bug#21428: 24.5; Crash of emacs on OS X, installed via homebrew cask

[Rainer M Krug]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Rainer M Krug <Rainer@krugs.de>
>> Cc: 21428@debbugs.gnu.org,  mituharu+bug-gnu-emacs-mac@math.s.chiba-u.ac.jp
>> Date: Fri, 25 Sep 2015 14:30:05 +0200
>> 
>> ,----
>> | xdisp.c:24333: Emacs fatal error: assertion failed: face != NULL
>> | 
>> | Breakpoint 1, terminate_due_to_signal (sig=6, backtrace_limit=2147483647) 
>> at emacs.c:370
>> | 370          signal (sig, SIG_DFL);
>> | (gdb) bt
>> | #0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at 
>> emacs.c:370
>> | #1 0x00000001002256eb in die (msg=0x1003b680a "face != NULL",
>> | file=0x1003b24f0 "xdisp.c", line=24333) at alloc.c:6951
>> | #2 0x0000000100062f17 in get_glyph_face_and_encoding
>> | (f=0x103811830, glyph=0x103c4b060, char2b=0x7fff5fbfb310) at
>> | xdisp.c:24333
>> | #3 0x00000001000b581d in fill_glyph_string (s=0x7fff5fbfb360,
>> | face_id=50, start=34, end=71, overlaps=0) at xdisp.c:24558
>
> OK, I think I've seen enough of these for now, thanks.  It seems like
> a face is removed from the frame's face cache, but Emacs still thinks
> the face is cached and tries to use its (stale) cache slot.  The face
> is different each time, and there's nothing problematic with the face
> itself.
>
> I took a look at the code, and couldn't find any obvious way this
> could happen.  I need some way to narrow down the search.  So I need
> to ask you to try a few things, okay?
>
> First, I'd like to know whether the line of code marked below is ever
> executed:
>
>   static void
>   uncache_face (struct face_cache *c, struct face *face)
>   {
>     int i = face->hash % FACE_CACHE_BUCKETS_SIZE;
>
>     if (face->prev)
>       face->prev->next = face->next;
>     else
>       c->buckets[i] = face->next;
>
>     if (face->next)
>       face->next->prev = face->prev;
>
>     c->faces_by_id[face->id] = NULL;
>     if (face->id == c->used)
>       --c->used;  <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
>   }
>
> This is from xfaces.c, line 4322 with the current Git master.  Please
> put a breakpoint there, and run Emacs under GDB until it crashes as
> before, or until this breakpoint breaks.  If it breaks, please show
> the backtrace.

OK - Emacs crashed again (same pattern) and the breakpoint was
triggered:

