bug#30653: 25.3; crash inside redisplay_internal

[Peter F. Patel-Schneider]

I am experiencing multiple crashes from Emacs 25.3 on Fedora 27 with XFCE.

The crashes happen inside redisplay_internal and when scrolling a window.
The following recipe causes a crash.  The crash causes X to freeze and then
dumps me back in a login screen.

emacs -Q -g 80x65
control-X control-F tt.text
control-V
control-P
control-shift-,
control-V
control-P

tt.text is the following file.   The contents of the file appear to be
significant to the crash.

<<<<<< CUT HERE >>>>>>
Tubhtugf ba jung jr jnag gb fgber vasbezngvba:

- gevcyr fgber
- snfg ybnqvat bs uhaqerqf bs zvyyvbaf bs gevcyrf
- dhrel hfvat ng yrnfg SPARQL

- qrpbengvbaf
  - r.t., pregnvagl snpgbe


- TODO
  - yvaxvat guvatf gbtrgure

- ernfbavat fhccbeg
  - pbafvfgrapl sbe ...
  - fcrrpu npgf
  - cerfhccbfvgvbaf
 - Q - jung yriry bs rkcerffvivgl?

- ubj zhpu vasrerapr vf arrqrq
  - zber guna pna or va jvgu HO flfgrzf?
    - cebwrpg vagb FOL?
    - cebwrpg vagb bagbybtl ynathntr?






- ernfbavat jbexorapu
  - gb fhccbeg NL ernfbavat

- anzrq ragvgvrf
  - gb ohvyq hc n xabjyrqtr tencu

- Spbgg unf ynathntr naq qngn fgehpgher
 

- Mnevfn Bbfgba
  - NL vasrerapr


- Cuneyvr
  - jub vf tbvat gb NRC
  - jung nobhg Oksbeq
    - RDFbk -
    - ...

- bagbybtl rinyhngvba
  - pbirentr
    - oernqgu, qrcguu
  - dhnyvgl
    - fgeratgu bs qrsvavgvbaf
    - pbeeryngvba jvgu ernyvgl
    - vagreany pbaarpgvbaf
  - rkcerffvirarff bs ercerfragngvba


- cerqvpgvir vagryyvtrapr
  - Pvz inaMrhef

- pbtavgvba
  - fhofhzcgvba
  - zrebabzl ?
- Yntb
  - fhofhzcgvba
  - ??
- Clp
  - fhofhzcgvba
  - ...


NRC Krlabgr Pbffvovyvgvrf
- Nhnapr if Gbbtyr Nbj

- fgngr bs gur neg va xabjyrqtr tencuf
  - fpurzn.bet
  - Ferronfr
  - Gbbtyr Kabjyrqtr Gencu
  - Ynubb!
  - Bvat
  - lntb
  - hccre bagbybtvrf - SUMO, Clp, ...
  - eryngvbafuvc gb NLU
  - eryngvbafuvc gb Clp
- flzobyvp AI if pbaarpgvbavfg AI


Tubhtugf ba jung jr jnag gb fgber vasbezngvba:

- gevcyr fgber
- snfg ybnqvat bs uhaqerqf bs zvyyvbaf bs gevcyrf
- dhrel hfvat ng yrnfg SPARQL

- qrpbengvbaf
  - r.t., pregnvagl snpgbe


- TODO
  - yvaxvat guvatf gbtrgure

- ernfbavat fhccbeg
  - pbafvfgrapl sbe ...
  - fcrrpu npgf
  - cerfhccbfvgvbaf
 - Q - jung yriry bs rkcerffvivgl?

- ubj zhpu vasrerapr vf arrqrq
  - zber guna pna or va jvgu HO flfgrzf?
    - cebwrpg vagb FOL?
    - cebwrpg vagb bagbybtl ynathntr?






