgKLmDzAiSMS9vj/YbsOh6QrvWJrltINE/nLTqyfHUpUOk/f9
 u5P3W23XCMjOWhWmLQ8CtEN25jpi22i9ot3+TAsDTUqM5ouGvLd8G7/72LlWMId47lqB0qC
 lg+3x1/qDwTdxc3GCGg3JV4EUYnXB+z4Pi+isI9LVOJXThqJ0Qki/51+hYPm7DSESkk+H+C
 2boQ5RcMLI7xVuKoG9S2A==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Thanks, but I still cannot reproduce this.  (On what OS did you
 > reproduce it?)

A Gtk build on Debian.  Run with all my customizations.

 > I also see no backtrace buffers, just a silent message
 > in *Messages* about its being unable to load the bogus color I
 > specified.  Can you help by showing values of variables involved in
 > the crash?
 >
 >> #0  0x00000000006c9b5c in cache_image (f=3D0x13a7e00, img=3D0x198ee20=
) at ../../src/image.c:1775
 >
 > Is this in v24.5 or in the current master?  If the latter, line 1775
 > of image.c is this:
 >
 > 	  else if (EQ (ascent, Qcenter))
 > 	    img->ascent =3D CENTERED_IMAGE_ASCENT;  <<<<<<<<<<<<<
 >
 > So is value of img a NULL pointer?  (The argument img in the call
 > above indicates it's non-NULL, but maybe your GDB shows only the value=

 > at entry?)
 >
 > If it's not NULL, and this is the correct line, then what caused the
 > crash?

Sorry, I forgot to tell.  Line 1775 of image.c here is

   for (i =3D 0; i < c->used; ++i)

in the context of

   struct image_cache *c =3D FRAME_IMAGE_CACHE (f);
   ptrdiff_t i;

   /* Find a free slot in c->images.  */
   for (i =3D 0; i < c->used; ++i)
     if (c->images[i] =3D=3D NULL)
       break;

   /* If no free slot found, maybe enlarge c->images.  */

in cache_image.  i is still 0 and I get

(gdb) p c->used
Cannot access memory at address 0x18

which should explain the direct cause of the segfault.

This is from a not-up-to-date version of trunk with some modifications I
made (none in image.c though).  A backtrace with some more data from the
Lisp part is below.

 > (I'm also puzzled what does this have to do with tooltips, since we
 > show no images in the tooltips, and customizing faces for the tooltip
 > frames should not affect showing images in other frames.)

Maybe it's the =E2=80=98debug=E2=80=99 call interfering?

