Emacs.app from trunk crash on startup or quit

[Carsten Mattner]

Jan,

could the crashes be related to your leak fixes?
[NSAutoreleasePool release] looks related.

The following trace is from normal startup.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x40000020
0x926d6d47 in objc_msgSend ()
(gdb) bt
#0  0x926d6d47 in objc_msgSend ()
#1  0x0000010a in ?? ()
#2  0x94fb2b47 in TDescriptor::~TDescriptor ()
#3  0x94fbd46c in TCFBase<TDescriptor>::ClassDestruct ()
#4  0x905fc8e1 in CFRelease ()
#5  0x926d9c58 in (anonymous namespace)::AutoreleasePoolPage::pop ()
#6  0x90627515 in _CFAutoreleasePoolPop ()
#7  0x9aa10b87 in -[NSAutoreleasePool release] ()
#8  0x002616f9 in ns_read_socket (terminal=0x86b790, expected=0,
hold_quit=0xbfffedc0) at nsterm.m:3421
#9  0x0010160f in read_avail_input (expected=0) at keyboard.c:6831
#10 0x001013b3 in gobble_input (expected=0) at keyboard.c:6746
#11 0x001012a3 in get_input_pending (addr=0x4dba34, flags=1) at keyboard.c:6720
#12 0x000fbdb3 in swallow_events (do_display=1) at keyboard.c:4202
#13 0x0000fa0d in sit_for (timeout=120, reading=1, do_display=1) at
dispnew.c:6025
#14 0x000f8738 in read_char (commandflag=1, nmaps=9, maps=0xbffff160,
prev_event=25404962, used_mouse_menu=0xbffff32c, end_time=0x0) at
keyboard.c:2688
#15 0x00106ffd in read_key_sequence (keybuf=0xbffff4d8, bufsize=30,
prompt=25404962, dont_downcase_last=0, can_return_switch_frame=1,
fix_current_buffer=1) at keyboard.c:9300
#16 0x000f552f in command_loop_1 () at keyboard.c:1448
#17 0x001aa9e6 in internal_condition_case (bfun=0xf5020
<command_loop_1>, handlers=25449866, hfun=0xf4630 <cmd_error>) at
eval.c:1499
#18 0x000f4b7d in command_loop_2 (ignore=25404962) at keyboard.c:1159
#19 0x001aa2cf in internal_catch (tag=25447890, func=0xf4b40
<command_loop_2>, arg=25404962) at eval.c:1256
#20 0x000f4afb in command_loop () at keyboard.c:1138
#21 0x000f4045 in recursive_edit_1 () at keyboard.c:758
#22 0x000f4236 in Frecursive_edit () at keyboard.c:822
#23 0x000f2000 in main (argc=1, argv=0xbffff9ac) at emacs.c:1715
(gdb)

Same issue if I start -Q and then try to quit emacs normally:
(gdb) bt
#0  0x926d6d54 in objc_msgSend ()
#1  0xb00876d2 in ?? ()
#2  0x94fb2b47 in TDescriptor::~TDescriptor ()
#3  0x94fbd46c in TCFBase<TDescriptor>::ClassDestruct ()
#4  0x905fc8e1 in CFRelease ()
#5  0x926d9c58 in (anonymous namespace)::AutoreleasePoolPage::pop ()
#6  0x90627515 in _CFAutoreleasePoolPop ()
#7  0x9aa10b87 in -[NSAutoreleasePool release] ()
#8  0x0025610d in ns_release_object (obj=0x6885a0) at nsterm.m:456
#9  0x002561d7 in ns_release_autorelease_pool (pool=0x6885a0) at nsterm.m:486
#10 0x000f271d in Fkill_emacs (arg=25404962) at emacs.c:2025
#11 0x001ae640 in Ffuncall (nargs=1, args=0xbfffe8c0) at eval.c:2986
#12 0x0020c661 in exec_byte_code (bytestr=3128881, vector=3128901,
maxdepth=20, args_template=25404962, nargs=0, args=0x0) at
bytecode.c:785
#13 0x001af211 in funcall_lambda (fun=3128853, nargs=1,
arg_vector=0xbfffec74) at eval.c:3217
#14 0x001ae8b0 in Ffuncall (nargs=2, args=0xbfffec70) at eval.c:3035
#15 0x0020c661 in exec_byte_code (bytestr=3129113, vector=3129133,
maxdepth=12, args_template=25404962, nargs=0, args=0x0) at
bytecode.c:785
#16 0x001af211 in funcall_lambda (fun=3129085, nargs=1,
arg_vector=0xbffff034) at eval.c:3217
#17 0x001ae8b0 in Ffuncall (nargs=2, args=0xbffff030) at eval.c:3035
#18 0x001a7446 in Fcall_interactively (function=25934410,
record_flag=25404962, keys=17205853) at callint.c:859
#19 0x001ae6a0 in Ffuncall (nargs=4, args=0xbffff390) at eval.c:2993
#20 0x001add61 in call3 (fn=25494946, arg1=25934410, arg2=25404962,
arg3=25404962) at eval.c:2786
#21 0x00109cdb in Fcommand_execute (cmd=25934410,
record_flag=25404962, keys=25404962, special=25404962) at
keyboard.c:10302
#22 0x000f5aa4 in command_loop_1 () at keyboard.c:1571
#23 0x001aa9e6 in internal_condition_case (bfun=0xf5020
<command_loop_1>, handlers=25449866, hfun=0xf4630 <cmd_error>) at
eval.c:1499
#24 0x000f4b7d in command_loop_2 (ignore=25404962) at keyboard.c:1159
#25 0x001aa2cf in internal_catch (tag=25447890, func=0xf4b40
<command_loop_2>, arg=25404962) at eval.c:1256
#26 0x000f4afb in command_loop () at keyboard.c:1138
#27 0x000f4045 in recursive_edit_1 () at keyboard.c:758
#28 0x000f4236 in Frecursive_edit () at keyboard.c:822
#29 0x000f2000 in main (argc=2, argv=0xbffff9a4) at emacs.c:1715

