GNU bug report logs - #20802
Segfault when showing non-GTK+ tooltip

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: emacs; Reported by: Tobias Getzner <tobias.getzner@HIDDEN>; dated Sat, 13 Jun 2015 09:19:02 UTC; Maintainer for emacs is bug-gnu-emacs@HIDDEN.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 19 Jun 2015 06:44:10 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Fri Jun 19 02:44:09 2015
Received: from localhost ([127.0.0.1]:51562 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5q25-0002CQ-JY
	for submit <at> debbugs.gnu.org; Fri, 19 Jun 2015 02:44:09 -0400
Received: from mout.gmx.net ([212.227.15.19]:63333)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z5q1t-0002Ba-UJ
 for 20802 <at> debbugs.gnu.org; Fri, 19 Jun 2015 02:44:07 -0400
Received: from [93.82.78.60] ([93.82.78.60]) by mail.gmx.com (mrgmx001) with
 ESMTPSA (Nemesis) id 0MdKDb-1ZMgDs2FL1-00ISaS; Fri, 19 Jun 2015 08:43:51
 +0200
Message-ID: <5583BA21.5080907@HIDDEN>
Date: Fri, 19 Jun 2015 08:43:45 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <55813F99.8070801@HIDDEN>
 <83bngemgqv.fsf@HIDDEN> <5582C990.5020009@HIDDEN> <83bngdko70.fsf@HIDDEN>
 <5582F65D.2020204@HIDDEN> <838ubhkkb6.fsf@HIDDEN> <55830187.1000802@HIDDEN>
 <834mm4lwvz.fsf@HIDDEN>
In-Reply-To: <834mm4lwvz.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:OsPsqY5M6kwk8XrquVNUajfcPgKmONSGcmZdDhfJyWXWLxe/IJG
 +lKTP8i9G+rrsqn9AoWMjmjrEeu114VBeQAdIfLImm8/Oedu9Rq0uC0BVygpwElNt52yjV5
 3cDbD7xE3dNQ+6kPeRUgmAb/CX1a+Xxr7rKxodc1omiJ37chlSRkeB0sihW9o2sqVkT1KiN
 Lq4jAVqhJGANvfsRM+7jg==
X-UI-Out-Filterresults: notjunk:1;V01:K0:HpKpcOVCgJs=:DN4pAxvIUUiZa5MSHVrnfu
 X6i78dDLY2U+uSAKZyVc6uqV4fQpzqkXq4OQn95Ial8sR+TkphOxcK0CCtoF8FePg+aGw/BP6
 z8XrBb23bV5LRxitVdEx+nFD81UGIt4r6O3TM5WtxBYp27FQEVHX6EbniTUY8Vv/lxtMRQFCK
 z8++NKjZI4B5TAeCZbrgDnjWd9nAkLNvDB9oiXVOr+EVWXGIVOmtXoQVEHChs5/+gO5E0Rf0s
 zKNRapnkBvJoF6QVmRs+2ypa0R6PZ7Ob2Up0Ri5280jP81zeWvWYeKYG7H9GiLSOcOM+lsyB2
 n3XiAdOyN/97Xt7IoFrdXBNaFcavHivmJdm5VwNeVPw74hRvoFgyMuAY7qLHXc0pxgscsci63
 /AMQsbvSw93Ju23wNUQ76cLc924PgpbMLeTJcLU8ZeieP5W8vy4eyn+qV+Rpf6xd/0GnN+Vi7
 fsVgo8zb5Hj0kUV16VegexnnNpayA594XIYzzb3HC54i1MqxwYkRebLBv980yCodaYz/2r9Io
 ZKCWReY5ecfxu4Qb/hWqoSI5Jumg2SfwAB7CjL+u/nbIs+1KOQ8qXxBWp8nTgo6Gdc4nGtEKf
 xmEj85exBnzvEHceGvceyb5Rzk3IKkaTEgWKnUqH+/Kq9PozGTq7VCGaJZX57A4B42qAUKBuc
 r6Nb9812Mw81gCgA8zqRPPijJKryBzl1DTjoGImV3yF9W1vy0O0rbX059RxiUGCmrogA=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 >> So on Windows we would keep the image cache forever?
 >
 > Yes.  We keep it forever already.

Then don't bother.  I'll have to figure this out myself.

martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 18 Jun 2015 18:00:50 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Jun 18 14:00:50 2015
Received: from localhost ([127.0.0.1]:51303 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5e7N-00042b-LV
	for submit <at> debbugs.gnu.org; Thu, 18 Jun 2015 14:00:50 -0400
Received: from mtaout22.012.net.il ([80.179.55.172]:37676)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z5e7K-00042L-EG
 for 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 14:00:48 -0400
Received: from conversion-daemon.a-mtaout22.012.net.il by
 a-mtaout22.012.net.il (HyperSendmail v2007.08) id
 <0NQ500400J54YV00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Thu, 18 Jun 2015 21:00:39 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout22.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ5005UIJD20V00@HIDDEN>;
 Thu, 18 Jun 2015 21:00:39 +0300 (IDT)
Date: Thu, 18 Jun 2015 21:00:32 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <55830187.1000802@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <834mm4lwvz.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <55813F99.8070801@HIDDEN>
 <83bngemgqv.fsf@HIDDEN> <5582C990.5020009@HIDDEN> <83bngdko70.fsf@HIDDEN>
 <5582F65D.2020204@HIDDEN> <838ubhkkb6.fsf@HIDDEN> <55830187.1000802@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Thu, 18 Jun 2015 19:36:07 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
>  > but please keep in mind that we never delete a terminal
>  > on Windows, until Emacs exits.
> 
> So on Windows we would keep the image cache forever?

Yes.  We keep it forever already.  Well, except maybe with the
recently-added daemon mode, when all the frames are gone.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 18 Jun 2015 17:36:22 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Jun 18 13:36:22 2015
Received: from localhost ([127.0.0.1]:51265 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5djh-0003Qi-TQ
	for submit <at> debbugs.gnu.org; Thu, 18 Jun 2015 13:36:22 -0400
Received: from mout.gmx.net ([212.227.15.18]:62722)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z5djg-0003QT-7G
 for 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 13:36:20 -0400
Received: from [194.166.85.204] ([194.166.85.204]) by mail.gmx.com (mrgmx001)
 with ESMTPSA (Nemesis) id 0MgKUo-1ZSHUZ1WzO-00Nhhr;
 Thu, 18 Jun 2015 19:36:13 +0200
Message-ID: <55830187.1000802@HIDDEN>
Date: Thu, 18 Jun 2015 19:36:07 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <55813F99.8070801@HIDDEN>
 <83bngemgqv.fsf@HIDDEN> <5582C990.5020009@HIDDEN> <83bngdko70.fsf@HIDDEN>
 <5582F65D.2020204@HIDDEN> <838ubhkkb6.fsf@HIDDEN>
In-Reply-To: <838ubhkkb6.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:hpjnF3Z/h/MEReB0+7UWoImXzeAh6upY1/mkRRPnMlJD+5sqWbE
 5UNCC67WjVqijNeEH4BMFKTV/mdBidosA109MS49FLzAwmrCYgX93+9WGe8eaCIGMxCr2A6
 4htq7rHom0XtJRYKSpJmSxFH3xPZb6XEpm8c3kY52wi3Nv9FJ6ZyAAaX4B56+b2XbLB6WDg
 AkrcTYoDg5kzGqMHBcGKA==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > I could try,

Thanks.

 > but please keep in mind that we never delete a terminal
 > on Windows, until Emacs exits.

So on Windows we would keep the image cache forever?

 > That part must be tested on Unix.

martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 18 Jun 2015 17:17:51 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Jun 18 13:17:51 2015
Received: from localhost ([127.0.0.1]:51256 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5dRm-0002z9-Rw
	for submit <at> debbugs.gnu.org; Thu, 18 Jun 2015 13:17:51 -0400
Received: from mtaout29.012.net.il ([80.179.55.185]:41881)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z5dRj-0002yr-LI
 for 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 13:17:49 -0400
Received: from conversion-daemon.mtaout29.012.net.il by mtaout29.012.net.il
 (HyperSendmail v2007.08) id <0NQ500I00H9HKM00@HIDDEN> for
 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 20:17:08 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout29.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ500I0NHCJZ900@HIDDEN>; Thu, 18 Jun 2015 20:17:08 +0300 (IDT)
Date: Thu, 18 Jun 2015 20:17:33 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <5582F65D.2020204@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <838ubhkkb6.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <55813F99.8070801@HIDDEN>
 <83bngemgqv.fsf@HIDDEN> <5582C990.5020009@HIDDEN> <83bngdko70.fsf@HIDDEN>
 <5582F65D.2020204@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Thu, 18 Jun 2015 18:48:29 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
>  > then we could simply count the
>  > frames on a terminal instead of using a refcount.  Something like this
>  > (we already have similar code in delete_frame):
>  >
>  >        count = 0;
>  >        FOR_EACH_FRAME (tail, frame1)
>  > 	if (FRAME_TERMINAL (XFRAME (frame)) == FRAME_TERMINAL (XFRAME (frame1)))
>  > 	  count++;
> 
> Something like that.  In any case we should get rid of _all_ refcounts
> for frames and displays.  If you came up with a patch for Windows I
> could do the remaining platforms (I'm not very eager doing this from
> scratch since I build without image support and there might be some
> wrinkle where testing with image support would be safer).

I could try, but please keep in mind that we never delete a terminal
on Windows, until Emacs exits.  That part must be tested on Unix.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 18 Jun 2015 16:48:48 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Jun 18 12:48:47 2015
Received: from localhost ([127.0.0.1]:51252 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5cze-0002Hk-OR
	for submit <at> debbugs.gnu.org; Thu, 18 Jun 2015 12:48:47 -0400
Received: from mout.gmx.net ([212.227.15.19]:54013)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z5czb-0002HV-M6
 for 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 12:48:44 -0400
Received: from [194.166.85.204] ([194.166.85.204]) by mail.gmx.com (mrgmx001)
 with ESMTPSA (Nemesis) id 0LkPBT-1YYE3C1Fox-00cTNX;
 Thu, 18 Jun 2015 18:48:37 +0200
Message-ID: <5582F65D.2020204@HIDDEN>
Date: Thu, 18 Jun 2015 18:48:29 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <55813F99.8070801@HIDDEN>
 <83bngemgqv.fsf@HIDDEN> <5582C990.5020009@HIDDEN> <83bngdko70.fsf@HIDDEN>
In-Reply-To: <83bngdko70.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:c+mAmz0teZk0XwJU+KX4BslQ5PPJZaowqogL3kG5y7V2oehn29U
 mavK58LmGvqq41u7fzflNF0NGzLrp+aKDFXeH/fcvWXyUvo/dLsL5gxsgLuCO35f6RSuXzG
 IzCasAkA6eWqSZhh7jQX0B2xQtafuDJSfu5q7ZlQUiqcz7VpjKw4+L+6FjiEcbwOcUIEmGx
 r44f/CNWH5mV77QsKpiPQ==
X-UI-Out-Filterresults: notjunk:1;V01:K0:xBgJSU9NFk4=:gFJXnfmyIS5etidENk79Qu
 4ylkHn40ODTPsiFBwxKH7F6OvuXZM0eeO4URMovEL6cntRyDmE5Pxqih9/8AKNXMZ+JcZFtjU
 Yq9Bf/T+aoh0Jys21VK6IOszoUvhPLr+pOYsR+RzVZVQkfVY3kVC5cAIZFaa0zL5gPsgBdVpt
 LT4Nbd9eh+aA1IM4DouowMAt5HItgsBp2PiQ1lNk0iXLI3kmXouVXRk4gV8rQ58KYwPZ4XsY0
 0UvExcPMgGWi68+7YEKBS5etVkQKu0BWGxkseL22fpnVxgbCvNQLYr7oC6jSKsAysv2N4C+oB
 f2llwgjQM1jGF9BOK6En0FAbD8DmZBTRIIdLDO2Q9ELqOjLJym39kWXHOepNtzpjkEsYpdqAj
 WyK0qImVId1WhvQef0j9eQnELJ8Djj1mc29ABbuOZkta7qEpQyoO46hv8P7tAaeQZQanGPdW0
 1AdMy9mATvKp8X4NlIfY2wrDKacCGXreSakMd0+NqJ9B9OfSc/WNa0OlRbGe565tVD4p7M7Xz
 uSO9WGyuALEbz9rmnLD04vLfwDmDJfvxOMeQefxcYTB0EG4lHcPhV7J9LcEXssNuTZrkc1f/T
 h0JpL9WsCqQIllZanech7c38epYpSyFY4D3DBJN35oAJJJmCtyHKCAf25Lfb5brXOMrKuwavb
 gcnlweX8FSZBlmje9neSWZtY3jxnf9E1lnmHGkM5poV4+1aKkgTn/DkKdC18CriNzn0w=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Do you agree that there's no need to decide whether we should free the
 > image cache while deleting a frame, and instead do that when we delete
 > a terminal?  If you agree, we should move the code that frees the
 > image cache there.

I do agree.

 > If, in addition, you are saying that we will sometimes delete a
 > terminal when it still has live frames,

frame.c has this very cryptic

     /* FIXME: Deleting the terminal crashes emacs because of a GTK
        bug.
        http://lists.gnu.org/archive/html/emacs-devel/2011-10/msg00363.html */

I doubt it's a Gtk bug.  It certainly is related to refcounts.

 > then we could simply count the
 > frames on a terminal instead of using a refcount.  Something like this
 > (we already have similar code in delete_frame):
 >
 >        count = 0;
 >        FOR_EACH_FRAME (tail, frame1)
 > 	if (FRAME_TERMINAL (XFRAME (frame)) == FRAME_TERMINAL (XFRAME (frame1)))
 > 	  count++;

Something like that.  In any case we should get rid of _all_ refcounts
for frames and displays.  If you came up with a patch for Windows I
could do the remaining platforms (I'm not very eager doing this from
scratch since I build without image support and there might be some
wrinkle where testing with image support would be safer).

martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 18 Jun 2015 15:53:57 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Jun 18 11:53:56 2015
Received: from localhost ([127.0.0.1]:51225 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5c8a-0000zP-FF
	for submit <at> debbugs.gnu.org; Thu, 18 Jun 2015 11:53:56 -0400
Received: from mtaout28.012.net.il ([80.179.55.184]:58577)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z5c8X-0000zB-BW
 for 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 11:53:54 -0400
Received: from conversion-daemon.mtaout28.012.net.il by mtaout28.012.net.il
 (HyperSendmail v2007.08) id <0NQ500J00DAH7500@HIDDEN> for
 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 18:53:22 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout28.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ500BWNDGY8EA0@HIDDEN>; Thu, 18 Jun 2015 18:53:22 +0300 (IDT)
Date: Thu, 18 Jun 2015 18:53:39 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <5582C990.5020009@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83bngdko70.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <55813F99.8070801@HIDDEN>
 <83bngemgqv.fsf@HIDDEN> <5582C990.5020009@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Thu, 18 Jun 2015 15:37:20 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
>  > Why can't we simply move the code that frees the image cache to
>  > delete_terminal?  There's only one image cache for each terminal, and
>  > it's shared by all frames on that terminal, right?  And we call
>  > delete-terminal when we delete the last frame on the terminal, right?
> 
> ‘delete-terminal’ can run into precisely the same problem I described in
> my previous scenario.  IMHO we have to give up the idea of using
> refcounts to tell whether a frame might still use some object - they are
> not up to this task.

These are 2 different issues.

Do you agree that there's no need to decide whether we should free the
image cache while deleting a frame, and instead do that when we delete
a terminal?  If you agree, we should move the code that frees the
image cache there.

If, in addition, you are saying that we will sometimes delete a
terminal when it still has live frames, then we could simply count the
frames on a terminal instead of using a refcount.  Something like this
(we already have similar code in delete_frame):

      count = 0;
      FOR_EACH_FRAME (tail, frame1)
	if (FRAME_TERMINAL (XFRAME (frame)) == FRAME_TERMINAL (XFRAME (frame1)))
	  count++;




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 18 Jun 2015 14:09:44 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Jun 18 10:09:44 2015
Received: from localhost ([127.0.0.1]:50904 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5aVj-0002qs-K6
	for submit <at> debbugs.gnu.org; Thu, 18 Jun 2015 10:09:43 -0400
Received: from mout.gmx.net ([212.227.15.19]:64083)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z5aVh-0002qd-Na
 for 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 10:09:42 -0400
Received: from glenalbyn.linguistics.ruhr-uni-bochum.de ([134.147.14.84]) by
 mail.gmx.com (mrgmx001) with ESMTPSA (Nemesis) id 0ML6qP-1Z5rUS0lsn-000No7;
 Thu, 18 Jun 2015 16:09:33 +0200
Message-ID: <1434636572.4701.3.camel@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: martin rudalics <rudalics@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>
Date: Thu, 18 Jun 2015 16:09:32 +0200
In-Reply-To: <5582C998.7060001@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>
 <1434472472.21431.4.camel@HIDDEN> <55805D69.2060707@HIDDEN>
 <1434526487.8634.10.camel@HIDDEN> <558129F7.9000709@HIDDEN>
 <1434550303.8634.12.camel@HIDDEN> <5582C998.7060001@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:fjSDYniviBYgzq8nNijfvE+sf3Z8nHoe7UazNMEeJYDdVJeNNmp
 xi01/U0mOxtmaHWivXgZBitbGmbpEC55NsTc9BdBIf51glMFtjVZkQGwx+8vFdTm4dEfERw
 cmiyGUY/pL+2aogNKC4pdaHP6O/uwRGp0LJnODTkrJJe6L/6JF3una7SIlZZ+IYigrObvUG
 ZK/bIsYIxEEM11D8cXGQA==
X-UI-Out-Filterresults: notjunk:1;V01:K0:QdPdLERWBFU=:33vkge3+93e5bXkibmyx7w
 oXV4TFm7cseLgTdJukHpiupgQ2EZKpPmXlE0zNdWP7CDOh+Zb2Koxd8zxFP6dGBbLqzZCCbFJ
 sx2CwNq2mzUVWYJq1CMrxqtDAGzRN2BTAG+BUjn72RpPspgscFBWyrtUh2V+7EGZ61PS3DsBn
 Dz3kd7IHut3ySpKEzmjfBHCGKKvDI2v4WIv6v754/2JPtT3afAG7CnJldySyVKOhIYeamy3Hl
 ahgjzQro+mnPDfPeCgwzZoSNxaduKSaoXPS65sYoQnEYNm1Nfh5ofrAILEs5nuP66uzeXlpJ8
 uPSNG9kHpjSm71ghnLysw6VV8G5fuQEKJ+CReIJaF1QK81QXjaNf7YaYlW2gUDWib8Ky+c415
 ey0KrSYXWUy0HHUQRQhJMZv3vq9+YLbvEkNeEeablCq35kCKrJGtJL6/vcMjQJm+zRh37aHTJ
 XsKHiXL7lutcZwcEbNjdbswU/ugmpbRkisZNmwJ92MTe2pSYTsCrjHoNECX39Wy/Jq6qlpn62
 hiWlEh9TlKAq1grTFLQ6IJUKzATXwgBDbndjPUNP+LcOR4xc66yuZpCioFXCUslE1eYjgzkFf
 zc4PznHA9TQQyd8J6LxWBjpTlfzueBxE9vb8qR/ZXDXj4qYedQprWLWmMxyroqMEfjckZxS9u
 v/SaFGXb6aSvMVytODqbcCWAsd3rqd8EUoGj+UyeXACmAiMnXc2VQWbV5y5tqasrjRc4=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Do, 2015-06-18 at 15:37 +0200, martin rudalics wrote:
>  > Indeed, =C2=ABnow the breakpoint=C2=BB, =C2=ABno segfault=C2=BB. :-)
>=20
> I now moved that part in front of the first call to x_default_parameter.
> Please try once more.  I suppose that with your change alone we could
> still get a crash by, for example, setting font-backend to a number in
> =E2=80=98default-frame-alist=E2=80=99.

Seems to work for me. I built from 711e14d and could only observe the
expected behavior, i.=E2=80=AFe., error message in echo area, tool-tip fall=
ing
back to echo area; no crash.

Thanks again!
TG





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 18 Jun 2015 13:37:47 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Jun 18 09:37:47 2015
Received: from localhost ([127.0.0.1]:50568 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5a0o-0001ys-C7
	for submit <at> debbugs.gnu.org; Thu, 18 Jun 2015 09:37:46 -0400
Received: from mout.gmx.net ([212.227.15.18]:60606)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z5a0h-0001yA-Sl
 for 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 09:37:40 -0400
Received: from [91.113.1.189] ([91.113.1.189]) by mail.gmx.com (mrgmx002) with
 ESMTPSA (Nemesis) id 0MNYxW-1ZBdkF0o9a-007B5f;
 Thu, 18 Jun 2015 15:37:33 +0200
Message-ID: <5582C998.7060001@HIDDEN>
Date: Thu, 18 Jun 2015 15:37:28 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Tobias Getzner <tobias.getzner@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>			
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>			
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>		
 <1434472472.21431.4.camel@HIDDEN> <55805D69.2060707@HIDDEN>	
 <1434526487.8634.10.camel@HIDDEN> <558129F7.9000709@HIDDEN>
 <1434550303.8634.12.camel@HIDDEN>
In-Reply-To: <1434550303.8634.12.camel@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:gVxwyurNxxrrRf3mEmw0XZxpARJiRouI7NtyP6eryRJ8uK4WV/F
 c8EJvDxuiv7F9Xh9xG5RCmi8kaN9/NaZrxuiEsQpuPktuDblZfcgypSIun+5xHWph//rC3i
 mDwvQbicgn3Pnm2GA4QnlWDBkoQnX8f2GVejKynSxLxqcWcYox2l+hXG36ibpqbE/nTqBS+
 fZpwVK5ak4hbsECBLvZeA==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Indeed, =C2=ABnow the breakpoint=C2=BB, =C2=ABno segfault=C2=BB. :-)

I now moved that part in front of the first call to x_default_parameter.
Please try once more.  I suppose that with your change alone we could
still get a crash by, for example, setting font-backend to a number in
=E2=80=98default-frame-alist=E2=80=99.

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 18 Jun 2015 13:37:38 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Thu Jun 18 09:37:38 2015
Received: from localhost ([127.0.0.1]:50563 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5a0f-0001yO-SH
	for submit <at> debbugs.gnu.org; Thu, 18 Jun 2015 09:37:38 -0400
Received: from mout.gmx.net ([212.227.15.15]:58426)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z5a0b-0001y1-UC
 for 20802 <at> debbugs.gnu.org; Thu, 18 Jun 2015 09:37:34 -0400
Received: from [91.113.1.189] ([91.113.1.189]) by mail.gmx.com (mrgmx003) with
 ESMTPSA (Nemesis) id 0MTSrf-1ZWm4g2ZWh-00SNoL;
 Thu, 18 Jun 2015 15:37:25 +0200
Message-ID: <5582C990.5020009@HIDDEN>
Date: Thu, 18 Jun 2015 15:37:20 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <55813F99.8070801@HIDDEN>
 <83bngemgqv.fsf@HIDDEN>
In-Reply-To: <83bngemgqv.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:eh3boOanb0DmHgk73cffXuUe4tTdXhuxupFcKBRgJ7kY92O55dP
 BEYzflhzgnA48Z7sW9qzYT2mjnIFVaYC9dsIMxbdvogfJu5NUNci8MD+ki69ZA+O62CuARM
 oo+vwR3TPrTg8SwRSv5QZoVmo87HYHgUIyLF9tYYAWEPFdf+LyOGy/0+ZVkX8ZPYtFcL+G+
 +xAOCTCam0sR1lD9pvzAg==
X-UI-Out-Filterresults: notjunk:1;V01:K0:Gnum6bDAjIg=:qo9mKVfXV35NCyeXi9Ir0V
 lohiwRg5kc6eAciB9MxgVIQ1eDk7wmegdZbnDrb3iq9ZzFCWLa+/DuspbC14MLMXJ1reEL+SI
 H9kHS6wXvxHZ/RH3St6UgeYL3ykXA5mDk6ndR1ZGeFLSW/bktzGeuqMnr/gFVjdciXEVUh81W
 wZgZzjYzsSn/Tp8P2BeYph+hQYQ9/qOHABIn4lbZpmDBLKM8OWjrqVao02aWrFGO+k3iDq/kL
 0LhjmOG5hMCKofa+qFWYwMbYifknZtkdF+EAaFawec7PxquMVg13wLsnDKlMzV1jUJXC8i2NV
 5SuVCgvStSeoR33VZiq1SD+B0PKp0PvaBdQq9XgBZ9KWCcGKw2eHUHkromSrGhm0aLpjtDYKy
 n7iSlEIjBda5b/ZPCccbuxW3Wc4wNly4+itn22S3R5ovl85L2Gou3M54u+8HgUujRqCCA4eec
 +vRgP/FfYuv8X6MpKgwY3xtW6K7Z4seEV0bqTF3bd4P4vRrlTd1SxsUm6vXZuvi2xV190MJEy
 TUQRqYVQrtaRhA8KU8fuHGHQ83znLPMBszRnBmt5+taiRJ+kWDqYPCkM49TVpZd55iTHeDrqQ
 ECwx64lTZBjk4AqQrpRi5KOL9DZyLzu2rV7AGPz1oyEi/QTPPkVOzMFCCtbm5G8EBy6Qq814G
 aYX/HgoxJEFh4e54ru9bgWAs2tH1lsuYu3gzFdAhN4yhFu0yNhMpLT2gypV7x90S4zII=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Why can't we simply move the code that frees the image cache to
 > delete_terminal?  There's only one image cache for each terminal, and
 > it's shared by all frames on that terminal, right?  And we call
 > delete-terminal when we delete the last frame on the terminal, right?

