Re: Segmentation fault in xg_hide_tooltip

[Jan Djärv]

Hmm, obviously a race condition.  I've checked in a fix, please try it.

        Jan D.


Julien Danjou skrev 2010-08-11 18.48:
> Hi,
>
> I've got a recurrent segmentation fault while playing with several
> frame in emacs 24.
>
> I've got several backtraces. All mention `tooltip', but are sometimes
> different and segfault later in GTK.
>
> This one seems the most accurate (I got it twice on 4 tries). I can also
> provide the other ones if that can help.
>
> #0  0x00000000004e0dfd in xg_hide_tooltip (f=0x2bd7ee0) at gtkutil.c:653
> #1  0x00000000004b6f61 in Fx_hide_tip () at xfns.c:5236
> #2  0x0000000000563193 in Ffuncall (nargs=<value optimized out>, args=<value 
> optimized out>) at eval.c:2980
> #3  0x000000000059dfa2 in Fbyte_code (bytestr=<value optimized out>, vector=<value 
> optimized out>, maxdepth=<value optimized out>) at bytecode.c:679
> #4  0x00000000005653af in funcall_lambda (fun=10090797, nargs=<value optimized out>, 
> arg_vector=<value optimized out>) at eval.c:3165
> #5  0x0000000000562fc3 in Ffuncall (nargs=<value optimized out>, args=0x99f928) 
> at eval.c:3040
> #6  0x000000000059dfa2 in Fbyte_code (bytestr=<value optimized out>, vector=<value 
> optimized out>, maxdepth=<value optimized out>) at bytecode.c:679
> #7  0x00000000005653af in funcall_lambda (fun=10092437, nargs=<value optimized out>, 
> arg_vector=<value optimized out>) at eval.c:3165
> #8  0x0000000000562fc3 in Ffuncall (nargs=<value optimized out>, args=0x99ff90) 
> at eval.c:3040
> #9  0x000000000056440a in call1 (fn=<value optimized out>, arg1=<value optimized 
> out>) at eval.c:2782
> #10 0x00000000004f7a27 in show_help_echo (help=11716946, window=<value optimized 
> out>, object=140737488342448, pos=24978448,
>      ok_to_overwrite_keystroke_echo=5) at keyboard.c:2317
> #11 0x00000000004f9bee in read_char (commandflag=<value optimized out>, nmaps=<value 
> optimized out>, maps=<value optimized out>,
>      prev_event=<value optimized out>, used_mouse_menu=<value optimized out>, 
> end_time=<value optimized out>) at keyboard.c:3208
> #12 0x00000000004fcddb in read_key_sequence (keybuf=<value optimized out>, 
> bufsize=<value optimized out>, prompt=<value optimized out>,
>      dont_downcase_last=<value optimized out>, can_return_switch_frame=<value optimized 
> out>, fix_current_buffer=<value optimized out>) at keyboard.c:9330
> #13 0x00000000004ff340 in command_loop_1 () at keyboard.c:1613
> #14 0x000000000056243d in internal_condition_case (bfun=<value optimized out>, 
> handlers=<value optimized out>, hfun=<value optimized out>) at eval.c:1458
> #15 0x00000000004f845e in command_loop_2 (ignore=<value optimized out>) at 
> keyboard.c:1338
> #16 0x0000000000562568 in internal_catch (tag=<value optimized out>, func=<value 
> optimized out>, arg=<value optimized out>) at eval.c:1202
> #17 0x00000000004f8623 in command_loop () at keyboard.c:1317
> #18 0x00000000004f8a08 in recursive_edit_1 () at keyboard.c:940
> #19 0x00000000004f8b47 in Frecursive_edit () at keyboard.c:1002
> #20 0x00000000004ec125 in main (argc=0, argv=0x7fffffffdfe8) at emacs.c:1763
> (gdb) print f
> $1 = (FRAME_PTR) 0x2bd7ee0
> (gdb) print f->output_data
> $2 = {tty = 0x0, x = 0x0, w32 = 0x0, ns = 0x0, nothing = 0}
> (gdb) print f->output_data.x
> $3 = (struct x_output *) 0x0
>
> The relevant code seems to be:
>   648 int
>   649 xg_hide_tooltip (FRAME_PTR f)
>   650 {
>   651   int ret = 0;
>   652 #ifdef USE_GTK_TOOLTIP
>   653   if (f->output_data.x->ttip_window)
>
>         ^^^ here
>
>   654     {
>   655       GtkWindow *win = f->output_data.x->ttip_window;
>
> […]
>
>   670 #endif
>   671   return ret;
>   672 }
>
> I've no idea how to "fix" this. Any hint appreciated. I can test patches
> if needed.