bug#20802: Segfault when showing non-GTK+ tooltip

[Tobias Getzner]

On Di, 2015-06-16 at 18:58 +0300, Eli Zaretskii wrote:
> > 
> > From: Tobias Getzner <tobias.getzner@gmx.de>
> > Date: Tue, 16 Jun 2015 17:34:05 +0200
> > 
> > Thanks! I built from master (34a43ba), which includes your 93ae9f4. 
> > I’m
> > still seeing a segfault for the steps given above. Backtrace below.
> 
> Please run Emacs under GDB, put a breakpoint in
> x_free_frame_resources, then perform your steps, and show backtrace
> each time the breakpoint breaks.
> 
> Thanks.
> 

Breakpoint 1, x_free_frame_resources (f=0x124fd70) at xterm.c:10970
10970   {
(gdb) bt
#0  x_free_frame_resources (f=0x124fd70) at xterm.c:10970
#1  0x00000000004c9715 in unwind_create_frame (frame=19201397) at xfns.c:2842
#2  0x00000000004c9759 in unwind_create_tip_frame (frame=<optimized out>) at 
xfns.c:4997
#3  0x0000000000557b2e in unbind_to (count=<optimized out>, 
value=value@entry=0) at eval.c:3211
#4  0x0000000000557cf9 in unwind_to_catch (catch=catch@entry=0x140a040, 
value=value@entry=19849283)
    at eval.c:1157
#5  0x00000000005592ed in Fsignal (error_symbol=error_symbol@entry=18624, 
data=<optimized out>)
    at eval.c:1557
#6  0x00000000005595f9 in xsignal (error_symbol=error_symbol@entry=18624, 
data=<optimized out>)
    at eval.c:1581
#7  0x0000000000559c6d in signal_error (s=s@entry=0x5e3d1d "Undefined color", 
arg=19849315, 
    arg@entry=34016084) at eval.c:1636
#8  0x00000000004ccc57 in x_decode_color (f=<optimized out>, 
color_name=34016084, 
    mono_color=<optimized out>) at xfns.c:495
#9  0x00000000004ce96c in x_set_foreground_color (f=0x124fd70, arg=34016084, 
oldval=<optimized out>)
    at xfns.c:602
#10 0x0000000000426ff6 in x_set_frame_parameters (f=f@entry=0x124fd70, 
alist=alist@entry=140737488338931)
    at frame.c:3152
#11 0x0000000000429ac7 in x_default_parameter (f=f@entry=0x124fd70, 
alist=alist@entry=19856675, 
    prop=prop@entry=22320, deflt=34090788, xprop=xprop@entry=0x5db8ca 
"foreground", 
    xclass=xclass@entry=0x5e3f61 "Foreground", type=RES_TYPE_STRING) at 
frame.c:4374
#12 0x00000000004cd200 in x_create_tip_frame (dpyinfo=0x173c900, 
parms=19856675, parms@entry=19857043, 
    text=text@entry=34092084) at xfns.c:5181
#13 0x00000000004cd94d in Fx_show_tip (string=34092084, frame=18429029, 
parms=19857043, timeout=42, dx=22, 
    dy=82) at xfns.c:5540
#14 0x0000000000558efa in Ffuncall (nargs=7, args=args@entry=0x7fffffffc2a8) at 
eval.c:2739
#15 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, 
vector=10509325, 
    maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#16 0x00000000005589af in funcall_lambda (fun=10509197, nargs=nargs@entry=2, 
    arg_vector=arg_vector@entry=0x7fffffffc4b0) at eval.c:2951
#17 0x0000000000558d7b in Ffuncall (nargs=3, args=args@entry=0x7fffffffc4a8) at 
eval.c:2779
#18 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, 
vector=10511429, 
    maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#19 0x00000000005589af in funcall_lambda (fun=10511333, nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffc768) at eval.c:2951