=E2=80=98delete-terminal=E2=80=99 can run into precisely the same problem=
 I described in
my previous scenario.  IMHO we have to give up the idea of using
refcounts to tell whether a frame might still use some object - they are
not up to this task.

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 17 Jun 2015 18:57:05 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Jun 17 14:57:05 2015
Received: from localhost ([127.0.0.1]:49969 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5IWF-0004cV-TW
	for submit <at> debbugs.gnu.org; Wed, 17 Jun 2015 14:57:04 -0400
Received: from pruche.dit.umontreal.ca ([132.204.246.22]:56378)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <monnier@HIDDEN>) id 1Z5IWD-0004c1-KS
 for 20802 <at> debbugs.gnu.org; Wed, 17 Jun 2015 14:57:02 -0400
Received: from ceviche.home (lechon.iro.umontreal.ca [132.204.27.242])
 by pruche.dit.umontreal.ca (8.14.1/8.14.1) with ESMTP id t5HIuw7J026363;
 Wed, 17 Jun 2015 14:56:59 -0400
Received: by ceviche.home (Postfix, from userid 20848)
 id 02DB06610A; Wed, 17 Jun 2015 14:56:58 -0400 (EDT)
From: Stefan Monnier <monnier@HIDDEN>
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
Message-ID: <jwvioamcgib.fsf-monnier+emacsbugs@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN>
 <557C2EF2.5030308@HIDDEN> <83vberpv07.fsf@HIDDEN>
 <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN>
 <55813F99.8070801@HIDDEN> <83bngemgqv.fsf@HIDDEN>
Date: Wed, 17 Jun 2015 14:56:58 -0400
In-Reply-To: <83bngemgqv.fsf@HIDDEN> (Eli Zaretskii's message of "Wed, 17 Jun
 2015 19:39:20 +0300")
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.0.50 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-NAI-Spam-Flag: NO
X-NAI-Spam-Threshold: 5
X-NAI-Spam-Score: 0
X-NAI-Spam-Rules: 1 Rules triggered
	RV5340=0
X-NAI-Spam-Version: 2.3.0.9393 : core <5340> : inlines <3220> : streams
 <1457041> : uri <1962107>
X-Spam-Score: -1.9 (-)
X-Debbugs-Envelope-To: 20802
Cc: martin rudalics <rudalics@HIDDEN>, tobias.getzner@HIDDEN,
 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -1.9 (-)

> Why can't we simply move the code that frees the image cache to
> delete_terminal?  There's only one image cache for each terminal, and
> it's shared by all frames on that terminal, right?  And we call
> delete-terminal when we delete the last frame on the terminal, right?

Indeed.  I think this is just a left over from when the image_cache was
located inside the "struct frame", and I simply failed to update this
part when I moved the cache to the "struct terminal".
Of course, that was many years ago, so maybe I did look into it and
discovered it wasn't that simple, but if so, I have no recollection of that.


        Stefan




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 17 Jun 2015 16:49:34 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Jun 17 12:49:34 2015
Received: from localhost ([127.0.0.1]:49769 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5GWr-0001TC-DP
	for submit <at> debbugs.gnu.org; Wed, 17 Jun 2015 12:49:34 -0400
Received: from mtaout29.012.net.il ([80.179.55.185]:48607)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z5GNE-0001Dt-EM
 for 20802 <at> debbugs.gnu.org; Wed, 17 Jun 2015 12:39:40 -0400
Received: from conversion-daemon.mtaout29.012.net.il by mtaout29.012.net.il
 (HyperSendmail v2007.08) id <0NQ300I00KTO8J00@HIDDEN> for
 20802 <at> debbugs.gnu.org; Wed, 17 Jun 2015 19:38:57 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout29.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ300BT0KWXYX60@HIDDEN>; Wed, 17 Jun 2015 19:38:57 +0300 (IDT)
Date: Wed, 17 Jun 2015 19:39:20 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <55813F99.8070801@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83bngemgqv.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <55813F99.8070801@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Wed, 17 Jun 2015 11:36:25 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> I'm meanwhile quite confident that we cannot fix the problem with
> refcounts in the first place.  Consider the following scenario: First
> make sure that the *Backtrace* window will pop up on a new frame.  Then
> make sure that you can trigger its creation, for example, by specifying
> an invalid color as with the present bug.  Also let's assume we use a
> static variable old_refcount as our shadow copy of the "real" refcount.
> 
> Now the following will happen:
> 
> (1) x_create_tip_frame copies the current value of the real refcount
>      into old_refcount.
> 
> (2) The bug triggers and causes Emacs to pop up the *Backtrace* window.
>      ‘x-create-frame’ copies the value of the real refcount into
>      old_refcount and afterwards increments the real refcount.
> 
> (3) Now unwind_create_frame will be run for the tip frame we tried to
>      create in (1).  old_refcount won't equal the real refcount since the
>      latter was incremented in (2) so we leave the real refcount alone.
>      Subsequently we decrement the real refcount and the real refcount
>      will no longer reflect the number of frames referencing the object
>      it guards.
> 
> So IMHO we have to maintain for every object currently guarded by a
> refcount a list of the frames referencing the object.  Or, have each
> frame keep a pointer to all objects it needs and when deleting a frame
> look for each object it guards whether at least one other frame exists
> that guards the same object.  Suggestions welcome.

Why can't we simply move the code that frees the image cache to
delete_terminal?  There's only one image cache for each terminal, and
it's shared by all frames on that terminal, right?  And we call
delete-terminal when we delete the last frame on the terminal, right?




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 17 Jun 2015 16:49:33 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Jun 17 12:49:33 2015
Received: from localhost ([127.0.0.1]:49767 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5GWq-0001T7-2Q
	for submit <at> debbugs.gnu.org; Wed, 17 Jun 2015 12:49:33 -0400
Received: from mtaout22.012.net.il ([80.179.55.172]:61247)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z5GEk-00011b-Q8
 for 20802 <at> debbugs.gnu.org; Wed, 17 Jun 2015 12:30:54 -0400
Received: from conversion-daemon.a-mtaout22.012.net.il by
 a-mtaout22.012.net.il (HyperSendmail v2007.08) id
 <0NQ300G00K75K600@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Wed, 17 Jun 2015 19:30:44 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout22.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ300GWYKJ8BR80@HIDDEN>;
 Wed, 17 Jun 2015 19:30:44 +0300 (IDT)
Date: Wed, 17 Jun 2015 19:30:34 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <1434526487.8634.10.camel@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: Tobias Getzner <tobias.getzner@HIDDEN>
Message-id: <83d20umh5h.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>
 <1434472472.21431.4.camel@HIDDEN> <55805D69.2060707@HIDDEN>
 <1434526487.8634.10.camel@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: rudalics@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> From: Tobias Getzner <tobias.getzner@HIDDEN>
> Cc: 20802 <at> debbugs.gnu.org
> Date: Wed, 17 Jun 2015 09:34:47 +0200
> 
> After setting a breakpoint at 5192, the segfault would trigger without
> the breakpoint kicking in. I then moved that hunk up to line 5172 (diff
> below). Now the breakpoint there would kick in, and further, now
> segfault would trigger; instead, it gave the «error while displaying
> tooltip message», and fell back on showing the tooltip message in the
> echo area.

Which AFAIU means the bug is solved by that change, because this is
the effect of setting an invalid face I'd expect.

> Does this address your questions too, Eli, or do you want me to step
> into «x_free_frame_resources» to make sure everything is solid?

No need, thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 17 Jun 2015 14:12:03 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Jun 17 10:12:03 2015
Received: from localhost ([127.0.0.1]:57523 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z5E4N-0008MF-2O
	for submit <at> debbugs.gnu.org; Wed, 17 Jun 2015 10:12:03 -0400
Received: from mout.gmx.net ([212.227.15.15]:63798)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z5E4G-0008Lw-3Q
 for 20802 <at> debbugs.gnu.org; Wed, 17 Jun 2015 10:11:56 -0400
Received: from glenalbyn.linguistics.ruhr-uni-bochum.de ([134.147.14.84]) by
 mail.gmx.com (mrgmx002) with ESMTPSA (Nemesis) id 0Lw285-1Z3qfd3HJt-017hul;
 Wed, 17 Jun 2015 16:11:44 +0200
Message-ID: <1434550303.8634.12.camel@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: martin rudalics <rudalics@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>
Date: Wed, 17 Jun 2015 16:11:43 +0200
In-Reply-To: <558129F7.9000709@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>
 <1434472472.21431.4.camel@HIDDEN> <55805D69.2060707@HIDDEN>
 <1434526487.8634.10.camel@HIDDEN> <558129F7.9000709@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:Yu8bVqz/ShNGmf4bNI1tf4wlvu0NOve/RarrjP8YTXCFClBB64k
 7l1LxXLBS+zDy2FClpKSYxepPp61POee3nCPradWiC9C87J7TowsM6tYQiz+ExXEXpsK1Gz
 0Fo/0XR4drRqRGtLmvQzW1OpCp5JKt3cKOG85OneyWE0/Dh4nOzdqxMyF7xs81vi1PNPFaR
 lWovhWXJ83HSOt+ff5KBg==
X-UI-Out-Filterresults: notjunk:1;V01:K0:HovwfHdq3+Y=:V8286rbgCfJ3d7xmLm9AMz
 3PPciA2xnx/xWl8NFLHxYwluGhPGJIsNUe4NCKltcTGrG6IAeQtiQh9Qo2D5bNI98eYKdnOG0
 WE4aLzdV1KdQG70MjagyF/6y/38RiujbNC82YCV2O1aKGpG6MdxfoSDUlWdzQP3uLPbY8rqRT
 YK1HOuQ3aNTOd8dBF+j8Ltwdc1pJQ5dlld2pPXz6Pwar56IetpVvPMJymKtg0VVeS2U/4jPPw
 1GLzhelT/yN/1OFhIcimBg/q0DqM/xy4NFl/DVJenayly3VrVETYX+ImfsZpy01pn8670jqbf
 2Z3I+b+418caeIFhpezfe/XPRFW2nrkC628Wxp2DKG2UEKXcTNPGv14Nysk7x/8Omagy/bt//
 qQ3J7Q89ELKwFzPd0ARBR42HcGKAFZcWaNOU81U88UZz1qaM9EGgs7cbPeyRy3k6cjcU7frJi
 7AF0sH54C1MyIWzIdxKOioPW6UaAwJKRO2gxhsLaZTVhEpT6ktg+aks0GSSjnhRtFcZNX8he1
 +J7rbMUWK0d+rDnir2ZXh2hGQSo0xW0dVvsMuOgHlrsUooOUynR803R8DuP0JKbyfnCLGRRJE
 drqPBldf3QRRSkwlvadWk/tgSp+kFsZGUPMInZ/aH/UbqeiKoJTjEehhKcUEItgi0hWx0LKa2
 fvJHEFNFgBXu8V0B3jFQy2BW4Ln6noPvsXEc/vb7Pj8mwvCD77ru4HGH5eFhQ2Jz5gTE=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Mi, 2015-06-17 at 10:04 +0200, martin rudalics wrote:
>  > After setting a breakpoint at 5192, the segfault would trigger=20
> without
>  > the breakpoint kicking in. I then moved that hunk up to line 5172=20
> (diff
>  > below). Now the breakpoint there would kick in, and further, now
>                                                                 ^^^
> Hopefully, that's a "no" up there.

Indeed, =C2=ABnow the breakpoint=C2=BB, =C2=ABno segfault=C2=BB. :-)




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 17 Jun 2015 09:36:39 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Jun 17 05:36:39 2015
Received: from localhost ([127.0.0.1]:56856 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z59lu-00076y-W7
	for submit <at> debbugs.gnu.org; Wed, 17 Jun 2015 05:36:39 -0400
Received: from mout.gmx.net ([212.227.17.20]:56459)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z59lt-00076i-5i
 for 20802 <at> debbugs.gnu.org; Wed, 17 Jun 2015 05:36:38 -0400
Received: from [88.117.51.111] ([88.117.51.111]) by mail.gmx.com (mrgmx103)
 with ESMTPSA (Nemesis) id 0LsTjw-1Yyihx2JqK-0123Dg; Wed, 17 Jun 2015 11:36:29
 +0200
Message-ID: <55813F99.8070801@HIDDEN>
Date: Wed, 17 Jun 2015 11:36:25 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN>
In-Reply-To: <83h9qapee0.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:GxT07N9/gitcdx8b5ahY4Ro02cQJIAgX66GHcgHF/+mWUT5EVRL
 9yH4H/7iOBk0mvTNaDAhI6p5Et3cO8BUBBYS+LNOdLu4ULRcmLIJzif6LbdOWmriJCrJaoW
 K98Mfv2S8IPFKaW3dyjV1OHXKXE+d1OxqWx+WPsqdEgGMT9l4YX+HmLCzWORxV6H6FTmE/K
 bbrWp0t6Txphs+5/dlqFA==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Thanks.  Now I know why this cannot be reproduced on Windows: this is
 > bug#17524 coming back to haunt us.  That bug was reported on Windows,
 > I fixed it on Windows, then suggested a similar fix for X, but was
 > told it didn't help there.
 >
 > So now please try making a fix on X similar to commit ebdc80316, and
 > if that indeed doesn't help with this crash, perhaps some simple
 > variation of that will.

I'm meanwhile quite confident that we cannot fix the problem with
refcounts in the first place.  Consider the following scenario: First
make sure that the *Backtrace* window will pop up on a new frame.  Then
make sure that you can trigger its creation, for example, by specifying
an invalid color as with the present bug.  Also let's assume we use a
static variable old_refcount as our shadow copy of the "real" refcount.

Now the following will happen:

(1) x_create_tip_frame copies the current value of the real refcount
     into old_refcount.

(2) The bug triggers and causes Emacs to pop up the *Backtrace* window.
     =E2=80=98x-create-frame=E2=80=99 copies the value of the real refcou=
nt into
     old_refcount and afterwards increments the real refcount.

(3) Now unwind_create_frame will be run for the tip frame we tried to
     create in (1).  old_refcount won't equal the real refcount since the=

     latter was incremented in (2) so we leave the real refcount alone.
     Subsequently we decrement the real refcount and the real refcount
     will no longer reflect the number of frames referencing the object
     it guards.

So IMHO we have to maintain for every object currently guarded by a
refcount a list of the frames referencing the object.  Or, have each
frame keep a pointer to all objects it needs and when deleting a frame
look for each object it guards whether at least one other frame exists
that guards the same object.  Suggestions welcome.

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 17 Jun 2015 08:04:23 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Jun 17 04:04:22 2015
Received: from localhost ([127.0.0.1]:56799 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z58Kc-0004z6-CL
	for submit <at> debbugs.gnu.org; Wed, 17 Jun 2015 04:04:22 -0400
Received: from mout.gmx.net ([212.227.17.21]:62643)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z58KZ-0004yt-Vk
 for 20802 <at> debbugs.gnu.org; Wed, 17 Jun 2015 04:04:20 -0400
Received: from [88.117.51.111] ([88.117.51.111]) by mail.gmx.com (mrgmx101)
 with ESMTPSA (Nemesis) id 0MWPOI-1Zcj3u1fn0-00XYa6; Wed, 17 Jun 2015 10:04:12
 +0200
Message-ID: <558129F7.9000709@HIDDEN>
Date: Wed, 17 Jun 2015 10:04:07 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Tobias Getzner <tobias.getzner@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>		
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>		
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>	
 <1434472472.21431.4.camel@HIDDEN> <55805D69.2060707@HIDDEN>
 <1434526487.8634.10.camel@HIDDEN>
In-Reply-To: <1434526487.8634.10.camel@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:hmLnb2RosE7Kw9kHOks9yRWoczYE9RL7a3LaYBoE5LV9qb7LLHC
 j0Z8WEJi7bZRDmHa203hs28pR9TTRw5o6P4KmvEYqyOnUCm41/ihmq/ivFNM3oJEh0ITVfn
 xcKZ5Cr7TghedcVyAWRfIWmGHH17psCkVlnX651rEDWfXr+w4zDAFUkpxjzS7HGaKm92yqS
 VuyPzDF46CpDB8XJZng1A==
X-UI-Out-Filterresults: notjunk:1;V01:K0:mOEJBWe6uOo=:JCxDzqz8uXoiGMOS5ks7eC
 nhKSEohsmFal/VWPYlpyMqGK22hed6RZ4UCkQX6kunSWFkZyalj8saj8lQS8FGEHG5nrGo2Qd
 r7nRIYyUSE/COvc9LJBbcDR1GA9gbbWkZ854XYVrB8Ska/C0k9x+Jz2MBb+vAO0eSkY0HB70I
 c6qQ6VMXawuvpIl4jUnIrNsxZUUb7frJj6EEX2iGc3AXoi4rjBcsFXN+qrGFhSc8av0i46VN+
 oLEHj7IkbjCATOkintK8nalruA/yAoe8Ydboh+7hej/pRCsNAJNyEJPTiukssbXt7kFrb4bWH
 Hjf+93FjuVKkPNrDdTuwJP8l1d7PQ6FuJPRPoZ9yroO4bDva7SJKNW+D91QRRGJ+vQcbYsj41
 ue6cgYTL1rMExTwngusiNUNw082c6XZzM+gLFp6onqqdZMxzl+LIPp4CjD+1wRlJIg1V2Tedt
 ScnR/txaRCKB72Z2+u4KdCyaIQhHX9dTFloPPzPg25mML854czt0UxwfsqLsu4q4fkKgDr3Ll
 9fcsYlTNN/qRr1qVtP4+8SNB17fIgyV6Ux+pOr3TabnRYp9wAceVlXc3dP644WUvjTulpGHwz
 EJiU3xBBszNZ/6n5v0kKN2OdFRCBGJ9fU+ZDZGxHRpkbBvXBvaMeMYhChlSuHqX6iDH00pwU1
 o5YUs8u78UWi4Yy0fEkU00liXv9rhOMSqDQIIJ3CvhQCM3n3OAV3DVvylwaExzoKbrRs=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > After setting a breakpoint at 5192, the segfault would trigger without=

 > the breakpoint kicking in. I then moved that hunk up to line 5172 (dif=
f
 > below). Now the breakpoint there would kick in, and further, now
                                                                ^^^
Hopefully, that's a "no" up there.

 > segfault would trigger; instead, it gave the =C2=ABerror while display=
ing
 > tooltip message=C2=BB, and fell back on showing the tooltip message in=
 the
 > echo area. Below is the state of  =C2=ABimage_cache_refcount=C2=BB for=
 a few
 > breaks. I fumbled a bit with the line history and only printed it for
 > some of the breaks.

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 17 Jun 2015 07:34:58 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Jun 17 03:34:58 2015
Received: from localhost ([127.0.0.1]:56792 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z57s9-0004HX-4p
	for submit <at> debbugs.gnu.org; Wed, 17 Jun 2015 03:34:57 -0400
Received: from mout.gmx.net ([212.227.15.19]:63705)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z57s6-0004HJ-M8
 for 20802 <at> debbugs.gnu.org; Wed, 17 Jun 2015 03:34:55 -0400
Received: from glenalbyn.linguistics.ruhr-uni-bochum.de ([134.147.14.84]) by
 mail.gmx.com (mrgmx003) with ESMTPSA (Nemesis) id 0MPm54-1ZA5gA2OJe-0052BF;
 Wed, 17 Jun 2015 09:34:48 +0200
Message-ID: <1434526487.8634.10.camel@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: martin rudalics <rudalics@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>
Date: Wed, 17 Jun 2015 09:34:47 +0200
In-Reply-To: <55805D69.2060707@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>
 <1434472472.21431.4.camel@HIDDEN> <55805D69.2060707@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:YW9+Euct6aNdKQ8CAuWmJAumhbJtgykGBBa3jg1H3TswPc5xA9Z
 LQCjvgoA5dZyNqli1TGAAMSsFohjdVmbiuzFk53SfBm2HI7F39ZyuvUTyTkoUt34o+LhjDP
 N9vFF8iTz18vNqAz1N+nSi2vubuEHoZtJeUMSzQyznS9Q3/HEFtAO/2O7EOympYl6Qhs7Co
 xPjGnX/nKw4ZIAbZyWfrA==
X-UI-Out-Filterresults: notjunk:1;V01:K0:BFnD/goeOTw=:5InYl66lS+UEcx0Y8HV3j7
 XE9fJmP1UoiVv02VM3SseT/9eG51JEboIEXL1O+GUykngHM51VgbyA2bZbiRhWt1XCwBrYnBz
 fQ4o0XlkF/IUIw7Pg0NJ50pP5BBdd/KC8NGulOoqWKNIVSnPLmT9Oiym2+3lutEH/4nYs9VSt
 UuffazNhA3Kq7h2bWfV+oMlksmekeHrVPFMawHDwbQYbDk101tgzK7toc1xTxRq0r9oxovmoA
 P0KWI6+Y0Ads09sUNC5H02F6cYN82FFtsw93HJJ5q06lWPlsu3tL6G3EinMMdbwN/YLYI9aH0
 Iwsp4+w2cny8VLHDEBkUOiYxXeDqgngWm3SFhY8wlk1S+bmuwpYzxScb1+dPuWWZIaqbivtA8
 mWQFG1qsSmSJVyNWnMZqmIiJoqEuiy+zf+bTKdWdKLeo9usMQKgpwt9ImUWefKzb3XOH/H8jS
 BbTQkMoWPEhWfO9ZXdxWep/LbbKW10V8WW6cUR7tptLxyIZeHT8r6ROVM6bZowX+FUolXGN21
 46e7dGoYTGOPFScKsU5242pEMGjyFrre7cnETobfz/DxD8v6Lp9lrxhBbll+9yX1mCcH/yxdd
 FU79IoZFuAEe/EEsuXLqJ25oO7puBOW+Vj+2YrLHA7TQs1YaqXaL/ua65OqARog4pJA6ijkgZ
 ba/9M4gcuLuLEkUBdxHHPcp9azp1qb4jwCxo1sBWSB4UoxTU9c3Hct/G6807HZr6tqVI=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Di, 2015-06-16 at 19:31 +0200, martin rudalics wrote:
> Can you try whether my conjecture is true by putting a breakpoint on
> line 5192 and check whether the refcount gets set there for the=20
> tooltip
> frame?  If it isn't, then could you experimentally try to move the
>=20
>    image_cache_refcount =3D
>      FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
> #ifdef GLYPH_DEBUG
>    dpyinfo_refcount =3D dpyinfo->reference_count;
> #endif /* GLYPH_DEBUG */
>=20
> block from line 5192 somewhere up in the code, first before line=20
> 5172,
> later maybe a bit further up and check whether it helps?

I=E2=80=99m not a C guy, so bear with me if I fail to follow your instructi=
ons
in a sensible way.=20

After setting a breakpoint at 5192, the segfault would trigger without
the breakpoint kicking in. I then moved that hunk up to line 5172 (diff
below). Now the breakpoint there would kick in, and further, now
segfault would trigger; instead, it gave the =C2=ABerror while displaying
tooltip message=C2=BB, and fell back on showing the tooltip message in the
echo area. Below is the state of  =C2=ABimage_cache_refcount=C2=BB for a fe=
w
breaks. I fumbled a bit with the line history and only printed it for
some of the breaks.

Does this address your questions too, Eli, or do you want me to step
into =C2=ABx_free_frame_resources=C2=BB to make sure everything is solid?

Best,
TG


=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3Ddif=
f=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D
diff --git a/src/xfns.c b/src/xfns.c
index d066043..2c1c772 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -5169,6 +5169,12 @@ x_create_tip_frame (struct x_display_info *dpyinfo,
                       parms);
     }
=20
+  image_cache_refcount =3D
+    FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
+#ifdef GLYPH_DEBUG
+  dpyinfo_refcount =3D dpyinfo->reference_count;
+#endif /* GLYPH_DEBUG */
+
   x_default_parameter (f, parms, Qinternal_border_width, make_number (1),
                       "internalBorderWidth", "internalBorderWidth",
                       RES_TYPE_NUMBER);
@@ -5189,12 +5195,6 @@ x_create_tip_frame (struct x_display_info *dpyinfo,
   x_default_parameter (f, parms, Qborder_color, build_string ("black"),
                       "borderColor", "BorderColor", RES_TYPE_STRING);
=20
-  image_cache_refcount =3D
-    FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
-#ifdef GLYPH_DEBUG
-  dpyinfo_refcount =3D dpyinfo->reference_count;
-#endif /* GLYPH_DEBUG */
-
   /* Init faces before x_default_parameter is called for the
      scroll-bar-width parameter because otherwise we end up in
      init_iterator with a null face cache, which should not happen.  */

=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D gd=
b session =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

Breakpoint 1, x_create_tip_frame (dpyinfo=3D0x1722e00, parms=3D35322131,=
=20
parms@entry=3D35322003, text=3Dtext@entry=3D33649076) at xfns.c:5172
5172	  image_cache_refcount =3D
(gdb) p image_cache_refcount
$1 =3D 0
(gdb) cont
Continuing.

