bug-gnu-emacs
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

bug#18180: 24.3.92; Segfault in mark_object


From: Mat Smiglarski
Subject: bug#18180: 24.3.92; Segfault in mark_object
Date: Sun, 03 Aug 2014 16:03:09 +0100
User-agent: Roundcube Webmail/1.0.1

This is a segfault during GC, in mark_object.

1. Start emacs

$ emacs -Q

2. Call some code which kills and creates a frame between 2 and 25 times.

This segfault is reasonably straightforward to reproduce, I can cause the crash within 2 minutes of starting emacs.

On the emacs-24 branch, this seems to occur in mark_object. The issue is also found on the trunk branch so I have supplied details of this also, however the backtrace is slightly different.

The issue may relate to bugs #15583 and #17168.

Finally, I have a core dumps which I don't mind sharing for both of these crashes which are ~350MB each, please ask.

Regards,
Mat

System Info:

In GNU Emacs 24.3.92.3 (x86_64-unknown-linux-gnu, GTK+ Version 3.10.8)
 of 2014-08-03 on zz
Windowing system distributor `The X.Org Foundation', version 11.0.11501000
System Description:     Ubuntu 14.04 LTS

Important settings:
  value of $LC_CTYPE: en_US.UTF-8
  value of $LANG: en_US.UTF-8
  value of $XMODIFIERS: @im=ibus
  locale-coding-system: utf-8-unix

Details of the two segfaults:

Crash on emacs-24 branch
(gdb) p Fsymbol_value(intern("emacs-bzr-version"))
$3 = 12112050
Attachment: backtrace.6212 (Output from bt full)

Crash on trunk:
(gdb) p Fsymbol_value(intern("emacs-bzr-version"))
$1 = 12341426
Attachment: backtrace.6069

2 shorter backtraces follow:

6212 - (gdb) bt full 6
#0  mark_object (arg=<optimized out>) at alloc.c:6248
        obj = 139640014399843
        cdr_count = 0
#1  0x000000000053b8a0 in Fgarbage_collect () at alloc.c:5647
        nextb = 0x19a2c10
        stack_top_variable = 0 '\000'
        i = <optimized out>
        message_p = false
        retval = <optimized out>
        tot_before = 0
#2  0x00000000005534d2 in maybe_gc () at lisp.h:4564
No locals.
#3  Ffuncall (nargs=5, args=0x7fffffffc738) at eval.c:2766
        fun = <optimized out>
        original_fun = <optimized out>
        numargs = 4
        val = <optimized out>
        internal_args = <optimized out>
        i = <optimized out>
#4 0x00000000005878e5 in exec_byte_code (bytestr=3, vector=2866666, maxdepth=182, args_template=12112050, nargs=140737488340816, args=0x5) at bytecode.c:916 targets = {0x58797c <exec_byte_code+988>, 0x58813f <exec_byte_code+2975>, 0x588144 <exec_byte_code+2980>, 0x588149 <exec_byte_code+2985>,
          0x587772 <exec_byte_code+466>, 0x587778 <exec_byte_code+472>,
0x588919 <exec_byte_code+4985>, 0x588956 <exec_byte_code+5046>, 0x5889d8 <exec_byte_code+5176>, 0x5889dd <exec_byte_code+5181>, 0x5889a7 <exec_byte_code+5127>, 0x5889ac <exec_byte_code+5132>,
          0x5877a9 <exec_byte_code+521>, 0x5877b0 <exec_byte_code+528>,
0x587e17 <exec_byte_code+2167>, 0x5889b1 <exec_byte_code+5137>, 0x587f83 <exec_byte_code+2531>, 0x587f88 <exec_byte_code+2536>, 0x588005 <exec_byte_code+2661>, 0x58800a <exec_byte_code+2666>,
          0x587815 <exec_byte_code+629>, 0x587818 <exec_byte_code+632>,
0x587fb4 <exec_byte_code+2580>, 0x587f8d <exec_byte_code+2541>, 0x588036 <exec_byte_code+2710>, 0x58803b <exec_byte_code+2715>, 0x588040 <exec_byte_code+2720>, 0x588045 <exec_byte_code+2725>,
          0x587881 <exec_byte_code+737>, 0x587888 <exec_byte_code+744>,
0x587ff0 <exec_byte_code+2640>, 0x58800f <exec_byte_code+2671>, 0x588091 <exec_byte_code+2801>, 0x588096 <exec_byte_code+2806>, 0x58809b <exec_byte_code+2811>, 0x5880a5 <exec_byte_code+2821>,
          0x5878c3 <exec_byte_code+803>, 0x5878c8 <exec_byte_code+808>,
0x588055 <exec_byte_code+2741>, 0x58806a <exec_byte_code+2762>, 0x5879f2 <exec_byte_code+1106>, 0x5879f7 <exec_byte_code+1111>, 0x5879fc <exec_byte_code+1116>, 0x5880ca <exec_byte_code+2858>,
          0x587905 <exec_byte_code+869>, 0x587908 <exec_byte_code+872>,
0x5880b5 <exec_byte_code+2837>, 0x5879cb <exec_byte_code+1067>, 0x58881e <exec_byte_code+4734>, 0x588813 <exec_byte_code+4723>,
          0x58871f <exec_byte_code+4479>, 0x58797c <exec_byte_code+988>,
          0x58797c <exec_byte_code+988>, 0x58797c <exec_byte_code+988>,
          0x58797c <exec_byte_code+988>, 0x58797c <exec_byte_code+988>,
0x588b3e <exec_byte_code+5534>, 0x588bcc <exec_byte_code+5676>, 0x588c03 <exec_byte_code+5731>, 0x588c3a <exec_byte_code+5786>, 0x588c71 <exec_byte_code+5841>, 0x587eda <exec_byte_code+2362>, 0x587f14 <exec_byte_code+2420>, 0x588cb2 <exec_byte_code+5906>, 0x587e9f <exec_byte_code+2303>, 0x587f48 <exec_byte_code+2472>, 0x588ce4 <exec_byte_code+5956>, 0x588d18 <exec_byte_code+6008>, 0x588d40 <exec_byte_code+6048>, 0x588d74 <exec_byte_code+6100>, 0x588da9 <exec_byte_code+6153>, 0x588e20 <exec_byte_code+6272>, 0x588e48 <exec_byte_code+6312>, 0x588e7c <exec_byte_code+6364>, 0x588eb4 <exec_byte_code+6420>, 0x588edc <exec_byte_code+6460>, 0x588f04 <exec_byte_code+6500>, 0x588f38 <exec_byte_code+6552>, 0x588f6c <exec_byte_code+6604>, 0x588fa0 <exec_byte_code+6656>, 0x588fd8 <exec_byte_code+6712>, 0x58900d <exec_byte_code+6765>, 0x589042 <exec_byte_code+6818>, 0x5890b9 <exec_byte_code+6937>, 0x5890f2 <exec_byte_code+6994>, 0x58912b <exec_byte_code+7051>, 0x589244 <exec_byte_code+7332>, 0x5891d2 <exec_byte_code+7218>, 0x58920b <exec_byte_code+7275>, 0x58927d <exec_byte_code+7389>, 0x5892b6 <exec_byte_code+7446>, 0x5892eb <exec_byte_code+7499>, 0x58931d <exec_byte_code+7549>, 0x589352 <exec_byte_code+7602>, 0x589387 <exec_byte_code+7655>, 0x5893bc <exec_byte_code+7708>,
