bug#44329: 28.0.50; Crash in bidi_mirror_char on view-hello-file when no bidi-display-reordering (harfbuzz)

[Kevin Brubeck Unhammer]

I'm seeing a crash in displaying hebrew characters when I have
bidi-display-reordering set to nil. I had to set it to t to be able to
write this email :)

Possibly related to these two:
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=44113
https://debbugs.gnu.org/cgi/bugreport.cgi?bug=41627
though I'm running with their patches
(0f1f795fc8b72bfa0381089d1ff60f8801e394b0 built today).

$ cat  ~/.emacs.d/chartab-bug-init.el
(setq-default bidi-display-reordering nil)

$ cat  ~/.emacs.d/chartab-fail.el

;                           "שָׁלוֹם"


$ gdb emacs
GNU gdb (Ubuntu 9.2-0ubuntu1~20.04) 9.2
Copyright (C) 2020 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from emacs...
SIGINT is used by the debugger.
Are you sure you want to change it? (y or n) [answered Y; input not from 
terminal]
DISPLAY = :0.0
TERM = tmux
Breakpoint 1 at 0x1aefa0: file emacs.c, line 377.
Breakpoint 2 at 0x176134: file xterm.c, line 10151.
(gdb) run --fg-daemon -Q -l ~/.emacs.d/chartab-bug-init.el
Starting program: /home/unhammer/src/emacs-nonative/src/emacs --fg-daemon -Q -l 
~/.emacs.d/chartab-bug-init.el
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Warning: due to a long standing Gtk+ bug
https://gitlab.gnome.org/GNOME/gtk/issues/221
Emacs might crash when run in daemon mode and the X11 connection is 
unexpectedly lost.
Using an Emacs configured with --with-x-toolkit=lucid does not have this 
problem.
[New Thread 0x7ffff1377700 (LWP 2219216)]
Starting Emacs daemon.
[New Thread 0x7ffff095a700 (LWP 2220385)]
[New Thread 0x7fffebfff700 (LWP 2220386)]
[Detaching after vfork from child process 2220387]
[Detaching after vfork from child process 2220389]

