bug#17975: 24.3.92; assertion failure deleting frames with varying names for the same display (and, using multiple X11 connections in that case too)

[Dmitry Antipov]

On 07/13/2014 08:35 PM, Eli Zaretskii wrote:

> If this doesn't fix the crash, then please show the backtrace, because
> the previous one started with the update_menu_bar call.

The backtrace at http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17975#20
has 32 frames started from main.  For the record, this is another one:

#0  XFindContext (display=display@entry=0x0, rid=12681952, 
context=context@entry=-5, data=data@entry=0x7ffffffecc80) at Context.c:245
#1  0x00000037da3a92d8 in _XmRCColorHook (w=w@entry=0x143d0c0, 
alIn=alIn@entry=0x7ffffffed340, acPtrIn=acPtrIn@entry=0x7ffffffecd7c)
    at RCHook.c:73
#2  0x00000037dbc1bed7 in CallInitialize (class=<optimized out>, 
req_widget=req_widget@entry=0x7ffffffecec0,
    new_widget=new_widget@entry=0x143d0c0, args=args@entry=0x7ffffffed340, 
num_args=num_args@entry=1) at Create.c:231
#3  0x00000037dbc1c867 in xtCreate (name=name@entry=0xd62ce0 "Line Wrapping in This 
Buffer", class=class@entry=0x0,
    widget_class=widget_class@entry=0x37da6b8800 <xmRowColumnClassRec>, 
parent=parent@entry=0x1535ce0, default_screen=0x133b220,
    args=args@entry=0x7ffffffed340, num_args=num_args@entry=1, 
typed_args=typed_args@entry=0x0,
    num_typed_args=num_typed_args@entry=0, parent_constraint_class=0x0, 
post_proc=post_proc@entry=0x37dbc1bef0 <widgetPostProc>)
    at Create.c:416
#4  0x00000037dbc1cc90 in _XtCreateWidget (name=name@entry=0xd62ce0 "Line Wrapping 
in This Buffer",
    widget_class=widget_class@entry=0x37da6b8800 <xmRowColumnClassRec>, 
parent=parent@entry=0x1535ce0,
    args=args@entry=0x7ffffffed340, num_args=num_args@entry=1, 
typed_args=typed_args@entry=0x0,
    num_typed_args=num_typed_args@entry=0) at Create.c:570
#5  0x00000037dbc1cf7e in XtCreateWidget (name=name@entry=0xd62ce0 "Line Wrapping in 
This Buffer",
    widget_class=0x37da6b8800 <xmRowColumnClassRec>, parent=0x1535ce0, 
args=args@entry=0x7ffffffed340, num_args=num_args@entry=1)
    at Create.c:589
#6  0x00000037da2f5a02 in create (p=p@entry=0x1550760, name=name@entry=0xd62ce0 
"Line Wrapping in This Buffer",
    old_al=old_al@entry=0x0, old_ac=old_ac@entry=0, type=type@entry=2, 
is_radio=is_radio@entry=0) at RowColumn.c:3246
#7  0x00000037da2f7cbe in XmCreatePulldownMenu (p=0x1550760, name=0xd62ce0 "Line 
Wrapping in This Buffer", al=0x0, ac=0)
    at RowColumn.c:3485
#8  0x00000000006d07b6 in update_one_menu_entry (instance=0xbf12a0, 
widget=0x1551ba0, val=0xd62c70, deep_p=1 '\001')
    at ../../trunk/lwlib/lwlib-Xm.c:695
#9  0x00000000006d0b55 in xm_update_menu (instance=0xbf12a0, widget=0x1550760, 
val=0xd62a50, deep_p=1 '\001')
    at ../../trunk/lwlib/lwlib-Xm.c:783
#10 0x00000000006d09dd in update_one_menu_entry (instance=0xbf12a0, 
widget=0x171bbf0, val=0xd62a50, deep_p=1 '\001')
    at ../../trunk/lwlib/lwlib-Xm.c:726
#11 0x00000000006d0b55 in xm_update_menu (instance=0xbf12a0, widget=0x150db10, 
