bug#38564: 27.0.50; macOS "emacs -nw" git-gutter-mode segfault

[Mike Hamrick]

Hi there,

Here is how I got emacs to segfault and drop be back to the shell:
- compile emacs 27.0.50 under macOS
- install the git-gutter package
- set up an after-init-hook for global-git-gutter-mode
- emacs -nw /some/file/under/version/control

The relevant part of my init.el looks like:
> (use-package git-gutter
>   :ensure t
>   :init
>  (add-hook 'after-init-hook 'global-git-gutter-mode))

I built emacs with debugging symbols, and ran it in the lldb debugger,
here is the stack trace:

* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
(code=1, address=0x40)
    frame #0: 0x000000010416ab3e 
emacs`ns_lookup_indexed_color(idx=18446744073709551613, f=0x00007facab80e210) 
at nsterm.m:2097:64
   2094 NSColor *
   2095 ns_lookup_indexed_color (unsigned long idx, struct frame *f)
   2096 {
-> 2097   struct ns_color_table *color_table = FRAME_DISPLAY_INFO 
(f)->color_table;
   2098   if (idx < 1 || idx >= color_table->avail)
   2099     return nil;
   2100   return color_table->colors[idx];
Likely cause: f->output_data.tty[29]->display_info->terminal accessed 0x40
(lldb) bt
* thread #1, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS 
(code=1, address=0x40)
  * frame #0: 0x000000010416ab3e 
emacs`ns_lookup_indexed_color(idx=18446744073709551613, f=0x00007facab80e210) 
at nsterm.m:2097:64
    frame #1: 0x000000010416b5fc emacs`ns_color_index_to_rgba(idx=-3, 
f=0x00007facab80e210) at nsterm.m:2299:9
    frame #2: 0x0000000103e88e23 
emacs`extend_face_to_end_of_line(it=0x00007ffeebdf5800) at xdisp.c:21833:7
    frame #3: 0x0000000103e5783a emacs`display_line(it=0x00007ffeebdf5800, 
cursor_vpos=3) at xdisp.c:23478:4
    frame #4: 0x0000000103e5468b emacs`try_window(window=0x00007facab80e445, 
pos=(charpos = 1, bytepos = 1), flags=1) at xdisp.c:19005:11
    frame #5: 0x0000000103e92e6f 
emacs`redisplay_window(window=0x00007facab80e445, just_this_one_p=false) at 
xdisp.c:18426:8
    frame #6: 0x0000000103e90f8d 
emacs`redisplay_window_0(window=0x00007facab80e445) at xdisp.c:16147:5
    frame #7: 0x000000010406083a 
emacs`internal_condition_case_1(bfun=(emacs`redisplay_window_0 at 
xdisp.c:16145), arg=0x00007facab80e445, handlers=0x00000001060f9d6b, 
hfun=(emacs`redisplay_window_error at xdisp.c:16138)) at eval.c:1379:25
    frame #8: 0x0000000103e8f87b 
emacs`redisplay_windows(window=0x00007facab80e445) at xdisp.c:16127:4
    frame #9: 0x0000000103e4f012 emacs`redisplay_internal at xdisp.c:15595:5
    frame #10: 0x0000000103e53110 
emacs`redisplay_preserve_echo_area(from_where=2) at xdisp.c:15948:5
    frame #11: 0x0000000103e0914a emacs`Fredisplay(force=0x0000000000000000) at 
dispnew.c:6066:3
    frame #12: 0x0000000104068003 emacs`funcall_subr(subr=0x0000000104209680, 
numargs=0, args=0x00007ffeebdfc398) at eval.c:2867:19
    frame #13: 0x0000000104066e24 emacs`Ffuncall(nargs=1, 
args=0x00007ffeebdfc390) at eval.c:2794:11
    frame #14: 0x00000001040d7ef8 
emacs`exec_byte_code(bytestr=0x0000000105c2125c, vector=0x0000000105c21015, 
maxdepth=0x000000000000001e, args_template=0x0000000000000c06, nargs=1, 
args=0x00007ffeebdfcad0) at bytecode.c:633:12