Breakpoint 1, x_create_tip_frame (dpyinfo=3D0x1722e00, parms=3D35764115,=
=20
parms@entry=3D35763987, text=3Dtext@entry=3D33650308) at xfns.c:5172
5172	  image_cache_refcount =3D
(gdb) cont
Continuing.
   =20

Breakpoint 1, x_create_tip_frame (dpyinfo=3D0x1722e00, parms=3D35830499,=
=20
parms@entry=3D35830371, text=3Dtext@entry=3D33651252) at xfns.c:5172
5172	  image_cache_refcount =3D
(gdb)=20
Continuing.

Breakpoint 1, x_create_tip_frame (dpyinfo=3D0x1722e00, parms=3D35987299,=
=20
parms@entry=3D35987171, text=3Dtext@entry=3D33650548) at xfns.c:5172
5172	  image_cache_refcount =3D
(gdb) p image_cache_refcount
$2 =3D 1
(gdb) cont
Continuing.

Breakpoint 1, x_create_tip_frame (dpyinfo=3D0x1722e00, parms=3D19632051,=
=20
parms@entry=3D19622915, text=3Dtext@entry=3D34077380) at xfns.c:5172
5172	  image_cache_refcount =3D
(gdb) cont
Continuing.

Breakpoint 1, x_create_tip_frame (dpyinfo=3D0x1722e00, parms=3D33536019,=
=20
parms@entry=3D33536531, text=3Dtext@entry=3D34075236) at xfns.c:5172
5172	  image_cache_refcount =3D
(gdb) cont
Continuing.
   =20
Breakpoint 1, x_create_tip_frame (dpyinfo=3D0x1722e00, parms=3D34033603,=
=20
parms@entry=3D34033971, text=3Dtext@entry=3D34074788) at xfns.c:5172
5172	  image_cache_refcount =3D
(gdb) p image_cache_refcount
$3 =3D 1
(gdb) clear
Deleted breakpoint 1=20
(gdb) cont
Continuing.





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 17:31:35 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 13:31:35 2015
Received: from localhost ([127.0.0.1]:56102 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4uhy-0001DE-Ky
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 13:31:34 -0400
Received: from mout.gmx.net ([212.227.17.20]:52761)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4uhv-0001D0-Lt
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 13:31:33 -0400
Received: from [88.117.84.100] ([88.117.84.100]) by mail.gmx.com (mrgmx103)
 with ESMTPSA (Nemesis) id 0LrNoG-1YzVKK2tjw-0139DY; Tue, 16 Jun 2015 19:31:24
 +0200
Message-ID: <55805D69.2060707@HIDDEN>
Date: Tue, 16 Jun 2015 19:31:21 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Tobias Getzner <tobias.getzner@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>	
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>	
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>
 <1434472472.21431.4.camel@HIDDEN>
In-Reply-To: <1434472472.21431.4.camel@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:qxoevH25QzMN2tXT/lftPDAJmPj8/HDVm9wdlnf8pEfYccAlY/y
 fp5IQFO/wI+FitivlCoch4YzVXhTdqcD6CrqXW+/kJPowvjuWWgqZdLHhZvpTVuM7E+fWrV
 d7GF0E0VxF9we8eZgrLPlu/FBgD5oLlsoQcxWKqvimt4TZGcXpAuWE0EnCMAOSvFy8UPOXL
 oEuARRmcl8Y3K4tLCHFEA==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Breakpoint 1, x_free_frame_resources (f=0x124fd70) at xterm.c:10970
 > 10970	{
 > (gdb) bt
 > #0  x_free_frame_resources (f=0x124fd70) at xterm.c:10970
 > #1  0x00000000004c9715 in unwind_create_frame (frame=19201397) at xfns.c:2842
 > #2  0x00000000004c9759 in unwind_create_tip_frame (frame=<optimized out>) at xfns.c:4997
 > #3  0x0000000000557b2e in unbind_to (count=<optimized out>, value=value@entry=0) at eval.c:3211
 > #4  0x0000000000557cf9 in unwind_to_catch (catch=catch@entry=0x140a040, value=value@entry=19849283)
 >      at eval.c:1157
 > #5  0x00000000005592ed in Fsignal (error_symbol=error_symbol@entry=18624, data=<optimized out>)
 >      at eval.c:1557
 > #6  0x00000000005595f9 in xsignal (error_symbol=error_symbol@entry=18624, data=<optimized out>)
 >      at eval.c:1581
 > #7  0x0000000000559c6d in signal_error (s=s@entry=0x5e3d1d "Undefined color", arg=19849315,
 >      arg@entry=34016084) at eval.c:1636
 > #8  0x00000000004ccc57 in x_decode_color (f=<optimized out>, color_name=34016084,
 >      mono_color=<optimized out>) at xfns.c:495
 > #9  0x00000000004ce96c in x_set_foreground_color (f=0x124fd70, arg=34016084, oldval=<optimized out>)
 >      at xfns.c:602
 > #10 0x0000000000426ff6 in x_set_frame_parameters (f=f@entry=0x124fd70, alist=alist@entry=140737488338931)
 >      at frame.c:3152
 > #11 0x0000000000429ac7 in x_default_parameter (f=f@entry=0x124fd70, alist=alist@entry=19856675,
 >      prop=prop@entry=22320, deflt=34090788, xprop=xprop@entry=0x5db8ca "foreground",
 >      xclass=xclass@entry=0x5e3f61 "Foreground", type=RES_TYPE_STRING) at frame.c:4374
 > #12 0x00000000004cd200 in x_create_tip_frame (dpyinfo=0x173c900, parms=19856675, parms@entry=19857043,
 >      text=text@entry=34092084) at xfns.c:5181
 > #13 0x00000000004cd94d in Fx_show_tip (string=34092084, frame=18429029, parms=19857043, timeout=42, dx=22,
 >      dy=82) at xfns.c:5540

Why am I not surprised?  xfns.c sets image_cache_refcount on line 5192,
that is, after it processes the foreground parameter on line 5181 so
probably line 5192 is not executed.  I initially tried to set it right
after the record_unwind_protect on line 5061 but that got me a(nother?)
segfault as well.  Funnily I coudn't get a crash after my patch.

Can you try whether my conjecture is true by putting a breakpoint on
line 5192 and check whether the refcount gets set there for the tooltip
frame?  If it isn't, then could you experimentally try to move the

   image_cache_refcount =
     FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
#ifdef GLYPH_DEBUG
   dpyinfo_refcount = dpyinfo->reference_count;
#endif /* GLYPH_DEBUG */

block from line 5192 somewhere up in the code, first before line 5172,
later maybe a bit further up and check whether it helps?

Thanks, martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 17:13:12 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 13:13:12 2015
Received: from localhost ([127.0.0.1]:56098 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4uQC-0000mx-1F
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 13:13:12 -0400
Received: from mtaout20.012.net.il ([80.179.55.166]:65232)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4uQ9-0000mj-1e
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 13:13:10 -0400
Received: from conversion-daemon.a-mtaout20.012.net.il by
 a-mtaout20.012.net.il (HyperSendmail v2007.08) id
 <0NQ100100RNVNI00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Tue, 16 Jun 2015 20:13:02 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ1001XQRTQIK70@HIDDEN>;
 Tue, 16 Jun 2015 20:13:02 +0300 (IDT)
Date: Tue, 16 Jun 2015 20:12:50 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <1434472472.21431.4.camel@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: Tobias Getzner <tobias.getzner@HIDDEN>
Message-id: <83lhfjmval.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>
 <1434472472.21431.4.camel@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: rudalics@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> From: Tobias Getzner <tobias.getzner@HIDDEN>
> Cc: rudalics@HIDDEN, 20802 <at> debbugs.gnu.org
> Date: Tue, 16 Jun 2015 18:34:32 +0200
> 
> On Di, 2015-06-16 at 18:58 +0300, Eli Zaretskii wrote:
> > > 
> > > From: Tobias Getzner <tobias.getzner@HIDDEN>
> > > Date: Tue, 16 Jun 2015 17:34:05 +0200
> > > 
> > > Thanks! I built from master (34a43ba), which includes your 93ae9f4. 
> > > I’m
> > > still seeing a segfault for the steps given above. Backtrace below.
> > 
> > Please run Emacs under GDB, put a breakpoint in
> > x_free_frame_resources, then perform your steps, and show backtrace
> > each time the breakpoint breaks.
> > 
> > Thanks.
> > 
> 
> Breakpoint 1, x_free_frame_resources (f=0x124fd70) at xterm.c:10970
> 10970	{
> (gdb) bt
> #0  x_free_frame_resources (f=0x124fd70) at xterm.c:10970
> #1  0x00000000004c9715 in unwind_create_frame (frame=19201397) at xfns.c:2842
> #2  0x00000000004c9759 in unwind_create_tip_frame (frame=<optimized out>) at xfns.c:4997
> #3  0x0000000000557b2e in unbind_to (count=<optimized out>, value=value@entry=0) at eval.c:3211
> #4  0x0000000000557cf9 in unwind_to_catch (catch=catch@entry=0x140a040, value=value@entry=19849283)
>     at eval.c:1157
> #5  0x00000000005592ed in Fsignal (error_symbol=error_symbol@entry=18624, data=<optimized out>)
>     at eval.c:1557
> #6  0x00000000005595f9 in xsignal (error_symbol=error_symbol@entry=18624, data=<optimized out>)
>     at eval.c:1581
> #7  0x0000000000559c6d in signal_error (s=s@entry=0x5e3d1d "Undefined color", arg=19849315, 
>     arg@entry=34016084) at eval.c:1636
> #8  0x00000000004ccc57 in x_decode_color (f=<optimized out>, color_name=34016084, 
>     mono_color=<optimized out>) at xfns.c:495

Is that the only call?  If so, I don't understand hy Martin's change
didn't work.

> (gdb) cont
> Continuing.
> Fatal error 11: Segmentation fault
> Program received signal SIGSEGV, Segmentation fault.
> 0x000000000045e51e in note_mouse_highlight (f=f@entry=0x1193460, x=<optimized out>, y=19) at xdisp.c:29600
> 29600		  struct image *img = IMAGE_FROM_ID (f, glyph->u.img_id);

And this is a different segfault from what you've shown before.

Can you step into the call to x_free_frame_resources, then step from
there into free_frame_faces, and see what it does there?  You are
supposed to see that image_cache->refcount is at least 2, and
therefore free_image_cache is not called.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 16:34:49 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 12:34:49 2015
Received: from localhost ([127.0.0.1]:56043 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4toz-0006rn-Ip
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 12:34:48 -0400
Received: from mout.gmx.net ([212.227.15.15]:58919)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z4tov-0006rW-7N
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 12:34:43 -0400
Received: from glenalbyn.linguistics.ruhr-uni-bochum.de ([134.147.14.84]) by
 mail.gmx.com (mrgmx001) with ESMTPSA (Nemesis) id 0Likl3-1YZQcG3Q9F-00d1qi;
 Tue, 16 Jun 2015 18:34:33 +0200
Message-ID: <1434472472.21431.4.camel@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: Eli Zaretskii <eliz@HIDDEN>
Date: Tue, 16 Jun 2015 18:34:32 +0200
In-Reply-To: <83oakfmyq4.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
 <1434468845.21431.2.camel@HIDDEN> <83oakfmyq4.fsf@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:P71YEzBw3ZFR/rKXRxqrBBphA4LwT31jz9bj+d5D3Bb2SM17mc+
 yzRq8s2cVWHLcIQuHH/Yr92cBgkoAy+lIzFeAHAZUn0kiejXNHTSqmAqJ7I7Io0HWz9+Bwo
 d0MOY8/nK0sYQYUhRtOEupNINUAnfWPGd9JoqfHz2vxOnTNqw+srzO2amMA1FUZA9d01esC
 G33ScubfpACASSJcdUkFw==
X-UI-Out-Filterresults: notjunk:1;V01:K0:4NBuRCg6mhU=:M8ksAYPeVVwu1ulqHMdaSi
 Ks92t05smnQshe6o151pZWFu7aiqDTqhZL2gdSrbBXhyfIsMIA2t/2VlUm4QwvP2aL0d9arJ0
 vJBblAjVgUXltnvrX0VyLqSnWO+RsLhtlieAjTN9CwEKyY0Q8OJ7Dbom3YQqFVvj3SZhch5We
 z+7ydAk2bz9ziA+P/ysk3L2daMWtaZ2JOyEdef0QomEpY+15evhqAd7InXILRS149lapcY6t7
 dHnEJz/l9NbZWNOyXSawXapALnvCYbTPspJQe9X2XGMH8KwjGFdazUlFVDEynutXZ4GZpwdxf
 +YM0avUoy8Cy1Ne9omRnvsZz4UrKGldf2nVECukWg0WuR4GlERdpEUfJIkbcpF4sLu1UrSLZq
 l56Z1rzKAWQmAr2PWHq3gjDsuoIInwQUJgNmBHZ1pc+4gBW7BHrTTlB2e8yI9qiZT2cbOMBWi
 C4H9yjJeoPhHF6CBlwzq/A64/887AJbPQnpzO/KhIzojBkGEoS6x2PSA8N5BqqzHVf4ML5NLO
 mZ97L8odU8a2REzfQtEjO0pIosI0MB0yuCqorCmj4EpXtMnDacMvvqQyr2f+/8gbi93m1KeJN
 RhK2ae7nuwidy+b3+CucCMDqX49udxpZ50afBZq/yPbZoyZk2fy/ZObS27i32G2SVmPEVIhqz
 bjxawsPcQEzRDMwZkzTnu00dfhj5G9ytla2yqT+3FcciUPJwo9VwRXnBtayHmvvLKi0Q=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: rudalics@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Di, 2015-06-16 at 18:58 +0300, Eli Zaretskii wrote:
> >=20
> > From: Tobias Getzner <tobias.getzner@HIDDEN>
> > Date: Tue, 16 Jun 2015 17:34:05 +0200
> >=20
> > Thanks! I built from master (34a43ba), which includes your 93ae9f4.=20
> > I=E2=80=99m
> > still seeing a segfault for the steps given above. Backtrace below.
>=20
> Please run Emacs under GDB, put a breakpoint in
> x_free_frame_resources, then perform your steps, and show backtrace
> each time the breakpoint breaks.
>=20
> Thanks.
>=20

Breakpoint 1, x_free_frame_resources (f=3D0x124fd70) at xterm.c:10970
10970	{
(gdb) bt
#0  x_free_frame_resources (f=3D0x124fd70) at xterm.c:10970
#1  0x00000000004c9715 in unwind_create_frame (frame=3D19201397) at xfns.c:=
2842
#2  0x00000000004c9759 in unwind_create_tip_frame (frame=3D<optimized out>)=
 at xfns.c:4997
#3  0x0000000000557b2e in unbind_to (count=3D<optimized out>, value=3Dvalue=
@entry=3D0) at eval.c:3211
#4  0x0000000000557cf9 in unwind_to_catch (catch=3Dcatch@entry=3D0x140a040,=
 value=3Dvalue@entry=3D19849283)
    at eval.c:1157
#5  0x00000000005592ed in Fsignal (error_symbol=3Derror_symbol@entry=3D1862=
4, data=3D<optimized out>)
    at eval.c:1557
#6  0x00000000005595f9 in xsignal (error_symbol=3Derror_symbol@entry=3D1862=
4, data=3D<optimized out>)
    at eval.c:1581
#7  0x0000000000559c6d in signal_error (s=3Ds@entry=3D0x5e3d1d "Undefined c=
olor", arg=3D19849315,=20
    arg@entry=3D34016084) at eval.c:1636
#8  0x00000000004ccc57 in x_decode_color (f=3D<optimized out>, color_name=
=3D34016084,=20
    mono_color=3D<optimized out>) at xfns.c:495
#9  0x00000000004ce96c in x_set_foreground_color (f=3D0x124fd70, arg=3D3401=
6084, oldval=3D<optimized out>)
    at xfns.c:602
#10 0x0000000000426ff6 in x_set_frame_parameters (f=3Df@entry=3D0x124fd70, =
alist=3Dalist@entry=3D140737488338931)
    at frame.c:3152
#11 0x0000000000429ac7 in x_default_parameter (f=3Df@entry=3D0x124fd70, ali=
st=3Dalist@entry=3D19856675,=20
    prop=3Dprop@entry=3D22320, deflt=3D34090788, xprop=3Dxprop@entry=3D0x5d=
b8ca "foreground",=20
    xclass=3Dxclass@entry=3D0x5e3f61 "Foreground", type=3DRES_TYPE_STRING) =
at frame.c:4374
#12 0x00000000004cd200 in x_create_tip_frame (dpyinfo=3D0x173c900, parms=3D=
19856675, parms@entry=3D19857043,=20
    text=3Dtext@entry=3D34092084) at xfns.c:5181
#13 0x00000000004cd94d in Fx_show_tip (string=3D34092084, frame=3D18429029,=
 parms=3D19857043, timeout=3D42, dx=3D22,=20
    dy=3D82) at xfns.c:5540
#14 0x0000000000558efa in Ffuncall (nargs=3D7, args=3Dargs@entry=3D0x7fffff=
ffc2a8) at eval.c:2739
#15 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10509325,=20
    maxdepth=3D<optimized out>, args_template=3Dargs_template@entry=3D0, na=
rgs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:919
#16 0x00000000005589af in funcall_lambda (fun=3D10509197, nargs=3Dnargs@ent=
ry=3D2,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffc4b0) at eval.c:2951
#17 0x0000000000558d7b in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffc4a8) at eval.c:2779
#18 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10511429,=20
    maxdepth=3D<optimized out>, args_template=3Dargs_template@entry=3D0, na=
rgs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:919
#19 0x00000000005589af in funcall_lambda (fun=3D10511333, nargs=3Dnargs@ent=
ry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffc768) at eval.c:2951
#20 0x0000000000558d7b in Ffuncall (nargs=3D2, args=3D0x7fffffffc760) at ev=
al.c:2779
#21 0x0000000000556f95 in run_hook_with_args (nargs=3D2, args=3D0x7fffffffc=
760, funcall=3D0x558ba0 <Ffuncall>)
    at eval.c:2529
#22 0x0000000000558e69 in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffc758) at eval.c:2698
#23 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10508605,=20
    maxdepth=3D<optimized out>, args_template=3Dargs_template@entry=3D0, na=
rgs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:919
#24 0x00000000005589af in funcall_lambda (fun=3D10508541, nargs=3Dnargs@ent=
ry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffca38) at eval.c:2951
#25 0x0000000000558d7b in Ffuncall (nargs=3Dnargs@entry=3D2, args=3Dargs@en=
try=3D0x7fffffffca30) at eval.c:2779
#26 0x000000000055a1f3 in Fapply (nargs=3D2, args=3D0x7fffffffca30) at eval=
.c:2293
#27 0x0000000000558e69 in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffca28) at eval.c:2698
#28 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10064605,=20
    maxdepth=3D<optimized out>, args_template=3Dargs_template@entry=3D0, na=
rgs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:919
#29 0x00000000005589af in funcall_lambda (fun=3D10064525, nargs=3Dnargs@ent=
ry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffcc28) at eval.c:2951
#30 0x0000000000558d7b in Ffuncall (nargs=3Dnargs@entry=3D2, args=3Dargs@en=
try=3D0x7fffffffcc20) at eval.c:2779
#31 0x000000000055904a in call1 (fn=3Dfn@entry=3D43776, arg1=3Darg1@entry=
=3D35546957) at eval.c:2573
#32 0x00000000004ee838 in timer_check_2 (idle_timers=3D<optimized out>, tim=
ers=3D<optimized out>)
    at keyboard.c:4536
#33 timer_check () at keyboard.c:4603
#34 0x00000000004eebe9 in readable_events (flags=3Dflags@entry=3D1) at keyb=
oard.c:3437
#35 0x00000000004f0218 in get_input_pending (flags=3Dflags@entry=3D1) at ke=
yboard.c:6821
#36 0x00000000004f2328 in detect_input_pending_run_timers (do_display=3Ddo_=
display@entry=3Dtrue)
    at keyboard.c:9976
#37 0x000000000059719e in wait_reading_process_output (time_limit=3Dtime_li=
mit@entry=3D30,=20
    nsecs=3D<optimized out>, nsecs@entry=3D0, read_kbd=3Dread_kbd@entry=3D-=
1, do_display=3Ddo_display@entry=3Dtrue,=20
    wait_for_cell=3Dwait_for_cell@entry=3D0, wait_proc=3Dwait_proc@entry=3D=
0x0, just_wait_proc=3D0) at process.c:5009
#38 0x00000000004221d2 in sit_for (timeout=3D<optimized out>, reading=3Drea=
ding@entry=3Dtrue,=20
    display_option=3Ddisplay_option@entry=3D1) at dispnew.c:5748
#39 0x00000000004f48a4 in read_char (commandflag=3Dcommandflag@entry=3D1, m=
ap=3Dmap@entry=3D35527283,=20
    prev_event=3D0, used_mouse_menu=3Dused_mouse_menu@entry=3D0x7fffffffd81=
b, end_time=3Dend_time@entry=3D0x0)
    at keyboard.c:2784
#40 0x00000000004f542c in read_key_sequence (keybuf=3Dkeybuf@entry=3D0x7fff=
ffffd8f0, prompt=3Dprompt@entry=3D0,=20
    dont_downcase_last=3Ddont_downcase_last@entry=3Dfalse,=20
    can_return_switch_frame=3Dcan_return_switch_frame@entry=3Dtrue,=20
    fix_current_buffer=3Dfix_current_buffer@entry=3Dtrue, prevent_redisplay=
=3Dprevent_redisplay@entry=3Dfalse,=20
    bufsize=3D30) at keyboard.c:9159
#41 0x00000000004f7051 in command_loop_1 () at keyboard.c:1407
#42 0x0000000000557537 in internal_condition_case (bfun=3Dbfun@entry=3D0x4f=
6e20 <command_loop_1>,=20
    handlers=3Dhandlers@entry=3D18624, hfun=3Dhfun@entry=3D0x4edf70 <cmd_er=
ror>) at eval.c:1348
#43 0x00000000004e95fc in command_loop_2 (ignore=3Dignore@entry=3D0) at key=
board.c:1139
#44 0x0000000000557413 in internal_catch (tag=3Dtag@entry=3D44352, func=3Df=
unc@entry=3D0x4e95e0 <command_loop_2>,=20
    arg=3Darg@entry=3D0) at eval.c:1108
#45 0x00000000004e95b9 in command_loop () at keyboard.c:1118
#46 0x00000000004edb5b in recursive_edit_1 () at keyboard.c:728
#47 0x00000000004edea8 in Frecursive_edit () at keyboard.c:799
#48 0x0000000000418447 in main (argc=3D2, argv=3D0x7fffffffdc58) at emacs.c=
:1626