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
0x000055555568bc54 in char_table_ref (table=XIL(0), c=1513) at chartab.c:237
237           val = tbl->contents[CHARTAB_IDX (c, 0, 0)];
(gdb) bt
#0  0x000055555568bc54 in char_table_ref (table=XIL(0), c=1513) at chartab.c:237
#1  0x000055555568f3ca in CHAR_TABLE_REF (ct=XIL(0), idx=1513) at lisp.h:2024
#2  0x000055555568fa15 in bidi_mirror_char (c=1513) at bidi.c:382
#3  0x0000555555873a98 in uni_mirroring (funcs=0x55555679c620, ch=1513, 
user_data=0x0) at hbfont.c:347
#4  0x00007ffff74f088e in  () at /usr/lib/x86_64-linux-gnu/libharfbuzz.so.0
#5  0x00007ffff74fe1b4 in hb_shape_plan_execute () at 
/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0
#6  0x00007ffff74fe69a in hb_shape_full () at 
/usr/lib/x86_64-linux-gnu/libharfbuzz.so.0
#7  0x0000555555873f7b in hbfont_shape (lgstring=XIL(0x7ffff203f27d), 
direction=XIL(0x2640)) at hbfont.c:494
#8  0x00005555557ef6d9 in Ffont_shape_gstring (gstring=XIL(0x7ffff203f27d), 
direction=XIL(0x2640)) at font.c:4482
#9  0x00005555557cbc4b in funcall_subr (subr=0x555555c81820 
<Sfont_shape_gstring>, numargs=2, args=0x7fffffff5030) at eval.c:2884
#10 0x00005555557cb7e5 in Ffuncall (nargs=3, args=0x7fffffff5028) at eval.c:2809
#11 0x000055555581b0fe in exec_byte_code (bytestr=XIL(0x7ffff1f93134), 
vector=XIL(0x7ffff1cea0d5), maxdepth=make_fixnum(7), args_template=XIL(0), 
nargs=0, args=0x0)
    at bytecode.c:632
#12 0x00005555557cbed6 in fetch_and_exec_byte_code (fun=XIL(0x7ffff1cea0ad), 
syms_left=XIL(0), nargs=0, args=0x0) at eval.c:2931
#13 0x00005555557cc61d in funcall_lambda (fun=XIL(0x7ffff1cea0ad), nargs=2, 
arg_vector=0x0) at eval.c:3081
#14 0x00005555557cb829 in Ffuncall (nargs=3, args=0x7fffffff5818) at eval.c:2811
#15 0x000055555581b0fe in exec_byte_code (bytestr=XIL(0x7ffff203f1ec), 
vector=XIL(0x7ffff203ef2d), maxdepth=make_fixnum(6), args_template=XIL(0), 
nargs=0, args=0x0)
    at bytecode.c:632
#16 0x00005555557cbed6 in fetch_and_exec_byte_code (fun=XIL(0x7ffff203eefd), 
syms_left=XIL(0), nargs=0, args=0x0) at eval.c:2931
#17 0x00005555557cc61d in funcall_lambda (fun=XIL(0x7ffff203eefd), nargs=6, 
arg_vector=0x0) at eval.c:3081
#18 0x00005555557cb829 in Ffuncall (nargs=7, args=0x7fffffff5d40) at eval.c:2811
#19 0x00005555557c7e58 in internal_condition_case_n (bfun=0x5555557cb665 
<Ffuncall>, nargs=7, args=0x7fffffff5d40, handlers=XIL(0x30), 
hfun=0x5555555c9e33 <safe_eval_handler>)
    at eval.c:1439
#20 0x00005555555ca0ef in safe__call (inhibit_quit=false, nargs=7, 
func=XIL(0x2aaa9c35b768), ap=0x7fffffff5e20) at xdisp.c:2982
#21 0x00005555555ca1ea in safe_call (nargs=7, func=XIL(0x2aaa9c35b768)) at 
xdisp.c:2997
#22 0x0000555555857df1 in autocmp_chars (rule=XIL(0x7ffff203e60d), charpos=12, 
bytepos=12, limit=15, win=0x5555562ff518, face=0x555556616900, string=XIL(0), 
direction=XIL(0x2640))
    at composite.c:939
#23 0x0000555555858c36 in composition_reseat_it (cmp_it=0x7fffffff7f80, 
charpos=12, bytepos=12, endpos=21, w=0x5555562ff518, bidi_level=0 '\000', 
face=0x555556616900, string=XIL(0))
    at composite.c:1250
#24 0x00005555555d9c9d in next_element_from_buffer (it=0x7fffffff7700) at 
xdisp.c:8938
#25 0x00005555555d609f in get_next_display_element (it=0x7fffffff7700) at 
xdisp.c:7476
#26 0x0000555555604379 in display_line (it=0x7fffffff7700, cursor_vpos=3) at 
xdisp.c:23426
#27 0x00005555555f794f in try_window (window=XIL(0x5555562ff51d), pos=..., 
flags=1) at xdisp.c:19363
#28 0x00005555555f4de6 in redisplay_window (window=XIL(0x5555562ff51d), 
just_this_one_p=false) at xdisp.c:18781
#29 0x00005555555ed29b in redisplay_window_0 (window=XIL(0x5555562ff51d)) at 
xdisp.c:16495
#30 0x00005555557c7cd8 in internal_condition_case_1
    (bfun=0x5555555ed255 <redisplay_window_0>, arg=XIL(0x5555562ff51d), 
handlers=XIL(0x7ffff202336b), hfun=0x5555555ed219 <redisplay_window_error>) at 
eval.c:1383
#31 0x00005555555ed1eb in redisplay_windows (window=XIL(0x5555562ff51d)) at 
xdisp.c:16475
#32 0x00005555555ebfe1 in redisplay_internal () at xdisp.c:15943
#33 0x00005555555ecb69 in redisplay_preserve_echo_area (from_where=12) at 
xdisp.c:16296
#34 0x000055555582d7b8 in wait_reading_process_output (time_limit=0, nsecs=0, 
read_kbd=-1, do_display=true, wait_for_cell=XIL(0), wait_proc=0x0, 
just_wait_proc=0) at process.c:5818
#35 0x0000555555710729 in kbd_buffer_get_event (kbp=0x7fffffffcc10, 
used_mouse_menu=0x7fffffffd21d, end_time=0x0) at keyboard.c:3874
#36 0x000055555570c55c in read_event_from_main_queue (end_time=0x0, 
local_getcjmp=0x7fffffffd020, used_mouse_menu=0x7fffffffd21d) at keyboard.c:2160
#37 0x000055555570c879 in read_decoded_event_from_main_queue (end_time=0x0, 
local_getcjmp=0x7fffffffd020, prev_event=XIL(0), 
used_mouse_menu=0x7fffffffd21d) at keyboard.c:2224
#38 0x000055555570e09e in read_char (commandflag=1, map=XIL(0x555555e93293), 
prev_event=XIL(0), used_mouse_menu=0x7fffffffd21d, end_time=0x0) at 
keyboard.c:2834
#39 0x000055555571d0cd in read_key_sequence
    (keybuf=0x7fffffffd400, prompt=XIL(0), dont_downcase_last=false, 
can_return_switch_frame=true, fix_current_buffer=true, prevent_redisplay=false) 
at keyboard.c:9552
#40 0x000055555570a178 in command_loop_1 () at keyboard.c:1354
#41 0x00005555557c7c29 in internal_condition_case (bfun=0x555555709d10 
<command_loop_1>, handlers=XIL(0x90), hfun=0x555555709441 <cmd_error>) at 
eval.c:1359
#42 0x00005555557099ad in command_loop_2 (ignore=XIL(0)) at keyboard.c:1095
#43 0x00005555557c742f in internal_catch (tag=XIL(0xd710), func=0x55555570997c 
<command_loop_2>, arg=XIL(0)) at eval.c:1120
#44 0x0000555555709948 in command_loop () at keyboard.c:1074
#45 0x0000555555708ff2 in recursive_edit_1 () at keyboard.c:718
#46 0x000055555570917d in Frecursive_edit () at keyboard.c:790
#47 0x0000555555705912 in main (argc=5, argv=0x7fffffffd888) at emacs.c:2047

