bug#20802: Segfault when showing non-GTK+ tooltip

[Tobias Getzner]

On Di, 2015-06-16 at 19:31 +0200, martin rudalics wrote:
> Can you try whether my conjecture is true by putting a breakpoint on
> line 5192 and check whether the refcount gets set there for the 
> tooltip
> frame?  If it isn't, then could you experimentally try to move the
> 
>    image_cache_refcount =
>      FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
> #ifdef GLYPH_DEBUG
>    dpyinfo_refcount = dpyinfo->reference_count;
> #endif /* GLYPH_DEBUG */
> 
> block from line 5192 somewhere up in the code, first before line 
> 5172,
> later maybe a bit further up and check whether it helps?

I’m not a C guy, so bear with me if I fail to follow your instructions
in a sensible way. 

After setting a breakpoint at 5192, the segfault would trigger without
the breakpoint kicking in. I then moved that hunk up to line 5172 (diff
below). Now the breakpoint there would kick in, and further, now
segfault would trigger; instead, it gave the «error while displaying
tooltip message», and fell back on showing the tooltip message in the
echo area. Below is the state of  «image_cache_refcount» for a few
breaks. I fumbled a bit with the line history and only printed it for
some of the breaks.

Does this address your questions too, Eli, or do you want me to step
into «x_free_frame_resources» to make sure everything is solid?

Best,
TG


========================diff=============================
diff --git a/src/xfns.c b/src/xfns.c
index d066043..2c1c772 100644
--- a/src/xfns.c
+++ b/src/xfns.c
@@ -5169,6 +5169,12 @@ x_create_tip_frame (struct x_display_info *dpyinfo,
                       parms);
     }
 
+  image_cache_refcount =
+    FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
+#ifdef GLYPH_DEBUG
+  dpyinfo_refcount = dpyinfo->reference_count;
+#endif /* GLYPH_DEBUG */
+
   x_default_parameter (f, parms, Qinternal_border_width, make_number (1),
                       "internalBorderWidth", "internalBorderWidth",
                       RES_TYPE_NUMBER);
@@ -5189,12 +5195,6 @@ x_create_tip_frame (struct x_display_info *dpyinfo,
   x_default_parameter (f, parms, Qborder_color, build_string ("black"),
                       "borderColor", "BorderColor", RES_TYPE_STRING);
 
-  image_cache_refcount =
-    FRAME_IMAGE_CACHE (f) ? FRAME_IMAGE_CACHE (f)->refcount : 0;
-#ifdef GLYPH_DEBUG
-  dpyinfo_refcount = dpyinfo->reference_count;
-#endif /* GLYPH_DEBUG */
-
   /* Init faces before x_default_parameter is called for the
      scroll-bar-width parameter because otherwise we end up in
      init_iterator with a null face cache, which should not happen.  */

======================== gdb session ======================

Breakpoint 1, x_create_tip_frame (dpyinfo=0x1722e00, parms=35322131, 
parms@entry=35322003, text=text@entry=33649076) at xfns.c:5172
5172      image_cache_refcount =
(gdb) p image_cache_refcount
$1 = 0
(gdb) cont
Continuing.

Breakpoint 1, x_create_tip_frame (dpyinfo=0x1722e00, parms=35764115, 
parms@entry=35763987, text=text@entry=33650308) at xfns.c:5172
5172      image_cache_refcount =
(gdb) cont
Continuing.
    

Breakpoint 1, x_create_tip_frame (dpyinfo=0x1722e00, parms=35830499, 
parms@entry=35830371, text=text@entry=33651252) at xfns.c:5172
5172      image_cache_refcount =
(gdb) 
Continuing.

Breakpoint 1, x_create_tip_frame (dpyinfo=0x1722e00, parms=35987299, 
parms@entry=35987171, text=text@entry=33650548) at xfns.c:5172
5172      image_cache_refcount =
(gdb) p image_cache_refcount
$2 = 1
(gdb) cont
Continuing.

Breakpoint 1, x_create_tip_frame (dpyinfo=0x1722e00, parms=19632051, 
parms@entry=19622915, text=text@entry=34077380) at xfns.c:5172
5172      image_cache_refcount =
(gdb) cont
Continuing.

Breakpoint 1, x_create_tip_frame (dpyinfo=0x1722e00, parms=33536019, 
parms@entry=33536531, text=text@entry=34075236) at xfns.c:5172
5172      image_cache_refcount =
(gdb) cont
Continuing.
    
Breakpoint 1, x_create_tip_frame (dpyinfo=0x1722e00, parms=34033603, 
parms@entry=34033971, text=text@entry=34074788) at xfns.c:5172
5172      image_cache_refcount =
(gdb) p image_cache_refcount
$3 = 1
(gdb) clear
Deleted breakpoint 1 
(gdb) cont
Continuing.