bug#10035: Crash in check_x_frame in w32fns.c

[Juanma Barranquero]

I'm hitting which I think is the same bug:

Breakpoint 1, w32_abort () at w32fns.c:7190
7190      button = MessageBox (NULL,(gdb) bt
#0  w32_abort () at w32fns.c:7190
#1  0x010ee13d in row_equal_p (a=0x508a158, b=0x4fcd158,
mouse_face_p=1) at dispnew.c:1294
#2  0x010f498b in scrolling_window (w=0x3974800, header_line_p=0) at
dispnew.c:4305
#3  0x010f317a in update_window (w=0x3974800, force_p=1) at dispnew.c:3605
#4  0x010f287a in update_window_tree (w=0x3974800, force_p=1) at dispnew.c:3349
#5  0x010f2853 in update_window_tree (w=0x3974c00, force_p=1) at dispnew.c:3347
#6  0x010f25c9 in update_frame (f=0x3a2ce00, force_p=1,
inhibit_hairy_id_p=0) at dispnew.c:3276
#7  0x011fec83 in redisplay_internal () at xdisp.c:13175
#8  0x011ffb84 in redisplay_preserve_echo_area (from_where=12) at xdisp.c:13389
#9  0x0104c131 in wait_reading_process_output (time_limit=300,
microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=54720538,
wait_proc=0x0,
    just_wait_proc=0) at process.c:4822
#10 0x010f99d9 in sit_for (timeout=1200, reading=1, do_display=1) at
dispnew.c:5994
#11 0x01009253 in read_char (commandflag=1, nmaps=4, maps=0x88f970,
prev_event=54720538, used_mouse_menu=0x88fa48, end_time=0x0) at
keyboard.c:2687
#12 0x0101c2bd in read_key_sequence (keybuf=0x88fbd0, bufsize=30,
prompt=54720538, dont_downcase_last=0, can_return_switch_frame=1,
    fix_current_buffer=1) at keyboard.c:9290
#13 0x01005c70 in command_loop_1 () at keyboard.c:1447
#14 0x01032e63 in internal_condition_case (bfun=0x1005678
<command_loop_1>, handlers=54778266, hfun=0x1004e97 <cmd_error>) at
eval.c:1499
#15 0x010052d4 in command_loop_2 (ignore=54720538) at keyboard.c:1158
#16 0x01032886 in internal_catch (tag=54776290, func=0x10052b0
<command_loop_2>, arg=54720538) at eval.c:1256
#17 0x01005290 in command_loop () at keyboard.c:1137
#18 0x0100486c in recursive_edit_1 () at keyboard.c:757
#19 0x01004b87 in Frecursive_edit () at keyboard.c:821
#20 0x010028b5 in main (argc=1, argv=0xa72c68) at emacs.c:1707


> Sorry, I meant to type this in frame #2, where a and be are arguments
> of the function row_equal_p:

(gdb) frame 1
#1  0x010ee13d in row_equal_p (a=0x508a158, b=0x4fcd158,
mouse_face_p=1) at dispnew.c:1294
1294      xassert (verify_row_hash (a));
(gdb) p a->enabled_p
$3 = 1
(gdb) p b->enabled_p
$4 = 1
(gdb)

I can reproduce it at will, but not from "emacs -Q". It happens for me
when trying to run slime + sbcl.

Output of "bt full" follows.