    frame #15: 0x000000010406847c emacs`funcall_lambda(fun=0x0000000105c20fe5, 
nargs=1, arg_vector=0x00007ffeebdfcac8) at eval.c:2989:11
    frame #16: 0x0000000104066e6e emacs`Ffuncall(nargs=2, 
args=0x00007ffeebdfcac0) at eval.c:2796:11
    frame #17: 0x00000001040d7ef8 
emacs`exec_byte_code(bytestr=0x0000000105d67b44, vector=0x0000000105d67645, 
maxdepth=0x000000000000003e, args_template=0x0000000000000c06, nargs=3, 
args=0x00007ffeebdfd478) at bytecode.c:633:12
    frame #18: 0x000000010406847c emacs`funcall_lambda(fun=0x0000000105d664ed, 
nargs=3, arg_vector=0x00007ffeebdfd460) at eval.c:2989:11
    frame #19: 0x0000000104066e6e emacs`Ffuncall(nargs=4, 
args=0x00007ffeebdfd458) at eval.c:2796:11
    frame #20: 0x0000000104055bda emacs`Ffuncall_interactively(nargs=4, 
args=0x00007ffeebdfd458) at callint.c:254:32
    frame #21: 0x0000000104067f2b emacs`funcall_subr(subr=0x0000000104212f20, 
numargs=4, args=0x00007ffeebdfd458) at eval.c:2847:12
    frame #22: 0x0000000104066e24 emacs`Ffuncall(nargs=5, 
args=0x00007ffeebdfd450) at eval.c:2794:11
    frame #23: 0x0000000104066c04 emacs`Fapply(nargs=3, 
args=0x00007ffeebdfdc70) at eval.c:2424:24
    frame #24: 0x000000010405600e 
emacs`Fcall_interactively(function=0x000000000173af88, 
record_flag=0x0000000000000000, keys=0x00000001064ffb35) at callint.c:342:36
    frame #25: 0x000000010406805e emacs`funcall_subr(subr=0x0000000104212ef0, 
numargs=3, args=0x00007ffeebdfde40) at eval.c:2872:19
    frame #26: 0x0000000104066e24 emacs`Ffuncall(nargs=4, 
args=0x00007ffeebdfde38) at eval.c:2794:11
    frame #27: 0x00000001040d7ef8 
emacs`exec_byte_code(bytestr=0x0000000105d1d5fc, vector=0x0000000105d1d09d, 
maxdepth=0x0000000000000036, args_template=0x0000000000001006, nargs=1, 
args=0x00007ffeebdfe5a8) at bytecode.c:633:12
    frame #28: 0x000000010406847c emacs`funcall_lambda(fun=0x0000000105d1d06d, 
nargs=1, arg_vector=0x00007ffeebdfe5a0) at eval.c:2989:11
    frame #29: 0x0000000104066e6e emacs`Ffuncall(nargs=2, 
args=0x00007ffeebdfe598) at eval.c:2796:11
    frame #30: 0x000000010406794f emacs`call1(fn=0x0000000000003ae0, 
arg1=0x000000000173af88) at eval.c:2654:10
    frame #31: 0x0000000103f643e9 emacs`command_loop_1 at keyboard.c:1458:13
    frame #32: 0x000000010406077f 
emacs`internal_condition_case(bfun=(emacs`command_loop_1 at keyboard.c:1236), 
handlers=0x0000000000000090, hfun=(emacs`cmd_error at keyboard.c:919)) at 
eval.c:1355:25
    frame #33: 0x0000000103f7bbcc 
emacs`command_loop_2(ignore=0x0000000000000000) at keyboard.c:1091:11
    frame #34: 0x00000001040600ea emacs`internal_catch(tag=0x000000000000c8a0, 
func=(emacs`command_loop_2 at keyboard.c:1087), arg=0x0000000000000000) at 
eval.c:1116:25
    frame #35: 0x0000000103f62ee8 emacs`command_loop at keyboard.c:1070:2
    frame #36: 0x0000000103f62d20 emacs`recursive_edit_1 at keyboard.c:714:9
    frame #37: 0x0000000103f630b9 emacs`Frecursive_edit at keyboard.c:786:3
    frame #38: 0x0000000103f60531 emacs`main(argc=3, argv=0x00007ffeebdfed58) 
at emacs.c:2054:3
    frame #39: 0x00007fff5cf7e3d5 libdyld.dylib`start + 1
    frame #40: 0x00007fff5cf7e3d5 libdyld.dylib`start + 1

