bug#17753: Cygwin emacs-X11 core dump

[Ken Brown]

On 9/17/2014 6:16 AM, Eli Zaretskii wrote:
> Anyway, one thing that strikes me (and is consistent across all your
> reports until now) is that atimer.c functions are run from a separate
> thread, not the main thread (which is Thread 1).  Ken, is this normal
> in the Cygwin-w32 build?

Timer functions in general are run in the main thread.  I don't think 
the backtrace of Thread 2 can be trusted.  Something weird is going on 
in Thread 2 in both the Cygwin-w32 build and the Cygwin-X11 build.  And 
it happens only on 64-bit Cygwin (which is where we've been seeing these 
strange crashes).

Here's a sample gdb session using the Cygwin-w32 build on 64-bit Cygwin 
(but I see the same thing with the Cygwin-X11 build):

$ gdb /usr/bin/emacs-w32.exe
GNU gdb (GDB) 7.6.50.20130728-cvs (cygwin-special)
[...]
(gdb) b run_timers
Breakpoint 1 at 0x10064785c: file 
/usr/src/debug/emacs-24.3.93-4/src/atimer.c, line 342.
(gdb) r -Q
Starting program: /usr/bin/emacs-w32.exe -Q
[New Thread 2072.0x1140]
[New Thread 2072.0x25ec]
[New Thread 2072.0x764]
[New Thread 2072.0x22d4]
[New Thread 2072.0x1c08]

Breakpoint 1, run_timers () at 
/usr/src/debug/emacs-24.3.93-4/src/atimer.c:342
342     {
(gdb) thread apply all bt

Thread 5 (Thread 2072.0x1c08):
#0  0x0000000076eb9e6a in USER32!SfmDxSetSwapChainStats ()
   from /c/Windows/system32/USER32.dll
#1  0x0000000076eb9e9e in USER32!GetMessageW ()
   from /c/Windows/system32/USER32.dll
#2  0x0000000000000000 in ?? ()

Thread 4 (Thread 2072.0x22d4):
#0  0x0000000076ff12fa in ntdll!ZwWaitForSingleObject ()
   from /c/Windows/system32/ntdll.dll
#1  0x000007fefce510dc in WaitForSingleObjectEx ()
   from /c/Windows/system32/KERNELBASE.dll
#2  0x0000000000000000 in ?? ()

Thread 3 (Thread 2072.0x764):
#0  0x0000000076ff186a in ntdll!ZwWaitForMultipleObjects ()
   from /c/Windows/system32/ntdll.dll
#1  0x0000000076fbb037 in ntdll!TpIsTimerSet ()
   from /c/Windows/system32/ntdll.dll
#2  0x0000000000000000 in ?? ()

Thread 2 (Thread 2072.0x25ec):
#0  0x0000000076ff131a in ntdll!ZwReadFile () from 
/c/Windows/system32/ntdll.dll
#1  0x000007fefce51a7a in ReadFile () from 
/c/Windows/system32/KERNELBASE.dll
#2  0x000000000042ce00 in ?? ()
#3  0x0000000100647983 in run_timers ()
    at /usr/src/debug/emacs-24.3.93-4/src/atimer.c:364
Backtrace stopped: previous frame inner to this frame (corrupt stack?)

Thread 1 (Thread 2072.0x1140):
#0  run_timers () at /usr/src/debug/emacs-24.3.93-4/src/atimer.c:342
#1  0x00000001006479b4 in do_pending_atimers ()
    at /usr/src/debug/emacs-24.3.93-4/src/atimer.c:385
#2  0x000000010053fb87 in process_pending_signals ()
    at /usr/src/debug/emacs-24.3.93-4/src/keyboard.c:7105
#3  0x00000001005b3c53 in Fmake_list (length=0, init=4306501682)
    at /usr/src/debug/emacs-24.3.93-4/src/alloc.c:2644
#4  0x00000001005e4e85 in concat (nargs=1, args=0x429650,
    target_type=Lisp_Cons, last_special=false)
    at /usr/src/debug/emacs-24.3.93-4/src/fns.c:588
#5  0x00000001005e4868 in Fcopy_sequence (arg=25770952502)
    at /usr/src/debug/emacs-24.3.93-4/src/fns.c:456
#6  0x000000010053a111 in timer_check ()
    at /usr/src/debug/emacs-24.3.93-4/src/keyboard.c:4568
[...]

You can see the expected timer functions running in the main thread, but 
I have no idea what's going on in Thread 2.  Is run_timers really being 
called there, or is that just an artifact of a corrupt stack?

