bug#25247: 26.0.50; Concurrency crashes

[Tino Calancha]

1)
Save a file /tmp/test.el with contains:

(defun mytest ()
  (dotimes (n 10)
    (message "[%d] Sleeping ..." n)
    (sleep-for 0.5))
  (message "End!")
  (sleep-for 1)
  (message nil))

(defun run-test ()
  (dotimes (_ 50)
    (make-thread #'mytest))
  (message "Number of threads %d" (length (all-threads))))

;; (run-test)

2)
emacs -Q -l /tmp/test.el
;; Evaluate (run-test) in buffer *scratch*; keep using Emacs, for instance,
;; split the window, and visit other buffers, or call (run-test) again:
C-x 3
C-x C-b
C-o <down> RET
;; Sometimes Emacs crash or hangs.
;; I saw following messages in a few crashes:

[xcb] Unknown sequence number while processing queue
[xcb] Most likely this is a multi-threaded client and XInitThreads has not been 
called
[xcb] Aborting, sorry about that.
emacs: ../../src/xcb_io.c:259: poll_for_event: Assertion 
`!xcb_xlib_threads_sequence_lost' failed.

When i see previous message i get the backtrace `bt_xcb' (see below); without 
the
previus message i get a backtrace `bt_no_xcb'.

3) If you uncomment
;; (run-test)
in /tmp/test.el and call:
emacs -Q -l /tmp/test.el

;; Then Emacs crash 100% of the times.
Following is the standard output:

alloc.c:4893: Emacs fatal error: assertion failed: ((uintptr_t) start) % 
GC_POINTER_ALIGNMENT == 0
Fatal error 6: Aborted
lisp.h:1592: Emacs fatal error: assertion failed: 0 <= size

Following is the backtrace:

(gdb) bt
#0  raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:58
#1  0x000000000058f7da in terminate_due_to_signal (sig=6, 
backtrace_limit=2147483647) at emacs.c:396
#2  0x00000000006278aa in die (msg=0x75e0fb "0 <= size", file=0x75df80 
"lisp.h", line=1592) at alloc.c:7315
#3  0x000000000058a5ee in ASIZE (array=...) at lisp.h:1592
#4  0x000000000065fc8b in hash_lookup (h=0xe78690 <bss_sbrk_buffer+387248>, 
key=..., hash=0x0) at fns.c:4000
#5  0x0000000000505125 in code_convert_string (string=..., coding_system=..., 
dst_object=..., encodep=false, nocopy=false, norecord=true) at coding.c:9437
#6  0x00000000005053fd in code_convert_string_norecord (string=..., 
coding_system=..., encodep=false) at coding.c:9479
#7  0x0000000000505475 in decode_file_name (fname=...) at coding.c:9498
#8  0x00000000005e487e in Fexpand_file_name (name=..., default_directory=...) 
at fileio.c:1094
#9  0x00000000005e4462 in Fexpand_file_name (name=..., default_directory=...) 
at fileio.c:898
#10 0x00000000005f02d8 in Fdo_auto_save (no_message=..., current_only=...) at 
fileio.c:5645
#11 0x0000000000591f56 in shut_down_emacs (sig=6, stuff=...) at emacs.c:2072
#12 0x000000000058f781 in terminate_due_to_signal (sig=6, 
backtrace_limit=2147483647) at emacs.c:379
#13 0x00000000006278aa in die (msg=0x76d3a8 "((uintptr_t) start) % 
GC_POINTER_ALIGNMENT == 0", file=0x76cb30 "alloc.c", line=4893) at alloc.c:7315
#14 0x0000000000622c81 in mark_memory (start=0x7fffbda63b17, 
end=0x7fffbda63b17) at alloc.c:4893
#15 0x0000000000622cdb in mark_stack (bottom=0x7fffbda63b17 "", 
end=0x7fffbda63b17 "") at alloc.c:5058
#16 0x00000000006e02f1 in mark_one_thread (thread=0x161bd60 
<bss_sbrk_buffer+8396672>) at thread.c:558
#17 0x00000000006e0486 in mark_threads_callback (ignore=0x0) at thread.c:589
#18 0x0000000000622d23 in flush_stack_call_func (func=0x6e03f3 
<mark_threads_callback>, arg=0x0) at alloc.c:5137
#19 0x00000000006e04b8 in mark_threads () at thread.c:596
#20 0x00000000006249a8 in garbage_collect_1 (end=0x7fffffff1208) at alloc.c:5849
#21 0x000000000062508a in Fgarbage_collect () at alloc.c:6068
#22 0x000000000058c9d4 in maybe_gc () at lisp.h:4793
#23 0x000000000064d884 in Ffuncall (nargs=2, args=0x7fffffff1350) at eval.c:2739
#24 0x0000000000649c88 in internal_condition_case_n (bfun=0x64d78d <Ffuncall>, 
nargs=2, args=0x7fffffff1350, handlers=..., hfun=0x449ac4 <safe_eval_handler>) 
at eval.c:1416
#25 0x0000000000449d39 in safe__call (inhibit_quit=false, nargs=2, func=..., 
ap=0x7fffffff1418) at xdisp.c:2567
#26 0x0000000000449e2c in safe_call (nargs=2, func=...) at xdisp.c:2583
#27 0x0000000000449e66 in safe_call1 (fn=..., arg=...) at xdisp.c:2594
#28 0x00000000005b11a8 in map_keymap_canonical (map=..., fun=0x4b30a1 
<single_menu_item>, args=..., data=0x7fffffff15c0) at keymap.c:639
#29 0x00000000004b2f24 in single_keymap_panes (keymap=..., pane_name=..., 
prefix=..., maxdepth=7) at menu.c:294
#30 0x00000000004b372d in single_menu_item (key=..., item=..., dummy=..., 
skp_v=0x7fffffff18b0) at menu.c:433
#31 0x00000000005b0b43 in map_keymap_item (fun=0x4b30a1 <single_menu_item>, 
args=..., key=..., val=..., data=0x7fffffff18b0) at keymap.c:546
#32 0x00000000005b0e3c in map_keymap_internal (map=..., fun=0x4b30a1 
<single_menu_item>, args=..., data=0x7fffffff18b0) at keymap.c:583
#33 0x00000000005b11c4 in map_keymap_canonical (map=..., fun=0x4b30a1 
<single_menu_item>, args=..., data=0x7fffffff18b0) at keymap.c:641
#34 0x00000000004b2f24 in single_keymap_panes (keymap=..., pane_name=..., 
prefix=..., maxdepth=8) at menu.c:294
#35 0x00000000004b372d in single_menu_item (key=..., item=..., dummy=..., 
skp_v=0x7fffffff1ba0) at menu.c:433
#36 0x00000000005b0b43 in map_keymap_item (fun=0x4b30a1 <single_menu_item>, 
args=..., key=..., val=..., data=0x7fffffff1ba0) at keymap.c:546
#37 0x00000000005b0e3c in map_keymap_internal (map=..., fun=0x4b30a1 
<single_menu_item>, args=..., data=0x7fffffff1ba0) at keymap.c:583
#38 0x00000000005b11c4 in map_keymap_canonical (map=..., fun=0x4b30a1 
<single_menu_item>, args=..., data=0x7fffffff1ba0) at keymap.c:641
#39 0x00000000004b2f24 in single_keymap_panes (keymap=..., pane_name=..., 
prefix=..., maxdepth=9) at menu.c:294
#40 0x00000000004b372d in single_menu_item (key=..., item=..., dummy=..., 
skp_v=0x7fffffff1e90) at menu.c:433
#41 0x00000000005b0b43 in map_keymap_item (fun=0x4b30a1 <single_menu_item>, 
args=..., key=..., val=..., data=0x7fffffff1e90) at keymap.c:546
#42 0x00000000005b0e3c in map_keymap_internal (map=..., fun=0x4b30a1 
<single_menu_item>, args=..., data=0x7fffffff1e90) at keymap.c:583
#43 0x00000000005b11c4 in map_keymap_canonical (map=..., fun=0x4b30a1 
<single_menu_item>, args=..., data=0x7fffffff1e90) at keymap.c:641
#44 0x00000000004b2f24 in single_keymap_panes (keymap=..., pane_name=..., 
prefix=..., maxdepth=10) at menu.c:294
#45 0x00000000004b3ed6 in parse_single_submenu (item_key=..., item_name=..., 
maps=...) at menu.c:562
#46 0x00000000004b7312 in set_frame_menubar (f=0x145ac30 
<bss_sbrk_buffer+6557264>, first_time=false, deep_p=true) at xmenu.c:787
#47 0x000000000046947f in update_menu_bar (f=0x145ac30 
<bss_sbrk_buffer+6557264>, save_match_data=false, hooks_run=true) at 
xdisp.c:12011
#48 0x0000000000469042 in prepare_menu_bars () at xdisp.c:11901
#49 0x000000000046bd89 in redisplay_internal () at xdisp.c:13661
#50 0x000000000046a88b in redisplay () at xdisp.c:13268
#51 0x00000000005980ef in read_char (commandflag=1, map=..., prev_event=..., 
used_mouse_menu=0x7fffffffe0bf, end_time=0x0) at keyboard.c:2485
#52 0x00000000005a916a in read_key_sequence (keybuf=0x7fffffffe250, bufsize=30, 
prompt=..., dont_downcase_last=false, can_return_switch_frame=true, 
fix_current_buffer=true, prevent_redisplay=false) at keyboard.c:9139
#53 0x0000000000594aff in command_loop_1 () at keyboard.c:1373
#54 0x0000000000649a60 in internal_condition_case (bfun=0x5946b3 
<command_loop_1>, handlers=..., hfun=0x593cf6 <cmd_error>) at eval.c:1336
#55 0x00000000005942ce in command_loop_2 (ignore=...) at keyboard.c:1115
#56 0x0000000000648f69 in internal_catch (tag=..., func=0x5942a1 
<command_loop_2>, arg=...) at eval.c:1101
#57 0x000000000059426c in command_loop () at keyboard.c:1094
#58 0x00000000005937e0 in recursive_edit_1 () at keyboard.c:700
#59 0x00000000005939d5 in Frecursive_edit () at keyboard.c:771
#60 0x000000000059153c in main (argc=5, argv=0x7fffffffe728) at emacs.c:1691