,----
| xdisp.c:24333: Emacs fatal error: assertion failed: face != NULL
| 
| Breakpoint 1, terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at 
emacs.c:370
| 370     signal (sig, SIG_DFL);
| (gdb) bt
| #0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:370
| #1  0x00000001002256fb in die (msg=0x1003b681a "face != NULL", 
file=0x1003b2500 "xdisp.c", line=24333) at alloc.c:6951
| #2  0x0000000100062f27 in get_glyph_face_and_encoding (f=0x10182bc30, 
glyph=0x11b381d60, char2b=0x7fff5fbfaf90) at xdisp.c:24333
| #3  0x00000001000b582d in fill_glyph_string (s=0x7fff5fbfafc0, face_id=27, 
start=18, end=41, overlaps=0) at xdisp.c:24558
| #4  0x000000010006d5d9 in draw_glyphs (w=0x10182ac30, x=152, row=0x11b1b9f00, 
area=TEXT_AREA, start=0, end=41, hl=DRAW_NORMAL_TEXT, overlaps=0) at 
xdisp.c:25225
| #5  0x000000010006cf01 in x_write_glyphs (w=0x10182ac30, 
updated_row=0x11b1b9f00, start=0x11b381a00, updated_area=TEXT_AREA, len=41) at 
xdisp.c:27256
| #6  0x0000000100011da8 in update_text_area (w=0x10182ac30, 
updated_row=0x11b1b9f00, vpos=29) at dispnew.c:3611
| #7  0x000000010000f962 in update_window_line (w=0x10182ac30, vpos=29, 
mouse_face_overwritten_p=0x7fff5fbfbdf2) at dispnew.c:3854
| #8  0x00000001000078b2 in update_window (w=0x10182ac30, force_p=true) at 
dispnew.c:3477
| #9  0x00000001000066bf in update_window_tree (w=0x10182ac30, force_p=true) at 
dispnew.c:3219
| #10 0x000000010000639b in update_frame (f=0x10182bc30, force_p=true, 
inhibit_hairy_id_p=false) at dispnew.c:3108
| #11 0x0000000100051fb9 in redisplay_internal () at xdisp.c:13815
| #12 0x0000000100053ad9 in redisplay () at xdisp.c:13059
| #13 0x0000000100184349 in read_char (commandflag=1, map=4819150115, 
prev_event=0, used_mouse_menu=0x7fff5fbfefb7, end_time=0x0) at keyboard.c:2465
| #14 0x000000010017f2a9 in read_key_sequence (keybuf=0x7fff5fbff2f0, 
bufsize=30, prompt=0, dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:9030
| #15 0x000000010017dba6 in command_loop_1 () at keyboard.c:1348
| #16 0x0000000100260716 in internal_condition_case (bfun=0x10017d5b0 
<command_loop_1>, handlers=17616, hfun=0x100198e20 <cmd_error>) at eval.c:1309
| #17 0x0000000100198d1c in command_loop_2 (ignore=0) at keyboard.c:1088
| #18 0x000000010025f7de in internal_catch (tag=42768, func=0x100198cf0 
<command_loop_2>, arg=0) at eval.c:1073
| #19 0x000000010017c8f0 in command_loop () at keyboard.c:1067
| #20 0x000000010017c732 in recursive_edit_1 () at keyboard.c:673
| #21 0x000000010017cb23 in Frecursive_edit () at keyboard.c:744
| #22 0x000000010017a6ca in main (argc=1, argv=0x7fff5fbff8f0) at emacs.c:1643
| 
| Lisp Backtrace:
| "redisplay_internal (C function)" (0x0)
| (gdb) bt full
| #0  terminate_due_to_signal (sig=6, backtrace_limit=2147483647) at emacs.c:370
| No locals.
| #1  0x00000001002256fb in die (msg=0x1003b681a "face != NULL", 
file=0x1003b2500 "xdisp.c", line=24333) at alloc.c:6951
| No locals.
| #2  0x0000000100062f27 in get_glyph_face_and_encoding (f=0x10182bc30, 
glyph=0x11b381d60, char2b=0x7fff5fbfaf90) at xdisp.c:24333
|       face = (struct face *) 0x0
|       code = 0
| #3  0x00000001000b582d in fill_glyph_string (s=0x7fff5fbfafc0, face_id=27, 
start=18, end=41, overlaps=0) at xdisp.c:24558
|       glyph = (struct glyph *) 0x11b381d60
|       last = (struct glyph *) 0x11b3821b0
|       voffset = 0
|       glyph_not_available_p = false
| #4  0x000000010006d5d9 in draw_glyphs (w=0x10182ac30, x=152, row=0x11b1b9f00, 
area=TEXT_AREA, start=0, end=41, hl=DRAW_NORMAL_TEXT, overlaps=0) at 
xdisp.c:25225
|       face_id = 27
|       char2b = (XChar2b *) 0x7fff5fbfaf90
|       first_glyph = (struct glyph *) 0x11b381d60
|       head = (struct glyph_string *) 0x7fff5fbfb6f0
|       tail = (struct glyph_string *) 0x7fff5fbfafc0
|       s = (struct glyph_string *) 0x7fff5fbfafc0
|       clip_head = (struct glyph_string *) 0x0
|       clip_tail = (struct glyph_string *) 0x0
|       i = 18
|       j = 1519995
|       x_reached = 1
|       last_x = 2537
|       area_left = 8
|       f = (struct frame *) 0x10182bc30
|       sa_avail = 15992
|       sa_count = 5
|       sa_must_free = false
| #5  0x000000010006cf01 in x_write_glyphs (w=0x10182ac30, 
updated_row=0x11b1b9f00, start=0x11b381a00, updated_area=TEXT_AREA, len=41) at 
xdisp.c:27256
|       x = 16779745
|       hpos = 0
|       chpos = 14
| #6  0x0000000100011da8 in update_text_area (w=0x10182ac30, 
updated_row=0x11b1b9f00, vpos=29) at dispnew.c:3611
|       current_row = (struct glyph_row *) 0x1045aa300
|       desired_row = (struct glyph_row *) 0x11b1b9f00
|       rif = (struct redisplay_interface *) 0x1007d8e98
|       changed_p = false
| #7  0x000000010000f962 in update_window_line (w=0x10182ac30, vpos=29, 
mouse_face_overwritten_p=0x7fff5fbfbdf2) at dispnew.c:3854
|       current_row = (struct glyph_row *) 0x1045aa300
|       desired_row = (struct glyph_row *) 0x11b1b9f00
|       rif = (struct redisplay_interface *) 0x1007d8e98
|       changed_p = false
