bug#30874: 27.0.50; Emacs crashes

[Jan Synacek]

On Thu, Mar 22, 2018 at 3:55 PM, Eli Zaretskii <eliz@gnu.org> wrote:
>> From: Jan Synacek <jsynacek@redhat.com>
>> Date: Thu, 22 Mar 2018 14:05:26 +0100
>> Cc: 30874@debbugs.gnu.org
>>
>> > What about adding the -xrm "emacs.synchronous: true" switch to the
>> > Emacs invocation command -- does it also not work?
>>
>> As far as I can tell, no. I still see the emacs frame remain open but
>> unresponsive and also see the same backtrace as before.
>
> Exactly the same backtrace?  The backtrace you posted:
>
>   #19 0x00000000004c2fcb in x_error_handler (display=0x2c59000,
>   event=0x7fffffff5d40) at xterm.c:9889
>   #20 0x00007ffff469ce3a in _XError () at /lib64/libX11.so.6
>   #21 0x00007ffff4699d6b in handle_error () at /lib64/libX11.so.6
>   ---Type <return> to continue, or q <return> to quit---
>   #22 0x00007ffff4699e15 in handle_response () at /lib64/libX11.so.6
>   #23 0x00007ffff469a745 in _XEventsQueued () at /lib64/libX11.so.6
>   #24 0x00007ffff468c2bd in XPending () at /lib64/libX11.so.6
>   #25 0x00007ffff64f2c2e in gdk_event_source_prepare () at 
> /lib64/libgdk-3.so.0
>   #26 0x00007ffff4e033f9 in g_main_context_prepare () at 
> /lib64/libglib-2.0.so.0
>   #27 0x00007ffff4e03dcb in g_main_context_iterate.isra () at
>   /lib64/libglib-2.0.so.0
>   #28 0x00007ffff4e03f57 in g_main_context_pending () at 
> /lib64/libglib-2.0.so.0
>   #29 0x00007ffff69b2d1d in gtk_events_pending () at /lib64/libgtk-3.so.0
>   #30 0x00000000004bfee7 in XTread_socket (terminal=<optimized out>,
>   hold_quit=0x7fffffff6040) at xterm.c:9146
>   #31 0x00000000004f7301 in gobble_input () at keyboard.c:6890
>   #32 0x00000000004f7925 in handle_async_input () at keyboard.c:7127
>   #33 0x00000000004f7925 in process_pending_signals () at keyboard.c:7141
>   #34 0x00000000005c8e5c in xftfont_open (f=0x13f0c30
>   <bss_sbrk_buffer+8312368>, entity=0x1243cb5 <bss_sbrk_buffer+6555317>,
>   pixel_size=15) at xftfont.c:391
>
> indicates that the X error message was read when Emacs unblocked input
> in xftfont_open, and read pending input.  In synchronous X operation,
> the call to x_error_handler should come from an X function, not from
> process_pending_signals.  I hoped that seeing the X function that
> caused the error will allow us to understand better what is causing
> the problem.  If you still see exactly the same backtrace in
> synchronous X operation, then I don't see any path forward, except
> saying that telling Emacs Dejavu Sans Mono can cover the entire
> Unicode range of characters is not recommended.  (But when I did that
> with a couple of fonts here, Emacs didn't crash.)  It could be a
> problem in the font backend you use, or it could be something else.

$ gdb --args ./src/emacs -Q -xrm "emacs.synchronous: true"
--eval="(switch-to-buffer \"*scratch*\")" --eval="(insert-char
#x274c)" --eval="(set-fontset-font \"fontset-default\" 'unicode
\"Dejavu Sans Mono\")"
...
Thread 4 (Thread 0x7fffd9d3e700 (LWP 5625)):
#0  0x00007fffefb24c6b in poll () at /lib64/libc.so.6
#1  0x00007ffff4e06e99 in g_main_context_iterate.isra () at
/lib64/libglib-2.0.so.0
#2  0x00007ffff4e06fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007fffd9d4642d in dconf_gdbus_worker_thread () at
/usr/lib64/gio/modules/libdconfsettings.so
#4  0x00007ffff4e2e486 in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007ffff048550b in start_thread () at /lib64/libpthread.so.0
#6  0x00007fffefb2f16f in clone () at /lib64/libc.so.6

Thread 3 (Thread 0x7fffdbdfc700 (LWP 5624)):
#0  0x00007fffefb24c6b in poll () at /lib64/libc.so.6
#1  0x00007ffff4e06e99 in g_main_context_iterate.isra () at
/lib64/libglib-2.0.so.0
#2  0x00007ffff4e07232 in g_main_loop_run () at /lib64/libglib-2.0.so.0
#3  0x00007ffff53efb56 in gdbus_shared_thread_func () at /lib64/libgio-2.0.so.0
#4  0x00007ffff4e2e486 in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007ffff048550b in start_thread () at /lib64/libpthread.so.0
#6  0x00007fffefb2f16f in clone () at /lib64/libc.so.6

