GNU bug report logs - #28862
Emacs 25.3.1 segmentation fault on killing *Colors* buffer

Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.

Package: emacs; Reported by: Levi <wacossusca34@HIDDEN>; Keywords: unreproducible; dated Mon, 16 Oct 2017 07:15:03 UTC; Maintainer for emacs is bug-gnu-emacs@HIDDEN.
Added tag(s) unreproducible. Request was from Noam Postavsky <npostavs@HIDDEN> to control <at> debbugs.gnu.org. Full text available.

Message received at 28862 <at> debbugs.gnu.org:


Received: (at 28862) by debbugs.gnu.org; 1 Nov 2017 23:09:04 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Nov 01 19:09:04 2017
Received: from localhost ([127.0.0.1]:46575 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1eA288-0008Lp-8V
	for submit <at> debbugs.gnu.org; Wed, 01 Nov 2017 19:09:04 -0400
Received: from mail-io0-f177.google.com ([209.85.223.177]:55691)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <npostavs@HIDDEN>)
 id 1eA286-0008LE-9R; Wed, 01 Nov 2017 19:09:02 -0400
Received: by mail-io0-f177.google.com with SMTP id p186so9677619ioe.12;
 Wed, 01 Nov 2017 16:09:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=sender:from:to:cc:subject:references:date:in-reply-to:message-id
 :user-agent:mime-version;
 bh=nwq6mbzkB+WBgtGUoIQk7SJfIwFHbsX2msaoaKXK6hk=;
 b=qUCGJl1yoXJXQQ4vHkumplL+DAREiQVBvGj4Rh/eyDlkOT7yvfs5KaGQ6oWzjOsKKj
 NyZaqAEU/j9ABqTHbaH5rwwE6TD6hxuR4L2hRzldJfVnOVUPib4pnpeBnvZnbq4HK5fj
 ro0ZnNCQfRxtnaKSUyo6Lr7xbTnTua82ZrCJHSp3wvOFIFiAtsPecQd/ga6/3mf6MEaE
 +E+qoSSwL1Ml67RLxZ9Lb83f5repn4os+SpGWotkTWdRYLqsJegOqtsXlZlFKX67YJaA
 H50zysR9N9p0XRcEdHYKzMF57fvINhnsuidR7N6YoGHIv0eIudLaikh+c1pIXiDLmACR
 xuZQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:sender:from:to:cc:subject:references:date
 :in-reply-to:message-id:user-agent:mime-version;
 bh=nwq6mbzkB+WBgtGUoIQk7SJfIwFHbsX2msaoaKXK6hk=;
 b=mHgyT9x/E0+rft66Go+gIR05sQvqGjAhGhJer4djUJMNw4zfY2XXpwaUZ8f6F++zbr
 0LR3nBSUOxT91ybgrxqhusi71exkWCDsjBzgiYWjWZywo0m09VLSF1lckOgKcItpxACQ
 c5SNdqS9EWIEao4beQBCuS87bsxJWPC+2Y+/dKSFOIjZzOp6olI2K8NFt3gQFDcl0jWy
 g3P+Almic/PC7c9bASVLgfy2rXmTDQwdBGu8LAhe9tK/x73+8oghg0Ke4MsGUskaLw9k
 TqCk5ZJMaW3jzcAiETIUtydq78MHgYMeSOGE6Le+vqVhyJ0UoR7WyJWGkkPozOIscwyD
 Qfsw==
X-Gm-Message-State: AMCzsaW0b/m++OvuWEX3hwAzZO+Ksi3PvrMQVPzr5edugAvzyOCZ7a87
 IICiIfi4S+fD9DCLovrpWpltBA==
X-Google-Smtp-Source: ABhQp+RDe8Hva5sbyTIkTtl5d4rzEd0U9V9LGy29ed+0pn+uG2uOyPvDIeZsxZu7mHA26m5vBfXv2A==
X-Received: by 10.107.83.4 with SMTP id h4mr2011582iob.145.1509577736412;
 Wed, 01 Nov 2017 16:08:56 -0700 (PDT)
Received: from zebian ([45.2.119.34])
 by smtp.googlemail.com with ESMTPSA id x137sm972485itb.37.2017.11.01.16.08.54
 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256);
 Wed, 01 Nov 2017 16:08:55 -0700 (PDT)
From: Noam Postavsky <npostavs@HIDDEN>
To: martin rudalics <rudalics@HIDDEN>
Subject: Re: bug#28862: Emacs 25.3.1 segmentation fault on killing *Colors*
 buffer
References: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>
 <59E46AFA.8060502@HIDDEN> <83vajff7rt.fsf@HIDDEN>
 <CAM1nYoGx9TxLTXnc61W9NFQnZFfusFatOrtS1OoJ34F55v+uuA@HIDDEN>
 <59E5C677.9010307@HIDDEN>
 <CAM1nYoHo5UcE+vA1-gHjXbzXYBOwkoV9bk8Gcdv2of3-d1SxeA@HIDDEN>
 <59E70CD7.3010700@HIDDEN>
Date: Wed, 01 Nov 2017 19:08:54 -0400
In-Reply-To: <59E70CD7.3010700@HIDDEN> (martin rudalics's message of "Wed, 18
 Oct 2017 10:12:07 +0200")
Message-ID: <878tfpa96h.fsf@HIDDEN>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.0.90 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: -2.1 (--)
X-Debbugs-Envelope-To: 28862
Cc: Levi <wacossusca34@HIDDEN>, 28862 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.1 (--)

tags 28862 + unreproducible
quit

martin rudalics <rudalics@HIDDEN> writes:

>> Have you (or anyone else) been able to reproduce the issue? If not, I can
>> start looking at other potential factors on my system.
>
> I was not able to reproduce it.  But I do not understand some parts of
> your scenario:

I couldn't reproduce it here either.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#28862; Package emacs. Full text available.

Message received at 28862 <at> debbugs.gnu.org:


Received: (at 28862) by debbugs.gnu.org; 18 Oct 2017 08:12:28 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Wed Oct 18 04:12:28 2017
Received: from localhost ([127.0.0.1]:47220 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1e4jSl-0007YT-Rd
	for submit <at> debbugs.gnu.org; Wed, 18 Oct 2017 04:12:28 -0400
Received: from mout.gmx.net ([212.227.15.18]:61691)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <rudalics@HIDDEN>) id 1e4jSi-0007Y2-13
 for 28862 <at> debbugs.gnu.org; Wed, 18 Oct 2017 04:12:24 -0400
Received: from [192.168.1.100] ([46.125.249.96]) by mail.gmx.com (mrgmx001
 [212.227.17.190]) with ESMTPSA (Nemesis) id 0MGj8j-1e06t733Tt-00DZT3; Wed, 18
 Oct 2017 10:12:16 +0200
Message-ID: <59E70CD7.3010700@HIDDEN>
Date: Wed, 18 Oct 2017 10:12:07 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Levi <wacossusca34@HIDDEN>, 28862 <at> debbugs.gnu.org
Subject: Re: bug#28862: Emacs 25.3.1 segmentation fault on killing *Colors*
 buffer
References: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>
 <59E46AFA.8060502@HIDDEN> <83vajff7rt.fsf@HIDDEN>
 <CAM1nYoGx9TxLTXnc61W9NFQnZFfusFatOrtS1OoJ34F55v+uuA@HIDDEN>
 <59E5C677.9010307@HIDDEN>
 <CAM1nYoHo5UcE+vA1-gHjXbzXYBOwkoV9bk8Gcdv2of3-d1SxeA@HIDDEN>
In-Reply-To: <CAM1nYoHo5UcE+vA1-gHjXbzXYBOwkoV9bk8Gcdv2of3-d1SxeA@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:D1W2KxLeQ3wG7+NjwFidHI8+TeSIAWH16Jqw0Aa2JlkOoE8ZTIS
 SZSm3kANJ/zXlKnyTY8vmRQ7IF8i8xQM2b8PQiTepDkIJJiBj5EgwaKRNPCviZIN7yJc46a
 7try4SNIZUz8do0xGV16ASbIQG3KtyYC4e1e/yTfgn1p61OwAfa6MYq6GY/V3PKFkczrVCG
 N2PfWM+3IG9p67J1AqrKQ==
X-UI-Out-Filterresults: notjunk:1;V01:K0:nysSE1VIAGY=:kP7npvU5Z1B5qMELehntfs
 wTJB8jYcm9J14luQvg18vRyzlYWZEerIUFDoWLTTEt2rwHJJYIc+ONGieIvGnv0YNJQZ4YRCC
 aneIL78M0TtDijYu/n0Xm6PJSiOcDSuUlOv/x90jeQ7m84/y7udo5akAzetRPXMtr905KXgiQ
 mjqVWO2erW5KuzY5srEKXNpLAFH9OKnW9X4AjSek8jcB3VQlsiKmgtkSQpSSyfhoJYNIXPlvy
 FNWTz/2OLD8RkIluYCIScicK1lJUWdvqlE85/peUg/AC8qfJ0yzAYTgsVyl17dsChOzdOVE3Q
 qLy9Y0gFJVjJ2hMznbuPQpzC4VShOV5BOiMZetJufd5AZbFQF+WxKQSsutwA1M4NFOyLAfNCK
 TRDM1ER6Tq/68v+O6pYuyYVv9iorobRGB2EYaLkDemfyXZVBALU+mnOCmB/pxIfDhh9UuEZ/d
 AOpIS8AlERu7Zp9NCejMtsKPbHYCcjJfg+YjH9XPdXfZ44ZEe/rFMXyABiTAj0YIAD2mVRUls
 4+t3QlJoQrYex5u0PjXxoJxVj1PdMf0V2OxwaJJp2XKSuiVhy9CPaQIR+tq1i+lqF0kFDRBDt
 0kJTJZjkEPDFnPecf58vhmuU3fmQE9bYkoXphMhhp6JI3uhC6gvV5AjX8Ctu73rtxuRVSkr2n
 V1JE1t5Yy21R5QELodEJUMCk13YMEzRStgLB/i/UwadBa9elw8LLQbDoB9PJraVlKxXU9X/ZL
 YH0LyqHOvgCGryUAF+2wUbKHvTkScEmDAf2pLskMwAmZnS9SJNzdi1xy2j2OcyLl3r172XpON
 aOPwU7FWpW8UqP4IzyQxhuU32wmfZ3YtYZJloGHWtM0V7wXnB/R5s0KjplUph4rV1cN5Naf
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 28862
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.7 (/)

 > Have you (or anyone else) been able to reproduce the issue? If not, I =
can
 > start looking at other potential factors on my system.

