bug#23259: 25.1.50; Xerror: "BadLength" on extreme zoom causing emacs to segfault

[Matthew Leach]

Recipe:

emacs -Q
open a file, emacs/src/process.c, say.
C-x C-=
and keep pressing
C-=

Emacs will grind to a halt a little but will eventually segfault when
the zoom is extreme enough.

Attached is the backtrace.  It looks as though X has thrown an error,
maybe we need to limit the amount of zoom that Emacs allows?

In GNU Emacs 25.1.50.1 (x86_64-unknown-linux-gnu, GTK+ Version 3.18.9)
 of 2016-03-24 built on spline
Repository revision: 39577d07124ee16895b9c6aab7e2c6e7d41cc715
Windowing system distributor 'The X.Org Foundation', version 11.0.11803000
Configured using:
 'configure --prefix=/usr/local'

Configured features:
XPM JPEG TIFF GIF PNG RSVG SOUND GPM DBUS GSETTINGS NOTIFY ACL GNUTLS
LIBXML2 FREETYPE XFT ZLIB TOOLKIT_SCROLL_BARS GTK3 X11

Important settings:
  value of $LANG: en_GB.UTF8
  locale-coding-system: utf-8-unix

Major mode: Group

Minor modes in effect:
  text-scale-mode: t
  gnus-topic-mode: t
  gnus-undo-mode: t
  diff-auto-refine-mode: t
  show-paren-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  buffer-read-only: t
  line-number-mode: t
  transient-mark-mode: t

Recent messages:
Checking new news...done
Checking new news...
Reading active file via nndraft...done
Checking new news...done
Checking new news...
Reading active file via nndraft...done
Checking new news...done
Checking new news...
Reading active file via nndraft...done
Checking new news...done

Load-path shadows:
/home/matthew/.emacs.d/elpa/emms-20160304.920/tq hides 
/usr/local/share/emacs/25.1.50/lisp/emacs-lisp/tq

Features:
(shadow emacsbug ielm shr-color color shr svg dom mm-archive face-remap
nnir smiley gnus-cite mail-extr gnus-async gnus-bcklg qp gnus-ml
gnus-topic nndraft nnmh utf-7 nnfolder bbdb-gnus bbdb-mua bbdb-com crm
network-stream puny nsm starttls gnus-agent gnus-srvr gnus-score
score-mode nnvirtual gnus-msg gnus-art mm-uu mml2015 mm-view mml-smime
smime dig gnus-cache gnus-sum bbdb-message sendmail bbdb bbdb-site
timezone gnus-demon nntp gnus-group gnus-undo gnus-article-treat-patch
diff-mode gnus-start gnus-cloud nnimap nnmail mail-source tls gnutls
utf7 netrc nnoo parse-time gnus-spec gnus-int gnus-range message rfc822
mml mml-sec epa derived epg mm-decode mm-bodies mm-encode mail-parse
rfc2231 mailabbrev gmm-utils mailheader gnus-win gnus nnheader subr-x
gnus-util rmail rmail-loaddefs rfc2047 rfc2045 ietf-drums mail-utils
mm-util mail-prsvr wid-edit conf-toplev conf-sp smartparens dash
conf-coffee conf-windmove windmove conf-whitespace conf-slime slime-repl
slime-parse slime compile etags xref project arc-mode archive-mode
noutline outline pp hyperspec browse-url conf-faces hl-sexp thingatpt
conf-eshell em-term term disp-table ehelp em-smart pcomplete comint
ansi-color ring esh-var esh-io esh-cmd esh-opt esh-ext esh-proc esh-arg
esh-groups eshell esh-module esh-mode esh-util conf-erc conf-emms
emms-librefm-stream xml emms-librefm-scrobbler emms-playlist-limit
emms-volume easy-mmode emms-volume-amixer emms-i18n emms-history
emms-score emms-stream-info emms-metaplaylist-mode emms-bookmarks
emms-cue emms-mode-line-icon emms-browser sort emms-playlist-sort
emms-last-played emms-player-xine emms-player-mpd tq emms-lyrics
emms-url url url-proxy url-privacy url-expand url-methods url-history
url-cookie url-domsuf url-util mailcap emms-streams emms-show-all
emms-tag-editor format-spec emms-mark emms-cache emms-info-ogginfo
emms-info-mp3info emms-playlist-mode emms-player-vlc advice
emms-source-playlist emms-source-file locate dired dired-loaddefs
emms-player-mplayer emms-playing-time emms-player-simple emms-info
later-do emms-setup emms-mode-line emms emms-compat conf-elisp
conf-packages conf-dir conf-dired conf-c-mode conf-auctex conf-asm
conf-ace-jump conf-personal ido seq edmacro kmacro paren preview-latex
tex-site auto-loads finder-inf slime-autoloads url-auth info package
epg-config url-handlers url-parse auth-source cl-seq eieio byte-opt
bytecomp byte-compile cl-extra help-mode easymenu cconv eieio-core
cl-macs gv eieio-loaddefs cl-loaddefs pcase cl-lib password-cache
url-vars time-date mule-util tooltip eldoc electric uniquify ediff-hook
vc-hooks lisp-float-type mwheel term/x-win x-win term/common-win x-dnd
tool-bar dnd fontset image regexp-opt fringe tabulated-list newcomment
elisp-mode lisp-mode prog-mode register page menu-bar rfn-eshadow timer
select scroll-bar mouse jit-lock font-lock syntax facemenu font-core
term/tty-colors frame cl-generic cham georgian utf-8-lang misc-lang
vietnamese tibetan thai tai-viet lao korean japanese eucjp-ms cp51932
hebrew greek romanian slovak czech european ethiopic indian cyrillic
chinese charscript case-table epa-hook jka-cmpr-hook help simple abbrev
obarray minibuffer cl-preloaded nadvice loaddefs button faces cus-face
macroexp files text-properties overlay sha1 md5 base64 format env
code-pages mule custom widget hashtable-print-readable backquote
dbusbind inotify dynamic-setting system-font-setting font-render-setting
move-toolbar gtk x-toolkit x multi-tty make-network-process emacs)