martin


#0  0x00000000006c9b5c in cache_image (f=3D0x13a7e00, img=3D0x249e010) at=
 ../../src/image.c:1775
#1  0x00000000006c96e3 in lookup_image (f=3D0x13a7e00, spec=3D...) at ../=
=2E./src/image.c:1686
#2  0x000000000044bebc in handle_single_display_spec (it=3D0x7fffffff46f0=
, spec=3D..., object=3D..., overlay=3D..., position=3D0x7fffffff4828, buf=
pos=3D203, display_replaced=3D0, frame_window_p=3Dtrue) at ../../src/xdis=
p.c:5137
#3  0x00000000004498cd in handle_display_spec (it=3D0x7fffffff46f0, spec=3D=
=2E.., object=3D..., overlay=3D..., position=3D0x7fffffff4828, bufpos=3D2=
03, frame_window_p=3Dtrue) at ../../src/xdisp.c:4654
#4  0x00000000004492c8 in handle_display_prop (it=3D0x7fffffff46f0) at ..=
/../src/xdisp.c:4576
#5  0x0000000000445e8d in handle_stop (it=3D0x7fffffff46f0) at ../../src/=
xdisp.c:3299
#6  0x0000000000454ee3 in next_element_from_buffer (it=3D0x7fffffff46f0) =
at ../../src/xdisp.c:8133
#7  0x00000000004511b5 in get_next_display_element (it=3D0x7fffffff46f0) =
at ../../src/xdisp.c:6785
#8  0x000000000047e4ea in display_line (it=3D0x7fffffff46f0) at ../../src=
/xdisp.c:20132
#9  0x00000000004719a2 in try_window (window=3D..., pos=3D..., flags=3D1)=
 at ../../src/xdisp.c:16892
#10 0x000000000046df50 in redisplay_window (window=3D..., just_this_one_p=
=3Dfalse) at ../../src/xdisp.c:16365
#11 0x00000000004654d0 in redisplay_window_0 (window=3D...) at ../../src/=
xdisp.c:14184
#12 0x0000000000625c43 in internal_condition_case_1 (bfun=3D0x46548e <red=
isplay_window_0>, arg=3D..., handlers=3D..., hfun=3D0x465456 <redisplay_w=
indow_error>) at ../../src/eval.c:1372
#13 0x000000000046542c in redisplay_windows (window=3D...) at ../../src/x=
disp.c:14164
#14 0x00000000004653e2 in redisplay_windows (window=3D...) at ../../src/x=
disp.c:14158
#15 0x00000000004641e1 in redisplay_internal () at ../../src/xdisp.c:1375=
6
#16 0x0000000000461e04 in redisplay () at ../../src/xdisp.c:13019
#17 0x000000000057d4a3 in read_char (commandflag=3D1, map=3D..., prev_eve=
nt=3D..., used_mouse_menu=3D0x7fffffff9d8f, end_time=3D0x0) at ../../src/=
keyboard.c:2542
#18 0x000000000058e17f in read_key_sequence (keybuf=3D0x7fffffff9f60, buf=
size=3D30, prompt=3D..., dont_downcase_last=3Dfalse, can_return_switch_fr=
ame=3Dtrue, fix_current_buffer=3Dtrue, prevent_redisplay=3Dfalse) at ../.=
=2E/src/keyboard.c:9156
#19 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#20 0x0000000000625ac9 in internal_condition_case (bfun=3D0x579c90 <comma=
nd_loop_1>, handlers=3D..., hfun=3D0x579300 <cmd_error>) at ../../src/eva=
l.c:1348
#21 0x00000000005798be in command_loop_2 (ignore=3D...) at ../../src/keyb=
oard.c:1139
#22 0x0000000000624ec4 in internal_catch (tag=3D..., func=3D0x579895 <com=
mand_loop_2>, arg=3D...) at ../../src/eval.c:1108
#23 0x00000000005797f6 in command_loop () at ../../src/keyboard.c:1110
#24 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728=