I was not able to reproduce it.  But I do not understand some parts of
your scenario:

 > 1) Run `emacs -Q` in a terminal with an X server running, spawning the=
 X
 > frontend for emacs

Is 1) strictly necessary?

 > 2) Paste the above code into the *scratch* buffer and evaluate it (wit=
h
 > `M-x eval-buffer`).
 >
 > 3) Spawn a new frame (with `C-x 5 2`)
 >
 > 4) Enter the customization menus (with `M-x customize`)
 >
 > 5) Navigate to any face in the UI, for example `Emacs -> Faces -> Basi=
c
 > Faces -> Cursor face`
 >
 > 6) Expand the options for the face of interest and click on `Choose` f=
or a
 > color. The colors buffer should appear in a new window, splitting the =
frame
 > in half.
 >
 > 7) Close the window containing the *Customize Group: ...*, such that t=
he
 > only buffer visible in the frame is the *Colors* buffer (I do this by
 > right-clicking the modeline)

Can't you instead of 4)-7) simply run =E2=80=98list-colors-display=E2=80=99=
?

 > 8) Close the frame via the window manager (`X` button, or some hotkey =
to
 > close the X window).

Does C-x 5 0 not exhibit the bug?

In any case please use GDB to step through delete_frame.  If it survives
=E2=80=98delete-frame-functions=E2=80=99 it should be easy to see where i=
t crashes.

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#28862; Package emacs. Full text available.

Message received at 28862 <at> debbugs.gnu.org:


Received: (at 28862) by debbugs.gnu.org; 17 Oct 2017 23:15:05 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Oct 17 19:15:05 2017
Received: from localhost ([127.0.0.1]:46745 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1e4b4j-0005R7-Fw
	for submit <at> debbugs.gnu.org; Tue, 17 Oct 2017 19:15:05 -0400
Received: from mail-oi0-f53.google.com ([209.85.218.53]:53133)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <wacossusca34@HIDDEN>) id 1e4b4g-0005QG-3r
 for 28862 <at> debbugs.gnu.org; Tue, 17 Oct 2017 19:15:03 -0400
Received: by mail-oi0-f53.google.com with SMTP id c202so5998123oih.9
 for <28862 <at> debbugs.gnu.org>; Tue, 17 Oct 2017 16:15:02 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=mime-version:in-reply-to:references:from:date:message-id:subject:to;
 bh=KgFXEiFPkkLlnlcNA0Ep4+8stQWqzs3V+eFR8lT3VMI=;
 b=nxxRstnflyW5T2f9DUE8/cGyeS3zNAqA1p/eQhOEI0clRxVr2prIYq4eFhZ4ZPj9K1
 x7d1KfMn0tnB+5cyGxc8MRfQBivTfWuScgu3n3/dlD8gHb0LwU/KUCZfGISio+w9VHzL
 VyD1VC45IjNXCHtsYXmgArpBOu7EIHM1zt9RwR2R5uB5nesJmFYDaZk5why2n/rZfewV
 1WhtxozwlavYrR5TTRm+1hTFfmYnnjQpBtR6Yc5A/BDU5hoQVPe5p9ApvUELVm+4FsZM
 BUYQIIF0COWOJ5XP8Z7n+A8P1nj0CiLEI5iI+UPe9IbB1Ri6UsoNHgT81mHppwqrINrg
 uHGw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:in-reply-to:references:from:date
 :message-id:subject:to;
 bh=KgFXEiFPkkLlnlcNA0Ep4+8stQWqzs3V+eFR8lT3VMI=;
 b=m3S58tuczVNHuliZo4agn7UzHxyu5jlwsrtNsNJX/5QBHhsdYVQEeGM7iyZs25ljIT
 o4FEo/YcuDN19v1KqR9CUJXTksEHlgFpkIw51htgnX4PsZILLBAsr5u6OvWv9HkWsAcH
 jlXpAXbGEAM6b7x/9KCQhJr8RLsemNPhbQicwZg/x/axF/fzxPf+aM0fal46Ad5brMrc
 hammwhpPxSqDjeP7MlIv21BVKRj80E3Kz7EZVjP36KvR8FYj631oUQ0yTHpOM7cwWwfx
 /MKzT6Xy9lA6YGyXZ4a0hRITpocAfcMuQrz3rSjraVUFm7HVHVtUYdrUrXxb7qEPhLl/
 o4+A==
X-Gm-Message-State: AMCzsaW+gbiKVPBEl6ZJMlYwZ0iqh1bQaJClYdi9vu81T9j+pV+zTrP0
 FyLm81/lJIgjv8QnT4gqofFmNFZkrFaU/7cLtgw=
X-Google-Smtp-Source: ABhQp+TPdYNfg9Drda63bxFl7uhldNDt3eBoa5R8Ib6EPDyMSHMx30TL2ONs8umG1OdAdkZsUPAK8gaL+WPWt+f1YdE=
X-Received: by 10.202.81.84 with SMTP id f81mr8665364oib.171.1508282096435;
 Tue, 17 Oct 2017 16:14:56 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.157.49.99 with HTTP; Tue, 17 Oct 2017 16:14:56 -0700 (PDT)
In-Reply-To: <59E5C677.9010307@HIDDEN>
References: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>
 <59E46AFA.8060502@HIDDEN> <83vajff7rt.fsf@HIDDEN>
 <CAM1nYoGx9TxLTXnc61W9NFQnZFfusFatOrtS1OoJ34F55v+uuA@HIDDEN>
 <59E5C677.9010307@HIDDEN>
From: Levi <wacossusca34@HIDDEN>
Date: Tue, 17 Oct 2017 16:14:56 -0700
Message-ID: <CAM1nYoHo5UcE+vA1-gHjXbzXYBOwkoV9bk8Gcdv2of3-d1SxeA@HIDDEN>
Subject: Re: bug#28862: Emacs 25.3.1 segmentation fault on killing *Colors*
 buffer
To: martin rudalics <rudalics@HIDDEN>, 28862 <at> debbugs.gnu.org
Content-Type: multipart/alternative; boundary="001a113b034094465c055bc64add"
X-Spam-Score: 0.7 (/)
X-Debbugs-Envelope-To: 28862
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.7 (/)

--001a113b034094465c055bc64add
Content-Type: text/plain; charset="UTF-8"

Yes, all the tests (except for the one mentioned where I used my own
config) were using `emacs -Q`. Attempting to remove the `window-list` call,
resulted in the following code:

(add-hook 'delete-frame-functions
          (lambda (frame)
            (kill-buffer "*Colors*")))

-- which did not prevent Emacs 26.0.90 from crashing if the given steps
were used.

Have you (or anyone else) been able to reproduce the issue? If not, I can
start looking at other potential factors on my system.

--001a113b034094465c055bc64add
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div>Yes, all the tests (except for the one mentioned=
 where I used my own config) were using `emacs -Q`. Attempting to remove th=
e `window-list` call, resulted in the following code:<br><span style=3D"fon=
t-family:monospace,monospace"><br></span><span class=3D"gmail-im"><span sty=
le=3D"font-family:monospace,monospace">(add-hook &#39;delete-frame-function=
s<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (lambda (frame)=
<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (kil=
l-buffer &quot;*Colors*&quot;)))</span><br><br></span></div><span class=3D"=
gmail-im">-- which did not prevent Emacs 26.0.90 from crashing if the given=
 steps were used.<br><br></span></div><span class=3D"gmail-im">Have you (or=
 anyone else) been able to reproduce the issue? If not, I can start looking=
 at other potential factors on my system.<br></span></div>

--001a113b034094465c055bc64add--




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#28862; Package emacs. Full text available.

Message received at 28862 <at> debbugs.gnu.org:


