bug#11813: Fwd: bug#11813: Segmentation fault on launch related to x_draw_glyph_string_background

[Left Right]

Sorry, I replied to Eli Zaretskii forgetting to CC the list.

---------- Forwarded message ----------
From: Left Right <olegsivokon@gmail.com>
Date: Fri, Jun 29, 2012 at 12:30 PM
Subject: Re: bug#11813: Segmentation fault on launch related to
x_draw_glyph_string_background
To: Eli Zaretskii <eliz@gnu.org>


I've reset the flags to no optimization and recompiled, and I see the
same error. Below is the full log, I'll paste it here in case the list
doesn't accept attachments, sorry if it will come out crooked.

Starting program: /home/wvxvw/projects/emacs-sources/emacs/src/emacs -q
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0x000000000056c02e in x_draw_glyph_string_background
(s=0x7fffffffba40, force_p=1) at xterm.c:1210
1210          else if (FONT_HEIGHT (s->font) < s->height - 2 * box_line_width
#0  0x000000000056c02e in x_draw_glyph_string_background
(s=0x7fffffffba40, force_p=1) at xterm.c:1210
       box_line_width = 0
#1  0x0000000000571508 in x_draw_glyph_string (s=0x7fffffffba40) at xterm.c:2814
       relief_drawn_p = 0
#2  0x0000000000493044 in draw_glyphs (w=0x146bdc0, x=850,
row=0x16748e0, area=TEXT_AREA, start=0, end=68, hl=DRAW_NORMAL_TEXT,
overlaps=0) at xdisp.c:23404
       head = 0x7fffffffbbe0
       tail = 0x7fffffffb940
       s = 0x7fffffffba40
       clip_head = 0x0
       clip_tail = 0x0
       i = 68
       j = 32
       x_reached = 850
       last_x = 841
       area_left = 1
       f = 0x146adb0
#3  0x000000000049a056 in x_write_glyphs (start=0xf20600, len=68) at
xdisp.c:25046
       x = 0
       hpos = 0
       chpos = 0
#4  0x0000000000415c2c in update_text_area (w=0x146bdc0, vpos=37) at
dispnew.c:3773
       current_row = 0xf23b90
       desired_row = 0x16748e0
       rif = 0xab19c0
       changed_p = 0
#5  0x000000000041676d in update_window_line (w=0x146bdc0, vpos=37,
mouse_face_overwritten_p=0x7fffffffc16c) at dispnew.c:4014
       current_row = 0xf23b90
       desired_row = 0x16748e0
       rif = 0xab19c0
       changed_p = 0
#6  0x000000000041563e in update_window (w=0x146bdc0, force_p=1) at
dispnew.c:3575
       end = 0x16748e0
       mode_line_row = 0x16748e0
       header_line_row = 0x0
       changed_p = 0
       mouse_face_overwritten_p = 0
       row = 0x16723e0
       yb = 612
       n_updated = 0
       desired_matrix = 0x11d6bb0
       paused_p = 15208032
       preempt_count = 9
       rif = 0xab19c0
#7  0x0000000000414cbc in update_window_tree (w=0x146bdc0, force_p=1)
at dispnew.c:3340
       paused_p = 0
#8  0x00000000004149a8 in update_frame (f=0x146adb0, force_p=1,
inhibit_hairy_id_p=1) at dispnew.c:3269
       paused_p = 0
       root_window = 0x146bdc0
#9  0x000000000045f36f in echo_area_display (update_frame_p=1) at xdisp.c:10752
       n = 1
       mini_window = 21417429
       w = 0x146cdd0
       f = 0x146adb0
       window_height_changed_p = 0
       sf = 0x146adb0
#10 0x000000000045ad75 in message3_nolog (m=23714017, nbytes=65,
multibyte=0) at xdisp.c:9628
       mini_window = 21417429
       frame = 21409205
       f = 0x146adb0
       sf = 0x146adb0
#11 0x000000000045a8cc in message3 (m=23714017, nbytes=65,
multibyte=0) at xdisp.c:9565
       gcpro1 = {
         next = 0x7fffffffc430,
         var = 0x6a9c9b,
         nvars = 0
       }
#12 0x0000000000699686 in Fmessage (nargs=2, args=0x7fffffffc4f0) at
editfns.c:3436
       val = 23714017
#13 0x00000000006a8de7 in Ffuncall (nargs=3, args=0x7fffffffc4e8) at eval.c:2802
       fun = 14492773
       original_fun = 15278610
       funcar = 15361794
       numargs = 2
       lisp_numargs = 6827520
       val = 11994129
       backtrace = {
         next = 0x7fffffffc940,
         function = 0x7fffffffc4e8,
         args = 0x7fffffffc4f0,
         nargs = 2,
         debug_on_exit = 0
       }
       internal_args = 0x7fffffffc9d8
       i = 15279986
#14 0x0000000000718bbc in exec_byte_code (bytestr=11994369,
vector=11994557, maxdepth=24, args_template=0, nargs=0,
args=0x7fffffffc9d8) at bytecode.c:784
       count = 4
       op = 2
       vectorp = 0xb705c8
       stack = {
         pc = 0xd9cad0 ")\207",
