Segmentation fault in xg_hide_tooltip

[Julien Danjou]

Hi,

I've got a recurrent segmentation fault while playing with several
frame in emacs 24.

I've got several backtraces. All mention `tooltip', but are sometimes
different and segfault later in GTK.

This one seems the most accurate (I got it twice on 4 tries). I can also
provide the other ones if that can help.

#0  0x00000000004e0dfd in xg_hide_tooltip (f=0x2bd7ee0) at gtkutil.c:653
#1  0x00000000004b6f61 in Fx_hide_tip () at xfns.c:5236
#2  0x0000000000563193 in Ffuncall (nargs=<value optimized out>, args=<value 
optimized out>) at eval.c:2980
#3  0x000000000059dfa2 in Fbyte_code (bytestr=<value optimized out>, 
vector=<value optimized out>, maxdepth=<value optimized out>) at bytecode.c:679
#4  0x00000000005653af in funcall_lambda (fun=10090797, nargs=<value optimized 
out>, arg_vector=<value optimized out>) at eval.c:3165
#5  0x0000000000562fc3 in Ffuncall (nargs=<value optimized out>, args=0x99f928) 
at eval.c:3040
#6  0x000000000059dfa2 in Fbyte_code (bytestr=<value optimized out>, 
vector=<value optimized out>, maxdepth=<value optimized out>) at bytecode.c:679
#7  0x00000000005653af in funcall_lambda (fun=10092437, nargs=<value optimized 
out>, arg_vector=<value optimized out>) at eval.c:3165
#8  0x0000000000562fc3 in Ffuncall (nargs=<value optimized out>, args=0x99ff90) 
at eval.c:3040
#9  0x000000000056440a in call1 (fn=<value optimized out>, arg1=<value 
optimized out>) at eval.c:2782
#10 0x00000000004f7a27 in show_help_echo (help=11716946, window=<value 
optimized out>, object=140737488342448, pos=24978448, 
    ok_to_overwrite_keystroke_echo=5) at keyboard.c:2317
#11 0x00000000004f9bee in read_char (commandflag=<value optimized out>, 
nmaps=<value optimized out>, maps=<value optimized out>, 
    prev_event=<value optimized out>, used_mouse_menu=<value optimized out>, 
end_time=<value optimized out>) at keyboard.c:3208
#12 0x00000000004fcddb in read_key_sequence (keybuf=<value optimized out>, 
bufsize=<value optimized out>, prompt=<value optimized out>, 
    dont_downcase_last=<value optimized out>, can_return_switch_frame=<value 
optimized out>, fix_current_buffer=<value optimized out>) at keyboard.c:9330
#13 0x00000000004ff340 in command_loop_1 () at keyboard.c:1613
#14 0x000000000056243d in internal_condition_case (bfun=<value optimized out>, 
handlers=<value optimized out>, hfun=<value optimized out>) at eval.c:1458
#15 0x00000000004f845e in command_loop_2 (ignore=<value optimized out>) at 
keyboard.c:1338
#16 0x0000000000562568 in internal_catch (tag=<value optimized out>, 
func=<value optimized out>, arg=<value optimized out>) at eval.c:1202
#17 0x00000000004f8623 in command_loop () at keyboard.c:1317
#18 0x00000000004f8a08 in recursive_edit_1 () at keyboard.c:940
#19 0x00000000004f8b47 in Frecursive_edit () at keyboard.c:1002
#20 0x00000000004ec125 in main (argc=0, argv=0x7fffffffdfe8) at emacs.c:1763
(gdb) print f
$1 = (FRAME_PTR) 0x2bd7ee0
(gdb) print f->output_data
$2 = {tty = 0x0, x = 0x0, w32 = 0x0, ns = 0x0, nothing = 0}
(gdb) print f->output_data.x
$3 = (struct x_output *) 0x0

The relevant code seems to be:
 648 int 
 649 xg_hide_tooltip (FRAME_PTR f) 
 650 { 
 651   int ret = 0; 
 652 #ifdef USE_GTK_TOOLTIP 
 653   if (f->output_data.x->ttip_window) 

       ^^^ here

 654     { 
 655       GtkWindow *win = f->output_data.x->ttip_window; 

[…]

 670 #endif 
 671   return ret; 
 672 } 

I've no idea how to "fix" this. Any hint appreciated. I can test patches
if needed.

-- 
Julien Danjou
// ᐰ <address@hidden>   http://julien.danjou.info

pgpUnlTbH13cb.pgp
Description: PGP signature