Received: (at 28862) by debbugs.gnu.org; 17 Oct 2017 08:59:51 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Tue Oct 17 04:59:51 2017
Received: from localhost ([127.0.0.1]:44878 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1e4Nj5-0001dT-Dy
	for submit <at> debbugs.gnu.org; Tue, 17 Oct 2017 04:59:51 -0400
Received: from mout.gmx.net ([212.227.15.18]:61354)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <rudalics@HIDDEN>) id 1e4Nj3-0001dA-SQ
 for 28862 <at> debbugs.gnu.org; Tue, 17 Oct 2017 04:59:50 -0400
Received: from [192.168.1.100] ([46.125.249.51]) by mail.gmx.com (mrgmx002
 [212.227.17.190]) with ESMTPSA (Nemesis) id 0LxgHz-1dBVrw2bUp-017FZG; Tue, 17
 Oct 2017 10:59:43 +0200
Message-ID: <59E5C677.9010307@HIDDEN>
Date: Tue, 17 Oct 2017 10:59:35 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Levi <wacossusca34@HIDDEN>, 28862 <at> debbugs.gnu.org
Subject: Re: bug#28862: Emacs 25.3.1 segmentation fault on killing *Colors*
 buffer
References: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>	<59E46AFA.8060502@HIDDEN>
 <83vajff7rt.fsf@HIDDEN>
 <CAM1nYoGx9TxLTXnc61W9NFQnZFfusFatOrtS1OoJ34F55v+uuA@HIDDEN>
In-Reply-To: <CAM1nYoGx9TxLTXnc61W9NFQnZFfusFatOrtS1OoJ34F55v+uuA@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:QXvXSFdUpQVjlR9o0P+J07HW+bX969F1Wg12I3ywC6W0cnSf5R+
 px2SMAQvlb97rq0FeDkQFUvT9kTdDXO8s15nSdrpHb17yEkwi0ZUXacBkUa7pwNxpAtwwU/
 Sr8+s1deOKSo/tefO6n44236MHqRsjW5uumOmubDHWOp5Iyhq15emf1XBr+ZcM3S9UtQfcv
 RuMeDBJtXagsXB7QYLNow==
X-UI-Out-Filterresults: notjunk:1;V01:K0:p6m/YG9r4is=:w7a4XPDeUYS3A4ymR5bjFs
 9nrf126UDvZLDAVfY7wN9l/0QOdWmdxpr+j4fz/90Yww8spyCNtn82kj95Gda8kw47nRLl3ID
 4UhFpOyZhFQvhBZ22Et+o8IBlKC+aYjYjmQ2yTic8bixgbWIND5FCH8h418U6zlaFbGTN4elC
 iEmdcuB8SqsiwD9Fxb+3h05QaWlPSBSFEbBJg8emBUfpXAfWKynDsAADsS4wV60l+2lehPJrP
 BxF0RQOKGFCeU+Y+o8XWMS4rdeAPcXC3OOvMJYkySWxZKUkZwdgpzPD9gPx0m3om5BuXwLPro
 bIPg9BtItWZqakGGI0UT9PBuGzgfZwBhne/ENcSIwM5ktSLy3LtIUETUBHhnQULWHfDOorRLG
 7503gpFBXOJ5z7h+dVtMCuKw+YRvyIosz/WD5JnC/KH08dAyZB7Xom26jrSJNP7PlcczTr+e6
 npdLBo8mJqmGSsh9pBxKEqAmW3U7uGA+QNgWHsvxJI4Rs4k31v288Do0lxKPPU82EOTXVj0Fk
 gOT5DuTkpGEQJ8gtTbTbohu/C2Q+XBXRi1bzWiDOfWKQlgvtf7JMzzZlt+dYCDa9Co2tAnr0l
 4wi+qMJsvs6J6ZS3J8/EuHhVvi8UJ2HNlXatF4HSE/03M9bMXmhFPIbR2uL+rFEccqlJ+cZyi
 ZXj8Jg4HILqj+on+S4cNp2HLP43Srn5uIG8SVQiL/EAvisQtGu0qBcsRyTxAw+dzY/pRvLvYq
 FPKeFKq1g3e4UVZCGJZ6hxq/4OjXtdStKCSuv2HJhSC64d8ZIjEieTJAfNSRdY2lzq0L7s+1j
 sv4Er7SSFMskOpk29VLY35AHloOmFXsauq5V9kg7kSMV9NH472dVheyDmf7l/xYuPAx+Xh7
X-Spam-Score: 2.0 (++)
X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 Content preview: > I tried running emacs through GDB in order to get a
 backtrace, 
 but couldn't > reproduce the crash there (memory corruption issue). Attaching
 to the > process with `gdb -p <pid>` allowed me to obtain this dump: [...]
 Content analysis details:   (2.0 points, 10.0 required)
 pts rule name              description
 ---- ---------------------- --------------------------------------------------
 1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
 [Blocked - see <http://www.spamcop.net/bl.shtml?46.125.249.51>]
 1.5 RCVD_IN_SORBS_WEB      RBL: SORBS: sender is an abusable web server
 [46.125.249.51 listed in dnsbl.sorbs.net]
 -0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
 trust [212.227.15.18 listed in list.dnswl.org]
 -0.0 SPF_PASS               SPF: sender matches SPF record
 0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
 (rudalics[at]gmx.at)
X-Debbugs-Envelope-To: 28862
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 2.0 (++)
X-Spam-Report: Spam detection software, running on the system "debbugs.gnu.org",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 the administrator of that system for details.
 
 Content preview:  > I tried running emacs through GDB in order to get a backtrace,
    but couldn't > reproduce the crash there (memory corruption issue). Attaching
    to the > process with `gdb -p <pid>` allowed me to obtain this dump: [...]
    
 
 Content analysis details:   (2.0 points, 10.0 required)
 
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
                [Blocked - see <http://www.spamcop.net/bl.shtml?46.125.249.51>]
  1.5 RCVD_IN_SORBS_WEB      RBL: SORBS: sender is an abusable web server
                             [46.125.249.51 listed in dnsbl.sorbs.net]
 -0.7 RCVD_IN_DNSWL_LOW      RBL: Sender listed at http://www.dnswl.org/, low
                             trust
                             [212.227.15.18 listed in list.dnswl.org]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 FREEMAIL_FROM          Sender email is commonly abused enduser mail provider
                             (rudalics[at]gmx.at)

 > I tried running emacs through GDB in order to get a backtrace, but cou=
ldn't
 > reproduce the crash there (memory corruption issue). Attaching to the
 > process with `gdb -p <pid>` allowed me to obtain this dump:

Is this with emacs -Q and your original scenario, i.e., just the

(add-hook 'delete-frame-functions
           (lambda (frame)
             (dolist (elem (window-list frame))
               (kill-buffer (window-buffer elem)))))

addition?  If you simplify that to removing the =E2=80=98window-list=E2=80=
=99 call and
only kill the *Colors* buffer does the crash occur as well?

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#28862; Package emacs. Full text available.

Message received at 28862 <at> debbugs.gnu.org:


Received: (at 28862) by debbugs.gnu.org; 17 Oct 2017 02:30:43 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Oct 16 22:30:43 2017
Received: from localhost ([127.0.0.1]:44540 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1e4HeV-0000dC-0P
	for submit <at> debbugs.gnu.org; Mon, 16 Oct 2017 22:30:43 -0400
Received: from mail-oi0-f53.google.com ([209.85.218.53]:56305)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <wacossusca34@HIDDEN>) id 1e4HeS-0000cy-7w
 for 28862 <at> debbugs.gnu.org; Mon, 16 Oct 2017 22:30:41 -0400
Received: by mail-oi0-f53.google.com with SMTP id g125so397050oib.12
 for <28862 <at> debbugs.gnu.org>; Mon, 16 Oct 2017 19:30:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=mime-version:in-reply-to:references:from:date:message-id:subject:to;
 bh=1QUQTw+cJgoYBukNR76qB+ub6Y7Mp4TiHulE2h4pgi0=;
 b=hzmiJCQ0gyBQIxnVDP+UjKf810HkvxFXqtWQ2UtH+yoPPl1cimje30i4gHN21Ou1dN
 rZFL50WY02hpquVj11MltMbKH56wiEMx+cGWP2q9QsQzMWL1EmhYpE4BBfUULgv3Wy/0
 p43yfFDKR8iX5JhcGMDlK4gqbSqxSZ7huOH6blAZc+VCOw0lSE/8u5jWykQCYj6HcgYg
 CCp8a+NRhgPbRJcd75gjlhj9epIL+vyltnP9osY6eTxFlJxZ13aVwoSCIRiS4g14P5Wh
 likMRzafD1fG7ubLZ0GJ7pW4wAMbYo7Jv2XWa0u9Qy2OkGNz95OvInfogRsR5AzLMzxO
 +8Rg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:in-reply-to:references:from:date
 :message-id:subject:to;
 bh=1QUQTw+cJgoYBukNR76qB+ub6Y7Mp4TiHulE2h4pgi0=;
 b=h9grPAqTkFiBkj5W5jXANJ3lyPqER9nilbAeAEhYyYav+zpaxYfA1bcOfCzHCoRgFu
 SRp9oETLw5nA91cfxF6H7zpDqcTualNOht8xIa204v34lFTCofui5iHDcN523f0B3z1I
 1AoA0MegEvXfHqa8UDj0uKjgGWxbZFaQQqNkLXx4no4L+QBwo4B7hO9oFUZoh8Izc/O0
 BRRTGgZ5zt1YSYMGVe6l6fkzrfCcrrWpSP/bD0AJ0TOpOe0TKIN/8aZkzA0NFULtjieD
 2d/oUU0hhXzSBrt7IeyvA17aNpYeLdNej6NWZWLwM9EqzdYr6vx53FohXuSYJqhQvFXi
 lwvg==
X-Gm-Message-State: AMCzsaXfsZSmEo8ydrms2EXj4QUVGRRvrsAk8ORXBPLvUCQHTfTgBEWp
 D1QajT1qdYBu16eWefDbi8WthMiMCS32UjtXUyuuBg==
X-Google-Smtp-Source: ABhQp+QFa6qj/2vPsMpoJ1smADB6I8PcH5dgy8bqNhabkl/nizoBlhG1/ZiD22ywk2+uikCkNH1evdhFIJ288OD6HJw=
X-Received: by 10.157.17.220 with SMTP id y28mr1562649oty.296.1508207434295;
 Mon, 16 Oct 2017 19:30:34 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.157.49.99 with HTTP; Mon, 16 Oct 2017 19:30:33 -0700 (PDT)
In-Reply-To: <83vajff7rt.fsf@HIDDEN>
References: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>
 <59E46AFA.8060502@HIDDEN> <83vajff7rt.fsf@HIDDEN>
From: Levi <wacossusca34@HIDDEN>
Date: Mon, 16 Oct 2017 19:30:33 -0700
Message-ID: <CAM1nYoGx9TxLTXnc61W9NFQnZFfusFatOrtS1OoJ34F55v+uuA@HIDDEN>
Subject: Re: bug#28862: Emacs 25.3.1 segmentation fault on killing *Colors*
 buffer
To: 28862 <at> debbugs.gnu.org
Content-Type: multipart/alternative; boundary="94eb2c1913c45e6ed3055bb4e89d"
X-Spam-Score: 0.7 (/)
X-Debbugs-Envelope-To: 28862
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: 0.7 (/)

--94eb2c1913c45e6ed3055bb4e89d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hey, Emacs 26.0.90 seems to have a similar bug when going through the same
steps on my system. If other users can't reproduce this, it may also be
related to the window manager's behaviour -- although that would still be
strange.

