bug#48732: 28.0.50; lisp_string_width segfaults on startup under macOS

[Eli Zaretskii]

> From: Naofumi Yasufuku <naofumi@yasufuku.dev>
> Date: Sun, 30 May 2021 04:28:11 +0900
> 
> After changes for auto-composition aware string-width (*),
> emacs segfaults frequently on startup under macOS.
> 
> gdb 'bt full’ is attached:
>   emacs_crash-lisp_string_width-gdb_bt_full.txt
>   emacs_crash-lisp_string_width-macOS_report.txt
> 
> On my machine, crash occurrence frequency can be increased with
> attached init.el.  Unfortunately, I cannot reproduce the crash with
> `--enable-checking='yes,glyphs' --enable-check-lisp-object-type`
> configure options.
> 
> Sometimes emacs starts without crash, but font setting is corrupted
> like the attached screenshot: after-lisp_string_width-autocmp.png

I cannot reproduce using your init.el.

> (gdb) p sym
> $1 = (Lisp_Object) 0x104621ba0
> (gdb) p XSYMBOL(sym)
> [New Thread 0x1b1f of process 79812]
> [New Thread 0x2a03 of process 79812]
> $2 = (struct Lisp_Symbol *) 0x204e4a730
> (gdb) p XSYMBOL(sym)->u
> Cannot access memory at address 0x204e4a730
> (gdb) p XSYMBOL(sym)->u.s
> Cannot access memory at address 0x204e4a730
> (gdb) p XSYMBOL(sym)->u.s.name
> Cannot access memory at address 0x204e4a738

So it's some kind of invalid "symbol".

> (gdb) up
> #2  0x00000001002976de in font_select_entity (f=0x10433f230,
>     entities=0x1048cb913, attrs=0x103778800, pixel_size=12, c=-1)
>     at font.c:3159
> 3159      FONT_SET_STYLE (prefer, FONT_WIDTH_INDEX, 
> attrs[LFACE_SWIDTH_INDEX]);
> (gdb) up
> #3  0x00000001002971b9 in font_find_for_lface (f=0x10433f230,
>     attrs=0x103778800, spec=0x10422c7ed, c=-1) at font.c:3302
> 3302                        val = font_select_entity (f, entities,

What is 'spec' in this frame?

  (gdb) pp spec

> (gdb) up
> #4  0x000000010033905e in fontset_find_font (fontset=0x104419835, c=1603,
>     face=0x103778800, charset_id=-1, fallback=false) at fontset.c:660
> 660             font_entity = font_find_for_lface (f, face->lface,

What is 'fontset' in this frame?

> #8  0x0000000100324fce in autocmp_chars (rule=0x105f2311d, charpos=308,
>     bytepos=334, limit=312, win=0x104342e20, face=0x0, string=0x1033e79c4,
>     direction=0x0) at composite.c:923
> 923         font_object = font_range (charpos, bytepos, &to, win, face, 
> string);
> (gdb) up
> #9  0x0000000100325f1d in find_automatic_composition (pos=308, limit=308,
>     start=0x7ffeefbf15a8, end=0x7ffeefbf15a0, gstring=0x7ffeefbf15b8,
>     string=0x1033e79c4) at composite.c:1612
> 1612                    *gstring = autocmp_chars (elt, check.pos, 
> check.pos_byte,
> (gdb) up
> #10 0x00000001001248c8 in lisp_string_width (string=0x1033e79c4, from=0,
>     to=479, precision=-1, nchars=0x7ffeefbf1a28, nbytes=0x7ffeefbf1a20)
>     at character.c:375
> 375                  && find_automatic_composition (i, -1, &ignore, &end, 
> &val, string)

This seems to indicate Emacs is asking string-width to compute width
of a string that has 479 characters?  How come we have such a long
string here?

  (gdb) pp string

> (gdb) up
> #11 0x00000001002514db in styled_format (nargs=2, args=0x7ffeefbf74c0,
>     message=false) at editfns.c:3392
> 3392                    width = lisp_string_width (arg, 0, nchars_string, 
> prec,
> (gdb) up
> #12 0x000000010024f48f in Fformat (nargs=2, args=0x7ffeefbf74c0)
>     at editfns.c:3061
> 3061    return styled_format (nargs, args, false);

What are the arguments to 'format' here?

  (gdb) pp args[0]
  (gdb) pp args[1]

> (gdb) up
> #13 0x000000010026b23b in call3 (fn=0x100420bf5, arg1=0x1000000000,
>     arg2=0x7ffeefbf73f0, arg3=0x10026ec04 <xcdr_addr+20>) at eval.c:2912
> 2912  {

What function is being called here, and with what arguments?

  (gdb) pp fn
  (gdb) pp arg1
  (gdb) pp arg2
  (gdb) pp arg3

The command 'pp' is defined in src/.gdbinit, you may need to source
that file before you could use the command.

Thanks.