         byte_string = 11994369,
         byte_string_start = 0xd9ca97 "\305\030\t\206\071",
         constants = 11994557,
         next = 0x7fffffffcac0
       }
       top = 0x7fffffffc4e8
       result = 15527856
#15 0x00000000006a9c9b in funcall_lambda (fun=11994317, nargs=0,
arg_vector=0x7fffffffc9d8) at eval.c:2986
       val = 8589921008
       syms_left = 0
       next = 19143602
       lexenv = 412
       count = 4
       i = 2
       optional = -13792
       rest = 32767
#16 0x00000000006a9529 in Ffuncall (nargs=1, args=0x7fffffffc9d0) at eval.c:2869
       fun = 11994317
       original_fun = 19439986
       funcar = 100000000
       numargs = 0
       lisp_numargs = 23522358
       val = 140737488347888
       backtrace = {
         next = 0x7fffffffcea0,
         function = 0x7fffffffc9d0,
         args = 0x7fffffffc9d8,
         nargs = 0,
         debug_on_exit = 0
       }
       internal_args = 0x7fffffffcf30
       i = 0
#17 0x0000000000718bbc in exec_byte_code (bytestr=11996273,
vector=11997101, maxdepth=88, args_template=1028, nargs=1,
args=0x7fffffffcf38) at bytecode.c:784
       count = 4
       op = 0
       vectorp = 0xb70fb8
       stack = {
         pc = 0xd9c51a "\210\b\203\021",
         byte_string = 11996273,
         byte_string_start = 0xd9c518 "\306 \210\b\203\021",
         constants = 11997101,
         next = 0x7fffffffd000
       }
       top = 0x7fffffffc9d0
       result = 140737488341568
#18 0x00000000006a9c9b in funcall_lambda (fun=11996221, nargs=1,
arg_vector=0x7fffffffcf30) at eval.c:2986
       val = 4310088018
       syms_left = 1028
       next = 15147520
       lexenv = 14970704
       count = 4
       i = 140737488345264
       optional = 22
       rest = 0
#19 0x00000000006a9529 in Ffuncall (nargs=2, args=0x7fffffffcf28) at eval.c:2869
       fun = 11996221
       original_fun = 19437266
       funcar = 15147520
       numargs = 1
       lisp_numargs = 6827520
       val = 19597478
       backtrace = {
         next = 0x7fffffffd3e0,
         function = 0x7fffffffcf28,
         args = 0x7fffffffcf30,
         nargs = 1,
         debug_on_exit = 0
       }
       internal_args = 0x12b0896
       i = 15279746
#20 0x0000000000718bbc in exec_byte_code (bytestr=11955625,
vector=11957277, maxdepth=72, args_template=0, nargs=0,
args=0x7fffffffd478) at bytecode.c:784
       count = 4
       op = 1
       vectorp = 0xb67428
       stack = {
         pc = 0xd9f3d7 "\210\016H\203\214\005\201\300",
         byte_string = 11955625,
         byte_string_start = 0xd9ee57 "\306
\020\307\021\n\023\307\024\310\311!\211\307=\204\060",
         constants = 11957277,
         next = 0x7fffffffd4f0
       }
       top = 0x7fffffffcf28
       result = 23097713
#21 0x00000000006a9c9b in funcall_lambda (fun=11955573, nargs=0,
arg_vector=0x7fffffffd478) at eval.c:2986
       val = 140737488345264
       syms_left = 0
       next = 140737488343984
       lexenv = 6786392
       count = 4
       i = 5
       optional = -11112
       rest = 32767
#22 0x00000000006a9529 in Ffuncall (nargs=1, args=0x7fffffffd470) at eval.c:2869
       fun = 11955573
       original_fun = 19238802
       funcar = 15147520
       numargs = 0
       lisp_numargs = 6827520
       val = 15120722
       backtrace = {
         next = 0x7fffffffda40,
         function = 0x7fffffffd470,
         args = 0x7fffffffd478,
         nargs = 0,
         debug_on_exit = 0
       }
       internal_args = 0x1607171
       i = 22203478
#23 0x0000000000718bbc in exec_byte_code (bytestr=11951433,
vector=11951885, maxdepth=32, args_template=0, nargs=0,
args=0x7fffffffd8b0) at bytecode.c:784
       count = 3
       op = 0
       vectorp = 0xb65f18
       stack = {
         pc = 0xd9f934
"\210)\210\351\352\353\"\210\354\321\355\"\211;\203\256",
         byte_string = 11951433,
         byte_string_start = 0xd9f89f "\b\203\b",
         constants = 11951885,
         next = 0x0
       }
       top = 0x7fffffffd470
       result = 140737308851520
#24 0x00000000006a9c9b in funcall_lambda (fun=11951381, nargs=0,
arg_vector=0x7fffffffd8b0) at eval.c:2986
       val = 140737353973760
       syms_left = 0
       next = 140737308427896
       lexenv = 140737293415912