(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x000000000042c4e2 in fill_image_glyph_string (s=3Ds@entry=3D0x7fffffffaff0=
) at xdisp.c:24517
24517	  s->img =3D IMAGE_FROM_ID (s->f, s->first_glyph->u.img_id);
(gdb) bt
#0  0x000000000042c4e2 in fill_image_glyph_string (s=3Ds@entry=3D0x7fffffff=
aff0) at xdisp.c:24517
#1  0x00000000004562f4 in draw_glyphs (w=3Dw@entry=3D0x1194470, x=3D<optimi=
zed out>, row=3Drow@entry=3D0x2125e40,=20
    area=3Darea@entry=3DTEXT_AREA, start=3D<optimized out>, end=3D3, hl=3DD=
RAW_NORMAL_TEXT, overlaps=3D0)
    at xdisp.c:25149
#2  0x0000000000458d95 in expose_area (w=3Dw@entry=3D0x1194470, row=3Drow@e=
ntry=3D0x2125e40,=20
    r=3Dr@entry=3D0x7fffffffb3c0, area=3Darea@entry=3DTEXT_AREA) at xdisp.c=
:30082
#3  0x0000000000458e91 in expose_line (w=3Dw@entry=3D0x1194470, row=3Drow@e=
ntry=3D0x2125e40,=20
    r=3Dr@entry=3D0x7fffffffb3c0) at xdisp.c:30107
#4  0x00000000004660f4 in expose_window (fr=3D0x7fffffffb430, w=3D0x1194470=
) at xdisp.c:30372
#5  expose_window_tree (w=3D0x1194470, r=3Dr@entry=3D0x7fffffffb430) at xdi=
sp.c:30446
#6  0x000000000046665a in expose_frame (f=3Df@entry=3D0x1193460, x=3D<optim=
ized out>, y=3D<optimized out>,=20
    w=3D<optimized out>, h=3D<optimized out>) at xdisp.c:30501
#7  0x00000000004c601c in handle_one_xevent (dpyinfo=3Ddpyinfo@entry=3D0x17=
3c900,=20
    event=3Devent@entry=3D0x7fffffffbaa0, finish=3Dfinish@entry=3D0xb42de0,=
 hold_quit=3D0x7fffffffbd20)
    at xterm.c:7683
#8  0x00000000004c6e10 in event_handler_gdk (gxev=3D0x7fffffffbaa0, ev=3D<o=
ptimized out>, data=3D<optimized out>)
    at xterm.c:7294
#9  0x00007ffff6750511 in ?? () from /usr/lib/libgdk-3.so.0
#10 0x00007ffff67507d0 in ?? () from /usr/lib/libgdk-3.so.0
#11 0x00007ffff67239f9 in gdk_display_get_event () from /usr/lib/libgdk-3.s=
o.0
#12 0x00007ffff6750592 in ?? () from /usr/lib/libgdk-3.so.0
#13 0x00007ffff50889fd in g_main_context_dispatch () from /usr/lib/libglib-=
2.0.so.0
#14 0x00007ffff5088ce0 in ?? () from /usr/lib/libglib-2.0.so.0
#15 0x00007ffff5088d8c in g_main_context_iteration () from /usr/lib/libglib=
-2.0.so.0
#16 0x00007ffff6bc80f5 in gtk_main_iteration () from /usr/lib/libgtk-3.so.0
#17 0x00000000004bcc92 in XTread_socket (terminal=3D<optimized out>, hold_q=
uit=3D0x7fffffffbd20)
    at xterm.c:8647
#18 0x00000000004f00c9 in gobble_input () at keyboard.c:6906
#19 0x00000000004efae5 in handle_async_input () at keyboard.c:7158
#20 process_pending_signals () at keyboard.c:7172
#21 0x00000000004c9715 in unwind_create_frame (frame=3D19201397) at xfns.c:=
2842
#22 0x00000000004c9759 in unwind_create_tip_frame (frame=3D<optimized out>)=
 at xfns.c:4997
#23 0x0000000000557b2e in unbind_to (count=3D<optimized out>, value=3Dvalue=
@entry=3D0) at eval.c:3211
#24 0x0000000000557cf9 in unwind_to_catch (catch=3Dcatch@entry=3D0x140a040,=
 value=3Dvalue@entry=3D19849283)
    at eval.c:1157
#25 0x00000000005592ed in Fsignal (error_symbol=3Derror_symbol@entry=3D1862=
4, data=3D<optimized out>)
    at eval.c:1557
#26 0x00000000005595f9 in xsignal (error_symbol=3Derror_symbol@entry=3D1862=
4, data=3D<optimized out>)
    at eval.c:1581
#27 0x0000000000559c6d in signal_error (s=3Ds@entry=3D0x5e3d1d "Undefined c=
olor", arg=3D19849315,=20
    arg@entry=3D34016084) at eval.c:1636
#28 0x00000000004ccc57 in x_decode_color (f=3D<optimized out>, color_name=
=3D34016084,=20
    mono_color=3D<optimized out>) at xfns.c:495
#29 0x00000000004ce96c in x_set_foreground_color (f=3D0x124fd70, arg=3D3401=
6084, oldval=3D<optimized out>)
    at xfns.c:602
#30 0x0000000000426ff6 in x_set_frame_parameters (f=3Df@entry=3D0x124fd70, =
alist=3Dalist@entry=3D140737488338931)
    at frame.c:3152
#31 0x0000000000429ac7 in x_default_parameter (f=3Df@entry=3D0x124fd70, ali=
st=3Dalist@entry=3D19856675,=20
    prop=3Dprop@entry=3D22320, deflt=3D34090788, xprop=3Dxprop@entry=3D0x5d=
b8ca "foreground",=20
    xclass=3Dxclass@entry=3D0x5e3f61 "Foreground", type=3DRES_TYPE_STRING) =
at frame.c:4374
#32 0x00000000004cd200 in x_create_tip_frame (dpyinfo=3D0x173c900, parms=3D=
19856675, parms@entry=3D19857043,=20
    text=3Dtext@entry=3D34092084) at xfns.c:5181
#33 0x00000000004cd94d in Fx_show_tip (string=3D34092084, frame=3D18429029,=
 parms=3D19857043, timeout=3D42, dx=3D22,=20
    dy=3D82) at xfns.c:5540
#34 0x0000000000558efa in Ffuncall (nargs=3D7, args=3Dargs@entry=3D0x7fffff=
ffc2a8) at eval.c:2739
#35 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10509325,=20
    maxdepth=3D<optimized out>, args_template=3Dargs_template@entry=3D0, na=
rgs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:919
#36 0x00000000005589af in funcall_lambda (fun=3D10509197, nargs=3Dnargs@ent=
ry=3D2,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffc4b0) at eval.c:2951
#37 0x0000000000558d7b in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffc4a8) at eval.c:2779
#38 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10511429,=20
    maxdepth=3D<optimized out>, args_template=3Dargs_template@entry=3D0, na=
rgs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:919
#39 0x00000000005589af in funcall_lambda (fun=3D10511333, nargs=3Dnargs@ent=
ry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffc768) at eval.c:2951
#40 0x0000000000558d7b in Ffuncall (nargs=3D2, args=3D0x7fffffffc760) at ev=
al.c:2779
#41 0x0000000000556f95 in run_hook_with_args (nargs=3D2, args=3D0x7fffffffc=
760, funcall=3D0x558ba0 <Ffuncall>)
    at eval.c:2529
#42 0x0000000000558e69 in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffc758) at eval.c:2698
#43 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10508605,=20
    maxdepth=3D<optimized out>, args_template=3Dargs_template@entry=3D0, na=
rgs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:919
#44 0x00000000005589af in funcall_lambda (fun=3D10508541, nargs=3Dnargs@ent=
ry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffca38) at eval.c:2951
#45 0x0000000000558d7b in Ffuncall (nargs=3Dnargs@entry=3D2, args=3Dargs@en=
try=3D0x7fffffffca30) at eval.c:2779
#46 0x000000000055a1f3 in Fapply (nargs=3D2, args=3D0x7fffffffca30) at eval=
.c:2293
#47 0x0000000000558e69 in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffca28) at eval.c:2698
#48 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10064605,=20
    maxdepth=3D<optimized out>, args_template=3Dargs_template@entry=3D0, na=
rgs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:919
#49 0x00000000005589af in funcall_lambda (fun=3D10064525, nargs=3Dnargs@ent=
ry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffcc28) at eval.c:2951
#50 0x0000000000558d7b in Ffuncall (nargs=3Dnargs@entry=3D2, args=3Dargs@en=
try=3D0x7fffffffcc20) at eval.c:2779
#51 0x000000000055904a in call1 (fn=3Dfn@entry=3D43776, arg1=3Darg1@entry=
=3D35546957) at eval.c:2573
#52 0x00000000004ee838 in timer_check_2 (idle_timers=3D<optimized out>, tim=
ers=3D<optimized out>)
    at keyboard.c:4536
#53 timer_check () at keyboard.c:4603
#54 0x00000000004eebe9 in readable_events (flags=3Dflags@entry=3D1) at keyb=
oard.c:3437
#55 0x00000000004f0218 in get_input_pending (flags=3Dflags@entry=3D1) at ke=
yboard.c:6821
#56 0x00000000004f2328 in detect_input_pending_run_timers (do_display=3Ddo_=
display@entry=3Dtrue)
    at keyboard.c:9976
#57 0x000000000059719e in wait_reading_process_output (time_limit=3Dtime_li=
mit@entry=3D30,=20
    nsecs=3D<optimized out>, nsecs@entry=3D0, read_kbd=3Dread_kbd@entry=3D-=
1, do_display=3Ddo_display@entry=3Dtrue,=20
    wait_for_cell=3Dwait_for_cell@entry=3D0, wait_proc=3Dwait_proc@entry=3D=
0x0, just_wait_proc=3D0) at process.c:5009
#58 0x00000000004221d2 in sit_for (timeout=3D<optimized out>, reading=3Drea=
ding@entry=3Dtrue,=20
    display_option=3Ddisplay_option@entry=3D1) at dispnew.c:5748
#59 0x00000000004f48a4 in read_char (commandflag=3Dcommandflag@entry=3D1, m=
ap=3Dmap@entry=3D35527283,=20
    prev_event=3D0, used_mouse_menu=3Dused_mouse_menu@entry=3D0x7fffffffd81=
b, end_time=3Dend_time@entry=3D0x0)
    at keyboard.c:2784
#60 0x00000000004f542c in read_key_sequence (keybuf=3Dkeybuf@entry=3D0x7fff=
ffffd8f0, prompt=3Dprompt@entry=3D0,=20
    dont_downcase_last=3Ddont_downcase_last@entry=3Dfalse,=20
    can_return_switch_frame=3Dcan_return_switch_frame@entry=3Dtrue,=20
    fix_current_buffer=3Dfix_current_buffer@entry=3Dtrue, prevent_redisplay=
=3Dprevent_redisplay@entry=3Dfalse,=20
    bufsize=3D30) at keyboard.c:9159
#61 0x00000000004f7051 in command_loop_1 () at keyboard.c:1407
#62 0x0000000000557537 in internal_condition_case (bfun=3Dbfun@entry=3D0x4f=
6e20 <command_loop_1>,=20
    handlers=3Dhandlers@entry=3D18624, hfun=3Dhfun@entry=3D0x4edf70 <cmd_er=
ror>) at eval.c:1348
#63 0x00000000004e95fc in command_loop_2 (ignore=3Dignore@entry=3D0) at key=
board.c:1139
#64 0x0000000000557413 in internal_catch (tag=3Dtag@entry=3D44352, func=3Df=
unc@entry=3D0x4e95e0 <command_loop_2>,=20
    arg=3Darg@entry=3D0) at eval.c:1108
#65 0x00000000004e95b9 in command_loop () at keyboard.c:1118
#66 0x00000000004edb5b in recursive_edit_1 () at keyboard.c:728
#67 0x00000000004edea8 in Frecursive_edit () at keyboard.c:799
#68 0x0000000000418447 in main (argc=3D2, argv=3D0x7fffffffdc58) at emacs.c=
:1626




(gdb) cont
Continuing.
Fatal error 11: Segmentation fault
Program received signal SIGSEGV, Segmentation fault.
0x000000000045e51e in note_mouse_highlight (f=3Df@entry=3D0x1193460, x=3D<o=
ptimized out>, y=3D19) at xdisp.c:29600
29600		  struct image *img =3D IMAGE_FROM_ID (f, glyph->u.img_id);




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 15:59:06 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 11:59:06 2015
Received: from localhost ([127.0.0.1]:56026 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4tGT-0004Yl-Km
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 11:59:05 -0400
Received: from mtaout22.012.net.il ([80.179.55.172]:64029)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4tGQ-0004Y5-2n
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 11:59:03 -0400
Received: from conversion-daemon.a-mtaout22.012.net.il by
 a-mtaout22.012.net.il (HyperSendmail v2007.08) id
 <0NQ100500OE0JZ00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Tue, 16 Jun 2015 18:58:55 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout22.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ100532OE6F750@HIDDEN>;
 Tue, 16 Jun 2015 18:58:55 +0300 (IDT)
Date: Tue, 16 Jun 2015 18:58:43 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <1434468845.21431.2.camel@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: Tobias Getzner <tobias.getzner@HIDDEN>
Message-id: <83oakfmyq4.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
 <1434468845.21431.2.camel@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: rudalics@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> From: Tobias Getzner <tobias.getzner@HIDDEN>
> Date: Tue, 16 Jun 2015 17:34:05 +0200
> 
> Thanks! I built from master (34a43ba), which includes your 93ae9f4. I’m
> still seeing a segfault for the steps given above. Backtrace below.

Please run Emacs under GDB, put a breakpoint in
x_free_frame_resources, then perform your steps, and show backtrace
each time the breakpoint breaks.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 15:34:17 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 11:34:17 2015
Received: from localhost ([127.0.0.1]:55984 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4ssS-0003yV-4a
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 11:34:17 -0400
Received: from mout.gmx.net ([212.227.17.22]:50146)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z4ssP-0003xy-GI
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 11:34:14 -0400
Received: from glenalbyn.linguistics.ruhr-uni-bochum.de ([134.147.14.84]) by
 mail.gmx.com (mrgmx102) with ESMTPSA (Nemesis) id 0MWQSM-1ZcQQ01B1O-00Xec8;
 Tue, 16 Jun 2015 17:34:06 +0200
Message-ID: <1434468845.21431.2.camel@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: martin rudalics <rudalics@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>, 
 20802 <at> debbugs.gnu.org
Date: Tue, 16 Jun 2015 17:34:05 +0200
In-Reply-To: <558024F4.5090205@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN> <558024F4.5090205@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:9C5aLq6Bq/T+Y5SZwrJuaVqvtdwFeOdkOgqCX6VJU+CW3YsHYPM
 TIR9yepnMtRbXVjCaX7UWN6o39DWd2mm9KxhEsyY/m9pXFCj1Z0CMVNWr7v/puJSkfEv+Rf
 ATEgh6BeWWSq9iKk1ksEKGKwOEsdyzO12QpSGbP57rnzq/lifl7lfVpp/Uxn8mPpGaMGWXi
 7wOpGpKry1W1SAlO2jqsw==
X-UI-Out-Filterresults: notjunk:1;V01:K0:vMPBw2StdF4=:p7hP0FvKl6w2eTN1EbI/oL
 54evsB0CKInugBE07vMu/Idunex3oyYCBHA8D1w0NzqJQyakM2ZbdBFThoCyEnlSEbCyZhBbs
 qVzvR8dj+VEKd4g3wg0VGS0qS3c88q9xw/P7cTGj31bv4c+t9hOdGE+Fj3Q0FZcsqcxWZBXvz
 XYSSabkaWB0chX2bf4/EgWsa7qzJjxA6TYwGtfw2yjDEl7hiW3u59Jp4jG1nvmolJi/DLgiNz
 GhGz57xw9QtHHEh9VfEYebfca4zfLR+NWtEoIC/+RcaZ7cZIc09XDhJF8Xkuq5n8B1cQeR9KI
 m0aj1yckbDoUvIFv3wZsLtOgb5xQLZxwUTw2xMqISQv/NC3hkBAvKvw2Pq1ZWJKT3QfaC9eYu
 PjwXgq9AWVqTfbKFwUuZnUil79qgkW9+V+WqpsX7pxD89aK7yVVTzu0706PfXNFzBvoYGzwGU
 ASzEPh5f62RNnijX2fc4Y/T4nk6aJfZtcENr9Q4eLWgDnKoNhJfKnsH0+ELgrHZavkLDqgoCI
 kHEtoEEfYzxCNo4DZZikQSITnVPJpnf+kaD7ipgb06jlux4HIA4RofBjOv82a8uXZrbT2Yocc
 P4tbGurAPSXkhLvapBsHZhpX6xzghcLuTJoy0LeMtRAf04iqwsNL/UbvfI2LJuEV+FpMotVqz
 qDlXn2v+PEn2kSqJ6jLk4a08pntxDWXBQnjS1JOFW55xcz7F6gzYOibzk7e+ZFKCXgfQ=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Di, 2015-06-16 at 15:30 +0200, martin rudalics wrote:
>  > This was after setting x-gtk-use-system-tooltip to nil and=20
> customizing
>  > the tooltip face to #qqq.
> [...]
>  > Program received signal SIGSEGV, Segmentation fault.
>  > cache_image (f=3D0x1170a68, img=3D<optimized out>) at image.c:1782
>  > 1782	  for (i =3D 0; i < c->used; ++i)
>=20
> This should be indeed the same segfault I saw.  Meanwhile I checked=20
> in a
> fix on trunk/master.  If you can build Emacs please try it.
>=20

Thanks! I built from master (34a43ba), which includes your 93ae9f4. I=E2=80=
=99m
still seeing a segfault for the steps given above. Backtrace below.

Best,
TG=20


Program received signal SIGSEGV, Segmentation fault.
lookup_image (f=3D0x1195480, spec=3Dspec@entry=3D16917427) at image.c:1744
1744	      cache_image (f, img);
(gdb) bt
#0  lookup_image (f=3D0x1195480, spec=3Dspec@entry=3D16917427) at image.c:1=
744
#1  0x000000000043737f in calc_pixel_width_or_height (res=3Dres@entry=3D0x7=
fffffff37c8, it=3Dit@entry=3D0x7fffffff72f0, prop=3D16917427, font=3Dfont@e=
ntry=3D0x11986c0, width_p=3Dwidth_p@entry=3Dtrue,=20
    align_to=3Dalign_to@entry=3D0x7fffffff3890) at xdisp.c:24019
#2  0x00000000004370e8 in calc_pixel_width_or_height (align_to=3D0x7fffffff=
3890, width_p=3D<optimized out>, font=3D0x11986c0, prop=3D<optimized out>, =
it=3D0x7fffffff72f0, res=3D0x7fffffff37c8) at xdisp.c:24056
#3  calc_pixel_width_or_height (res=3Dres@entry=3D0x7fffffff3838, it=3Dit@e=
ntry=3D0x7fffffff72f0, prop=3D16917347, font=3Dfont@entry=3D0x11986c0, widt=
h_p=3Dwidth_p@entry=3Dtrue, align_to=3Dalign_to@entry=3D0x7fffffff3890)
    at xdisp.c:24058
#4  0x00000000004372e6 in calc_pixel_width_or_height (align_to=3D0x7fffffff=
3890, width_p=3Dtrue, font=3D0x11986c0, prop=3D<optimized out>, it=3D0x7fff=
ffff72f0, res=3D0x7fffffff3838) at xdisp.c:23902
#5  calc_pixel_width_or_height (res=3Dres@entry=3D0x7fffffff3898, it=3Dit@e=
ntry=3D0x7fffffff72f0, prop=3D<optimized out>, font=3Dfont@entry=3D0x11986c=
0, width_p=3Dwidth_p@entry=3Dtrue, align_to=3Dalign_to@entry=3D0x7fffffff38=
90)
    at xdisp.c:24033
#6  0x000000000045b4f1 in calc_pixel_width_or_height (align_to=3D0x7fffffff=
3890, width_p=3Dtrue, font=3D0x11986c0, prop=3D<optimized out>, it=3D0x7fff=
ffff72f0, res=3D0x7fffffff3898) at xdisp.c:25909
#7  produce_stretch_glyph (it=3D0x7fffffff72f0) at xdisp.c:25910
#8  0x000000000045a415 in x_produce_glyphs (it=3D0x7fffffff72f0) at xdisp.c=
:27136
#9  0x00000000004480ee in display_line (it=3Dit@entry=3D0x7fffffff72f0) at =
xdisp.c:20223
#10 0x000000000044c6ca in try_window (window=3Dwindow@entry=3D18441365, pos=
=3D..., flags=3Dflags@entry=3D1) at xdisp.c:16889
#11 0x00000000004627d2 in redisplay_window (window=3D18441365, just_this_on=
e_p=3Djust_this_one_p@entry=3Dfalse) at xdisp.c:16362
#12 0x000000000046548b in redisplay_window_0 (window=3Dwindow@entry=3D18441=
365) at xdisp.c:14181
#13 0x000000000055765b in internal_condition_case_1 (bfun=3Dbfun@entry=3D0x=
465460 <redisplay_window_0>, arg=3D18441365, handlers=3D<optimized out>, hf=
un=3Dhfun@entry=3D0x42c260 <redisplay_window_error>) at eval.c:1372
#14 0x00000000004319df in redisplay_windows (window=3D18441365) at xdisp.c:=
14161
#15 0x0000000000452541 in redisplay_internal () at xdisp.c:13753
#16 0x000000000045469a in redisplay_preserve_echo_area (from_where=3Dfrom_w=
here@entry=3D2) at xdisp.c:14014
#17 0x000000000041d6de in Fredisplay (force=3D0) at dispnew.c:5777
#18 0x0000000000558f5e in Ffuncall (nargs=3D1, args=3Dargs@entry=3D0x7fffff=
ffc140) at eval.c:2718
#19 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D8816373, maxdepth=3D<optimized out>, args_template=3D<optimized out>, na=
rgs=3Dnargs@entry=3D1, args=3D<optimized out>, args@entry=3D0x7fffffffc140)
    at bytecode.c:919
#20 0x0000000000558ad4 in funcall_lambda (fun=3D8816340, nargs=3Dnargs@entr=
y=3D1, arg_vector=3D0x7fffffffc140, arg_vector@entry=3D0x7fffffffc2c0) at e=
val.c:2885
#21 0x0000000000558d7b in Ffuncall (nargs=3D2, args=3Dargs@entry=3D0x7fffff=
ffc2b8) at eval.c:2779
#22 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10509325, maxdepth=3D<optimized out>, args_template=3Dargs_template@entr=
y=3D0, nargs=3Dnargs@entry=3D0, args=3D<optimized out>, args@entry=3D0x0)
    at bytecode.c:919
#23 0x00000000005589af in funcall_lambda (fun=3D10509197, nargs=3Dnargs@ent=
ry=3D2, arg_vector=3Darg_vector@entry=3D0x7fffffffc4c0) at eval.c:2951
#24 0x0000000000558d7b in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffc4b8) at eval.c:2779
#25 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10511429, maxdepth=3D<optimized out>, args_template=3Dargs_template@entr=
y=3D0, nargs=3Dnargs@entry=3D0, args=3D<optimized out>, args@entry=3D0x0)
    at bytecode.c:919
#26 0x00000000005589af in funcall_lambda (fun=3D10511333, nargs=3Dnargs@ent=
ry=3D1, arg_vector=3Darg_vector@entry=3D0x7fffffffc778) at eval.c:2951
#27 0x0000000000558d7b in Ffuncall (nargs=3D2, args=3D0x7fffffffc770) at ev=
al.c:2779
#28 0x0000000000556f95 in run_hook_with_args (nargs=3D2, args=3D0x7fffffffc=
770, funcall=3D0x558ba0 <Ffuncall>) at eval.c:2529
#29 0x0000000000558e69 in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffc768) at eval.c:2698
#30 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10508605, maxdepth=3D<optimized out>, args_template=3Dargs_template@entr=
y=3D0, nargs=3Dnargs@entry=3D0, args=3D<optimized out>, args@entry=3D0x0)
    at bytecode.c:919
#31 0x00000000005589af in funcall_lambda (fun=3D10508541, nargs=3Dnargs@ent=
ry=3D1, arg_vector=3Darg_vector@entry=3D0x7fffffffca48) at eval.c:2951
#32 0x0000000000558d7b in Ffuncall (nargs=3Dnargs@entry=3D2, args=3Dargs@en=
try=3D0x7fffffffca40) at eval.c:2779
#33 0x000000000055a1f3 in Fapply (nargs=3D2, args=3D0x7fffffffca40) at eval=
.c:2293
#34 0x0000000000558e69 in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ffca38) at eval.c:2698
#35 0x000000000058c273 in exec_byte_code (bytestr=3D<optimized out>, vector=
=3D10064605, maxdepth=3D<optimized out>, args_template=3Dargs_template@entr=
y=3D0, nargs=3Dnargs@entry=3D0, args=3D<optimized out>, args@entry=3D0x0)
    at bytecode.c:919
#36 0x00000000005589af in funcall_lambda (fun=3D10064525, nargs=3Dnargs@ent=
ry=3D1, arg_vector=3Darg_vector@entry=3D0x7fffffffcc38) at eval.c:2951
#37 0x0000000000558d7b in Ffuncall (nargs=3Dnargs@entry=3D2, args=3Dargs@en=
try=3D0x7fffffffcc30) at eval.c:2779
#38 0x000000000055904a in call1 (fn=3Dfn@entry=3D43776, arg1=3Darg1@entry=
=3D23853549) at eval.c:2573
#39 0x00000000004ee838 in timer_check_2 (idle_timers=3D<optimized out>, tim=
ers=3D<optimized out>) at keyboard.c:4536
#40 timer_check () at keyboard.c:4603
#41 0x00000000004eebe9 in readable_events (flags=3Dflags@entry=3D1) at keyb=
oard.c:3437
#42 0x00000000004f0218 in get_input_pending (flags=3Dflags@entry=3D1) at ke=
yboard.c:6821
#43 0x00000000004f2328 in detect_input_pending_run_timers (do_display=3Ddo_=
display@entry=3Dtrue) at keyboard.c:9976
#44 0x000000000059719e in wait_reading_process_output (time_limit=3Dtime_li=
mit@entry=3D30, nsecs=3D<optimized out>, nsecs@entry=3D0, read_kbd=3Dread_k=
bd@entry=3D-1, do_display=3Ddo_display@entry=3Dtrue,=20
    wait_for_cell=3Dwait_for_cell@entry=3D0, wait_proc=3Dwait_proc@entry=3D=
0x0, just_wait_proc=3D0) at process.c:5009
#45 0x00000000004221d2 in sit_for (timeout=3D<optimized out>, reading=3Drea=
ding@entry=3Dtrue, display_option=3Ddisplay_option@entry=3D1) at dispnew.c:=
5748
#46 0x00000000004f48a4 in read_char (commandflag=3Dcommandflag@entry=3D1, m=
ap=3Dmap@entry=3D34697955, prev_event=3D0, used_mouse_menu=3Dused_mouse_men=
u@entry=3D0x7fffffffd82b, end_time=3Dend_time@entry=3D0x0) at keyboard.c:27=
84
#47 0x00000000004f542c in read_key_sequence (keybuf=3Dkeybuf@entry=3D0x7fff=
ffffd900, prompt=3Dprompt@entry=3D0, dont_downcase_last=3Ddont_downcase_las=
t@entry=3Dfalse,=20
    can_return_switch_frame=3Dcan_return_switch_frame@entry=3Dtrue, fix_cur=
rent_buffer=3Dfix_current_buffer@entry=3Dtrue, prevent_redisplay=3Dprevent_=
redisplay@entry=3Dfalse, bufsize=3D30) at keyboard.c:9159
#48 0x00000000004f7051 in command_loop_1 () at keyboard.c:1407
#49 0x0000000000557537 in internal_condition_case (bfun=3Dbfun@entry=3D0x4f=
6e20 <command_loop_1>, handlers=3Dhandlers@entry=3D18624, hfun=3Dhfun@entry=
=3D0x4edf70 <cmd_error>) at eval.c:1348
#50 0x00000000004e95fc in command_loop_2 (ignore=3Dignore@entry=3D0) at key=
board.c:1139
#51 0x0000000000557413 in internal_catch (tag=3Dtag@entry=3D44352, func=3Df=
unc@entry=3D0x4e95e0 <command_loop_2>, arg=3Darg@entry=3D0) at eval.c:1108
#52 0x00000000004e95b9 in command_loop () at keyboard.c:1118
#53 0x00000000004edb5b in recursive_edit_1 () at keyboard.c:728
#54 0x00000000004edea8 in Frecursive_edit () at keyboard.c:799
#55 0x0000000000418447 in main (argc=3D2, argv=3D0x7fffffffdc68) at emacs.c=
:1626