Memory information:
((conses 16 280541 38221)
 (symbols 48 48084 0)
 (miscs 40 175 424)
 (strings 32 84243 9005)
 (string-bytes 1 2667208)
 (vectors 16 37227)
 (vector-slots 8 744155 16170)
 (floats 8 683 853)
 (intervals 56 690 22)
 (buffers 976 38)
 (heap 1024 68673 3320))

-- 
Matt

#0  terminate_due_to_signal (sig=sig@entry=6, 
backtrace_limit=backtrace_limit@entry=40) at emacs.c:369
No locals.
#1  0x00000000005022f3 in emacs_abort () at sysdep.c:2255
No locals.
#2  0x00000000004bbc21 in x_connection_closed (dpy=dpy@entry=0x14bc000, 
error_message=<optimized out>, 
    error_message@entry=0x7fffffffd960 "X protocol error: BadLength (poly 
request too large or internal Xlib length error) on protocol request 139", 
ioerror=ioerror@entry=false) at xterm.c:9462
        tail = <optimized out>
#3  0x00000000004c0115 in x_error_quitter (display=0x14bc000, 
event=0x7fffffffdb20, event=0x7fffffffdb20) at xterm.c:9553
        buf = "BadLength (poly request too large or internal Xlib length 
error)", '\000' <repeats 191 times>
        buf1 = "X protocol error: BadLength (poly request too large or internal 
Xlib length error) on protocol request 139", '\000' <repeats 158 times>...
#4  0x00000000004c019b in x_error_handler (display=0x14bc000, 
event=0x7fffffffdb20) at xterm.c:9523
No locals.
#5  0x00007ffff490a87d in _XError () from /usr/lib/libX11.so.6
No symbol table info available.
#6  0x00007ffff49077c7 in ?? () from /usr/lib/libX11.so.6
No symbol table info available.
#7  0x00007ffff4907885 in ?? () from /usr/lib/libX11.so.6
No symbol table info available.
#8  0x00007ffff4908235 in _XEventsQueued () from /usr/lib/libX11.so.6
No symbol table info available.
#9  0x00007ffff48f9b87 in XPending () from /usr/lib/libX11.so.6
No symbol table info available.
#10 0x00007ffff674f59e in ?? () from /usr/lib/libgdk-3.so.0
No symbol table info available.
#11 0x00007ffff507668d in g_main_context_prepare () from 
/usr/lib/libglib-2.0.so.0
No symbol table info available.
#12 0x00007ffff507702b in ?? () from /usr/lib/libglib-2.0.so.0
No symbol table info available.
#13 0x00007ffff50771b7 in g_main_context_pending () from 
/usr/lib/libglib-2.0.so.0
No symbol table info available.
#14 0x00007ffff6be959d in gtk_events_pending () from /usr/lib/libgtk-3.so.0
No symbol table info available.
#15 0x00000000004bcb6b in XTread_socket (terminal=<optimized out>, 
hold_quit=0x7fffffffde10) at xterm.c:8772
        count = 0
        dpyinfo = 0x1559c00
#16 0x00000000004f0af9 in gobble_input () at keyboard.c:6801
        nr = <optimized out>
        hold_quit = {
          kind = NO_EVENT, 
          part = scroll_bar_nowhere, 
          code = 0, 
          modifiers = 0, 
          x = 0, 
          y = 0, 
          timestamp = 0, 
          frame_or_window = 0, 
          arg = 0
        }
        next = 0x0
        nread = 0
        err = false
        t = 0x11a7cd0
#17 0x00000000004f04c5 in handle_async_input () at keyboard.c:7053
        nread = <optimized out>
#18 process_pending_signals () at keyboard.c:7067
No locals.
#19 0x000000000055ad45 in Ffuncall (nargs=nargs@entry=1, 
args=args@entry=0x7fffffffdf38) at eval.c:2639
        fun = <optimized out>
        original_fun = <optimized out>
        numargs = 0
        val = <optimized out>
        internal_args = <optimized out>
        count = <optimized out>
#20 0x000000000055af38 in call0 (fn=8803984) at eval.c:2552
No locals.
#21 0x00000000004ec656 in timer_start_idle () at keyboard.c:4241
No locals.
#22 0x00000000004f53fb in timer_start_idle () at keyboard.c:4047
No locals.
#23 read_char (commandflag=commandflag@entry=1, map=map@entry=40159507, 
prev_event=0, 
    used_mouse_menu=used_mouse_menu@entry=0x7fffffffe5bb, 
end_time=end_time@entry=0x0) at keyboard.c:2599