#25 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#26 0x000000000062978c in Ffuncall (nargs=3D1, args=3D0x7fffffffa408) at =
=2E./../src/eval.c:2715
#27 0x0000000000675d20 in exec_byte_code (bytestr=3D..., vector=3D..., ma=
xdepth=3D..., args_template=3D..., nargs=3D2, args=3D0x7fffffffac98) at .=
=2E/../src/bytecode.c:919
#28 0x000000000062a11f in funcall_lambda (fun=3D..., nargs=3D2, arg_vecto=
r=3D0x7fffffffac98) at ../../src/eval.c:2885
#29 0x0000000000629a1a in Ffuncall (nargs=3D3, args=3D0x7fffffffac90) at =
=2E./../src/eval.c:2767
#30 0x0000000000628a06 in Fapply (nargs=3D2, args=3D0x7fffffffada0) at ..=
/../src/eval.c:2337
#31 0x00000000006290fc in apply1 (fn=3D..., arg=3D...) at ../../src/eval.=
c:2558
#32 0x0000000000622711 in call_debugger (arg=3D...) at ../../src/eval.c:3=
09
#33 0x0000000000626ab3 in maybe_call_debugger (conditions=3D..., sig=3D..=
=2E, data=3D...) at ../../src/eval.c:1726
#34 0x00000000006262c8 in Fsignal (error_symbol=3D..., data=3D...) at ../=
=2E./src/eval.c:1544
#35 0x00000000006263fe in xsignal (error_symbol=3D..., data=3D...) at ../=
=2E./src/eval.c:1581
#36 0x000000000062663c in signal_error (s=3D0x6fd2de "Undefined color", a=
rg=3D...) at ../../src/eval.c:1636
#37 0x000000000054c091 in x_decode_color (f=3D0x24d2c30, color_name=3D...=
, mono_color=3D16777215) at ../../src/xfns.c:495
#38 0x000000000054c566 in x_set_background_color (f=3D0x24d2c30, arg=3D..=
=2E, oldval=3D...) at ../../src/xfns.c:638
#39 0x000000000042d45d in x_set_frame_parameters (f=3D0x24d2c30, alist=3D=
=2E..) at ../../src/frame.c:3152
#40 0x0000000000431ce6 in x_default_parameter (f=3D0x24d2c30, alist=3D...=
, prop=3D..., deflt=3D..., xprop=3D0x6fd49d "background", xclass=3D0x6fd9=
08 "Background", type=3DRES_TYPE_STRING) at ../../src/frame.c:4374
#41 0x000000000055549d in x_create_tip_frame (dpyinfo=3D0x1621ee0, parms=3D=
=2E.., text=3D...) at ../../src/xfns.c:5173
#42 0x0000000000556884 in Fx_show_tip (string=3D..., frame=3D..., parms=3D=
=2E.., timeout=3D..., dx=3D..., dy=3D...) at ../../src/xfns.c:5543
#43 0x0000000000628116 in eval_sub (form=3D...) at ../../src/eval.c:2200
#44 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#45 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#46 0x00000000006229d4 in Fif (args=3D...) at ../../src/eval.c:396
#47 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#48 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#49 0x000000000062437c in FletX (args=3D...) at ../../src/eval.c:896
#50 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#51 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#52 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#53 0x00000000006229d4 in Fif (args=3D...) at ../../src/eval.c:396
#54 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#55 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#56 0x000000000062437c in FletX (args=3D...) at ../../src/eval.c:896
#57 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#58 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#59 0x000000000062a511 in funcall_lambda (fun=3D..., nargs=3D0, arg_vecto=
r=3D0x0) at ../../src/eval.c:2944
#60 0x0000000000629b19 in Ffuncall (nargs=3D1, args=3D0x7fffffffcbb0) at =
=2E./../src/eval.c:2779
#61 0x000000000062853a in Fapply (nargs=3D2, args=3D0x7fffffffcbb0) at ..=
/../src/eval.c:2289
#62 0x0000000000629676 in Ffuncall (nargs=3D3, args=3D0x7fffffffcba8) at =
=2E./../src/eval.c:2698
#63 0x0000000000675d20 in exec_byte_code (bytestr=3D..., vector=3D..., ma=
xdepth=3D..., args_template=3D..., nargs=3D0, args=3D0x0) at ../../src/by=
tecode.c:919
#64 0x000000000062a5b1 in funcall_lambda (fun=3D..., nargs=3D1, arg_vecto=
r=3D0xadb72d) at ../../src/eval.c:2951
#65 0x0000000000629a1a in Ffuncall (nargs=3D2, args=3D0x7fffffffd430) at =
=2E./../src/eval.c:2767
#66 0x0000000000629153 in call1 (fn=3D..., arg1=3D...) at ../../src/eval.=
c:2573
#67 0x0000000000582a83 in timer_check_2 (timers=3D..., idle_timers=3D...)=
 at ../../src/keyboard.c:4533
#68 0x0000000000582bf2 in timer_check () at ../../src/keyboard.c:4600
#69 0x000000000058008d in readable_events (flags=3D1) at ../../src/keyboa=
rd.c:3434
#70 0x000000000058841c in get_input_pending (flags=3D1) at ../../src/keyb=
oard.c:6818
#71 0x000000000058ff13 in detect_input_pending_run_timers (do_display=3Dt=
rue) at ../../src/keyboard.c:9973
#72 0x0000000000684c13 in wait_reading_process_output (time_limit=3D2025,=
 nsecs=3D0, read_kbd=3D-1, do_display=3Dtrue, wait_for_cell=3D..., wait_p=
roc=3D0x0, just_wait_proc=3D0) at ../../src/process.c:5014
#73 0x0000000000422610 in sit_for (timeout=3D..., reading=3Dtrue, display=
_option=3D1) at ../../src/dispnew.c:5748
#74 0x000000000057de53 in read_char (commandflag=3D1, map=3D..., prev_eve=
nt=3D..., used_mouse_menu=3D0x7fffffffe23f, end_time=3D0x0) at ../../src/=
keyboard.c:2781
#75 0x000000000058e17f in read_key_sequence (keybuf=3D0x7fffffffe410, buf=
size=3D30, prompt=3D..., dont_downcase_last=3Dfalse, can_return_switch_fr=
ame=3Dtrue, fix_current_buffer=3Dtrue, prevent_redisplay=3Dfalse) at ../.=
=2E/src/keyboard.c:9156
#76 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#77 0x0000000000625ac9 in internal_condition_case (bfun=3D0x579c90 <comma=
nd_loop_1>, handlers=3D..., hfun=3D0x579300 <cmd_error>) at ../../src/eva=
l.c:1348
#78 0x00000000005798be in command_loop_2 (ignore=3D...) at ../../src/keyb=
oard.c:1139
#79 0x0000000000624ec4 in internal_catch (tag=3D..., func=3D0x579895 <com=
mand_loop_2>, arg=3D...) at ../../src/eval.c:1108
#80 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#81 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728=