Thread 2 (Thread 0x7fffe0e3a700 (LWP 5623)):
#0  0x00007fffefb24c6b in poll () at /lib64/libc.so.6
#1  0x00007ffff4e06e99 in g_main_context_iterate.isra () at
/lib64/libglib-2.0.so.0
#2  0x00007ffff4e06fac in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#3  0x00007ffff4e06ff1 in glib_worker_main () at /lib64/libglib-2.0.so.0
#4  0x00007ffff4e2e486 in g_thread_proxy () at /lib64/libglib-2.0.so.0
#5  0x00007ffff048550b in start_thread () at /lib64/libpthread.so.0
#6  0x00007fffefb2f16f in clone () at /lib64/libc.so.6

Thread 1 (Thread 0x7ffff7fa2fc0 (LWP 5619)):
#0  0x00007ffff0490050 in raise () at /lib64/libpthread.so.0
#1  0x00000000004f0571 in terminate_due_to_signal (sig=sig@entry=6,
backtrace_limit=backtrace_limit@entry=40) at emacs.c:395
#2  0x00000000005096a3 in emacs_abort () at sysdep.c:2426
#3  0x00000000004bf4c6 in x_connection_closed
(dpy=dpy@entry=0x2c59430, error_message=<optimized out>,
    error_message@entry=0x7fffffff4580 "X protocol error: BadLength
(poly request too large or internal Xlib length error) on protocol
request 138", ioerror=ioerror@entry=false) at xterm.c:9831
#4  0x00000000004c2f50 in x_error_quitter (display=0x2c59430,
event=<optimized out>, event=<optimized out>) at xterm.c:9919
#5  0x00000000004c2fcb in x_error_handler (display=0x2c59430,
event=0x7fffffff4740) at xterm.c:9889
#6  0x00007ffff469fe3a in _XError () at /lib64/libX11.so.6
#7  0x00007ffff469cd6b in handle_error () at /lib64/libX11.so.6
#8  0x00007ffff469ce15 in handle_response () at /lib64/libX11.so.6
#9  0x00007ffff469d745 in _XEventsQueued () at /lib64/libX11.so.6
#10 0x00007ffff467ecca in XFlush () at /lib64/libX11.so.6
#11 0x00007ffff46bc65e in _XimProtoDestroyIC () at /lib64/libX11.so.6
#12 0x00007ffff46aaa02 in XDestroyIC () at /lib64/libX11.so.6
#13 0x00000000004d408f in free_frame_xic (f=f@entry=0x13f0c30
<bss_sbrk_buffer+8312368>) at xfns.c:2676
#14 0x00000000004cc648 in x_free_frame_resources (f=0x13f0c30
<bss_sbrk_buffer+8312368>) at xterm.c:11777
#15 0x00000000004ccd1b in x_destroy_window (f=<optimized out>) at xterm.c:11906
#16 0x00000000004280d0 in delete_frame (frame=<optimized out>,
force=force@entry=0x98a0) at frame.c:2055
#17 0x00000000004bf543 in x_connection_closed
(dpy=dpy@entry=0x2c59430, error_message=<optimized out>,
    error_message@entry=0x7fffffff5b50 "X protocol error: BadLength
(poly request too large or internal Xlib length error) on protocol
request 138", ioerror=ioerror@entry=false) at xterm.c:9810
#18 0x00000000004c2f50 in x_error_quitter (display=0x2c59430,
event=<optimized out>, event=<optimized out>) at xterm.c:9919
#19 0x00000000004c2fcb in x_error_handler (display=0x2c59430,
event=0x7fffffff5d10) at xterm.c:9889
#20 0x00007ffff469fe3a in _XError () at /lib64/libX11.so.6
#21 0x00007ffff469cd6b in handle_error () at /lib64/libX11.so.6
#22 0x00007ffff469ce15 in handle_response () at /lib64/libX11.so.6
#23 0x00007ffff469d745 in _XEventsQueued () at /lib64/libX11.so.6
#24 0x00007ffff468f2bd in XPending () at /lib64/libX11.so.6
#25 0x00007ffff64f5c2e in gdk_event_source_prepare () at /lib64/libgdk-3.so.0
#26 0x00007ffff4e063f9 in g_main_context_prepare () at /lib64/libglib-2.0.so.0
#27 0x00007ffff4e06dcb in g_main_context_iterate.isra () at
/lib64/libglib-2.0.so.0
#28 0x00007ffff4e06f57 in g_main_context_pending () at /lib64/libglib-2.0.so.0
#29 0x00007ffff69b5d1d in gtk_events_pending () at /lib64/libgtk-3.so.0
#30 0x00000000004bfee7 in XTread_socket (terminal=<optimized out>,
hold_quit=0x7fffffff6010) at xterm.c:9146
#31 0x00000000004f7301 in gobble_input () at keyboard.c:6890
#32 0x00000000004f7925 in handle_async_input () at keyboard.c:7127