Repeating the same steps in 32-bit Cygwin, gives the following:

$ gdb /usr/bin/emacs-w32.exe
GNU gdb (GDB) 7.6.50.20130728-cvs (cygwin-special)
[...]
(gdb) b run_timers
Breakpoint 1 at 0x5e625e: file 
/usr/src/debug/emacs-24.3.93-4/src/atimer.c, line 343.
(gdb) r -Q
Starting program: /usr/bin/emacs-w32.exe -Q
[New Thread 3284.0x25d0]
[New Thread 3284.0x2088]
[New Thread 3284.0x27a0]
[New Thread 3284.0x216c]
[New Thread 3284.0x9d0]

Breakpoint 1, run_timers () at 
/usr/src/debug/emacs-24.3.93-4/src/atimer.c:343
343       struct timespec now = current_timespec ();
(gdb) thread apply all bt

Thread 5 (Thread 3284.0x9d0):
#0  0x769778d7 in USER32!DispatchMessageW () from 
/c/Windows/syswow64/USER32.dll
#1  0x005ffd9c in w32_msg_pump (msg_buf=0x3c0acd8)
    at /usr/src/debug/emacs-24.3.93-4/src/w32fns.c:2450
#2  0x005fffdf in w32_msg_worker@4 (arg=0x0)
    at /usr/src/debug/emacs-24.3.93-4/src/w32fns.c:2676
#3  0x61005eb4 in _cygtls::call2(unsigned long (*)(void*, void*), void*, 
void*)@16 (this=<optimized out>, func=func@entry=0x5fff3f 
<w32_msg_worker@4>,
    arg=0x3c0ac70, arg@entry=0x0, buf=buf@entry=0x3c0cdc4)
    at /usr/src/debug/cygwin-1.7.32-1/winsup/cygwin/cygtls.cc:100
#4  0x61006026 in _cygtls::call (func=0x5fff3f <w32_msg_worker@4>, arg=0x0)
    at /usr/src/debug/cygwin-1.7.32-1/winsup/cygwin/cygtls.cc:30
#5  0x6107d6c8 in threadfunc_fe (arg=<optimized out>)
    at /usr/src/debug/cygwin-1.7.32-1/winsup/cygwin/init.cc:30
#6  0x76bf338a in KERNEL32!BaseThreadInitThunk ()
   from /c/Windows/syswow64/kernel32.dll
#7  0x771b9f72 in ntdll!RtlInitializeExceptionChain ()
   from /c/Windows/system32/ntdll.dll
#8  0x771b9f45 in ntdll!RtlInitializeExceptionChain ()
   from /c/Windows/system32/ntdll.dll
#9  0x00000000 in ?? ()

Thread 4 (Thread 3284.0x216c):
#0  0x7719f8d1 in ntdll!ZwWaitForSingleObject ()
   from /c/Windows/system32/ntdll.dll
#1  0x7719f8d1 in ntdll!ZwWaitForSingleObject ()
   from /c/Windows/system32/ntdll.dll
#2  0x756814ab in WaitForSingleObjectEx ()
   from /c/Windows/syswow64/KERNELBASE.dll
#3  0x00000318 in ?? ()
#4  0x00000000 in ?? ()

Thread 3 (Thread 3284.0x27a0):
#0  0x771a015d in ntdll!ZwWaitForMultipleObjects ()
   from /c/Windows/system32/ntdll.dll
#1  0x771a015d in ntdll!ZwWaitForMultipleObjects ()
   from /c/Windows/system32/ntdll.dll
#2  0x771d2f91 in ntdll!RtlMoveMemory () from /c/Windows/system32/ntdll.dll
#3  0x00000001 in ?? ()
#4  0x00000001 in ?? ()
#5  0x00000000 in ?? ()

Thread 2 (Thread 3284.0x2088):
#0  0x7719f905 in ntdll!ZwReadFile () from /c/Windows/system32/ntdll.dll
#1  0x7719f905 in ntdll!ZwReadFile () from /c/Windows/system32/ntdll.dll
#2  0x7567dd62 in ReadFile () from /c/Windows/syswow64/KERNELBASE.dll
#3  0x00000094 in ?? ()
#4  0x00000000 in ?? ()

Thread 1 (Thread 3284.0x25d0):
#0  run_timers () at /usr/src/debug/emacs-24.3.93-4/src/atimer.c:343
#1  0x005e634c in do_pending_atimers ()
    at /usr/src/debug/emacs-24.3.93-4/src/atimer.c:385
#2  0x0050d946 in process_pending_signals ()
    at /usr/src/debug/emacs-24.3.93-4/src/keyboard.c:7105
#3  0x0056c13e in Fmake_list (length=0, init=9555994)
    at /usr/src/debug/emacs-24.3.93-4/src/alloc.c:2644
#4  0x00594cba in concat (nargs=1, args=0x28a030, target_type=Lisp_Cons,
    last_special=false) at /usr/src/debug/emacs-24.3.93-4/src/fns.c:588
#5  0x005947cf in Fcopy_sequence (arg=-2146299490)
    at /usr/src/debug/emacs-24.3.93-4/src/fns.c:456
#6  0x00508e9f in timer_check ()
    at /usr/src/debug/emacs-24.3.93-4/src/keyboard.c:4571

Notice that Thread 2 doesn't look much different than Threads 3 and 4; 
in particular, it doesn't show that strange call to run_timers.

I think I should take this to the Cygwin list, unless you have other 
suggestions of things to look at.

Ken