bug#12703: segfault in 0x0000000100087491 in char_table_ref () at chartab.c:233 (emacs-24.2.50.1, osx-10.8.2)

[Leif Walsh]

Hi,

I am getting a pretty reproducible bug in my own build of
emacs-24.2.50.1 on osx-10.8.2 with the "lion fullscreen patch" from
somewhere.

Build info:

git://git.savannah.gnu.org/emacs.git@fbfb2416
additional patch attached in fullscreen.patch
config.log attached

Steps to reproduce:

1. Install auto-complete-1.3.1 and git://github.com/brianjcj/auto-complete-clang
2. Visit a c++ file
3. Try completing some stuff
4. Segfaults after not too much messing around

Backtrace:

(gdb) bt
#0  0x00007fff96242d46 in __kill ()
#1  0x000000010009f63e in fatal_error_backtrace (sig=6,
backtrace_limit=6) at emacs.c:331
#2  0x00000001000bc5b3 in emacs_abort () at sysdep.c:1830
#3  0x000000010018c73d in ns_term_shutdown (sig=<value temporarily
unavailable, due to optimizations>) at nsterm.m:4229
#4  0x000000010009f5f1 in fatal_error_backtrace (sig=11,
backtrace_limit=10) at emacs.c:314
#5  0x00000001000a1cde in handle_fatal_signal (sig=<value temporarily
unavailable, due to optimizations>) at emacs.c:287
#6  0x00000001000bc80d in handle_on_main_thread (sig=11,
handler=0x1000a1cd0 <handle_fatal_signal>) at sysdep.c:1493
#7  <signal handler called>
#8  0x0000000100087491 in char_table_ref () at chartab.c:233
#9  0x000000010016fadf in composition_compute_stop_pos
(cmp_it=0x7fff5fbf2770, charpos=4195335, bytepos=5, endpos=4300718816,
string=140734799751024) at composite.c:1053
#10 0x000000010002e701 in compute_stop_pos (it=0x7fff5fbf4c40) at xdisp.c:3393
#11 0x000000010002fdcb in next_element_from_string (it=0x7fff5fbf43d8)
at xdisp.c:7525
#12 0x00000001000318f2 in get_next_display_element (it=0x7fff5fbf43d8)
at xdisp.c:6568
#13 0x0000000100039f06 in display_line (it=0x7fff5fbf43d8) at xdisp.c:19382
#14 0x00000001000410cf in try_window (window=4346955808,
flags=1606373632) at xdisp.c:16285
#15 0x000000010004a5b6 in redisplay_window (window=140734799758296,
just_this_one_p=1606393984) at xdisp.c:15811
#16 0x0000000100035d86 in redisplay_window_0 (window=140734799758296)
at xdisp.c:13879
#17 0x000000010011b030 in internal_condition_case_1 (bfun=0x100035d60
<redisplay_window_0>, arg=140734799758296, handlers=4320156886,
hfun=0x100016250 <redisplay_window_error>) at eval.c:1346
#18 0x0000000100035d3c in redisplay_windows (window=140734799758296)
at xdisp.c:13859
#19 0x00000001000422ad in redisplay_internal () at xdisp.c:13439
#20 0x0000000100042b37 in redisplay_preserve_echo_area
(from_where=51992685) at xdisp.c:13695
#21 0x00000001000aaf39 in detect_input_pending_run_timers
(do_display=1) at keyboard.c:10361
#22 0x000000010015dbed in wait_reading_process_output
(time_limit=140734799790240, nsecs=1606402208, read_kbd=1606402208,
do_display=1606402208, wait_for_cell=140734799790240,
wait_proc=0x7fff5fbfc0a0, just_wait_proc=0) at process.c:4768
#23 0x00000001000056c5 in sit_for (timeout=28, do_display=1,
reading=true) at dispnew.c:5977
#24 0x00000001000ae6e8 in read_char (commandflag=1606402928,
nmaps=140734799790960, maps=0x7fff5fbfc370, prev_event=1,
used_mouse_menu=0x7fff5fbfc370, end_time=0x7fff5fbfc370) at
keyboard.c:2707
#25 0x00000001000b26b1 in read_key_sequence () at keyboard.c:2838
#26 0x00000001000b4148 in command_loop_1 () at keyboard.c:1487
#27 0x000000010011b186 in internal_condition_case (bfun=0x1000b2d10
<command_loop_1>, handlers=4320212282, hfun=0x1000b41d0 <cmd_error>)
at eval.c:1308
#28 0x00000001000b2cee in command_loop_2 (ignore=140734799791752) at
keyboard.c:1182
#29 0x000000010011b282 in internal_catch (tag=140734799791752,
func=0x1000b2cb0 <command_loop_2>, arg=140734799791752) at eval.c:1069
#30 0x00000001000b4760 in command_loop [inlined] () at
/Users/leif/git/emacs/src/keyboard.c:1161
#31 0x00000001000b4760 in recursive_edit_1 () at keyboard.c:782
#32 0x00000001000a4ead in Frecursive_edit () at keyboard.c:846
#33 0x00000001000a1c2d in main (argc=25241098, argv=0x7fff5fbfcc70) at
emacs.c:1655
(gdb) thread apply all bt

Thread 5 (core thread 4):
#0  0x00007fff96243322 in select$DARWIN_EXTSN ()
#1  0x000000010018876b in -[EmacsApp fd_handler:] (self=0x5,
_cmd=0x100f09b00, unused=0x0) at nsterm.m:4570
#2  0x00007fff9750a612 in __NSThread__main__ ()
#3  0x00007fff930d4742 in _pthread_start ()
#4  0x00007fff930c1181 in thread_start ()