*) Following is the backtrace `bt_xcb'

(gdb) bt
#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:58
#1  0x00007fffefa9940a in __GI_abort () at abort.c:89
#2  0x00007fffefa90e47 in __assert_fail_base (fmt=<optimized out>, 
assertion=assertion@entry=0x7ffff493fc00 "!xcb_xlib_threads_sequence_lost", 
file=file@entry=0x7ffff493fa6b "../../src/xcb_io.c", line=line@entry=259, 
function=function@entry=0x7ffff493fea8 "poll_for_event") at assert.c:92
#3  0x00007fffefa90ef2 in __GI___assert_fail (assertion=0x7ffff493fc00 
"!xcb_xlib_threads_sequence_lost", file=0x7ffff493fa6b "../../src/xcb_io.c", 
line=259, function=0x7ffff493fea8 "poll_for_event") at assert.c:101
#4  0x00007ffff48cd77a in ?? () from /usr/lib/x86_64-linux-gnu/libX11.so.6
#5  0x00007ffff48cd82b in ?? () from /usr/lib/x86_64-linux-gnu/libX11.so.6
#6  0x00007ffff48cdb1d in _XEventsQueued () from 
/usr/lib/x86_64-linux-gnu/libX11.so.6
#7  0x00007ffff48af58a in XFlush () from /usr/lib/x86_64-linux-gnu/libX11.so.6
#8  0x0000000000541ff2 in x_flush (f=0x145ac30 <bss_sbrk_buffer+6557264>) at 
xterm.c:257
#9  0x0000000000543111 in x_flip_and_flush (f=0x145ac30 
<bss_sbrk_buffer+6557264>) at xterm.c:1217
#10 0x000000000058e269 in flush_frame (f=0x145ac30 <bss_sbrk_buffer+6557264>) 
at frame.h:1481
#11 0x0000000000467d3a in echo_area_display (update_frame_p=true) at 
xdisp.c:11435
#12 0x0000000000464e43 in message3_nolog (m=...) at xdisp.c:10413
#13 0x0000000000464af1 in message3 (m=...) at xdisp.c:10342
#14 0x000000000063e868 in Fmessage (nargs=2, args=0x7fff3b015360) at 
editfns.c:3767
#15 0x000000000064c009 in eval_sub (form=...) at eval.c:2204
#16 0x0000000000646be7 in Fprogn (body=...) at eval.c:450
#17 0x0000000000648b79 in Fwhile (args=...) at eval.c:992
#18 0x000000000064bdf7 in eval_sub (form=...) at eval.c:2186
#19 0x0000000000646be7 in Fprogn (body=...) at eval.c:450
#20 0x0000000000648a5b in Flet (args=...) at eval.c:973
#21 0x000000000064bdf7 in eval_sub (form=...) at eval.c:2186
#22 0x0000000000646be7 in Fprogn (body=...) at eval.c:450
#23 0x000000000064ea54 in funcall_lambda (fun=..., nargs=0, arg_vector=0x0) at 
eval.c:3028
#24 0x000000000064dab1 in Ffuncall (nargs=1, args=0x14f4c50 
<bss_sbrk_buffer+7188080>) at eval.c:2771
#25 0x00000000006e057f in invoke_thread_function () at thread.c:634
#26 0x0000000000649a60 in internal_condition_case (bfun=0x6e0557 
<invoke_thread_function>, handlers=..., hfun=0x6e059e <do_nothing>) at 
eval.c:1336
#27 0x00000000006e06cb in run_thread (state=0x14f4c30 
<bss_sbrk_buffer+7188048>) at thread.c:668
#28 0x00007ffff0455464 in start_thread (arg=0x7fff3b016700) at 
pthread_create.c:333
#29 0x00007fffefb4d9df in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:105

*) Following is the backtrace `bt_no_xcb':