#20 0x0000000000558d7b in Ffuncall (nargs=2, args=0x7fffffffc760) at eval.c:2779
#21 0x0000000000556f95 in run_hook_with_args (nargs=2, args=0x7fffffffc760, 
funcall=0x558ba0 <Ffuncall>)
    at eval.c:2529
#22 0x0000000000558e69 in Ffuncall (nargs=3, args=args@entry=0x7fffffffc758) at 
eval.c:2698
#23 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, 
vector=10508605, 
    maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#24 0x00000000005589af in funcall_lambda (fun=10508541, nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffca38) at eval.c:2951
#25 0x0000000000558d7b in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffca30) at eval.c:2779
#26 0x000000000055a1f3 in Fapply (nargs=2, args=0x7fffffffca30) at eval.c:2293
#27 0x0000000000558e69 in Ffuncall (nargs=3, args=args@entry=0x7fffffffca28) at 
eval.c:2698
#28 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, 
vector=10064605, 
    maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#29 0x00000000005589af in funcall_lambda (fun=10064525, nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffcc28) at eval.c:2951
#30 0x0000000000558d7b in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffcc20) at eval.c:2779
#31 0x000000000055904a in call1 (fn=fn@entry=43776, arg1=arg1@entry=35546957) 
at eval.c:2573
#32 0x00000000004ee838 in timer_check_2 (idle_timers=<optimized out>, 
timers=<optimized out>)
    at keyboard.c:4536
#33 timer_check () at keyboard.c:4603
#34 0x00000000004eebe9 in readable_events (flags=flags@entry=1) at 
keyboard.c:3437
#35 0x00000000004f0218 in get_input_pending (flags=flags@entry=1) at 
keyboard.c:6821
#36 0x00000000004f2328 in detect_input_pending_run_timers 
(do_display=do_display@entry=true)
    at keyboard.c:9976
#37 0x000000000059719e in wait_reading_process_output 
(time_limit=time_limit@entry=30, 
    nsecs=<optimized out>, nsecs@entry=0, read_kbd=read_kbd@entry=-1, 
do_display=do_display@entry=true, 
    wait_for_cell=wait_for_cell@entry=0, wait_proc=wait_proc@entry=0x0, 
just_wait_proc=0) at process.c:5009
#38 0x00000000004221d2 in sit_for (timeout=<optimized out>, 
reading=reading@entry=true, 
    display_option=display_option@entry=1) at dispnew.c:5748
#39 0x00000000004f48a4 in read_char (commandflag=commandflag@entry=1, 
map=map@entry=35527283, 
    prev_event=0, used_mouse_menu=used_mouse_menu@entry=0x7fffffffd81b, 
end_time=end_time@entry=0x0)
    at keyboard.c:2784
#40 0x00000000004f542c in read_key_sequence 
(keybuf=keybuf@entry=0x7fffffffd8f0, prompt=prompt@entry=0, 
    dont_downcase_last=dont_downcase_last@entry=false, 
    can_return_switch_frame=can_return_switch_frame@entry=true, 
    fix_current_buffer=fix_current_buffer@entry=true, 
prevent_redisplay=prevent_redisplay@entry=false, 
    bufsize=30) at keyboard.c:9159
#41 0x00000000004f7051 in command_loop_1 () at keyboard.c:1407
#42 0x0000000000557537 in internal_condition_case (bfun=bfun@entry=0x4f6e20 
<command_loop_1>, 
    handlers=handlers@entry=18624, hfun=hfun@entry=0x4edf70 <cmd_error>) at 