With 26.0.90, Emacs always hangs when trying to reproduce the issue, and
prints to stderr: 'Fatal error 11: Segmentation fault'. Sending SIGTERM or
^C does not terminate the process, only killing it works.

I tried running emacs through GDB in order to get a backtrace, but couldn't
reproduce the crash there (memory corruption issue). Attaching to the
process with `gdb -p <pid>` allowed me to obtain this dump:

#0  0x00007f66ca0a038b in __lll_lock_wait_private () at /usr/lib/libc.so.6
#1  0x00007f66ca01c609 in _int_free () at /usr/lib/libc.so.6
#2  0x00007f66cc8a7a43 in xmlCleanupCharEncodingHandlers () at
/usr/lib/libxml2.so.2
#3  0x00007f66cc8c6819 in xmlCleanupParser () at /usr/lib/libxml2.so.2
#4  0x00000000005c7a95 in xml_cleanup_parser () at xml.c:266
#5  0x00000000004f5cf2 in shut_down_emacs (sig=3Dsig@entry=3D11,
stuff=3Dstuff@entry=3D0)
    at emacs.c:2122
#6  0x00000000004f5ec3 in terminate_due_to_signal (sig=3Dsig@entry=3D11,
backtrace_limit=3Dbacktrace_limit@entry=3D40) at emacs.c:377
#7  0x000000000050e3ce in handle_fatal_signal (sig=3Dsig@entry=3D11) at
sysdep.c:1768
#8  0x000000000050e5e8 in deliver_thread_signal (sig=3D11, handler=3D0x50e3=
c0
<handle_fatal_signal>) at sysdep.c:1742
#9  0x000000000050e66c in deliver_fatal_thread_signal (sig=3D<optimized out=
>)
    at sysdep.c:1780
#10 0x000000000050e66c in handle_sigsegv (sig=3D<optimized out>,
siginfo=3D<optimized out>, arg=3D<optimized out>) at sysdep.c:1865
#11 0x00007f66cac72da0 in <signal handler called> () at
/usr/lib/libpthread.so.0
#12 0x00007f66ca01afc3 in malloc_consolidate () at /usr/lib/libc.so.6
#13 0x00007f66ca01df52 in _int_malloc () at /usr/lib/libc.so.6
#14 0x00007f66ca01faf4 in malloc () at /usr/lib/libc.so.6
#15 0x00000000005eb6d5 in hybrid_malloc (size=3D<optimized out>) at
gmalloc.c:1734
#16 0x000000000054faad in lmalloc (size=3D4096) at alloc.c:1450
#17 0x000000000054faad in xmalloc (size=3Dsize@entry=3D4096) at alloc.c:846
#18 0x0000000000550bb3 in allocate_vector_block () at alloc.c:3063
#19 0x0000000000550bb3 in allocate_vector_from_block (nbytes=3D1160) at
alloc.c:3127
#20 0x0000000000550bb3 in allocate_vectorlike (len=3D144) at alloc.c:3332
#21 0x000000000055181d in allocate_vectorlike (len=3D144) at alloc.c:3376
#22 0x000000000055181d in allocate_vector (len=3Dlen@entry=3D144) at
alloc.c:3372
#23 0x0000000000551967 in Fmake_vector (length=3Dlength@entry=3D578,
init=3Dinit@entry=3D0)
    at alloc.c:3466
#24 0x0000000000575116 in concat (nargs=3Dnargs@entry=3D1,
args=3Dargs@entry=3D0x7fff73dbe7f8,
target_type=3DLisp_Vectorlike, last_special=3Dlast_special@entry=3Dfalse) a=
t
fns.c:648
#25 0x0000000000575260 in Fcopy_sequence (arg=3D<optimized out>) at fns.c:5=
14
#26 0x00000000004334d2 in update_tool_bar (f=3Df@entry=3D0x114dc30
<bss_sbrk_buffer+5520464>, save_match_data=3Dsave_match_data@entry=3Dfalse)=
 at
xdisp.c:12272
#27 0x00000000004579d3 in update_tool_bar (save_match_data=3Dfalse,
f=3D<optimized out>)
    at xdisp.c:12217
#28 0x00000000004579d3 in prepare_menu_bars () at xdisp.c:12054
#29 0x00000000004579d3 in redisplay_internal () at xdisp.c:13907
#30 0x00000000004591d5 in redisplay_preserve_echo_area
(from_where=3Dfrom_where@entry=3D5) at xdisp.c:14602
#31 0x00000000004fff3a in read_char (commandflag=3Dcommandflag@entry=3D1,
map=3Dmap@entry=3D70360643, prev_event=3D0,
used_mouse_menu=3Dused_mouse_menu@entry=3D0x7fff73dc027b,
end_time=3Dend_time@entry=3D0x0) at keyboard.c:2478
#32 0x0000000000502dac in read_key_sequence
(keybuf=3Dkeybuf@entry=3D0x7fff73dc0370,
prompt=3Dprompt@entry=3D0, dont_downcase_last=3Ddont_downcase_last@entry=3D=
false,
can_return_switch_frame=3Dcan_return_switch_frame@entry=3Dtrue,
fix_current_buffer=3Dfix_current_buffer@entry=3Dtrue, prevent_redisplay=3Dp=
revent_
redisplay@entry=3Dfalse, bufsize=3D30)
    at keyboard.c:9147
#33 0x00000000005047e4 in command_loop_1 () at keyboard.c:1368
#34 0x000000000056a8be in internal_condition_case (bfun=3Dbfun@entry=3D0x50=
45c0
<command_loop_1>, handlers=3Dhandlers@entry=3D21024, hfun=3Dhfun@entry=3D0x=
4fb4d0
<cmd_error>)
    at eval.c:1332
#35 0x00000000004f62a4 in command_loop_2 (ignore=3Dignore@entry=3D0) at
keyboard.c:1110
#36 0x000000000056a82d in internal_catch (tag=3Dtag@entry=3D50880,
func=3Dfunc@entry=3D0x4f6280 <command_loop_2>, arg=3Darg@entry=3D0) at eval=
.c:1097
#37 0x00000000004f623b in command_loop () at keyboard.c:1089
#38 0x00000000004fb0e3 in recursive_edit_1 () at keyboard.c:695
#39 0x00000000004fb3fe in Frecursive_edit () at keyboard.c:766
#40 0x0000000000419ffe in main (argc=3D<optimized out>, argv=3D0x7fff73dc07=
28)
    at emacs.c:1713

It looks like this time around the stack isn't corrupted, and symbol
information is there.

Another point is that during one of the runs (albiet with my own
configuration, rather than `emacs -Q`) is that I got the process to hang
with the following output instead:

*** Error in `./emacs': malloc(): memory corruption (fast):
0x0000000004066390 ***
Fatal error 6: Aborted

Is there a quick workaround I can use to avoid this crash for the time
being? I would like to close all visible buffers when a frame is
closed/deleted, like how I was initially doing so via
'delete-frame-functions.

Thanks in advance,

-Levi

On Mon, Oct 16, 2017 at 8:10 AM, Eli Zaretskii <eliz@HIDDEN> wrote:

> > Date: Mon, 16 Oct 2017 10:16:58 +0200
> > From: martin rudalics <rudalics@HIDDEN>
> >
> > Now if killing a buffer in =E2=80=98delete-frame-functions=E2=80=99 may=
 delete a frame
> > because, for example, the buffer is shown in a dedicated window which i=
s
> > the only window on that frame, you may run exactly in the scenario
> > described above.  I hopefully fixed that for Emacs 26 so if you could
> > try the release version ...
>
> FWIW, the recipe doesn't crash for me in Emacs 26.0.90, so I guess
> your fix solved at least this case.
>
> Thanks.
>