- ernfbavat jbexorapu
  - gb fhccbeg NL ernfbavat

- anzrq ragvgvrf
  - gb ohvyq hc n xabjyrqtr tencu

- Spbgg unf ynathntr naq qngn fgehpgher
 

- Mnevfn Bbfgba
  - NL vasrerapr


- Cuneyvr
  - jub vf tbvat gb NRC
  - jung nobhg Oksbeq
    - RDFbk -
    - ...

- bagbybtl rinyhngvba
  - pbirentr
    - oernqgu, qrcguu
  - dhnyvgl
    - fgeratgu bs qrsvavgvbaf
    - pbeeryngvba jvgu ernyvgl
    - vagreany pbaarpgvbaf
  - rkcerffvirarff bs ercerfragngvba


- cerqvpgvir vagryyvtrapr
  - Pvz inaMrhef

- pbtavgvba
  - fhofhzcgvba
  - zrebabzl ?
- Yntb
  - fhofhzcgvba
  - ??
- Clp
  - fhofhzcgvba
  - ...


NRC Krlabgr Pbffvovyvgvrf
- Nhnapr if Gbbtyr Nbj

- fgngr bs gur neg va xabjyrqtr tencuf
  - fpurzn.bet
  - Ferronfr
  - Gbbtyr Kabjyrqtr Gencu
  - Ynubb!
  - Bvat
  - lntb
  - hccre bagbybtvrf - SUMO, Clp, ...
  - eryngvbafuvc gb NLU
  - eryngvbafuvc gb Clp
- flzobyvp AI if pbaarpgvbavfg AI


<<<<<< CUT HERE >>>>>>



The kernel log has the following information

                                              
Stack trace of thread 2277:
#0  0x00007f1a35a6198b raise (libpthread.so.0)
#1  0x00000000004f1254 terminate_due_to_signal (emacs-25.3)
#2  0x000000000050abb3 emacs_abort (emacs-25.3)
#3  0x0000000000456002 redisplay_internal (emacs-25.3)
#4  0x0000000000457115 redisplay_preserve_echo_area (emacs-25.3)
#5  0x00000000005a2988 Fdelete_process (emacs-25.3)
#6  0x00000000005aa3e5 kill_buffer_processes (emacs-25.3)
#7  0x00000000004f1046 shut_down_emacs (emacs-25.3)
#8  0x00000000004c0cda x_connection_closed (emacs-25.3)
#9  0x00000000004c0e37 x_io_error_quitter (emacs-25.3)
#10 0x00007f1a3d70aede _XIOError (libX11.so.6)
#11 0x00007f1a3d70876d _XEventsQueued (libX11.so.6)
#12 0x00007f1a3d6fa2bd XPending (libX11.so.6)
#13 0x00007f1a3f763c2e gdk_event_source_prepare (libgdk-3.so.0)
#14 0x00007f1a3e0743f9 g_main_context_prepare (libglib-2.0.so.0)
#15 0x00007f1a3e074dcb g_main_context_iterate.isra.23 (libglib-2.0.so.0)
#16 0x00007f1a3e074f57 g_main_context_pending (libglib-2.0.so.0)
#17 0x00007f1a3fc23d1d gtk_events_pending (libgtk-3.so.0)
#18 0x00000000004c1707 XTread_socket (emacs-25.3)
#19 0x00000000004f8121 gobble_input (emacs-25.3)
#20 0x00000000004f8705 process_pending_signals (emacs-25.3)
#21 0x00000000005a783d wait_reading_process_output (emacs-25.3)
#22 0x0000000000423520 sit_for (emacs-25.3)
#23 0x00000000004fd0c7 read_char (emacs-25.3)
#24 0x00000000004fdf80 read_key_sequence.constprop.54 (emacs-25.3)
#25 0x00000000004ffa04 command_loop_1 (emacs-25.3)
#26 0x0000000000563502 internal_condition_case (emacs-25.3)
#27 0x00000000004f1644 command_loop_2 (emacs-25.3)
#28 0x0000000000563481 internal_catch (emacs-25.3)
#29 0x00000000004f15db command_loop (emacs-25.3)
#30 0x00000000004f5e97 recursive_edit_1 (emacs-25.3)
#31 0x00000000004f61ba Frecursive_edit (emacs-25.3)
#32 0x000000000041a060 main (emacs-25.3)
#33 0x00007f1a34e2c00a __libc_start_main (libc.so.6)
#34 0x000000000041ab4a _start (emacs-25.3)