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 14:55:38 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 10:55:38 2015
Received: from localhost ([127.0.0.1]:55941 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4sH2-00032u-8i
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 10:55:37 -0400
Received: from mtaout25.012.net.il ([80.179.55.181]:44102)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4sGy-00032a-Ag
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 10:55:33 -0400
Received: from conversion-daemon.mtaout25.012.net.il by mtaout25.012.net.il
 (HyperSendmail v2007.08) id <0NQ100I00KW64Y00@HIDDEN> for
 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 17:50:39 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout25.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NQ100IHDL8EPT10@HIDDEN>; Tue, 16 Jun 2015 17:50:39 +0300 (IDT)
Date: Tue, 16 Jun 2015 17:54:51 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <558024E6.6090503@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83wpz3n1ok.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
 <83zj41nhg9.fsf@HIDDEN> <557EF6B7.3000701@HIDDEN> <83fv5sop6q.fsf@HIDDEN>
 <558024E6.6090503@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Tue, 16 Jun 2015 15:30:14 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> In 32a4883..93ae9f4 master -> master I checked in a fix for X and NS
> although I wasn't able to reproduce the crash on the latter (probably
> due to the fact that on NS like with the native Gtk tooltips one can't
> override the colors anyway).
> 
>  >> One last question: In struct image_cache we specify refcount as
>  >> ptrdiff_t while w32fns.c defines image_cache_refcount as int.  Both
>  >> xfns.c and nsfns.m define image_cache_refcount as ptrdiff_t.  Shouldn't
>  >> we uniquify this?
>  >
>  > Yes, please.  The fewer differences between the various *fns.c and
>  > *term.c functions with similar, let alone identical names, the better.
> 
> I made it a ptrdiff_t on Windows.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 13:31:19 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 09:31:19 2015
Received: from localhost ([127.0.0.1]:55378 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4qxR-00011l-CU
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 09:31:18 -0400
Received: from mout.gmx.net ([212.227.15.19]:59252)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4qwp-00010T-Ua
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 09:30:40 -0400
Received: from [188.22.108.24] ([188.22.108.24]) by mail.gmx.com (mrgmx002)
 with ESMTPSA (Nemesis) id 0MYOkT-1ZZyhq0fS5-00V5Vu; Tue, 16 Jun 2015 15:30:31
 +0200
Message-ID: <558024F4.5090205@HIDDEN>
Date: Tue, 16 Jun 2015 15:30:28 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Tobias Getzner <tobias.getzner@HIDDEN>, Eli Zaretskii <eliz@HIDDEN>, 
 20802 <at> debbugs.gnu.org
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <1434439264.2078.6.camel@HIDDEN>
In-Reply-To: <1434439264.2078.6.camel@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:jkr9LCO+DS6oORlhT3W45qwljs2jKuaWc1KCV9jDwFn4UQJTquy
 OzL3P3LIcxPG9utQXNPUYJrFBh/+PqAaDexDdSmGFFsRT0s+7jHuszbcvbeWAomkz5chtsa
 +lVMqmsF2UVLW2rbyBLYtOp8gp0ynRPgYFDzbHm0Fab0w9lhFWWkoHJfogekshPX1YBnXTs
 9XXxxnKaqw8G627P2havA==
X-UI-Out-Filterresults: notjunk:1;V01:K0:oDKb8XK7YTc=:YBJgPasAGu2FhLm1Sf0rFc
 Vq5A5gZA33OyNpl6W+8RBIp5mm6gskzu5/KIadrl0PTiPlgi/4xWNKT6g+9UnQL4ak0u9OFI9
 RMJWcpEthov878XmL4iEPhryRvReRuz6cBCvpM52+3c60HIwIyPxw3kK8yWSv5QZtLbN09cgn
 518vQOJ7b6a4UAVUvGDZnJTEDvCd7wJ3sVyOukrURA9+ZX4g49YAaaDQkdGf0AEKjnDrO8IN3
 8pziWCyazvJkoiZ01aCynHTvwCkIpNxPYtmSdxy6Gsznb05vgGVDmNLfR5TdIy0ZhUEstiABq
 G+aL5S2XsyqZPuCyh/nxWw9Sn1K+Qn+CAWDVNQHca3SgaZz/LEqmx6z06eLxH+rt6ISBibLIc
 RBqQozMvqzyzvh7gN4XTn3tY69AWW7SCigbgCpChc4rDXgvZVg92Zxi6CtujgmuZDIKq+qiNb
 Zg/K7ddIH5oRWvpQCj+hzajBYaLtlsMTWbh32m0Exi2gznaGBu/T7QTBjsbiqhPzIFHu3l3Us
 pc/vxD0F720lvwkrnB/UWYjkhERgluIk2ChKZu+C7tbVay2uzgfGt6fUThQmku6pLx/xzTxlj
 XpQbHuYUdT7VifNVfGHg9JIN3/QfhGpqDlX4e43vYx2eWGq3ZekT8nNxXuWzpuormHzUwzprZ
 1gofTeAdH0EwBCfJEd29DI2B8hffIho2Zzs23NbMDh2MhWiHJ6egAIg3yra1XJhuV91M=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > This was after setting x-gtk-use-system-tooltip to nil and customizing
 > the tooltip face to #qqq.
[...]
 > Program received signal SIGSEGV, Segmentation fault.
 > cache_image (f=0x1170a68, img=<optimized out>) at image.c:1782
 > 1782	  for (i = 0; i < c->used; ++i)

This should be indeed the same segfault I saw.  Meanwhile I checked in a
fix on trunk/master.  If you can build Emacs please try it.

Thanks for report and backtrace, martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 13:30:45 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 09:30:45 2015
Received: from localhost ([127.0.0.1]:55375 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4qws-00010g-QY
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 09:30:43 -0400
Received: from mout.gmx.net ([212.227.15.19]:53843)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4qwa-000108-5B
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 09:30:25 -0400
Received: from [188.22.108.24] ([188.22.108.24]) by mail.gmx.com (mrgmx001)
 with ESMTPSA (Nemesis) id 0MTBLi-1ZWvuB1ylS-00S3LE; Tue, 16 Jun 2015 15:30:17
 +0200
Message-ID: <558024E6.6090503@HIDDEN>
Date: Tue, 16 Jun 2015 15:30:14 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
 <83zj41nhg9.fsf@HIDDEN> <557EF6B7.3000701@HIDDEN> <83fv5sop6q.fsf@HIDDEN>
In-Reply-To: <83fv5sop6q.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:DdPeCt926ljA8o+kzkFt0bqMUz1yARSKK3t9YosLlMmnJNj+HdQ
 ymZEd/9HzB0Lmo5Fc21jN7TfhdwTvULWSSHGMkAzfcoZ0wmgetACrrsZUM7z/milRdNxKgy
 dyY1Hmxu/pGxlIyyYfpVTv4E/4/sGtDOhzFNgO2xEeghMEOydLFtmckRcucUlZ/6vzvkJor
 MbZj0CNdXqDHh7azwhqJQ==
X-UI-Out-Filterresults: notjunk:1;V01:K0:t0MEvyMX6Tk=:yHpPxGNCnNYjhl+3eQui8G
 teKs39tG7bUUUnOTZP8PVTe4bmNTVI0cMTQWmdWeW1+jLit2756a6OuNVmNk4RQuJNrt9/l++
 TgANgazkfBtHa/TEqXTe1fc+sVcJosf1OioZcQroWkGMqiC6jOzNGPfXo2MaEdXdKqKYfMKv0
 dQXFX/gsUqJvufH7gvV1UMDAw8xJT9lMQ5ayGszWPTu/ycYO7zkoY95axJV0jBYN6O9rQ1UlU
 NPyG6rItFPxTvnSauKgT9gXSQ0Tk86Wyj64Uk98PQ7kn5Z0Rr0dkumZ7EaLYkzmhKGjIgfLsF
 OIcewC/LDFL9IY01tT97RBk8EHCGdifjynni9QPILKMhhqhOztik1ZH+XKoH1SxWJd9cBybNR
 2eMl5CiorH9SjUNguspP0jgfDn36sqQnmEGq/J20bgF+L2apJFZJcOGIpK6S4IfwfIEb2nJ9L
 i0+/4PcJH0DY5Pe1VequU3F05BGaPsvyf4Ma2339DBw0VHNkA1GGMtTo0TfQiqLWCujGld+oa
 uWXCZ7SOXOmQXZ0tsmEPUg6Du+7lkf/sLGZ4kGBnE1p3G3/tGw1y8DnDX/01U+Z2upbXw0fl4
 l3GOeYT3sIdRfhH5Nk/x2H2RZ9PtDmVThXhgr1vVHseABRuJ2NqTYdvdrpfD0tlCI4gqbEQVF
 BQr1/qx8xlYRGQytrP+Cocj6tY7rr3H/PzB6JPzI7cDbbQ4/UZSNLnOwxtTrcLRJqnlc=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

In 32a4883..93ae9f4 master -> master I checked in a fix for X and NS
although I wasn't able to reproduce the crash on the latter (probably
due to the fact that on NS like with the native Gtk tooltips one can't
override the colors anyway).

 >> One last question: In struct image_cache we specify refcount as
 >> ptrdiff_t while w32fns.c defines image_cache_refcount as int.  Both
 >> xfns.c and nsfns.m define image_cache_refcount as ptrdiff_t.  Shouldn't
 >> we uniquify this?
 >
 > Yes, please.  The fewer differences between the various *fns.c and
 > *term.c functions with similar, let alone identical names, the better.

I made it a ptrdiff_t on Windows.

Thanks for the basic work, martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 16 Jun 2015 07:21:19 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Jun 16 03:21:18 2015
Received: from localhost ([127.0.0.1]:55186 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4lBM-0007fj-Mk
	for submit <at> debbugs.gnu.org; Tue, 16 Jun 2015 03:21:18 -0400
Received: from mout.gmx.net ([212.227.17.20]:49512)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z4lBI-0007fU-Nm
 for 20802 <at> debbugs.gnu.org; Tue, 16 Jun 2015 03:21:14 -0400
Received: from glenalbyn.linguistics.ruhr-uni-bochum.de ([134.147.14.84]) by
 mail.gmx.com (mrgmx103) with ESMTPSA (Nemesis) id 0Lp3Qu-1ZYKm52mWa-00er5M;
 Tue, 16 Jun 2015 09:21:05 +0200
Message-ID: <1434439264.2078.6.camel@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: Eli Zaretskii <eliz@HIDDEN>, 20802 <at> debbugs.gnu.org
Date: Tue, 16 Jun 2015 09:21:04 +0200
In-Reply-To: <83381wq76d.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:gkJKtsh/321X+sXrKUJUXrRrcQtxnpxFlPR/njz3nXyEdg10eGj
 AYb9YqQUGJCl/DtcHvxUp8JZ1AAUoN9To036y8aykFscSsorAmo+JVVOmAxo3Q5HtVcOTzF
 PCy11LU5uLrMorevkGz7oE5E0D2CfwjjfGBNmw41Z74HVsoidVDvPQbWi3Ew4/ZoHbJKdLU
 JJQB0lwn17j5ZTsDzzbag==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

On Sa, 2015-06-13 at 12:38 +0300, Eli Zaretskii wrote:
> > From: Tobias Getzner <tobias.getzner@HIDDEN>
> > Date: Sat, 13 Jun 2015 11:18:38 +0200
> >=20
> > When x-gtk-use-system-tooltips is set to nil, and the tooltip face=20
> > is
> > customized using an invalid color string such as #zz, Emacs will
> > segfault when a tooltip is being drawn.
>=20
> I cannot reproduce this on my system, so please show a backtrace from
> running Emacs inside GDB.  Also, please tell how you customized the
> face color, exactly -- it could be that only some specific ways of
> customizing it cause the problem.

Thanks to Martin for reproducing. From what little I can infer, you
seem to have made sense of this already, but just for the sake of
completeness, below is my backtrace. The line numbers seem a bit
different, but I guess it=E2=80=99s otherwise identical to Martin=E2=80=99s=
?

This was after setting x-gtk-use-system-tooltip to nil and customizing
the tooltip face to #qqq.

Best, and thanks,
TG


Program received signal SIGSEGV, Segmentation fault.
cache_image (f=3D0x1170a68, img=3D<optimized out>) at image.c:1782
1782	  for (i =3D 0; i < c->used; ++i)
(gdb) bt
#0  cache_image (f=3D0x1170a68, img=3D<optimized out>) at image.c:1782
#1  lookup_image (f=3D0x1170a68, spec=3Dspec@entry=3D19521878) at
image.c:1693
#2  0x00000000004393ff in handle_single_display_spec (it=3Dit@entry=3D0x7ff
fffff7da0,=20
    spec=3D<optimized out>, object=3Dobject@entry=3D31549445,=20
overlay=3Doverlay@entry=3D12308786,=20
    position=3Dposition@entry=3D0x7fffffff7ed8, bufpos=3Dbufpos@entry=3D255=
,
display_replaced_p=3D0,=20
    frame_window_p=3D1) at xdisp.c:5310
#3  0x0000000000439fd8 in handle_display_spec (it=3Dit@entry=3D0x7fffffff7d
a0, spec=3D<optimized out>,=20
    object=3Dobject@entry=3D31549445, overlay=3D12308786,=20
position=3Dposition@entry=3D0x7fffffff7ed8,=20
    bufpos=3Dbufpos@entry=3D255, frame_window_p=3D1) at xdisp.c:4836
#4  0x000000000043a299 in handle_display_prop (it=3D0x7fffffff7da0) at
xdisp.c:4759
#5  0x000000000043d002 in handle_stop (it=3Dit@entry=3D0x7fffffff7da0) at
xdisp.c:3492
#6  0x00000000004463a2 in next_element_from_buffer (it=3D0x7fffffff7da0)
at xdisp.c:8290
#7  0x0000000000441275 in get_next_display_element (it=3Dit@entry=3D0x7ffff
fff7da0) at xdisp.c:6944
#8  0x0000000000447188 in display_line (it=3Dit@entry=3D0x7fffffff7da0) at
xdisp.c:20241
#9  0x000000000044b6ea in try_window (window=3Dwindow@entry=3D18291325,
pos=3D..., flags=3Dflags@entry=3D1)
    at xdisp.c:17007
#10 0x000000000046170e in redisplay_window (window=3D18291325,=20
    just_this_one_p=3Djust_this_one_p@entry=3Dfalse) at xdisp.c:16486
#11 0x0000000000463aa3 in redisplay_window_0 (window=3Dwindow@entry=3D18291
325) at xdisp.c:14373
#12 0x000000000055b53b in internal_condition_case_1 (
    bfun=3Dbfun@entry=3D0x463a70 <redisplay_window_0>, arg=3D18291325,
handlers=3D<optimized out>,=20
    hfun=3Dhfun@entry=3D0x42be50 <redisplay_window_error>) at eval.c:1372
#13 0x0000000000430caf in redisplay_windows (window=3D18291325) at
xdisp.c:14353
#14 0x0000000000450331 in redisplay_internal () at xdisp.c:13949
#15 0x0000000000452530 in redisplay_preserve_echo_area (
from_where=3Dfrom_where@entry=3D2)
    at xdisp.c:14206
#16 0x000000000041b065 in Fredisplay (force=3D12308786) at dispnew.c:5896
#17 0x000000000055d1a7 in Ffuncall (nargs=3D<optimized out>,=20
args=3Dargs@entry=3D0x7fffffffc1f0)
    at eval.c:2811
#18 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D8822021,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D1,=20
    args=3D<optimized out>, args@entry=3D0x869ce1 <pure+123745>) at
bytecode.c:916
#19 0x000000000055ccb7 in funcall_lambda (fun=3D140737488339872,=20
nargs=3Dnargs@entry=3D1,=20
    arg_vector=3D0x869ce1 <pure+123745>, arg_vector@entry=3D0x7fffffffc340)
at eval.c:2978
#20 0x000000000055cfbb in Ffuncall (nargs=3D2, args=3Dargs@entry=3D0x7fffff=
ff
c338) at eval.c:2872
#21 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10488933,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,
nargs=3D<optimized out>,=20
    args=3D<optimized out>) at bytecode.c:916
#22 0x000000000055c4e3 in eval_sub (form=3D<optimized out>) at
eval.c:2187
#23 0x000000000055fbc3 in Fprogn (body=3D10488838) at eval.c:462
#24 internal_lisp_condition_case (var=3D<optimized out>,
bodyform=3D10488550,=20
    handlers=3D<optimized out>) at eval.c:1306
#25 0x0000000000593bcf in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10488493,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:1162
#26 0x000000000055cc1f in funcall_lambda (fun=3D10488365,=20
nargs=3Dnargs@entry=3D2,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffc720) at eval.c:3044
#27 0x000000000055cfbb in Ffuncall (nargs=3D3, args=3Dargs@entry=3D0x7fffff=
ff
c718) at eval.c:2872
#28 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10490901,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:916
#29 0x000000000055cc1f in funcall_lambda (fun=3D10490821,=20
nargs=3Dnargs@entry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffc978) at eval.c:3044
#30 0x000000000055cfbb in Ffuncall (nargs=3D2, args=3D0x7fffffffc970) at
eval.c:2872
#31 0x000000000055b89d in run_hook_with_args (nargs=3D2,
args=3D0x7fffffffc970,=20
    funcall=3D0x55cd90 <Ffuncall>) at eval.c:2547
#32 0x000000000055d09a in Ffuncall (nargs=3D<optimized out>,=20
args=3Dargs@entry=3D0x7fffffffc968)
    at eval.c:2792
#33 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10488085,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:916
#34 0x000000000055cc1f in funcall_lambda (fun=3D10488021,=20
nargs=3Dnargs@entry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffcbf8) at eval.c:3044
#35 0x000000000055cfbb in Ffuncall (nargs=3Dnargs@entry=3D2,=20
args=3Dargs@entry=3D0x7fffffffcbf0)
    at eval.c:2872
#36 0x000000000055e6a2 in Fapply (nargs=3D2, args=3D0x7fffffffcbf0) at
eval.c:2297
#37 0x000000000055d09a in Ffuncall (nargs=3D<optimized out>,=20
args=3Dargs@entry=3D0x7fffffffcbe8)
    at eval.c:2792
#38 0x00000000005927c3 in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10054405,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,
nargs=3D<optimized out>,=20
    args=3D<optimized out>) at bytecode.c:916
#39 0x000000000055c4e3 in eval_sub (form=3Dform@entry=3D10054326) at
eval.c:2187
#40 0x000000000055fade in internal_lisp_condition_case (var=3D<optimized
out>, bodyform=3D10054326,=20
    handlers=3D<optimized out>) at eval.c:1317
#41 0x0000000000593bcf in exec_byte_code (bytestr=3D<optimized out>,
vector=3D10054093,=20
    maxdepth=3D<optimized out>, args_template=3D<optimized out>,=20
nargs=3Dnargs@entry=3D0,=20
    args=3D<optimized out>, args@entry=3D0x0) at bytecode.c:1162
#42 0x000000000055cc1f in funcall_lambda (fun=3D10054013,=20
nargs=3Dnargs@entry=3D1,=20
    arg_vector=3Darg_vector@entry=3D0x7fffffffcfe8) at eval.c:3044
#43 0x000000000055cfbb in Ffuncall (nargs=3Dnargs@entry=3D2,=20
args=3Dargs@entry=3D0x7fffffffcfe0)
    at eval.c:2872
#44 0x000000000055d2da in call1 (fn=3D<optimized out>, arg1=3Darg1@entry=3D=
18
809933) at eval.c:2610
#45 0x00000000004ef218 in timer_check_2 (idle_timers=3D<optimized out>,
timers=3D<optimized out>)
    at keyboard.c:4515
#46 timer_check () at keyboard.c:4582
#47 0x00000000004ef5d1 in readable_events (flags=3D1) at keyboard.c:3448
#48 0x00000000004f0c78 in get_input_pending (flags=3Dflags@entry=3D1) at
keyboard.c:6766
#49 0x00000000004f3ea8 in detect_input_pending_run_timers (
do_display=3Ddo_display@entry=3Dtrue)
    at keyboard.c:9895
#50 0x000000000059cd8c in wait_reading_process_output (
time_limit=3Dtime_limit@entry=3D30,=20
    nsecs=3Dnsecs@entry=3D0, read_kbd=3Dread_kbd@entry=3D-1,=20
do_display=3Ddo_display@entry=3Dtrue,=20
    wait_for_cell=3D12308786, wait_proc=3Dwait_proc@entry=3D0x0,
just_wait_proc=3D0) at process.c:4702
#51 0x00000000004221f3 in sit_for (timeout=3D<optimized out>,=20
reading=3Dreading@entry=3Dtrue,=20
    display_option=3Ddisplay_option@entry=3D1) at dispnew.c:5867
#52 0x00000000004f4df4 in read_char (commandflag=3D1, map=3Dmap@entry=3D353=
25
094, prev_event=3D12308786,=20
    used_mouse_menu=3Dused_mouse_menu@entry=3D0x7fffffffd7bb,=20
end_time=3Dend_time@entry=3D0x0)
    at keyboard.c:2810
#53 0x00000000004f5fcd in read_key_sequence (keybuf=3Dkeybuf@entry=3D0x7fff
ffffd890, prompt=3D12308786,=20
    dont_downcase_last=3Ddont_downcase_last@entry=3Dfalse,=20
    can_return_switch_frame=3Dcan_return_switch_frame@entry=3Dtrue,=20
    fix_current_buffer=3Dfix_current_buffer@entry=3Dtrue,=20
    prevent_redisplay=3Dprevent_redisplay@entry=3Dfalse, bufsize=3D30) at
keyboard.c:9089
#54 0x00000000004f7d30 in command_loop_1 () at keyboard.c:1453
#55 0x000000000055b417 in internal_condition_case (bfun=3Dbfun@entry=3D0x4f
7b30 <command_loop_1>,=20
    handlers=3D<optimized out>, hfun=3Dhfun@entry=3D0x4ee880 <cmd_error>) a=
t
eval.c:1348
#56 0x00000000004e9d6e in command_loop_2 (ignore=3Dignore@entry=3D12308786)
at keyboard.c:1178
#57 0x000000000055b2fb in internal_catch (tag=3D12356258,=20
    func=3Dfunc@entry=3D0x4e9d50 <command_loop_2>, arg=3D12308786) at
eval.c:1112
#58 0x00000000004ee467 in command_loop () at keyboard.c:1157
#59 recursive_edit_1 () at keyboard.c:778
#60 0x00000000004ee7a8 in Frecursive_edit () at keyboard.c:849
#61 0x00000000004181a9 in main (argc=3D<optimized out>,
argv=3D0x7fffffffdbf8) at emacs.c:1642




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 15 Jun 2015 17:29:57 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Jun 15 13:29:57 2015
Received: from localhost ([127.0.0.1]:54926 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4YCq-00025i-WE
	for submit <at> debbugs.gnu.org; Mon, 15 Jun 2015 13:29:57 -0400
Received: from mtaout20.012.net.il ([80.179.55.166]:40120)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4YCo-00025T-Ej
 for 20802 <at> debbugs.gnu.org; Mon, 15 Jun 2015 13:29:55 -0400
Received: from conversion-daemon.a-mtaout20.012.net.il by
 a-mtaout20.012.net.il (HyperSendmail v2007.08) id
 <0NPZ00E00XQ0TD00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Mon, 15 Jun 2015 20:29:47 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPZ00ELSXXNKMB0@HIDDEN>;
 Mon, 15 Jun 2015 20:29:47 +0300 (IDT)
Date: Mon, 15 Jun 2015 20:29:33 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557EF6B7.3000701@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83fv5sop6q.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
 <83zj41nhg9.fsf@HIDDEN> <557EF6B7.3000701@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Mon, 15 Jun 2015 18:00:55 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> One last question: In struct image_cache we specify refcount as
> ptrdiff_t while w32fns.c defines image_cache_refcount as int.  Both
> xfns.c and nsfns.m define image_cache_refcount as ptrdiff_t.  Shouldn't
> we uniquify this?