--94eb2c1913c45e6ed3055bb4e89d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hey, Emacs 26.0.90 seems to have a similar bug when g=
oing through=20
the same steps on my system. If other users can&#39;t reproduce this, it ma=
y
 also be related to the window manager&#39;s behaviour -- although that=20
would still be strange.<br></div><div><br></div><div>With 26.0.90, Emacs
 always hangs when trying to reproduce the issue, and prints to stderr:=20
&#39;Fatal error 11: Segmentation fault&#39;. Sending SIGTERM or ^C does no=
t=20
terminate the process, only killing it works.<br><br></div><div>I tried=20
running emacs through GDB in order to get a backtrace, but couldn&#39;t=20
reproduce the crash there (memory corruption issue). Attaching to the=20
process with `gdb -p &lt;pid&gt;` allowed me to obtain this dump:<br><br><s=
pan style=3D"font-family:monospace,monospace">#0=C2=A0 0x00007f66ca0a038b i=
n __lll_lock_wait_private () at /usr/lib/libc.so.6<br>#1=C2=A0 0x00007f66ca=
01c609 in _int_free () at /usr/lib/libc.so.6<br>#2=C2=A0 0x00007f66cc8a7a43=
 in xmlCleanupCharEncodingHandlers () at /usr/lib/libxml2.so.2<br>#3=C2=A0 =
0x00007f66cc8c6819 in xmlCleanupParser () at /usr/lib/libxml2.so.2<br>#4=C2=
=A0 0x00000000005c7a95 in xml_cleanup_parser () at xml.c:266<br>#5=C2=A0 0x=
00000000004f5cf2 in shut_down_emacs (sig=3Dsig@entry=3D11, stuff=3Dstuff@en=
try=3D0)<br>=C2=A0=C2=A0=C2=A0 at emacs.c:2122<br>#6=C2=A0 0x00000000004f5e=
c3 in terminate_due_to_signal (sig=3Dsig@entry=3D11, backtrace_limit=3Dback=
trace_<wbr>limit@entry=3D40) at emacs.c:377<br>#7=C2=A0 0x000000000050e3ce =
in handle_fatal_signal (sig=3Dsig@entry=3D11) at sysdep.c:1768<br>#8=C2=A0 =
0x000000000050e5e8 in deliver_thread_signal (sig=3D11, handler=3D0x50e3c0 &=
lt;handle_fatal_signal&gt;) at sysdep.c:1742<br>#9=C2=A0 0x000000000050e66c=
 in deliver_fatal_thread_signal (sig=3D&lt;optimized out&gt;)<br>=C2=A0=C2=
=A0=C2=A0 at sysdep.c:1780<br>#10
 0x000000000050e66c in handle_sigsegv (sig=3D&lt;optimized out&gt;,=20
siginfo=3D&lt;optimized out&gt;, arg=3D&lt;optimized out&gt;) at=20
sysdep.c:1865<br>#11 0x00007f66cac72da0 in &lt;signal handler called&gt; ()=
 at /usr/lib/libpthread.so.0<br>#12 0x00007f66ca01afc3 in malloc_consolidat=
e () at /usr/lib/libc.so.6<br>#13 0x00007f66ca01df52 in _int_malloc () at /=
usr/lib/libc.so.6<br>#14 0x00007f66ca01faf4 in malloc () at /usr/lib/libc.s=
o.6<br>#15 0x00000000005eb6d5 in hybrid_malloc (size=3D&lt;optimized out&gt=
;) at gmalloc.c:1734<br>#16 0x000000000054faad in lmalloc (size=3D4096) at =
alloc.c:1450<br>#17 0x000000000054faad in xmalloc (size=3Dsize@entry=3D4096=
) at alloc.c:846<br>#18 0x0000000000550bb3 in allocate_vector_block () at a=
lloc.c:3063<br>#19 0x0000000000550bb3 in allocate_vector_from_block (nbytes=
=3D1160) at alloc.c:3127<br>#20 0x0000000000550bb3 in allocate_vectorlike (=
len=3D144) at alloc.c:3332<br>#21 0x000000000055181d in allocate_vectorlike=
 (len=3D144) at alloc.c:3376<br>#22 0x000000000055181d in allocate_vector (=
len=3Dlen@entry=3D144) at alloc.c:3372<br>#23 0x0000000000551967 in Fmake_v=
ector (length=3Dlength@entry=3D578, init=3Dinit@entry=3D0)<br>=C2=A0=C2=A0=
=C2=A0 at alloc.c:3466<br>#24 0x0000000000575116 in concat (nargs=3Dnargs@e=
ntry=3D1, args=3Dargs@entry=3D<wbr>0x7fff73dbe7f8, target_type=3DLisp_Vecto=
rlike, last_special=3Dlast_special@<wbr>entry=3Dfalse) at fns.c:648<br>#25 =
0x0000000000575260 in Fcopy_sequence (arg=3D&lt;optimized out&gt;) at fns.c=
:514<br>#26 0x00000000004334d2 in update_tool_bar (f=3Df@entry=3D0x114dc30 =
&lt;bss_sbrk_buffer+5520464&gt;, save_match_data=3Dsave_match_<wbr>data@ent=
ry=3Dfalse) at xdisp.c:12272<br>#27 0x00000000004579d3 in update_tool_bar (=
save_match_data=3Dfalse, f=3D&lt;optimized out&gt;)<br>=C2=A0=C2=A0=C2=A0 a=
t xdisp.c:12217<br>#28 0x00000000004579d3 in prepare_menu_bars () at xdisp.=
c:12054<br>#29 0x00000000004579d3 in redisplay_internal () at xdisp.c:13907=
<br>#30 0x00000000004591d5 in redisplay_preserve_echo_area (from_where=3Dfr=
om_where@entry=3D<wbr>5) at xdisp.c:14602<br>#31 0x00000000004fff3a in read=
_char (commandflag=3Dcommandflag@entry<wbr>=3D1, map=3Dmap@entry=3D70360643=
, prev_event=3D0, used_mouse_menu=3Dused_mouse_<wbr>menu@entry=3D0x7fff73dc=
027b, end_time=3Dend_time@entry=3D0x0) at keyboard.c:2478<br>#32 0x00000000=
00502dac in read_key_sequence (keybuf=3Dkeybuf@entry=3D<wbr>0x7fff73dc0370,=
 prompt=3Dprompt@entry=3D0, dont_downcase_last=3Ddont_<wbr>downcase_last@en=
try=3Dfalse, can_return_switch_frame=3Dcan_<wbr>return_switch_frame@entry=
=3D<wbr>true, fix_current_buffer=3Dfix_<wbr>current_buffer@entry=3Dtrue, pr=
event_redisplay=3Dprevent_<wbr>redisplay@entry=3Dfalse, bufsize=3D30)<br>=
=C2=A0=C2=A0=C2=A0 at keyboard.c:9147<br>#33 0x00000000005047e4 in command_=
loop_1 () at keyboard.c:1368<br>#34
 0x000000000056a8be in internal_condition_case (bfun=3Dbfun@entry=3D0x5045c=
0
 &lt;command_loop_1&gt;, handlers=3Dhandlers@entry=3D21024,=20
hfun=3Dhfun@entry=3D0x4fb4d0 &lt;cmd_error&gt;)<br>=C2=A0=C2=A0=C2=A0 at ev=
al.c:1332<br>#35 0x00000000004f62a4 in command_loop_2 (ignore=3Dignore@entr=
y=3D0) at keyboard.c:1110<br>#36
 0x000000000056a82d in internal_catch (tag=3Dtag@entry=3D50880,=20
func=3Dfunc@entry=3D0x4f6280 &lt;command_loop_2&gt;, arg=3Darg@entry=3D0) a=
t=20
eval.c:1097<br>#37 0x00000000004f623b in command_loop () at keyboard.c:1089=
<br>#38 0x00000000004fb0e3 in recursive_edit_1 () at keyboard.c:695<br>#39 =
0x00000000004fb3fe in Frecursive_edit () at keyboard.c:766<br>#40 0x0000000=
000419ffe in main (argc=3D&lt;optimized out&gt;, argv=3D0x7fff73dc0728)<br>=
=C2=A0=C2=A0=C2=A0 at emacs.c:1713</span><br></div><div><br></div><div>It l=
ooks like this time around the stack isn&#39;t corrupted, and symbol inform=
ation is there.<br></div><div><br></div><div>Another
 point is that during one of the runs (albiet with my own configuration,
 rather than `emacs -Q`) is that I got the process to hang with the=20
following output instead:<br><br><span style=3D"font-family:monospace,monos=
pace">*** Error in `./emacs&#39;: malloc(): memory corruption (fast): 0x000=
0000004066390 ***<br>Fatal error 6: Aborted</span></div><div><span style=3D=
"font-family:arial,helvetica,sans-serif"><br></span></div><div><span style=
=3D"font-family:arial,helvetica,sans-serif">Is
 there a quick workaround I can use to avoid this crash for the time=20
being? I would like to close all visible buffers when a frame is=20
closed/deleted, like how I was initially doing so via=20
&#39;delete-frame-functions.<br><br></span></div><div><span style=3D"font-f=
amily:arial,helvetica,sans-serif">Thanks in advance,<br><br></span></div><s=
pan style=3D"font-family:arial,helvetica,sans-serif">-Levi</span></div><div=
 class=3D"gmail_extra"><br><div class=3D"gmail_quote">On Mon, Oct 16, 2017 =
at 8:10 AM, Eli Zaretskii <span dir=3D"ltr">&lt;<a href=3D"mailto:eliz@gnu.=
org" target=3D"_blank">eliz@HIDDEN</a>&gt;</span> wrote:<br><blockquote cl=
ass=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;p=
adding-left:1ex">&gt; Date: Mon, 16 Oct 2017 10:16:58 +0200<br>
&gt; From: martin rudalics &lt;<a href=3D"mailto:rudalics@HIDDEN">rudalics@=
gmx.at</a>&gt;<br>
<span class=3D"">&gt;<br>
&gt; Now if killing a buffer in =E2=80=98delete-frame-functions=E2=80=99 ma=
y delete a frame<br>
&gt; because, for example, the buffer is shown in a dedicated window which =
is<br>
&gt; the only window on that frame, you may run exactly in the scenario<br>
&gt; described above.=C2=A0 I hopefully fixed that for Emacs 26 so if you c=
ould<br>
&gt; try the release version ...<br>
<br>
</span>FWIW, the recipe doesn&#39;t crash for me in Emacs 26.0.90, so I gue=
ss<br>
your fix solved at least this case.<br>
<br>
Thanks.<br>
</blockquote></div><br></div>

--94eb2c1913c45e6ed3055bb4e89d--




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#28862; Package emacs. Full text available.