Lisp Backtrace:
"font-shape-gstring" (0xffff5030)
"hebrew-shape-gstring" (0xffff5820)
"auto-compose-chars" (0xffff5d48)
"redisplay_internal (C function)" (0x0)
(gdb) up 10
#10 0x00005555557cb7e5 in Ffuncall (nargs=3, args=0x7fffffff5028) at eval.c:2809
2809        val = funcall_subr (XSUBR (fun), numargs, args + 1);
(gdb) p *args
$1 = XIL(0x2aaa9c2af820)
(gdb) pr
font-shape-gstring
(gdb) p args[1]
$2 = XIL(0x7ffff203f27d)
(gdb) pr
[[#<font-object "-PfEd-Linux Libertine Display 
O-normal-normal-normal-*-18-*-*-*-*-0-iso10646-1"> 1513 1464 1473] nil [0 0 
1513 1005 11 0 11 11 0 nil] [1 1 1464 967 0 1 5 -1 4 nil] [2 2 1473 976 0 5 7 
12 -10 nil] nil nil nil nil nil]
(gdb) p args[2]
$3 = XIL(0x2640)
(gdb) pr
L2R
(gdb) q




In GNU Emacs 28.0.50 (build 1, x86_64-pc-linux-gnu, GTK+ Version 3.24.20, cairo 
version 1.16.0)
 of 2020-10-30 built on vengepadda
Repository revision: 0f1f795fc8b72bfa0381089d1ff60f8801e394b0
Repository branch: master
Windowing system distributor 'The X.Org Foundation', version 11.0.12008000
System Description: Ubuntu 20.04.1 LTS

Configured using:
 'configure --prefix=/home/unhammer/PREFIX/emacs-nonative
 --with-libsystemd --with-pop=yes --with-sound=alsa --without-gconf
 --with-mailutils --with-json --with-cairo
 --enable-check-lisp-object-type --with-x=yes --with-x-toolkit=gtk3
 --with-toolkit-scroll-bars 'CFLAGS=-O0 -g3''