Stack trace of thread 2306:
#0  0x00007f1a35a5ccbb pthread_cond_wait@@GLIBC_2.3.2 (libpthread.so.0)
#1  0x00007f1a2adcee0c
_ZNSt18condition_variable4waitERSt11unique_lockISt5mutexE (libstdc++.so.6)
#2  0x00007f1a38d3f237 _ZN7bmalloc9Scavenger13threadRunLoopEv
(libjavascriptcoregtk-4.0.so.18)
#3  0x00007f1a2add514f execute_native_thread_routine (libstdc++.so.6)
#4  0x00007f1a35a5661b start_thread (libpthread.so.0)
#5  0x00007f1a34f2298f __clone (libc.so.6)

Stack trace of thread 2327:
#0  0x00007f1a34f163db __poll (libc.so.6)
#1  0x00007f1a3e074e99 g_main_context_iterate.isra.23 (libglib-2.0.so.0)
#2  0x00007f1a3e075232 g_main_loop_run (libglib-2.0.so.0)
#3  0x00007f1a3e65db56 gdbus_shared_thread_func (libgio-2.0.so.0)
#4  0x00007f1a3e09c486 g_thread_proxy (libglib-2.0.so.0)
#5  0x00007f1a35a5661b start_thread (libpthread.so.0)
#6  0x00007f1a34f2298f __clone (libc.so.6)

Stack trace of thread 2339:
#0  0x00007f1a34f163db __poll (libc.so.6)
#1  0x00007f1a3e074e99 g_main_context_iterate.isra.23 (libglib-2.0.so.0)
#2  0x00007f1a3e074fac g_main_context_iteration (libglib-2.0.so.0)
#3  0x00007f1a1d2a642d dconf_gdbus_worker_thread (libdconfsettings.so)
#4  0x00007f1a3e09c486 g_thread_proxy (libglib-2.0.so.0)
#5  0x00007f1a35a5661b start_thread (libpthread.so.0)
#6  0x00007f1a34f2298f __clone (libc.so.6)

Stack trace of thread 2307:
#0  0x00007f1a34f163db __poll (libc.so.6)
#1  0x00007f1a3e074e99 g_main_context_iterate.isra.23 (libglib-2.0.so.0)
#2  0x00007f1a3e074fac g_main_context_iteration (libglib-2.0.so.0)
#3  0x00007f1a3e074ff1 glib_worker_main (libglib-2.0.so.0)
#4  0x00007f1a3e09c486 g_thread_proxy (libglib-2.0.so.0)
#5  0x00007f1a35a5661b start_thread (libpthread.so.0)
#6  0x00007f1a34f2298f __clone (libc.so.6)


Abrt processing gives the following backtrace information


Truncated backtrace:
Thread no. 1 (10 frames)
 #0 raise at ../sysdeps/unix/sysv/linux/raise.c:51
 #2 emacs_abort at ../../src/sysdep.c:2255
 #3 redisplay_internal at ../../src/xdisp.c:13536
 #4 redisplay_preserve_echo_area at ../../src/xdisp.c:14328
 #5 Fdelete_process at ../../src/process.c:873
 #6 kill_buffer_processes at ../../src/process.c:7231
 #7 shut_down_emacs at ../../src/emacs.c:2002
 #8 x_connection_closed at ../../src/xterm.c:9462
 #9 x_io_error_quitter at ../../src/xterm.c:9574
 #12 XIGetClientPointer at XGetCPtr.c:59

See https://bugzilla.redhat.com/attachment.cgi?id=1400957 for more abrt
output.