    Juanma



(gdb) bt full
#0  w32_abort () at w32fns.c:7190
        button = 0
#1  0x010ee13d in row_equal_p (a=0x508a158, b=0x4fcd158,
mouse_face_p=1) at dispnew.c:1294
No locals.
#2  0x010f498b in scrolling_window (w=0x3974800, header_line_p=0) at
dispnew.c:4305
        d = 0x4fcd158
        c = 0x508a158
        desired_matrix = 0x5330380
        current_matrix = 0x52ffc00
        yb = 465
        i = 2
        j = 84461132
        first_old = 83686988
        first_new = 84461132
        last_old = 124
        last_new = 87995232
        nruns = 83686988
        run_idx = 21981248
        n = 17764536
        entry = 0x4fcf64c
        rif = 0x14f6840
#3  0x010f317a in update_window (w=0x3974800, force_p=1) at dispnew.c:3605
        rc = -1
        end = 0x4fcf64c
        mode_line_row = 0x4fcf64c
        header_line_row = 0x0
        changed_p = 0
        mouse_face_overwritten_p = 0
        row = 0x4fcd000
        yb = 465
        desired_matrix = 0x5330380
        paused_p = 0
        rif = 0x14f6840
#4  0x010f287a in update_window_tree (w=0x3974800, force_p=1) at dispnew.c:3349
        paused_p = 0
#5  0x010f2853 in update_window_tree (w=0x3974c00, force_p=1) at dispnew.c:3347
        paused_p = 0
#6  0x010f25c9 in update_frame (f=0x3a2ce00, force_p=1,
inhibit_hairy_id_p=0) at dispnew.c:3276
        paused_p = 0
        root_window = 0x3974c00
#7  0x011fec83 in redisplay_internal () at xdisp.c:13175
        f = 0x3a2ce00
        tail = 59282974
        frame = 61001221
        w = 0x3974800
        sw = 0x3974800
        fr = 0x3a2ce00
        pending = 0
        must_finish = 1
        tlbufpos = {
          charpos = 342,
          bytepos = 342
        }
        tlendpos = {
          charpos = 0,
          bytepos = 0
        }
        number_of_visible_frames = 1
        count = 3
        count1 = 5
        sf = 0x3a2ce00
        polling_stopped_here = 1
        old_frame = 61001221
        consider_all_windows_p = 1
#8  0x011ffb84 in redisplay_preserve_echo_area (from_where=12) at xdisp.c:13389
No locals.
#9  0x0104c131 in wait_reading_process_output (time_limit=300,
microsecs=0, read_kbd=-1, do_display=1, wait_for_cell=54720538,
wait_proc=0x0,
    just_wait_proc=0) at process.c:4822
        nread = 261
        timeout_reduced_for_timers = 1
        channel = 3
        nfds = 1
        Available = {
          bits = {0, 0}
        }
        Writeok = {
          bits = {0, 0}
        }
        check_write = 0
        check_delay = 1
        no_avail = 0
        xerrno = 22
        proc = 60705797
        timeout = {
          tv_sec = 0,
          tv_usec = 179000
        }
        end_time = {
          tv_sec = 1321216849,
          tv_usec = 259000
        }
        wait_channel = -1
        got_some_input = 1
        count = 2
#10 0x010f99d9 in sit_for (timeout=1200, reading=1, do_display=1) at
dispnew.c:5994
        sec = 300
        usec = 0
#11 0x01009253 in read_char (commandflag=1, nmaps=4, maps=0x88f970,
prev_event=54720538, used_mouse_menu=0x88fa48, end_time=0x0) at
keyboard.c:2687
        tem0 = 8976680
        timeout = 300
        delay_level = 4
        buffer_size = 2
        c = 54720538
        jmpcount = 2
        local_getcjmp = {8976680, 60417664, 8976760, 60417672,
8976300, 16812939, 8978372, 0, 101, 0, 0, 60417664, 8976568, 16939745,
56133544,
          56297856}
        save_jump = {0 <repeats 16 times>}
        key_already_recorded = 0
        tem = 82319702
        save = 342
        previous_echo_area_message = 54720538
        also_record = 54720538
        reread = 0
        gcpro1 = {
          next = 0x1262215,
          var = 0x53ae98e,
          nvars = 54764386
        }
        gcpro2 = {
          next = 0x343a362,
          var = 0x10f,
          nvars = 8976408
        }
        polling_stopped_here = 0