val=0xc009a0, deep_p=1 '\001')
    at ../../trunk/lwlib/lwlib-Xm.c:783
#12 0x00000000006d0ed8 in xm_update_one_widget (instance=0xbf12a0, 
widget=0x150db10, val=0xc009a0, deep_p=1 '\001')
    at ../../trunk/lwlib/lwlib-Xm.c:879
#13 0x00000000006ce0c6 in set_one_value (instance=0xbf12a0, val=0xc009a0, 
deep_p=1 '\001') at ../../trunk/lwlib/lwlib.c:534
#14 0x00000000006ce11b in update_one_widget_instance (instance=0xbf12a0, 
deep_p=1 '\001') at ../../trunk/lwlib/lwlib.c:554
#15 0x00000000006ce161 in update_all_widget_values (info=0x13532a0, deep_p=1 
'\001') at ../../trunk/lwlib/lwlib.c:564
#16 0x00000000006ce385 in lw_modify_all_widgets (id=2, val=0x1384ff0, deep_p=1 
'\001') at ../../trunk/lwlib/lwlib.c:618
#17 0x00000000004a5428 in set_frame_menubar (f=0x11b49d0, first_time=false, 
deep_p=true) at ../../trunk/src/xmenu.c:973
#18 0x000000000045c923 in update_menu_bar (f=0x11b49d0, save_match_data=0, 
hooks_run=1) at ../../trunk/src/xdisp.c:11822
#19 0x000000000045c567 in prepare_menu_bars () at ../../trunk/src/xdisp.c:11705
#20 0x0000000000460b87 in redisplay_internal () at ../../trunk/src/xdisp.c:13497
#21 0x000000000045f865 in redisplay () at ../../trunk/src/xdisp.c:13116
#22 0x000000000056af8a in read_char (commandflag=1, map=..., prev_event=..., 
used_mouse_menu=0x7fffffffd75f, end_time=0x0)
    at ../../trunk/src/keyboard.c:2561
#23 0x000000000057a59d in read_key_sequence (keybuf=0x7fffffffd940, bufsize=30, 
prompt=..., dont_downcase_last=false,
    can_return_switch_frame=true, fix_current_buffer=true, 
prevent_redisplay=false) at ../../trunk/src/keyboard.c:9085
#24 0x0000000000567f52 in command_loop_1 () at ../../trunk/src/keyboard.c:1439
#25 0x0000000000608f24 in internal_condition_case (bfun=0x567b90 <command_loop_1>, 
handlers=..., hfun=0x567366 <cmd_error>)
    at ../../trunk/src/eval.c:1349
#26 0x000000000056782e in command_loop_2 (ignore=...) at 
../../trunk/src/keyboard.c:1170
#27 0x00000000006083a7 in internal_catch (tag=..., func=0x56780b 
<command_loop_2>, arg=...) at ../../trunk/src/eval.c:1113
#28 0x00000000005677e2 in command_loop () at ../../trunk/src/keyboard.c:1149
#29 0x0000000000566e92 in recursive_edit_1 () at ../../trunk/src/keyboard.c:770
#30 0x0000000000567062 in Frecursive_edit () at ../../trunk/src/keyboard.c:841
#31 0x0000000000564f69 in main (argc=4, argv=0x7fffffffddc8) at 
../../trunk/src/emacs.c:1656

> If it is
> called for a frame other than the one just deleted, then what exactly
> is the reason for the crash?  Why is the frame's display structure
> NULL?

I don't know what "the frame's display structure" is.

If you mean F->output_data.x->display_info->display, then it looks
correct.  For the crash listed above (frame pointer noticed at #18):

(gdb) p ((struct frame *)0x11b49d0)->output_data.x->display_info
$1 = (struct x_display_info *) 0xd834a0
(gdb) p ((struct frame *)0x11b49d0)->output_data.x->display_info->display
$2 = (Display *) 0xc182e0

And the frame is definitely live:

(gdb) p ((struct frame *)0x11b49d0)->terminal
$3 = (struct terminal *) 0x11b3c28

Dmitry