bug#11984: 24.1; segfault while deleting a window

[Russell Sim]

Russell Sim <russell.sim@gmail.com> writes:

> Chong Yidong <cyd@gnu.org> writes:
>> I committed a fix to the emacs-24 branch adding CHECK_LIVE_FRAME calls
>> to those two functions (patch below).  But for long-term safety, I think
>> decode_any_windows had better signal an error if the window's frame
>> isn't live.  But I'm not sure if there's any subtle reliance in existing
>> code on allowing window functions to be called for windows on dead
>> frames---anyone know?
>
> Thanks for the champion effort, but I can still create the bug on
> emacs-24 3770cb4 which includes Chongs patch.
>
> Here is a full backtrace, and another core
> http://russellsim.org/emacs-24.3770cb4.core

Oh crap, I just realised that you didn't add you full patch in the
commit.  I have re-compiled and included the extra in
window-absolute-pixel-edges and delete-other-windows-internal changes.
Unfortunately I still get the error.

I here is an updated core
file. http://russellsim.org/emacs-24.3770cb4-patch.core

This may or may not help since I have no idea what extra would be
included in a core file, line 2653 has the contents:

  hlinfo = MOUSE_HL_INFO (f);

Thanks,
Russell


#0  0x000000000048c5cc in Fdelete_other_windows_internal (window=24470869, 
root=24128309) at window.c:2653
        w = 0x1756550
        r = 0x1702b30
        s = 0xc59212
        f = 0xc390d0
        sibling = 812
        pwindow = 24470869
        swindow = 13333010
        delta = 12726818
        startpos = 1
        top = 4
        new_top = 32767
        resize_failed = -115344
        hlinfo = 0xc23222
#1  0x0000000000602a69 in Ffuncall (nargs=3, args=0x7ffffffe3e30) at eval.c:3005
        fun = 9345541
        original_fun = 12950978
        funcar = 103079215107
        numargs = 2
        lisp_numargs = 12782626
        val = 12726818
        backtrace = {next = 0x7ffffffe42e0, function = 0x7ffffffe3e30, args = 
0x7ffffffe3e38, nargs = 2, debug_on_exit = 0}
        internal_args = 0x7ffffffe3e38
        i = 12726818
#2  0x000000000064de50 in exec_byte_code (bytestr=9699809, vector=9699861, 
maxdepth=20, args_template=12726818, nargs=0, args=0x0) at bytecode.c:785
        count = 25
        op = 2
        vectorp = 0x940220
        stack = {pc = 0xb6f179 "\210\323\r!\210\324\r!\210Շ", byte_string = 
9699809, byte_string_start = 0xb6f118 "\b\204U", constants = 9699861, next = 
0x7ffffffe4540}
        top = 0x7ffffffe3e30
        result = 140737488241984
#3  0x000000000064d3bb in Fbyte_code (bytestr=9699809, vector=9699861, 
maxdepth=20) at bytecode.c:423
No locals.
#4  0x0000000000601427 in eval_sub (form=9699782) at eval.c:2356
        numargs = 12
        args_left = 12726818
        i = 3
        maxargs = 3
        argvals = {9699809, 9699861, 20, 140737488241376, 140737488241384, 1, 
140737488241296, 5816836}
        fun = 12108133
        val = 12816597
        original_fun = 12866754
        original_args = 9699798
        funcar = 5815511
        backtrace = {next = 0x7ffffffe4a80, function = 0x7ffffffe4310, args = 
0x7ffffffe4240, nargs = 3, debug_on_exit = 0}
        gcpro1 = {next = 0x7ffffffe4310, var = 0x6021f4, nvars = 12864482}
        gcpro2 = {next = 0xc23222, var = 0xc23222, nvars = 12726818}
        gcpro3 = {next = 0x1, var = 0x7ffffffe4240, nvars = 3}
#5  0x00000000005ff063 in internal_catch (tag=13220914, func=0x600d8d 
<eval_sub>, arg=9699782) at eval.c:1272
        c = {tag = 13220914, val = 12726818, next = 0x7ffffffe6a50, gcpro = 
0x0, jmp = {{__jmpbuf = {140737488242928, 1568579509601815893, 140737488242928, 
140737488243584, 0, 0, 1568579509629078869, 
                -1568579215016735403}, __mask_was_saved = 0, __saved_mask = 
{__val = {6302801, 140737488241872, 16, 12726818, 94489280514, 140737488241872, 
2, 140737488243328, 140737488241872, 140737488241880, 
                  1, 24566916, 12769218, 12726818, 13453714, 1}}}}, backlist = 
0x7ffffffe4a80, handlerlist = 0x7ffffffe6a20, lisp_eval_depth = 10, pdlcount = 
25, poll_suppress_count = 1, 
          interrupt_input_blocked = 0, byte_stack = 0x7ffffffe4540}
#6  0x000000000064eaaf in exec_byte_code (bytestr=9699617, vector=9699653, 
maxdepth=16, args_template=12726818, nargs=0, args=0x0) at bytecode.c:966
        v1 = 9699782
        count = 20
        op = 141
        vectorp = 0x940150
        stack = {pc = 0xb6f1a2 "-\207", byte_string = 9699617, 
byte_string_start = 0xb6f185 
"\306\b!\020\307\b!\031\310\b\311\"\032\310\b\303\"\033ʉ\034\035\313\t!\210\314͍-\207",
 constants = 9699653, 
          next = 0x7ffffffe59a0}
        top = 0x7ffffffe44d0
        result = 9465524
#7  0x0000000000603469 in funcall_lambda (fun=9699557, nargs=0, 
arg_vector=0x7ffffffe48f0) at eval.c:3233
        val = 24566917
        syms_left = 12726818
        next = 12782626
        lexenv = 12726818
        count = 19
        i = 0
        optional = 1
        rest = 0
#8  0x0000000000602f70 in apply_lambda (fun=9699557, args=12726818) at 
eval.c:3110
        args_left = 12726818
        i = 0
        numargs = 0
        arg_vector = 0x7ffffffe48f0
        gcpro1 = {next = 0x7ffffffe49b0, var = 0x5fd4ea, nvars = 0}
        gcpro2 = {next = 0xc40d72, var = 0xc23222, nvars = 12726818}
        gcpro3 = {next = 0x7ffffffe49b0, var = 0xc23222, nvars = 9470012}
        tem = 24566917
        sa_count = 19
        sa_must_free = 0
#9  0x00000000006015ec in eval_sub (form=22159046) at eval.c:2395
        fun = 9699557
        val = 24566917
        original_fun = 13582674
        original_args = 12726818
        funcar = 4307814658
        backtrace = {next = 0x7ffffffe4d50, function = 0x7ffffffe4ab0, args = 
0x7ffffffe48f0, nargs = 0, debug_on_exit = 0}
        gcpro1 = {next = 0xc23222, var = 0x7ffffffe4b80, nvars = 
140737488243344}
        gcpro2 = {next = 0x16f1e00, var = 0xbfbfd0, nvars = 1}
        gcpro3 = {next = 0xbfbfd0, var = 0xc23252, nvars = 2}
#10 0x00000000005fd5bb in Fprogn (args=24433798) at eval.c:364
        val = 24566917
        gcpro1 = {next = 0x14bcf42, var = 0xc23222, nvars = 0}