        orig_kboard = 0x38ea980
#12 0x0101c2bd in read_key_sequence (keybuf=0x88fbd0, bufsize=30,
prompt=54720538, dont_downcase_last=0, can_return_switch_frame=1,
    fix_current_buffer=1) at keyboard.c:9290
        interrupted_kboard = 0x38ea980
        interrupted_frame = 0x3a2ce00
        key = 83529221
        used_mouse_menu = 0
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 54720538
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 4
        nmaps_allocated = 4
        defs = 0x88f950
        submaps = 0x88f970
        orig_local_map = 86338862
        orig_keymap = 54720538
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
          parent = 59285670,
          map = 59285670,
          start = 0,
          end = 0
        }
        keytran = {
          parent = 54709958,
          map = 54709958,
          start = 0,
          end = 0
        }
        indec = {
          parent = 59285678,
          map = 59285678,
          start = 0,
          end = 0
        }
        shift_translated = 0
        delayed_switch_frame = 54720538
        original_uppercase = 54825298
        original_uppercase_position = -1
        dummyflag = 0
        starting_buffer = 0x4fa8e00
        fake_prefixed_keys = 54720538
        outer_gcpro1 = {
          next = 0x162f5e4,
          var = 0x342f81a,
          nvars = 83529216
        }
#13 0x01005c70 in command_loop_1 () at keyboard.c:1447
        cmd = 54776506
        keybuf = {536871392, 196, 8977388, 8977120, 0, 0, 54720538,
54825802, 54720538, 0, 0, 2130567168, 0, 0, 8977464, 17009385,
54825802,
          54720538, 54698478, 54720538, 0, 54720538, 0, 2130567168, 0,
0, 8977512, 16992044, 2, 54698478}
        i = 1
        prev_modiff = 16
        prev_buffer = 0x4fa8400
        already_adjusted = 0
#14 0x01032e63 in internal_condition_case (bfun=0x1005678
<command_loop_1>, handlers=54778266, hfun=0x1004e97 <cmd_error>) at
eval.c:1499
        val = 54698478
        c = {
          tag = 54720538,
          val = 54720538,
          next = 0x88fd74,
          gcpro = 0x0,
          jmp = {8977720, 2130567168, 0, 0, 8977548, 16985616,
8978372, 0, 11291440, 8977684, 1968346385, 11291440, 1, 1973563960, 0,
3082},
          backlist = 0x0,
          handlerlist = 0x0,
          lisp_eval_depth = 0,
          pdlcount = 2,
          poll_suppress_count = 0,
          interrupt_input_blocked = 0,
          byte_stack = 0x0
        }
        h = {
          handler = 54778266,
          var = 54720538,
          chosen_clause = 1996562125,
          tag = 0x88fcc0,
          next = 0x0
        }
#15 0x010052d4 in command_loop_2 (ignore=54720538) at keyboard.c:1158
        val = 2130567168
#16 0x01032886 in internal_catch (tag=54776290, func=0x10052b0
<command_loop_2>, arg=54720538) at eval.c:1256
        c = {
          tag = 54776290,
          val = 54720538,
          next = 0x0,
          gcpro = 0x0,
          jmp = {8977896, 2130567168, 0, 0, 8977756, 16984183,
8978372, 0, 54720538, 54759424, 1973565248, 1973565311, 2130567168,
23404840,
            54759424, 23404840},
          backlist = 0x0,
          handlerlist = 0x0,
          lisp_eval_depth = 0,
          pdlcount = 2,
          poll_suppress_count = 0,
          interrupt_input_blocked = 0,
          byte_stack = 0x0
        }
#17 0x01005290 in command_loop () at keyboard.c:1137
No locals.
#18 0x0100486c in recursive_edit_1 () at keyboard.c:757
        count = 1
        val = 1972937794
#19 0x01004b87 in Frecursive_edit () at keyboard.c:821
        count = 0
        buffer = 54720538
#20 0x010028b5 in main (argc=1, argv=0xa72c68) at emacs.c:1707
        dummy = 8978372
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = 1
        skip_args = 0
        no_loadup = 0
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
(gdb)