       count = 3
       i = 4294969316
       optional = 33
       rest = 0
#25 0x00000000006a98c5 in apply_lambda (fun=11951381, args=15120722)
at eval.c:2929
       args_left = 15120722
       i = 0
       numargs = 0
       arg_vector = 0x7fffffffd8b0
       gcpro1 = {
         next = 0x0,
         var = 0x15f0778,
         nvars = 0
       }
       gcpro2 = {
         next = 0x100000000,
         var = 0xffffffff,
         nvars = 140737488345680
       }
       gcpro3 = {
         next = 0x7fff00000001,
         var = 0x0,
         nvars = 140733193388033
       }
       tem = 2
       sa_count = 3
       sa_must_free = 0
#26 0x00000000006a7120 in eval_sub (form=15346758) at eval.c:2212
       fun = 11951381
       val = 140737353973760
       original_fun = 19139458
       original_args = 15120722
       funcar = 15120722
       backtrace = {
         next = 0x0,
         function = 0x7fffffffda70,
         args = 0x7fffffffd8b0,
         nargs = 0,
         debug_on_exit = 0
       }
       gcpro1 = {
         next = 0x7fffffffdaa0,
         var = 0x683a75,
         nvars = 2822930839
       }
       gcpro2 = {
         next = 0x7ffff7fd66e0,
         var = 0x7fffffffda90,
         nvars = 276967387
       }
       gcpro3 = {
         next = 0x7ffff4617000,
         var = 0x7fffffffda70,
         nvars = 1
       }
#27 0x00000000006a6270 in Feval (form=15346758, lexical=15120722) at eval.c:2021
       count = 2
#28 0x00000000005cc3bf in top_level_2 () at keyboard.c:1164
No locals.
#29 0x00000000006a446d in internal_condition_case (bfun=0x5cc3a2
<top_level_2>, handlers=15172450, hfun=0x5cbea5 <cmd_error>) at
eval.c:1333
       val = 6079425
       c = {
         tag = 15120722,
         val = 15120722,
         next = 0x7fffffffdd00,
         gcpro = 0x0,
         jmp = {{
             __jmpbuf = {2, -5741430973350281040, 4243568,
140737488347888, 0, 0, -5741430973453041488, 5741431852756107440},
             __mask_was_saved = 0,
             __saved_mask = {
               __val = {4294967295, 0, 1, 11191568, 0, 0, 0, 0,
140737351960338, 1, 0, 1, 140737308399024, 1, 2, 140737488346656}
             }
           }},
         backlist = 0x0,
         handlerlist = 0x0,
         lisp_eval_depth = 0,
         pdlcount = 2,
         poll_suppress_count = 1,
         interrupt_input_blocked = 0,
         byte_stack = 0x0
       }
       h = {
         handler = 15172450,
         var = 15120722,
         chosen_clause = 140737488346080,
         tag = 0x7fffffffdb90,
         next = 0x0
       }
#30 0x00000000005cc3f9 in top_level_1 (ignore=15120722) at keyboard.c:1172
No locals.
#31 0x00000000006a3cfd in internal_catch (tag=15168242, func=0x5cc3c1
<top_level_1>, arg=15120722) at eval.c:1090
       c = {
         tag = 15168242,
         val = 15120722,
         next = 0x0,
         gcpro = 0x0,
         jmp = {{
             __jmpbuf = {2, -5741430973297852240, 4243568,
140737488347888, 0, 0, -5741430973339795280, 5741431850440851632},
             __mask_was_saved = 0,
             __saved_mask = {
               __val = {15120722, 140737488346608, 6830709, 0,
4302523939, 140737311891096, 15120722, 15340368, 140737488346712, 14,
15147520, 14523360, 6827487, 140737488346672,
                 15120722, 4243568}
             }
           }},
         backlist = 0x0,
         handlerlist = 0x0,
         lisp_eval_depth = 0,
         pdlcount = 2,
         poll_suppress_count = 1,
         interrupt_input_blocked = 0,
         byte_stack = 0x0
       }
#32 0x00000000005cc31d in command_loop () at keyboard.c:1127
No locals.
#33 0x00000000005cb6f1 in recursive_edit_1 () at keyboard.c:754
       count = 1
       val = 6077156
#34 0x00000000005cbacc in Frecursive_edit () at keyboard.c:818
       count = 0
       buffer = 15120722
#35 0x00000000005c927c in main (argc=2, argv=0x7fffffffe2f8) at emacs.c:1693
       dummy = 140737354131128
       stack_bottom_variable = 0 '\000'
       do_initial_setlocale = 1
       skip_args = 0
       rlim = {
         rlim_cur = 8720000,
         rlim_max = 18446744073709551615
       }
       no_loadup = 0
       junk = 0x0
       dname_arg = 0x0
       ch_to_dir = 0x3d8f538 <Address 0x3d8f538 out of bounds>

