libxft crash with current Emacs master branch

[Alex Bennée]

Hi,

I've been seeing crashes in the last few weeks while tracking the Emacs
master branch.

#0  0x00007fa172105c05 in ?? () from /usr/lib/x86_64-linux-gnu/libXft.so.2
#1  0x00007fa172101e37 in ?? () from /usr/lib/x86_64-linux-gnu/libXft.so.2
#2  0x00007fa1725334f2 in XCloseDisplay () from 
/usr/lib/x86_64-linux-gnu/libX11.so.6
#3  0x00007fa172c8ffd5 in ?? () from /usr/lib/x86_64-linux-gnu/libXt.so.6
#4  0x00007fa172c90b6c in XtCloseDisplay () from 
/usr/lib/x86_64-linux-gnu/libXt.so.6
#5  0x00000000004b7e1a in x_delete_terminal (terminal=<optimized out>) at 
xterm.c:10331
#6  0x00000000004aa506 in Fdelete_terminal (address@hidden, force=<optimized 
out>) at terminal.c:348
#7  0x0000000000421268 in delete_frame (frame=<optimized out>, force=<optimized 
out>) at frame.c:1400
#8  0x000000000054bc58 in Ffuncall (address@hidden, address@hidden) at 
eval.c:2809
#9  0x0000000000548050 in Fcall_interactively (function=<optimized out>, 
record_flag=<optimized out>, keys=<optimized out>) at callint.c:836
#10 0x000000000054bc48 in Ffuncall (nargs=<optimized out>, args=<optimized 
out>) at eval.c:2813
#11 0x000000000057fbbd in exec_byte_code (bytestr=0, vector=140733678945484, 
maxdepth=0, args_template=78271296, nargs=140733678946512, 
    args=0x4) at bytecode.c:919
#12 0x000000000054b7a7 in funcall_lambda (fun=9555397, address@hidden, 
address@hidden) at eval.c:2974
#13 0x000000000054ba7b in Ffuncall (address@hidden, address@hidden) at 
eval.c:2867
#14 0x000000000054bdaa in call1 (fn=<optimized out>, arg1=<optimized out>) at 
eval.c:2605
#15 0x00000000004e914d in command_loop_1 () at keyboard.c:1552
#16 0x000000000054a0be in internal_condition_case (address@hidden 
<command_loop_1>, handlers=<optimized out>, 
    address@hidden <cmd_error>) at eval.c:1345
#17 0x00000000004db40e in command_loop_2 (address@hidden) at keyboard.c:1170
#18 0x0000000000549fcb in internal_catch (tag=12155426, address@hidden 
<command_loop_2>, arg=12108018) at eval.c:1109
#19 0x00000000004df997 in command_loop () at keyboard.c:1149
#20 recursive_edit_1 () at keyboard.c:777
#21 0x00000000004dfc82 in Frecursive_edit () at keyboard.c:841
#22 0x0000000000413b65 in main (argc=<optimized out>, argv=0x7fff1cf10e18) at 
emacs.c:1637
#5  0x00000000004b7e1a in x_delete_terminal (terminal=<optimized out>) at 
xterm.c:10331

With additional debug symbols I saw this:

#0  XftFontManageMemory (address@hidden) at ../../src/xftfreetype.c:1115
#1  0x00007f1449f09e37 in _XftCloseDisplay (dpy=0x321c690, codes=<optimized 
out>) at ../../src/xftdpy.c:40
#2  0x00007f144a33b4f2 in XCloseDisplay () from 
/usr/lib/x86_64-linux-gnu/libX11.so.6
#3  0x00007f144aa97fd5 in ?? () from /usr/lib/x86_64-linux-gnu/libXt.so.6
#4  0x00007f144aa98b6c in XtCloseDisplay () from 
/usr/lib/x86_64-linux-gnu/libXt.so.6
#5  0x00000000005148cf in x_delete_terminal ()
#6  0x00000000004f305f in Fdelete_terminal ()
#7  0x00000000004232b6 in delete_frame ()
#8  0x00000000004235c9 in Fdelete_frame ()
#9  0x00000000005cebab in Ffuncall ()
#10 0x00000000005c93fe in Fcall_interactively ()
#11 0x00000000005cebda in Ffuncall ()
#12 0x0000000000610bb3 in exec_byte_code ()
#13 0x00000000005cf266 in funcall_lambda ()
#14 0x00000000005ced6d in Ffuncall ()
#15 0x00000000005ce502 in call1 ()
#16 0x000000000053a8c0 in command_loop_1 ()
#17 0x00000000005cb9e8 in internal_condition_case ()
#18 0x0000000000539eee in command_loop_2 ()
#19 0x00000000005cb1fa in internal_catch ()
#20 0x0000000000539e9c in command_loop ()
#21 0x000000000053967e in recursive_edit_1 ()
#22 0x00000000005397eb in Frecursive_edit ()
#23 0x00000000005377f3 in main ()
#0  XftFontManageMemory (address@hidden) at ../../src/xftfreetype.c:1115
1115    in ../../src/xftfreetype.c
$1 = (Display *) 0x321c690
$2 = {ext_data = 0x2c77a60, free_funcs = 0x3765ad0, fd = 11, conn_checker = 0, 
proto_major_version = 11, proto_minor_version = 0, 
  vendor = 0x3a48cf0 "The X.Org Foundation", resource_base = 12582912, 
resource_mask = 2097151, resource_id = 0, resource_shift = 0, 
  resource_alloc = 0x7f144a35d2d0 <_XAllocID>, byte_order = 0, bitmap_unit = 
32, bitmap_pad = 32, bitmap_bit_order = 0, nformats = 7, 
  pixmap_format = 0x3a28c00, vnumber = 11, release = 11204000, head = 0x0, tail 
= 0x0, qlen = 0, last_request_read = 6434, request = 6435, 
  last_req = 0x2d5ba70 "\217\023\002", buffer = 0x2d5ba70 "\217\023\002", 
bufptr = 0x2d5ba78 "<", bufmax = 0x2d5fa70 "", 
  max_request_size = 65535, db = 0x0, synchandler = 0x0, display_name = 
0x399c8a0 ":0", default_screen = 0, nscreens = 1, 
  screens = 0x3b97e40, motion_buffer = 256, flags = 2, min_keycode = 8, 
max_keycode = 255, keysyms = 0x0, modifiermap = 0x0, 
  keysyms_per_keycode = 0, xdefaults = 0x0, scratch_buffer = 0x0, 
scratch_length = 0, ext_number = 4, ext_procs = 0x3687980, event_vec = {
    0x7f144a35ed30 <_XUnknownWireEvent>, 0x7f144a35ed30 <_XUnknownWireEvent>, 
0x7f144a35ed70 <_XWireToEvent> <repeats 34 times>, 
    0x7f144a35ed30 <_XUnknownWireEvent> <repeats 53 times>, 0x7f144a3b0750, 
0x7f144a35ed30 <_XUnknownWireEvent> <repeats 38 times>}, 
  wire_vec = {0x7f144a35ed60 <_XUnknownNativeEvent>, 0x7f144a35ed60 
<_XUnknownNativeEvent>, 0x0 <repeats 34 times>, 
    0x7f144a35ed60 <_XUnknownNativeEvent> <repeats 92 times>}, lock_meaning = 
0, lock = 0x0, async_handlers = 0x0, bigreq_size = 4194303, 
  lock_fns = 0x0, idlist_alloc = 0x7f144a35d320 <_XAllocIDs>, key_bindings = 
0x0, cursor_font = 12582913, atoms = 0x2808260, 
  mode_switch = 0, num_lock = 0, context_db = 0x2cb1160, error_vec = 0x0, cms = 
{defaultCCCs = 0x38f5150 "\220\306!\003", 
    clientCmaps = 0x38f50d0 " ", perVisualIntensityMaps = 0x0}, im_filters = 
0x0, qfree = 0x3a5f5c0, next_event_serial_num = 78, 
  flushes = 0x0, im_fd_info = 0x0, im_fd_length = 0, conn_watchers = 0x3946be0, 
watcher_count = 1, filedes = 0x25a7450 "\v", 
  savedsynchandler = 0x0, resource_max = 2097146, xcmisc_opcode = 0, xkb_info = 
0x3a3a720, trans_conn = 0x0, xcb = 0x2c189e0, 
  next_cookie = 0, generic_event_vec = {0x0 <repeats 128 times>}, 
generic_event_copy_vec = {0x0 <repeats 128 times>}, cookiejar = 0x0}
Source directories searched: /home/alex/src/pkgs/xft-2.3.1/src:$cdir:$cwd
