bug#3399: Crash in multi-TTY mode

[Shannon Jones]

I'm almost embarrassed to report this, since it's rather strange and
most likely unique to my setup.  Still, it involves a crash so I
thought it would be worthwhile to see if anyone else can reproduce it.

* Emacs version: GNU Emacs 23.0.94.1 (i686-pc-linux-gnu, GTK+ Version
  2.10.4) of 2009-05-26

* Compiled on CentOS 5.3.

* No options given to configure

* To reproduce:

Run screen
In screen, run 'emacs -Q -nw'
M-x server-start
Detach screen (C-a d)

Now emacs is running in the background inside screen.

Run 'emacsclient -c' outside of screen, but as the same user.

As the window is painting, hit C-x C-c

The window will close.  Re-open screen, and see that Emacs has crashed
with this error:

Fatal error (11)Segmentation fault (core dumped)

My emacs is running on a server, and I'm displaying on my home machine
over the internet.  The latency is high enough that I can see the
screen painting (it takes about 5-10 seconds to fully paint the first
time).  If I wait until the window is completely open, then C-x C-c
doesn't crash emacs.

I'm using Windows XP with Xming 6.9.0.31 as the X server.  I can
reproduce it 100% of the time on this machine.

If I use Ubuntu 8.10 as the X server, then emacs doesn't crash.
However, on Ubuntu 8.10, if I hit C-x C-c repeatedly while the window
is drawing, then the background emacs (the one running in screen)
exits but doesn't crash.  It shouldn't exit, since I was typing C-x
C-c in the emacsclient window, not the background emacs session.  I
get 'xcxcxc' repeated on the command prompt in the screen session.  I
presume this is because I was repeatedly typing C-x C-c in the
emacsclient window.  Even though it was detatched, typing in the
emacsclient window is causing letters to appear on the command prompt
in the screen session.


Here is some output from gdb from core dump:
(gdb) bt
#0  0xffffe410 in __kernel_vsyscall ()
#1  0x420a81b6 in kill () from /lib/libc.so.6
#2  0x0811853f in fatal_error_signal (sig=11) at 
/home/sjones/src/emacs-23.0.94/src/emacs.c:403
#3  <signal handler called>
#4  0x423b98cb in ?? () from /usr/lib/libX11.so.6
#5  0x423b9951 in XrmDestroyDatabase () from /usr/lib/libX11.so.6
#6  0x080d6662 in x_delete_terminal (terminal=0x8566ff0) at 
/home/sjones/src/emacs-23.0.94/src/xterm.c:10748
#7  0x080cd0f2 in Fdelete_terminal (terminal=139882484, force=137882961) at 
/home/sjones/src/emacs-23.0.94/src/terminal.c:331
#8  0x0806296c in delete_frame (frame=141662156, force=137882961) at 
/home/sjones/src/emacs-23.0.94/src/frame.c:1511
#9  0x0818286e in Ffuncall (nargs=2, args=0xbf85a560) at 
/home/sjones/src/emacs-23.0.94/src/eval.c:3048
#10 0x081b5632 in Fbyte_code (bytestr=139173083, vector=140402188, maxdepth=48) 
at /home/sjones/src/emacs-23.0.94/src/bytecode.c:678
#11 0x081822d7 in funcall_lambda (fun=139418028, nargs=1, 
arg_vector=0xbf85a694) at /home/sjones/src/emacs-23.0.94/src/eval.c:3232
#12 0x081826fb in Ffuncall (nargs=2, args=0xbf85a690) at 
/home/sjones/src/emacs-23.0.94/src/eval.c:3102
#13 0x081b5632 in Fbyte_code (bytestr=138274787, vector=140375140, maxdepth=32) 
at /home/sjones/src/emacs-23.0.94/src/bytecode.c:678
#14 0x081822d7 in funcall_lambda (fun=140271524, nargs=1, 
arg_vector=0xbf85a7b4) at /home/sjones/src/emacs-23.0.94/src/eval.c:3232
#15 0x081826fb in Ffuncall (nargs=2, args=0xbf85a7b0) at 
/home/sjones/src/emacs-23.0.94/src/eval.c:3102
#16 0x081b5632 in Fbyte_code (bytestr=136489203, vector=136489220, maxdepth=24) 
at /home/sjones/src/emacs-23.0.94/src/bytecode.c:678
#17 0x081822d7 in funcall_lambda (fun=136489156, nargs=1, 
arg_vector=0xbf85a924) at /home/sjones/src/emacs-23.0.94/src/eval.c:3232
#18 0x081826fb in Ffuncall (nargs=2, args=0xbf85a920) at 
/home/sjones/src/emacs-23.0.94/src/eval.c:3102
#19 0x0817fb27 in Fcall_interactively (function=138844913, 
record_flag=137882913, keys=137921284) at 
/home/sjones/src/emacs-23.0.94/src/callint.c:868
#20 0x0818288e in Ffuncall (nargs=4, args=0xbf85aad0) at 
/home/sjones/src/emacs-23.0.94/src/eval.c:3051
#21 0x08182aa9 in call3 (fn=138047481, arg1=138844913, arg2=137882913, 
arg3=137882913) at /home/sjones/src/emacs-23.0.94/src/eval.c:2875
#22 0x08127dbb in command_loop_1 () at 
/home/sjones/src/emacs-23.0.94/src/keyboard.c:1901
#23 0x08181262 in internal_condition_case (bfun=0x8127a50 <command_loop_1>, 
handlers=137926017, hfun=0x81229e0 <cmd_error>) at 
/home/sjones/src/emacs-23.0.94/src/eval.c:1512
#24 0x08121f73 in command_loop_2 () at 
/home/sjones/src/emacs-23.0.94/src/keyboard.c:1359
#25 0x0818131a in internal_catch (tag=137922041, func=0x8121f50 
<command_loop_2>, arg=137882913) at 
/home/sjones/src/emacs-23.0.94/src/eval.c:1248
#26 0x08122837 in command_loop () at 
/home/sjones/src/emacs-23.0.94/src/keyboard.c:1338
#27 0x08122bab in recursive_edit_1 () at 
/home/sjones/src/emacs-23.0.94/src/keyboard.c:953
#28 0x08122ce1 in Frecursive_edit () at 
/home/sjones/src/emacs-23.0.94/src/keyboard.c:1015
#29 0x0811785b in main (argc=Cannot access memory at address 0x1
) at /home/sjones/src/emacs-23.0.94/src/emacs.c:1852