Thread 4 (core thread 3):
#0  0x00007fff962436d6 in __workq_kernreturn ()
#1  0x00007fff930d6eec in _pthread_workq_return ()
#2  0x00007fff930d6cb3 in _pthread_wqthread ()
#3  0x00007fff930c1171 in start_wqthread ()

Thread 3 (core thread 2):
#0  0x00007fff96243d16 in kevent ()
#1  0x00007fff8c571dea in _dispatch_mgr_invoke ()
#2  0x00007fff8c5719ee in _dispatch_mgr_thread ()

Thread 2 (core thread 1):
#0  0x00007fff962436d6 in __workq_kernreturn ()
#1  0x00007fff930d6eec in _pthread_workq_return ()
#2  0x00007fff930d6cb3 in _pthread_wqthread ()
#3  0x00007fff930c1171 in start_wqthread ()

Thread 1 (core thread 0):
#0  0x00007fff96242d46 in __kill ()
#1  0x000000010009f63e in fatal_error_backtrace (sig=6,
backtrace_limit=6) at emacs.c:331
#2  0x00000001000bc5b3 in emacs_abort () at sysdep.c:1830
#3  0x000000010018c73d in ns_term_shutdown (sig=<value temporarily
unavailable, due to optimizations>) at nsterm.m:4229
#4  0x000000010009f5f1 in fatal_error_backtrace (sig=11,
backtrace_limit=10) at emacs.c:314
#5  0x00000001000a1cde in handle_fatal_signal (sig=<value temporarily
unavailable, due to optimizations>) at emacs.c:287
#6  0x00000001000bc80d in handle_on_main_thread (sig=11,
handler=0x1000a1cd0 <handle_fatal_signal>) at sysdep.c:1493
#7  <signal handler called>
#8  0x0000000100087491 in char_table_ref () at chartab.c:233
#9  0x000000010016fadf in composition_compute_stop_pos
(cmp_it=0x7fff5fbf2770, charpos=4195335, bytepos=5, endpos=4300718816,
string=140734799751024) at composite.c:1053
#10 0x000000010002e701 in compute_stop_pos (it=0x7fff5fbf4c40) at xdisp.c:3393
#11 0x000000010002fdcb in next_element_from_string (it=0x7fff5fbf43d8)
at xdisp.c:7525
#12 0x00000001000318f2 in get_next_display_element (it=0x7fff5fbf43d8)
at xdisp.c:6568
#13 0x0000000100039f06 in display_line (it=0x7fff5fbf43d8) at xdisp.c:19382
#14 0x00000001000410cf in try_window (window=4346955808,
flags=1606373632) at xdisp.c:16285
#15 0x000000010004a5b6 in redisplay_window (window=140734799758296,
just_this_one_p=1606393984) at xdisp.c:15811
#16 0x0000000100035d86 in redisplay_window_0 (window=140734799758296)
at xdisp.c:13879
#17 0x000000010011b030 in internal_condition_case_1 (bfun=0x100035d60
<redisplay_window_0>, arg=140734799758296, handlers=4320156886,
hfun=0x100016250 <redisplay_window_error>) at eval.c:1346
#18 0x0000000100035d3c in redisplay_windows (window=140734799758296)
at xdisp.c:13859
#19 0x00000001000422ad in redisplay_internal () at xdisp.c:13439
#20 0x0000000100042b37 in redisplay_preserve_echo_area
(from_where=51992685) at xdisp.c:13695
#21 0x00000001000aaf39 in detect_input_pending_run_timers
(do_display=1) at keyboard.c:10361
#22 0x000000010015dbed in wait_reading_process_output
(time_limit=140734799790240, nsecs=1606402208, read_kbd=1606402208,
do_display=1606402208, wait_for_cell=140734799790240,
wait_proc=0x7fff5fbfc0a0, just_wait_proc=0) at process.c:4768
#23 0x00000001000056c5 in sit_for (timeout=28, do_display=1,
reading=true) at dispnew.c:5977
#24 0x00000001000ae6e8 in read_char (commandflag=1606402928,
nmaps=140734799790960, maps=0x7fff5fbfc370, prev_event=1,
used_mouse_menu=0x7fff5fbfc370, end_time=0x7fff5fbfc370) at
keyboard.c:2707
#25 0x00000001000b26b1 in read_key_sequence () at keyboard.c:2838
#26 0x00000001000b4148 in command_loop_1 () at keyboard.c:1487
#27 0x000000010011b186 in internal_condition_case (bfun=0x1000b2d10
<command_loop_1>, handlers=4320212282, hfun=0x1000b41d0 <cmd_error>)
at eval.c:1308
#28 0x00000001000b2cee in command_loop_2 (ignore=140734799791752) at
keyboard.c:1182
#29 0x000000010011b282 in internal_catch (tag=140734799791752,
func=0x1000b2cb0 <command_loop_2>, arg=140734799791752) at eval.c:1069
#30 0x00000001000b4760 in command_loop [inlined] () at
/Users/leif/git/emacs/src/keyboard.c:1161
#31 0x00000001000b4760 in recursive_edit_1 () at keyboard.c:782
#32 0x00000001000a4ead in Frecursive_edit () at keyboard.c:846
#33 0x00000001000a1c2d in main (argc=25241098, argv=0x7fff5fbfcc70) at
emacs.c:1655

Let me know if there's anything else I can do to help.  I'm not
familiar with emacs code but I'm handy with gdb.

I'm uploading the corefile to my server, it's gonna be maybe a half an
hour (it's ~120MB bzipped), when it's done you can:
wget 
'http://leifwalsh.com/emacs24-osx10.8-segfault-auto-complete-clang.core.bz2'
-O- | bunzip2 -c >core.34598

-- 
Cheers,
Leif

fullscreen.patch
Description: Binary data

config.log
Description: Binary data