bug#5365: 23.1.91; Wrong type argument: keymapp, ("DEAD" . 35215396)

[Stefan Monnier]

>> Today I've built and installed an emacs-snapshot package for Debian, and
>> I'm seeing this:
>> 
>> ,----
>> | % emacs -Q
>> | Wrong type argument: keymapp, ("DEAD" . 35215396)
>> | % echo $?
>> | 255
>> `----

This cons cell is almost for sure on the free-list.  I.e. the memory
management code thought it was unused and put it back on the free list
for reuse (and luckily it hasn't been reused yet).

This implies that a backtrace probably won't be sufficient to track it
down :-(

>> Unfortunately this is a Heisenbug, I'm not able to reproduce it under
>> gdb.

> I now managed to attach gdb to a running process and get a backtrace
> after setting a breakpoint on Fsignal:

> | Lisp Backtrace:
> | "keymap-parent" (0xffa14acc)
> | "x-setup-function-keys" (0xffa14c34)
> | "x-create-frame-with-faces" (0xffa14db4)
> | "make-frame" (0xffa14f34)
> | "frame-initialize" (0xffa150b4)
> | "command-line" (0xffa15234)
> | "normal-top-level" (0xffa15330)
> | (gdb)

OK, so if we trust your backtrace (if you compiled with optimizations,
there's a good chance that some parts of the backtrace aren't to be
trusted, tho the Lisp part is less likely to be invented), the above
implies that we're looking at the (keymap-parent local-function-key-map)
call in x-win.el's x-setup-function-keys.

> ,----
> | (gdb) bt
> | #0  Fsignal (error_symbol=138366426, data=138990086) at eval.c:1629
> | #1  0x0818cfa8 in xsignal (error_symbol=138366426, data=138990086) at 
> eval.c:1729
> | #2  0x0818d377 in xsignal2 (error_symbol=138366426, arg1=138358370, 
> arg2=140861614) at eval.c:1753
> | #3  0x0817b0a1 in wrong_type_argument (predicate=138358370, 
> value=140861614) at data.c:118
> | #4  0x081324a5 in get_keymap (object=140861614, error=1, autoload=1) at 
> keymap.c:307
> | #5  0x08132d32 in keymap_parent (keymap=140861614, autoload=1) at 
> keymap.c:321
> | #6  0x08132dc9 in Fkeymap_parent (keymap=140861614) at keymap.c:341

And this seems to indicate that the free cons cell ("DEAD" . 35215396)
is actually the one we got from local-function-key-map.  As for how that
could happen...


        Stefan