#82 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#83 0x0000000000576cd3 in main (argc=3D1, argv=3D0x7fffffffe8e8) at ../..=
/src/emacs.c:1626

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
"recursive-edit" (0xffffa410)
"debug" (0xffffac98)
"x-show-tip" (0xffffb810)
"progn" (0xffffbb20)
"if" (0xffffbd40)
"let*" (0xffffc040)
"progn" (0xffffc250)
"if" (0xffffc470)
"let*" (0xffffc770)
"eldoc-tooltip--make" (0xffffcbb8)
"apply" (0xffffcbb0)
"timer-event-handler" (0xffffd438)






Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 10:54:30 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 06:54:30 2015
Received: from localhost ([127.0.0.1]:52409 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3j54-0007a9-7m
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 06:54:30 -0400
Received: from mtaout22.012.net.il ([80.179.55.172]:37514)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z3j51-0007Zv-CD
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 06:54:28 -0400
Received: from conversion-daemon.a-mtaout22.012.net.il by
 a-mtaout22.012.net.il (HyperSendmail v2007.08) id
 <0NPV00G00PNDIW00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Sat, 13 Jun 2015 13:54:20 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout22.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPV00GLBQAKKZ00@HIDDEN>;
 Sat, 13 Jun 2015 13:54:20 +0300 (IDT)
Date: Sat, 13 Jun 2015 13:54:18 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557C0526.5050607@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <831thfri91.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Sat, 13 Jun 2015 12:25:42 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: 20802 <at> debbugs.gnu.org
> 
> Below is a bt after setting an invalid background color.  Tooltips are
> shown via ‘x-show-tip’ and the crash triggers after the backtrace buffer
> complaining about the invalid color popped up and I tried to switch to
> another buffer.  I have no idea whether it's the OP's original issue.

Thanks, but I still cannot reproduce this.  (On what OS did you
reproduce it?)  I also see no backtrace buffers, just a silent message
in *Messages* about its being unable to load the bogus color I
specified.  Can you help by showing values of variables involved in
the crash?

> #0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x198ee20) at ../../src/image.c:1775

Is this in v24.5 or in the current master?  If the latter, line 1775
of image.c is this:

	  else if (EQ (ascent, Qcenter))
	    img->ascent = CENTERED_IMAGE_ASCENT;  <<<<<<<<<<<<<

So is value of img a NULL pointer?  (The argument img in the call
above indicates it's non-NULL, but maybe your GDB shows only the value
at entry?)

If it's not NULL, and this is the correct line, then what caused the
crash?

(I'm also puzzled what does this have to do with tooltips, since we
show no images in the tooltips, and customizing faces for the tooltip
frames should not affect showing images in other frames.)