| #8  0x00000001000078b2 in update_window (w=0x10182ac30, force_p=true) at 
dispnew.c:3477
|       vpos = 29
|       i = 783
|       end = (struct glyph_row *) 0x11b1c0300
|       mode_line_row = (struct glyph_row *) 0x11b1c0300
|       header_line_row = (struct glyph_row *) 0x11b1b8200
|       changed_p = true
|       mouse_face_overwritten_p = false
|       row = (struct glyph_row *) 0x11b1b9f00
|       yb = 1402
|       n_updated = 0
|       desired_matrix = (struct glyph_matrix *) 0x101478110
|       paused_p = false
|       preempt_count = 17
|       rif = (struct redisplay_interface *) 0x1007d8e98
| #9  0x00000001000066bf in update_window_tree (w=0x10182ac30, force_p=true) at 
dispnew.c:3219
|       paused_p = false
| #10 0x000000010000639b in update_frame (f=0x10182bc30, force_p=true, 
inhibit_hairy_id_p=false) at dispnew.c:3108
|       paused_p = false
|       root_window = (struct window *) 0x10182ac30
| #11 0x0000000100051fb9 in redisplay_internal () at xdisp.c:13815
|       gcscrollbars = false
|       f = (struct frame *) 0x10182bc30
|       w = (struct window *) 0x10182ac30
|       sw = (struct window *) 0x10182ac30
|       fr = (struct frame *) 0x10182bc30
|       pending = false
|       must_finish = false
|       match_p = true
|       tlbufpos = {
|   charpos = 774,
|   bytepos = 774
| }
|       tlendpos = {
|   charpos = 269,
|   bytepos = 269
| }
|       number_of_visible_frames = 1
|       count = 2
|       sf = (struct frame *) 0x10182bc30
|       polling_stopped_here = true
|       tail = 4412501059
|       frame = 4320312373
|       consider_all_windows_p = true
|       update_miniwindow_p = false
| #12 0x0000000100053ad9 in redisplay () at xdisp.c:13059
| No locals.
| #13 0x0000000100184349 in read_char (commandflag=1, map=4819150115, 
prev_event=0, used_mouse_menu=0x7fff5fbfefb7, end_time=0x0) at keyboard.c:2465
|       echo_current = true
|       c = 0
|       jmpcount = 140734799801360
|       local_getcjmp = 0x7fff5fbfeba0
|       save_jump = 0x7fff5fbfeb00
|       tem = 2
|       save = 0
|       previous_echo_area_message = 0
|       also_record = 0
|       reread = false
|       recorded = false
|       polling_stopped_here = false
|       orig_kboard = (struct kboard *) 0x101436bb0
| #14 0x000000010017f2a9 in read_key_sequence (keybuf=0x7fff5fbff2f0, 
bufsize=30, prompt=0, dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:9030
|       interrupted_kboard = (KBOARD *) 0x101436bb0
|       interrupted_frame = (struct frame *) 0x10182bc30
|       key = 140734799802480
|       used_mouse_menu = false
|       echo_local_start = 0
|       last_real_key_start = 0
|       keys_local_start = 0
|       new_binding = 1062
|       count = 2
|       t = 0
|       echo_start = 0
|       keys_start = 0
|       current_binding = 4819150115
|       first_event = 0
|       first_unbound = 31
|       mock_input = 0
|       fkey = {
|   parent = 4337131763,
|   map = 4337131763,
|   start = 0,
|   end = 0
| }
|       keytran = {
|   parent = 4336943683,
|   map = 4336943683,
|   start = 0,
|   end = 0
| }
|       indec = {
|   parent = 4337131827,
|   map = 4337131827,
|   start = 0,
|   end = 0
| }
|       shift_translated = false
|       delayed_switch_frame = 0
|       original_uppercase = 0
|       original_uppercase_position = -1
|       dummyflag = false
|       starting_buffer = (struct buffer *) 0x112b39c90
|       fake_prefixed_keys = 0
| #15 0x000000010017dba6 in command_loop_1 () at keyboard.c:1348
|       cmd = 61397272
|       keybuf = 0x7fff5fbff2f0
|       i = 1
|       prev_modiff = 15153
|       prev_buffer = (struct buffer *) 0x112b39c90
|       already_adjusted = false
| #16 0x0000000100260716 in internal_condition_case (bfun=0x10017d5b0 
<command_loop_1>, handlers=17616, hfun=0x100198e20 <cmd_error>) at eval.c:1309
|       val = 4303299704
|       c = (struct handler *) 0x101403dc0
| #17 0x0000000100198d1c in command_loop_2 (ignore=0) at keyboard.c:1088
|       val = 2
| #18 0x000000010025f7de in internal_catch (tag=42768, func=0x100198cf0 
<command_loop_2>, arg=0) at eval.c:1073
|       val = 0
|       c = (struct handler *) 0x101404e60
| #19 0x000000010017c8f0 in command_loop () at keyboard.c:1067
| No locals.
| #20 0x000000010017c732 in recursive_edit_1 () at keyboard.c:673
|       count = 1
|       val = 0
| #21 0x000000010017cb23 in Frecursive_edit () at keyboard.c:744
|       count = 0
|       buffer = 0
| #22 0x000000010017a6ca in main (argc=1, argv=0x7fff5fbff8f0) at emacs.c:1643
|       dummy = 140734799806464
|       stack_bottom_variable = 0 '\0'
|       do_initial_setlocale = true
|       dumping = false
|       skip_args = 0
|       rlim = {
|   rlim_cur = 8720000,
|   rlim_max = 67104768
| }
|       no_loadup = false
|       junk = 0x0
|       dname_arg = 0x0
|       dname_arg2 = 0x7fff5fbff870 "\001"
|       ch_to_dir = 0x0
|       original_pwd = 0x0
| 
| Lisp Backtrace:
| "redisplay_internal (C function)" (0x0)
| (gdb)
`----

