bug#47207: 28.0.50; decode_next_window_args crash

[martin rudalics]

>> #0  0x00000000005a5f85 in terminate_due_to_signal (sig=6, 
backtrace_limit=2147483647) at ../../src/emacs.c:379
>> #1  0x0000000000651df0 in die (msg=0x788ee1 "WINDOWP (a)", file=0x788ece 
"../../src/window.h", line=543) at ../../src/alloc.c:7420
>> #2  0x00000000004bdca6 in XWINDOW (a=XIL(0)) at ../../src/window.h:543
>> #3  0x00000000004c6a4d in decode_next_window_args (window=0x7fffffffa808, 
minibuf=0x7fffffffa800, all_frames=0x7fffffffa7f8) at ../../src/window.c:2891
>> #4  0x00000000004c6bff in next_window (window=XIL(0x2b04405), 
minibuf=XIL(0), all_frames=XIL(0x30), next_p=true) at ../../src/window.c:2927
>
> Do you have local changes in window.c?  The line numbers are about 200
> lines off the current sources.

Sorry.  The following backtrace is from a fairly recent master.


Thread 1 "emacs" hit Breakpoint 1, terminate_due_to_signal (sig=6, 
backtrace_limit=2147483647) at ../../src/emacs.c:379
379       signal (sig, SIG_DFL);
(gdb) bt
#0  0x00000000005ac554 in terminate_due_to_signal (sig=6, 
backtrace_limit=2147483647) at ../../src/emacs.c:379
#1  0x0000000000658972 in die (msg=0x7900b9 "WINDOWP (a)", file=0x7900a6 
"../../src/window.h", line=472) at ../../src/alloc.c:7420
#2  0x00000000004c6efc in XWINDOW (a=XIL(0)) at ../../src/window.h:472
#3  0x00000000004d1897 in decode_next_window_args (window=0x7fffffffa808, 
minibuf=0x7fffffffa800, all_frames=0x7fffffffa7f8) at ../../src/window.c:2672
#4  0x00000000004d1a49 in next_window (window=XIL(0x2abb4b5), minibuf=XIL(0), 
all_frames=XIL(0x30), next_p=true) at ../../src/window.c:2708
#5  0x00000000004d1ed0 in Fnext_window (window=XIL(0x2abb4b5), minibuf=XIL(0), 
all_frames=XIL(0x30)) at ../../src/window.c:2804
#6  0x0000000000691a93 in funcall_subr (subr=0xc52760 <Snext_window>, 
numargs=3, args=0x7fffffffa9d0) at ../../src/eval.c:2992
#7  0x0000000000691510 in Ffuncall (nargs=4, args=0x7fffffffa9c8) at 
../../src/eval.c:2914
#8  0x00000000006eb040 in exec_byte_code (bytestr=XIL(0x7ffff40a9b14), 
vector=XIL(0x7ffff3cc7245), maxdepth=make_fixnum(12), 
args_template=make_fixnum(769), nargs=2, args=0x7fffffffaf68) at 
../../src/bytecode.c:632
#9  0x0000000000691cc8 in fetch_and_exec_byte_code (fun=XIL(0x7ffff3cc71ed), 
syms_left=make_fixnum(769), nargs=2, args=0x7fffffffaf58) at 
../../src/eval.c:3036
#10 0x000000000069214e in funcall_lambda (fun=XIL(0x7ffff3cc71ed), nargs=2, 
arg_vector=0x7fffffffaf58) at ../../src/eval.c:3117
#11 0x0000000000691554 in Ffuncall (nargs=3, args=0x7fffffffaf50) at 
../../src/eval.c:2916
#12 0x00000000006eb040 in exec_byte_code (bytestr=XIL(0x1ab0764), 
vector=XIL(0x197fefd), maxdepth=make_fixnum(7), args_template=make_fixnum(256), 
nargs=0, args=0x7fffffffb4a0) at ../../src/bytecode.c:632
#13 0x0000000000691cc8 in fetch_and_exec_byte_code (fun=XIL(0x197ff9d), 
syms_left=make_fixnum(256), nargs=0, args=0x7fffffffb4a0) at 
../../src/eval.c:3036
#14 0x000000000069214e in funcall_lambda (fun=XIL(0x197ff9d), nargs=0, 
arg_vector=0x7fffffffb4a0) at ../../src/eval.c:3117
#15 0x0000000000691554 in Ffuncall (nargs=1, args=0x7fffffffb498) at 
../../src/eval.c:2916
#16 0x00000000006eb040 in exec_byte_code (bytestr=XIL(0x1a6ced4), 
vector=XIL(0x195e1f5), maxdepth=make_fixnum(9), args_template=make_fixnum(514), 
nargs=2, args=0x7fffffffba68) at ../../src/bytecode.c:632
#17 0x0000000000691cc8 in fetch_and_exec_byte_code (fun=XIL(0x195e2dd), 
syms_left=make_fixnum(514), nargs=2, args=0x7fffffffba58) at 
../../src/eval.c:3036
#18 0x000000000069214e in funcall_lambda (fun=XIL(0x195e2dd), nargs=2, 
arg_vector=0x7fffffffba58) at ../../src/eval.c:3117
#19 0x0000000000691554 in Ffuncall (nargs=3, args=0x7fffffffba50) at 
../../src/eval.c:2916
#20 0x00000000006eb040 in exec_byte_code (bytestr=XIL(0x1a0a974), 
vector=XIL(0x195ded5), maxdepth=make_fixnum(8), args_template=make_fixnum(771), 
nargs=3, args=0x7fffffffbfc0) at ../../src/bytecode.c:632
#21 0x0000000000691cc8 in fetch_and_exec_byte_code (fun=XIL(0x193f76d), 
syms_left=make_fixnum(771), nargs=3, args=0x7fffffffbfa8) at 
../../src/eval.c:3036
#22 0x000000000069214e in funcall_lambda (fun=XIL(0x193f76d), nargs=3, 
arg_vector=0x7fffffffbfa8) at ../../src/eval.c:3117
#23 0x0000000000691554 in Ffuncall (nargs=4, args=0x7fffffffbfa0) at 
../../src/eval.c:2916