(gdb) frame 6
#6  0x080d6662 in x_delete_terminal (terminal=0x8566ff0) at 
/home/sjones/src/emacs-23.0.94/src/xterm.c:10748
10748         XrmDestroyDatabase (dpyinfo->xrdb);


(gdb) print *dpyinfo
$1 = {next = 0x0, terminal = 0x8566ff0, connection = 6, display = 0x86b99f8, 
name_list_element = 140648661, reference_count = 0, screen = 0x8625570, resx = 
75.027692307692305, resy = 74.950819672131146, visual = 0x85de890, cmap = 32,
  n_planes = 24, grabbed = 0, icon_bitmap_id = -1, root_window = 62, 
client_leader_window = 0, vertical_scroll_bar_cursor = 8388619, xg_cursor = 
0x8534fb8, xrdb = 0x8567158, smallest_char_width = 7, smallest_font_height = 15,
  scratch_cursor_gc = 0x0, mouse_face_beg_row = -1, mouse_face_beg_col = -1, 
mouse_face_beg_x = 0, mouse_face_beg_y = 0, mouse_face_end_row = -1, 
mouse_face_end_col = -1, mouse_face_end_x = 0, mouse_face_end_y = 0,
  mouse_face_past_end = 0, mouse_face_window = 137882913, mouse_face_face_id = 
0, mouse_face_overlay = 137882913, mouse_face_deferred_gc = 0, 
mouse_face_mouse_frame = 0x0, mouse_face_mouse_x = 577, mouse_face_mouse_y = 
263,
  mouse_face_defer = 0, mouse_face_hidden = 0, mouse_face_image_state = 0, 
x_id_name = 0x8535020 "emacs@mymachine.example.com", n_fonts = 6, bitmaps = 
0x0, bitmaps_size = 0, bitmaps_last = 0, meta_mod_mask = 8, shift_lock_mask = 0,
  alt_mod_mask = 0, super_mod_mask = 0, hyper_mod_mask = 0, Xatom_wm_protocols 
= 165, Xatom_wm_take_focus = 262, Xatom_wm_save_yourself = 276, 
Xatom_wm_delete_window = 166, Xatom_wm_change_state = 168, 
Xatom_wm_configure_denied = 277,
  Xatom_wm_window_moved = 278, Xatom_wm_client_leader = 191, Xatom_editres = 
254, Xatom_CLIPBOARD = 169, Xatom_TIMESTAMP = 279, Xatom_TEXT = 280, 
Xatom_DELETE = 281, Xatom_COMPOUND_TEXT = 173, Xatom_UTF8_STRING = 172,
  Xatom_MULTIPLE = 282, Xatom_INCR = 283, Xatom_EMACS_TMP = 284, Xatom_TARGETS 
= 174, Xatom_NULL = 285, Xatom_ATOM_PAIR = 286, Xatom_PIXEL_SIZE = 151, 
Xatom_AVERAGE_WIDTH = 156, Xatom_MULE_BASELINE_OFFSET = 287,
  Xatom_MULE_RELATIVE_COMPOSE = 288, Xatom_MULE_DEFAULT_ASCENT = 289, 
Xatom_DONE = 291, Xatom_PAGE = 290, Xatom_Scrollbar = 292, Xatom_XEMBED = 293, 
cut_buffers_initialized = 0, x_focus_frame = 0x0, x_focus_event_frame = 0x0,
  x_highlight_frame = 0x0, gray = 8388620, xim = 0x0, xim_styles = 0x85eeee0, 
xim_callback_data = 0x85fc2e8, color_cells = 0x0, ncolor_cells = 0, red_bits = 
8, blue_bits = 8, green_bits = 8, red_offset = 16, blue_offset = 0,
  green_offset = 8, wm_type = X_WMTYPE_UNKNOWN, x_dnd_atoms = 0x853cfa0, 
x_dnd_atoms_size = 8, x_dnd_atoms_length = 6, net_supported_atoms = 0x0, 
nr_net_supported_atoms = 0, net_supported_window = 0, Xatom_net_wm_state = 266,
  Xatom_net_wm_state_fullscreen_atom = 270, Xatom_net_wm_state_maximized_horz = 
269, Xatom_net_wm_state_maximized_vert = 268}


(gdb) print dpyinfo->xrdb
$2 = (XrmDatabase) 0x8567158