I was able to prevent emacs from crashing with this rather naive patch.

diff --git a/src/nsterm.m b/src/nsterm.m
index c415159890..ea2b141d95 100644
--- a/src/nsterm.m
+++ b/src/nsterm.m
@@ -2094,6 +2094,8 @@ so some key presses (TAB) are swallowed by the system.  */
 NSColor *
 ns_lookup_indexed_color (unsigned long idx, struct frame *f)
 {
+  if (FRAME_DISPLAY_INFO (f) == nil)
+    return nil;
   struct ns_color_table *color_table = FRAME_DISPLAY_INFO (f)->color_table;
   if (idx < 1 || idx >= color_table->avail)
     return nil;

Here is more information about my setup post patch:

In GNU Emacs 27.0.50 (build 2, x86_64-apple-darwin18.7.0, NS appkit-1671.60 
Version 10.14.6 (Build 18G1012))
 of 2019-12-10 built on st-mikeh1
Repository revision: ea93326cc046cb1beb7535cdf6d69b216b767685
Repository branch: master
System Description:  Mac OS X 10.14.6

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.

Configured using:
 'configure --prefix=/Users/mikeh'

Configured features:
RSVG GLIB NOTIFY KQUEUE ACL GNUTLS LIBXML2 ZLIB TOOLKIT_SCROLL_BARS NS
MODULES THREADS JSON PDUMPER LCMS2

Important settings:
  value of $LANG: en_US.UTF-8
  locale-coding-system: utf-8-unix

Major mode: Fundamental

Minor modes in effect:
  global-git-gutter-mode: t
  tooltip-mode: t
  global-eldoc-mode: t
  electric-indent-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  buffer-read-only: t
  line-number-mode: t
  transient-mark-mode: t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug message rmc puny dired dired-loaddefs
format-spec rfc822 mml mml-sec epa derived epg epg-config gnus-util
rmail rmail-loaddefs text-property-search time-date mm-decode mm-bodies
mm-encode mail-parse rfc2231 mailabbrev gmm-utils mailheader sendmail
rfc2047 rfc2045 ietf-drums mm-util mail-prsvr mail-utils term/xterm
xterm git-gutter advice cl-extra help-mode use-package-ensure
use-package-core finder-inf info package easymenu browse-url
url-handlers url-parse auth-source cl-seq eieio eieio-core cl-macs
eieio-loaddefs password-cache json subr-x map url-vars seq byte-opt gv
bytecomp byte-compile cconv cl-loaddefs cl-lib tooltip eldoc electric
uniquify ediff-hook vc-hooks lisp-float-type mwheel term/ns-win ns-win
ucs-normalize mule-util term/common-win tool-bar dnd fontset image
regexp-opt fringe tabulated-list replace newcomment text-mode elisp-mode
lisp-mode prog-mode register page tab-bar menu-bar rfn-eshadow isearch
timer select scroll-bar mouse jit-lock font-lock syntax facemenu
font-core term/tty-colors frame minibuffer cl-generic cham georgian
utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao korean
japanese eucjp-ms cp51932 hebrew greek romanian slovak czech european
ethiopic indian cyrillic chinese composite charscript charprop
case-table epa-hook jka-cmpr-hook help simple abbrev obarray
cl-preloaded nadvice loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote threads kqueue cocoa ns
lcms2 multi-tty make-network-process emacs)

Memory information:
((conses 16 80357 7586)
 (symbols 48 9267 1)
 (strings 32 27500 1423)
 (string-bytes 1 893518)
 (vectors 16 12896)
 (vector-slots 8 135599 5856)
 (floats 8 39 323)
 (intervals 56 179 0)
 (buffers 1000 12))