eval.c:1348
#43 0x00000000004e95fc in command_loop_2 (ignore=ignore@entry=0) at 
keyboard.c:1139
#44 0x0000000000557413 in internal_catch (tag=tag@entry=44352, 
func=func@entry=0x4e95e0 <command_loop_2>, 
    arg=arg@entry=0) at eval.c:1108
#45 0x00000000004e95b9 in command_loop () at keyboard.c:1118
#46 0x00000000004edb5b in recursive_edit_1 () at keyboard.c:728
#47 0x00000000004edea8 in Frecursive_edit () at keyboard.c:799
#48 0x0000000000418447 in main (argc=2, argv=0x7fffffffdc58) at emacs.c:1626




(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x000000000042c4e2 in fill_image_glyph_string (s=s@entry=0x7fffffffaff0) at 
xdisp.c:24517
24517     s->img = IMAGE_FROM_ID (s->f, s->first_glyph->u.img_id);
(gdb) bt
#0  0x000000000042c4e2 in fill_image_glyph_string (s=s@entry=0x7fffffffaff0) at 
xdisp.c:24517
#1  0x00000000004562f4 in draw_glyphs (w=w@entry=0x1194470, x=<optimized out>, 
row=row@entry=0x2125e40, 
    area=area@entry=TEXT_AREA, start=<optimized out>, end=3, 
hl=DRAW_NORMAL_TEXT, overlaps=0)
    at xdisp.c:25149
#2  0x0000000000458d95 in expose_area (w=w@entry=0x1194470, 
row=row@entry=0x2125e40, 
    r=r@entry=0x7fffffffb3c0, area=area@entry=TEXT_AREA) at xdisp.c:30082
#3  0x0000000000458e91 in expose_line (w=w@entry=0x1194470, 
row=row@entry=0x2125e40, 
    r=r@entry=0x7fffffffb3c0) at xdisp.c:30107
#4  0x00000000004660f4 in expose_window (fr=0x7fffffffb430, w=0x1194470) at 
xdisp.c:30372
#5  expose_window_tree (w=0x1194470, r=r@entry=0x7fffffffb430) at xdisp.c:30446
#6  0x000000000046665a in expose_frame (f=f@entry=0x1193460, x=<optimized out>, 
y=<optimized out>, 
    w=<optimized out>, h=<optimized out>) at xdisp.c:30501
#7  0x00000000004c601c in handle_one_xevent (dpyinfo=dpyinfo@entry=0x173c900, 
    event=event@entry=0x7fffffffbaa0, finish=finish@entry=0xb42de0, 
hold_quit=0x7fffffffbd20)
    at xterm.c:7683
#8  0x00000000004c6e10 in event_handler_gdk (gxev=0x7fffffffbaa0, ev=<optimized 
out>, data=<optimized out>)
    at xterm.c:7294
#9  0x00007ffff6750511 in ?? () from /usr/lib/libgdk-3.so.0
#10 0x00007ffff67507d0 in ?? () from /usr/lib/libgdk-3.so.0
#11 0x00007ffff67239f9 in gdk_display_get_event () from /usr/lib/libgdk-3.so.0
#12 0x00007ffff6750592 in ?? () from /usr/lib/libgdk-3.so.0
#13 0x00007ffff50889fd in g_main_context_dispatch () from 
/usr/lib/libglib-2.0.so.0
#14 0x00007ffff5088ce0 in ?? () from /usr/lib/libglib-2.0.so.0
#15 0x00007ffff5088d8c in g_main_context_iteration () from 
/usr/lib/libglib-2.0.so.0
#16 0x00007ffff6bc80f5 in gtk_main_iteration () from /usr/lib/libgtk-3.so.0
#17 0x00000000004bcc92 in XTread_socket (terminal=<optimized out>, 
hold_quit=0x7fffffffbd20)
    at xterm.c:8647
#18 0x00000000004f00c9 in gobble_input () at keyboard.c:6906
#19 0x00000000004efae5 in handle_async_input () at keyboard.c:7158
#20 process_pending_signals () at keyboard.c:7172
#21 0x00000000004c9715 in unwind_create_frame (frame=19201397) at xfns.c:2842
#22 0x00000000004c9759 in unwind_create_tip_frame (frame=<optimized out>) at 
xfns.c:4997
#23 0x0000000000557b2e in unbind_to (count=<optimized out>, 