In GNU Emacs 25.3.1 (x86_64-redhat-linux-gnu, GTK+ Version 3.22.19)
 of 2017-09-14 built on buildvm-31.phx2.fedoraproject.org
Windowing system distributor 'Fedora Project', version 11.0.11906000
System Description:    Fedora release 27 (Twenty Seven)

Configured using:
 'configure --build=x86_64-redhat-linux-gnu
 --host=x86_64-redhat-linux-gnu --program-prefix=
 --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr
 --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc
 --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64
 --libexecdir=/usr/libexec --localstatedir=/var
 --sharedstatedir=/var/lib --mandir=/usr/share/man
 --infodir=/usr/share/info --with-dbus --with-gif --with-jpeg --with-png
 --with-rsvg --with-tiff --with-xft --with-xpm --with-x-toolkit=gtk3
 --with-gpm=no --with-xwidgets --with-modules
 build_alias=x86_64-redhat-linux-gnu host_alias=x86_64-redhat-linux-gnu
 'CFLAGS=-DMAIL_USE_LOCKF -O2 -g -pipe -Wall -Werror=format-security
 -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong
 --param=ssp-buffer-size=4 -grecord-gcc-switches
 -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -mtune=generic'
 LDFLAGS=-Wl,-z,relro
 PKG_CONFIG_PATH=:/usr/lib64/pkgconfig:/usr/share/pkgconfig'

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND DBUS GCONF GSETTINGS NOTIFY
ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11 MODULES XWIDGETS

Important settings:
  value of $LC_COLLATE: C
  value of $LANG: en_US.utf8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Major mode: Text

Minor modes in effect:
  shell-dirtrack-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  auto-fill-function: do-auto-fill
  transient-mark-mode: t

Recent messages:
Loading /usr/share/emacs/site-lisp/site-start.d/git-init.el (source)...done
Loading /usr/share/emacs/site-lisp/site-start.d/mercurial-site-start.el
(source)...done
Loading /usr/share/emacs/site-lisp/site-start.d/systemtap-init.el 
(source)...done
Loading /usr/share/emacs/site-lisp/site-start.d/w3m-init.el (source)...done
Windowing setup
‘epa-file’ already enabled
For information about GNU Emacs and the GNU system, type C-h C-a.
Mark set
mwheel-scroll: Beginning of buffer [9 times]
Auto-saving...done

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message idna dired format-spec rfc822
mml mml-sec password-cache gnus-util mm-decode mm-bodies mm-encode
mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail rfc2047
rfc2045 ietf-drums mm-util help-fns help-mode easymenu cl-loaddefs pcase
cl-lib mail-prsvr mail-utils server dirtrack shell pcomplete comint
ansi-color ring epa-file epa derived epg epg-config time-date mule-util
tooltip eldoc electric uniquify ediff-hook vc-hooks lisp-float-type
mwheel x-win term/common-win x-dnd tool-bar dnd fontset image regexp-opt
fringe tabulated-list newcomment elisp-mode lisp-mode prog-mode register
page menu-bar rfn-eshadow timer select scroll-bar mouse jit-lock
font-lock syntax facemenu font-core frame cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese charscript case-table epa-hook
jka-cmpr-hook help simple abbrev minibuffer cl-preloaded nadvice
loaddefs button faces cus-face macroexp files text-properties overlay
sha1 md5 base64 format env code-pages mule custom widget
hashtable-print-readable backquote dbusbind inotify dynamic-setting
system-font-setting font-render-setting xwidget-internal move-toolbar
gtk x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 93665 4647)
 (symbols 48 20565 0)
 (miscs 40 62 108)
 (strings 32 17006 5066)
 (string-bytes 1 501077)
 (vectors 16 12932)
 (vector-slots 8 442827 2655)
 (floats 8 167 3)
 (intervals 56 264 0)
 (buffers 976 20))