(gdb) bt
#0  raise (sig=6) at ../sysdeps/unix/sysv/linux/raise.c:58
#1  0x000000000058f7da in terminate_due_to_signal (sig=6, backtrace_limit=40) 
at emacs.c:396
#2  0x00000000005bddd9 in emacs_abort () at sysdep.c:2364
#3  0x00000000005a3903 in unblock_input_to (level=-1) at keyboard.c:7170
#4  0x00000000005a391a in unblock_input () at keyboard.c:7186
#5  0x00000000006ef5b0 in xftfont_text_extents (font=0x1466e40 
<bss_sbrk_buffer+6606944>, code=0x7fffd37a676c, nglyphs=1, metrics=0xd8b088 
<metrics>) at xftfont.c:568
#6  0x0000000000499c33 in get_per_char_metric (font=0x1466e40 
<bss_sbrk_buffer+6606944>, char2b=0x7fffd37a6810) at xdisp.c:25141
#7  0x00000000004a2db3 in x_produce_glyphs (it=0x7fffd37a7df0) at xdisp.c:27160
#8  0x0000000000489b2d in display_line (it=0x7fffd37a7df0) at xdisp.c:20798
#9  0x000000000047b092 in try_window (window=..., pos=..., flags=1) at 
xdisp.c:17376
#10 0x0000000000477577 in redisplay_window (window=..., just_this_one_p=false) 
at xdisp.c:16813
#11 0x000000000046e560 in redisplay_window_0 (window=...) at xdisp.c:14554
#12 0x0000000000649b0e in internal_condition_case_1 (bfun=0x46e51e 
<redisplay_window_0>, arg=..., handlers=..., hfun=0x46e4e6 
<redisplay_window_error>) at eval.c:1360
#13 0x000000000046e4bb in redisplay_windows (window=...) at xdisp.c:14534
#14 0x000000000046e46d in redisplay_windows (window=...) at xdisp.c:14528
#15 0x000000000046cf51 in redisplay_internal () at xdisp.c:14023
#16 0x000000000046dbb6 in redisplay_preserve_echo_area (from_where=2) at 
xdisp.c:14353
#17 0x000000000042857b in Fredisplay (force=...) at dispnew.c:5792
#18 0x000000000064de3d in funcall_subr (subr=0x9d0580 <Sredisplay>, numargs=0, 
args=0x7fffd37ad008) at eval.c:2832
#19 0x000000000064d977 in Ffuncall (nargs=1, args=0x7fffd37ad000) at eval.c:2757
#20 0x000000000069ed31 in exec_byte_code (bytestr=..., vector=..., 
maxdepth=..., args_template=..., nargs=1, args=0x7fffd37ad708) at bytecode.c:726
#21 0x000000000064e5ca in funcall_lambda (fun=..., nargs=1, 
arg_vector=0x7fffd37ad700) at eval.c:2957
#22 0x000000000064e1e7 in apply_lambda (fun=..., args=..., count=1) at 
eval.c:2894
#23 0x000000000064c3cd in eval_sub (form=...) at eval.c:2278
#24 0x0000000000646be7 in Fprogn (body=...) at eval.c:450
#25 0x000000000064ea54 in funcall_lambda (fun=..., nargs=0, arg_vector=0x0) at 
eval.c:3028
#26 0x000000000064dab1 in Ffuncall (nargs=1, args=0x15c2eb8 
<bss_sbrk_buffer+8032472>) at eval.c:2771
#27 0x00000000006e057f in invoke_thread_function () at thread.c:634
#28 0x0000000000649a60 in internal_condition_case (bfun=0x6e0557 
<invoke_thread_function>, handlers=..., hfun=0x6e059e <do_nothing>) at 
eval.c:1336
#29 0x00000000006e06cb in run_thread (state=0x15c2e98 
<bss_sbrk_buffer+8032440>) at thread.c:668
#30 0x00007ffff0455464 in start_thread (arg=0x7fffd37ae700) at 
pthread_create.c:333
#31 0x00007fffefb4d9df in clone () at 
../sysdeps/unix/sysv/linux/x86_64/clone.S:105
(gdb) 

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
In GNU Emacs 26.0.50.1 (x86_64-pc-linux-gnu, GTK+ Version 3.22.5)
 of 2016-12-22 built on calancha-pc
Repository revision: 3ec1503374d3115651c130eaeee31181266d0863
Windowing system distributor 'The X.Org Foundation', version 11.0.11900000
System Description:     Debian GNU/Linux testing (stretch)

Configured using:
 'configure --enable-checking=yes,glyphs --enable-check-lisp-object-type
 'CFLAGS=-O0 -g3''

Configured features:
XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GCONF GSETTINGS
NOTIFY ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS GTK3 X11 LIBSYSTEMD