Yes, please.  The fewer differences between the various *fns.c and
*term.c functions with similar, let alone identical names, the better.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 15 Jun 2015 16:01:11 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Jun 15 12:01:11 2015
Received: from localhost ([127.0.0.1]:54876 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4Wow-0008Vu-HV
	for submit <at> debbugs.gnu.org; Mon, 15 Jun 2015 12:01:10 -0400
Received: from mout.gmx.net ([212.227.17.20]:56460)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4Wot-0008VV-Ka
 for 20802 <at> debbugs.gnu.org; Mon, 15 Jun 2015 12:01:08 -0400
Received: from [178.190.21.103] ([178.190.21.103]) by mail.gmx.com (mrgmx103)
 with ESMTPSA (Nemesis) id 0M6SE3-1ZF2Jd1yax-00ySQN;
 Mon, 15 Jun 2015 18:00:58 +0200
Message-ID: <557EF6B7.3000701@HIDDEN>
Date: Mon, 15 Jun 2015 18:00:55 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
 <83zj41nhg9.fsf@HIDDEN>
In-Reply-To: <83zj41nhg9.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:3ygWe03tFgyZRa1kcWfw7vYhpkETwD3xm1EQVCZmpuI0jfqerKP
 yRKH25OnIVl2lcHqGUNejXuAmuoVlMTIxKAQA++dhcltLBCjkTkNqFAJsV4it8e8ypCW+o2
 Nlkw8IocQGaDedMxlpdUPw+W+Wp8KWobrb3FkGQzM4XujRGv60OQJWOZauXvfUpPPuzJB40
 Xa/fOITnflrA3EwEN7kUQ==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 >> How are these supposed to
 >> work when GLYPH_DEBUG is not defined?
 >
 > It cannot, obviously.  Bug#17524 was reported in the GLYPH_DEBUG code:
 > the assertion there segfaulted when it tried to access the image
 > cache.  So the code was fixed only for that situation.

Hmmm ...  you should have told Michael back then.  You clairvoyantly
identified the problem then as ...

   But the real problem is that call to
   x_free_frame_resources, which eventually calls free_frame_faces, which
   decrements the image-cache refcount and frees the image cache, because
   the refcount goes to zero.

... but the recipe ...

   So I think the X version needs the same change I made in w32fns.c in
   revision 117131, modulo the changes to the assertions.

... was misleading because the bug was triggerd without violating an
assertion.  I doubt that Michael then build with glyph debugging enabled
because otherwise his fix should have helped indeed.

 > IOW, that bug was mentioned as a source of ideas, not as something to
 > copy verbatim to xfns.c.  Sorry if I was unclear about that.

OK.  One last question: In struct image_cache we specify refcount as
ptrdiff_t while w32fns.c defines image_cache_refcount as int.  Both
xfns.c and nsfns.m define image_cache_refcount as ptrdiff_t.  Shouldn't
we uniquify this?

martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 15 Jun 2015 15:02:25 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Jun 15 11:02:25 2015
Received: from localhost ([127.0.0.1]:54839 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4Vu4-0006xD-PQ
	for submit <at> debbugs.gnu.org; Mon, 15 Jun 2015 11:02:25 -0400
Received: from mtaout20.012.net.il ([80.179.55.166]:46428)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z4Vu1-0006wo-N9
 for 20802 <at> debbugs.gnu.org; Mon, 15 Jun 2015 11:02:22 -0400
Received: from conversion-daemon.a-mtaout20.012.net.il by
 a-mtaout20.012.net.il (HyperSendmail v2007.08) id
 <0NPZ00D00QV2WC00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Mon, 15 Jun 2015 18:02:13 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPZ00D0FR3OX200@HIDDEN>;
 Mon, 15 Jun 2015 18:02:13 +0300 (IDT)
Date: Mon, 15 Jun 2015 18:01:58 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557E8B50.80905@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83zj41nhg9.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN> <557E8B50.80905@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Mon, 15 Jun 2015 10:22:40 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
>  > Thanks.  Now I know why this cannot be reproduced on Windows: this is
>  > bug#17524 coming back to haunt us.  That bug was reported on Windows,
>  > I fixed it on Windows, then suggested a similar fix for X, but was
>  > told it didn't help there.
>  >
>  > So now please try making a fix on X similar to commit ebdc80316, and
>  > if that indeed doesn't help with this crash, perhaps some simple
>  > variation of that will.
> 
> Sorry.  I must be missing something very elementary here.  Your "shadow"
> refcounts
> 
> #ifdef GLYPH_DEBUG
> static int image_cache_refcount, dpyinfo_refcount;
> #endif
> 
> are defined iff you have GLYPH_DEBUG defined.  How are these supposed to
> work when GLYPH_DEBUG is not defined?

It cannot, obviously.  Bug#17524 was reported in the GLYPH_DEBUG code:
the assertion there segfaulted when it tried to access the image
cache.  So the code was fixed only for that situation.

Doing that for a non-GLYPH_DEBUG code will require the shadow variable
to come out of that condition as well.  Or use some other flag
variable to indicate that x_free_frame_resources is about to be called
when the refcount was not yet incremented.

IOW, that bug was mentioned as a source of ideas, not as something to
copy verbatim to xfns.c.  Sorry if I was unclear about that.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 15 Jun 2015 08:22:56 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Jun 15 04:22:56 2015
Received: from localhost ([127.0.0.1]:54339 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z4PfT-0004bq-Nt
	for submit <at> debbugs.gnu.org; Mon, 15 Jun 2015 04:22:55 -0400
Received: from mout.gmx.net ([212.227.15.18]:50347)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z4PfR-0004bc-0g
 for 20802 <at> debbugs.gnu.org; Mon, 15 Jun 2015 04:22:53 -0400
Received: from [178.190.162.212] ([178.190.162.212]) by mail.gmx.com
 (mrgmx003) with ESMTPSA (Nemesis) id 0Lmqxo-1ZVmrV2QU0-00h6VF; Mon, 15 Jun
 2015 10:22:41 +0200
Message-ID: <557E8B50.80905@HIDDEN>
Date: Mon, 15 Jun 2015 10:22:40 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN> <83h9qapee0.fsf@HIDDEN>
In-Reply-To: <83h9qapee0.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:bAtKJN8z8eibgl/L3Uu7q5T58uMPVys744pptBRu9KEkKJNXUsK
 zxDP8X22NncIc7YfxUIDw50zAVjNgw8+Oz+cVImB5f/M3iI8rsxUiCI04EKA+y3DUDdo2WB
 7MCF5a2Pgyi/MhuaTsT8UZE+ZpWsTioVVzQGmIbrzfghl+Ms7hKSx+DQ3PseQv42cPuhJaU
 JP349/HLT7K3YRMmXumqQ==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Thanks.  Now I know why this cannot be reproduced on Windows: this is
 > bug#17524 coming back to haunt us.  That bug was reported on Windows,
 > I fixed it on Windows, then suggested a similar fix for X, but was
 > told it didn't help there.
 >
 > So now please try making a fix on X similar to commit ebdc80316, and
 > if that indeed doesn't help with this crash, perhaps some simple
 > variation of that will.

Sorry.  I must be missing something very elementary here.  Your "shadow"
refcounts

#ifdef GLYPH_DEBUG
static int image_cache_refcount, dpyinfo_refcount;
#endif

are defined iff you have GLYPH_DEBUG defined.  How are these supposed to
work when GLYPH_DEBUG is not defined?

martin




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 14 Jun 2015 14:13:14 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Jun 14 10:13:13 2015
Received: from localhost ([127.0.0.1]:53972 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z48ev-0004qO-Da
	for submit <at> debbugs.gnu.org; Sun, 14 Jun 2015 10:13:13 -0400
Received: from mtaout26.012.net.il ([80.179.55.182]:33223)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z48es-0004q9-Su
 for 20802 <at> debbugs.gnu.org; Sun, 14 Jun 2015 10:13:11 -0400
Received: from conversion-daemon.mtaout26.012.net.il by mtaout26.012.net.il
 (HyperSendmail v2007.08) id <0NPX00J00U7QBA00@HIDDEN> for
 20802 <at> debbugs.gnu.org; Sun, 14 Jun 2015 17:15:23 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout26.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPX00C5MU9NR580@HIDDEN>; Sun, 14 Jun 2015 17:15:23 +0300 (IDT)
Date: Sun, 14 Jun 2015 17:12:55 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557D5EE9.7070902@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83h9qapee0.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
 <557D5EE9.7070902@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Sun, 14 Jun 2015 13:00:57 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> What happens is given in the backtraces below.  The first breakpoint is
> hit when Emacs creates the image cache for the original frame
> (f=0x13a7e00).  The second breakpoint is hit when freeing the image
> cache for the tooltip frame (f=0xe0c7a0).  This removes the image_cache
> created in make_image_cache at 0x1676f90.  The third breakpoint is the
> same as in my earlier posts.
> 
> The reason seems obvious: When the color is not defined for the tooltip
> frame we do _not_ increment the refcount of the image cache.  But we
> subsequently free the image cache in unwind_create_frame.  Bad luck.

Thanks.  Now I know why this cannot be reproduced on Windows: this is
bug#17524 coming back to haunt us.  That bug was reported on Windows,
I fixed it on Windows, then suggested a similar fix for X, but was
told it didn't help there.

So now please try making a fix on X similar to commit ebdc80316, and
if that indeed doesn't help with this crash, perhaps some simple
variation of that will.

TIA




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 14 Jun 2015 11:01:22 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sun Jun 14 07:01:22 2015
Received: from localhost ([127.0.0.1]:53256 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z45fE-0005r3-Rg
	for submit <at> debbugs.gnu.org; Sun, 14 Jun 2015 07:01:22 -0400
Received: from mout.gmx.net ([212.227.17.22]:57935)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z45fA-0005qo-RC
 for 20802 <at> debbugs.gnu.org; Sun, 14 Jun 2015 07:01:18 -0400
Received: from [178.190.22.22] ([178.190.22.22]) by mail.gmx.com (mrgmx102)
 with ESMTPSA (Nemesis) id 0Lz0aC-1Z8Zi03An2-014FK3; Sun, 14 Jun 2015 13:01:09
 +0200
Message-ID: <557D5EE9.7070902@HIDDEN>
Date: Sun, 14 Jun 2015 13:00:57 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN> <83twubpt43.fsf@HIDDEN>
In-Reply-To: <83twubpt43.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:Jh4yIjVJ7+nyhHrJm5KlSt1MCIMwtcMW1psXWMaPE2sXLM7m32w
 sJi1PkPCXKxRVw0HkHv5ORUPJ3uOfU+FQD34xa7+bep0WyFeLRTkbDV/OhmylNS5D/h3cbt
 XxY0thbiBuXbV7dbpcmdCnExC9yir932s9WZ/BgZMuibYEbvCKzL9U+cZUx7+oxMfzjviAm
 I5asxtsolYOeXZEQ07hpw==
X-UI-Out-Filterresults: notjunk:1;V01:K0:XLzyHO68enQ=:taG/cL8GJ7s+ktDadTfTy6
 BhBAOzjPjEEB3jgo7FsJ0wnKpQjeRde7HK1knB6dTZUOg0iAufhVCIuHFxWhKa4uJ+oTb6Ytd
 RlvPayGHPVYzDAyIr6fnE19zmV2VTLN7+Mt6AISJyYNd01L6IBrLJz+SZSnvdo+jai1yv4+GZ
 3nkor/rGIYs6N7jujtuEEPz6WGBfRVpwq2nu+kmsSWCFAMbZnHIoOOxl/y93qf6tnDhpr+MM1
 bK2QVqUXZH7LWZYWblCAfX96F1VSCJ1KsZqQRh++veEAx5WJtZ8uq9Fon3++YUyn1mDv6pWyG
 dzU37UX9FVyG0FczUxSTQOrCa3Akr4xjiYrV4GY+fWfpkYXQskbQWpyzNHGtaDhMbaJrViWXI
 zBuQQk7LdfX28sBsG6jBfgaSSa7FLfc4UIp3V9t6hpP4vLyzX9GuON+28OiDhqlhB+tlqc860
 TXcjMZMIle9b7P4fSYD8VpE/Ko03a5X4M7fFPFlhFADLg8KVOP4J8M9e7LFPKx/yAI40JtyMR
 uRoe+RyLsWfZ2MuENL02oxhOokswJBKutpkkdSk4XeKt/Uh21Cxis/tEqVhrPBHzwQG/D+Pay
 LQ4krLjMArwxvYlJnlZXFRxwuB2fSWqcAXbw5GSGwOyHo9oWRPyiYgRkuRjzHMsKHzJmEH/UB
 JfxR/Ua5/ZteBq/Lgrz/Wn8TMEqE7gGaPsE0wCvkubb9HArFY3PR7pV6pBQAvJs43p5Q=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

What happens is given in the backtraces below.  The first breakpoint is
hit when Emacs creates the image cache for the original frame
(f=0x13a7e00).  The second breakpoint is hit when freeing the image
cache for the tooltip frame (f=0xe0c7a0).  This removes the image_cache
created in make_image_cache at 0x1676f90.  The third breakpoint is the
same as in my earlier posts.

The reason seems obvious: When the color is not defined for the tooltip
frame we do _not_ increment the refcount of the image cache.  But we
subsequently free the image cache in unwind_create_frame.  Bad luck.

martin


(gdb) run
Starting program: /home/martin/emacs-git/trunk/obj-gtk/src/emacs
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffef48c700 (LWP 4514)]
[New Thread 0x7fffedadf700 (LWP 4515)]
[New Thread 0x7fffed28e700 (LWP 4516)]
(gdb) bt
#0  make_image_cache () at ../../src/image.c:1356
#1  0x0000000000524b87 in init_frame_faces (f=0x13a7e00) at ../../src/xfaces.c:591
#2  0x0000000000551afb in Fx_create_frame (parms=...) at ../../src/xfns.c:3215
#3  0x00000000006297ae in Ffuncall (nargs=2, args=0x7fffffffb848) at ../../src/eval.c:2718
#4  0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#5  0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, arg_vector=0xa0be8d) at ../../src/eval.c:2951
#6  0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffc0d8) at ../../src/eval.c:2767
#7  0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x7fffffffc978) at ../../src/bytecode.c:919
#8  0x000000000062a11f in funcall_lambda (fun=..., nargs=1, arg_vector=0x7fffffffc970) at ../../src/eval.c:2885
#9  0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffc968) at ../../src/eval.c:2767
#10 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x7fffffffd1e0) at ../../src/bytecode.c:919
#11 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, arg_vector=0x7fffffffd1e0) at ../../src/eval.c:2885
#12 0x0000000000629a1a in Ffuncall (nargs=1, args=0x7fffffffd1d8) at ../../src/eval.c:2767
#13 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x7fffffffdab8) at ../../src/bytecode.c:919
#14 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, arg_vector=0x7fffffffdab8) at ../../src/eval.c:2885
#15 0x0000000000629a1a in Ffuncall (nargs=1, args=0x7fffffffdab0) at ../../src/eval.c:2767
#16 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x7fffffffe260) at ../../src/bytecode.c:919
#17 0x000000000062a11f in funcall_lambda (fun=..., nargs=0, arg_vector=0x7fffffffe260) at ../../src/eval.c:2885
#18 0x0000000000629db3 in apply_lambda (fun=..., args=..., count=3) at ../../src/eval.c:2826
#19 0x0000000000628201 in eval_sub (form=...) at ../../src/eval.c:2226
#20 0x00000000006276a7 in Feval (form=..., lexical=...) at ../../src/eval.c:1996
#21 0x00000000005798fe in top_level_2 () at ../../src/keyboard.c:1148
#22 0x0000000000625ac9 in internal_condition_case (bfun=0x5798e1 <top_level_2>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#23 0x000000000057993f in top_level_1 (ignore=...) at ../../src/keyboard.c:1156
#24 0x0000000000624ec4 in internal_catch (tag=..., func=0x579900 <top_level_1>, arg=...) at ../../src/eval.c:1108
#25 0x0000000000579839 in command_loop () at ../../src/keyboard.c:1117
#26 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#27 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#28 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at ../../src/emacs.c:1626

Lisp Backtrace:
"x-create-frame" (0xffffb850)
"x-create-frame-with-faces" (0xffffc0e0)
"make-frame" (0xffffc970)
"frame-initialize" (0xffffd1e0)
"command-line" (0xffffdab8)
"normal-top-level" (0xffffe260)
(gdb) p c
$38 = (struct image_cache *) 0x1676f90
(gdb) c
Continuing.
(gdb) bt
#0  free_image_cache (f=0xe0c7a0) at ../../src/image.c:1432
#1  0x0000000000524c5e in free_frame_faces (f=0xe0c7a0) at ../../src/xfaces.c:624
#2  0x0000000000548bb0 in x_free_frame_resources (f=0xe0c7a0) at ../../src/xterm.c:10228
#3  0x0000000000550621 in unwind_create_frame (frame=...) at ../../src/xfns.c:2833
#4  0x00000000005549b3 in unwind_create_tip_frame (frame=...) at ../../src/xfns.c:4991
#5  0x000000000062ae77 in unbind_to (count=9, value=...) at ../../src/eval.c:3208
#6  0x0000000000624fa6 in unwind_to_catch (catch=0x15696d0, value=...) at ../../src/eval.c:1157
#7  0x00000000006250b4 in Fthrow (tag=..., value=...) at ../../src/eval.c:1188
#8  0x00000000005799be in Ftop_level () at ../../src/keyboard.c:1179
#9  0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffff9168) at ../../src/eval.c:2715
#10 0x000000000061f642 in Ffuncall_interactively (nargs=1, args=0x7fffffff9168) at ../../src/callint.c:252
#11 0x0000000000629676 in Ffuncall (nargs=2, args=0x7fffffff9160) at ../../src/eval.c:2698
#12 0x0000000000621bf9 in Fcall_interactively (function=..., record_flag=..., keys=...) at ../../src/callint.c:849
#13 0x0000000000629813 in Ffuncall (nargs=4, args=0x7fffffff9688) at ../../src/eval.c:2725
#14 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=1, args=0x7fffffff9f20) at ../../src/bytecode.c:919
#15 0x000000000062a11f in funcall_lambda (fun=..., nargs=1, arg_vector=0x7fffffff9f18) at ../../src/eval.c:2885
#16 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffff9f10) at ../../src/eval.c:2767
#17 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#18 0x000000000057a4f6 in command_loop_1 () at ../../src/keyboard.c:1521
#19 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#20 0x00000000005798be in command_loop_2 (ignore=...) at ../../src/keyboard.c:1139
#21 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 <command_loop_2>, arg=...) at ../../src/eval.c:1108
#22 0x00000000005797f6 in command_loop () at ../../src/keyboard.c:1110
#23 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#24 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#25 0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffffa408) at ../../src/eval.c:2715
#26 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=2, args=0x7fffffffac98) at ../../src/bytecode.c:919
#27 0x000000000062a11f in funcall_lambda (fun=..., nargs=2, arg_vector=0x7fffffffac98) at ../../src/eval.c:2885
#28 0x0000000000629a1a in Ffuncall (nargs=3, args=0x7fffffffac90) at ../../src/eval.c:2767
#29 0x0000000000628a06 in Fapply (nargs=2, args=0x7fffffffada0) at ../../src/eval.c:2337
#30 0x00000000006290fc in apply1 (fn=..., arg=...) at ../../src/eval.c:2558
#31 0x0000000000622711 in call_debugger (arg=...) at ../../src/eval.c:309
#32 0x0000000000626ab3 in maybe_call_debugger (conditions=..., sig=..., data=...) at ../../src/eval.c:1726
#33 0x00000000006262c8 in Fsignal (error_symbol=..., data=...) at ../../src/eval.c:1544
#34 0x00000000006263fe in xsignal (error_symbol=..., data=...) at ../../src/eval.c:1581
#35 0x000000000062663c in signal_error (s=0x6fd2de "Undefined color", arg=...) at ../../src/eval.c:1636
#36 0x000000000054c091 in x_decode_color (f=0xe0c7a0, color_name=..., mono_color=16777215) at ../../src/xfns.c:495
#37 0x000000000054c566 in x_set_background_color (f=0xe0c7a0, arg=..., oldval=...) at ../../src/xfns.c:638
#38 0x000000000042d45d in x_set_frame_parameters (f=0xe0c7a0, alist=...) at ../../src/frame.c:3152
#39 0x0000000000431ce6 in x_default_parameter (f=0xe0c7a0, alist=..., prop=..., deflt=..., xprop=0x6fd49d "background", xclass=0x6fd908 "Background", type=RES_TYPE_STRING) at ../../src/frame.c:4374
#40 0x000000000055549d in x_create_tip_frame (dpyinfo=0x1622000, parms=..., text=...) at ../../src/xfns.c:5173
#41 0x0000000000556884 in Fx_show_tip (string=..., frame=..., parms=..., timeout=..., dx=..., dy=...) at ../../src/xfns.c:5543
#42 0x0000000000628116 in eval_sub (form=...) at ../../src/eval.c:2200
#43 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#44 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#45 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#46 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#47 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#48 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#49 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#50 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#51 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#52 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#53 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#54 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#55 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#56 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#57 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#58 0x000000000062a511 in funcall_lambda (fun=..., nargs=0, arg_vector=0x0) at ../../src/eval.c:2944
#59 0x0000000000629b19 in Ffuncall (nargs=1, args=0x7fffffffcbb0) at ../../src/eval.c:2779
#60 0x000000000062853a in Fapply (nargs=2, args=0x7fffffffcbb0) at ../../src/eval.c:2289
#61 0x0000000000629676 in Ffuncall (nargs=3, args=0x7fffffffcba8) at ../../src/eval.c:2698
#62 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#63 0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, arg_vector=0xadb72d) at ../../src/eval.c:2951
#64 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffd430) at ../../src/eval.c:2767
#65 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#66 0x0000000000582a83 in timer_check_2 (timers=..., idle_timers=...) at ../../src/keyboard.c:4533
#67 0x0000000000582bf2 in timer_check () at ../../src/keyboard.c:4600
#68 0x000000000058008d in readable_events (flags=1) at ../../src/keyboard.c:3434
#69 0x000000000058841c in get_input_pending (flags=1) at ../../src/keyboard.c:6818
#70 0x000000000058ff13 in detect_input_pending_run_timers (do_display=true) at ../../src/keyboard.c:9973
#71 0x0000000000684c13 in wait_reading_process_output (time_limit=2025, nsecs=0, read_kbd=-1, do_display=true, wait_for_cell=..., wait_proc=0x0, just_wait_proc=0) at ../../src/process.c:5014
#72 0x0000000000422610 in sit_for (timeout=..., reading=true, display_option=1) at ../../src/dispnew.c:5748
#73 0x000000000057de53 in read_char (commandflag=1, map=..., prev_event=..., used_mouse_menu=0x7fffffffe23f, end_time=0x0) at ../../src/keyboard.c:2781
#74 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffffe410, bufsize=30, prompt=..., dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#75 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#76 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#77 0x00000000005798be in command_loop_2 (ignore=...) at ../../src/keyboard.c:1139
#78 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 <command_loop_2>, arg=...) at ../../src/eval.c:1108
#79 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#80 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#81 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#82 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at ../../src/emacs.c:1626