#0  XftFontManageMemory (address@hidden) at ../../src/xftfreetype.c:1115
1115            for (prev = &info->fontHash[font->info.hash % 
XFT_NUM_FONT_HASH];
$3 = (XftDisplayInfo *) 0x3a944d0
$4 = {next = 0x0, display = 0x321c690, codes = 0x3687988, defaults = 0x2d39930, 
hasRender = 1, fonts = 0x3f325d0, solidFormat = 0x38fa090, 
  glyph_memory = 72652, max_glyph_memory = 4194304, use_free_glyphs = 1, 
num_unref_fonts = 2, max_unref_fonts = 0, colors = {{color = {
        red = 31868, green = 47288, blue = 48059, alpha = 65535}, screen = 0, 
pict = 12582984}, {color = {red = 56540, green = 56540, 
        blue = 52428, alpha = 65535}, screen = 0, pict = 12582994}, {color = 
{red = 18036, green = 28271, blue = 116, alpha = 65535}, 
      screen = -1, pict = 0}, {color = {red = 22704, green = 687, blue = 0, 
alpha = 0}, screen = -1, pict = 0}, {color = {red = 2, 
        green = 47011, blue = 0, alpha = 65535}, screen = -1, pict = 0}, {color 
= {red = 32639, green = 40863, blue = 32639, 
        alpha = 65535}, screen = 0, pict = 12582969}, {color = {red = 57311, 
green = 44975, blue = 36751, alpha = 65535}, screen = 0, 
      pict = 12582979}, {color = {red = 60138, green = 47031, blue = 0, alpha = 
65535}, screen = 0, pict = 12582992}, {color = {
        red = 24415, green = 32639, blue = 24415, alpha = 65535}, screen = 0, 
pict = 12582962}, {color = {red = 16191, green = 16191, 
        blue = 16191, alpha = 65535}, screen = 0, pict = 12582989}, {color = 
{red = 65535, green = 65535, blue = 65535, alpha = 65535}, 
      screen = 0, pict = 12582966}, {color = {red = 39321, green = 39321, blue 
= 39321, alpha = 65535}, screen = 0, pict = 12582964}, {
      color = {red = 32639, green = 32639, blue = 32639, alpha = 65535}, screen 
= 0, pict = 12582976}, {color = {red = 49087, 
        green = 60395, blue = 49087, alpha = 65535}, screen = 0, pict = 
12582972}, {color = {red = 37779, green = 57568, blue = 58339, 
        alpha = 65535}, screen = 0, pict = 12582986}, {color = {red = 61680, 
green = 57311, blue = 44975, alpha = 65535}, screen = 0, 
      pict = 12583002}}, fontHash = {0x0 <repeats 19 times>, 0x3f325d0, 0x0, 
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3cd0c00, 
    0x0 <repeats 96 times>}}
There is no member named fonthash.
$5 = {0x0 <repeats 19 times>, 0x3f325d0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 
0x0, 0x0, 0x0, 0x3cd0c00, 0x0 <repeats 96 times>}
$6 = (XftFontInt *) 0x0
#0  XftFontManageMemory (address@hidden) at ../../src/xftfreetype.c:1115
#1  0x00007f1449f09e37 in _XftCloseDisplay (dpy=0x321c690, codes=<optimized 
out>) at ../../src/xftdpy.c:40
#2  0x00007f144a33b4f2 in XCloseDisplay () from 
/usr/lib/x86_64-linux-gnu/libX11.so.6
#3  0x00007f144aa97fd5 in ?? () from /usr/lib/x86_64-linux-gnu/libXt.so.6
#4  0x00007f144aa98b6c in XtCloseDisplay () from 
/usr/lib/x86_64-linux-gnu/libXt.so.6
#5  0x00000000005148cf in x_delete_terminal ()
#6  0x00000000004f305f in Fdelete_terminal ()
#7  0x00000000004232b6 in delete_frame ()
#8  0x00000000004235c9 in Fdelete_frame ()
#9  0x00000000005cebab in Ffuncall ()
#10 0x00000000005c93fe in Fcall_interactively ()
#11 0x00000000005cebda in Ffuncall ()
#12 0x0000000000610bb3 in exec_byte_code ()
#13 0x00000000005cf266 in funcall_lambda ()
#14 0x00000000005ced6d in Ffuncall ()
#15 0x00000000005ce502 in call1 ()
#16 0x000000000053a8c0 in command_loop_1 ()
#17 0x00000000005cb9e8 in internal_condition_case ()
#18 0x0000000000539eee in command_loop_2 ()
#19 0x00000000005cb1fa in internal_catch ()
#20 0x0000000000539e9c in command_loop ()
#21 0x000000000053967e in recursive_edit_1 ()
#22 0x00000000005397eb in Frecursive_edit ()
#23 0x00000000005377f3 in main ()
Stack level 0, frame at 0x7fff63f5ab20:
 rip = 0x7f1449f0dc05 in XftFontManageMemory (../../src/xftfreetype.c:1115); 
saved rip 0x7f1449f09e37
 called by frame at 0x7fff63f5ab40
 source language c.
 Arglist at 0x7fff63f5aae8, args: address@hidden
 Locals at 0x7fff63f5aae8, Previous frame's sp is 0x7fff63f5ab20
 Saved registers:
  rbx at 0x7fff63f5aaf8, rbp at 0x7fff63f5ab00, r12 at 0x7fff63f5ab08, r13 at 
0x7fff63f5ab10, rip at 0x7fff63f5ab18
1110                    *prev = font->next;
1111                    break;
1112                }
1113            }
1114            /* Unhook from hash list */
1115            for (prev = &info->fontHash[font->info.hash % 
XFT_NUM_FONT_HASH];
1116                 *prev;
1117                 prev = &(*(XftFontInt **) prev)->hash_next)
1118            {
1119                if (*prev == public)
1095        while (info->num_unref_fonts > info->max_unref_fonts)
1096        {
1097            public = XftFontFindNthUnref (info, rand() % 
info->num_unref_fonts);
1098            font = (XftFontInt *) public;
1099    
1100            if (XftDebug () & XFT_DBG_CACHE)
1101                printf ("freeing unreferenced font %s/%d size %dx%d\n",
1102                        font->info.file->file, font->info.file->id,
1103                        (int) font->info.xsize >> 6, (int) font->info.ysize 
>> 6);
1104    
$7 = (XftDisplayInfo *) 0x3a944d0
$8 = {next = 0x0, display = 0x321c690, codes = 0x3687988, defaults = 0x2d39930, 
hasRender = 1, fonts = 0x3f325d0, solidFormat = 0x38fa090, 
  glyph_memory = 72652, max_glyph_memory = 4194304, use_free_glyphs = 1, 
num_unref_fonts = 2, max_unref_fonts = 0, colors = {{color = {
        red = 31868, green = 47288, blue = 48059, alpha = 65535}, screen = 0, 
pict = 12582984}, {color = {red = 56540, green = 56540, 
        blue = 52428, alpha = 65535}, screen = 0, pict = 12582994}, {color = 
{red = 18036, green = 28271, blue = 116, alpha = 65535}, 
      screen = -1, pict = 0}, {color = {red = 22704, green = 687, blue = 0, 
alpha = 0}, screen = -1, pict = 0}, {color = {red = 2, 
        green = 47011, blue = 0, alpha = 65535}, screen = -1, pict = 0}, {color 
= {red = 32639, green = 40863, blue = 32639, 
        alpha = 65535}, screen = 0, pict = 12582969}, {color = {red = 57311, 
green = 44975, blue = 36751, alpha = 65535}, screen = 0, 
      pict = 12582979}, {color = {red = 60138, green = 47031, blue = 0, alpha = 
65535}, screen = 0, pict = 12582992}, {color = {
        red = 24415, green = 32639, blue = 24415, alpha = 65535}, screen = 0, 
pict = 12582962}, {color = {red = 16191, green = 16191, 
        blue = 16191, alpha = 65535}, screen = 0, pict = 12582989}, {color = 
{red = 65535, green = 65535, blue = 65535, alpha = 65535}, 
      screen = 0, pict = 12582966}, {color = {red = 39321, green = 39321, blue 
= 39321, alpha = 65535}, screen = 0, pict = 12582964}, {
      color = {red = 32639, green = 32639, blue = 32639, alpha = 65535}, screen 
= 0, pict = 12582976}, {color = {red = 49087, 
        green = 60395, blue = 49087, alpha = 65535}, screen = 0, pict = 
12582972}, {color = {red = 37779, green = 57568, blue = 58339, 
        alpha = 65535}, screen = 0, pict = 12582986}, {color = {red = 61680, 
green = 57311, blue = 44975, alpha = 65535}, screen = 0, 
      pict = 12583002}}, fontHash = {0x0 <repeats 19 times>, 0x3f325d0, 0x0, 
0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3cd0c00, 
    0x0 <repeats 96 times>}}

This is while running Emacs in a crouton chroot on a Chromebook. Is this
something Emacs may have introduced or should I be looking lower down in
the stack. I haven't updated the chroot for some time but I suppose it
could be a new interaction with the ChromeOS X server which Emacs is
running under.

Any ideas or hints on debugging this?


Cheers,

--
Alex Bennée
http://www.bennee.com/~alex