Message received at 28862 <at> debbugs.gnu.org:


Received: (at 28862) by debbugs.gnu.org; 16 Oct 2017 15:10:58 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Oct 16 11:10:58 2017
Received: from localhost ([127.0.0.1]:43975 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1e472g-0001ZA-9m
	for submit <at> debbugs.gnu.org; Mon, 16 Oct 2017 11:10:58 -0400
Received: from eggs.gnu.org ([208.118.235.92]:45065)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <eliz@HIDDEN>) id 1e472e-0001Yx-Oi
 for 28862 <at> debbugs.gnu.org; Mon, 16 Oct 2017 11:10:57 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <eliz@HIDDEN>) id 1e472U-0007X0-23
 for 28862 <at> debbugs.gnu.org; Mon, 16 Oct 2017 11:10:51 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,RP_MATCHES_RCVD
 autolearn=disabled version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:55760)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <eliz@HIDDEN>)
 id 1e472T-0007Wu-Uo; Mon, 16 Oct 2017 11:10:45 -0400
Received: from [176.228.60.248] (port=1968 helo=home-c4e4a596f7)
 by fencepost.gnu.org with esmtpsa (TLS1.2:RSA_AES_256_CBC_SHA1:256)
 (Exim 4.82) (envelope-from <eliz@HIDDEN>)
 id 1e472T-0001hh-9e; Mon, 16 Oct 2017 11:10:45 -0400
Date: Mon, 16 Oct 2017 18:10:30 +0300
Message-Id: <83vajff7rt.fsf@HIDDEN>
From: Eli Zaretskii <eliz@HIDDEN>
To: martin rudalics <rudalics@HIDDEN>
In-reply-to: <59E46AFA.8060502@HIDDEN> (message from martin rudalics on Mon,
 16 Oct 2017 10:16:58 +0200)
Subject: Re: bug#28862: Emacs 25.3.1 segmentation fault on killing *Colors*
 buffer
References: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>
 <59E46AFA.8060502@HIDDEN>
MIME-version: 1.0
Content-type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 28862
Cc: wacossusca34@HIDDEN, 28862 <at> debbugs.gnu.org
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Reply-To: Eli Zaretskii <eliz@HIDDEN>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -5.0 (-----)

> Date: Mon, 16 Oct 2017 10:16:58 +0200
> From: martin rudalics <rudalics@HIDDEN>
> 
> Now if killing a buffer in ‘delete-frame-functions’ may delete a frame
> because, for example, the buffer is shown in a dedicated window which is
> the only window on that frame, you may run exactly in the scenario
> described above.  I hopefully fixed that for Emacs 26 so if you could
> try the release version ...

FWIW, the recipe doesn't crash for me in Emacs 26.0.90, so I guess
your fix solved at least this case.

Thanks.




Information forwarded to bug-gnu-emacs@HIDDEN:
bug#28862; Package emacs. Full text available.

Message received at 28862 <at> debbugs.gnu.org:


Received: (at 28862) by debbugs.gnu.org; 16 Oct 2017 08:17:13 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Oct 16 04:17:12 2017
Received: from localhost ([127.0.0.1]:42471 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1e40aG-0000JI-ML
	for submit <at> debbugs.gnu.org; Mon, 16 Oct 2017 04:17:12 -0400
Received: from mout.gmx.net ([212.227.15.19]:57857)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <rudalics@HIDDEN>) id 1e40aF-0000J3-5F
 for 28862 <at> debbugs.gnu.org; Mon, 16 Oct 2017 04:17:11 -0400
Received: from [192.168.1.100] ([46.125.249.64]) by mail.gmx.com (mrgmx002
 [212.227.17.190]) with ESMTPSA (Nemesis) id 0MMBun-1e9nLh0IO5-0083hs; Mon, 16
 Oct 2017 10:17:04 +0200
Message-ID: <59E46AFA.8060502@HIDDEN>
Date: Mon, 16 Oct 2017 10:16:58 +0200
From: martin rudalics <rudalics@HIDDEN>
MIME-Version: 1.0
To: Levi <wacossusca34@HIDDEN>, 28862 <at> debbugs.gnu.org
Subject: Re: bug#28862: Emacs 25.3.1 segmentation fault on killing *Colors*
 buffer
References: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>
In-Reply-To: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: quoted-printable
X-Provags-ID: V03:K0:WZlFDav8+p+e0hCaQSJCtS2e+Dz95U0cCyVR37HrWa+TeusrsMT
 2c3vqZcxOJ3wP3z1ae2vfIqNBpCYbjqpFaY4Y5mXk8BgETgJMbyO4vyCKLaobe1GqrP0xY/
 3x/q0oxuznNseODDCp1NyANvf4eX8Q2q8IJo8OXiOKhqkjzPtXWYMD+Edys6eZR1EHgWC1e
 YIaTBx1QuZCiJuo/Q7SYA==
X-UI-Out-Filterresults: notjunk:1;V01:K0:Kyd5glK1f3w=:mELQ9cBSg4bhryMXMDfGp6
 jj5IkxkqDDdEJfdDIqHfrQ4nrkVYykwmOW0iN7sjbDwZMmFZjBUV96Ofnemdv7SSDIEq9f5Fo
 jgy6jG27/XPKAD1l4A2xkWjihHtKbFyZluSJgo6oR06ONT3Au04dw/htKI1O0h2Bees8R/Jni
 2R6DrFE/EudJcBnOpGKoTNiY7SYzGvBhsLI4y6Hpkb7VR4O2oCp7H++RO9dUPopsFKlNjIfXU
 ep6J4A3nmCu8bP9fA4RgxU8FSdG+IqmU7rfldQHx2zNWCohr0XaTECvTfolqHu7QDCmWa59/q
 B9+bsB1FLkQ7y3Ie5TwQyDSsW1NgYPRP+WoYfTsWc9+XeESMvolwIObKbqwKgfwvHe1oJ3nAG
 uDGwVCc4JfZvdOLlCQKqTz968U+I4fZR7z10ffht35ScTX0H89+FPt12wOLTAz3fKTcLY8Zi0
 D0bxg8bL5N+XPLPJCF1QICI9T724L7fv+B2Vry2vNjojaB5FkSV9zuoRvYDvxKHdtW8eS3Ea7
 FiCoJLKEMUEc6isWgzZkYgdqDvUR8KmkyBSdDU4TRxpy5HKxLB/Lzcs/3v4KdjPTYsKYoJG6j
 y/hwC64o1hGCv93yMqkrfgacOxQKYx51/qmmPnbPxySUqGUl/l1Woc8fwDxT90XQwzq2upukt
 qsL6m0e4VqXxmW3TCHmETgHG4h8Q01Zhwh7uebHtb7uj9CoCRydizk83Dj0J1U80s1sHYv4aC
 nJYgw4VdKmcI6A4xXij2eD9hI48YBbpvmvN80ZyKQXuVrOUQYuHKOrFtPyGuty/mzHse/wrWH
 idt0JmE6LM84gSSqxevTfAyy74gkDDJ+2feT+2klMPHB9vaHosuL5pJu8gigMQEnt9uSlQM
X-Spam-Score: -0.7 (/)
X-Debbugs-Envelope-To: 28862
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -0.7 (/)

 > (add-hook 'delete-frame-functions
 >            (lambda (frame)
 >              (dolist (elem (window-list frame))
 >                (kill-buffer (window-buffer elem)))))

=E2=80=98delete-frame-functions=E2=80=99 must be used with great care.  F=
or example, I
can crash Emacs 25 by evaluating the following forms in row:

(defvar old-frame (selected-frame))

(defvar new-frame (make-frame))

(add-hook 'delete-frame-functions
	  (lambda (f) (delete-frame new-frame)))

(delete-frame old-frame)

Now if killing a buffer in =E2=80=98delete-frame-functions=E2=80=99 may d=
elete a frame
because, for example, the buffer is shown in a dedicated window which is
the only window on that frame, you may run exactly in the scenario
described above.  I hopefully fixed that for Emacs 26 so if you could
try the release version ...

martin





Information forwarded to bug-gnu-emacs@HIDDEN:
bug#28862; Package emacs. Full text available.

Message received at submit <at> debbugs.gnu.org:


Received: (at submit) by debbugs.gnu.org; 16 Oct 2017 07:14:56 +0000
From debbugs-submit-bounces <at> debbugs.gnu.org Mon Oct 16 03:14:55 2017
Received: from localhost ([127.0.0.1]:42361 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces <at> debbugs.gnu.org>)
	id 1e3zbz-0007BS-B0
	for submit <at> debbugs.gnu.org; Mon, 16 Oct 2017 03:14:55 -0400
Received: from mail-oi0-f47.google.com ([209.85.218.47]:48743)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <wacossusca34@HIDDEN>) id 1e3vT6-0000YT-QP
 for submit <at> debbugs.gnu.org; Sun, 15 Oct 2017 22:49:29 -0400
Received: by mail-oi0-f47.google.com with SMTP id m198so23076864oig.5
 for <submit <at> debbugs.gnu.org>; Sun, 15 Oct 2017 19:49:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025;
 h=mime-version:from:date:message-id:subject:to;
 bh=88MQEba9Hov/wT1sbNui+DGvDfn2P260LiteyaGiS3o=;
 b=fcCaJS3Hq2EET5ucxWaVZSr7JO3cisNEUjBaUQyySTY1Z/iC+txwVM++rfeLwVTBRO
 wxzCk2RLcc7GPdEqCMqXR9l5AiE2otow+pYrXXqgd3tVVRxWwip38hzyuzCk4XgM27z2
 /cZ6hxmhzxzcA5TxKAKOqANphnxX8KLwCWl1vGxsDxdnZAa+8KZSH4INHgxLvcjApQzr
 9TbBCTgi13VkQ0/MkBLUtF6NczAqbB0jFQ5Ch9oVIntLF8/dYn5qISfuLx6H+Pj1Mlh5
 OM+PcSJ97ILdcO6V3bMsFobmbuGgfn4mS9W8vmm+mxGTW6cHy4XuHdPJnm6mtQB0aJdh
 9Qgw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20161025;
 h=x-gm-message-state:mime-version:from:date:message-id:subject:to;
 bh=88MQEba9Hov/wT1sbNui+DGvDfn2P260LiteyaGiS3o=;
 b=M/u/tehAspYJCg+DjOmHVE8RBOXhMm5KoZfanI69lZZyZAN5/z891aY3rSD+d3MLVy
 hZTp3UNYleCtcV5OCuJdY8pdbtbnQAOpX0/kXRH69neJnbXk1MHmUqxPYOWmMKkdBh+Q
 cKyo2oNaElTwOXspFYXgsJKWno81+PamxcpBIJrIZFMYyCt+tX9jNqwidbP1R3tb9G3C
 0uHFi5W40+VJu7gZxbLHKQ/pVp4JrSO73Zcvap4Xnm2lTxouJsTIcRNvGHU/yak4dbmx
 k+2jKqmPLRdNAVEASH6ZOvu6xA20QDSQY+tp2RMt4dQKk4Aru/kYvX3L093yRf1f13ck
 +cBQ==
X-Gm-Message-State: AMCzsaVfX6n6nPtO2nkYEWmtcPQHDPegmvOq80I762Z6JkDMsMt802x9
 5FgumPdCMmSypMQ456ewjho0uGdcbThjSWUKI/PfDg==
X-Google-Smtp-Source: ABhQp+QyWmnssi1UKViRVjKLEi4DeBorMIpdgowZ7+b547vsHexfdW7YO7IIf4AaG4pHtsN8HFl4L1ewYJw28yDEx18=
X-Received: by 10.202.216.69 with SMTP id p66mr4202895oig.126.1508122162870;
 Sun, 15 Oct 2017 19:49:22 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.157.49.99 with HTTP; Sun, 15 Oct 2017 19:49:22 -0700 (PDT)
From: Levi <wacossusca34@HIDDEN>
Date: Sun, 15 Oct 2017 19:49:22 -0700
Message-ID: <CAM1nYoG5v0t766Z2LTNrHVWp-LGsNTK=Ci7_AACUbSUxtt6pbA@HIDDEN>
Subject: Emacs 25.3.1 segmentation fault on killing *Colors* buffer
To: submit <at> debbugs.gnu.org
Content-Type: multipart/alternative; boundary="001a113d362ecbbea7055ba10de2"
X-Spam-Score: -2.0 (--)
X-Debbugs-Envelope-To: submit
X-Mailman-Approved-At: Mon, 16 Oct 2017 03:14:53 -0400
X-BeenThere: debbugs-submit <at> debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit <at> debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request <at> debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces <at> debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces <at> debbugs.gnu.org>
X-Spam-Score: -2.0 (--)