value=value@entry=0) at eval.c:3211
#24 0x0000000000557cf9 in unwind_to_catch (catch=catch@entry=0x140a040, 
value=value@entry=19849283)
    at eval.c:1157
#25 0x00000000005592ed in Fsignal (error_symbol=error_symbol@entry=18624, 
data=<optimized out>)
    at eval.c:1557
#26 0x00000000005595f9 in xsignal (error_symbol=error_symbol@entry=18624, 
data=<optimized out>)
    at eval.c:1581
#27 0x0000000000559c6d in signal_error (s=s@entry=0x5e3d1d "Undefined color", 
arg=19849315, 
    arg@entry=34016084) at eval.c:1636
#28 0x00000000004ccc57 in x_decode_color (f=<optimized out>, 
color_name=34016084, 
    mono_color=<optimized out>) at xfns.c:495
#29 0x00000000004ce96c in x_set_foreground_color (f=0x124fd70, arg=34016084, 
oldval=<optimized out>)
    at xfns.c:602
#30 0x0000000000426ff6 in x_set_frame_parameters (f=f@entry=0x124fd70, 
alist=alist@entry=140737488338931)
    at frame.c:3152
#31 0x0000000000429ac7 in x_default_parameter (f=f@entry=0x124fd70, 
alist=alist@entry=19856675, 
    prop=prop@entry=22320, deflt=34090788, xprop=xprop@entry=0x5db8ca 
"foreground", 
    xclass=xclass@entry=0x5e3f61 "Foreground", type=RES_TYPE_STRING) at 
frame.c:4374
#32 0x00000000004cd200 in x_create_tip_frame (dpyinfo=0x173c900, 
parms=19856675, parms@entry=19857043, 
    text=text@entry=34092084) at xfns.c:5181
#33 0x00000000004cd94d in Fx_show_tip (string=34092084, frame=18429029, 
parms=19857043, timeout=42, dx=22, 
    dy=82) at xfns.c:5540
#34 0x0000000000558efa in Ffuncall (nargs=7, args=args@entry=0x7fffffffc2a8) at 
eval.c:2739
#35 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, 
vector=10509325, 
    maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#36 0x00000000005589af in funcall_lambda (fun=10509197, nargs=nargs@entry=2, 
    arg_vector=arg_vector@entry=0x7fffffffc4b0) at eval.c:2951
#37 0x0000000000558d7b in Ffuncall (nargs=3, args=args@entry=0x7fffffffc4a8) at 
eval.c:2779
#38 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, 
vector=10511429, 
    maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#39 0x00000000005589af in funcall_lambda (fun=10511333, nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffc768) at eval.c:2951
#40 0x0000000000558d7b in Ffuncall (nargs=2, args=0x7fffffffc760) at eval.c:2779
#41 0x0000000000556f95 in run_hook_with_args (nargs=2, args=0x7fffffffc760, 
funcall=0x558ba0 <Ffuncall>)
    at eval.c:2529
#42 0x0000000000558e69 in Ffuncall (nargs=3, args=args@entry=0x7fffffffc758) at 
eval.c:2698
#43 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, 
vector=10508605, 
    maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#44 0x00000000005589af in funcall_lambda (fun=10508541, nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffca38) at eval.c:2951
#45 0x0000000000558d7b in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffca30) at eval.c:2779
#46 0x000000000055a1f3 in Fapply (nargs=2, args=0x7fffffffca30) at eval.c:2293
#47 0x0000000000558e69 in Ffuncall (nargs=3, args=args@entry=0x7fffffffca28) at 
eval.c:2698