#33 0x00000000004f7925 in process_pending_signals () at keyboard.c:7141
#34 0x00000000005c8e5c in xftfont_open (f=0x13f0c30
<bss_sbrk_buffer+8312368>, entity=0x2fae835, pixel_size=15) at
xftfont.c:391
#35 0x000000000057a91c in font_open_entity (f=0x13f0c30
<bss_sbrk_buffer+8312368>, entity=0x2fae835, pixel_size=15) at
font.c:2903
#36 0x00000000005cb0a4 in fontset_find_font
(fontset=fontset@entry=0x142ac35 <bss_sbrk_buffer+8549941>,
c=c@entry=10060, face=face@entry=0x2e3e260,
charset_id=charset_id@entry=-1, fallback=fallback@entry=true) at
fontset.c:707
#37 0x00000000005cb8bb in fontset_font
(fontset=fontset@entry=0x142ac35 <bss_sbrk_buffer+8549941>,
c=c@entry=10060, face=face@entry=0x2e3e260, id=-1) at fontset.c:788
#38 0x00000000005cbbbc in face_for_char (f=0x13f0c30
<bss_sbrk_buffer+8312368>, face=face@entry=0x2e3e260, c=10060,
pos=<optimized out>, object=<optimized out>)
    at fontset.c:990
#39 0x00000000004474d9 in FACE_FOR_CHAR (object=<optimized out>,
pos=<optimized out>, character=<optimized out>, face=0x2e3e260,
f=<optimized out>) at dispextern.h:1818
#40 0x00000000004474d9 in get_next_display_element
(it=it@entry=0x7fffffff8a60) at xdisp.c:7324
#41 0x000000000044e5f8 in display_line (it=it@entry=0x7fffffff8a60,
cursor_vpos=cursor_vpos@entry=0) at xdisp.c:21502
#42 0x00000000004536fd in try_window (window=window@entry=0x13f1c35
<bss_sbrk_buffer+8316469>, pos=..., flags=flags@entry=1) at
xdisp.c:17718
#43 0x0000000000466751 in redisplay_window (window=0x13f1c35
<bss_sbrk_buffer+8316469>,
just_this_one_p=just_this_one_p@entry=false) at xdisp.c:17165
#44 0x00000000004692eb in redisplay_window_0
(window=window@entry=0x13f1c35 <bss_sbrk_buffer+8316469>) at
xdisp.c:14922
#45 0x0000000000561e86 in internal_condition_case_1
(bfun=bfun@entry=0x4692c0 <redisplay_window_0>,
arg=arg@entry=0x13f1c35 <bss_sbrk_buffer+8316469>, handlers=<optimized
out>, hfun=hfun@entry=0x42f220 <redisplay_window_error>) at
eval.c:1356
#46 0x0000000000434315 in redisplay_windows (window=0x13f1c35
<bss_sbrk_buffer+8316469>) at xdisp.c:14902
#47 0x000000000045705d in redisplay_internal () at xdisp.c:14385
#48 0x0000000000458d55 in redisplay () at xdisp.c:13597
#49 0x00000000004fa4bb in read_char (commandflag=commandflag@entry=1,
map=map@entry=0x1548573 <bss_sbrk_buffer+9719667>, prev_event=0x0,
used_mouse_menu=used_mouse_menu@entry=0x7fffffffdf5b,
end_time=end_time@entry=0x0) at keyboard.c:2486
#50 0x00000000004fcffb in read_key_sequence
(keybuf=keybuf@entry=0x7fffffffe030, prompt=prompt@entry=0x0,
dont_downcase_last=dont_downcase_last@entry=false,
can_return_switch_frame=can_return_switch_frame@entry=true,
fix_current_buffer=fix_current_buffer@entry=true,
prevent_redisplay=prevent_redisplay@entry=false, bufsize=30)
    at keyboard.c:9137
#51 0x00000000004feaee in command_loop_1 () at keyboard.c:1370
#52 0x0000000000561dee in internal_condition_case
(bfun=bfun@entry=0x4fe900 <command_loop_1>,
handlers=handlers@entry=0x5280, hfun=hfun@entry=0x4f5b20 <cmd_error>)
    at eval.c:1332
#53 0x00000000004f093c in command_loop_2 (ignore=ignore@entry=0x0) at
keyboard.c:1111
#54 0x0000000000561d5d in internal_catch (tag=tag@entry=0xc750,
func=func@entry=0x4f0920 <command_loop_2>, arg=arg@entry=0x0) at
eval.c:1097
#55 0x00000000004f08e4 in command_loop () at keyboard.c:1090
#56 0x00000000004f5743 in recursive_edit_1 () at keyboard.c:696
#57 0x00000000004f5a57 in Frecursive_edit () at keyboard.c:767
#58 0x000000000041a73f in main (argc=7, argv=0x7fffffffe398) at emacs.c:1724

Reproducible with Fedora 27 using gnome and gdm. AFAIK, I'm not even
running wayland. I also use nvidia drivers version 390.42 in case it
matters.

-- 
Jan Synacek
Software Engineer, Red Hat