--001a113d362ecbbea7055ba10de2
Content-Type: text/plain; charset="UTF-8"

Package: emacs
Version: 25.3.1

I have encountered a very strange and niche bug that causes Emacs to
segfault when a *Colors* buffer is killed that has been created through
`M-x customize`, browsing for any face, and then clicking `Choose` for a
face to modify. There are some extra requirements in order to get emacs to
crash:

- The *Colors* buffer must be separated into its own frame (ie. with `C-x 5
2`), as the only buffer viewed in the frame (it cannot be split).

- The *Colors* buffer must be killed *while the frame is also being closed*.
This can be done by evalutating the following elisp code to kill all
buffers viewed by a frame when it is closed:

(add-hook 'delete-frame-functions
          (lambda (frame)
            (dolist (elem (window-list frame))
              (kill-buffer (window-buffer elem)))))

The exact steps can be followed to reproduce the issue:

1) Run `emacs -Q` in a terminal with an X server running, spawning the X
frontend for emacs

2) Paste the above code into the *scratch* buffer and evaluate it (with
`M-x eval-buffer`).

3) Spawn a new frame (with `C-x 5 2`)

4) Enter the customization menus (with `M-x customize`)

5) Navigate to any face in the UI, for example `Emacs -> Faces -> Basic
Faces -> Cursor face`

6) Expand the options for the face of interest and click on `Choose` for a
color. The colors buffer should appear in a new window, splitting the frame
in half.

7) Close the window containing the *Customize Group: ...*, such that the
only buffer visible in the frame is the *Colors* buffer (I do this by
right-clicking the modeline)

8) Close the frame via the window manager (`X` button, or some hotkey to
close the X window).

If the steps were followed on Emacs 25.3.1, emacs should crash. I found
some other oddities where it wouldn't crash if you didn't follow the steps
perfectly, and every once in a while it would lock up instead of crashing
(but wouldn't use any CPU resources), or in even rarer occasions, work
properly. But it segfaults most of the time in `emacs -Q`.

On my custom configuration with the same hooks added to
'delete-frame-functions, emacs just hangs instead of segfaulting.

I know nothing about Emacs' codebase, but I assume this is some oddity with
how the *Colors* buffer is associated with the *Customize Group: ...*
buffer that spawned it through the C code, and when the *Colors* buffer is
killed in an odd way (ie. *while the frame containing it is being closed*),
Emacs freaks out and does some undefined behaviour.

This was obvserved on Linux (uname: 4.13.5-1-ARCH, xorg-server: 1.19.5-1,
distribution: Arch Linux).

GDB Backtrace:

#0  0x00007f09e4b47bc7 in x86_64_fallback_frame_state (context=0xb91050,
context=0xb91050, fs=0xb91140) at ./md-unwind-support.h:58
#1  0x00007f09e4b47bc7 in uw_frame_state_for (context=context@entry=0xb91050,
fs=fs@entry=0xb91140) at /build/gcc-multilib/src/gcc/
libgcc/unwind-dw2.c:1257
#2  0x00007f09e4b49778 in _Unwind_Backtrace (trace=0x7f09e9f62c60
<backtrace_helper>, trace_argument=0xb91300) at /build/gcc-multilib/src/gcc/
libgcc/unwind.inc:290
#3  0x00007f09e9f62dd8 in backtrace () at /usr/lib/libc.so.6
#4  0x000000000050907f in  ()
#5  0x00000000004eefbc in  ()
#6  0x000000000050771f in  ()
#7  0x00000000005078e9 in  ()
#8  0x0000000000507975 in  ()
#9  0x00007f09ea42bda0 in <signal handler called> () at
/usr/lib/libpthread.so.0
#10 0x00007f0900000000 in  ()
#11 0x00007f09eece5bcf in  () at /usr/lib/libgobject-2.0.so.0
#12 0x00007f09eece697d in g_object_new_with_properties () at
/usr/lib/libgobject-2.0.so.0
#13 0x00007f09eece6a7a in g_object_new () at /usr/lib/libgobject-2.0.so.0
#14 0x00007f09efede5f0 in  () at /usr/lib/libgtk-3.so.0
#15 0x00007f09efecbe1d in  () at /usr/lib/libgtk-3.so.0
#16 0x00007f09efecabd5 in  () at /usr/lib/libgtk-3.so.0
#17 0x00007f09efecb9b5 in  () at /usr/lib/libgtk-3.so.0
#18 0x00007f09efecb9cb in  () at /usr/lib/libgtk-3.so.0
#19 0x00007f09efecb9cb in  () at /usr/lib/libgtk-3.so.0
#20 0x00007f09efecb9cb in  () at /usr/lib/libgtk-3.so.0
#21 0x00007f09efecb9cb in  () at /usr/lib/libgtk-3.so.0
#22 0x00007f09efeb1d98 in  () at /usr/lib/libgtk-3.so.0
#23 0x00007f09eece16f5 in g_closure_invoke () at
/usr/lib/libgobject-2.0.so.0
#24 0x00007f09eecf50b0 in  () at /usr/lib/libgobject-2.0.so.0
#25 0x00007f09eecf9696 in g_signal_emit_valist () at
/usr/lib/libgobject-2.0.so.0
#26 0x00007f09eecfa920 in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#27 0x00007f09efa92f3f in  () at /usr/lib/libgdk-3.so.0
#28 0x00007f09efa7d7c3 in  () at /usr/lib/libgdk-3.so.0
#29 0x00007f09eea0fcb3 in  () at /usr/lib/libglib-2.0.so.0
#30 0x00007f09eea110be in g_main_context_dispatch () at
/usr/lib/libglib-2.0.so.0
#31 0x00000000005e0581 in  ()
#32 0x00000000005a6e3d in  ()
#33 0x000000000041ed44 in  ()
#34 0x00000000004fb239 in  ()
#35 0x00000000004fc0a0 in  ()
#36 0x00000000004fdb44 in  ()
#37 0x0000000000562a43 in  ()
#38 0x00000000004ef3e5 in  ()
#39 0x00000000005629c2 in  ()
#40 0x00000000004ef37d in  ()
#41 0x00000000004f3d6c in  ()
#42 0x00000000004f409c in  ()
#43 0x00000000004148b9 in  ()
#44 0x00007f09e9e7ff6a in __libc_start_main () at /usr/lib/libc.so.6
#45 0x000000000041544a in  ()

... don't ask how I found this issue. My workflow is insane and consists of
using a frame for every buffer spawned by emacs -- relevant xkcd
<https://xkcd.com/1172/>.