Lisp Backtrace:
"x-show-tip" (0xffffb810)
"progn" (0xffffbb20)
"if" (0xffffbd40)
"let*" (0xffffc040)
"progn" (0xffffc250)
"if" (0xffffc470)
"let*" (0xffffc770)
"eldoc-tooltip--make" (0xffffcbb8)
"apply" (0xffffcbb0)
"timer-event-handler" (0xffffd438)
(gdb) p c
$39 = (struct image_cache *) 0x1676f90
(gdb) c
Continuing.
(gdb) bt
#0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x24d7600) at ../../src/image.c:1775
#1  0x00000000006c96e3 in lookup_image (f=0x13a7e00, spec=...) at ../../src/image.c:1686
#2  0x000000000044bebc in handle_single_display_spec (it=0x7fffffff46f0, spec=..., object=..., overlay=..., position=0x7fffffff4828, bufpos=203, display_replaced=0, frame_window_p=true) at ../../src/xdisp.c:5137
#3  0x00000000004498cd in handle_display_spec (it=0x7fffffff46f0, spec=..., object=..., overlay=..., position=0x7fffffff4828, bufpos=203, frame_window_p=true) at ../../src/xdisp.c:4654
#4  0x00000000004492c8 in handle_display_prop (it=0x7fffffff46f0) at ../../src/xdisp.c:4576
#5  0x0000000000445e8d in handle_stop (it=0x7fffffff46f0) at ../../src/xdisp.c:3299
#6  0x0000000000454ee3 in next_element_from_buffer (it=0x7fffffff46f0) at ../../src/xdisp.c:8133
#7  0x00000000004511b5 in get_next_display_element (it=0x7fffffff46f0) at ../../src/xdisp.c:6785
#8  0x000000000047e4ea in display_line (it=0x7fffffff46f0) at ../../src/xdisp.c:20132
#9  0x00000000004719a2 in try_window (window=..., pos=..., flags=1) at ../../src/xdisp.c:16892
#10 0x000000000046df50 in redisplay_window (window=..., just_this_one_p=false) at ../../src/xdisp.c:16365
#11 0x00000000004654d0 in redisplay_window_0 (window=...) at ../../src/xdisp.c:14184
#12 0x0000000000625c43 in internal_condition_case_1 (bfun=0x46548e <redisplay_window_0>, arg=..., handlers=..., hfun=0x465456 <redisplay_window_error>) at ../../src/eval.c:1372
#13 0x000000000046542c in redisplay_windows (window=...) at ../../src/xdisp.c:14164
#14 0x00000000004653e2 in redisplay_windows (window=...) at ../../src/xdisp.c:14158
#15 0x00000000004641e1 in redisplay_internal () at ../../src/xdisp.c:13756
#16 0x0000000000461e04 in redisplay () at ../../src/xdisp.c:13019
#17 0x000000000057d4a3 in read_char (commandflag=1, map=..., prev_event=..., used_mouse_menu=0x7fffffff9d8f, end_time=0x0) at ../../src/keyboard.c:2542
#18 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffff9f60, bufsize=30, prompt=..., dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#19 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#20 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#21 0x00000000005798be in command_loop_2 (ignore=...) at ../../src/keyboard.c:1139
#22 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 <command_loop_2>, arg=...) at ../../src/eval.c:1108
#23 0x00000000005797f6 in command_loop () at ../../src/keyboard.c:1110
#24 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#25 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#26 0x000000000062978c in Ffuncall (nargs=1, args=0x7fffffffa408) at ../../src/eval.c:2715
#27 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=2, args=0x7fffffffac98) at ../../src/bytecode.c:919
#28 0x000000000062a11f in funcall_lambda (fun=..., nargs=2, arg_vector=0x7fffffffac98) at ../../src/eval.c:2885
#29 0x0000000000629a1a in Ffuncall (nargs=3, args=0x7fffffffac90) at ../../src/eval.c:2767
#30 0x0000000000628a06 in Fapply (nargs=2, args=0x7fffffffada0) at ../../src/eval.c:2337
#31 0x00000000006290fc in apply1 (fn=..., arg=...) at ../../src/eval.c:2558
#32 0x0000000000622711 in call_debugger (arg=...) at ../../src/eval.c:309
#33 0x0000000000626ab3 in maybe_call_debugger (conditions=..., sig=..., data=...) at ../../src/eval.c:1726
#34 0x00000000006262c8 in Fsignal (error_symbol=..., data=...) at ../../src/eval.c:1544
#35 0x00000000006263fe in xsignal (error_symbol=..., data=...) at ../../src/eval.c:1581
#36 0x000000000062663c in signal_error (s=0x6fd2de "Undefined color", arg=...) at ../../src/eval.c:1636
#37 0x000000000054c091 in x_decode_color (f=0x26aafb0, color_name=..., mono_color=16777215) at ../../src/xfns.c:495
#38 0x000000000054c566 in x_set_background_color (f=0x26aafb0, arg=..., oldval=...) at ../../src/xfns.c:638
#39 0x000000000042d45d in x_set_frame_parameters (f=0x26aafb0, alist=...) at ../../src/frame.c:3152
#40 0x0000000000431ce6 in x_default_parameter (f=0x26aafb0, alist=..., prop=..., deflt=..., xprop=0x6fd49d "background", xclass=0x6fd908 "Background", type=RES_TYPE_STRING) at ../../src/frame.c:4374
#41 0x000000000055549d in x_create_tip_frame (dpyinfo=0x1622000, parms=..., text=...) at ../../src/xfns.c:5173
#42 0x0000000000556884 in Fx_show_tip (string=..., frame=..., parms=..., timeout=..., dx=..., dy=...) at ../../src/xfns.c:5543
#43 0x0000000000628116 in eval_sub (form=...) at ../../src/eval.c:2200
#44 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#45 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#46 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#47 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#48 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#49 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#50 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#51 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#52 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#53 0x00000000006229d4 in Fif (args=...) at ../../src/eval.c:396
#54 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#55 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#56 0x000000000062437c in FletX (args=...) at ../../src/eval.c:896
#57 0x0000000000627c9a in eval_sub (form=...) at ../../src/eval.c:2131
#58 0x0000000000622c5f in Fprogn (body=...) at ../../src/eval.c:445
#59 0x000000000062a511 in funcall_lambda (fun=..., nargs=0, arg_vector=0x0) at ../../src/eval.c:2944
#60 0x0000000000629b19 in Ffuncall (nargs=1, args=0x7fffffffcbb0) at ../../src/eval.c:2779
#61 0x000000000062853a in Fapply (nargs=2, args=0x7fffffffcbb0) at ../../src/eval.c:2289
#62 0x0000000000629676 in Ffuncall (nargs=3, args=0x7fffffffcba8) at ../../src/eval.c:2698
#63 0x0000000000675d20 in exec_byte_code (bytestr=..., vector=..., maxdepth=..., args_template=..., nargs=0, args=0x0) at ../../src/bytecode.c:919
#64 0x000000000062a5b1 in funcall_lambda (fun=..., nargs=1, arg_vector=0xadb72d) at ../../src/eval.c:2951
#65 0x0000000000629a1a in Ffuncall (nargs=2, args=0x7fffffffd430) at ../../src/eval.c:2767
#66 0x0000000000629153 in call1 (fn=..., arg1=...) at ../../src/eval.c:2573
#67 0x0000000000582a83 in timer_check_2 (timers=..., idle_timers=...) at ../../src/keyboard.c:4533
#68 0x0000000000582bf2 in timer_check () at ../../src/keyboard.c:4600
#69 0x000000000058008d in readable_events (flags=1) at ../../src/keyboard.c:3434
#70 0x000000000058841c in get_input_pending (flags=1) at ../../src/keyboard.c:6818
#71 0x000000000058ff13 in detect_input_pending_run_timers (do_display=true) at ../../src/keyboard.c:9973
#72 0x0000000000684c13 in wait_reading_process_output (time_limit=2025, nsecs=0, read_kbd=-1, do_display=true, wait_for_cell=..., wait_proc=0x0, just_wait_proc=0) at ../../src/process.c:5014
#73 0x0000000000422610 in sit_for (timeout=..., reading=true, display_option=1) at ../../src/dispnew.c:5748
#74 0x000000000057de53 in read_char (commandflag=1, map=..., prev_event=..., used_mouse_menu=0x7fffffffe23f, end_time=0x0) at ../../src/keyboard.c:2781
#75 0x000000000058e17f in read_key_sequence (keybuf=0x7fffffffe410, bufsize=30, prompt=..., dont_downcase_last=false, can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) at ../../src/keyboard.c:9156
#76 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#77 0x0000000000625ac9 in internal_condition_case (bfun=0x579c90 <command_loop_1>, handlers=..., hfun=0x579300 <cmd_error>) at ../../src/eval.c:1348
#78 0x00000000005798be in command_loop_2 (ignore=...) at ../../src/keyboard.c:1139
#79 0x0000000000624ec4 in internal_catch (tag=..., func=0x579895 <command_loop_2>, arg=...) at ../../src/eval.c:1108
#80 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#81 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728
#82 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#83 0x0000000000576cd3 in main (argc=1, argv=0x7fffffffe8e8) at ../../src/emacs.c:1626

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
"recursive-edit" (0xffffa410)
"debug" (0xffffac98)
"x-show-tip" (0xffffb810)
"progn" (0xffffbb20)
"if" (0xffffbd40)
"let*" (0xffffc040)
"progn" (0xffffc250)
"if" (0xffffc470)
"let*" (0xffffc770)
"eldoc-tooltip--make" (0xffffcbb8)
"apply" (0xffffcbb0)
"timer-event-handler" (0xffffd438)
(gdb) p c
$40 = (struct image_cache *) 0x0
(gdb)




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 14:42:48 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 10:42:48 2015
Received: from localhost ([127.0.0.1]:52829 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3me0-0007bc-1j
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:42:48 -0400
Received: from mtaout20.012.net.il ([80.179.55.166]:61929)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z3mdx-0007bM-LM
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:42:46 -0400
Received: from conversion-daemon.a-mtaout20.012.net.il by
 a-mtaout20.012.net.il (HyperSendmail v2007.08) id
 <0NPW00G000G1UW00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Sat, 13 Jun 2015 17:42:39 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout20.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPW00GIO0V2XG00@HIDDEN>;
 Sat, 13 Jun 2015 17:42:39 +0300 (IDT)
Date: Sat, 13 Jun 2015 17:42:36 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557C3E1F.6030305@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83twubpt43.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN> <557C3E1F.6030305@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Sat, 13 Jun 2015 16:28:47 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
> As I mentioned earlier this seems to be due to the fact that the
> debugger intervenes in some recursive fashion.  The crash happens after
> the backtrace window popped up and when I try to ‘switch-to-prev-buffer’
> in the window where the tooltip should have appeared.  Without that I'm
> _not_ able to reproduce the crash.
> 
>  > Can you see what is that frame, and why we didn't call
>  > init_frame_faces for it?
> 
> What makes you think this is not my normal frame in the first place and
> why init_frame_faces was not called for it?  Hmmm, I see, nothing can
> stop make_image_cache apparently.

Exactly.  It is created in init_frame_faces, and never removed as long
as the frame is alive.

> I'll look into this later

Thanks.

>  > Also, which image are we trying to display
>  > here?
> 
> How would I know?

I thought you could look that up in the debugger.  For example, the
value of 'spec' in frame #1 (see below) could tell.

>  > Something on the toolbar, perhaps?  Did you move mouse pointer
>  > over a tool-bar button to trigger a tooltip that failed?
> 
> The toolbar is disabled with my customizations.

Hmm... then what other images do we display?  Note that according to
the backtrace, we've found a 'display' property in  buffer, which
caused the call to lookup_image:

  #0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x198ee20) at ../../src/image.c:1775
  #1  0x00000000006c96e3 in lookup_image (f=0x13a7e00, spec=...) at ../../src/image.c:1686
  #2  0x000000000044bebc in handle_single_display_spec (it=0x7fffffff8ba0, spec=..., object=..., overlay=..., position=0x7fffffff8cd8, bufpos=203, display_replaced=0, frame_window_p=true) at ../../src/xdisp.c:5137
  [...]
  #6  0x0000000000454ee3 in next_element_from_buffer (it=0x7fffffff8ba0) at ../../src/xdisp.c:8133

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 14:29:06 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 10:29:06 2015
Received: from localhost ([127.0.0.1]:52819 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3mQj-0005ls-EQ
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:29:06 -0400
Received: from mout.gmx.net ([212.227.15.19]:65154)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z3mQh-0005lJ-AC
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:29:04 -0400
Received: from [178.190.161.122] ([178.190.161.122]) by mail.gmx.com
 (mrgmx001) with ESMTPSA (Nemesis) id 0MaaOf-1YkJlZ2aFd-00K7Nb; Sat, 13 Jun
 2015 16:28:56 +0200
Message-ID: <557C3E1F.6030305@HIDDEN>
Date: Sat, 13 Jun 2015 16:28:47 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
 <83vberpv07.fsf@HIDDEN>
In-Reply-To: <83vberpv07.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:2P9it5LOblp2qQ4gvgXkPt/gLm17EvTLvApjeCE95LsaHlwGmpl
 Vn4Plqz2AqqjP5+HMY3u5V42TjfGvnv5nzHY+oRMrAi9rydiXsn8+XLvFG9C5DnQSsjdiNr
 W6ONiaD8/+VNqVg1r7E2gs9v3l3ghmrEJHozol7nwm9ePhi1LMQcCMwjyA/qn0S9dy+R15k
 VZA7diHLVffBHQ3mnCx4Q==
X-UI-Out-Filterresults: notjunk:1;V01:K0:Z0v80EP0pEI=:liTTJ+tgEJmYAKSNoPZ7OM
 slNzEQrEkGn+0frCRW32l0MW0KlMnhawqwi6AeMRR32L2RhjjYIiQtnxRWdAZYxZvLDo/RMYS
 MnF3LCjBN4MEQfJQBMaOgmvJATSJkc3Mk1y1JD75tLIxIdzmVIs/gxa0HbmxTyX6jgVh+waL4
 ukSfmPExLfDmw5ezw2xCPekhU9EO25eWZKYcdhQEomBFKDH9QtZIGVOxjNGt2mpu6mZeww52n
 Sc+eYFD0zIzQL2g2MqihN8cdWhUPRGMN5ETK0Va2EhQSAgxK5vLzKOKS214XGMNsXdN0cx350
 Jr8b2ufCvCHWDHI/qkan5O7xd5MafMypN6TlQzekF3tV098/NrdRuWkOaMRIX1oF6H5hVx2Gm
 6jhvbrxHDU2sossbNZbbLtr+Q8b4bgJxWoz6coXIMgG4Byufl0LJh3XN7vkudHbWMO5u/ei08
 LHvYhdsJr/KeRrX+H6LQeOUBXd3YkjodFqzezme/d5n0I9NtYvXRrfXqyXq2tYt0Nj7cK5f9t
 qA+YtnMEx4gzPqiYDsSgyCeceCkts5rK3WrDDpx7QcpFd1JTQjyzb1UqbucFvoPkehgGY5tNb
 qdLrb5BpVEXF4+cWY3zTq+nayJG3FaiqXgN81msfE/fT+YwuzNX70V/x7h0E2MVkZWBMQaxS/
 1biBnm9W9CI6a+tBtAmWRwRl+2SEbJB7T9T8ZUrsNM3qa7Q7P+FOoAUnTY6/dhX9KBPo=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > So FRAME_IMAGE_CACHE returns a NULL pointer, I guess.  But how did
 > that happen?  We allocate the cache in xfaces.c:init_frame_faces.  I
 > could understand why init_frame_faces was not yet called for the tip
 > frame we were trying to create, but the crash happens because of a
 > different frame.  Look:
 >
 >    #37 0x000000000054c091 in x_decode_color (f=3D0x24d2c30, color_name=
=3D..., mono_color=3D16777215) at ../../src/xfns.c:495
 >    #38 0x000000000054c566 in x_set_background_color (f=3D0x24d2c30, ar=
g=3D..., oldval=3D...) at ../../src/xfns.c:638
 >    #39 0x000000000042d45d in x_set_frame_parameters (f=3D0x24d2c30, al=
ist=3D...) at ../../src/frame.c:3152
 >    #40 0x0000000000431ce6 in x_default_parameter (f=3D0x24d2c30, alist=
=3D..., prop=3D..., deflt=3D..., xprop=3D0x6fd49d "background", xclass=3D=
0x6fd908 "Background", type=3DRES_TYPE_STRING) at ../../src/frame.c:4374
 >    #41 0x000000000055549d in x_create_tip_frame (dpyinfo=3D0x1621ee0, =
parms=3D..., text=3D...) at ../../src/xfns.c:5173
 >
 > This is the tip frame we are creating, its pointer is 0x24d2c30.  But
 > when we crash, it's for a different frame, whose pointer is 0x13a7e00:=

 >
 >    #0  0x00000000006c9b5c in cache_image (f=3D0x13a7e00, img=3D0x249e0=
10) at ../../src/image.c:1775
 >    #1  0x00000000006c96e3 in lookup_image (f=3D0x13a7e00, spec=3D...) =
at ../../src/image.c:1686

As I mentioned earlier this seems to be due to the fact that the
debugger intervenes in some recursive fashion.  The crash happens after
the backtrace window popped up and when I try to =E2=80=98switch-to-prev-=
buffer=E2=80=99
in the window where the tooltip should have appeared.  Without that I'm
_not_ able to reproduce the crash.

 > Can you see what is that frame, and why we didn't call
 > init_frame_faces for it?

What makes you think this is not my normal frame in the first place and
why init_frame_faces was not called for it?  Hmmm, I see, nothing can
stop make_image_cache apparently.  I'll look into this later - sounds
like a thunderstorm approaching and I'll rather switch off my machine.

 > Also, which image are we trying to display
 > here?

How would I know?  I never see one because I build without image
support.

 > Something on the toolbar, perhaps?  Did you move mouse pointer
 > over a tool-bar button to trigger a tooltip that failed?

The toolbar is disabled with my customizations.

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 14:01:59 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 10:01:59 2015
Received: from localhost ([127.0.0.1]:52785 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3m0U-000565-Ol
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:01:59 -0400
Received: from mtaout28.012.net.il ([80.179.55.184]:53261)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z3m0Q-00055o-0T
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 10:01:56 -0400
Received: from conversion-daemon.mtaout28.012.net.il by mtaout28.012.net.il
 (HyperSendmail v2007.08) id <0NPV00A00YRCCB00@HIDDEN> for
 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 17:01:18 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by mtaout28.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPV0061LYY6CZ50@HIDDEN>; Sat, 13 Jun 2015 17:01:18 +0300 (IDT)
Date: Sat, 13 Jun 2015 17:01:44 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557C2EF2.5030308@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <83vberpv07.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN> <557C2EF2.5030308@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Sat, 13 Jun 2015 15:24:02 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
> 
>  > Thanks, but I still cannot reproduce this.  (On what OS did you
>  > reproduce it?)
> 
> A Gtk build on Debian.  Run with all my customizations.

I see that x_decode_color in xfns.c signals an error, while the same
function in w32fns.c doesn't.  But even if I add the call to
signal_error to w32fns.c's implementation, I still cannot reproduce
the crash.  I do see an error message in the echo area, but no
debugger pops up.

> Sorry, I forgot to tell.  Line 1775 of image.c here is
> 
>    for (i = 0; i < c->used; ++i)
> 
> in the context of
> 
>    struct image_cache *c = FRAME_IMAGE_CACHE (f);
>    ptrdiff_t i;
> 
>    /* Find a free slot in c->images.  */
>    for (i = 0; i < c->used; ++i)
>      if (c->images[i] == NULL)
>        break;
> 
>    /* If no free slot found, maybe enlarge c->images.  */
> 
> in cache_image.  i is still 0 and I get
> 
> (gdb) p c->used
> Cannot access memory at address 0x18

So FRAME_IMAGE_CACHE returns a NULL pointer, I guess.  But how did
that happen?  We allocate the cache in xfaces.c:init_frame_faces.  I
could understand why init_frame_faces was not yet called for the tip
frame we were trying to create, but the crash happens because of a
different frame.  Look:

  #37 0x000000000054c091 in x_decode_color (f=0x24d2c30, color_name=..., mono_color=16777215) at ../../src/xfns.c:495
  #38 0x000000000054c566 in x_set_background_color (f=0x24d2c30, arg=..., oldval=...) at ../../src/xfns.c:638
  #39 0x000000000042d45d in x_set_frame_parameters (f=0x24d2c30, alist=...) at ../../src/frame.c:3152
  #40 0x0000000000431ce6 in x_default_parameter (f=0x24d2c30, alist=..., prop=..., deflt=..., xprop=0x6fd49d "background", xclass=0x6fd908 "Background", type=RES_TYPE_STRING) at ../../src/frame.c:4374
  #41 0x000000000055549d in x_create_tip_frame (dpyinfo=0x1621ee0, parms=..., text=...) at ../../src/xfns.c:5173

This is the tip frame we are creating, its pointer is 0x24d2c30.  But
when we crash, it's for a different frame, whose pointer is 0x13a7e00:

  #0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x249e010) at ../../src/image.c:1775
  #1  0x00000000006c96e3 in lookup_image (f=0x13a7e00, spec=...) at ../../src/image.c:1686

Can you see what is that frame, and why we didn't call
init_frame_faces for it?  Also, which image are we trying to display
here?  Something on the toolbar, perhaps?  Did you move mouse pointer
over a tool-bar button to trigger a tooltip that failed?




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 13:24:21 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 09:24:21 2015
Received: from localhost ([127.0.0.1]:52467 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3lQ4-00048o-BK
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 09:24:21 -0400
Received: from mout.gmx.net ([212.227.15.18]:58096)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z3lQ2-00048a-6K
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 09:24:19 -0400
Received: from [188.22.238.237] ([188.22.238.237]) by mail.gmx.com (mrgmx002)
 with ESMTPSA (Nemesis) id 0LsCdj-1ZAFGu1lTr-013sNl;
 Sat, 13 Jun 2015 15:24:11 +0200
Message-ID: <557C2EF2.5030308@HIDDEN>
Date: Sat, 13 Jun 2015 15:24:02 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN> <831thfri91.fsf@HIDDEN>
In-Reply-To: <831thfri91.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:rhXgKLmDzAiSMS9vj/YbsOh6QrvWJrltINE/nLTqyfHUpUOk/f9
 u5P3W23XCMjOWhWmLQ8CtEN25jpi22i9ot3+TAsDTUqM5ouGvLd8G7/72LlWMId47lqB0qC
 lg+3x1/qDwTdxc3GCGg3JV4EUYnXB+z4Pi+isI9LVOJXThqJ0Qki/51+hYPm7DSESkk+H+C
 2boQ5RcMLI7xVuKoG9S2A==
X-UI-Out-Filterresults: notjunk:1;
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 > Thanks, but I still cannot reproduce this.  (On what OS did you
 > reproduce it?)

A Gtk build on Debian.  Run with all my customizations.

 > I also see no backtrace buffers, just a silent message
 > in *Messages* about its being unable to load the bogus color I
 > specified.  Can you help by showing values of variables involved in
 > the crash?
 >
 >> #0  0x00000000006c9b5c in cache_image (f=3D0x13a7e00, img=3D0x198ee20=
) at ../../src/image.c:1775
 >
 > Is this in v24.5 or in the current master?  If the latter, line 1775
 > of image.c is this:
 >
 > 	  else if (EQ (ascent, Qcenter))
 > 	    img->ascent =3D CENTERED_IMAGE_ASCENT;  <<<<<<<<<<<<<
 >
 > So is value of img a NULL pointer?  (The argument img in the call
 > above indicates it's non-NULL, but maybe your GDB shows only the value=

 > at entry?)
 >
 > If it's not NULL, and this is the correct line, then what caused the
 > crash?

Sorry, I forgot to tell.  Line 1775 of image.c here is

   for (i =3D 0; i < c->used; ++i)

in the context of

   struct image_cache *c =3D FRAME_IMAGE_CACHE (f);
   ptrdiff_t i;

   /* Find a free slot in c->images.  */
   for (i =3D 0; i < c->used; ++i)
     if (c->images[i] =3D=3D NULL)
       break;

   /* If no free slot found, maybe enlarge c->images.  */

in cache_image.  i is still 0 and I get

(gdb) p c->used
Cannot access memory at address 0x18

which should explain the direct cause of the segfault.

This is from a not-up-to-date version of trunk with some modifications I
made (none in image.c though).  A backtrace with some more data from the
Lisp part is below.

 > (I'm also puzzled what does this have to do with tooltips, since we
 > show no images in the tooltips, and customizing faces for the tooltip
 > frames should not affect showing images in other frames.)

