bug#12814: 24.3.50; Emacs crash in event_to_kboard at keyboard.c:3421

[Tassilo Horn]

Eli Zaretskii <eliz@gnu.org> writes:

> They haven't, but now you should be able to use xtype to see what kind
> of object is obj that cases the crash.

Ok.  It took much longer for the crash to occur, but now xtype worked
(complete backtrace attached).

Program received signal SIGSEGV, Segmentation fault.
0x00000000005437a4 in event_to_kboard (event=0xbc0660 <kbd_buffer+18944>)
    at keyboard.c:3421
3421      if (WINDOWP (obj))
(gdb) p obj
$1 = 7652357
(gdb) xtype 
Lisp_Vectorlike
Cannot access memory at address 0x74c400

Bye,
Tassilo

Program received signal SIGSEGV, Segmentation fault.
0x00000000005437a4 in event_to_kboard (event=0xbc0660 <kbd_buffer+18944>)
    at keyboard.c:3421
3421      if (WINDOWP (obj))
(gdb) p obj
$1 = 7652357
(gdb) xtype 
Lisp_Vectorlike
Cannot access memory at address 0x74c400
(gdb) bt full
#0  0x00000000005437a4 in event_to_kboard (event=0xbc0660 <kbd_buffer+18944>)
    at keyboard.c:3421
        obj = 7652357
#1  0x00000000005442bd in kbd_buffer_get_event (kbp=0x7fff3d71dd20, 
    used_mouse_menu=0x7fff3d71e2d7, end_time=0x0) at keyboard.c:3823
        event = 0xbc0660 <kbd_buffer+18944>
        obj = 357921035
#2  0x0000000000541e8d in read_char (commandflag=1, nmaps=8, 
    maps=0x7fff3d71e0c0, prev_event=12766914, used_mouse_menu=0x7fff3d71e2d7, 
    end_time=0x0) at keyboard.c:2768
        kb = 0x10000000532ead5
        c = 12766914
        jmpcount = 2
        local_getcjmp = {{
            __jmpbuf = {0, 2550837358400367020, 4290928, 140734224264208, 0, 
              0, 2550837360409438636, -2551254709291062868}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {190348, 140734224261248, 6058850, 57672011, 9323869, 
                12766914, 4290928, 140734224260896, 6116284, 1, 12766914, 
                12807021, 100865958, 0, 12766866, 12766914}
            }
          }}
---Type <return> to continue, or q <return> to quit---
        save_jump = {{
            __jmpbuf = {0, 0, 0, 0, 0, 0, 0, 0}, 
            __mask_was_saved = 0, 
            __saved_mask = {
              __val = {0 <repeats 16 times>}
            }
          }}
        tem = 87222992
        save = 12769840
        previous_echo_area_message = 12766914
        also_record = 12766914
        reread = false
        gcpro1 = {
          next = 0x532ead0, 
          var = 0x33e7ec0, 
          nvars = 54427328
        }
        gcpro2 = {
          next = 0x7fff3d71dd60, 
          var = 0x63dbd7 <find_interval+117>, 
          nvars = 54427328
        }
        polling_stopped_here = true
---Type <return> to continue, or q <return> to quit---
        orig_kboard = 0x27a50c0
#3  0x000000000054e93c in read_key_sequence (keybuf=0x7fff3d71e550, 
    bufsize=30, prompt=12766914, dont_downcase_last=false, 
    can_return_switch_frame=true, fix_current_buffer=true) at keyboard.c:9223
        interrupted_kboard = 0x27a50c0
        interrupted_frame = 0x122bd10
        key = 40
        used_mouse_menu = false
        echo_local_start = 0
        last_real_key_start = 0
        keys_local_start = 0
        local_first_binding = 0
        from_string = 12766914
        count = 2
        t = 0
        echo_start = 0
        keys_start = 0
        nmaps = 8
        nmaps_allocated = 8
        defs = 0x7fff3d71e070
        submaps = 0x7fff3d71e0c0
        orig_local_map = 74940486
        orig_keymap = 12766914
---Type <return> to continue, or q <return> to quit---
        localized_local_map = 0
        first_binding = 0
        first_unbound = 31
        mock_input = 0
        fkey = {
          parent = 19811574, 
          map = 19811574, 
          start = 0, 
          end = 0
        }
        keytran = {
          parent = 12746166, 
          map = 12746166, 
          start = 0, 
          end = 0
        }
        indec = {
          parent = 19811558, 
          map = 19811558, 
          start = 0, 