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 10:26:04 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 06:26:04 2015
Received: from localhost ([127.0.0.1]:52359 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3idV-0006sk-5c
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 06:26:03 -0400
Received: from mout.gmx.net ([212.227.15.15]:63676)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z3idR-0006sW-Qb
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 06:25:58 -0400
Received: from [178.191.142.117] ([178.191.142.117]) by mail.gmx.com
 (mrgmx001) with ESMTPSA (Nemesis) id 0Lq9oW-1ZYfjr0lqy-00drLX; Sat, 13 Jun
 2015 12:25:51 +0200
Message-ID: <557C0526.5050607@HIDDEN>
Date: Sat, 13 Jun 2015 12:25:42 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>, Tobias Getzner <tobias.getzner@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
In-Reply-To: <83381wq76d.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:K76Daq4aDm42FUnnNC0PHaaPd8WEQjHQaGrNIQ7wJA0oBj1aIvp
 6I/ZAf2q4ouK2I55TTo5DuiddFQeiiRlUs4HAtqug30zADM4/8bTJU2Kbj1PwAAtW5ZmaXN
 ozHKPU0zvFv5nLyagqP2O68MmVLUckoJlYjwB+29FwWIiOsf0FAPbM45mLkkntZHjoKQeD3
 R2d4cV/uZDhCbQPBbZ58Q==
X-UI-Out-Filterresults: notjunk:1;V01:K0:3ac8Q93IQPo=:yDQ0V47HJ81BmVWXQNaaTN
 BccGoyAzHqc8WXRyuP0Ai3PP1NHRkDrZmpAt3kekJ79soplzbqUwmkkAftkPPNIM4x/7/9Do3
 LJSoW0lYKrhjSHS/F1RP46QeuwjYH/lT8CUmWipEHLY2COcoB6LNg5u4U4O+sSfnF88JeTLrd
 vJ/8sYsTTP95NYiyDbKa99twNWZWz3KQvyqi282Mmwhy27nzlY/ZUa4dvKUIDvhXnJXxE17jp
 7ijV9RbdWefXPzK7L8nwTZ4oKXzgg8jokwa1NLWPHs3j1Jup1GdumaSMUlXzplsZzkvxXXLfh
 FokUbqt7oTqdX48TyO1iFKSY8O5qGYrVrwQClxBBpjh33Ilhifb1GKKK1E2lhsEiswWSlbmhY
 OmNrDyuIYSTraW7JYxpYENnuWz5RSkV0Y1dFYjk2fwUa8ayUuyu+GEYpLuYfAvEsZEZOTJBsa
 QbZTI1UxExTfPRdO7mcfVavPJ4l12llg81XZjN4K/smzdRpEe/c82F+leiul/ycJkCxi/aJLb
 Js3Ccz+F/roWxSquEmPpTicScogsi/DKQZ+es48/XGebcQO5jEoYs5HWAEPnpZ4rSjy6EVAcA
 SR3mNbEJtKyg1MrhOp/+qbPOxL6rEfYL7p0chdJ4W/IIWA7TkntkU2IBzG77PSeIN5TcjfBCp
 F9Uf2/VvumWe/Ay+IWvgdhSBePiRtuSqt+0EzD0+xLnfVBgHq0Nz/5xZT6KoDSMB/uUk=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 >> When x-gtk-use-system-tooltips is set to nil, and the tooltip face is=

 >> customized using an invalid color string such as #zz, Emacs will
 >> segfault when a tooltip is being drawn.
 >
 > I cannot reproduce this on my system, so please show a backtrace from
 > running Emacs inside GDB.  Also, please tell how you customized the
 > face color, exactly -- it could be that only some specific ways of
 > customizing it cause the problem.