#24 0x00000000006eb040 in exec_byte_code (bytestr=XIL(0x1acf284), 
vector=XIL(0x18d0a6d), maxdepth=make_fixnum(17), 
args_template=make_fixnum(2312), nargs=9, args=0x7fffffffcb10) at 
../../src/bytecode.c:632
#25 0x0000000000691cc8 in fetch_and_exec_byte_code (fun=XIL(0x18d0e8d), 
syms_left=make_fixnum(2312), nargs=9, args=0x7fffffffcac8) at 
../../src/eval.c:3036
#26 0x000000000069214e in funcall_lambda (fun=XIL(0x18d0e8d), nargs=9, 
arg_vector=0x7fffffffcac8) at ../../src/eval.c:3117
#27 0x0000000000691554 in Ffuncall (nargs=10, args=0x7fffffffcac0) at 
../../src/eval.c:2916
#28 0x00000000006eb040 in exec_byte_code (bytestr=XIL(0x19cf9b4), 
vector=XIL(0x168d8b5), maxdepth=make_fixnum(25), 
args_template=make_fixnum(1541), nargs=5, args=0x7fffffffd0f8) at 
../../src/bytecode.c:632
#29 0x0000000000691cc8 in fetch_and_exec_byte_code (fun=XIL(0x168d92d), 
syms_left=make_fixnum(1541), nargs=5, args=0x7fffffffd0d0) at 
../../src/eval.c:3036
#30 0x000000000069214e in funcall_lambda (fun=XIL(0x168d92d), nargs=5, 
arg_vector=0x7fffffffd0d0) at ../../src/eval.c:3117
#31 0x0000000000691554 in Ffuncall (nargs=6, args=0x7fffffffd0c8) at 
../../src/eval.c:2916
#32 0x00000000006eb040 in exec_byte_code (bytestr=XIL(0x19cfb94), 
vector=XIL(0x1172b95), maxdepth=make_fixnum(10), 
args_template=make_fixnum(1026), nargs=2, args=0x7fffffffd540) at 
../../src/bytecode.c:632
#33 0x0000000000691cc8 in fetch_and_exec_byte_code (fun=XIL(0x1702115), 
syms_left=make_fixnum(1026), nargs=2, args=0x7fffffffd530) at 
../../src/eval.c:3036
#34 0x000000000069214e in funcall_lambda (fun=XIL(0x1702115), nargs=2, 
arg_vector=0x7fffffffd530) at ../../src/eval.c:3117
#35 0x0000000000691e72 in apply_lambda (fun=XIL(0x1702115), 
args=XIL(0x1a76453), count=9) at ../../src/eval.c:3061
#36 0x000000000068ffbc in eval_sub (form=XIL(0x1a76493)) at 
../../src/eval.c:2436
#37 0x000000000068a172 in Fprogn (body=XIL(0)) at ../../src/eval.c:462
#38 0x0000000000692605 in funcall_lambda (fun=XIL(0x1a58a53), nargs=0, 
arg_vector=0x0) at ../../src/eval.c:3184
#39 0x0000000000691667 in Ffuncall (nargs=1, args=0x7fffffffda88) at 
../../src/eval.c:2928
#40 0x000000000068576a in Ffuncall_interactively (nargs=1, args=0x7fffffffda88) 
at ../../src/callint.c:260
#41 0x000000000069193a in funcall_subr (subr=0xc5dce0 <Sfuncall_interactively>, 
numargs=1, args=0x7fffffffda88) at ../../src/eval.c:2967
#42 0x0000000000691510 in Ffuncall (nargs=2, args=0x7fffffffda80) at 
../../src/eval.c:2914
#43 0x0000000000690311 in Fapply (nargs=3, args=0x7fffffffda80) at 
../../src/eval.c:2497
#44 0x0000000000685bf2 in Fcall_interactively (function=XIL(0xd0a900), 
record_flag=XIL(0), keys=XIL(0x7ffff437d235)) at ../../src/callint.c:353
#45 0x0000000000691a93 in funcall_subr (subr=0xc5dd20 <Scall_interactively>, 
numargs=3, args=0x7fffffffdd40) at ../../src/eval.c:2992
#46 0x0000000000691510 in Ffuncall (nargs=4, args=0x7fffffffdd38) at 
../../src/eval.c:2914
#47 0x00000000006eb040 in exec_byte_code (bytestr=XIL(0x7ffff3d87ac4), 
vector=XIL(0x7ffff3d8772d), maxdepth=make_fixnum(13), 
args_template=make_fixnum(1025), nargs=1, args=0x7fffffffe2b0) at 
../../src/bytecode.c:632
#48 0x0000000000691cc8 in fetch_and_exec_byte_code (fun=XIL(0x7ffff3d876fd), 
syms_left=make_fixnum(1025), nargs=1, args=0x7fffffffe2a8) at 
../../src/eval.c:3036
#49 0x000000000069214e in funcall_lambda (fun=XIL(0x7ffff3d876fd), nargs=1, 
arg_vector=0x7fffffffe2a8) at ../../src/eval.c:3117
#50 0x0000000000691554 in Ffuncall (nargs=2, args=0x7fffffffe2a0) at 
../../src/eval.c:2916
#51 0x0000000000690e40 in call1 (fn=XIL(0x42f0), arg1=XIL(0xd0a900)) at 
../../src/eval.c:2774
#52 0x00000000005b43ea in command_loop_1 () at ../../src/keyboard.c:1466
#53 0x000000000068d36c in internal_condition_case (bfun=0x5b3b91 <command_loop_1>, 
handlers=XIL(0x90), hfun=0x5b31a0 <cmd_error>) at ../../src/eval.c:1439
#54 0x00000000005b3776 in command_loop_2 (ignore=XIL(0)) at 
../../src/keyboard.c:1094
#55 0x000000000068c778 in internal_catch (tag=XIL(0xd5f0), func=0x5b3749 
<command_loop_2>, arg=XIL(0)) at ../../src/eval.c:1189
#56 0x00000000005b3714 in command_loop () at ../../src/keyboard.c:1073
#57 0x00000000005b2c87 in recursive_edit_1 () at ../../src/keyboard.c:720
#58 0x00000000005b2e7f in Frecursive_edit () at ../../src/keyboard.c:789
#59 0x00000000005aed56 in main (argc=1, argv=0x7fffffffe7c8) at 
../../src/emacs.c:2050