          end = 0
        }
        shift_translated = false
---Type <return> to continue, or q <return> to quit---
        delayed_switch_frame = 12766914
        original_uppercase = 87222992
        original_uppercase_position = -1
        dummyflag = false
        starting_buffer = 0x532ead0
        fake_prefixed_keys = 12766914
        gcpro1 = {
          next = 0x7fff3d71e300, 
          var = 0x532ead5, 
          nvars = 12953202
        }
#4  0x000000000053f414 in command_loop_1 () at keyboard.c:1458
        cmd = 12807106
        keybuf = {436, 12, 12766914, 140734224262752, 12766962, 99474918, 
          3994319585295, 40855936, 40580512, 800, 140734224262592, 9345238, 
          12818658, 19053840, 140734224262640, 5165477, 9374113, 6970589, 
          140734224262192, 12766914, 12766914, 9345249, 140734224262720, 
          5499993, 140734224262752, 99474918, 12766914, 19053840, 
          140734224262720, 0}
        i = 1
        prev_modiff = 49690
        prev_buffer = 0x532ead0
        already_adjusted = false
---Type <return> to continue, or q <return> to quit---
#5  0x00000000005d6d57 in internal_condition_case (
    bfun=0x53f02d <command_loop_1>, handlers=12818562, 
    hfun=0x53e92e <cmd_error>) at eval.c:1288
        val = 1
        c = {
          tag = 12766914, 
          val = 12766914, 
          next = 0x7fff3d71e890, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {0, 2550837358681385388, 4290928, 140734224264208, 0, 
                0, 2550837358582819244, -2551254790071916116}, 
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {15895489283637635500, 0, 140223433214848, 4294967295, 
                  0, 9290408, 0, 0, 0, 0, 140223529376260, 1, 0, 1, 
                  140223429356144, 0}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
---Type <return> to continue, or q <return> to quit---
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
        h = {
          handler = 12818562, 
          var = 12766914, 
          chosen_clause = 12766962, 
          tag = 0x7fff3d71e710, 
          next = 0x0
        }
#6  0x000000000053ed46 in command_loop_2 (ignore=12766914) at keyboard.c:1167
        val = 0
#7  0x00000000005d672b in internal_catch (tag=12814402, 
    func=0x53ed20 <command_loop_2>, arg=12766914) at eval.c:1059
        c = {
          tag = 12814402, 
          val = 12766914, 
          next = 0x0, 
          gcpro = 0x0, 
          jmp = {{
              __jmpbuf = {0, 2550837358631053740, 4290928, 140734224264208, 0, 
                0, 2550837358672996780, -2551254790282155604}, 
---Type <return> to continue, or q <return> to quit---
              __mask_was_saved = 0, 
              __saved_mask = {
                __val = {0, 0, 144, 0, 0, 140734224263568, 6025345, 
                  4294967296, 12766914, 12766914, 12988610, 140734224263664, 
                  0, 12218656, 12793680, 352}
              }
            }}, 
          backlist = 0x0, 
          handlerlist = 0x0, 
          lisp_eval_depth = 0, 
          pdlcount = 2, 
          poll_suppress_count = 1, 
          interrupt_input_blocked = 0, 
          byte_stack = 0x0
        }
#8  0x000000000053ecf8 in command_loop () at keyboard.c:1146
No locals.
#9  0x000000000053e47b in recursive_edit_1 () at keyboard.c:778
        count = 1
        val = 12766914
#10 0x000000000053e621 in Frecursive_edit () at keyboard.c:842
        count = 0
        buffer = 12766914
---Type <return> to continue, or q <return> to quit---
#11 0x000000000053c564 in main (argc=1, argv=0x7fff3d71ec18) at emacs.c:1564
        dummy = 4247287
        stack_bottom_variable = 0 '\000'
        do_initial_setlocale = true
        dumping = false
        skip_args = 0
        rlim = {
          rlim_cur = 8720000, 
          rlim_max = 18446744073709551615
        }
        no_loadup = false
        junk = 0x0
        dname_arg = 0x0
        ch_to_dir = 0x13ad000 "<\001"
(gdb) 
(gdb) xbacktrace 
(gdb)