          0x58945a <exec_byte_code+7866>, 0x58794d <exec_byte_code+941>,
0x589490 <exec_byte_code+7920>, 0x5894b8 <exec_byte_code+7960>, 0x589527 <exec_byte_code+8071>, 0x58955d <exec_byte_code+8125>, 0x589593 <exec_byte_code+8179>, 0x5895bb <exec_byte_code+8219>, 0x5895e5 <exec_byte_code+8261>, 0x58960f <exec_byte_code+8303>,
          0x58963c <exec_byte_code+8348>, 0x58797c <exec_byte_code+988>,
0x58966b <exec_byte_code+8395>, 0x589698 <exec_byte_code+8440>, 0x5896c5 <exec_byte_code+8485>, 0x5896f2 <exec_byte_code+8530>, 0x58971f <exec_byte_code+8575>, 0x58974c <exec_byte_code+8620>,
          0x58794d <exec_byte_code+941>, 0x58797c <exec_byte_code+988>,
0x589774 <exec_byte_code+8660>, 0x5897b3 <exec_byte_code+8723>, 0x5897db <exec_byte_code+8763>, 0x589803 <exec_byte_code+8803>, 0x589837 <exec_byte_code+8855>, 0x58986b <exec_byte_code+8907>, 0x5882f2 <exec_byte_code+3410>, 0x5883c8 <exec_byte_code+3624>, 0x589a74 <exec_byte_code+9428>, 0x589aa8 <exec_byte_code+9480>, 0x5883fc <exec_byte_code+3676>, 0x588429 <exec_byte_code+3721>,
          0x58797c <exec_byte_code+988>, 0x58866b <exec_byte_code+4299>,
0x587a05 <exec_byte_code+1125>, 0x587e2c <exec_byte_code+2188>, 0x587c71 <exec_byte_code+1745>, 0x587b13 <exec_byte_code+1395>, 0x587d73 <exec_byte_code+2003>, 0x5885f7 <exec_byte_code+4183>, 0x58864a <exec_byte_code+4266>, 0x587fc9 <exec_byte_code+2601>, 0x58853c <exec_byte_code+3996>, 0x5884de <exec_byte_code+3902>, 0x5886b7 <exec_byte_code+4375>, 0x5886e6 <exec_byte_code+4422>, 0x58884d <exec_byte_code+4781>, 0x588899 <exec_byte_code+4857>, 0x5888d1 <exec_byte_code+4913>, 0x588ae8 <exec_byte_code+5448>, 0x5884b1 <exec_byte_code+3857>, 0x588451 <exec_byte_code+3761>, 0x588489 <exec_byte_code+3817>, 0x589893 <exec_byte_code+8947>, 0x5898bb <exec_byte_code+8987>, 0x5898e3 <exec_byte_code+9027>, 0x58990b <exec_byte_code+9067>, 0x58993f <exec_byte_code+9119>, 0x589973 <exec_byte_code+9171>, 0x5899a7 <exec_byte_code+9223>, 0x5899db <exec_byte_code+9275>, 0x588155 <exec_byte_code+2997>, 0x588189 <exec_byte_code+3049>, 0x5881bd <exec_byte_code+3101>, 0x5881e5 <exec_byte_code+3141>, 0x588219 <exec_byte_code+3193>, 0x58824d <exec_byte_code+3245>, 0x588285 <exec_byte_code+3301>, 0x5882bd <exec_byte_code+3357>, 0x5893f1 <exec_byte_code+7761>, 0x589426 <exec_byte_code+7814>, 0x5880cf <exec_byte_code+2863>,
          0x58810d <exec_byte_code+2925>, 0x58797c <exec_byte_code+988>,
0x587a99 <exec_byte_code+1273>, 0x587d18 <exec_byte_code+1912>, 0x587b83 <exec_byte_code+1507>, 0x587c0e <exec_byte_code+1646>, 0x58856b <exec_byte_code+4043>, 0x588dde <exec_byte_code+6206>, 0x589077 <exec_byte_code+6871>, 0x5894e5 <exec_byte_code+8005>, 0x5889e2 <exec_byte_code+5186>, 0x588a1f <exec_byte_code+5247>,
          0x58797c <exec_byte_code+988>, 0x58797c <exec_byte_code+988>,
          0x588a70 <exec_byte_code+5328>, 0x58797c <exec_byte_code+988>,
          0x58797c <exec_byte_code+988>, 0x58797c <exec_byte_code+988>,
          0x58797c <exec_byte_code+988>, 0x58797c <exec_byte_code+988>,
          0x58797c <exec_byte_code+988>, 0x58797c <exec_byte_code+988>,
          0x58797c <exec_byte_code+988>, 0x58797c <exec_byte_code+988>,
          0x588ab8 <exec_byte_code+5400> <repeats 64 times>}
        stack = {
          pc = 0xac48b8 <pure+2671224> "\207",
          byte_string = 9140745,
byte_string_start = 0xac486b <pure+2671147> "\303\304\b\t\b\305=\203E",
          next = 0x7fffffffc9e0
        }
        result = 3
        type = (unknown: 4294952784)
#5 0x000000000055318f in funcall_lambda (fun=9140701, address@hidden,
    address@hidden) at eval.c:3049
        val = <optimized out>
        syms_left = 12112050
        lexenv = 12112050
        i = <optimized out>
        optional = <optimized out>
        rest = <optimized out>
(More stack frames follow...)