Lisp Backtrace:
"next-window" (0xffffa9d0)
"other-window" (0xffffaf58)
"ediff-skip-unsuitable-frames" (0xffffb4a0)
"ediff-prepare-error-list" (0xffffba58)
"ediff-setup-diff-regions" (0xffffbfa8)
"ediff-setup" (0xffffcac8)
"ediff-buffers-internal" (0xffffd0d0)
"ediff-buffers" (0xffffd530)
"my-diffs-b" (0xffffda90)
"funcall-interactively" (0xffffda88)
"call-interactively" (0xffffdd40)
"command-execute" (0xffffe2a8)
(gdb) frame 3
#3  0x00000000004d1897 in decode_next_window_args (window=0x7fffffffa808, 
minibuf=0x7fffffffa800, all_frames=0x7fffffffa7f8) at ../../src/window.c:2672
2672        *minibuf = this_minibuffer_depth (XWINDOW (miniwin)->contents)
(gdb) p miniwin
$1 = XIL(0)
(gdb) frame 5
#5  0x00000000004d1ed0 in Fnext_window (window=XIL(0x2abb4b5), minibuf=XIL(0), 
all_frames=XIL(0x30)) at ../../src/window.c:2804
2804      return next_window (window, minibuf, all_frames, true);
(gdb) p XWINDOW (window)->contents
$2 = XIL(0x10f3195)
(gdb) xpr
Lisp_Vectorlike
PVEC_BUFFER
$3 = (struct buffer *) 0x10f3190
0x1db57b8 " *tip*"
(gdb)


>> we probably should decide whether to consider tooltip windows in
>> `next-window' or `other-window' at all.
>
> Not sure why.  Don't we envision some applications that would like to
> examine tooltip windows?  IOW, that tooltip frames don't have a
> minibuffer doesn't necessarily mean we don't want to give window
> iterations access to tooltip windows.

But then people must be always careful to never look into the minibuffer
window of a tooltip when writing C code.  Think of minibuf.c's

      struct frame *sf = XFRAME (selected_frame);
      /* I don't think that any frames may validly have a null minibuffer
         window anymore.  */
      if (NILP (sf->minibuffer_window))
        emacs_abort ();

martin