Lisp Backtrace:
"kill-emacs" (0xbfffe8c4)
"save-buffers-kill-emacs" (0xbfffec74)
"save-buffers-kill-terminal" (0xbffff034)
"call-interactively" (0xbffff394)

(gdb) frame 0
#0  0x926d6d54 in objc_msgSend ()
(gdb) frame 1
#1  0xb00876d2 in ?? ()
(gdb) frame 2
#2  0x94fb2b47 in TDescriptor::~TDescriptor ()
(gdb) frame 3
#3  0x94fbd46c in TCFBase<TDescriptor>::ClassDestruct ()
(gdb) frame 4
#4  0x905fc8e1 in CFRelease ()
(gdb) frame 5
#5  0x926d9c58 in (anonymous namespace)::AutoreleasePoolPage::pop ()
(gdb) frame 6
#6  0x90627515 in _CFAutoreleasePoolPop ()
(gdb) frame 7
#7  0x9aa10b87 in -[NSAutoreleasePool release] ()
(gdb) frame 8
#8  0x0025610d in ns_release_object (obj=0x6885a0) at nsterm.m:456
456         [(id)obj release];
Current language:  auto; currently objective-c
(gdb) frame 9
#9  0x002561d7 in ns_release_autorelease_pool (pool=0x6885a0) at nsterm.m:486
486       ns_release_object (pool);
(gdb) frame 10
#10 0x000f271d in Fkill_emacs (arg=25404962) at emacs.c:2025
2025      ns_release_autorelease_pool (ns_pool);
Current language:  auto; currently c
gdb) frame 11
#11 0x001ae640 in Ffuncall (nargs=1, args=0xbfffe8c0) at eval.c:2986
2986                  val = (XSUBR (fun)->function.a1 (internal_args[0]));
(gdb) frame 12
#12 0x0020c661 in exec_byte_code (bytestr=3128881, vector=3128901,
maxdepth=20, args_template=25404962, nargs=0, args=0x0) at byte
code.c:785
785                 TOP = Ffuncall (op + 1, &TOP);
(gdb) frame 13
#13 0x001af211 in funcall_lambda (fun=3128853, nargs=1,
arg_vector=0xbfffec74) at eval.c:3217
3217          val = exec_byte_code (AREF (fun, COMPILED_BYTECODE),
(gdb) frame 14
#14 0x001ae8b0 in Ffuncall (nargs=2, args=0xbfffec70) at eval.c:3035
3035        val = funcall_lambda (fun, numargs, args + 1);
(gdb) frame 15
#15 0x0020c661 in exec_byte_code (bytestr=3129113, vector=3129133,
maxdepth=12, args_template=25404962, nargs=0, args=0x0) at byte
code.c:785
785                 TOP = Ffuncall (op + 1, &TOP);
(gdb) frame 16
#16 0x001af211 in funcall_lambda (fun=3129085, nargs=1,
arg_vector=0xbffff034) at eval.c:3217
3217          val = exec_byte_code (AREF (fun, COMPILED_BYTECODE),
(gdb) frame 17
#17 0x001ae8b0 in Ffuncall (nargs=2, args=0xbffff030) at eval.c:3035
3035        val = funcall_lambda (fun, numargs, args + 1);
(gdb)