Maybe it's the =E2=80=98debug=E2=80=99 call interfering?

martin


#0  0x00000000006c9b5c in cache_image (f=3D0x13a7e00, img=3D0x249e010) at=
 ../../src/image.c:1775
#1  0x00000000006c96e3 in lookup_image (f=3D0x13a7e00, spec=3D...) at ../=
=2E./src/image.c:1686
#2  0x000000000044bebc in handle_single_display_spec (it=3D0x7fffffff46f0=
, spec=3D..., object=3D..., overlay=3D..., position=3D0x7fffffff4828, buf=
pos=3D203, display_replaced=3D0, frame_window_p=3Dtrue) at ../../src/xdis=
p.c:5137
#3  0x00000000004498cd in handle_display_spec (it=3D0x7fffffff46f0, spec=3D=
=2E.., object=3D..., overlay=3D..., position=3D0x7fffffff4828, bufpos=3D2=
03, frame_window_p=3Dtrue) at ../../src/xdisp.c:4654
#4  0x00000000004492c8 in handle_display_prop (it=3D0x7fffffff46f0) at ..=
/../src/xdisp.c:4576
#5  0x0000000000445e8d in handle_stop (it=3D0x7fffffff46f0) at ../../src/=
xdisp.c:3299
#6  0x0000000000454ee3 in next_element_from_buffer (it=3D0x7fffffff46f0) =
at ../../src/xdisp.c:8133
#7  0x00000000004511b5 in get_next_display_element (it=3D0x7fffffff46f0) =
at ../../src/xdisp.c:6785
#8  0x000000000047e4ea in display_line (it=3D0x7fffffff46f0) at ../../src=
/xdisp.c:20132
#9  0x00000000004719a2 in try_window (window=3D..., pos=3D..., flags=3D1)=
 at ../../src/xdisp.c:16892
#10 0x000000000046df50 in redisplay_window (window=3D..., just_this_one_p=
=3Dfalse) at ../../src/xdisp.c:16365
#11 0x00000000004654d0 in redisplay_window_0 (window=3D...) at ../../src/=
xdisp.c:14184
#12 0x0000000000625c43 in internal_condition_case_1 (bfun=3D0x46548e <red=
isplay_window_0>, arg=3D..., handlers=3D..., hfun=3D0x465456 <redisplay_w=
indow_error>) at ../../src/eval.c:1372
#13 0x000000000046542c in redisplay_windows (window=3D...) at ../../src/x=
disp.c:14164
#14 0x00000000004653e2 in redisplay_windows (window=3D...) at ../../src/x=
disp.c:14158
#15 0x00000000004641e1 in redisplay_internal () at ../../src/xdisp.c:1375=
6
#16 0x0000000000461e04 in redisplay () at ../../src/xdisp.c:13019
#17 0x000000000057d4a3 in read_char (commandflag=3D1, map=3D..., prev_eve=
nt=3D..., used_mouse_menu=3D0x7fffffff9d8f, end_time=3D0x0) at ../../src/=
keyboard.c:2542
#18 0x000000000058e17f in read_key_sequence (keybuf=3D0x7fffffff9f60, buf=
size=3D30, prompt=3D..., dont_downcase_last=3Dfalse, can_return_switch_fr=
ame=3Dtrue, fix_current_buffer=3Dtrue, prevent_redisplay=3Dfalse) at ../.=
=2E/src/keyboard.c:9156
#19 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#20 0x0000000000625ac9 in internal_condition_case (bfun=3D0x579c90 <comma=
nd_loop_1>, handlers=3D..., hfun=3D0x579300 <cmd_error>) at ../../src/eva=
l.c:1348
#21 0x00000000005798be in command_loop_2 (ignore=3D...) at ../../src/keyb=
oard.c:1139
#22 0x0000000000624ec4 in internal_catch (tag=3D..., func=3D0x579895 <com=
mand_loop_2>, arg=3D...) at ../../src/eval.c:1108
#23 0x00000000005797f6 in command_loop () at ../../src/keyboard.c:1110
#24 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728=

#25 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#26 0x000000000062978c in Ffuncall (nargs=3D1, args=3D0x7fffffffa408) at =
=2E./../src/eval.c:2715
#27 0x0000000000675d20 in exec_byte_code (bytestr=3D..., vector=3D..., ma=
xdepth=3D..., args_template=3D..., nargs=3D2, args=3D0x7fffffffac98) at .=
=2E/../src/bytecode.c:919
#28 0x000000000062a11f in funcall_lambda (fun=3D..., nargs=3D2, arg_vecto=
r=3D0x7fffffffac98) at ../../src/eval.c:2885
#29 0x0000000000629a1a in Ffuncall (nargs=3D3, args=3D0x7fffffffac90) at =
=2E./../src/eval.c:2767
#30 0x0000000000628a06 in Fapply (nargs=3D2, args=3D0x7fffffffada0) at ..=
/../src/eval.c:2337
#31 0x00000000006290fc in apply1 (fn=3D..., arg=3D...) at ../../src/eval.=
c:2558
#32 0x0000000000622711 in call_debugger (arg=3D...) at ../../src/eval.c:3=
09
#33 0x0000000000626ab3 in maybe_call_debugger (conditions=3D..., sig=3D..=
=2E, data=3D...) at ../../src/eval.c:1726
#34 0x00000000006262c8 in Fsignal (error_symbol=3D..., data=3D...) at ../=
=2E./src/eval.c:1544
#35 0x00000000006263fe in xsignal (error_symbol=3D..., data=3D...) at ../=
=2E./src/eval.c:1581
#36 0x000000000062663c in signal_error (s=3D0x6fd2de "Undefined color", a=
rg=3D...) at ../../src/eval.c:1636
#37 0x000000000054c091 in x_decode_color (f=3D0x24d2c30, color_name=3D...=
, mono_color=3D16777215) at ../../src/xfns.c:495
#38 0x000000000054c566 in x_set_background_color (f=3D0x24d2c30, arg=3D..=
=2E, oldval=3D...) at ../../src/xfns.c:638
#39 0x000000000042d45d in x_set_frame_parameters (f=3D0x24d2c30, alist=3D=
=2E..) at ../../src/frame.c:3152
#40 0x0000000000431ce6 in x_default_parameter (f=3D0x24d2c30, alist=3D...=
, prop=3D..., deflt=3D..., xprop=3D0x6fd49d "background", xclass=3D0x6fd9=
08 "Background", type=3DRES_TYPE_STRING) at ../../src/frame.c:4374
#41 0x000000000055549d in x_create_tip_frame (dpyinfo=3D0x1621ee0, parms=3D=
=2E.., text=3D...) at ../../src/xfns.c:5173
#42 0x0000000000556884 in Fx_show_tip (string=3D..., frame=3D..., parms=3D=
=2E.., timeout=3D..., dx=3D..., dy=3D...) at ../../src/xfns.c:5543
#43 0x0000000000628116 in eval_sub (form=3D...) at ../../src/eval.c:2200
#44 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#45 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#46 0x00000000006229d4 in Fif (args=3D...) at ../../src/eval.c:396
#47 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#48 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#49 0x000000000062437c in FletX (args=3D...) at ../../src/eval.c:896
#50 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#51 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#52 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#53 0x00000000006229d4 in Fif (args=3D...) at ../../src/eval.c:396
#54 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#55 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#56 0x000000000062437c in FletX (args=3D...) at ../../src/eval.c:896
#57 0x0000000000627c9a in eval_sub (form=3D...) at ../../src/eval.c:2131
#58 0x0000000000622c5f in Fprogn (body=3D...) at ../../src/eval.c:445
#59 0x000000000062a511 in funcall_lambda (fun=3D..., nargs=3D0, arg_vecto=
r=3D0x0) at ../../src/eval.c:2944
#60 0x0000000000629b19 in Ffuncall (nargs=3D1, args=3D0x7fffffffcbb0) at =
=2E./../src/eval.c:2779
#61 0x000000000062853a in Fapply (nargs=3D2, args=3D0x7fffffffcbb0) at ..=
/../src/eval.c:2289
#62 0x0000000000629676 in Ffuncall (nargs=3D3, args=3D0x7fffffffcba8) at =
=2E./../src/eval.c:2698
#63 0x0000000000675d20 in exec_byte_code (bytestr=3D..., vector=3D..., ma=
xdepth=3D..., args_template=3D..., nargs=3D0, args=3D0x0) at ../../src/by=
tecode.c:919
#64 0x000000000062a5b1 in funcall_lambda (fun=3D..., nargs=3D1, arg_vecto=
r=3D0xadb72d) at ../../src/eval.c:2951
#65 0x0000000000629a1a in Ffuncall (nargs=3D2, args=3D0x7fffffffd430) at =
=2E./../src/eval.c:2767
#66 0x0000000000629153 in call1 (fn=3D..., arg1=3D...) at ../../src/eval.=
c:2573
#67 0x0000000000582a83 in timer_check_2 (timers=3D..., idle_timers=3D...)=
 at ../../src/keyboard.c:4533
#68 0x0000000000582bf2 in timer_check () at ../../src/keyboard.c:4600
#69 0x000000000058008d in readable_events (flags=3D1) at ../../src/keyboa=
rd.c:3434
#70 0x000000000058841c in get_input_pending (flags=3D1) at ../../src/keyb=
oard.c:6818
#71 0x000000000058ff13 in detect_input_pending_run_timers (do_display=3Dt=
rue) at ../../src/keyboard.c:9973
#72 0x0000000000684c13 in wait_reading_process_output (time_limit=3D2025,=
 nsecs=3D0, read_kbd=3D-1, do_display=3Dtrue, wait_for_cell=3D..., wait_p=
roc=3D0x0, just_wait_proc=3D0) at ../../src/process.c:5014
#73 0x0000000000422610 in sit_for (timeout=3D..., reading=3Dtrue, display=
_option=3D1) at ../../src/dispnew.c:5748
#74 0x000000000057de53 in read_char (commandflag=3D1, map=3D..., prev_eve=
nt=3D..., used_mouse_menu=3D0x7fffffffe23f, end_time=3D0x0) at ../../src/=
keyboard.c:2781
#75 0x000000000058e17f in read_key_sequence (keybuf=3D0x7fffffffe410, buf=
size=3D30, prompt=3D..., dont_downcase_last=3Dfalse, can_return_switch_fr=
ame=3Dtrue, fix_current_buffer=3Dtrue, prevent_redisplay=3Dfalse) at ../.=
=2E/src/keyboard.c:9156
#76 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#77 0x0000000000625ac9 in internal_condition_case (bfun=3D0x579c90 <comma=
nd_loop_1>, handlers=3D..., hfun=3D0x579300 <cmd_error>) at ../../src/eva=
l.c:1348
#78 0x00000000005798be in command_loop_2 (ignore=3D...) at ../../src/keyb=
oard.c:1139
#79 0x0000000000624ec4 in internal_catch (tag=3D..., func=3D0x579895 <com=
mand_loop_2>, arg=3D...) at ../../src/eval.c:1108
#80 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#81 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728=

#82 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#83 0x0000000000576cd3 in main (argc=3D1, argv=3D0x7fffffffe8e8) at ../..=
/src/emacs.c:1626

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)
"recursive-edit" (0xffffa410)
"debug" (0xffffac98)
"x-show-tip" (0xffffb810)
"progn" (0xffffbb20)
"if" (0xffffbd40)
"let*" (0xffffc040)
"progn" (0xffffc250)
"if" (0xffffc470)
"let*" (0xffffc770)
"eldoc-tooltip--make" (0xffffcbb8)
"apply" (0xffffcbb0)
"timer-event-handler" (0xffffd438)






Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 10:54:30 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 06:54:30 2015
Received: from localhost ([127.0.0.1]:52409 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3j54-0007a9-7m
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 06:54:30 -0400
Received: from mtaout22.012.net.il ([80.179.55.172]:37514)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z3j51-0007Zv-CD
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 06:54:28 -0400
Received: from conversion-daemon.a-mtaout22.012.net.il by
 a-mtaout22.012.net.il (HyperSendmail v2007.08) id
 <0NPV00G00PNDIW00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Sat, 13 Jun 2015 13:54:20 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout22.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPV00GLBQAKKZ00@HIDDEN>;
 Sat, 13 Jun 2015 13:54:20 +0300 (IDT)
Date: Sat, 13 Jun 2015 13:54:18 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <557C0526.5050607@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: martin rudalics <rudalics@HIDDEN>
Message-id: <831thfri91.fsf@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 8BIT
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
 <557C0526.5050607@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: tobias.getzner@HIDDEN, 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> Date: Sat, 13 Jun 2015 12:25:42 +0200
> From: martin rudalics <rudalics@HIDDEN>
> CC: 20802 <at> debbugs.gnu.org
> 
> Below is a bt after setting an invalid background color.  Tooltips are
> shown via ‘x-show-tip’ and the crash triggers after the backtrace buffer
> complaining about the invalid color popped up and I tried to switch to
> another buffer.  I have no idea whether it's the OP's original issue.

Thanks, but I still cannot reproduce this.  (On what OS did you
reproduce it?)  I also see no backtrace buffers, just a silent message
in *Messages* about its being unable to load the bogus color I
specified.  Can you help by showing values of variables involved in
the crash?

> #0  0x00000000006c9b5c in cache_image (f=0x13a7e00, img=0x198ee20) at ../../src/image.c:1775

Is this in v24.5 or in the current master?  If the latter, line 1775
of image.c is this:

	  else if (EQ (ascent, Qcenter))
	    img->ascent = CENTERED_IMAGE_ASCENT;  <<<<<<<<<<<<<

So is value of img a NULL pointer?  (The argument img in the call
above indicates it's non-NULL, but maybe your GDB shows only the value
at entry?)

If it's not NULL, and this is the correct line, then what caused the
crash?

(I'm also puzzled what does this have to do with tooltips, since we
show no images in the tooltips, and customizing faces for the tooltip
frames should not affect showing images in other frames.)

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 10:26:04 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 06:26:04 2015
Received: from localhost ([127.0.0.1]:52359 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3idV-0006sk-5c
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 06:26:03 -0400
Received: from mout.gmx.net ([212.227.15.15]:63676)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <rudalics@HIDDEN>) id 1Z3idR-0006sW-Qb
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 06:25:58 -0400
Received: from [178.191.142.117] ([178.191.142.117]) by mail.gmx.com
 (mrgmx001) with ESMTPSA (Nemesis) id 0Lq9oW-1ZYfjr0lqy-00drLX; Sat, 13 Jun
 2015 12:25:51 +0200
Message-ID: <557C0526.5050607@HIDDEN>
Date: Sat, 13 Jun 2015 12:25:42 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Eli Zaretskii <eliz@HIDDEN>, Tobias Getzner <tobias.getzner@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
References: <1434187118.10061.4.camel@HIDDEN> <83381wq76d.fsf@HIDDEN>
In-Reply-To: <83381wq76d.fsf@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:K76Daq4aDm42FUnnNC0PHaaPd8WEQjHQaGrNIQ7wJA0oBj1aIvp
 6I/ZAf2q4ouK2I55TTo5DuiddFQeiiRlUs4HAtqug30zADM4/8bTJU2Kbj1PwAAtW5ZmaXN
 ozHKPU0zvFv5nLyagqP2O68MmVLUckoJlYjwB+29FwWIiOsf0FAPbM45mLkkntZHjoKQeD3
 R2d4cV/uZDhCbQPBbZ58Q==
X-UI-Out-Filterresults: notjunk:1;V01:K0:3ac8Q93IQPo=:yDQ0V47HJ81BmVWXQNaaTN
 BccGoyAzHqc8WXRyuP0Ai3PP1NHRkDrZmpAt3kekJ79soplzbqUwmkkAftkPPNIM4x/7/9Do3
 LJSoW0lYKrhjSHS/F1RP46QeuwjYH/lT8CUmWipEHLY2COcoB6LNg5u4U4O+sSfnF88JeTLrd
 vJ/8sYsTTP95NYiyDbKa99twNWZWz3KQvyqi282Mmwhy27nzlY/ZUa4dvKUIDvhXnJXxE17jp
 7ijV9RbdWefXPzK7L8nwTZ4oKXzgg8jokwa1NLWPHs3j1Jup1GdumaSMUlXzplsZzkvxXXLfh
 FokUbqt7oTqdX48TyO1iFKSY8O5qGYrVrwQClxBBpjh33Ilhifb1GKKK1E2lhsEiswWSlbmhY
 OmNrDyuIYSTraW7JYxpYENnuWz5RSkV0Y1dFYjk2fwUa8ayUuyu+GEYpLuYfAvEsZEZOTJBsa
 QbZTI1UxExTfPRdO7mcfVavPJ4l12llg81XZjN4K/smzdRpEe/c82F+leiul/ycJkCxi/aJLb
 Js3Ccz+F/roWxSquEmPpTicScogsi/DKQZ+es48/XGebcQO5jEoYs5HWAEPnpZ4rSjy6EVAcA
 SR3mNbEJtKyg1MrhOp/+qbPOxL6rEfYL7p0chdJ4W/IIWA7TkntkU2IBzG77PSeIN5TcjfBCp
 F9Uf2/VvumWe/Ay+IWvgdhSBePiRtuSqt+0EzD0+xLnfVBgHq0Nz/5xZT6KoDSMB/uUk=
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.0 (/)

 >> When x-gtk-use-system-tooltips is set to nil, and the tooltip face is=

 >> customized using an invalid color string such as #zz, Emacs will
 >> segfault when a tooltip is being drawn.
 >
 > I cannot reproduce this on my system, so please show a backtrace from
 > running Emacs inside GDB.  Also, please tell how you customized the
 > face color, exactly -- it could be that only some specific ways of
 > customizing it cause the problem.

Below is a bt after setting an invalid background color.  Tooltips are
shown via =E2=80=98x-show-tip=E2=80=99 and the crash triggers after the b=
acktrace buffer
complaining about the invalid color popped up and I tried to switch to
another buffer.  I have no idea whether it's the OP's original issue.

martin


#0  0x00000000006c9b5c in cache_image (f=3D0x13a7e00, img=3D0x198ee20) at=
 ../../src/image.c:1775
#1  0x00000000006c96e3 in lookup_image (f=3D0x13a7e00, spec=3D...) at ../=
=2E./src/image.c:1686
#2  0x000000000044bebc in handle_single_display_spec (it=3D0x7fffffff8ba0=
, spec=3D..., object=3D..., overlay=3D..., position=3D0x7fffffff8cd8, buf=
pos=3D203, display_replaced=3D0, frame_window_p=3Dtrue) at ../../src/xdis=
p.c:5137
#3  0x00000000004498cd in handle_display_spec (it=3D0x7fffffff8ba0, spec=3D=
=2E.., object=3D..., overlay=3D..., position=3D0x7fffffff8cd8, bufpos=3D2=
03, frame_window_p=3Dtrue) at ../../src/xdisp.c:4654
#4  0x00000000004492c8 in handle_display_prop (it=3D0x7fffffff8ba0) at ..=
/../src/xdisp.c:4576
#5  0x0000000000445e8d in handle_stop (it=3D0x7fffffff8ba0) at ../../src/=
xdisp.c:3299
#6  0x0000000000454ee3 in next_element_from_buffer (it=3D0x7fffffff8ba0) =
at ../../src/xdisp.c:8133
#7  0x00000000004511b5 in get_next_display_element (it=3D0x7fffffff8ba0) =
at ../../src/xdisp.c:6785
#8  0x000000000047e4ea in display_line (it=3D0x7fffffff8ba0) at ../../src=
/xdisp.c:20132
#9  0x00000000004719a2 in try_window (window=3D..., pos=3D..., flags=3D1)=
 at ../../src/xdisp.c:16892
#10 0x000000000046df50 in redisplay_window (window=3D..., just_this_one_p=
=3Dfalse) at ../../src/xdisp.c:16365
#11 0x00000000004654d0 in redisplay_window_0 (window=3D...) at ../../src/=
xdisp.c:14184
#12 0x0000000000625c43 in internal_condition_case_1 (bfun=3D0x46548e <red=
isplay_window_0>, arg=3D..., handlers=3D..., hfun=3D0x465456 <redisplay_w=
indow_error>) at ../../src/eval.c:1372
#13 0x000000000046542c in redisplay_windows (window=3D...) at ../../src/x=
disp.c:14164
#14 0x00000000004653e2 in redisplay_windows (window=3D...) at ../../src/x=
disp.c:14158
#15 0x00000000004641e1 in redisplay_internal () at ../../src/xdisp.c:1375=
6
#16 0x0000000000461e04 in redisplay () at ../../src/xdisp.c:13019
#17 0x000000000057d4a3 in read_char (commandflag=3D1, map=3D..., prev_eve=
nt=3D..., used_mouse_menu=3D0x7fffffffe23f, end_time=3D0x0) at ../../src/=
keyboard.c:2542
#18 0x000000000058e17f in read_key_sequence (keybuf=3D0x7fffffffe410, buf=
size=3D30, prompt=3D..., dont_downcase_last=3Dfalse, can_return_switch_fr=
ame=3Dtrue, fix_current_buffer=3Dtrue, prevent_redisplay=3Dfalse) at ../.=
=2E/src/keyboard.c:9156
#19 0x000000000057a0e7 in command_loop_1 () at ../../src/keyboard.c:1407
#20 0x0000000000625ac9 in internal_condition_case (bfun=3D0x579c90 <comma=
nd_loop_1>, handlers=3D..., hfun=3D0x579300 <cmd_error>) at ../../src/eva=
l.c:1348
#21 0x00000000005798be in command_loop_2 (ignore=3D...) at ../../src/keyb=
oard.c:1139
#22 0x0000000000624ec4 in internal_catch (tag=3D..., func=3D0x579895 <com=
mand_loop_2>, arg=3D...) at ../../src/eval.c:1108
#23 0x0000000000579860 in command_loop () at ../../src/keyboard.c:1118
#24 0x0000000000578df7 in recursive_edit_1 () at ../../src/keyboard.c:728=

#25 0x0000000000578ff3 in Frecursive_edit () at ../../src/keyboard.c:799
#26 0x0000000000576cd3 in main (argc=3D1, argv=3D0x7fffffffe8e8) at ../..=
/src/emacs.c:1626

Lisp Backtrace:
"redisplay_internal (C function)" (0x0)





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at 20802 <at> debbugs.gnu.org:


Received: (at 20802) by debbugs.gnu.org; 13 Jun 2015 09:39:03 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 05:39:03 2015
Received: from localhost ([127.0.0.1]:52353 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3hu2-0005ie-Eu
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:39:03 -0400
Received: from mtaout22.012.net.il ([80.179.55.172]:59379)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <eliz@HIDDEN>) id 1Z3htz-0005i7-PF
 for 20802 <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:39:00 -0400
Received: from conversion-daemon.a-mtaout22.012.net.il by
 a-mtaout22.012.net.il (HyperSendmail v2007.08) id
 <0NPV00G00ME43T00@HIDDEN> for 20802 <at> debbugs.gnu.org;
 Sat, 13 Jun 2015 12:38:53 +0300 (IDT)
Received: from HOME-C4E4A596F7 ([87.69.4.28]) by a-mtaout22.012.net.il
 (HyperSendmail v2007.08) with ESMTPA id
 <0NPV00FEVMSTYI80@HIDDEN>;
 Sat, 13 Jun 2015 12:38:53 +0300 (IDT)
Date: Sat, 13 Jun 2015 12:38:50 +0300
From: Eli Zaretskii <eliz@HIDDEN>
Subject: Re: bug#20802: Segfault when showing non-GTK+ tooltip
In-reply-to: <1434187118.10061.4.camel@HIDDEN>
X-012-Sender: halo1@HIDDEN
To: Tobias Getzner <tobias.getzner@HIDDEN>
Message-id: <83381wq76d.fsf@HIDDEN>
References: <1434187118.10061.4.camel@HIDDEN>
X-Spam-Score: 1.0 (+)
X-Debbugs-Envelope-To: 20802
Cc: 20802 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: Eli Zaretskii <eliz@HIDDEN>
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 1.0 (+)

> From: Tobias Getzner <tobias.getzner@HIDDEN>
> Date: Sat, 13 Jun 2015 11:18:38 +0200
> 
> When x-gtk-use-system-tooltips is set to nil, and the tooltip face is
> customized using an invalid color string such as #zz, Emacs will
> segfault when a tooltip is being drawn.

I cannot reproduce this on my system, so please show a backtrace from
running Emacs inside GDB.  Also, please tell how you customized the
face color, exactly -- it could be that only some specific ways of
customizing it cause the problem.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 13 Jun 2015 09:18:55 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Sat Jun 13 05:18:55 2015
Received: from localhost ([127.0.0.1]:52336 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.80)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1Z3haZ-0005DH-Bk
	for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:18:55 -0400
Received: from eggs.gnu.org ([208.118.235.92]:35464)
 by debbugs.gnu.org with esmtp (Exim 4.80)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haW-0005D5-VV
 for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:18:53 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haQ-0005Hk-R6
 for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:18:47 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=0.0 required=5.0 tests=BAYES_40,FREEMAIL_FROM
 autolearn=disabled version=3.3.2
Received: from lists.gnu.org ([2001:4830:134:3::11]:52011)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haQ-0005Hg-Nx
 for submit <at> debbugs.gnu.org; Sat, 13 Jun 2015 05:18:46 -0400
Received: from eggs.gnu.org ([2001:4830:134:3::10]:48965)
 by lists.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haP-0004ww-O4
 for bug-gnu-emacs@HIDDEN; Sat, 13 Jun 2015 05:18:46 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haL-0005HK-Nu
 for bug-gnu-emacs@HIDDEN; Sat, 13 Jun 2015 05:18:45 -0400
Received: from mout.gmx.net ([212.227.17.20]:58896)
 by eggs.gnu.org with esmtp (Exim 4.71)
 (envelope-from <tobias.getzner@HIDDEN>) id 1Z3haL-0005HE-Ek
 for bug-gnu-emacs@HIDDEN; Sat, 13 Jun 2015 05:18:41 -0400
Received: from wirrsal ([78.49.163.59]) by mail.gmx.com (mrgmx102) with
 ESMTPSA (Nemesis) id 0LgNGi-1ZQbjX1xeW-00ng36 for <bug-gnu-emacs@HIDDEN>;
 Sat, 13 Jun 2015 11:18:39 +0200
Message-ID: <1434187118.10061.4.camel@HIDDEN>
Subject: Segfault when showing non-GTK+ tooltip
From: Tobias Getzner <tobias.getzner@HIDDEN>
To: bug-gnu-emacs@HIDDEN
Date: Sat, 13 Jun 2015 11:18:38 +0200
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.3 
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Provags-ID: V03:K0:/K7iaxuCdR8/sYrodEfV/8C4kRwotKklAHSmnjH4dbjCCn93wqW
 rjDJaApcCf+XVyrMjmjMCKpqEfTpzPKdDaH103dVpGsKUIacrk/lE/rDkczdW8QkKli5dsS
 q8EbmMowZStH7nKlwMdvoJwdVFP8kgY5p2oRKge9YkU/HlBhl3Cxl3T+mH83hVGWHRpgwzN
 F8G/xkYIx3DJXQTTt2veg==
X-UI-Out-Filterresults: notjunk:1;
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic]
X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address
 (bad octet value).
X-Received-From: 2001:4830:134:3::11
X-Spam-Score: -4.1 (----)
X-Debbugs-Envelope-To: submit
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -4.1 (----)

When x-gtk-use-system-tooltips is set to nil, and the tooltip face is
customized using an invalid color string such as #zz, Emacs will
segfault when a tooltip is being drawn.

This is for Emacs 24.5.
 Best regards,
TG





Acknowledgement sent to Tobias Getzner <tobias.getzner@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-gnu-emacs@HIDDEN. Full text available.
Report forwarded to bug-gnu-emacs@HIDDEN:
bug#20802; Package emacs. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Mon, 25 Nov 2019 12:00:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.