Lisp Backtrace:
"message" (0xffffc4f0)
"display-startup-echo-area-message" (0xffffc9d8)
"command-line-1" (0xffffcf30)
"command-line" (0xffffd478)
"normal-top-level" (0xffffd8b0)
$1 = {
 x = 82,
 y = 631,
 ybase = 649,
 width = 288,
 background_width = 288,
 height = 25,
 left_overhang = 0,
 right_overhang = 0,
 f = 0x146adb0,
 w = 0x146bdc0,
 display = 0x161a6b0,
 window = 52428926,
 row = 0x16748e0,
 area = TEXT_AREA,
 char2b = 0x0,
 nchars = 12,
 hl = DRAW_NORMAL_TEXT,
 face = 0x16549c0,
 font = 0x0,
 cmp = 0x0,
 cmp_id = 0,
 cmp_from = 0,
 cmp_to = 0,
 extends_to_end_of_line_p = 0,
 background_filled_p = 0,
 two_byte_p = 0,
 font_not_found_p = 0,
 stippled_p = 0,
 for_overlaps = 0,
 padding_p = 0,
 gc = 0xf64360,
 first_glyph = 0xf20780,
 img = 0x0,
 slice = {
   x = 0,
   y = 0,
   width = 0,
   height = 0
 },
 clip_head = 0x0,
 clip_tail = 0x0,
 clip = {{
     x = 1,
     y = 631,
     width = 840,
     height = 25
   }, {
     x = 0,
     y = 0,
     width = 0,
     height = 0
   }},
 num_clips = 1,
 underline_position = 0,
 underline_thickness = 0,
 next = 0x7fffffffb940,
 prev = 0x7fffffffbbe0
}
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff548a497 in kill () from /lib/libc.so.6
A debugging session is active.

       Inferior 1 [process 27265] will be killed.

Quit anyway? (y or n)

As an aside, I also tried to compile it with no XFT support, with the
same result. When configuring for this compilation I didn't add any
more options, just the --enable-checking --enable-asserts.

Best.

Oleg

gdb.txt
Description: Text document