#48 0x000000000058c273 in exec_byte_code (bytestr=<optimized out>, 
vector=10064605, 
    maxdepth=<optimized out>, args_template=args_template@entry=0, 
nargs=nargs@entry=0, 
    args=<optimized out>, args@entry=0x0) at bytecode.c:919
#49 0x00000000005589af in funcall_lambda (fun=10064525, nargs=nargs@entry=1, 
    arg_vector=arg_vector@entry=0x7fffffffcc28) at eval.c:2951
#50 0x0000000000558d7b in Ffuncall (nargs=nargs@entry=2, 
args=args@entry=0x7fffffffcc20) at eval.c:2779
#51 0x000000000055904a in call1 (fn=fn@entry=43776, arg1=arg1@entry=35546957) 
at eval.c:2573
#52 0x00000000004ee838 in timer_check_2 (idle_timers=<optimized out>, 
timers=<optimized out>)
    at keyboard.c:4536
#53 timer_check () at keyboard.c:4603
#54 0x00000000004eebe9 in readable_events (flags=flags@entry=1) at 
keyboard.c:3437
#55 0x00000000004f0218 in get_input_pending (flags=flags@entry=1) at 
keyboard.c:6821
#56 0x00000000004f2328 in detect_input_pending_run_timers 
(do_display=do_display@entry=true)
    at keyboard.c:9976
#57 0x000000000059719e in wait_reading_process_output 
(time_limit=time_limit@entry=30, 
    nsecs=<optimized out>, nsecs@entry=0, read_kbd=read_kbd@entry=-1, 
do_display=do_display@entry=true, 
    wait_for_cell=wait_for_cell@entry=0, wait_proc=wait_proc@entry=0x0, 
just_wait_proc=0) at process.c:5009
#58 0x00000000004221d2 in sit_for (timeout=<optimized out>, 
reading=reading@entry=true, 
    display_option=display_option@entry=1) at dispnew.c:5748
#59 0x00000000004f48a4 in read_char (commandflag=commandflag@entry=1, 
map=map@entry=35527283, 
    prev_event=0, used_mouse_menu=used_mouse_menu@entry=0x7fffffffd81b, 
end_time=end_time@entry=0x0)
    at keyboard.c:2784
#60 0x00000000004f542c in read_key_sequence 
(keybuf=keybuf@entry=0x7fffffffd8f0, prompt=prompt@entry=0, 
    dont_downcase_last=dont_downcase_last@entry=false, 
    can_return_switch_frame=can_return_switch_frame@entry=true, 
    fix_current_buffer=fix_current_buffer@entry=true, 
prevent_redisplay=prevent_redisplay@entry=false, 
    bufsize=30) at keyboard.c:9159
#61 0x00000000004f7051 in command_loop_1 () at keyboard.c:1407
#62 0x0000000000557537 in internal_condition_case (bfun=bfun@entry=0x4f6e20 
<command_loop_1>, 
    handlers=handlers@entry=18624, hfun=hfun@entry=0x4edf70 <cmd_error>) at 
eval.c:1348
#63 0x00000000004e95fc in command_loop_2 (ignore=ignore@entry=0) at 
keyboard.c:1139
#64 0x0000000000557413 in internal_catch (tag=tag@entry=44352, 
func=func@entry=0x4e95e0 <command_loop_2>, 
    arg=arg@entry=0) at eval.c:1108
#65 0x00000000004e95b9 in command_loop () at keyboard.c:1118
#66 0x00000000004edb5b in recursive_edit_1 () at keyboard.c:728
#67 0x00000000004edea8 in Frecursive_edit () at keyboard.c:799
#68 0x0000000000418447 in main (argc=2, argv=0x7fffffffdc58) at emacs.c:1626




(gdb) cont
Continuing.
Fatal error 11: Segmentation fault
Program received signal SIGSEGV, Segmentation fault.
0x000000000045e51e in note_mouse_highlight (f=f@entry=0x1193460, x=<optimized 
out>, y=19) at xdisp.c:29600
29600             struct image *img = IMAGE_FROM_ID (f, glyph->u.img_id);