Below is a bt after setting an invalid background color.  Tooltips are
shown via =E2=80=98x-show-tip=E2=80=99 and the crash triggers after the b=
acktrace buffer
complaining about the invalid color popped up and I tried to switch to
another buffer.  I have no idea whether it's the OP's original issue.

martin


#0  0x00000000006c9b5c in cache_image (f=3D0x13a7e00, img=3D0x198ee20) at=
 ../../src/image.c:1775
#1  0x00000000006c96e3 in lookup_image (f=3D0x13a7e00, spec=3D...) at ../=
=2E./src/image.c:1686
#2  0x000000000044bebc in handle_single_display_spec (it=3D0x7fffffff8ba0=
, spec=3D..., object=3D..., overlay=3D..., position=3D0x7fffffff8cd8, buf=
pos=3D203, display_replaced=3D0, frame_window_p=3Dtrue) at ../../src/xdis=
p.c:5137
#3  0x00000000004498cd in handle_display_spec (it=3D0x7fffffff8ba0, spec=3D=
=2E.., object=3D..., overlay=3D..., position=3D0x7fffffff8cd8, bufpos=3D2=
03, frame_window_p=3Dtrue) at ../../src/xdisp.c:4654
#4  0x00000000004492c8 in handle_display_prop (it=3D0x7fffffff8ba0) at ..=
/../src/xdisp.c:4576
#5  0x0000000000445e8d in handle_stop (it=3D0x7fffffff8ba0) at ../../src/=
xdisp.c:3299
#6  0x0000000000454ee3 in next_element_from_buffer (it=3D0x7fffffff8ba0) =
at ../../src/xdisp.c:8133
#7  0x00000000004511b5 in get_next_display_element (it=3D0x7fffffff8ba0) =
at ../../src/xdisp.c:6785
#8  0x000000000047e4ea in display_line (it=3D0x7fffffff8ba0) at ../../src=
/xdisp.c:20132
#9  0x00000000004719a2 in try_window (window=3D..., pos=3D..., flags=3D1)=
 at ../../src/xdisp.c:16892
#10 0x000000000046df50 in redisplay_window (window=3D..., just_this_one_p=
=3Dfalse) at ../../src/xdisp.c:16365
#11 0x00000000004654d0 in redisplay_window_0 (window=3D...) at ../../src/=
xdisp.c:14184
#12 0x0000000000625c43 in internal_condition_case_1 (bfun=3D0x46548e <red=
isplay_window_0>, arg=3D..., handlers=3D..., hfun=3D0x465456 <redisplay_w=
indow_error>) at ../../src/eval.c:1372
#13 0x000000000046542c in redisplay_windows (window=3D...) at ../../src/x=
disp.c:14164
#14 0x00000000004653e2 in redisplay_windows (window=3D...) at ../../src/x=
disp.c:14158
#15 0x00000000004641e1 in redisplay_internal () at ../../src/xdisp.c:1375=
6
#16 0x0000000000461e04 in redisplay () at ../../src/xdisp.c:13019
#17 0x000000000057d4a3 in read_char (commandflag=3D1, map=3D..., prev_eve=
nt=3D..., used_mouse_menu=3D0x7fffffffe23f, end_time=3D0x0) at ../../src/=
keyboard.c:2542
#18 0x000000000058e17f in read_key_sequence (keybuf=3D0x7fffffffe410, buf=
size=3D30, prompt=3D..., dont_downcase_last=3Dfalse, can_return_switch_fr=
ame=3Dtrue, fix_current_buffer=3Dtrue, prevent_redisplay=3Dfalse) at ../.=
=2E/src/keyboard.c:9156
#19 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#20 0x0000000000625ac9 in internal_condition_case (bfun=3D0x579c90 <comma=
nd_loop_1>, handlers=3D..., hfun=3D0x579300 <cmd_error>) at ../../src/eva=
l.c:1348
#21 0x00000000005798be in command_loop_2 (ignore=3D...) at ../../src/keyb=
oard.c:1139
#22 0x0000000000624ec4 in internal_catch (tag=3D..., func=3D0x579895 <com=
mand_loop_2>, arg=3D...) at ../../src/eval.c:1108
#23 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#24 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728=

#25 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#26 0x0000000000576cd3 in main (argc=3D1, argv=3D0x7fffffffe8e8) at ../..=
/src/emacs.c:1626