Lisp Backtrace:
"Automatic GC" (0xb73088)
"apply" (0xffffc740)
"face-spec-reset-face" (0xffffc990)
"face-spec-recalc" (0xffffcb40)
"byte-code" (0xffffcc30)
"face-set-after-frame-default" (0xffffcf20)
"x-create-frame-with-faces" (0xffffd0d0)
"make-frame" (0xffffd200)
"let*" (0xffffd3f8)
"setq" (0xffffd4e8)
"stupider-speed-read" (0xffffd6c8)
"call-interactively" (0xffffd8d0)
"command-execute" (0xffffda40)
"execute-extended-command" (0xffffdba8)
"call-interactively" (0xffffde20)
"command-execute" (0xffffdf68)

6069 - (gdb) bt full 6
**** bt full 6
#0  XCAR (c=3255377271362580334) at lisp.h:1052
No locals.
#1  compact_undo_list (list=3255377271362580334) at alloc.c:5506
        tail = 3255377271362580334
        prev = 0x7fffffffb678
#2  garbage_collect_1 (end=0x7fffffffb668) at alloc.c:5675
        nextb = 0x194b800
        i = <optimized out>
        retval = <optimized out>
        stack_top_variable = 0 '\000'
        message_p = false
        tot_before = 0
#3  Fgarbage_collect () at alloc.c:5896
        end = 0x7fffffffb668
#4  0x0000000000558ee2 in maybe_gc () at lisp.h:4547
No locals.
#5  Ffuncall (nargs=2, args=0x7fffffffb7f8) at eval.c:2759
        fun = <optimized out>
        original_fun = <optimized out>
        numargs = 1
        val = <optimized out>
        internal_args = <optimized out>
        i = <optimized out>
(More stack frames follow...)

Lisp Backtrace:
"Automatic GC" (0xbaa970)
"purecopy" (0xffffb800)
"set-face-attribute" (0xffffb9b8)
"apply" (0xffffbbc0)
"face-spec-reset-face" (0xffffbe10)
"face-spec-recalc" (0xffffbfc0)
"byte-code" (0xffffc0b0)
"face-set-after-frame-default" (0xffffc3a0)
"x-create-frame-with-faces" (0xffffc550)
"make-frame" (0xffffc680)
"let*" (0xffffc878)
"setq" (0xffffc968)
"stupider-speed-read" (0xffffcbf0)
"funcall-interactively" (0xffffcbe8)
"call-interactively" (0xffffce20)
"command-execute" (0xffffcf90)
"execute-extended-command" (0xffffd190)
"funcall-interactively" (0xffffd188)
"call-interactively" (0xffffd3f0)
"command-execute" (0xffffd538)
"call-last-kbd-macro" (0xffffd780)
"kmacro-call-macro" (0xffffd970)
"kmacro-end-and-call-macro" (0xffffdc00)
"funcall-interactively" (0xffffdbf8)
"call-interactively" (0xffffde00)
"command-execute" (0xffffdf48)

Attachment: backtrace.6212
Description: Text Data

Attachment: backtrace.6069
Description: Text Data


reply via email to

[Prev in Thread] Current Thread [Next in Thread]