        c = 0
        jmpcount = 2
        local_getcjmp = {{
            __jmpbuf = {0, -1876234902778123125, 28329072, 23142480, 
140737488348816, 40159507, 1876237390707846283, 
              -1876236781231903605}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {29009957, 0, 1, 0 <repeats 13 times>}
            }
          }}
        save_jump = {{
            __jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5943704, 2, 16339680, 30, 
5541974, 17312880}
            }
          }}
        tem = <optimized out>
        save = <optimized out>
        previous_echo_area_message = 0
        also_record = 0
        reread = false
        recorded = false
        polling_stopped_here = false
        orig_kboard = 0x1612050
#24 0x00000000004f640a in read_key_sequence 
(keybuf=keybuf@entry=0x7fffffffe690, prompt=prompt@entry=0, 
    dont_downcase_last=dont_downcase_last@entry=false, 
can_return_switch_frame=can_return_switch_frame@entry=true, 
    fix_current_buffer=fix_current_buffer@entry=true, 
prevent_redisplay=prevent_redisplay@entry=false, bufsize=30) at keyboard.c:9054
        interrupted_kboard = 0x1612050
        interrupted_frame = 0x1218e90
        key = <optimized out>
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = <optimized out>
        keys_local_start = <optimized out>
        new_binding = <optimized out>
        t = <optimized out>
        echo_start = 0
        keys_start = 0
        current_binding = 40159507
        first_event = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
          parent = 16686083, 
          map = 16686083, 
          start = 0, 
          end = 0
        }
        keytran = {
          parent = 12516931, 
          map = 12516931, 
          start = 0, 
          end = 0
        }
        indec = {
          parent = 16686099, 
          map = 16686099, 
          start = 0, 
          end = 0
        }
        shift_translated = false
        delayed_switch_frame = 0
        original_uppercase = 0
        original_uppercase_position = -1
        dummyflag = false
        fake_prefixed_keys = 0
#25 0x00000000004f7fe6 in command_loop_1 () at keyboard.c:1357
        cmd = <optimized out>
        keybuf = {268435702, 268435702, 9903877, 0, 0, 5660497, 9903872, 28656, 
0, 12278528, 0, 0, 0, 4410541, 0, 5542814, 0, 0, 0, 
          28656, 28656, 0, 12723443, 4002, 140737488349664, 5544553, 28656, 64, 
0, 5610273}
        i = <optimized out>
        prev_modiff = 1428
        prev_buffer = 0x1baa820
#26 0x0000000000559602 in internal_condition_case (bfun=bfun@entry=0x4f7df0 
<command_loop_1>, handlers=handlers@entry=19296, 
    hfun=hfun@entry=0x4ee8b0 <cmd_error>) at eval.c:1310
        val = <optimized out>
        c = <optimized out>
#27 0x00000000004e9fbc in command_loop_2 (ignore=ignore@entry=0) at 
keyboard.c:1099
        val = 271
#28 0x00000000005595a3 in internal_catch (tag=tag@entry=46128, 
func=func@entry=0x4e9fa0 <command_loop_2>, arg=arg@entry=0)
    at eval.c:1075
        val = <optimized out>
        c = <optimized out>
#29 0x00000000004e9f79 in command_loop () at keyboard.c:1078
No locals.
#30 0x00000000004ee49b in recursive_edit_1 () at keyboard.c:684
        val = <optimized out>
#31 0x00000000004ee7e8 in Frecursive_edit () at keyboard.c:755
        buffer = <optimized out>
#32 0x0000000000417433 in main (argc=1, argv=0x7fffffffe9e8) at emacs.c:1646
        dummy = 0
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = <optimized out>
        dumping = <optimized out>
        skip_args = 0
        rlim = {
          rlim_cur = 8720000, 
          rlim_max = 18446744073709551615
        }
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x0
        original_pwd = <optimized out>