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 09:39:03 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 05:39:03 2015
Received: from localhost ([127.0.0.1]:52353 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3hu2-0005ie-Eu
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:39:03 -0400
Received: from mtaout22.012.net.il ([80.179.55.172]:59379)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z3htz-0005i7-PF
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:39:00 -0400
Received: from conversion-daemon.a-mtaout22.012.net.il by
 a-mtaout22.012.net.il (HyperSendmail v2007.08) id
 <0NPV00G00ME43T00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Sat, 13 Jun 2015 12:38:53 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout22.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPV00FEVMSTYI80@HIDDEN>;
 Sat, 13 Jun 2015 12:38:53 +0300 (IDT)
Date: Sat, 13 Jun 2015 12:38:50 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <1434187118.10061.4.camel@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: Tobias Getzner <tobias.getzner@HIDDEN>
Message-id: <83381wq76d.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> From: Tobias Getzner <tobias.getzner@HIDDEN>
> Date: Sat, 13 Jun 2015 11:18:38 +0200
> 
> When x-gtk-use-system-tooltips is set to nil, and the tooltip face is
> customized using an invalid color string such as #zz, Emacs will
> segfault when a tooltip is being drawn.

I cannot reproduce this on my system, so please show a backtrace from
running Emacs inside GDB.  Also, please tell how you customized the
face color, exactly -- it could be that only some specific ways of
customizing it cause the problem.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 13 Jun 2015 09:18:55 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 05:18:55 2015
Received: from localhost ([127.0.0.1]:52336 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3haZ-0005DH-Bk
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:18:55 -0400
Received: from eggs.gnu.org ([208.118.235.92]:35464)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haW-0005D5-VV
 for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:18:53 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haQ-0005Hk-R6
 for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:18:47 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=0.0 required=5.0 tests=BAYES_40,FREEMAIL_FROM
 autolearn=disabled version=3.3.2
Received: from lists.gnu.org ([2001:4830:134:3::11]:52011)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haQ-0005Hg-Nx
 for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:18:46 -0400
Received: from eggs.gnu.org ([2001:4830:134:3::10]:48965)
 by lists.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haP-0004ww-O4
 for bug-gnu-emacs@HIDDEN; Sat, 13 Jun 2015 05:18:46 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haL-0005HK-Nu
 for bug-gnu-emacs@HIDDEN; Sat, 13 Jun 2015 05:18:45 -0400
Received: from mout.gmx.net ([212.227.17.20]:58896)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haL-0005HE-Ek
 for bug-gnu-emacs@HIDDEN; Sat, 13 Jun 2015 05:18:41 -0400
Received: from wirrsal ([78.49.163.59]) by mail.gmx.com (mrgmx102) with
 ESMTPSA (Nemesis) id 0LgNGi-1ZQbjX1xeW-00ng36 for <bug-gnu-emacs@HIDDEN>;
 Sat, 13 Jun 2015 11:18:39 +0200
Message-ID: <1434187118.10061.4.camel@HIDDEN>
Subject: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: bug-gnu-emacs@HIDDEN
Date: Sat, 13 Jun 2015 11:18:38 +0200
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:/K7iaxuCdR8/sYrodEfV/8C4kRwotKklAHSmnjH4dbjCCn93wqW
 rjDJaApcCf+XVyrMjmjMCKpqEfTpzPKdDaH103dVpGsKUIacrk/lE/rDkczdW8QkKli5dsS
 q8EbmMowZStH7nKlwMdvoJwdVFP8kgY5p2oRKge9YkU/HlBhl3Cxl3T+mH83hVGWHRpgwzN
 F8G/xkYIx3DJXQTTt2veg==
X-UI-Out-Filterresults: notjunk:1;
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic]
X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address
 (bad octet value).
X-Received-From: 2001:4830:134:3::11
X-Spam-Score: -4.1 (----)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -4.1 (----)

When x-gtk-use-system-tooltips is set to nil, and the tooltip face is
customized using an invalid color string such as #zz, Emacs will
segfault when a tooltip is being drawn.

This is for Emacs 24.5.
 Best regards,
TG





Acknowledgement sent to Tobias Getzner <tobias.getzner@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-gnu-emacs@HIDDEN. Full text available.
Report forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Tue, 16 Jun 2015 16:00:06 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.