- Levi

--001a113d362ecbbea7055ba10de2
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Package: emacs<br></div>Version: 25.3.1<br><div><div>=
<br><div class=3D"gmail_quote"><div dir=3D"ltr"><div><div><div><div><div><d=
iv><div><div><div><div><div><div><div><div><div><div><div>I
 have encountered a very strange and niche bug that causes Emacs to=20
segfault when a *Colors* buffer is killed that has been created through=20
`M-x customize`, browsing for any face, and then clicking `Choose` for a
 face to modify. There are some extra requirements in order to get emacs
 to crash:<br><br></div>- The *Colors* buffer must be separated into its
 own frame (ie. with `C-x 5 2`), as the only buffer viewed in the frame=20
(it cannot be split).<br><br></div>- The *Colors* buffer must be killed <i>=
while the frame is also being closed</i>. This can be done by evalutating t=
he following elisp code to kill all buffers viewed by a frame when it is cl=
osed:<br><span style=3D"font-family:monospace,monospace"><br>(add-hook &#39=
;delete-frame-functions<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 (lambda (frame)<br>=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 (dolist (elem (window-list frame))<br>=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 (kill-buffer (=
window-buffer elem)))))<br><br></span></div><span style=3D"font-family:aria=
l,helvetica,sans-serif">The exact steps can be followed to reproduce the is=
sue:<br><br></span></div><span style=3D"font-family:arial,helvetica,sans-se=
rif">1) Run `emacs -Q` in a terminal with an X server running, spawning the=
 X frontend for emacs<br><br></span></div><span style=3D"font-family:arial,=
helvetica,sans-serif">2) Paste the above code into the *scratch* buffer and=
 evaluate it (with `M-x eval-buffer`</span><span style=3D"font-family:monos=
pace,monospace"><font face=3D"arial,helvetica,sans-serif">).<br><br></font>=
</span></div><span style=3D"font-family:monospace,monospace"><font face=3D"=
arial,helvetica,sans-serif">3) Spawn a new frame (with `C-x 5 2`)<br><br></=
font></span></div><span style=3D"font-family:monospace,monospace"><font fac=
e=3D"arial,helvetica,sans-serif">4) Enter the customization menus (with `M-=
x customize`)<br><br></font></span></div><span style=3D"font-family:monospa=
ce,monospace"><font face=3D"arial,helvetica,sans-serif">5) Navigate to any =
face in the UI, for example `Emacs -&gt; Faces -&gt; Basic Faces -&gt; Curs=
or face`<br><br></font></span></div><span style=3D"font-family:monospace,mo=
nospace"><font face=3D"arial,helvetica,sans-serif">6)
 Expand the options for the face of interest and click on `Choose` for a
 color. The colors buffer should appear in a new window, splitting the=20
frame in half.<br><br></font></span></div><span style=3D"font-family:monosp=
ace,monospace"><font face=3D"arial,helvetica,sans-serif">7)
 Close the window containing the *Customize Group: ...*, such that the=20
only buffer visible in the frame is the *Colors* buffer (I do this by=20
right-clicking the modeline)<br><br></font></span></div><span style=3D"font=
-family:monospace,monospace"><font face=3D"arial,helvetica,sans-serif">8) C=
lose the frame via the window manager (`X` button, or some hotkey to close =
the X window).<br><br></font></span></div><span style=3D"font-family:monosp=
ace,monospace"><font face=3D"arial,helvetica,sans-serif">If
 the steps were followed on Emacs 25.3.1, emacs should crash. I found=20
some other oddities where it wouldn&#39;t crash if you didn&#39;t follow th=
e=20
steps perfectly, and every once in a while it would lock up instead of=20
crashing (but wouldn&#39;t use any CPU resources), or in even rarer=20
occasions, work properly. But it segfaults most of the time in `emacs=20
-Q`.<br><br></font></span></div><span style=3D"font-family:monospace,monosp=
ace"><font face=3D"arial,helvetica,sans-serif">On my custom configuration w=
ith the same hooks added to &#39;delete-frame-functions, emacs just hangs i=
nstead of segfaulting.<br><br></font></span></div><span style=3D"font-famil=
y:monospace,monospace"><font face=3D"arial,helvetica,sans-serif">I
 know nothing about Emacs&#39; codebase, but I assume this is some oddity=
=20
with how the *Colors* buffer is associated with the *Customize Group:=20
...* buffer that spawned it through the C code, and when the *Colors*=20
buffer is killed in an odd way (ie. <i>while the frame containing it is bei=
ng closed</i>), Emacs freaks out and does some undefined behaviour.<br><br>=
</font></span></div><span style=3D"font-family:monospace,monospace"><font f=
ace=3D"arial,helvetica,sans-serif">This was obvserved on Linux (uname: 4.13=
.5-1-ARCH, xorg-server: 1.19.5-1, distribution: Arch Linux).</font></span><=
/div><div><span style=3D"font-family:monospace,monospace"><font face=3D"ari=
al,helvetica,sans-serif"><br></font></span></div><font face=3D"arial,helvet=
ica,sans-serif">GDB Backtrace:<br><br><span style=3D"font-family:monospace,=
monospace">#0=C2=A0
 0x00007f09e4b47bc7 in x86_64_fallback_frame_state (context=3D0xb91050,=20
context=3D0xb91050, fs=3D0xb91140) at ./md-unwind-support.h:58<br>#1=C2=A0 =
0x00007f09e4b47bc7 in uw_frame_state_for (context=3Dcontext@entry=3D<wbr>0x=
b91050, fs=3Dfs@entry=3D0xb91140) at /build/gcc-multilib/src/gcc/<wbr>libgc=
c/unwind-dw2.c:1257<br>#2=C2=A0
 0x00007f09e4b49778 in _Unwind_Backtrace (trace=3D0x7f09e9f62c60=20
&lt;backtrace_helper&gt;, trace_argument=3D0xb91300) at=20
/build/gcc-multilib/src/gcc/<wbr>libgcc/unwind.inc:290<br>#3=C2=A0 0x00007f=
09e9f62dd8 in backtrace () at /usr/lib/libc.so.6<br>#4=C2=A0 0x000000000050=
907f in=C2=A0 ()<br>#5=C2=A0 0x00000000004eefbc in=C2=A0 ()<br>#6=C2=A0 0x0=
00000000050771f in=C2=A0 ()<br>#7=C2=A0 0x00000000005078e9 in=C2=A0 ()<br>#=
8=C2=A0 0x0000000000507975 in=C2=A0 ()<br>#9=C2=A0 0x00007f09ea42bda0 in &l=
t;signal handler called&gt; () at /usr/lib/libpthread.so.0<br>#10 0x00007f0=
900000000 in=C2=A0 ()<br>#11 0x00007f09eece5bcf in=C2=A0 () at /usr/lib/lib=
gobject-2.0.so.0<br>#12 0x00007f09eece697d in g_object_new_with_properties =
() at /usr/lib/libgobject-2.0.so.0<br>#13 0x00007f09eece6a7a in g_object_ne=
w () at /usr/lib/libgobject-2.0.so.0<br>#14 0x00007f09efede5f0 in=C2=A0 () =
at /usr/lib/libgtk-3.so.0<br>#15 0x00007f09efecbe1d in=C2=A0 () at /usr/lib=
/libgtk-3.so.0<br>#16 0x00007f09efecabd5 in=C2=A0 () at /usr/lib/libgtk-3.s=
o.0<br>#17 0x00007f09efecb9b5 in=C2=A0 () at /usr/lib/libgtk-3.so.0<br>#18 =
0x00007f09efecb9cb in=C2=A0 () at /usr/lib/libgtk-3.so.0<br>#19 0x00007f09e=
fecb9cb in=C2=A0 () at /usr/lib/libgtk-3.so.0<br>#20 0x00007f09efecb9cb in=
=C2=A0 () at /usr/lib/libgtk-3.so.0<br>#21 0x00007f09efecb9cb in=C2=A0 () a=
t /usr/lib/libgtk-3.so.0<br>#22 0x00007f09efeb1d98 in=C2=A0 () at /usr/lib/=
libgtk-3.so.0<br>#23 0x00007f09eece16f5 in g_closure_invoke () at /usr/lib/=
libgobject-2.0.so.0<br>#24 0x00007f09eecf50b0 in=C2=A0 () at /usr/lib/libgo=
bject-2.0.so.0<br>#25 0x00007f09eecf9696 in g_signal_emit_valist () at /usr=
/lib/libgobject-2.0.so.0<br>#26 0x00007f09eecfa920 in g_signal_emit () at /=
usr/lib/libgobject-2.0.so.0<br>#27 0x00007f09efa92f3f in=C2=A0 () at /usr/l=
ib/libgdk-3.so.0<br>#28 0x00007f09efa7d7c3 in=C2=A0 () at /usr/lib/libgdk-3=
.so.0<br>#29 0x00007f09eea0fcb3 in=C2=A0 () at /usr/lib/libglib-2.0.so.0<br=
>#30 0x00007f09eea110be in g_main_context_dispatch () at /usr/lib/libglib-2=
.0.so.0<br>#31 0x00000000005e0581 in=C2=A0 ()<br>#32 0x00000000005a6e3d in=
=C2=A0 ()<br>#33 0x000000000041ed44 in=C2=A0 ()<br>#34 0x00000000004fb239 i=
n=C2=A0 ()<br>#35 0x00000000004fc0a0 in=C2=A0 ()<br>#36 0x00000000004fdb44 =
in=C2=A0 ()<br>#37 0x0000000000562a43 in=C2=A0 ()<br>#38 0x00000000004ef3e5=
 in=C2=A0 ()<br>#39 0x00000000005629c2 in=C2=A0 ()<br>#40 0x00000000004ef37=
d in=C2=A0 ()<br>#41 0x00000000004f3d6c in=C2=A0 ()<br>#42 0x00000000004f40=
9c in=C2=A0 ()<br>#43 0x00000000004148b9 in=C2=A0 ()<br>#44 0x00007f09e9e7f=
f6a in __libc_start_main () at /usr/lib/libc.so.6<br>#45 0x000000000041544a=
 in=C2=A0 ()</span><br></font><div><span style=3D"font-family:monospace,mon=
ospace"><font face=3D"arial,helvetica,sans-serif"><br></font></span></div><=
span style=3D"font-family:monospace,monospace"><font face=3D"arial,helvetic=
a,sans-serif">... don&#39;t ask how I found this issue. My workflow is insa=
ne and consists of using a frame for every buffer spawned by emacs -- <a hr=
ef=3D"https://xkcd.com/1172/" target=3D"_blank">relevant xkcd</a>.<span cla=
ss=3D"gmail-HOEnZb"><font color=3D"#888888"><br><br></font></span></font></=
span></div><span class=3D"gmail-HOEnZb"><font color=3D"#888888"><span style=
=3D"font-family:monospace,monospace"><font face=3D"arial,helvetica,sans-ser=
if">- Levi<br></font></span></font></span></div>
</div></div></div></div>

--001a113d362ecbbea7055ba10de2--




Acknowledgement sent to Levi <wacossusca34@HIDDEN>:
New bug report received and forwarded. Copy sent to bug-gnu-emacs@HIDDEN. Full text available.
Report forwarded to bug-gnu-emacs@HIDDEN:
bug#28862; Package emacs. Full text available.
Please note: This is a static page, with minimal formatting, updated once a day.
Click here to see this page with the latest information and nicer formatting.
Last modified: Wed, 1 Nov 2017 23:15:02 UTC

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997 nCipher Corporation Ltd, 1994-97 Ian Jackson.