Configured features:
XPM JPEG TIFF GIF PNG RSVG CAIRO SOUND GPM DBUS GSETTINGS GLIB NOTIFY
INOTIFY ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE HARFBUZZ M17N_FLT LIBOTF
ZLIB TOOLKIT_SCROLL_BARS GTK3 X11 XDBE XIM MODULES THREADS LIBSYSTEMD
JSON PDUMPER LCMS2

Important settings:
  value of $LANG: nn_NO.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Lisp Interaction

Minor modes in effect:
  shell-dirtrack-mode: t
  evil-mode: t
  evil-local-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
~/src/evil/evil-common hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-common
~/src/evil/evil-search hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-search
~/src/evil/evil-keybindings hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-keybindings
~/src/evil/evil-development hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-development
~/src/evil/evil-states hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-states
~/src/evil/evil-vars hides /home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-vars
~/src/evil/evil-commands hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-commands
~/src/evil/evil hides /home/unhammer/.emacs.d/elpa/evil-1.14.0/evil
~/src/evil/evil-command-window hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-command-window
~/src/evil/evil-integration hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-integration
~/src/evil/evil-types hides /home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-types
~/src/evil/evil-digraphs hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-digraphs
~/src/evil/evil-core hides /home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-core
~/src/evil/evil-repeat hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-repeat
~/src/evil/evil-pkg hides /home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-pkg
~/src/evil/evil-maps hides /home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-maps
~/src/evil/evil-macros hides 
/home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-macros
~/src/evil/evil-ex hides /home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-ex
~/src/evil/evil-jumps hides /home/unhammer/.emacs.d/elpa/evil-1.14.0/evil-jumps
/home/unhammer/.emacs.d/elpa/hierarchy-0.7.0/hierarchy hides 
/home/unhammer/PREFIX/emacs-nonative/share/emacs/28.0.50/lisp/emacs-lisp/hierarchy

Features:
(shadow sort mail-extr emacsbug message rmc puny dired dired-loaddefs
rfc822 mml mml-sec epa derived epg epg-config gnus-util rmail
rmail-loaddefs text-property-search time-date mm-decode mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils evil
evil-keybindings evil-integration evil-maps evil-commands reveal
flyspell ispell evil-jumps evil-command-window evil-types evil-search
evil-ex shell pcomplete comint ansi-color evil-macros evil-repeat
evil-states evil-core advice evil-common windmove thingatpt rect
evil-digraphs evil-vars ring finder-inf csv-mode-autoloads edmacro
kmacro minimap-autoloads rx url-auth info package easymenu browse-url
url url-proxy url-privacy url-expand url-methods url-history url-cookie
url-domsuf url-util mailcap url-handlers url-parse auth-source cl-seq
eieio eieio-core cl-macs eieio-loaddefs password-cache json subr-x map
url-vars seq byte-opt gv bytecomp byte-compile cconv cl-loaddefs cl-lib
tooltip eldoc electric uniquify ediff-hook vc-hooks lisp-float-type
mwheel term/x-win x-win term/common-win x-dnd tool-bar dnd fontset image
regexp-opt fringe tabulated-list replace newcomment text-mode elisp-mode
lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow isearch
timer select scroll-bar mouse jit-lock font-lock syntax facemenu
font-core term/tty-colors frame minibuffer cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray
cl-preloaded nadvice button loaddefs faces cus-face macroexp files
window text-properties overlay sha1 md5 base64 format env code-pages
mule custom widget hashtable-print-readable backquote threads dbusbind
inotify lcms2 dynamic-setting system-font-setting font-render-setting
cairo move-toolbar gtk x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 138012 9411)
 (symbols 48 15127 1)
 (strings 32 48525 2377)
 (string-bytes 1 1693551)
 (vectors 16 20401)
 (vector-slots 8 254917 9835)
 (floats 8 34 15)
 (intervals 56 237 0)
 (buffers 992 10))

signature.asc
Description: PGP signature