I am sure the crash occurs again, so please let me know what further
info you need from the next crash.



>
> If this breakpoint never breaks before another crash, please
> reconfigure Emacs like this:
>
>   CFLAGS="-ggdb3 -O0" CXXFLAGS="-ggdb3 -O0" LDFLAGS="-ggdb3" ./configure 
> --enable-checking='yes,glyphs'
>
> then rebuild, and run it after setting these three variables to t:
>
>   inhibit-try-cursor-movement
>   inhibit-try-window-id
>   inhibit-try-window-reusing
>
> This disables some redisplay optimizations, so you might see slow
> redisplay; this is normal.  What is important is to see whether the
> crashes disappear when these variables are set to non-nil values.  If
> you run for a long time without crashes, then set these variables to
> nil, one by one, in the order they are shown above, and each time let
> Emacs run enough time for you to be sure the problem doesn't happen,
> before you proceed to the next variable.
>
> I hope these two procedures will collect data that will help me zero
> in on the problematic code.
>
> Thanks.

-- 
Rainer M. Krug, PhD (Conservation Ecology, SUN), MSc (Conservation Biology, 
UCT), Dipl. Phys. (Germany)

Centre of Excellence for Invasion Biology
Stellenbosch University
South Africa

Tel :       +33 - (0)9 53 10 27 44
Cell:       +33 - (0)6 85 62 59 98
Fax :       +33 - (0)9 58 10 27 44

Fax (D):    +49 - (0)3 21 21 25 22 44

email:      Rainer@krugs.de

Skype:      RMkrug

PGP: 0x0F52F982

signature.asc
Description: PGP signature